Kids, Would You Please Start Fighting - <AUTHOR> https://www.nytimes.com/2017/11/04/opinion/sunday/kids-would-you-please-start-fighting.html <comment><AUTHOR> The article quotes studies claiming that people who grow up with conflict in their personal lives are more likely to be comfortable with differing opinions and certain forms of creative debate.

Since there's seemingly some benefit of exposure to these kinds of negative experiences, they mention advice on how to mitigate the negative aspect of conflict.

But I think it's actually great advice to teach children/students these civil, but pseudo-adversarial skills as general purpose cooperative reasoning tools completely independent of conflict-management. From the article:

• Frame it as a debate, rather than a conflict.

• Argue as if you're right but listen as if you're wrong.

• Make the most respectful interpretation of the other person's perspective.

• Acknowledge where you agree with your critics and what you've learned from them.

These behaviors correlate very strongly with the people I personally have found most intelligent and productive in group settings.

<comment><USER2> This is fantastic advise for effective debate.

I would add:

* agree on the meaning of the words you use.

* be upfront about how willing you are to be wrong / change your mind (I phrase this as "what would have to be true for you to accept I am right" and vice versa for my beliefs).

<comment><AUTHOR> I really like the part about agreeing on words, and I'd riff on a bit more with two sub-patterns i've found useful

1) "I see when you say X you mean [specific definition]. Given that definition I agree with you, but I disagree with the definition"

2) "When I say X it seems it means [specific definition] to you. Rather than fight over the definition I will avoid saying X and use different terms so we can keep moving"

<comment><USER3> This is a really problem with some specific topics like copyright, where the terms were invented for propaganda.

We really need a better word than "piracy".

</comment></comment></comment></comment><comment><USER4> I agree with the message. I think that it is our civic duty to ensure that debates are possible. Because when a society transcends into Fascism, the first thing that is lost is the right to disagree. If it becomes impossible to question the prevailing dogma and everyone who attempts to do so is labelled a traitor or worse, then the path to totalitarianism is open.

People should remember the Iraq war and especially the build-up to it. Debates were silenced by the rallying call to "Support our troops!" You couldn't claim that the war was a pointless hunt for oil engineered by the oil companies. Because that implied that the "war moms," those who let their sons enlist and fight the stupid war in Iraq, were doing something wrong. Telling it how it was, that whoever travels half-way cross the world to participate in a war against a people they should have no beef with, is committing state-sanctioned murder, was not allowed. I know that is polarizing, but polarizing is whatever a lot of people disagree with. It doesn't mean that it is factually incorrect.

So the next time the US rallies the dogs of war, remember Iraq and what made that war possible. Because it will happen again. When Trump, or his successor, decides that "something has to be done" about North Korea, Iran or Syria, do break the decorum. Don't allow disagreement to become taboo because then history will repeat itself.

<comment><USER5> Traditionally, once the decision is made to go to war, all debate about the justifications for the war must end.

Countries where the debate continues end up having a social split where part of the nation supports the war, and part does not. This kind of civil division is _fatal_ during war time if your enemy isn't similarly hobbled.

Any war, even the most worthy, is susceptible to having its justifications criticized but the consequences of not being unified during the conflict are so catastrophic that people prefer to criticise wars only after they have been won or lost.

<comment><USER6> That's certainly true about total war where the nation's survival is threatened by defeat, but it's not true about the kind of limited wars was have seen since world war 2. In fact, because these wars are limited wars for the world powers that start them, but total wars for the postcolonial states in the receiving end, I think it's very correct that the public e.g. in the US continue to aggressively question the rationale for war even after it's begun in e.g. Vietnam, Iraq, and so on.

Henry Kissinger would certainly have been happier to see a US public united behind the Vietnam war effort because it would have made it easier to win in a geopolitical sense, but what about in a moral sense? The US wasn't threatened existentially by failure in Vietnam, and it's right that we didn't adopt the attitude expressed in your comment.

<comment><USER3> On that note, the US spends almost as much in defense as _the entire rest of the world_.

Losing a "war" in the middle East would not affect the US very much outside reputation.

<comment><USER7> I would respectively suggest that most countries in the rest of the world don't behave in such a was as to require this level of excessive spending on "defence". As you state, if you are conducting defensive operations, how can it be that failure of that defence will not impact your country.

</comment></comment></comment></comment></comment><comment><USER8> I showed 'Crockers Rules', after Lee Daniel Crocker, to my mum and my sister over Christmas, as I thought it might help all of us indicate the level of acerbic comment we are currently able to process.

"Declaring yourself to be operating by "Crocker's Rules" means that other people are allowed to optimize their messages for information, not for being nice to you. Crocker's Rules means that you have accepted full responsibility for the operation of your own mind - if you're offended, it's your fault. Anyone is allowed to call you a moron and claim to be doing you a favor. (Which, in point of fact, they would be. One of the big problems with this culture is that everyone's afraid to tell you you're wrong, or they think they have to dance around it.) Two people using Crocker's Rules should be able to communicate all relevant information in the minimum amount of time, without paraphrasing or social formatting. Obviously, don't declare yourself to be operating by Crocker's Rules unless you have that kind of mental discipline.

Note that Crocker's Rules does not mean you can insult people; it means that other people don't have to worry about whether they are insulting you. Crocker's Rules are a discipline, not a privilege. Furthermore, taking advantage of Crocker's Rules does not imply reciprocity. How could it? Crocker's Rules are something you do for yourself, to maximize information received - not something you grit your teeth over and do as a favor."

<comment><USER9> How silicon valley.. maximize efficiency at the expense of all culture and social norms!

No need for complex social relations, I will process information, more than ever before (because there is so much of it now!), like the great logical- positivist that I am!

Moreover, I certainly do not have any political positions embedded in my norms-steamrolling worldview, because all there is, in fact, is information.

<comment><AUTHOR> This seems like an uncharitable read. The whole point of Crocker Rules is that you opt in. No one forces you to accept Crocker Rules (that would indeed be steamrolling). You declare "feel free to say things that might insult me", not "I'm going to assume you don't mind being insulted".

Personally, I've found this to be a very useful tool with people who are conflict-avoidant. I tell them "if you're afraid of offending me, please don't hesitate, I promise I won't get mad".

Sometimes I go as far as to suggest something they might be thinking that might be offensive in order to get the ball rolling and show them there won't be negative consequences.

For example: "Hey I wonder if you're concerned I'll be offended if you propose throwing out my work and replacing it. Don't worry, it's fine. I just want what's best for the project, so if you're holding back because you're concerned I'll be upset, you can relax."

<comment><USER9> \- You are are participant in society, so your preferences indeed affect other people

\- the example of the project at work is benign, especially since the outcome doesn't matter to you. What happens then the issues are about personal skin- in-the-game, like someone coming after your means of living, gentrification of your neighborhood, attacking the behavior of your significant other, etc..

<comment><AUTHOR> I think we must be interpreting the meaning of Crocker Rules differently.

You say the example I gave is benign — so is it fair to assume you believe that this behavior is useful in at least some cases?

You're right that I have the "luxury" to do so in that situation because the outcome isn't particularly painful.

And you're also right that it would be difficult to opt in to Crocker Rules when discussing something with huge stakes and emotional charge. But that's why it's opt-in ... no one should try to force you to accept it, and you can choose to accept it depending on context.

I would probably not volunteer for Crocker Rules with someone proposing something that would grievously harm my family.

(and just to be clear: I never actually use the term, I always use in-context statements like the one in the example).

<comment><USER9> I can certainly appreciate the desire to not overreact to every little thing, and try to discuss things calmly, yes

<comment><USER8> I come from somewhere where the opposite of that is the dominant culture, so I was explaining Crocker's rules as a method of us pointing out to each other when we are not capable of operating by them, rather than when we are. I had a bad head cold and was trying to work out a diplomatic method to get them to chill out a little. It half worked, some of the time.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Or, perhaps restore training in the Scientific Method.

A root of the growing divide between Left and Right is that neither party realizes how easily falsified their claims are.

Scientists realize that they are wrong almost always, and that when they are right, their hypothesis is usually very narrowly defined.

If people were trained to realize that they were almost always wrong by the time they reached 6th grade, you'd see a lot more openness to debate, and far fewer entrenched positions - and much more liberty allowed by/to everyone, I think.

Presently, kids exit grade school pretty much believing that they are pretty much "right" in everything they believe. This is tragically false, and a foundation for a lifetime of deep disappointment.

</comment><comment><USER11> I don't know if NYT's assessment of the study is accurate (the study is paywalled), but here's the key paragraph for people trying to decide if this or the study is worth reading:

>> _It turns out that highly creative adults often grow up in families full of tension. Not fistfights or personal insults, but real disagreements. When adults in their early 30s were asked to write imaginative stories, the most creative ones came from those whose parents had the most conflict a quarter- century earlier. Their parents had clashing views on how to raise children. They had different values and attitudes and interests. And when highly creative architects and scientists were compared with their technically skilled but less original peers, the innovators often had more friction in their families. As the psychologist Robert Albert put it, "the creative person-to-be comes from a family that is anything but harmonious, one with a 'wobble.' "_

Referenced study: [http://www.sciencedirect.com/science/article/pii/S0092656698...](http://www.sciencedirect.com/science/article/pii/S0092656698922401)

There's another study linked, but the rest is anecdata built on famous people that, personally, wasn't too illuminating on a skim. It might be interesting to read for the narrative.

<comment><USER12> Sci-hub has it. Non-paywalled: [http://doi.org.https.sci- hub.hk/10.1006/jrpe.1998.2240](http://doi.org.https.sci- hub.hk/10.1006/jrpe.1998.2240)

</comment></comment><comment><USER13> I wonder how technology could be used to enhance debate. What if each side of an argument had a fixed percentage of talk time, enforced by software? Would people ratchet down their arguments and stop interrupting each other? Would they conserve their time so they can get a lengthy last word? What if you actually LOST time when you interrupted the other side?

<comment><USER14> You might enjoy poking around some of the links here [https://wiki.lesswrong.com/wiki/Debate_tools](https://wiki.lesswrong.com/wiki/Debate_tools)

</comment></comment><comment><USER15> I would emphasize one background assumption, viz., the importance of the respect for and appreciation of truth. Otherwise, we slip into sophistry where we are less interested in truth and more interested in deploying words as weapons and instruments of power.

</comment><comment><USER16> The media always focuses on the negative: if kids were really fighting more and being more aggressive, the titles wouldn't be "Kids are more corageous than their parents were". They would be more like "Did we create a violent world for our kids?"

It's been proven that humans focus more on the negatives than the positives, so the media takes advantage of that with these type of headlines.

</comment><comment><USER17> I wouldn't encourage children to fight but when children are accompanied by adults at all times and have _all_ their conflicts mediated for them, it almost certainly stunts their social skills. Similarly, banning all physical contact in primary schools is a poor way to encourage emotional health... for any mammal.

[http://www.bbc.com/future/story/20131014-the-touching- moment...](http://www.bbc.com/future/story/20131014-the-touching-moments-we- all-need)

[https://stpauls.vxcommunity.com/Issue/Us-Experiment-On- Infan...](https://stpauls.vxcommunity.com/Issue/Us-Experiment-On-Infants- Withholding-Affection/13213)

</comment><comment><USER18> Sam Harris impresses me in his podcasts when he has guests he disagrees with that the disagreements can become intense, but when they reach the end, he's back to friendly and cordial.

It's often hard to disagree on content without anger or other personal emotions, but his doing it inspires me to improve my skill at it.

<comment><USER19> Good example - I was also going to mention Sam Harris. Another thing he does is state his guest's position in his own words, and then ask the guest if he got the position correct. It's a good way to start a discussion and avoids the occurrence of two people arguing about a caricature of each person's position, instead of their _actual_ position.

</comment></comment><comment><USER20> I really don't want to say this in an uncivil way but can people please stop spamming Hacker News with these articles full of cherry-picked scientific studies from New York Times or can their posts be automatically weighted less if their goal is to promote articles from NYT?

It's really frustrating having to spend a couple of minutes to read seemingly interesting articles only to find out a few minutes later it's probably someone writing for his own gain (well... popular media).

The first scientific journal article that is linked to appears to use the word "parental" to refer to the relationship between a child and her/his parents instead of, and as suggested in the article, between parents (see "parental warmth" and "parental restrictiveness" in the abstract of the journal article). The second scientific journal article that is linked to is used to argue that "architects and scientists were compared with their technically skilled but less original peers"—but the article that is linked to only mentions architects (apologies, but not actually too sorry, if it's actually because of the pay wall and that the authors did not mention scientist in the abstract).

This is probably considered an emotional, and potentially uncivil, response. But it's really, really frustrating. Just because some guy has a PhD doesn't mean what they write is credible when they quote scientific journals—I know plenty of people who have PhDs but what they say are far from credible.

I mean, is it even at all surprising that people who are subjected to an environment with more conflicting views (both good and bad) of any kind are probably less likely to comply and think more?

EDIT: expansion of why I think the interpretation of the first article I mentioned is wrong and cherry-picked. Added emotional sentiment at the end.

<comment><USER21> I agree.

I've submitted a Ask HN: ban nytimes lately - and got banned. Ive also sent an email to moderator asking for a feature that allows the ban of domains per user.

Note that I've actually enjoyed this post, but anyway, if someone wants to read nytimes, he knows where to find it.

EDIT: what's my opinion precisely you may ask? I think those are not hacker news per the guidelines. They are often general - good - but not really surprising. Therefore they are kinda platitude.

EDIT2: currently, there is 2 newyorker.com, 2 nytimes.com, 2 economist.com on the front page. And it's like that every day lately.

<comment><USER22> Probably a better practice than commenting here about is:

1\. Flag articles you don't want here.

2\. Don't participate in discussion of those articles, not even to talk about how you don't want them here.

3\. Submit, upvote and comment on things you do want here.

I used to self post my own writing fairly regularly. I mostly have stopped. I don't feel it really goes well even though I posted stuff for a time in part because some people said they wanted to hear from me. I am still trying to figure out what exactly to write about these days, having recently abandoned a bunch of projects.

And I am saying that to try to make the point that what people say they want or don't want in comments seems to have a poor signal to noise ratio. I haven't personally found it to be a reliable indicator of what works on HN.

A much stronger indicator of interest or lack thereof boils down to "voting with your feet" as a means to indicate what isn't wanted here and "voting with your wallet (attention)" as to what is wanted here.

Give attention to things you want here. Starve other things of attention. Even if it doesn't have a notable impact on what appears on the front page, it will positively impact your experience of the site

<comment><USER23>
      Flag articles you don't want here.

This is how unexplained flagging (there are no categories to explain _why_ a reader is flagging) becomes a problem. People then flag articles that they simply disagree with, as opposed to using flags only to signal inappropriateness (spam, language, duplication, self-promotion, etc.).

For example, Craigslist used to have different flags for different reasons, e.g. Prohibited by policey, Spam, Illegal Content, Wrong Category, Sex for Money, etc. Now it's a unary, generic flag only.

<comment><USER22> HN has a counter measure: vouching. So if something gets flagged, people who think it doesn't deserve to be can counterweight it with a vouch.

I am old and cranky and at a point where I would rather see more of that than more off topic pissing and moaning about what one or two individuals would like to see or not see here. It's lots of sound and noise, but no real action. I am suggesting they take action because my experience suggests that's both more effective and more satisfying.

But, then, in some sense, I am being a hypocrite. I probably should have just flagged and downvoted their off topic, annoying comments rather than trying to make suggestions.

So, whatever.

<comment><USER21> _I probably should have just flagged and downvoted their off topic_

You did the right thing.

</comment></comment></comment></comment></comment></comment><comment><USER24> A bit off-topic, but...

How come when I click and drag on text on this article, instead of highlighting it, it goes to the next article?(!) What kind of UX is that?

</comment><comment><USER25> This is sort of why me and my wife pick fights with our kids where we can. We stress them to the point of snapping, then cool them down. It feels a little like bullying, but we cut back and emphasize that we still love them.

My 5 year old daughter in particular inherits the stubbornness of both her parents. She often she says something she regrets immediately (e.g "I hate you!"), cries on realizing it, but refuses to take it back.

We teach them that disagreements are perfectly normal. Differences in opinion should be embraced. And while you disagree with someone, you don't take it personally and dislike the person.

Shows like My Little Pony are excellent at this. While these shows have a villain and plot, the drama and conflict in most of the episodes revolve around growing up and dealing with stark personality differences. Friends will argue a lot, but the shows highlight that this doesn't end a friendship. And even someone who was 'evil' can turn over a new leaf.

She had a rough first week of school. Was picked on by a classmate, admitted she spent much of the day crying. But she goes home, opens up My Little Pony for inspiration. Then she's excited to go to school again. A couple of weeks later, she has solved the conflict with her classmate.

<comment><USER20> This is from someone on the receiving end and is probably slightly older than your kids—I think it's great that you are teaching your kids how to deal with conflicts and making them think, but I'm not sure that stressing them to the point of snapping is a good thing.

My dad did that to me and he still does it occasionally even when I'm "in the right"; I think he probably means well (he claims that he does when I confront him about it), but it's still an awful feeling that doesn't make me thankful of what he does or like him more. If you really do make your kids feel like that you are bullying them, maybe you should consider cutting it back a little.

<comment><USER25> Haha, my eldest child is 5. We kind of stress our kids since they're young enough to communicate. They don't enjoy it in the moment, but bear no grudge.

We try to be very careful with damage control. We honestly talk it out. My daughter is good with labeling her feelings. She would say things like "Mom loves to pick on me for no reason, but I know she's just kidding," or "I was really angry with you this morning, because you glued the wallpaper without me, but I'm not angry anymore."

And when they do get angry, we talk it out, what they're pissed about, say sorry, and how to fix it.

I think it's sort of like exercise. We take care to not go past the 'injury' point, but sometimes it happens and we try to avoid it next time.

<comment><USER26> I do not pick on my kids without reason and they are able to express they are angry about wallpaper too. There are plenty on naturally occurring points of difference and topics, there is no need for me to go out of way to stress them out to the point of breaking.

I teach them that if some kids do that to them, it is their right to defend themselves or retaliate (otherwise they would end up submissive victims of bullying, have seen that when I was child multiple times). I also teach then that if someone do it to others, it is their right to defend that other person too from bullying.</comment></comment></comment></comment>


Leg exercise is critical to brain and nervous system health - <AUTHOR> https://blog.frontiersin.org/2018/06/07/neuroscience-leg-exercise-brain-nervous-system-health/ <comment><USER2> This is pretty stupid.

"Leg exercise is critical to brain and nervous system health" is the title but what they actually did is hang a mouse by it's tail for a month.

I guess doing strange things to rodents and measuring the outcomes is useful, but going so far as to turn it into health advice for humans is absurd.

<comment><USER3> Are you referencing the actual study? The article states, "The study involved restricting mice from using their hind legs, but not their front legs, over a period of 28 days."

<comment><USER2> Yes. They achieve those restrictions by holding up the mouse by the tail so only the front legs are on the floor of the cage.

<comment><USER4> Which makes the whole study bullshit because what they actually measured was effects of stress not of the lack of leg exercise

<comment><USER5> They also didn't control for other muscles so who's to say that it is specific to leg exercise, or even, sedentary life, living life at a 45 degree incline, too much blood flowing to the brain, or any other factor.

</comment></comment></comment></comment></comment><comment><USER6> I'm all for barbell squats and deadlifts, but I have to point out that there's a difference between saying "leg exercise is critical to brain and nervous system health" and "mice restricted from using their hind legs exhibit lower numbers of neural stem cells".

<comment><USER7> You're not wrong; the full write up (and the researcher's quote in particular) makes a much more nuanced statement than the title does. I do wonder if these conclusions are ill-founded, though. Otherwise wouldn't people who lose a limb or use thereof suffer from extreme neurodegeneration?

</comment></comment><comment><USER8> My non scientific opinion is that the way they made the mice not be able to use their rear limbs (suspension of the mice by the tail attached to fixure on ceiling of cage) might have only shown measureable stress levels via blood sample in 6 percent of mice studied but that had to have some other psychological impact on all the mice - if we did that to humans at least we could tell human subjects what was going to happen, I am not arguing that mice have the same cognitive abilities as humans.

</comment><comment><USER5> Not one instance of the word "leg" in the paper.

They were basically lifted off the ground with only their front legs touching the ground.

How does one go from load bearing exercise to just leg exercise?

There's no evidence in the paper to suggest that legs have some special quality over other load bearing muscles.

Bad journalism.

</comment><comment><USER9> If anyone found this article interesting I'm sure they'll find this podcast also very interesting:

[https://shruggedcollective.com/3-things-you-dont-know- about-...](https://shruggedcollective.com/3-things-you-dont-know-about- muscle/)

</comment><comment><USER10> I've read that our lymphatic system needs muscle movement to properly circulate. Is it possible that leg movement has a positive lymphatic response? Could it be that better lymphatic systems == better nervous system health?

</comment><comment><USER11> blatantly p hacking</comment>


Monarch butterfly populations are declining - <AUTHOR> http://monarchwatch.org <comment><AUTHOR> national geographic photographer joelsartore with a short video about the monarchs and #pollinatormonday during "pollinator week", starting june 19th.

> > [https://www.instagram.com/p/BVQSmx7j6l_/](https://www.instagram.com/p/BVQSmx7j6l_/)</comment>


DrChrono - Record Patient Data - On KillerStartups - <AUTHOR> http://www.killerstartups.com/Web-App-Tools/drchrono-com-record-patient-data

<comment><USER2> It'll be interesting to see how DrChrono and other smaller companies break into the electronic healthcare record (EHR) market and compete with the larger medical IT companies. I work as a consultant for a public medical IT company so I've seen first hand just how much work it takes for a hospital to upgrade their software. Besides a strong product and sales team, there's a ton of training and support that is required for a hospital to successfully convert to a new system.

It looks like DrChrono's target market is smaller physicians offices, which I'm not as familiar with (I consult with larger hospital systems). If DrChrono can successfully demonstrate how their software can eliminate errors, improve efficiency, and save doctor's offices money in the long run, then they will have a good chance, but there are a number of things they need to execute correctly in order to succeed.

Training and support are VERY important for a successful switch to new software. Physicians and nurses are typically older and not as technically savvy as the people who develop and sell the software. They do not like change because they are used to their workflow with their paper-based systems, and I've seen firsthand projects that took a turn for the worse because the hospital executives decided to make the switch to new software and the physicians and nurses did not like the change to their current workflow.

DrChrono also needs to be flexible enough to cater to the different workflows and reporting needs of each physicians office. This is definitely not a "One software fits all" market. What may be a perfect fit for one physician may not meet the needs of another office.

Summary: This is a tough market to be successful in because of so many factors, but that doesn't mean that it can't be done.

<comment><USER3> It's happening in our hospital now as we have just implemented computerized physician order entry (literally just last week was the start date).

I don't think it's fair to blame the physicians and nurses - sometimes it is the hospital and its IT staff and the software being used. The machines we are equipped we are REALLY slow, the servers are slow, and there are not enough machines available. That makes it a real pain to enter orders now. There has to be some ability to "freelance" an order in the system and there really isn't. I understand why, the order should be standardized so the system automatically recognizes what the medication is, what the dosing is, whether it may interact with other meds, etc. But that's time consuming for the medical provider - unless it's executed exceptionally well.

<comment><USER2> I didn't mean to sound like the blame is solely on the physicians and nurses. The consultants make mistakes too. Sometimes the software is not perfect. Sometimes there's miscommunication. Sometimes the scope of the project gets way out of hand.

My main point was that due to the size of these projects, there are so many things that need to happen for a successful switchover.

</comment></comment></comment><comment><USER3> I see many physicians using an iPad in the hospital to access the hospitals EMR system in a very cumbersome way - they log into the hospitals servers, so they are then in a Windows setting, then log into the desktop version of the hospitals EMR system (HMS in this case) using their iPad. Implementation in the office setting, if it's done, is pretty similar.

Hopefully companies like DrChrono can change this by designing an EMR system that is really made to work on a tablet. The existing companies, including AllScripts, just let you use the desktop version on an iPad, which kind of sucks.

</comment><comment><USER4> "You might be surprised to know that one out of five doctors in private practices uses an iPad already"

That's a vague statement, are they using them at work, or do doctors simply have a propensity for neat personal technology?

<comment><USER5> I would suspect it is more of the latter right now, but as apps come out for the iPad, I think it's definitely going to be an asset for doctors, especially in the inpatient setting where doctors need their technology to travel with them.

I don't see iPads being very successful in an outpatient or ambulatory setting, mainly because most exam rooms are already equipped with desktops, and limited functionality may be more of a hindrance.</comment></comment>


Ask HN: Hiring away your best contact at a potential major customer? - <AUTHOR>

I'm in a weird, but good spot.  What would HN do?
I'm heading up an angel-funded B2B startup.  We've got a landing page up and have gotten some press, but we're mostly in build mode and focused on working quietly with a few customers to tailor the system to their uses.  So, it's very early stage.
There's a customer we'd love to land that would be a great fit and a big win for us.  However, our contact there, one of their two decision makers on outside vendors, is also a longtime colleague of mine and has expressed interest in joining up, "going back into startup mode" (his first company was sold in a smallish but fairly quick exit a few years ago to the big customer in question), and heading up our sales and biz-dev.
Can I possibly land him AND his company's business?  If so, how?
Context: I haven't worked together with him on anything, but he's been advising and encouraging me since news of my angel round broke.  Shortly afterward he invited me over to his place to review candidates for our first engineering hire and to break down how our business model and pricing would work, based on his own experience in the industry.  Those conversations were incredibly useful as he shared actual numbers and helped me understand some nuances in how this industry evaluates vendors that I hadn't seen before.  These conversations were also when he asked if we might have an opening for him and talked about how he's had a good run at BigCo. and would like to join up a cool startup and do that again.
That was 3 months ago.  Based on his advice, I scrapped all the candidates for the engineering position, started over, and found someone light years better than the previous candidates.  We're building away and have a few early customers.
Meanwhile, we've met with him twice, but in a more professional capacity than I think he might have expected to show off the app and get his feedback on it.
And meanwhile, every week or so, he sense me clippings on news that we might want to keep track of, new entrants into our weird little field, new products launching.
It's been months since I talked to him one-on-one. Since then, I've brought in a co-founder and a few other people.  The co-founder wants to bring him on board, but is very adamant that there's a particular way we have to play this and wants to regulate all future contact we have with the guy.
Meanwhile, he keeps sending me clippings.  I'm not sure how to respond.  I'd love to tell him flat out, "we want your business, but we want you even more.  Is there a way we can get both?"  But that seems like it could get people in trouble.
I feel like Steve Jobs would be able to pull this off.  Get his guy, and get a fat contract with his company.  Not sure how, though.
How would you play this? <comment><USER2> If he is a good fit and would add value to your company, hire him. Presumably he would still have the necessary contacts at his original company to help you get in the door, and it sounds like he could probably introduce you to other decision-makers in the industry.

If you wait until after he has signed his current company up for a contract, you are going to create a perception problem, regardless of the reality of the situation. It simply looks like a setup to the majority of people who won't be privy to the entire context of the hire.

</comment><comment><USER3> Yes, you can do it. Hiring insiders is tried-and-true way to get business.

Like so many other things in life, it's all in the execution. Can this guy leave his current company and keep his reputation there intact? Can he also get you business other places?

<comment><AUTHOR> I know it's done. I've just never had to think about it before. On the one hand, it sounds unethical for him to lead us into a contract, then leave and come work for us. On the other, our product is awesome and will solve a key business problem for them. It's a no-brainer for him to midwife a deal between us and his company.

I feel kind of weird even bringing it up to him. Maybe I just need to sack up.

<comment><USER4> He's already approached you, it's not like you've gone out hunting him. It also sounds like he might have a better idea of how to handle the situation than you do. Talk to him about it?</comment></comment></comment>


Ask HN: What's the best way to apply for jobs privately? - <AUTHOR> You don't want a current employer to think you're about to jump ship. What do you do? <comment><USER2> Make a habit of meeting people in the morning for coffee. So if you come in a little late, it's normal.

Attend evening meet-ups and industry events, happy hours-- great for networking with insiders.

Finally, keep ALL communication / surfing on your personal device.

</comment><comment><USER3> Find a good recruiter.

Make a practice of taking the occasional personal day / mental health day even when happily employed and not looking.

<comment><AUTHOR> how do you find a good recruiter?

i'm usually not a big fan of recruiters. they spam everyone, and are reminiscent of con artists.

<comment><USER3> Yeah, there are a lot of bad ones out there. The best way I know is through networking. Chances are that someone in your network has worked with a good recruiter; or worked with someone they liked who was incidentally hired through a recruiter.

If you're sifting through recruiter spam, pay attention to which ones are talking about opportunities that are relevant to you and why. I keep an email folder just for messages from recruiters - it helps me keep a pulse on what people are looking for. And if I do start looking it becomes a) a well of potential recruiters to work with, and b) a training set for my own neural network (aka brain) to work out how the best and worst are communicating.

Let's take a look at this month's spam so far. I'm a full stack developer slash engineering manager in NYC with almost 20 years of experience in web development mostly in PHP and Python. The recruiter who just sent me a mid- level front-end opening is toast. So is the one who sent me a senior opening on .Net. And the one who sent an opening in Cincinnati. And the one who asked me to send HIM names of good candidates for his opening.

The one who sent me an opening similar to what I'm doing now, but with a 50% pay raise might get an email back if I happen to be looking. So might the one who sent me a VPE opening. Both personalized their messages to reflect specific details of my profile - which means they actually read it and didn't just mail merge me into a spray-and-pray mailing. And they're not just trying to fill an opening with a body who matches qualifications but also putting consideration into how the candidate might want to _advance_ in their own careers.

After speaking further with them, I may or may not end up working with either. I already have a recruiter I like who found my current position, and working with more than one recruiter at a time if you're already working full time gets to be exhausting. (Heck, juggling 3 or 4 when you're between jobs can be a full time job if they've got robust pipelines.)

Good luck!

</comment></comment></comment><comment><USER4> Go to some social/private/kids event at school for half a day and dress up in a suit. Wear it back to the office. Perceptive people/managers will start to worry. Works every time.

<comment><USER5> Isn't this answering the opposite question of what the OP asked? He does _not_ want his managers to know he's pursuing another job.

Then again, maybe Poe's law applies.

</comment></comment><comment><USER6> Take a day off and let them think. And why you want to jump ship? Have you tried to express the issues and renegotiate?

<comment><USER7> So, now no one can ever take a day off, lest their manager think that they are interviewing somewhere else?

<comment><USER8> What's wrong with you? (Because of this and the other reply) The suggestions are pretty standard and could be for a myriad of reasons other than seeking a new employer. Besides, how do you think it works for most people when they switch jobs?

</comment></comment></comment><comment><USER9> Take a "sick" day.

<comment><USER10> This really doesn't work, I've taken a few "sick" days but to be honest, we are that quiet sometimes that nobody even notices if I'm not there</comment></comment>


Show HN: Nanr – Monetize Your Content with 1 Click Nano Donations - <AUTHOR> https://nanr.io <comment><USER2> I feel like I came across something similar on HN a while back. Not sure of the name (or it could just be this).

<comment><USER3> Maybe you mean quid.works.

[https://news.ycombinator.com/item?id=19038110](https://news.ycombinator.com/item?id=19038110)</comment></comment>


KDE 4.7 released - <AUTHOR> http://www.kde.org/announcements/4.7/

<comment><USER2> It looks very very nice, but I find its features to be almost... useless. I feel like the desktop is trying to grab the spotlight, instead of focusing on the applications.

For example, how many people _really_ do use desktop widgets on a PC? I'm willing to bet you that the majority of users spend most of their time in a web browser and some kind of a text editor (IDE/Office/...). IMHO the KDE project is going in a wrong direction by putting so much emphasis on the desktop. Just let me quickly start my favourite applications, then go away, until I call you back. I think that Ubuntu's Unity is much more closer to this goal.

PS: last time I tried KDE was with Kubuntu 11.04. I just played around adding and removing widgets, until I dragged the clock from the bottom bar to the desktop. Then I had an incredible frustrating experience when it took me almost half an hour to figure out _how to add the clock back on the bottom bar_. It just kept going under it.

PPS: The second issue was a show stopper: it didn't remember the settings for my dual-monitor setup. The only fix I could find was to edit configuration files... I mean, be serious, it's 2011, not 1999. So I returned to Ubuntu with Unity, which worked just fine.

</comment><comment><AUTHOR> Each time a new Ubuntu version is released, I try out KDE - but always end up going back to Gnome for productivity reasons.

The fact that KDE is bloated because of all the semantic desktop stuff doesnt help a bit. Since KDE has switched to its SC (software compilation) based nomenclature, I would happily _pay_ for a KDE-light S.C. with NO MySQL, nepomuk, strigi, akonadi, konqueror and just a bare desktop with Chrome and LibreOffice (saying I can disable it doesnt count )

Since, I'm unable to use Unity in any significant way, I'm looking for a way to use KDE.

And I hope they make a much better default theme than what they have - everything said and done, Gnome looks much much more polished.

<comment><USER3> Why is saying you can disable it doesn't count?

OSX comes with Spotlight, but first thing I do is install Quicksilver. I don't expect someone to ship an OSX-light without Spotlight.

(I use KDE with all those things disabled on my desktop, OSX on my MBP.)

</comment></comment><comment><USER4> Just went back to XFCE4 after a month or so on KDE4.4 on Debian. I go back to KDE every now and then, when I feel the need for desktop effects and pretty transparency and stuff like that. This time, I really tried to customize my desktop to be as productive as possible, and I almost succeeded. The windows mozaic display from all desktop a-la-mac when the mouse reaches the top left corner was useful to switch from firefox to konsole. I really like gwenview, yakuake and konqueror for file browsing carry useful features.

On the other hand, I couldn't get my networking to work properly. Whether it's network-manager or the kde frontend that's clunky, I don't know, but it made it impossible to switch from a network to another without rebooting the machine.

It also took me DAYS to find how to deactivate this really annoying desktop switch when the mouse reaches the side of the screen. At some point, I was being very careful not to drag my mouse to the side. Terrible user experience.

KDE is full of options, everywhere, but in the end I felt like most of them are useless. The lack of separation between "basic" parameters and "super geek advanced that even the developers don't touch" ends up in big control panel with plenty of options, and you don't even know where to start looking. So you start Googling, which is usually not a good sign.

Being back to XFCE4 is indeed a relief. Like working out after months of junk food.

<comment><USER5> There's a know issue with kde network applet and it's been known for some time, kde team is working on fixing it. Meanwhile use gnome-network-manager instead -- remove applet, install gnome-network-manager though apt, then create a symlink to it rhough ~/.kde/Autostart

</comment></comment><comment><USER6> Does anyone have experience with the KDE 4 version of KMail and whether its GMail integration is any good? IIRC, 4.6 was the first version of KDE4 to include the new KDEpim suite, so this would be their first major update to the new KDEpim.

<comment><USER7> I would assume that such an email client would have half-decent IMAP support. Besides copying your contacts from gmail, this should do everything you require.

<comment><USER8> _Besides copying your contacts from gmail, this should do everything you require._

The problem is that you don't want a copy, you want a _maintained copy_. You want your data synchronized.

Outlook does this very neatly with Exchange, which is why it rules the enterprise. Android does this very neatly with your Gmail/Google account. The iPhone also does this to some extent (at least against Exchange contacts).

Once you get used to the idea that there is only one set of data, going back to working on different sets, different copies of what should be the same data feels very, very wrong.

You can say what you like, but a copy alone will not do "everything you require" for most people these days.

<comment><USER7> IMAP handles the email synchronisation(1), the only problem is the contact synchronisation. Contacts don't change that much though, so occasional, manual copies to your devices is possible. It is strange that there isn't a good solution like IMAP for this.

1\. <http://mail.google.com/support/bin/answer.py?answer=75725>

<comment><USER9> With Gmail, my contacts change all the time. That is, every time a new person emails me, and I email them back.

<comment><USER10> I used to have the same issue. Thankfully Thunderbird, which I switched to, has a bidirectional contact sync plugin for google contacts.

FWIW the last time I tried KMail with GMail, there were some issues with how the folder-to-tag mapping worked. This ended up with me needing to untag a lot of stuff manually in my GMail. But since this was over a year and a half back, I wont really go by this. Things could well be better now

</comment></comment></comment></comment></comment></comment><comment><USER11> Having a read to the announcements worths it. Want to test digikam2 and git integration among others.

Waiting for Kubuntu version. I still use Debian in another computer but I know Kubuntu one will come first.

</comment><comment><USER12> I'm not a Linux guy, but I'm curious. And I prefer "vanilla" experience when I'm trying a new toy. Which Linux distribution should I use if I want to test a KDE as clean as possible?

<comment><USER13> Slackware Linux currently features a vanilla KDE 4.5.5. Tastes differ so you might like others (like Kubuntu and OpenSuse), too.

<comment><USER14> * Slackware patches KDE to remove the PAM dependency.

* The Slackware devs do not much fancy the new HAL replacements.

* KDE apparently changed the compilation infrastructure such that everything comes as a lot of little packages, which makes maintenance harder for them. Without somebody to step up, Alien Bob has even implied that KDE might get dropped from the official package list.

</comment></comment></comment><comment><USER15> Cool, but I'm gonna stick to XFCE4. Don't like the aero in KDE..

<comment><USER6> If that's your only complaint, the desktop effects can be easily disabled.

<comment><USER16> Yes, desktop effects can be easily disabled, or modified which one to be enabled, System Settings -> Desktop Effects.

And, the default theme 'Air' can be easily changed too, System Settings -> Workspace Appearance.

Screenshot for both: [http://freedupthoughts.files.wordpress.com/2011/02/kde- syste...](http://freedupthoughts.files.wordpress.com/2011/02/kde-system- settings.png)

It's sad to see users choosing desktop environments based on factors like looks, not features/functionality/etc...</comment></comment></comment>


White House open-sourcing the code for Facebook Messenger bot - <AUTHOR> https://www.whitehouse.gov/blog/2016/10/13/removing-barriers-constituent-conversations <comment><USER2> idk but using drupal to create messenger bot is like using Wordpress to make neural network.</comment>


Web Extension equivalents to legacy Firefox add-ons - <AUTHOR> https://docs.google.com/spreadsheets/d/1TFcEXMcKrwoIAECIVyBU0GPoSmRqZ7A0VBvqeKYVSww/edit?usp=sharing <comment><USER2> I was skeptical, but one month in, I have to admit the speed and stability gains are worth the lost addons. Fortunately for me, I only had to give up very small conveniences.

I did lose a few hours over XMarks' inability to sync Firefox search keywords correctly anymore (it's not solved, but you can input the keywords yourself on all your machines and they won't be erased) but that's it.

<comment><USER3> I was skeptical, and one month in, I still sort of hate it, but there isn't really anywhere else to go.

Firefox 1.0 arguably had better UI, or at least the option to _make_ it better.

Also, I remember running it on a 32MB machine. Today, with only this single HN tab open, memory consumption is reported at somewhere above half a gigabyte.

<comment><USER2> This pains me too. It's hard to believe that all the new "browser technology" is responsible for this bloat.

On the other hand, I will trade memory use for many things. One thing that is infuriating to me is that despite the memory hog, a single tab can still crash the whole browser. All the memory use doesn't even buy you failure isolation.

</comment></comment></comment><comment><USER4> Originally via: [https://www.reddit.com/r/firefox/comments/6i1fu2/webext_equi...](https://www.reddit.com/r/firefox/comments/6i1fu2/webext_equivalents_to_legacy_addons/)

</comment><comment><USER5> The main thing I miss is "It's All Text!", which the creator / maintainer indicated was impossible to port away from Legacy, in no small part due to the security aspects of it.

I really, truly, hate inputting anything more than a couple of lines in to websites. Worse when you're fighting WYSIWYG editors, fixed box widths. Even worse than that is when you spend 20 minutes filling in the box, hit submit and find your session timed out.

"It's All Text" allowed me to just click an "edit" button beside the text box, go edit the thing in my favourite text editor, hit save and then go click submit in the browser. If the site screwed up somehow, the text was still open in my text editor.

<comment><USER6> It's not precisely impossible to port, but it's a lot more complicated; in practice it requires a separate platform-specific executable, registered with the browser, to marshal between the browser and the editor.

I miss it, too. But not enough to reimplement it, at least not yet.

<comment><USER7> I was a heavy It's All Text! user, too, and fortunately, an alternative exists, implemented just as you describe. See: [https://github.com/jlebon/textern](https://github.com/jlebon/textern)

</comment></comment></comment><comment><USER8> I just want to be able to scroll through open tabs. I don't know why they'd disable this when even chrome has it.

<comment><USER9> It interferes with the tab overflow scrolling, which Chrome doesn't have.

So, in Firefox, if you open enough tabs, it will eventually overflow them and then you can scroll the tab list either with those little scroll buttons to the left and right or with the scrollwheel.

<comment><USER8> That makes sense but I'd have expected a configurable option from Firefox.

</comment></comment></comment><comment><USER10> A much more helpful title would be "Webext equivalents to legacy Firefox add- ons" instead of "Firefox Stuff".

<comment><USER11> Thanks! We've updated the title from "Firefox Stuff".</comment></comment>


Sir Ken Robinson on public speaking (6 presentation tips) - <AUTHOR> http://www.presentationzen.com/presentationzen/2008/02/sir-ken-robinso.html

<comment><USER2> Overall a good list. People on news.yc probably don't need #5 -- we probably rehearse too little. The rest are spot on, but you need practice to get good at them. Once again I'll plug Toastmasters.</comment>


HTML5 Boilerplate v0.9.5 Released - <AUTHOR> https://groups.google.com/group/html5boilerplate/msg/722b7f3f4aec2a67 <comment><USER2> I started working on markup for a new site this week and put HTML5 Boilerplate into real use for the first time. It has been a very helpful, time-saving starting point. I'll definitely be incorporating most of it into my "new site" template.

</comment><comment><USER3> HTML5 Boilerplate is a really impressive attempt to consolidate all best practices into one template. The comments alone are one of the best sources of documentation for front-end development.

Now the choice is selectively building up your own template for projects, or starting with HTML5 Boilerplate and just keeping parts that are needed. My strategy has been to start with the boilerplate since lots of commonly forgotten "small" details are included by default.

</comment><comment><USER4> Wow - the site freezes my Chromium (nightly) tab for it. Never had that happen before for websites - only plugin-related issues. Guess that is what you get for using spankin' new features!

</comment><comment><USER5> Can someone explain to me why their site - <http://html5boilerplate.com/> \- uses the <b> and <i> tag?

<comment><USER6> I created the design, and it is a deliberate use of those tags to create graphical elements which you can see in the background. It should be diagonal in browsers that support CSS transforms, and vertical in browsers that dont.

<http://html5doctor.com/i-b-em-strong-element/>

<comment><USER5> I figured there was a great reason, I just didn't know how to begin finding that answer short of asking the experts.

</comment></comment></comment><comment><USER7> Related link for the Haml/Sass ones among us: <http://github.com/himmel/html5-boilerplate>

And also for the Compass users: <http://github.com/sporkd/compass- html5-boilerplate>

Great resources, though be aware they're still not up to date with todays release. Well worth it in any case.

</comment><comment><USER8> We just launched our new website which uses HTML5 Boilerplate (and HAML and SASS, and Rail 3 but that's neither here nor there): <http://cubus.ro>. Any feedback is welcome and much appreciated, including usage of HTML5 elements.

</comment><comment><USER9> The CSS file is a thing of horrifying beauty. I don't know whether to hail it as my savior or try to drive a stake through it.

</comment><comment><USER10> What the hell is this?

I think we should seriously think this web thing over.</comment>


Sshmuxd: SSH proxy to replace jump hosts - <AUTHOR> https://github.com/joushou/sshmuxd <comment><USER2> Jumpboxes aren't that bad to automate, actually.

We already help with automating jumpbox creation. (docs: [https://userify.com/docs/tips/jumpbox/](https://userify.com/docs/tips/jumpbox/)) and we're building even more jumpbox automation now. Don't allow root for any jumpbox accounts, but of course root escalation exploits abound. (I just found another in an AWS agent yesterday.)

Of course, as another commenter mentioned, if your jumpbox is compromised, than the jumpbox could serve as a gateway to your network. It's a tradeoff between exposing all of your servers to inbound SSH or only one.

There's another way, which is pure TCP forwarding on a different port for each server (ie 21321 -> inner server 22), but whether this actually reduces the attack surface is debatable, since the totality of open ports remains the same across the entire network.

My personal feeling is that using a jumpbox and locking it down (preferably to your company's IP ranges, etc) is the best way to go. You can also add MFA to the jumpbox entry point itself. We're going to help with automating all of that in the near future, too.

(disclaimer: CTO @Userify)

<comment><USER3> Hi CTO for Userify person!

One thing is setup of jump hosts (basic version just being a box with sshd enabled + users with authorized_keys, which is beyond simple), but it's the limitation of hosts. I have 1 big network where a set of users are only allowed to jump to 1 or more unique host each, with myself and a few others being able to jump to every single one. I believe that your solution requires things to be on different subnets to isolate them, with separate jump hosts for each subnet, correct? Here, I only need one sshmux for everyone.

Another "fun" feature is that sshmux can also throw unknown users to a separate host, such as ssh-chat, for support or hanging out.

Actually, in case of -oProxyCommand="ssh -W %h:%p jump_host", you're still fully secure in the case that the jump host (sorry for not calling it a jumpbox) is compromised. This is true both for normal SSH servers and for sshmux. They can mess with the original raw ssh connection that requests the forward, but this will just screw the connection up. They can connect it to a wrong host, but that will provide incorrect host keys. The agent isn't forwarded, so they don't get to sign anything with the private key. Messing with the new connection that gets established is subject to SSH's normal MITM resistance. This means that even root on the jump host would require real SSH protocol vulnerabilities to attack the connection.

Good luck with Userify!

<comment><USER2> That's cool. Another way is to localtunnel to TCP forward to endhost in your config (ie two SSH connections, the first to the jump host, the second through the jump host, without agent forwarding), but that gets tedious fast without scripting support, especially if you want to use different portnums to avoid conflicts. ControlMaster would be a good choice to multiplex multiple connections to the same box.

> I believe that your solution requires things to be on different subnets to > isolate them, with separate jump hosts for each subnet, correct? Here, I > only need one sshmux for everyone.

Right, we're automating the .ssh/authorized_keys (and sudoers) right now ([https://github.com/userify/shim/blob/master/shim.py](https://github.com/userify/shim/blob/master/shim.py)), so you can set it up however you like, as long as those boxes can get to either Userify for key updates, or your on-premises Userify server(s). Only one jumpbox is needed across any network, depending on how you prefer to lockdown your network. (The HOWTO refers to EC2, but it can be built anywhere, exactly the same way.)

sshmux looks like an interesting project, and love the simplicity. Wonder if Userify might automate the ProxyCommand setup! Seems really useful.

> Good luck with Userify!

Thanks! We have 350 companies on the platform right now and growing fast, and Userify Enterprise (on-premise) is in beta at several large enterprises as well.

BTW, joushou, we're looking for brilliant SSH and golang hackers.. ping me if you get bored :)

<comment><USER3> > sshmux looks like an interesting project, and love the simplicity. Wonder if > Userify might automate the ProxyCommand setup! Seems really useful.

Yeah, ProxyCommand is a bit cumbersome for many setups, which is why the agent forwarding mode has the interactive selection screen...

If you feel like poking at sshmux or think there's anything that would be helpful if added, don't hesitate to add it to the issue tracker. Real-life use-cases get higher priority.

> Thanks! We have 350 companies on the platform right now and growing fast, > and Userify Enterprise (on-premise) is in beta at several large enterprises > as well.

That's great! I guess getting Userify Enterprise out of beta is a bit thing on the roadmap.

> BTW, joushou, we're looking for brilliant SSH and golang hackers.. ping me > if you get bored :)

It sounds very interesting (I like Go and SSH, what can possibly go wrong?!), and I am indeed occasionally bored, but I'm ~8000km away... Commuting from Sweden to Denmark is bad enough! ;)

</comment></comment></comment></comment><comment><USER4> > sshmux, and by extension, sshmuxd, can only forward normal sessions (ssh'ing > directly to sshmuxd without a ProxyCommand) if agent forwarding is enabled.

This is very dangerous.

With the average setup, anyone with root access on the middle box can borrow the ssh key of any user connecting through it.

See [http://unixwiz.net/techtips/ssh-agent- forwarding.html#sec](http://unixwiz.net/techtips/ssh-agent- forwarding.html#sec) for more info.

<comment><USER5> Considering this seems intended for use in somewhat corporate situations, it may or may not be that serious of a problem.

This is yet another situation where Kerberos got it right years and years ago, but is almost impossible to actually /use/ even now after n years.

<comment><USER3> Exactly. And yes, Kerberos got it somewhat right, but as someone who have used configured and used it, it is quite the exercise to set up. It took ages to get working, and even then, it was slightly cumbersome to use.

<comment><USER6> _" It took ages to get working, and even then, it was slightly cumbersome to use."_

I've wondered from time to time why Kerberos more or less faded into obscurity. I guess we have the answer then.

</comment></comment></comment></comment><comment><USER7> I don't really understand what this is supposed to be useful for. Relying on a random software to secure your ssh entry point, instead of a proper linux configuration, that seems like a risky tradeoff.

<comment><USER3> I'm the author of the project.

The project is meant to ensure that you can allow multiple users access through a jump-host style mechanism, while not permitting any other "abuse" of the jump host. You can lock down SSH a lot, but not as much as sshmux does. Security wise, the code is very, very simple and easy to follow, and even if it went rogue, that's no different than the trust you put in your usual SSH server. If this is a concern, do not use the agent forwarding mode, which would render a rogue server a pointless and unfruitful prank.

If you use the ProxyCommand mode, the only thing an "evil" sshmux would be able to do would be to break the connection. It won't be able to fake the endpoint if it is already in your known_hosts, as it does not have the real endpoints private host key. It is, therefore, secure in this mode.

</comment></comment><comment><USER8> Increasingly I am using sshuttle[0] to solve this problem. When you have lots of machines, ProxyCommand'ing always feels like such a burden.

[0] [https://github.com/apenwarr/sshuttle](https://github.com/apenwarr/sshuttle)

<comment><USER3> When I use SSH as VPN, it's usually because I want less flexible applications to use it, using socks5 configured as a system-level proxy. When doing more work on our corporate network, I usually SSH through the jump to my desktop and work from there, unless I specifically need to access another machine for something.

As for sshuttle, it's a very convenient device, although the design appears rather complicated. I'll look into it.

<comment><USER9> The design is possibly the simplest for what it does (and it does that exceedingly well).

sshuttle is:

\- a tcp multiplexer (multiple connections onto one stream)

\- a router (uses firewall rules to make normal connections go through the multiplexer)

\- a few kludgy tunneling operations, to make the combination above seem like a real VPN (discovery of remote subnets, tunneling of DNS requests, ....)

\- a default setup that runs the multiplexed stream through an ssh connection, thereby giving all the security guarantees that ssh provides (integrity, confidentiality, mitm resistance)

\- packaged in such a way that the remote side needs to have a minimal python>2.6 install, and a user capable of making tcp connections. Nothing more.

In my experience, it works way better than IPSEC tunnels and some commercial VPNs that I've used. With two caveats that I'm ok with with: a) only TCP, and b) all connections seem to come from your remote ssh server. No VPN solution that I'm aware of makes so few demands; do you know of one that doesn't require root at the remote server?

<comment><USER3> ssh -D (socks5 mode) doesn't require root, and can forward both udp and tcp traffic, doing what it appears that the client requires. socks5 is just a protocol that tells the server to connect to X on port Y using protocol Z, or to bind to X on port Y using protocol Z. Root is only required if you want to bind to privileged ports. A bonus with this is that it only requires a SSH server in default configuration.

SOCKS5 most common usage is to just use it as a proxy for HTTP traffic or similar, but it can make any connection. The trick lies in the "kludgy tunnelling operations" and the "router" (firewall rules).It's this magic that makes it better than the socks5 proxy solution, as it really does appear like a VPN. I wonder how much effort it would be to get rid of some of the "magic", though.

But I have to agree, that _ANYTHING_ is better than a real VPN in complexity.

<comment><USER9> > ssh -D (socks5 mode) doesn't require root, and can forward both udp and tcp > traffic

No, but it requires a SOCKS5 client, of which there aren't many among software I use.

> The trick lies in the "kludgy tunnelling operations" and the "router" > (firewall rules)

The other important part of the magic is the packaging. While ssh+socks support is pretty common these days, it is not supported on e.g. dropbear (which is popular on routers).

sshuttle copies whatever it needs to the other side; as a result, there's never an issue of version compatibility (which socks use sidesteps by virtue of using an old, cemented protocol). I have, in fact, needed to modify sshuttle with new options and features for a project, and I was not bound in any way by the existing protocol - whatever changes I made were always supported by the other end of the connection because the connection starts by copying them to the remote.

> I wonder how much effort it would be to get rid of some of the "magic", > though.

sshuttle is very well written; It is easy to tear it apart and rebuild it in other ways. But if you took the magic apart, you'd be left with a non-standard UDP-deficient SOCKS-alike system. Why would you want that?

<comment><USER3> If you tied the local FW magic to a socks5 client, you'd be able to skip part of the magic, assuming you don't desperately need mDNS. SOCKS5 does UDP too, IIRC. I like tearing things apart, and I like making clean muggler solutions, rather than relying on wizardry. :)

With that said, I might still end up using sshuttle as it is. It's a nice project. I just crave for tinkering around. :D

</comment></comment></comment></comment></comment></comment><comment><USER10> Why not simply configure your ssh correctly?

<comment><USER11> Jump hosts exist for a purpose.

<comment><USER10> Yes, and there is a way to configure your client to use one.

<comment><USER3> sshmux is a jump host that allows more user-control than you can with a ssh server. Unless you use the interactive mode with agent forward, you still need to configure your client to use one.

I'm not sure I get what you're on about, to be honest. :/

</comment></comment></comment></comment><comment><USER12> Does this support SFTP? What about for windows users that use FileZilla and don't have an .ssh/config?

<comment><USER3> SFTP/SCP works if you use the ProxyCommand, or agent forwarding. Clients such as WinSCP support agent forwarding, at least. Not sure about FileZilla. I'm not a Windows user, so can't say. :/

<comment><USER12> I know FileZilla also supports agent forwarding, but I'm not entirely sure how this would work in practise. If I'm understanding things right you can have a single jumphost and give a user access to multiple targets. So when the user connects to the jumphost using SFTP then what files/directories do they see?

Maybe I should just install and try this for myself...

<comment><USER3> Interactive selection for agent-forwarding only works for regular SSH, not sftp, due to having no way to enter input.

If I get around to it, one could wrap sftp completely, so that the available servers simply show up as root-level directories.

EDIT: Opened an issue about it.

<comment><USER12> > If I get around to it, one could wrap sftp completely, so that the available > servers simply show up as root-level directories.

That wound be amazing! I'll see if I can check if ProxyCommand is doable with FileZilla later as well.

</comment></comment></comment></comment></comment><comment><USER13> [https://blog.habets.se/2014/06/Another-way-to-protect- your-S...](https://blog.habets.se/2014/06/Another-way-to-protect-your-SSH- keys)

Seems like the same thing. Even written in go, too.

<comment><USER3> I see why you might think that, but no. SSHProxy tries to move the private key from your computer to an external thing. SSHProxy doesn't have anything to do with sshmux.

SSHProxy is a two part thing:

1\. A server that, when connected to, will ssh to the requested host, but authenticate with a local private key.

2\. A client that will, when connected to the server, work like netcat for ProxyCommand purposes.

I'm skipping some info about additional SSH sessions being involved, as they don't provide any additional security.

The result is essentially ProxyCommand="ssh -W %h:%p jump_host", but instead of you having the private key, the jump_host has it. You then use a different private key to authenticate to the jump host.

I get the idea, and I by no means say he shouldn't have implemented it, but this provides no additional security what so ever. It just moves your private key from one machine to another. I hope he had fun implementing it, though! If you don't implement what might be a bad idea, you'll never get around to the good ones. Plus, bad ideas can be fun, even if they remain bad when done.

<comment><USER13> Ah yes, on closer inspection on a non-phone they are quite different.

You are just wrong on the no additional security though. In addition to enabling auditing, it also allows a username/password to be turned into an ssh key, so that you can know that if the rpi wasn't turned on, then nobody could log in to the target machine. It's similar to a TPM in this regard (as blog says), or can be a jumpgate protecting the systems behind it from compromised or malicious users.

I'm sorry you don't get it, but I'm not hurt by someone not understanding something when they criticize it. If you don't see the point of not having direct access to your key, then there's nothing I can do.

<comment><USER3> I have to disagree with you.

1\. The private key is not secure by default by putting it on a different host. 2\. This still allows an evil user getting access to his original machine to SSH into any host requiring his private key.

1 should be pretty obvious. If my intention is to get a hold of the actual private key file, he just moved the target. As for 2: We're talking about avoiding compromising a private key file stored on the client, so in order for that to be an issue in the first place, we're giving an evil user Y reading abilities on the local client. The normal user is called user X. The evil thing to do is to log into the other server on poor user X's behalf. User X used SSHProxy, and moved his private key to a raspberry pi. So, what does evil user Y do on user X's computer?

He just logs in through the SSHProxy, getting access to the remote service. Having the raspberry pi disconnect at times doesn't really matter, as that just means patience (or starting a job that keeps trying). Once logged in, evil user Y could add another key to the authorized_keys file if he wanted to.

Having a service automatically sign things with private key A stored in remote location B, as long as you provide private key B stored in "easily accessible" location A (Which we still assume due to thinking the private key was insecure) is no more secure than storing private key A in "easily accessible" location A. The only argument becomes the ability to occasionally take the pi offline, which doesn't seem to be what he touts as a reason for the project. The issue with this is essentially a reversed modified version of the ssh- agent socket issue, which is blindly signing things as well.

If you truly want to protect your private key: * Encrypt a USB dongle * Put a password protected private key on it * Only plug said USB dongle in when you need it, store separately from your laptop (on your person) * Change your password occasionally

Likewise, having a TPM be your signer doesn't change anything if you have it sign blindly. PCR's allow you to at least verify system state first, but using the TPM in this case only protects you against people stealing your filesystem without your physical machine. With access to the machine, the TPM will keep on signing things blindly. User interaction beats TPM in all areas. One of the cute features TPM was supposed to bring, that actually was going to matter (if you ask the manufacturers, that is) was Remote Attestation. Unfortunately, it wasn't any good and was never used for anything.

Also, for future reference, while it's completely okay to suggest that people are wrong or misunderstanding, there are nicer ways to say it than "You are just wrong", and "not understanding something when they criticise it". I have no idea about your qualifications, and you have no idea about mine. We're all humans, so be polite about it. No one likes being insulted.

<comment><USER14> > Also, for future reference, while it's completely okay to suggest that > people are wrong or misunderstanding, there are nicer ways to say it than > "You are just wrong", and "not understanding something when they criticise > it".

It's useful information to me that you value pleasant phrasing over criticism that might improve your security.

Thanks for making this clear up front.

<comment><USER3> It's also good to know that you completely ignored security advice from security professionals, making this a waste of time. You could say that up front as well: "I'm going to write a comment insulting you, but don't you DARE try to disprove me with logic!"

</comment></comment></comment></comment></comment></comment><comment><USER15> I've used a similar setup to wrap RDP to allow employees to securely remotely access their office desktop. There is a market for someone willing to make this a turn-key replacement for Terminal Services.

</comment><comment><USER16> Probably 15 years ago I did something similar at an overall system level with a program called pdmenu which provided a jump host menu for semi-technical users. The technical details of course are entirely different, but it did the same general system idea of presenting individual users with custom tailored prompts to log into various systems (and a few other tasks, and logging, etc). pdmenu had (has?) a great menu CLI for end users.

</comment><comment><USER17> Looked at the code, it is nice and short.

However I'm not that familiar with go so might be overlooking something. Is there any logging included on who connected at what time from what IP?

<comment><USER3> Not at the current time. Will implement, just haven't had the time. I mainly code on this during my daily commute between Denmark and Sweden. :)

<comment><USER18> You live in Copenhagen and work in Malmo or something? Is that common?

<comment><USER3> Landskrona, actually. Malmö would have been nicer, but the waiting list for an apartment is 2-3 years.

It's actually quite common, especially in Malmö (Malmö<->Copenhagen takes about half an hour, Landskrona<->Copenhagen 1:20), for a lot of reasons. The first being that living expenses, including rent and household items, are cheaper in Sweden. Local wages are always adjusted after the local living expenses, so living in Sweden while working in Denmark is economically favorable, especially seeing that you get a tax deduction bonus based on distance from home to work through the shortest feasible route. Cars are also orders of magnitude cheaper in Sweden due to different taxing. Not everything is cheaper or better there, though. Diesel and alcohol is more expensive, and my selection of rye bread is much narrower up there!

For me, it's due to me wanting to start a life with my wife, and a lot private things going on that made Sweden the obvious choice.

</comment></comment></comment></comment><comment><USER19> This is nice but the agent forwarding is a legitimate concern especially because a compromised host can take off with the private keys which are used while beginning the session. Most private keys are used for more than connecting to a single host.

In our setup we use jailkit allowing only ssh passthrough [1], we have added LDAP support to it (may release the patch later).

[1] [http://olivier.sessink.nl/jailkit/howtos_ssh_only.html](http://olivier.sessink.nl/jailkit/howtos_ssh_only.html)

<comment><USER3> What authentication do you have from the jump host to the target? To me, it looks like it has been reduced to either none or keyboard-interactive (password) login, which is considered bad practice. I could very easily implement support for this in sshmux, providing the setup you seem to use, as a way to avoid agent forwarding, but I just genuinely did not expect anyone to use password authentication, apart from in default config scenarios, before a public key has been installed.

Agent forwarding does not provide private keys, but only individual signing requests. This means that while the user is connected, and evil remote can request arbitrary signing, but only as long as the user is connected, and only as long as the users ssh agent is willing to do so. Using ssh-add -c further means that the user will have to accept each signing request. Also note that ssh -W, which is immune to any of these concerns, is fully supported by sshmux.

Correct me if I'm wrong, but "Jailkit" does not seem to stop an evil legitimate user from poking around other hosts with forwarding and such (which they can as long as ssh -W functions, within the limits of what a firewall allows the jump host to do in general). sshmux allows you to lock users to targets, rather than lock general capabilities of the entire jump host. This is because, while I provide clients access to various hosts, I do not trust them enough to have any unnecessary privileges.

</comment></comment><comment><USER20> Its nice.. That said, one if the real issue is getting people to use -W ;)

<comment><USER21> I'm looking at the man page, I had no idea about `-W`. However, what does this protect against that the standard:

        ProxyCommand ssh -q <jumpHost> nc %h 22

doesn't protect?

 __Edit: __just tried `-W` as an addition to the line but I get

       littlefish :: ~ » ssh pgsql3
       Bad stdio forwarding specification '<jumpHost>'
       ssh_exchange_identification: Connection closed by remote host

<comment><USER22> Try formatting it like this:

        ProxyCommand ssh jumpHost -W %h:%p

-W is essentially the same as using nc, however it doesn't require executing a command on the jumphost. This project uses that fact to make the jumphost more secure (you can't execute arbitrary commands), and do destination white-listing for each user.

</comment></comment></comment><comment><USER23> Why not simply use a VPN?

<comment><USER3> VPN's can be quite a pain, and is considerably more work than raw SSH. Depending on the VPN, the authentication strength is usually also quite a bit lower than that of SSH with RSA keys. There's also additional overhead. I have both VPN and jump hosts to get into our corporate network, and I most certainly prefer the jump host for convenience and performance.

There is also the user-level access restrictions of sshmux which will be much more difficult to replicate with VPN's. At least with pptpd, I believe it would require putting users on individual subnets with firewall rules restricting access to only their permitted hosts. Long story short, it wouldn't be a feasible solution.</comment></comment>


How I made an Scroll-Animations website load in less than 3 seconds - <AUTHOR> https://prashantsani.com/spider/2017/02/09/portfolio-website-2017-behind-the-scenes/ <comment><USER2> That's a pretty nice website. It took 4.1 minutes to load on my connection though (was completely black for the first three minutes).

I'm stealing wifi from across the street so I get about 3kbps average, so I understand you did not optimize for that ;)</comment>


Tim Cook Continues to Slowly Kill Post-Steve Jobs Apple - <AUTHOR> http://www.forbes.com/sites/thestreet/2012/09/21/tim-cook-continues-to-slowly-kill-post-steve-jobs-apple/

<comment><USER2> What people forget is that Tim Cook played a major role in the success that Steve Jobs had when he came back to Apple. And they also forget that Steve wasn't perfect and made his share of mistakes as well.

</comment><comment><USER3> "It's not easy to go against the grain..." but you've got to do it to get attention.

I'm inclined to agree that iOS Maps wouldn't have got past Steve Jobs, because he was fanatical about the smallest details. Apple is, for Christ's sake, outsourcing its data collection! To a company that obliviously claims it is not responsible for the "user experience". Steve would have bought them, cut their throats or both.

The questions now are: Will Tim Cook mobilize the resources needed just to compete with Google in worldwide data acquisition? Can he inspire his Maps team to change the world? The latter is not Cook's forte. If he makes a competitive matrix, they're dead.

<comment><USER4> > _I'm inclined to agree that iOS Maps wouldn't have got past Steve Jobs, > because he was fanatical about the smallest details._

I'm inclined to call this out.

If it made business sense, Steve would have done the exact same thing. Especially if Apple had no choice to continue using Google Maps (because of Google demands, etc).

Even worse regressions have happened under Steve's watch because they HAD to happen. E.g the move from PowerPC to Intel meant that all existing third party programs made until then had to run in a subpar, emulated, environment (Rosetta). Steve went along, because there was no way they could continue using PowerPC and still have a mobile processor roadmap.</comment></comment>


Ask HN: Free sources of historical financial data? - <AUTHOR>

Does anyone know where I can download historical pricing / volume data for options, futures, commodities, etc.? I know Y! has something for equities but I've not seen anything else.<p>Thanks! <comment><USER2> [http://www.traderji.com/data-feeds/19943-commodity- historica...](http://www.traderji.com/data-feeds/19943-commodity-historical- data.html)</comment>


David Foster Wallace on "exercising control over how you think" - <AUTHOR> http://online.wsj.com/article/SB122178211966454607.html#printMode

<comment><AUTHOR> "Probably the most dangerous thing about college education, at least in my own case, is that it enables my tendency to over-intellectualize stuff, to get lost in abstract arguments inside my head instead of simply paying attention to what's going on right in front of me. Paying attention to what's going on inside me. As I'm sure you guys know by now, it is extremely difficult to stay alert and attentive instead of getting hypnotized by the constant monologue inside your own head." -DFW

</comment><comment><USER2> There was a discussion on HN on a blog post that was (subconsciously) inspired by this speech

<http://news.ycombinator.com/item?id=2672854></comment>


Under the Hood: Building Facebook Camera - <AUTHOR> https://www.facebook.com/notes/facebook-engineering/under-the-hood-building-facebook-camera/10151048033208920

<comment><USER2> I love these little notes that they (FB Engineering) have been posting. It gives some nice insight into how at least larger companies develop the products (both technical and non-technical) including what they take into consideration.</comment>