Microsoft Adds an OpenSSH Client to Windows 10 - <AUTHOR> https://www.servethehome.com/say-farewell-putty-microsoft-adds-openssh-client-windows-10/ <comment><USER3> Hey there, everyone! I'm the PM for this project, and it looks like I'm a little late to the party, but I wanted to drop in some notes to add to the discussion:

* we also shipped OpenSSH's sshd server, but it's a little tricky to configure right now. Expect a blog post this week. * This is not production-ready in the current version of Windows 10 (hence the "(Beta)" in the label), but we hope to be soon. * All of this is being done in open-source out of a fork at [https://github.com/powershell/Win32-OpenSSH](https://github.com/powershell/Win32-OpenSSH) (code work is technically checked into [https://github.com/powershell/openssh-portable/](https://github.com/powershell/openssh-portable/) first, but those will be consolidated at some point). Check the Wiki there for a ton of info. * We've been working closely with the official OpenSSH Portable maintainers to get upstream at some point in the future. They've been awesome to work with so far, and we're really looking forward to moving Windows onto the definitive SSH implementation of the world.

This is been a super fun project to work on over the last couple years, and I'm glad that there's such a groundswell of excitement around it. Like I said, I hope to be publishing a lot more documentation/material on our plans as we get to a production-ready state.

I've also been super swamped with the release of PowerShell Core 6.0 [1] for Windows/macOS/Linux coming early next year, hence the lack of a good release announcement on these beta bits...Thanks to Patrick Kennedy for finding it and letting everyone know! :) )

[1]: [https://github.com/powershell/powershell](https://github.com/powershell/powershell)

<comment><USER4> Having no idea how an SSH server is intended to work on Windows, I have a question:

When I connect to a Windows box running an sshd, what exactly happens? Do I just get dropped into a command prompt or PowerShell session or what?

<comment><USER3> It drops into cmd, but it is configurable (and there's actually a Chocolatey community package for it that I believe prompts you for which default shell you want at install-time).

With PowerShell Core 6, we _also_ support PowerShell Remoting Protocol (PSRP) over SSH as a transport, which means that you can do stuff like New-PSSession and Enter-PSSession without WinRM. (PowerShell just gets registered as a "subsystem" of sshd, same thing sftp-server does.) You can check that out here: [https://github.com/powershell/powershell/tree/master/demos/S...](https://github.com/powershell/powershell/tree/master/demos/SSHRemoting)

<comment><USER5> That's really odd. Are you going to fix this before the final release?

</comment></comment></comment></comment><comment><USER6> When I have to work on a Windows machine the first thing I install is git: [https://git-scm.com/downloads](https://git-scm.com/downloads)

It comes with bash and all the standard tools (including ssh IIRC), so I can work on a real command line. Especially as a vi user, I'm right at home.

I find this a lot easier to manage than Cygwin: a lighter install, no packages to select, and smoother integration.

<comment><USER7> These days you go to the Microsoft App store and download Ubuntu. It loads up actual bash and comes with everything you'd expect. (ssh being just one of the things). The terminal emulation is improving (there are still a couple of glitches) but pretty much all of my daily tools work exactly correctly.

<comment><USER8> Is there any advantages over using Ubuntu itself directly?

<comment><USER7> Well not if you aren't using other parts of Windows :-) but if you are constrained to using Windows for other reasons then the advantage is you get all the tools with a much lighter weight system than say running a virtual machine.

There are also some systems where kernel support for the devices is lagging, either because they are proprietary and poorly documented or because they have insufficient market penetration to get someone interested in writing good driver support. For example support for the pen on the Surface Pro 4 line is really horrible (IMHO) on Linux.

<comment><USER6> So these devices need real kernel drivers? Windows doesn't provide some kind of emulation through its own drivers? I guess that makes sense although it didn't occur to me.

If that's true, will those new drivers also work on a regular non-Windows Linux install? That would be really great news, and pretty ironic, if device manufacturers or even Microsoft itself were suddenly writing more/better drivers for the Linux kernel. :-)

<comment><USER9> The grandparent is saying that if you run plain Ubuntu directly on a device, Ubuntu (or really, the Linux kernel) might not have drivers that work reasonably well for some hardware on that device, while Windows most certainly does have decent drivers for that hardware.

When you run Ubuntu on top of windows, windows replaces/emulates the Linux kernel - at least the part it needs to run the subset of Ubuntu that windows currently can - this emulation provided to run Ubuntu is done on the interface between the kernel and userspace, it is not done on a device/driver level.

Drivers are OS specific, the drivers in question here are either windows drivers, which works only on windows, or they are linux drivers which work only on linux. (Noone is writing drivers for windows which could also work on linux)

<comment><USER10> It's not an emulator. The NT kernel really does support the necessary system calls.

<comment><USER9> Sure, but there's a layer that emulates the linux syscalls. Though perhaps it's more appropriate to call it "translates" instead of emulate.

<comment><USER10> Its not a layer on top of the NT system call infrastructure. Its brand new NT system calls that do exactly what the equivalent Linux ones do. There is no combination of win32 NT system calls that will get you the behavior of fork().

<comment><USER11> Aren't the NT system calls also just a personality module above the actual NT kernel? The kernel was originally designed to provide multiple kinds of user spaces so that it could run OS/2 programs alongside Win32 ones.

<comment><USER10> No. win32 is a personality, the underlying ntdll calls are not part of that.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> "For years, Apple MacBooks have been the go-to choice for many admins partly because getting to a ssh shell is so easy."

I really can't believe somebody ever bought a MacBook because they found installing putty too much of hassle.

<comment><USER13> You'd better believe that if Windows had an acceptable terminal 10 years ago I would have never purchased my first MacBook.

The pleasant interaction with other *nix systems was and is a primary driver for my choice of OS X.

PuTTy sucks. Every other terminal I have tried on Windows sucks. Getting terminal-based software to work on Windows sucks. I stopped trying years ago because a terminal on OS X doesn't suck. It might not be a perfect 10, but I'm happy with it.

I'm also more interested in Windows more and more as time passes.

Losing as the most popular OS has made Microsoft start doing some of the right things.

<comment><USER14> > PuTTy sucks

Never been a problem for me. What are your complaints?

I barely notice the difference, but if I had to choose I'd take putty over Terminal.app, which has default keyboard-shortcuts that clash with Bash. (I believe it was Alt-b, Alt-d, or maybe Alt-f. I forget exactly.)

<comment><USER15> It's one of those things that's hard to explain. If you're used to a proper terminal emulator, you'll know immediately. PuTTy has terrible configuration and awkward default settings, and gives the impression of being pretty flimsy. Remove the network cable while in an SSH session, and PuTTy will immediately disconnect you. Try doing a port forward, and you'll need to dig around instead of just typing it into a terminal. Also aesthetically, PuTTy has nothing on Terminal.app or iTerm2 etc.

<comment><USER16> This is so true. Another attemp to explain might be: The cmd.exe and PuTTy always feel like foreign bodies in the windows world, they don't integrate, they are an rough try to fill the gap between the "old" command line world and the "new" windows world (in the win95 language). In contrast, already the OS X terminal feels like a first class citizen in the environment.

It is worth to emphasize what has been said before here: Since Windows popularity is decending, they start to catch up with that attitude. Nowadays, for instance, you can open the terminal from every folder in explorer.exe -- this is exactly this kind of integration Windows missed for 20 years. Once they kick out cmd.exe in favour of something like Console2 ([https://www.hanselman.com/blog/Console2ABetterWindowsCommand...](https://www.hanselman.com/blog/Console2ABetterWindowsCommandPrompt.aspx)) and update the toolchain even more than they did with PowerShell (actually integrating GNU/bash was a major step), developers will come back.

<comment><USER17> Have you used Windows recently? The Console team has made significant improvements in the last year, with more on the way. This article has a good rundown of some.

[https://blogs.msdn.microsoft.com/commandline/2017/10/11/what...](https://blogs.msdn.microsoft.com/commandline/2017/10/11/whats- new-in-windows-console-in-windows-10-fall-creators-update/)

</comment></comment></comment></comment></comment></comment><comment><USER18> It's about time.

I can't imagine (as the author asserts) that people left Windows for Apple because of the lack of a command ssh client. Here's a thought: If you need to spend time on Unix/Linux machines, why not just run that on the desktop? I've been Linux only for 10 years and have no issues. OK, I do need Windows for the rare moments where I have to collaborate on Word or PowerPoint documents; Win in a VM (KVM/QEMU) gets the job done.

Does this new client support ssh-copy-id and passwordless logins? I have a couple of public-facing machines that need ssh; I refuse to enable password authentication as they'll get banged on all day!

<comment><USER19> Because Windows is foisted upon people in corporate environments. Not everyone gets to run their OS of choice.

<comment><USER18> Good point - as Mel Brooks said, "It's good to be the king!" In my last job, I was IT; I dread going to some place where they force Windows upon me!

<comment><USER20> I work at a very corporate place with forced windows laptops. There are zero systems in the company we can sit down at and log into, except our laptops. The OS version is updated, and upgraded, automatically, even including major versions. I was just force upgraded to windows 10 and lost support for my programming environment. I had to recreate it in a new toolset because the one I have a thousand hours in is no longer supported. (It would work, it's just not supported - I cannot install it, but it would work fine if I could).

One arm of my company allows macs. This one does not, period. We have a 0% non windows 10 user base. We can have temporary admin access for 12 hours if we will out a report, but everything we do is recorded. It doesnt work if we're on wifi or battery. We are not allowed to install browser extensions, even if we are developing against the web.

My last job let everyone have admin/root. I had everything I ever wanted. My workflow was glorious. I was so comfortable. I was able to work 3 to 4 times faster on average, i.e. my yearly output was probably 3 to 4 times more productive. I invented new things, scratched my itches, and felt like the king of the world.

But this job will let me retire.

<comment><USER21> I work in the public sector and our sysadmins have actually made a game out of tricking people into updating to Windows 10 (and allowing them to take back admin rights in the process). Like offering Office 2016 upgrades, but only if you upgrade to Windows 10 too.

I understand it's much easier for them to manage things this way, but they're not going to have the results they want by going about it this way. When my Windows 10 "upgrade" comes, I'll just be dedicating one of my monitors to my own Arch (maybe Qubes) box where I can actually get shit done. I'm a C# dev too, which makes even less sense, but requesting permission to install simple dev tools is not going to happen. Life is too short for this nonsense.

<comment><USER22> What's your opposition to Windows 10 if you're already running Windows?

We're running Windows 7 and I'm begging to get into the pilot for Windows 10. As time passes more and more things break in Windows 7 and it becomes less useful. Most of Intels drivers are garbage and their Bluetooth stack is next to useless.

I'm running VMs ontop of my Windows 7 install for all development work. Anything that's Windows based is either a 10 or 2016.

<comment><USER21> I guess I should have noted that I do all my C# dev work in Windows 7 and run Arch VMs for everything else. My Windows 10 setup won't be much different, but I just don't trust Windows 10 and won't be running my VMs on it.

I haven't followed up on whether this "feature" made it into an actual Windows 10 update, but I remember reading about keylogging to the cloud as a way to pre-load your start menu with things that might be relevant to what you're doing. Maybe it's just being a developer and knowing what this kind of casual abstraction can cause, but I'm not okay with the philosophy that gets it into a test release of Windows 10. Microsoft is doing cool stuff these days but they still haven't won me over.

<comment><USER22> I'm not aware of any keylogging to the cloud "feature". That sounds like some crazy conspiracy theory dreamed up by the people who hate Windows 10 and or Microsoft.

Windows 10 has the same frequently used app feature as Windows 7, which you can didable. You can optionally allow Microsoft to gather data about onscreen keyboard usage to improve suggestions, like Google Gboard on Android. Cortana's searches are obviously cloud based, but can be disabled. And Windows 10 offers suggested apps and features in like 3 different places in the OS, which can also be disabled. Maybe someone dreamed up a fantastic spyware feature based on all of those things.

<comment><USER21> I hear what you're saying, but none of it makes me feel better about using Windows 10. It's not high-quality HN discussion, though here's a Reddit thread about it: [https://www.reddit.com/r/Windows10/comments/31rxsv/disable_k...](https://www.reddit.com/r/Windows10/comments/31rxsv/disable_keylogger_windows_10/)

You've told me three things that I can disable in Windows 10. Why is this stuff enabled by default in the first place? How do you know this is everything I need to disable to address these concerns? Or better, why isn't user consent requested before any serious "diagnostic tracking" like this? The answer, I think, is that it's too complicated for the average user. Once this "diagnostic tool" is effectively hidden from the user, and enabled on all devices, the tool either has to be monitored regularly (to make sure _more_ features aren't auto-enabled like these were) or eliminated completely. I've spent too much of my life "monitoring" closed-source software to give much consideration to that option, at this point.

<comment><USER22> During installation/setup you have the option to disable a lot, unfortunately in an enterprise environment that isn't always something the user gets to see. Fortunately most of the crap is disabled or not present in the enterprise version of Windows 10.

It's on by default so that users will interact with it and try it out. This is pretty standard practice on every major OS or application you use today. New features are enabled by default and the user gets to figure out how to disable them if they don't like it.

Case in point, the latest update to Gmail on Android enables a feature of opening URLs in a Chrome Frame inside Gmail instead of using your browser. This is great for Google, not so much for the user. I got screwed over because of this feature because a nonce token I received was consumed by the Chrome Frame which promptly crashed.

Windows 10's suggestions and prompts are about on par with MacOS High Sierra's. If you're questioning that statement, try not setting up iCloud some time then come back to me.

<comment><USER21> It's a trust issue. I think it's a major leap to auto-enable new features without letting the users know what's going on, but people don't seem to have a problem with it these days as long as it doesn't raise any red flags in their mind or on social media. If we're auto-enabling stuff like this, don't users stop asking the questions? And is that consent?

That's not even going into who is making these decisions, the corporations who only stand to profit from you enabling these features. They will roll it back if there is enough public outcry, but burying the option in the system settings is one way to avoid mass public outcry. Convenient, isn't it.

Sure another major corporation is doing this with their products, but that doesn't make it right. None of this is an acceptable reason to continue sneaking it into their products. Plus the data collected has a potential for even more profit, which is where I just peace out and use an OS I trust. Why in the world would I give Windows 10 the benefit of the doubt?

<comment><USER22> There's definitely value in a lot of the data collected and there's also mass confusion about what's being collected and what collection can be disabled or can't as the case may be.

I'm not trying to justify data collection and I think that certain kinds of telemetry data are perfectly acceptable to be collected. The reason I bring up comparisons to other OSes is that often opponents to Windows 10 mention switching to other OSes which aren't necessarily any better.

With regards to trust in privacy and security, I can't say that I trust Microsoft any less than others. As an enterprise software and services provider, they are in a position where their products must meet certain standards in order to be adopted. The fact that they still are implies there's at least a certain level of trust held in them, unless you're the type of person who feels all companies are in on it.

Speaking of in terms of trusting in long term commitment and support, I would say I have greater trust in Microsoft than just about anyone else. They have the best track record when it comes to not outright abandoning products. You can argue that opensource software will always be supportable, that doesn't mean that it will be supported.

<comment><USER21> That's a good point about open source software not always being supported. I guess it's no coincidence that the large organizations where I've worked were all .NET shops, but all the Linux boxes ran Red Hat Enterprise. And the biggest complaint I've heard about about Microsoft not supporting old products was a discussion about Windows Server 2003 (In 2016...).

I don't think that "all companies are in on it" necessarily, but there's a reason for that kind of loyalty to customers and it's not because it feels good. I'm not going to knock Microsoft too much because while I do feel like they're off the mark in some areas, they're improving their developer support a lot recently so I'm excited to follow what happens. But I don't think it's a coincidence that they're rapidly increasing developer support either (we sat through the app-less wonder of Windows Mobile for quite a while). They are also of course a publicly-traded company, at the mercy of profit-demanding shareholders.

I would like to see a world where the people who use the products have an equal opportunity to contribute and improve it. Not someone behind a wall squeezing money out of pockets, or throwing candy at developers so they'll make their platform more appealing for them. Or at least as appealing as the other guys', else they go under. I'm hanging onto an ideology, I know.

Like digitalsushi said, this .NET job will let me retire but it still sucks. It could suck a lot worse though.

<comment><USER22> > I would like to see a world where the people who use the products have an > equal opportunity to contribute and improve it. Not someone behind a wall > squeezing money out of pockets, or throwing candy at developers so they'll > make their platform more appealing for them. Or at least as appealing as the > other guys', else they go under. I'm hanging onto an ideology, I know.

I would to and I also recognize that sometimes the community doesn't always push something in the right direction. Sometimes it takes a dictator to make things happen. Sometimes there's so many desperate projects that need to work in concert but can't or won't because of political reasons.

One of the advantages of a major corporation at the helm is that they can force a vision upon everyone under them and on the industry as a whole. That strength however is a great weakness or detriment to the industry if the person driving the boat has ideas that aren't in the communitie's best interest.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> Ultimately this probably helps increase the overall internet security. Although in recent years it was available from a TLS secured source [0], the putty.org site (which might or might not be operated by the maintainers) is still not https secured. Given that probably tens or hundreds of thousands downloaded it from there (imagine, getting an SSH client from an unknown source!) I'm surprised not more happened. Other than that, thanks for the great work maintaining this project which helped me and others a great deal throughout my career. Countless times have I been stranded on a Windows server and quickly needed an SSH client.

[0][https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.ht...](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)

<comment><USER24> Putty binaries are all signed, which is what you should be looking at when authenticating a release. Whether you fetch them over SSL is of little importance.

<comment><USER23> You are, of course, absolutely correct. And I hope this is what internal package maintainers in large companies and individuals using putty as their standard SSH client do. However, for many of us putty is a backup when they are not on their linux/osx machine and just quickly need an SSH client to do something. The workflow there is google->putty->first result->download->execute. You absolutely shouldn't, but we also shouldn't drink and sleep 8h a night :)

<comment><USER25> I put a copy of putty at a short but private url at my own domain so that I can get it over https.

</comment></comment></comment></comment><comment><USER26> If open source isn't a requirement and you want a polished GUI client, [https://www.bitvise.com/ssh-client](https://www.bitvise.com/ssh-client) has been free as in beer for about 1.5 years. It will be tough for them to beat being part of the default install!

Odd licensing (free for up to 4 users/machines, but crossing to 5 required $45/seat) really crimped adoption before the license was changed. [https://web.archive.org/web/20160329203117/https://www.bitvi...](https://web.archive.org/web/20160329203117/https://www.bitvise.com/ssh- client-pricing)

Bitvise sells a solid Windows-friendly SSH server for $100. I am not affiliated apart from being a happy user since before OpenSSH supported AuthenticationMethods (multiple required) in 2013; it has been my straightforward licensing alternative to Remote Desktop Gateway.

<comment><USER27> They're also squatting the putty.org domain to advertise their software, which is pretty bad-mannered.

<comment><USER26> Thanks for pointing this out; I'd forgotten about that (having given up on Putty after discovering the difficulty of sharing configuration [https://stackoverflow.com/q/13023920](https://stackoverflow.com/q/13023920)).

Putty.org links to the Putty download page with a disclaimer separating promotion of Bitvise software below. The contrast in marketing language between "source code [...] developed and supported by a group of volunteers" vs. "developed and supported professionally" definitely appeals directly to the Windows mindset! Unfortunately Bitvise's "growth hacking" makes commercial sense, even if it does cost them potential users.

It is always interesting to contrast various SEO approaches; for example: contrasting [https://www.chiark.greenend.org.uk/~sgtatham/putty](https://www.chiark.greenend.org.uk/~sgtatham/putty) and [https://winscp.net](https://winscp.net). It would be neat if the Putty author would chime in here; perhaps a funding drive for putty.net is in order!

</comment></comment></comment><comment><USER28> My main issue is the terminal emulator. MinTTY is the only I can get to work like I want with colors and fonts, but I still miss ligatures and the performances are bad.

I'd really like something faster with full color and font support I can SSH from.

By true color support, I mean this: [https://github.com/chriskempson/base16-shell](https://github.com/chriskempson/base16-shell)

I use it to change my colors depending on the machine I am on. If I log onto a production server, the color scheme switch to high contrast with red background.

<comment><USER29> Have you tried this out in recent Windows releases? We added 24-bit color support [1] to the console in Sep 2016, and built a colortool (that supports solarized) this summer [2]. Most of this should work, and we're all ears for things that don't.

1\. [https://blogs.msdn.microsoft.com/commandline/2016/09/22/24-b...](https://blogs.msdn.microsoft.com/commandline/2016/09/22/24-bit- color-in-the-windows-console/)

2\. [https://blogs.msdn.microsoft.com/commandline/2017/08/11/intr...](https://blogs.msdn.microsoft.com/commandline/2017/08/11/introducing- the-windows-console-colortool/)

<comment><USER28> Does it support setting colors via escape sequence from the shell? because that's the whole point.

<comment><USER29> Ah, no, I don't believe so - colortool calls into kernel 32.dll to set the colors it looks like, so they're system wide. The github project linked in the second blog post would be a good spot to put a bug/feature request in though.

</comment></comment></comment></comment><comment><USER30> I'm interested how well the client works under cmd.exe. Last I tried to use ssh via cygwin, I remember having a lot of issues with escape codes not working, to the point that I had to go ahead and install puTTY anyway, just because it was a much better terminal emulator. Microsoft has neglected their terminal emulator for 20 years now[0]. I hope they improve it soon. I'm aware that some cosmetic features were added in Windows 10 but frankly it still sucks compared to even the most basic Unix terminals. Making the terminal a first class citizen in Windows would do a lot to win developer market share.

<comment><USER31> You're missing [0]

As for the terminal, it went under quite a revamp for lxss support (linux subsystem / Windows Subsystem for Linux)

<comment><USER30> Oops, that was supposed to be a a footnote (just my acknowledgement that there had been some changes to cmd for Windows 10), but I decided to put it inline. Can't edit with the HN app I'm using currently.

</comment></comment></comment><comment><USER32> 1:47 video on how to install it.

If you do not want to watch go to "Manage Optional Features" then + "Add a feature". You can then scroll down the list and find the OpenSSH Client (Beta) and OpenSSH Server (Beta) features in Windows.

Do you really need a video when the installation instructions are 2 sentences?

<comment><USER33> Even if the installation instructions are more than 2 sentences, I absolutely hate if video is the only documentation method. It has its value as a _supplement_ to a text description, but not without the text.

(The worst offender that I've come across for this stuff is Minecraft mods. I want to know how this machine block works, not watch you chat about random stuff for 30 minutes hoping that the explanation is somewhere around minute 19!)

<comment><USER34> Maybe YouTube should have a "kudos, this video was so good that I'll watch an extra 30-second ad just to thank you"-button.

(I assume most of these videos are so unnecessarily long because it increases ad earnings for the content creators.)

</comment></comment></comment><comment><USER35> As someone who makes online training courses, the whole putty dance for Windows was so cumbersome. This is excellent news.

Personally I would recommend anyone on Windows to use WSL (which supports ssh and scp out of the box) but it's nice to see this is available for people who don't want to use WSL.

<comment><USER26> > the whole putty dance for Windows

Do you have something you can share publicly to demonstrate to the uninitiated how painful this has been?

Putty's dedication to the Windows registry has caused me tremendous grief.

Helping end users (Windows developers) configure Putty is the bane of my "discount" remote access strategy (SSH port forwarding).

<comment><USER35> I usually point people to specific steps of this DO guide [https://www.digitalocean.com/community/tutorials/how-to- use-...](https://www.digitalocean.com/community/tutorials/how-to-use-ssh-keys- with-putty-on-digitalocean-droplets-windows-users).

It gets even worse too because in some of my courses (like my Let's Encrypt course) I request people to securely transfer files to their DO server.

So now they have to set up WinSCP or a comparable tool, which has its own set of lengthly instructions.

And for comparison on MacOS, Linux or WSL it's just:

Create SSH key: ssh-keygen -t rsa (hit enter a couple of times)

SSH into a server: ssh user@host

SCP a file to a server: scp foo.conf user@host:/tmp

</comment></comment></comment><comment><USER36> Although it's appreciated as a UNIX admin I can honestly say I don't use Windows by choice but because my enterprise says I must. That's partially because all the productivity tools are found there and partially because the desktop guys are massive Microsoft bigots and refuse to host anything else. (It's OK I can say that as a massive UNIX bigot and besides they'll tell you the same.)

And frankly with the tiniest bit of effort I can crank up a local xterm and then ssh which gives me lovely things like color, font choice, easy window size changes and thousands of lines of scrollback. Why in 2017 would I want to use a bare naked ssh client unless there is simply no other choice?

<comment><USER37> Default packages are extremely important. That you can walk up to any computer and get work done without installing anything, even downloading putty.exe is _far_ too much effort in some cases. Also it is kind of rude to just download and execute things on friends/colleagues computers ad hoc.

If this will be installed by default it will be awesome, and imho even the process described here by enabling a feature is still better than putty.exe (it will get managed by windows and updated if need be etc.).

For my own windows computers though, the first thing I install is WSL and a proper terminal app (cmder).

<comment><USER38> Downloading putty.exe (or executing on a USB or share) is less invasive than installing the OpenSSH client feature.

<comment><USER36> Oh you fancy people with the ability to download and execute things.

</comment></comment></comment></comment><comment><USER39> I'm confused. I've been using [https://github.com/PowerShell/Win32-OpenSSH](https://github.com/PowerShell/Win32-OpenSSH) for this for a long time now. Everything works well. Is this new thing somehow different? Better?

<comment><USER40> Same thing but you can install it via Windows optional features now.

</comment></comment><comment><USER41> Ever since Windows 10 was released, you could download and install the OpenSSH client. It's great that Microsoft has actually built this in now (even if it is beta).

</comment><comment><USER42> Wow, took them what, 20 years?

But nevertheless I'm happy. Great job

<comment><USER43> Took them? Why should Windows come with an SSH client?

<comment><USER44> I don't work for Microsoft, but my guess would be in order to securely access a shell. (Remotely, but srsh doesn't roll off the tongue)

Honestly though, I'm more interested in an SSH server for Windows. I haven't tried for many years, but last time I did, getting something more secure than telnet was a massive pain.

<comment><USER45> I'm using this in production on a Windows Server 2016

[https://github.com/PowerShell/Win32-OpenSSH/wiki/Install- Win...](https://github.com/PowerShell/Win32-OpenSSH/wiki/Install- Win32-OpenSSH)

It works but I never managed to connect to it using public/private keys, only username and password.

Luckily I don't have to type them:

sshpass -f password.txt email@example.com "powershell Stop-Computer"

It would be great if at least Windows Server came with a built in ssh server.

<comment><USER26> Maybe this is because key auth requires domain\username@host (doesn't resolve the domain automagically)?

[https://github.com/PowerShell/Win32-OpenSSH/issues/420#issue...](https://github.com/PowerShell/Win32-OpenSSH/issues/420#issuecomment-306592145)

</comment></comment></comment></comment></comment><comment><USER46> Seems like they're missing support for a lot of algorithms.

It's a good step to be sure, but not a replacement for Putty by any means.

<comment><USER47> Which algorithms are they missing?

<comment><USER46> ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group- exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman- group14-sha1,diffie-hellman-group1-sha1

without these you'll likely be unable to connect to Cisco devices, vCenter, etc.

<comment><USER48> The SHA1 variants are deprecated on modern OpenSSH as well, although they're still supported if you explicitly enable them.

I agree that it would be nice to have them "opt-in" in Windows as well, in my experience a significant amount of legacy equipment still uses these deprecated algorithms.

</comment></comment></comment></comment><comment><USER49> What I'd really like to see is an OpenSSH _server_ for Windows. My biggest gripe is not being able to SSH into a Windows machine and use one of the 3 major shells available now (cmd/powershell/bash).

<comment><USER50> it has a ssh server, too. but I do not know which shell you get after ssh'ing into (trying out right now)

</comment></comment><comment><USER51> I prefer installing OpenSSH from Chocolatey instead, since that way I know I'm getting every month's updates. I've been using the sshd for a year now on my media server, and have the client on all my machines. It's pretty solid, although I do have one ongoing issue related to how ssh-agent works (instead of emulating UNIX domain sockets it uses Windows named pipes, and I can't make a working proxy for Windows gpg-agent to replace it so I can use my smartcard for SSH).

</comment><comment><USER52> Does it include an SSH agent to replace Pageant? And preferably with WSL integration?

<comment><USER53> I haven't tried the os feature version, but I assume it is the same one you can install from chocolatey... If so, then yes, it has ssh-agent.

</comment></comment><comment><USER54> This is well and good but I wish Microsoft would take a strong stance on corporations launching MITM attacks on their employees' HTTPS sessions by injecting their SSL certificates on every session. I can understand corporations blocking sites like facebook but I don't see why they need to read everything I read on the web.

<comment><USER55> Sounds like an issue for lawmakers or HR are your workplace, not Microsoft...

Microsoft is a technology company, they aren't in charge of the HR or management at your workplace and consequently shouldn't be trying to fix HR issues using technology. There's plenty of legitimate uses for MitM-ling TLS, and in some circumstances even that is one of them (e.g. on hardened networks with VPN endpoint interconnects).

</comment></comment><comment><USER56> Back in the late 90's I used to carry a memory stick with VNC and putty upon that I use to tunnel a VNC connection over SSH to my home network and oven over bonded ISDN (128k which I had at the time in the UK) it was more than usable or attaching to any of my systems.

Then Cygwin came of age, proved very very very useful for adding the tools windows corporate desktops missed out upon for work related activities.

But in all that time, PuTTy has been a very good terminal client for SSH needs. Whilst it is good that Microsoft is adding this, it has never been a hurdle for many and those who run into a corporate wall that tough, have always been able (from the ones I've worked with and collegues) been able to circumnavigate around it :- Usually using the corporate security policies to bash the corporate desktop witch upon the head. Fight fire with fire if you can't bend the rules.

<comment><USER57> I am missing the point you are trying to make.

For those who like -- and prefer -- GUI, Putty (or any other GUI based SSH client) will remain king. For the rest, this is very good news. It is the same client many have been using for many years under their Unix alike OS, just on Microsoft Windows.

<comment><USER56> Point being, those who wanted SSH or unix tools under windows - there have always been options, even with the most zealous of corporate desktop policy that I have encountered and in the worst cases, you can use the corporate security policy to make that happen.

</comment></comment></comment><comment><USER58> If one's necessities are not limited to an ssh client, Cygwin has been available for years, is free software, and has a very good integration with Windows (you have read/write access to the whole filesystem, for example, something presently cannot be done with win10 subsystem for Linux)

<comment><USER59> the WSL does have full access to the file system... cd /mnt/c/ gets you access to the C drive...

<comment><USER60> It can't work with network shares or non-ntfs volumes though.

<comment><USER59> you know, i just noticed this... my ExFAT SD Card is not visible... hmmm....

<comment><USER61> I think this is because WSL uses NTFS Alternate data streams to store linux file attributes, and they don't survive when a file is copied to a non-NTFS file system.

<comment><USER62> No, I don't think so. Alternate streams are only used inside the emulated Linux filesystem, not externally.

</comment></comment></comment></comment></comment></comment><comment><USER63> Yeah, they probably found out that sending the data from their own adware/spyware over unencrypted channels back to their own servers was too insecure. _just kidding_ ;-)

No seriously: Congratulations MS and please evaluate again if you really need that extra money you make with your advertising deals.

</comment><comment><USER64> I just use the ssh client within the Ubuntu thingy in Windows 10 - surely that was an option?

</comment><comment><USER65> So this is why Microsoft is such a leader in technology. After only 22 years, ssh is now in it's operating system! Wouldn't it be nice to have a monopoly that actually is innovative, rather than simply a lackluster follower?

</comment><comment><USER66> The first thing I always installed in Windows was the gnu tools port. (unixutils?)

Now when I sit down at a Windows box, it's the Ubuntu terminal. Over the years, I've become pretty platform agnostic. However, having to change my keyboard shortcuts for Mac, and no single way to copy/paste in a terminal between Windows (double right-click)/Mac (alternate between middle-click, or right click and paste depending on the source)/Linux (good old middle click!) is pretty annoying. It's also annoying that the Mac uses a whole different button for copy/paste, and the Home/End keys don't work the same.

</comment><comment><USER26> Haven't seen any discussion yet of the licensing aspects of accessing a Windows server via SSH.

Linking an independent Microsoft licensing consultant discussing fun terms like "External Connectors" vs. "Client Access Licenses" (CALs), the "Primary User of a Windows device" and the current "Web Workload" exception... maybe a new exception is on the way.

[https://github.com/PowerShell/Win32-OpenSSH/issues/926#issue...](https://github.com/PowerShell/Win32-OpenSSH/issues/926#issuecomment-346871838)

</comment><comment><USER67> It's in beta and you still have to use the bag of sh*t windows terminal.

I'll skip and continue supporting and using PuTTY.

The PuTTY developers should get a trophy for an essential dev tool that has been around for ages, free and just works.

</comment><comment><USER68> As a sysadmin who put up with MSs crap for many years, got fed up, and went fully gnu+Linux only...

Sorry Microsoft, too little too late, you are an anti-user company, and I hope your desktop share withers and dies. I'd rather see the world on osx cause at least it has a semi-decent gnu userland.

I smell blood in the water with moves like this. Its time to ramp up the attack people! Step 1: rip out AD and replace with Samba4. Step 2: windows servers become Linux servers. Step 3: non-office user terminals become Linux terminals. ...

</comment><comment><USER69> Built-in OpenSSH was never the problem. You could always get builds for Windows.

Lack of a half-decent terminal emulator is. cmd.exe is just terrible (I assume that's what I see in the screenshot).

<comment><USER70> I hope you are aware that Windows 10 has improved console: [https://blogs.windows.com/buildingapps/2014/10/07/console- im...](https://blogs.windows.com/buildingapps/2014/10/07/console-improvements- in-the-windows-10-technical-preview/)

And keeps improving: [https://blogs.msdn.microsoft.com/commandline/tag/console/](https://blogs.msdn.microsoft.com/commandline/tag/console/)

<comment><USER71> I was happily surprised a while back when I started using WSL, but there are a few things that I still miss:

* tabs * splitting a pane * a default font with a high unicode coverage * better theme support (the current system is clunky)

<comment><USER70> You may get away with ConEmu then: [https://rakhesh.com/windows/whee-cmder- can-do-split-panes/](https://rakhesh.com/windows/whee-cmder-can-do-split- panes/)

</comment></comment></comment></comment><comment><USER72> Next step: add recognition for foreign partition formats like HFS+ and ext4. Just recognition would be a great step, something along the lines of: hey we see there are partitions on this disk; are you sure you want to format this? This instead of: Do you want to format this disk?

I don't even expect that you can read or write to those partitions, which of course would be trivial to add for them. Just recognition would be great!

</comment><comment><USER73> Microsoft is definitely other company nowadays. When I started on IT, more than a decade ago, they had a completely other market positioning and strategy.

</comment><comment><USER74> Well, I gave this a try on my Windows machine. I tried to generate a key pair to pass around. I have yet to figure out how to give ssh-keygen a path spec it can write to. Even no path (just file name for the key in the current directory) fails with "invalid argument"

So on that note, anyone know how to report bugs on this? Cursory Googling isn't turning up much.

</comment><comment><USER75> Looks like there's a server too, sounds good.

</comment><comment><USER76> I have been using VanDyke's SecureCRT for more than a year now at work and I must say if works very, very well.

</comment><comment><USER77> Last I checked bash on windows is still segregated from the windows system proper. So you cannot call any windows utility/compilers from windows bash. You cannot write to existing files/directories either, based on WSL docs. Hopefully these limitations will be removed.

<comment><USER78> I don't think that's true. You've been able to execute windows tools from WSL for a while now.

<comment><USER79> And access to file system through /mnt/c even longer.

</comment></comment></comment><comment><USER80> I needed to reboot to make the install of ssh work. Then I did `ssh linuxbox` and it tried to login me in as winuser@winbox@linuxbox instead of winuser@linuxbox. The -l option fixed that. The gtop command looked nice! - <USER2> didn't on putty.

</comment><comment><USER81> You can also use ubuntu bash on windows. With that you can use a ton a linux utilities.

</comment><comment><USER5> I've been using this from the daily builds for a year, maybe two, to SSH into my app servers, DB boxes and load balancers and start tunnels,

It works. Really well.

Microsoft are going to try and get the forked Windows support merged into OpenSSH ports upstream.

</comment><comment><USER82> So, it took Microsoft 17 years to catch up?

I ported openssh to windows in year 2000.

[http://download.jgaa.com/ftp/pub/OpenSSH/](http://download.jgaa.com/ftp/pub/OpenSSH/)

</comment><comment><USER83> > There is a new beta feature in Windows 10 that may just see the retirement > of Putty from many users

I don't think so. Putty is not only a superb ssh client, it's also so much better shell than command prompt.

</comment><comment><USER84> For the love of God, I cannot get ssh-add working with passphrase protected private keys. If there is no passphrase protection on the private key, then it works fine. I guess this is what beta means ;-)

</comment><comment><USER85> The best terminal ssh is obviously mobaXterm.. It even supports X windows. Plus it's free.

[https://mobaxterm.mobatek.net/](https://mobaxterm.mobatek.net/)

</comment><comment><USER86> I'm not sure how useful this is by itself. It's cool that it's there for convenience, but I think I'd rather stick to either Git on Windows or Windows Subsystem for Linux (WSL)

</comment><comment><USER87> Central store with apps, built-in ssh... Almost like Ubuntu 4.10...

<comment><USER88> Shhh. It will only be another decade or two for Microsoft to complete their ugly rewrite of Unix.

</comment></comment><comment><USER89> I wonder if it has some "convenient" extensions to the ssh protocol that will only be available on Windows...

At least they can't afford intentional incompatibilities in this case.

<comment><USER90> _I wonder if it has some "convenient" extensions to the ssh protocol that will only be available on Windows..._

Does it, or is this FUD? The source code is available.

<comment><USER89> Unfortunately I am somewhat older and I am cursed with a very good memory. The behaviour I describe in the OP used to be the standard for Microsoft.

Feel free to audit the source code if you want, I'm not using Windows any more so I don't really care.

</comment></comment></comment><comment><USER91> Holy smokes! Why did it take them that long? This is why Microsoft loses so often. They crawl when it comes to innovation. Thank goodness for their surface line of products

<comment><USER92> >Why did it take them that long?

Because they relied on software sales to businesses, therefore incompatible tools and vendor lock-in. They're now changing their business model towards IaaS/PaaS.

>This is why Microsoft loses so often.

Microsoft loses how? You might not like them but they definitely haven't lost anything.

</comment></comment><comment><USER93> How do I get it to use my SSH key automatically? Do I make a .ssh folder in my home folder? Which key format does it use; PuTTY or the regular format?

</comment><comment><USER94> It seems it only available in Administrator mode, to enable it for normal user, you have to add "C:\Windows\System32\OpenSSH" to your PATH.

</comment><comment><USER95> All this talk about putty and I can't believe nobody has mentioned Bitvise Tunnelier. It's been my goto SSH client on Windows forever now.

</comment><comment><USER96> Can't wait when the WSman in powershell will be replaced with SSH. This is one of the obstacles for PS for Linux, due lack out of the box

</comment><comment><USER97> anyone old enough to remember services for unix? [https://en.wikipedia.org/wiki/Windows_Services_for_UNIX](https://en.wikipedia.org/wiki/Windows_Services_for_UNIX)

What happened? Will this latest attempt to be non-hostile to unix be dumped as well? No ssh server, why not?

<comment><USER98> It does include an SSH server.

> There is a new beta feature in Windows 10 that may just see the retirement > of Putty from many users: an OpenSSH client and OpenSSH server application > for Windows.

</comment></comment><comment><USER99> Maybe someday, we will even be able to type sftp://foo@bar/var/www into the Explorer address bar!

</comment><comment><USER100> I love that you have to dig through a list of supplemental fonts to enable the SSH client/server. Oh Microsoft.

</comment><comment><USER101> Only available on 1709. No joy on LTSB :(((

</comment><comment><USER96> There is clear direction where MS heads. Can't wait the moment when they will replace WSman over SSL to native SSH

</comment><comment> mark-r Is this a new client and server, or are they just taking advantage of the ability to run native Linux binaries?

<comment><USER78> I'd assume its windows native, considering it can run without the WSL.

</comment></comment><comment><USER102> Dear Microsoft,

great to see you are including OpenSSH as part of your own OS, it's a carefully crafted piece of software that has a lot of appeal among users.

A nice follow-up is to generously contribute back to The OpenBSD Foundation. You were already a donor and, doing so, are helping further developments while being much cheaper than hiring a team all by yourself.

Thank you.

</comment><comment><USER103> I can't wait for the day we can accurately describe windows as a quirky Linux distro

</comment><comment><USER104> What could possibly go wrong?

</comment><comment><USER105> yep, welcome to 1999. geez.

</comment><comment><USER106> Exciting news!

</comment><comment><USER107> Can we finally proclaim 2017 as the year of the Linux desktop?

<comment><USER33> 2017 was certainly the year of Linux on the Windows desktop. :)

</comment></comment><comment><USER108> Even if installing Putty is not a hassle, i see no reason why we can't try SSH . If it makes IT admin's job easier, we should give it a try.

</comment><comment><USER109> Die putty. Die. MUHAHAHAHA.

<comment><USER110> The UX would have to be better than Putty first. Seeing as putty emulates a decent terminal, this isn't going to be trivial.

</comment></comment><comment><USER111> Welcome to the 90's Microsoft. Glad you could make it.

No one has used telnet for over 20 years. The fact that it took Redmond over 20 years to incorporte an SSH client proves to me that they really aren't as security conscious as they claim to be.

</comment><comment><USER112> Great. Microsoft. That's just great. Now could you please remove the spy/adware that is also included in Windows 10?

<comment><USER113> Even if they did, would you ever trust them again?

</comment></comment><comment><USER114> Great stuff, now windows malware can use ssh to infect Linux servers!

<comment><USER115> If SSH connectivity was a major reason why Windows malware couldn't propagate to Linux servers, we'd be in very deep shit already.

<comment><USER114> you miss the point that the right ssh keys will be used by default. currently malware would have to search for and use the keys by itself. now the servers will be on a gold platter, ready to be served

<comment><USER48> What makes you believe that? Is malware targeting putty common?</comment></comment></comment></comment>


Show HN: Slashblog – A Blog for Your Website - <AUTHOR> https://slashblog.io <comment><AUTHOR> Hey Hacker News, I've been working on this side project for a couple weeks. Please let me know what you think needs improvement. Thank you!</comment>


Bitcoin as a Political Tool - <AUTHOR> https://firstname.lastname@example.com/bitcoin-as-a-political-tool-19ab3167a23b <comment><USER2> Welcome to 2012.</comment>


Facebook Details Its New Plan to Combat Fake News Stories - <AUTHOR> http://www.npr.org/sections/thetwo-way/2016/12/15/505728377/facebook-details-its-new-plan-to-combat-fake-news-stories <comment><USER2> Facebook as news curators already didn't work very well ([http://gizmodo.com/former-facebook-workers-we-routinely- supp...](http://gizmodo.com/former-facebook-workers-we-routinely-suppressed- conser-1775461006)), here they're going to be fact checking and we'll have to wait and see how well they manage that. Most writers use real facts to create incorrect narratives, and if they're only reviewing what is factual that still leaves a lot of room for interpretation.</comment>


Running Hunchentoot behind Apache - <AUTHOR> http://www.newartisans.com/blog_files/common.lisp.with.apache.php

<comment><USER2> Why wouldn't this be particularly slow? You're running a potentially inefficient web server with a proxy webserver in front of it. Doing this with Python's built in webserver (as seen in Django and such) with Apache proxying is very inefficient and performs poorly compared to Apache with mod_python or cgi. Even replacing Apache with something LigHTTPd only marginally makes things faster, since the bottleneck is Python's webserver.

I don't understand why this wouldn't also occur with Hutchentoot. I would think a CGI interface, or a mod_lisp written much like mod_python or mod_php, would be significantly faster.

So, all that said, is Hutchentoot a bottleneck?

<comment><USER3> I'm not sure about performance but I did try Hunchentoot with mod_lisp2 and apache and I encountered a number of strange errors (I'm guessing this is because of mod_lisp2's quality) so much so I had to use Hunchentoot's built-in server which gave me no problems at all.

On Hunchentoot's page the author does talk about performance issues (for dynamic not static content) if you care to look. So you're probably right but it's better to get your system running first and deal with performance second.

However, as I guess apache is faster than most of the homebrew lisp servers (although this is pure conjecture) I would like to see a more stable mod_lisp.

<comment><USER4> Older versions of hunchentoot (named TBNL) used mod_lisp and mod_lisp2 to communicate requests to the Lisp side in a simplified form (similar to FastCGI). Since Hunchentoot can speak HTTP directly now, mod_proxy is effectively the same as mod_lisp for hunchentoot's purposes. mod_lisp is not an embedded interpreter in Apache.

<comment><USER5> TBNL could speak HTTP directly too. I'd be interested to see a mod_lisp vs mod_proxy benchmark with Hunchentoot.

</comment></comment></comment></comment><comment><USER6> Did anyone else notice this on the same site?

<http://www.newartisans.com/blog_files/ready.lisp.on.osx.php>

Zero fuss way to get started with Common Lisp on Mac OS X. Aquamacs bundled with SBCL, launches immediately into REPL at startup. I will recommend this to anyone who wants to learn Lisp on the Mac.</comment>


Why staying logged in to your FB/Twitter is dangerous - <AUTHOR> http://finance.yahoo.com/family-home/article/112769/like-button-follows-users-wsj The seemingly harmless "Like" & "Tweet This" button on the websites you visited can be used to track your browsing habit even if you never click on them <comment><USER2> This doesn't seem to be the full story. If I log out of FB I still have multiple cookies for the .facebook.com domain (e.g., c_user, which seems to contain my user id).

The like/comment/etc. 'widgets' are served from facebook.com, so presumably they are still tracking me.

Don't know why this article didn't mention Ghostery or <http://disconnect.me>

<comment><USER3> You could also use multiple profiles (at least in Firefox), one for browsing around and one for social network sites.

In that case there will be guaranteed no cookie cross-pollution as the sites are completely isolated from each other.

Just logging out is indeed simply ineffective.

<comment><USER4> If only... Facebook uses a Flash LSO, which is of course shared between browsers.

<comment><USER3> "of course shared between browsers"

Is it? Are saying that the flash crap doesn't distinguish between browsers/profiles?

That's another very bad security problem with flash. For me, it's the final straw. I'm going to wipe flash from all my machines now.

</comment></comment></comment></comment><comment><USER5> It's not really "dangerous", it is just that you give a bit more information to FB/Twitter/$SocialCompany than you thought you would.

While, I usually logout of FB or Twitter, I have a few adblock rules to block them on other webpages. It works fairly well... If I want to like and share, I believe I can do it manually...

<comment><USER6> From what I gathered in the article, logging out doesn't solve the problem. The cookie works if you've logged in anytime in the last month

<comment><USER4> Also, Facebook uses a Flash LSO. You have to clear that to really be logged out.

<comment><USER5> I don't have Flash :D

</comment></comment></comment></comment><comment><USER7> They couldn't have published a more obvious story. Anyone with any sense doesn't log into either service and you don't need to be logged into either service for them to track you. It's amazing what freely available information (your IP, the sites you visit, etc) can do to help turn you from an aggregate anonymous identity into a fairly well "guessed" identity. And since webmasters carelessly litter their sites with this third party crap, they can build up a significant database of the places you've visisted and your habits, without knowing much else about you.

The first thing I did when Facebook rolled out all of that garbage was redirect everything facebook related to localhost and then created adblock/element rules to filter out all twitter and facebook buttons, tags, etc. I even filter out the whole "facebook discussions" crap that are attached to seemingly 80% of pages, these days.

Then again, I guess the public lags behind such things. I'm sure there are people out there just today learning what a cookie is, so . . . _~shrug~_

<comment><AUTHOR> Yeah, most people would think that those buttons on the sites they've visited won't do anything unless they click on it. So yes, this is an obvious story to some, but also a "why didn't I think of that!" moment for the rest. just sayin. ;)

<comment><USER8> I have to agree. A vast majority of people don't know about this, and the one who I have mentioned this to don't seem to even care.

</comment></comment></comment><comment><USER9> Ironically, the article's header has Facebook "Recommend" and Twitter "Tweet" buttons. The Facebook one has 4,000 "likes" and the Twitter one has 235 Tweets.

</comment><comment><USER10> Link to original story:

[http://online.wsj.com/article/SB1000142405274870428150457632...](http://online.wsj.com/article/SB10001424052748704281504576329441432995616.html)</comment>


Programming Languages and their Celebrity Equivalents - <AUTHOR> http://www.brandnoo.com/2008/04/07/programming-languages-and-their-celebrity-equivalents/

<comment><USER2> The list doesn't really make any sense, which would be okay if it was funny, but it isn't.

</comment><comment><USER3> I don't even like Rails, but comparing it to Paris is just mean.</comment>


Guide to Internal Communication, the Basecamp Way - <AUTHOR> https://basecamp.com/guides/how-we-communicate <comment><USER2> It reminds me of how the Wordpress team works. I cannot find the source, but from my memory, they use long form writing in Wordpress to build Wordpress. Each team member writes up what they are working on, publishes it to an internal Wordpress site, and reads and comments on what others are working on.

Amazon is also another example of using long form writing - specifically in the context of meetings. [0]

[0] [https://news.ycombinator.com/item?id=5703147](https://news.ycombinator.com/item?id=5703147)</comment>


HOTorNOT Reverses Course On "Reinventing" -- Back to Paid Accounts - <AUTHOR> http://mashable.com/2007/09/18/hot-or-not-3/

<comment><AUTHOR> The Full Email

\--

Dear loyal HOTorNOT star members,

Based on feedback we got from many of you, we have decided to start requiring star memberships on HOTorNOT again. While many of you saw how going free would be good, you also warned us that this would probably lead to more spammers and fake profiles.

You were right, this is exactly what happened. The spammers got aggressive to the point where they were screwing up the system, even causing the "someone wants to meet you" emails to not be sent for periods as long as 5 days.

We don't really regret trying to make the site free so everybody can use it, but it's clear that most of our users believe an inexpensive paid site works better than a free site filled with spammers.

If you left the site after we went free, we hope you'll come back and join again. If you are still here, we hope turning subscriptions back on has a noticable impact for you, helping you meet more people without having your time wasted by the spammers.

thanks, and have fun!

Your friends, Jim and James :)

</comment><comment><USER4> James Hong's Reply to Valleywag's post of this story

Tim, Instead of just making assumptions about what I was thinking, you could have just asked. We don't keep anything we do at HOTorNOT a secret, in fact we're tragically transparent. Were the assumptions I made 3 months ago wrong? I'm not sure, they might be.. but even if they were wrong, I would have no problem admitting it. Sometimes we are right from the get go.. sometimes we are wrong and have to readjust.

The truth is that I still don't think an advertising model was the wrong thing to pursue. The fact that revenue was already 1/3 of what subscription revenues used to be was a promising sign, because that was all generated using Adsense... selling direct would likely have landed us making more than before. Of course, it would have required a lot of hardwork, but I think it would ultimately have worked out.

No, this decision was not based on business models, it was based on us realizing that worrying about your user experience is more important than how you monetize. If we lost all our users because of the spammers, it wouldn't really matter which business model we chose to apply, right?

As for other free sites being able to deal with the spammer problem while we were not, I really can't say why. Maybe they're smarter than us, or in most cases, still too small to attract the attention of spammers... or maybe they do have a problem but it's just not apparent because they don't talk about it?

I don't know. I don't have insight into their systems, and it is always a presumptuous and unintelligent thing to do to make conclusions about other people's businesses without having any data. So was I wrong 3 months ago? I don't know yet. For all I know, I might be wrong NOW, switching back. What I do know is that until we are confident that we can effectively fight the spammers off without having to charge, we have to keep charging.

But lets be honest.. I'm not going to feel too bad about that, either. Even when I was in the 9th grade flipping burgers at Burger King for $3 an hour, I wouldn't have complained about paying $6 a month for a service that connected me with lots of hotties.. and we got a lot of feedback from women that any guy too cheap to pay $6 was probably not the kind of guy they wanted to date anyway (our system only requires 1 of 2 people to be a paid member for them to communicate.. so even under a subscription model, our site remains effectively free for most women) james

<comment><USER5> What Valleywag has discovered is that they don't have to bother getting things right in order to generate a lot of page views. They're like a troll in that respect.

I wonder if they started out with this plan, or if they just discovered it by being careless and noticing it didn't hurt their traffic.

<comment><USER6> They certainly aren't the first "journalists" to use the trolling tactic. Dvorak and Orlowski are two other examples that come to mind.

<comment><USER5> Mm, yes, and Donna Bogatin. She was beating on us for a while, but she seems to have stopped. What's distinctive about Valleywag is that it's a site and not just an individual.

Maybe we should make up a name for them. Journotrolls?

<comment><USER7> trollporters

<comment><USER5> That's better. Trollporters it is.

<comment><USER8> It's really not. Trollporter - some big green dude who carries bags, or a futuristic way for troll folk to travel instantly. I suggest Journatroll, it rolls of the tongue a little better than Journotroll. As a plus its fairly easy to work Journatrollism into a sentence where you would have said Journalism.

<comment><USER5> Hmm, maybe journatroll is better. A lot of these people aren't really reporters, more editorial writers.

<comment><USER9> reportroll

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Interesting. Sometimes you need charging as a design feature, not just as a business model.

<comment><USER11> That's not entirely true. Charging is an easy out for handling spam, but lots of companies handle that sort of thing technically. There's one of two things happening here:

1) Hot or Not doesn't have the technical chops to reign in the spam.

2) Hot or Not isn't comfortable with the free dating model anymore, but wants to blame the switch back on something people might have sympathy for.

I actually would bet on the latter, but if it's the former (as they claim), I might be more worried about their future.

<comment><USER12> Is there any free dating site with the 'technical chops' to reign in spam? So far as I can tell, none of them overcome spam directly via technology.

eHarmony - <USER3>

Match.com - <USER3>

Myspace - Gets spam; though it's less of an issue because it seems like spammers haven't been able to figure out how to emulate a typical real profile, and because many people use the site to connect with people they know already. In other words it's not technology or effort from Myspace, it's that the model is different.

Facebook - Pseudo-dating site, like myspace, plus it has additional restrictions on creating an account.

Any other dating site I've seen has spam all over the place.

<comment><USER11> OkCupid.com's pretty good about it. Maybe I'm biased.

Also, dating sites aren't the only sites susceptible to spam. Craigslist would probably be a spammer's heaven if they didn't have such great community filtering features.

<comment><USER12> You're right, Craigslist is a good example. But even there there's enough phishing going on that I'm not comfortable using the dating section. I've had success finding apartments though.

The difference with dating sites, though, is that they only work when members are active, aggressive, and open with their personal information. They work best in a way that spammers will rush to exploit, at which point everyone gets frustrated and stops using the service. This doesn't stop spammers, and pretty soon the ratio of valid profiles to fake ones is ridiculously small.

<comment><USER13> More importantly, Craigslist uses pay to filter spam in other ways: real estate and job listings.

In that case, it was "asked" for by the users.

</comment></comment></comment></comment></comment></comment><comment><USER14> Too bad they already hired a bunch of developers for the revolution and paid them with a huge chunk of the company. When a leader raises an army, he had better go to war.</comment>


100+ new features on Google+ - <AUTHOR> http://googlemobile.blogspot.com/2011/09/google-101-102-103-104-105-106-107.html

<comment><USER2> Nice to see quick and continuous iteration on the mobile app.

Points I took:

\- Hangouts have now subsumed Facetime into a really great group chat.

\- A lot of small tweaks that bring feature parity to the mobile experience.

\- Huddle renamed to Messenger, and added photo sharing support. If they add access from the web or from gchat or something, I will be much more interested in this.</comment>


Adding Mainline Arm Frame Buffer Compression Support for Rockchip - <AUTHOR> https://www.collabora.com/news-and-blog/blog/2020/04/08/adding-mainline-arm-frame-buffer-compression-support-for-rockchip/ <comment><USER2> From that sample buffer, it looks like this is just some sort of RLE?

What happens in the "worst case" for compression? Does that just mean you can't hit your fps budget?

<comment><USER3> It is as much or more about saving power by reducing costly traffic to the external RAM. For the pathological cases where you don't compress you simple don't save power, on average you do.

<comment><USER2> Good point. I hadn't imagined that particular case.</comment></comment></comment>


Freedom 251 $4 Smartphone is Sketchy as Hell - <AUTHOR> http://www.androidauthority.com/4-dollar-freedom-251-smartphone-sketchy-674506/ <comment><USER2> 99.999% chance it's a scam to collect the money and run, or to collect the money and earn interest, then refund.

There's a very little chance the phone is subsidized in some obscure way, but I doubt it.</comment>


Ask HN: Why do SaaS companies display their hosting company's logo? - <AUTHOR>

I've seen this frequently, particularly if the company is hosted with Rackspace. What's going on here? Why are Saas companies advertising their hosting provider?<p>For example: http://i.imgur.com/2rjbA.png <comment><USER2> Referral fees would be an easy explanation. Another reason is that SaaS companies, particularly in the enterprise space, need to reassure their customers about the quality of their infrastructure, reliability and redundancy. So if the servers are hosted in Equinix instead of under a developer's desk, it conveys a level of security and competence that the company's brand should benefit from. I have never seen a Rackspace facility, so I don't actually know what they are like, but the Equinix datacenters I have been to are better than any major corporate setup I've seen.

<comment><USER3> I agree with the trust aspect, even if most consumers wouldn't recognize the RackSpace brand.

Another explanation could be: it's an easy way to fill up some whitespace in the footer.

</comment></comment><comment><USER4> We <http://www.forty.to> as part of winning a place in the Rackspace startup program, receive $2000 dollars of Rackspace services per month for a year. But, as part of the deal, we display the Rackspace logo on our home page. From our point of view, it's a great deal.

<comment><AUTHOR> How do you enter/win that? I did a quick google and found some cursory information about it, but nothing about entering or applying.

<comment><USER4> Open the page...

<http://www.rackspacestartups.com/>

Click on any one of the links, say "500 Startups". Fill out the application form, and you're off to the races.

Good luck!

<comment><AUTHOR> Awesome.

I'm not sure I'm quite understanding the process. All these links appear to be seed funds, VCs, etc. Am I applying for investment capital when I fill out these forms, or just for the $24k of hosting? Do these people take equity, or what do they get out of it?

There seems to be so little information provided!

<comment><USER4> You are applying for $24k of hosting nothing else. They take no equity. In return you place a Rackspace logo on your home page. It's a very good deal.

What Rackspace gets is exposure, good karma, and nothing more.

The good karma, however, goes some way in ensuring you stay with Rackspace when the year is up.

PS: Yeah, there's little info provided. I heard out about it through word-of- mouth, Will Perkins at ezeep, and applied right away.

<comment><AUTHOR> Gotcha! I'll be applying for this then!

Just one last question: why are the details sent to a seed fund or VC? The thing that's really confusing me is the affiliation with these funds.

<comment><USER4> The details are not sent to a seed fund or VC.

The various links 21212, 3 Day Startup... confuse me too. AFAIK they are only groups Rackspace has a relation with. The links 21212, 3 Day Startup... all go to the same application form, save the image about the form.

<comment><AUTHOR> What a strange system!

Thanks for letting me know about this. I really, really appreciate it!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I once heard that some of them get a discount on hosting if they display the Rackspace logo.

</comment><comment><AUTHOR> I emailed FreshBooks and asked why they do it. I got the following reply:

Hey Matt,

I can't really speak to why everyone does it, but Rackspace has provided us with amazing service so I think its something of a hat tip in recognition.

Have a great day Matt,

\- John

</comment><comment><USER6> In some cases, because everyone is doing it.

Otherwise I am pretty sure they have some kind of partnership that are built on foundation of hosting for advertising.</comment>


What Made the Aeron Chair an Icon - <AUTHOR> http://www.fastcodesign.com/3057277/what-made-the-aeron-chair-an-icon <comment><USER2> The article talks about the design choices as the reason for success but I think the expense of the chair and need to perceive some related value caused the, in my opinion, over-rated reputation, coders attributing their 14hr marathons and their 10x factors to some chair, in some instances their new physical posture, tone and health all due to the magic of a $1000+ chair.

In my experience having worked in an office which was all Aeron chairs for several months I feel no different now on this $100 office mate chair or any of similar priced chair at the various co-working places I visit. I should note too Im not exactly in great shape.

tl;dr - price and talk made the Aeron chair an icon

<comment><USER3> 100% agree - it's a status symbol. Anyone remember the "consulting" that came with it to learn the 1000 different adjustments? Dot-com at it's peak.

I added an adjustable-height keyboard tray screwed into the bottom of a desk and it will give anyone much better ergo than any chair alone.

Each time I get one, I replace it with a patio/lawn chair (+keyboard tray) and cut the legs to my height - those are actually designed to be sat in for hours. The first time my boss was a bit perturbed until I put the "extra" chair in his office.

A copy of the AIA Graphic Standards Manual[1] has charts for work tables and desks shows just how wrong not having a keyboard tray is for ergo.

[1] [http://www.graphicstandards.com/](http://www.graphicstandards.com/)</comment></comment>


Binary Search Is a Pathological Case for Caches (2012) - <AUTHOR> http://www.pvk.ca/Blog/2012/07/30/binary-search-is-a-pathological-case-for-caches/ <comment><USER2> This article demonstrates why performance intensive software systems (like database engines) implement many of their own data structures and algorithms, often not even reusing those implementations internally, and avoid standard libraries for many use cases. The suboptimality of any particular use case can be quite large relative to a purpose-built implementation for that spot in the software. It is a lot more work but it can also dramatically improve real- world throughput and variance because you have visibility into exactly what the access pattern will be.

If you measure these things at large scales you will see surprisingly smooth and regular constructive interference patterns that emerge from the interaction of boundary constants in the software and hardware. This is a difficult type of variance to eliminate. That obvious solution is to inject pseudo-randomization into scheduling and boundary constants. This dampens the patterns but even if you turn the randomization knobs pretty high the patterns do not go away! And you can't go too crazy because that randomization has its own performance costs as the algorithms move further away from their theoretical optimum.

Some latency hiding computing architectures, like barrel processors, actually hash memory addressing in hardware to eliminate locality so that you do not see these kinds of locality and aliasing effects. However, most modern CPUs are specifically designed to exploit locality so this technique generalizes poorly.

</comment><comment><USER3> This to me signals that our hardware is just not designed for the kind of workloads we actually want to do. Trying to control cache lines is akin to trying to drive a car from the back seat using a hanger, a pool cue, and rope. You can do it, but why not get in the driver's seat? Sadly, the modern CPU doesn't let you have the type of explicit control you really want over the very fast memory here. You are always at the mercy of some specifics of how the automagic works.

This is where a GPU or a co-processor would be nice. When you can dedicate hardware and memory (cache and RAM) to specific processes, you get to write algorithms that can fully take advantage of the hardware. This can be very useful where, for example, you run a database server: you don't care about random other tasks being extremely fast: bash, cron, STMP server, etc. can all take a long time, but the all-important database should be very fast. And that's when you can run its sorting algorithms on a few dozen dedicated cores where you are allowed to directly place data into the on die cache (which would no longer be cache, but just another time of RAM).

<comment><USER4> Manually managing the cache would defeat the purpose of a cache. Computing with what to fill the cache and filling it would likely take more time than handling cache misses.

Even specifying the caching strategy (whether it be associativity, eviction strategy, or something else) seems very unlikely to be beneficial to me. Caches are fast because they are hard-wired and close to the registers. For them to be useful, they need to be able to decide in the blink of an eye whether a value is already present or not. Doing that in software would be absurd. That is why the CPU vendor tries to find a strategy that performs well in a broad range of scenarios.

I have no idea what GPUs have to do with this, but co-processors are nothing new. What you are describing is a NUMA system with all the background stuff pinned to one node and your actual workload to the other (or both).

EDIT: Also, 99.9% of the time, the CPU is better at caching than a human could hope to be. You don't know the input data in advance, how you want to know what caching strategy would be optimal? From what information do you draw conclusions as to how the cache should behave for optimal performance? There's a reason programmers don't manage registers manually (because the compiler is almost always better at it), what gives you the impression that managing the cache manually would have a positive outcome?

<comment><USER3> While what you are saying is true for caches, I am talking about a CPU architecture where the near-die memory is not a cache at all. If I can request that my process get direct access to what used to be the L2 cache, with, let's say, a capacity of 4 MB's, I could then place my 2 MB array that needs sorting into it, and sort it without ever leaving L2. I then relinquish control over this fast hardware buffer, so the next process can use it.

There are of course a lot of issues with this model in a time sharing multiprocess OS: how do you request access, how do you ensure clean allocation, etc.? Those are problems that would need to be resolved. This does work well in PIC's: you get some small amount of RAM (something like 64-512 bytes), and then you can attach a separate RAM chip via i2c or SPI. Perhaps if a CPU die was surrounded by a reasonable number of such buffers (something like 16 x 8 MB), we could write completely different type of code.

</comment></comment></comment><comment><USER4> This article is a great example of the very tangible effects caused by hardware properties that are often disregarded. Very interesting read!

Also, I can't help but note the (probably non-existent) connection to 3-way partitioning for quicksort (which is consistently ~10-15% (iirc) faster than traditional quicksort). It is interesting how we seem to assume that surely factors of two must be the best choice, computers working in binary and all. But sometimes this is true only in theory, but not in practice (binary search), sometimes it's good but not optimal (quicksort), and sometimes it outright is the provably worst choice (dynamic arrays)!

</comment><comment><USER5> I wish the author included data sorted in a van Emde Boas layout, which should be the cache-friendly equivalent of a sorted array to be searched with binary search.

<comment><USER6> I believe it is rather memory hungry.

</comment></comment><comment><USER7> Personally, trying to automagically cache controlled at the hardware level has... issues. It far too often is/becomes a leaky abstraction.

The problem is that hardware is too inflexible. And trying to explicitly manage things in software, that is from the operating system, has other issues. It's expensive, both in terms of time taken for the context switch / etc - and it tends to wipe out a large chunk of cache too.

Modern processors are mainly cache, in terms of die area. There's plenty of room for adding new bits and pieces if it helps speed things up.

So, what's between the hardware and the OS? Well, what about an FPGA? So you have the hardware read cache if present, but have the FPGA make the decisions about how to manage the cache. What to keep, what to toss, that sort of thing. This FPGA could also be used for basic system calls / scheduling, and perhaps even for specialized disk access (read: something like "this process can read in this range without consulting the OS") (As OS time can be most of the latency when reading from an SSD.) - with a system to fallback to a full syscall if necessary.

You could perhaps even implement the branch prediction unit in the FPGA.

</comment><comment><USER8> old reddit thread : [http://www.reddit.com/r/programming/comments/xe1zz/binary_se...](http://www.reddit.com/r/programming/comments/xe1zz/binary_search_is_a_pathological_case_for_caches/)</comment>


Optimizing Your Industry to the Point of Suicide (2012) - <AUTHOR> http://www.baekdal.com/opinion/optimizing-your-industry-to-the-point-of-suicide <comment><USER2> I have really mixed feelings about this. On the other hand I dislike this method of selling games but I also understand that it is rather difficult to make money selling $1 games. And a $5 price tag in the market doesn't work for most games (the exceptions seem to be ones that are coming from PC/consoles: Grand Theft Auto games, Minecraft and Final Fantasy games sell for $5-$15). But this micro transaction trend has been getting out of hand, this is already the second article on the subject on HN this week.

I play a lot of simulator games, which have a lot of after market content. Flight simulators have a lot of 3rd party vendors who create additional aircraft and scenery (an aircraft may cost around $30 or more). The most popular train simulator has additional 1st party content, trains and routes which total up to $2000 even after discounts in Steam x-mas sales. The racing simulator I play has a subscription model and cars and tracks cost extra ($50 a year + $12 per car + $15 per track). But these pieces of extra content are very high quality and are accurate visually, historically and performance wise. I have no problem spending $10 to $30 every now and then on this.

But there's a stark difference between additional content in simulators (which obviously costs money to create) and a pay-to-win IAP gaming model. In p2w games, there's a hidden subscription fee because you essentially have to pay every now and then to stay in the game and not have to wait for ages (e.g. real racing android game requires you to buy new tires every few races, or wait for hours) and a price on additional content which is usually nothing but a piece of artwork (which is cheap to create in contrast to the accurate simulator content). The biggest problem with this is that these games are labelled as "free" while in reality you pay subscription + extra for additional content.

I would actually like to pay for games on my mobile, but I don't want to play games that where the whole game design is optimized for maximum IAP profit rather than maximum fun. But when browsing the Android market for games, you just can't find any interesting games that do not employ this IAP pricing model.

<comment><USER3> Apple, as gatekeeper had (has?) the opportunity to fix this.

They should not be listed as free games. Free games should be listed as demos.

In-app purchasing should be limited to unlocking discrete chunks of game- play... not 'coins'.

There should be a way to buy the game outright instead of freemium.

Essentially, we're back to where we were with video arcades, before consoles at home gave us unlimited play.

Video arcades died... Freemium games need to die too.

Apple has a noose of very bad karma around it's neck because of this.

<comment><USER2> > Apple, as gatekeeper had (has?) the opportunity to fix this.

Why would it be in Apple's interests to prohibit micro transactions in games? On the contrary, they do make a 30% cut of the sales, don't they?

Even if Apple did change their policy, there's still Google, Amazon, Russian Yandex and Chinese app stores that do allow this. If Apple (or anyone else) disallows this, the game publishers will release their stuff on the markets that do allow IAPs.

Although it seems like Apple have had some bad PR and having to refund some (32M$ !) of kids' purchases: [http://news.cnet.com/8301-13579_3-57617270-37/apple-to- refun...](http://news.cnet.com/8301-13579_3-57617270-37/apple-to-refund-at- least-$32.5m-for-kids-in-app-purchases/)

> Apple has a noose of very bad karma around it's neck because of this.

Only some gamers complain, this isn't really hurting Apple's image as a whole enough to make them take action.

I'm guessing this phenomenon will die by itself given some time. Gamers and parents are already revolting. When more parents will prevent their kids from using their credit cards, a (major?) part of the money supply will run dry and the game publishers will have to come up with other business models.

</comment></comment></comment><comment><USER4> This is a natural outcrop of the everything is free/cheap zeitgeist. The demands from users for game quality far outstrips what they expect to pay for them, so if you charge high they will just not buy it or find a loss leader and play their game - they are all almost perfect replacements for the average user after all. If a small amount of people want to pony up $100+ per title then it might work, but there is something to be said for high volume low cost.

At the risk of being crass, the online porn industry has gone to this model as well. They give a significant amount of free teaser video leading up to what would be the climax of the scene, only to cut away to an ad or just outright end.

I would assume it is working the same as with freemium games.

</comment><comment><USER5> The thing that ultimately limits this strategy is people get far more excited about paying up-front for a "thing" that is play-oriented, whether it's marketed as a professional tool or a game. When you lead with monetization, you have to actively cut out regions of play so that feedback loops related to monetization can dominate.

With F2P microtransactions in the context of a single player game(multiplayer adds social value effects), the hope is, essentially, that people are too uninformed to take control of their own play experiences. Everyone who would consider themselves a games enthusiast essentially lives in a different world - even if they're addicts, they know how to satisfy their addiction at lower cost, and often with more ability to customize the experience.

</comment><comment><USER6> Isn't this kind of a supply and demand thing? There is plenty of demand for indie games and fantastic indie games get created frequently enough (e.g. Hyper Light Drifter, Dustforce, FEZ [I know, I know]). If you want to change the medium for the better, the most permanent solution under Capitalism is to change what people will pay for.

This article harks on mobile games a lot. Why do you need games on your phone? More artistic, less crass games appear on systems like the 3DS, and PCs. If I really wanted an art piece of a game on my hypothetical iPhone, I would try to make one myself.

I do disagree with micropurchases in children's games. They just don't have the thinking power yet to realize what they're dealing with. That's a more pertinent moral question, I think.

</comment><comment><USER7> Another rant on IAP in the games market.

Here is the sticking point for me, if its suicide then great these things will fail and like the original DivX idea it will be some cautionary tale in the past.

But what is really the rant? Is the rant it costs me more to play this game? Is that it? Your $5 game is not as entertaining for as long as your $50 game? I agree that the nickel and diming is annoying but they offer the "big bag of tokens" for some big price $50 - $70. If you buy that you can whiz right through things, and they don't "re-lock" so in the case of the racing game the cars are there forever, except you had to pay $50 for that game instead of the $1 - $5 you thought it cost.

<comment><USER8> When I think how much money I spent sinking quarters into Galaga at the local diner as a child, I just can't feel that bad when people complain about Candy Crush charging $0.99 for another 5 lives to people that are too impatient to wait a couple hours for the free set. Is that _really_ so exploitative? Meh. I played past level 100 on Candy Crush without spending a cent, which is probably dozens of hours of gameplay.

The market _is_ speaking pretty clearly: it is not even close to profitable to make premium casual games, the group of hardcore people that are willing to pay up front is way too small to make it worthwhile. IAP lets you get many more people enjoying your game, and you make a lot more money doing it, which is IMO a win on both ends. I get that a lot of gamers _hope_ these games will fail, but as of right now, this is the most profitable and fast growing sector in the games industry, so I'd be hesitant to predict its downfall yet.

If there was some magical way to get the same number of mass market users to pay a fair $5 up front for games (hell, even $1 would be great), every one of us in the game industry would be thrilled to hear it, because it's much easier to make premium games than freemium. I'm open to ideas, but I haven't heard many realistic ones.

Disclaimer: I work on F2P games (not for King), so take all of this with a grain of salt based on self-interest.

<comment><USER9> How many people/kids were willing/allowed to sink that much money into Galaga? It was not mainstream hobby.

At least, my parents taught me it is not wise investment and I plan to teach my kids the same about level ups in seemingly free games.

Speaking about exploitation, I recall one especially ugly example. A game with kiddy graphics and story had crying Bambi 10 minutes into play. You came there and Bambi told you that he is dying and the only way to save him is to pay money. If this is not emotional manipulation I do not know what is.

<comment><USER10> Do you have a link for further reference.

</comment></comment></comment></comment><comment><USER11> Has anyone looked at applying this to the non-gaming market? I'm guessing the emotional attachment isn't as much but you are still attached from the time you have invested.

Let's take Word for example. You write a three page document, you want to save it? That's $1 please. Printing? That's another dollar. Oh you don't like Cambria? You can unlock Times New Roman for $10, or our Business Serif Pack for $49!

I guess it's similar to shareware, but more annoying...

</comment><comment><USER12> As much as I also dislike how some IAP game developers base all their gameplay mechanisms purely on maximizing the user likeliness to keep spending without even noticing, I recognize that they get the very basics of video game design very right.

Because they have to.

The goal for any game developer who treats its creation not only as an artistic piece but also has a product, is to design software that offers a positive feedback loop to the user in order to keep her engaged.

Consider how Nintendo, for instance, considers the Mario platformer franchise as an instrument (see Ask Iwata interviews). During development, designers are focused on getting the timing (rhythm) right between challenge (say ennemies or holes) and corresponding rewards (powerups or secret exits). This ultimately plays/tricks how our brains are wired (effort needs reward) in order to engage users and ultimately enjoy the game... and pay again (and again) for the sequels/updates when they need their fix.

Imho IAP is an interesting return to the origins of video gaming (and coin- based arcades) and refocuses the industry on getting the core ingredient right, the feedback loop, rather than betting it all on graphics, story, feature-creep... and marketing.

Marketing is important when you need to convince your game is worth paying upfront, even in a seemingly minimal amount, as mobile gaming is a very "dispensable" expense in the general public.

There is no ROI in marketing an IAP game that does not engage enough of its users (enough). On the other hand, marketing heavily an upfront-cost game can draw sales, sometimes thanks to the franchise name as well, despite providing no to little entertainent to most of its users as the feedback loop is just not good enough to engage them.

For good or bad, I think IAP is accelerating adoption of data-driven practices for video game design. As an engineer/scientist, this is very interesting.

Last but not least, IAP probably helps expand the (mobile) gaming audience to people who would have otherwise either not played game(s) at all or would have downloaded illegally.

In the long term, I believe this can only be good for the industry. The bad parts of IAP will be regulated by better consumer protections for the worst "abuses" and more naturally over time by the users themselves as they get more familiar with the model and more "meaningful" IAP titles become available.

</comment><comment><USER13> It's not exactly moral but it's basically convincing people to pay for very extensive entertainment.

People want to believe that people are smart enough to figure out that this is a bad deal but they're not. Welcome to reality.

</comment><comment><USER14> Another thing to teach my kids about personal finance.</comment>