Linode Manager Two-Step Authentication - <AUTHOR> https://blog.linode.com/2013/05/02/linode-manager-two-step-auth/

<comment><USER2> After being bitten the first time with Linode I don't care what technical measures they are taking. I want to know what process and policy changes have been made.

Do they still store public/private keys on the same server ? How often are they doing security audits (which clearly never happened before) ? Are they still going to be dodgy and withhold key information from their users ? Are users still going to find out hackings from IRC/Reddit rather than Linode itself ?

Two factor authentication would have done NOTHING to prevent both hacking attempts.

<comment><USER3> I also find it really troubling they haven't released a "Here's what we're doing different" blog post in response to the attack. Their only blog post on the matter came a week (2 weeks?) after the intrusion, which they were of course pressured to release after everyone found out via a pastebin IRC transcript... By chance I happened to sign up for my first Linode account the day before that hit HN.

I hope their silence on the aftermath is due to an ongoing investigation with feds, or something, where they can't talk about it yet. Do they think their customers are stupid and will forget the incident?

Imagine if AWS had a security breach of that magnitude. They would release an initial 4000 word blog post in grave technical detail, and then follow up with a 25 page white paper, or whatever.

Oh, and to stay on topic, I tried Linode's 2-factor with Google Authenticator and it works well.

<comment><USER2>
       Do they think their customers are stupid and will forget the incident?

Yes. They have done it before and people on here still recommend them with a straight face. It honestly confuses me that people care so little about security.

<comment><USER4> I'm one of those people who have a slight interest in the security but don't know enough about it to be properly informed about my own decisions.

For people like me who basically can't make my own decisions properly, where should I switch to? Is DigitalOcean better in this regard?

<comment><USER5> Digital Ocean is largely untested in this regard.

<comment><USER6> And that's the real issue

Two factor auth addresses the user password as being a weak link, and this is a nice step

Oh and btw, yes, the private keys were on the server, with a passphrase

</comment></comment></comment></comment></comment></comment><comment><USER7> I left Linode after 5 years of being a customer because I can no longer trust them. I let the first issue slide as I thought they would learn and communicate better to their customer base but the second incident has shown they learned nothing.

Security issues will happen with any provider it is all in how a provider communicates and remediates those issues. Linode has shown it will not communicate thoroughly and does not talk about any remediation so why would you trust a company like that with your data?

The last incident was extremely sad for me because I thought I was using a company that I had a good relationship with. I could care less that CC details were lost as CCs are easily replaceable and protected against fraudulent use. What they lost was my trust which is far more valuable that my credit card number.

<comment><USER8> Out of curiosity, who did you switch to? I would leave too (after being a customer for nearly 8 years) but I'm having trouble finding other providers which don't have their own set of issues.

<comment><USER7> I have been testing/working with a few different providers. The three I'm currently working with the most are Ramnode, Gigenet and DigitalOcean.

Ramnode's panel is SolusVM which isn't as good as Linode but their performance blows Linode out of the water. They have ipv4/ipv6, multiple locations (Atlanta and Seattle) and a good owner who seems very open/honest with customers. I expect we'll see feature enhancements as they grow bigger.

Gigenet Cloud has multiple locations (Chicago and Los Angeles), ipv4/ipv6, good performance, good custom panel and a company that has been around for a long time. They use a SAN for all their nodes. Overall one of the most underrated cloud providers out there. (Note: I got free credits for beta testing their cloud)

DigitalOcean has multiple locations (San Francisco, New York, Amsterdam), a decent custom panel (would like to see more statistics and it seems a good staff. They did have a security issues that they seemed very open about ([https://www.digitalocean.com/blog_posts/resolved-lvm-data- is...](https://www.digitalocean.com/blog_posts/resolved-lvm-data-issue))

Other hosts I have tested/used but did not choose:

Rackspace - Excellent panel, ho-hum support/performance. My biggest issue is they lock instance throughput and refuse to change that. If you have a 512 instance you are locked to 20 mbit which doesn't make sense as you are billed per GB. I asked to have this unlocked as my instances push more and they refused.

Amazon AWS - Great interface but the lack of ipv6 (unless you buy ELB) and poor performance had me look elsewhere.

Others tested/used:

Joyentcloud, Terremark, Zerigo (Was a long time customer but they went downhill when 8x8 bought them), Voxcloud, Cloudsigma , Azure, HP Cloud, Stormondemand (Another good cloud provider that just didn't fit with me), VPS.net, Gandi

<comment><USER9> Great post. I'm interested to know which you end up ultimately choosing. I just worry that ramnode and digital ocean won't be able to keep their current price model and still maintain quality service in the years to come.

</comment></comment></comment></comment><comment><USER10> I find all the whining of all these armchair security experts a bit wearing. No one outside of Linode and the alleged hacker knows exactly why and how Linode was hacked so quit speculating, you are simply making things up. "Ooh, this is a bad thing, I bet Linode did this bad thing". For example people are suggesting that 2FA is useless if outsiders had free run of Linode's infrastructure, and so it would be. BUT, is there any evidence whatsoever that this was the case? If not then STFU and stop spreading lies. 2FA is useless against a nuclear strike, what exactly is the point of saying so? Anyone can fantasise disasters.

To get some positive content out of this thread. Is there a VM provider with a provably better security record than Linode?

If you are going to stay with Linode then 2FA seems like a no brainer. So, is there a simple way to get the 2FA iDevice systems (Google, Duo) to work on multiple devices, say to allow an iPad or an iPhone to be used interchangeably?

</comment><comment><USER11> Wow, this is great.

It would be nice if they let you set up SSL cert + MFA + password. I am kind of angry that modern desktop browsers continue to make SSL certs suck so much, but they're decent on mobile. I hope a future version of OSX builds in great cert management and UI/UX with local biometrics or something.

</comment><comment><USER12> I was hoping for Yubikey support. But I'll take this for now.

I'll have to see if the Google Authenticator app shows up on all of my iDevices linked to my Apple account and whether the code from any of them will work (from the setup process, I don't see why not). Does anybody know?

If the app will work from any of iDevices, it would not be secure enough for a service storing bitcoins :) because the second factor should be hard to copy (which a real hardware token is, while a software token isn't).

<comment><USER2>
       it would not be secure enough for a service storing bitcoins

Linode was hacked twice (once where Bitcoins were stolen) in recent times and was shown to have the worst security practices I've ever seen. They have never been secure enough for storing Bitcoins.

<comment><USER13> Are you serious??

What you were doing is the equivalent of living your wallet in a public place unattended, and then shouting and screaming it got stolen. You are putting your bitcoin wallet on a public accessible server, you should know the risks of this by now.

Don't leave your wallet in a public place unattended, that includes your bitcoin wallet.

Let me guess, you didn't bother to encrypt your wallet either, didn't you?

Don't blame others for lack of security, if you can't even figure out your own security best practices...

<comment><USER2> Are you replying to the right person ?

I don't own Bitcoins. And if I did I would never, ever host them on a Linode server.

</comment></comment></comment></comment><comment><USER14> Not everybody owns or wants a smartphone. Linode needs to extend this to some non-smartphone device, like YubiKey, or offer SMS codes, like Google Authenticator. This is a step in the right direction, but is ultimately disappointing for me.

<comment><USER15> I have to imagine the overlap between Linode customers and smart phone owners was so large (and the cost of implementation so low) that leaving out hardware authenticators makes sense for v1.

<comment><USER11> One area where hardware authenticators work really well is where you want to split access to an account, or have some accountable/logged procedure for it. You put the physical token in an envelope and in a safe/put it in the control of a finance person. Tech people have the password, but need to request the token to do logins.

This also requires having role accounts which aren't able to reset authentication settings when logged in, though, to really be good (or else you just disable tokens on first successful login).

Also works well for paranoid people who don't trust their phone, or people who log in _only_ from a phone/tablet and thus where MFA is really one-device- authentication.

<comment><USER16> I see what you mean about losing the phone, but unless you're saving your password locally it still satisfies the old "Something you have, and something you know" rule. If you lose your phone, the attacker won't know your password. And an attacker without your phone won't have your OTP.

These physically secure OTP techniques are interesting, but shouldn't you have accountability at the system level anyways? If everyone has a two-factor device and a password, it's pretty tough to plausibly deny that you logged into a server. Someone would have to guessed your password and stolen your device.

</comment></comment></comment></comment><comment><USER17> This will do absolutely nothing if Linode themselves are hacked, which is what happened the past two (100% of the) times.

<comment><USER18> Ok, so they get hacked and passwords are stolen and those are cracked. Guess what? They're useless. With 2FA, the attackers still won't be able to get in.

<comment><USER19> The problem wasn't in passwords being stolen. CC information was allegedly leaked.

<comment><USER20> Allegedly? They admitted it was.

<comment><USER19> They admitted that the encrypted CC numbers were leaked, they didn't mention if the encryption keys were stored on the same machine. The alleged hacker said that the encryption keys were stored on the same machine, making the encryption useless.

<comment><USER21> It was also made clear that the encryption key was protected by a passphrase which was not stored on the machine.

<comment><USER22> "which was not stored on the machine", like they should be commended ( Reminds me of exams where you received some credit for including your name... ).

I am sorry, them confirming this fact, and even if I recall adding a smiley in the tweet they did it, just cemented that they do not understand their business.

They clearly wish to give the impression that they are "secure". They need more lock icons...they are almost as effective as the racing stickers on my car!

<comment><USER21> The real problem here is that PCI certification is an absolute joke.

There should be several classes of certification, from "I want to sell a few pet rocks" to "I'm Apple with 150,000,000 credit cards on file". Right now there's basically two.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> just a warning: I just enabled it and it wasn't working with my account & google authenticator for android. I had to call customer support in order to disable the feature so I could login into my account again.

<comment><USER22> Would you mind sharing details ( process wise) of what they did to validate that it was a legitimate request from the account holder?

</comment></comment><comment><USER24> Regardless of Linode's previous screwups, I welcome this change and I hope more hosting companies to offer 2-factor authentication soon.

For anyone installing the Linode's recommended Windows App "Authenticator", WARNING, it does not work! I was locked out! I then used the Microsoft's Authenticator app to find the right token.

Do not logout without verifying it works first in an incognito mode. Better yet, save the secret key temporarily to your PC.

</comment><comment><USER25> Doesn't work for the Linode Manager iPhone app. After enabling 2FA on Linode, the iPhone app still uses only user/pass..... (app last updated, jan 17th, 2011)

</comment><comment><USER26> Ok, so can anyone recommend an established VPS provider, with a comparable management interface, and a track-record of excellent security practices?

<comment><USER11> Amazon AWS has the best security of any virtual server provider I've seen, by miles. There might be specialty providers (e.g. FireHost) which are good dedicated server offerings, too, but I haven't evaluated them -- it usually is "AWS, is it good enough?" and then if no, directly to a cage, do not pass go, do not collect $50k.

AWS also has the best first and second derivative on everything related to product; they were essentially crippled crap in 2006, and have turned into a viable option over the past years, without slowing down. Compared to the level of innovation in colo/dedicated hosting (~zero per year) and openstack, AWS is amazing.

It's still inferior to a good on-premises or colocated environment (mainly due to technical limitations in the virtualized environment; AWS's policy is top- notch commercial standard), but that may not matter for you. AWS pricing and performance is also worse in a lot of ways than dedicated hardware, but may also not matter to you.

A lot of the big cloud/dedicated hosting companies have decent security (SoftLayer, Rackspace), but aren't as good at AWS at policy or technical security. The sketchy VPS providers are miles below the middling standard set by companies like Rackspace.

Linode is solidly in the "sketchy VPS provider" realm. A bit better for availability, and not likely to actually be attacking you themselves, but not a responsible choice for anyone who cares about security from everything I've seen.

PaaS, in practice, is also a good solution if you care about security but have no skills or budget. While Heroku has its own set of problems around price, performance, and availability, it's more secure out of the box than a badly configured/maintained AWS deployment of your own, or a badly configured on- premises/colocated cage or dedicated servers.

<comment><USER9> How about for those that just want a small instance system. I just do the smallest linode setup for some personal projects. From my understanding, AWS is expensive for that type of use case?

<comment><USER11> AWS Free Tier is...free.

I'd probably go with <http://prgmr.com/xen/> for low end above that.

<comment><USER27> How do people expect prgmr.com compares with linode in terms of security?

</comment></comment></comment></comment></comment><comment><USER28> Glad to see Ann Arbor's Duo Security listed as a choice. Know the team and if you chose the Duo option you won't regret it.

</comment><comment><USER29> Ah, there's a bright side to the recent breach after all.

</comment><comment><USER30> Linode is no longer worth paying any attention too....

<comment><USER31> Because obviously nothing ever improves.

<comment><USER32> They certainly aren't improving their transparency.

<comment><USER31> Their transparency hasn't been awful; it should be better. I am for now giving the benefit of the doubt that they'll be releasing further details as they become more certain of them and/or investigations conclude.

</comment></comment></comment></comment><comment><USER33> it's security theater. if someone gets in again, they can download the api keys and own you that way.

</comment><comment><USER34> Is this likely to actually fix anything? Were the past intrusions via the manager? Or via a compromise of the login to the manager via individual user accounts?

Or is this just a show? Either way, this question itself reflects the fact that they refuse to give proper information and postmortems.</comment>


Charlie Hebdo's Wednesday Edition to Include Prophet Mohammed Cartoons - <AUTHOR> http://www.telegraph.co.uk/news/worldnews/europe/france/11340358/Charlie-Hebdos-Wednesday-edition-to-include-Prophet-Mohammed-cartoons.html

<comment><USER2> Eventually these terrorists will also learn that trying to censor something drives sales and popularity through the roof:

[https://en.wikipedia.org/wiki/2_Live_Crew#As_Nasty_As_They_W...](https://en.wikipedia.org/wiki/2_Live_Crew#As_Nasty_As_They_Wanna_Be)

If you don't like something, ignore it.

<comment><USER3> > If you don't like something, ignore it.

Please could you email me photographs of eg your mother or spouse or child?

Let's test your "just ignore it" philosophy.

<comment><USER2> Personal "doxxing" and direct personal slander is a completely different thing. We're talking about general types of speech that some find offensive, like mocking religion, profanity, racism, etc. Trying to censor offensive speech simply brings attention to it and drives popularity. Before these attacks, nobody had heard of Charlie Hebdo.

<comment><USER4> I certainly hadn't, but like many others I will certainly be trying to get hold of a copy of the upcoming edition.</comment></comment></comment></comment>


Dangerous New Chris Anderson Theory: We No Longer Need Logic - <AUTHOR> http://whydoeseverythingsuck.com/2008/06/dangerous-new-chris-anderson-theory-we.html <comment><USER2> This is a big exaggeration. _Dangerous?_ Because it might lead to an outbreak of bad science and poor conclusions? What's one more drop of water in that ocean?

If, in fact, Anderson's idea turns out to be half silly and half banal, the world won't even notice. Folks are too busy squaring the circle, constructing their perpetual motion machines, and printing out new labels to paste on their creationist tracts to take much notice of yet another half-baked idea.

<comment><USER3> I'm not sure what to make of this. I think Hank is taking the idea that correlation is good enough _too_ seriously. Since I've been playing with correlations at home and learning how people find correlations in huge data sets, I've found that a correlation actually _is_ good enough for most purposes. Think about what the correlation is used for. It makes suggestions on things to buy or things you should explore. It's making suggestions. A movie suggestion is exactly that, a suggestion. It's not an exact science and you can't have a 100% guarantee that a consumer will be into something _enough_ to buy it. It's the same thing as trying to predict the market. The correlations can provide a useful service for getting information to people about things they might like. Hopefully the service makes it easy to buy the product and _then_ the picture seems complete.

</comment></comment><comment><USER4> Kevin Kelley wrote a less critical, more constructive response to the Petabyte theory here:

[http://www.kk.org/thetechnium/archives/2008/06/the_google_wa...](http://www.kk.org/thetechnium/archives/2008/06/the_google_way.php)

Gist: "My guess is that this emerging method will be one additional tool in the evolution of the scientific method. It will not replace any current methods (sorry, no end of science!) but will compliment established theory- driven science. Let's call this data intensive approach to problem solving Correlative Analytics ... In the coming world of cloud computing perfectly good answers will become a commodity. The real value of the rest of science then becomes asking good questions."

<comment><USER5> _The real value of the rest of science then becomes asking good questions._

It were ever thus. Oddly enough Picasso appears to have been one of the first to recognize the relevance of this in the computer age -- " _Computers are useless. They can only give you answers_ " -- long around 1968.

I fire up Maxima (Macsyma) all the time to do mindless derivatives, integrals, sums, and series, so that I can get frustrated as hell working on less tractable problems. The symbolic rearrangements (the ones that can be done without reference to the more complicated reality at hand) are just bookkeeping, and computers are awesome for that.

If raw data (and lots of it) were sufficient, things like dynamic programming, heuristic decomposition, and approximation algorithms (complete with correctness bounds) would be pointless. It's not and they aren't.

nb. Don't take any of the above to mean that the province of "asking interesting questions" is somehow restricted to scientists, or artists, or anyone else. But it _is_ probably the highest hurdle towards discovering something worth pursuing. The antecedent execution thereof is rarely easy, either. Tools help -- a lot -- but by themselves they cannot somehow pull the future into the present. For the time being, at least, intelligence amplification still trumps artificial intelligence. (I hope it stays that way for a while, being human and all)

<comment><USER6> "Computers are useless. They can only give you answers."

Such as 42.

</comment></comment></comment><comment><USER7> It may be "dangerous", but basing causation just on correlation (or statistical data in general) is actually a pretty prominent idea: <http://plato.stanford.edu/entries/causation-probabilistic/>. Chris Anderson obviously glosses over many tricky details, but Judea Pearl among others have written extensively on it. Ultimately, all these ideas can probably be traced back to David Hume (at least here in the West).

Hank's argument that Chris is suggesting that we don't try to find spurious correlations is rather simplistic since a probabilistic theory of causation can account for "spurious" and "real" correlations quite well. Indeed, the only reason why we know that "spurious" correlations exist is because they eventually show up in the data (i.e. the economist finds out that the stock market does not predict sun spots). Thus, a statistical definition of causation (more or less one that only uses a notion of correlation), can actually be quite robust.

</comment><comment><USER8> I enjoyed the article Hank. As someone working on developing data-driven machine learning systems for marketing purposes, it made me think twice about some of the conclusions I am able to jump to based only on correlation. Certainly, these methods are quite useful in my field and the other less precise social sciences. In the hard sciences, however, advancing theory without a model seems preposterous save perhaps for a supportive role in special cases.

EDIT: almost feels like a republic (model) vs. democracy (data) political discussion

</comment><comment><USER9> Next Hank will tell me the sun doesn't revolve around the earth, as is 100 percent consistent with observation.

</comment><comment><USER10> This is NOT Chris Anderson. This is Berkeley researchers from the mid EIGHTIES and a lawyer in 1913, for the love of God.

<http://en.wikipedia.org/wiki/Bayesian_Networks#History>

This is like if somebody finds P Diddy's version of "Every Breath You Take" and goes, "wow, I didn't know Diddy wrote that song."

If you haven't been watching Bayes, you don't know what powers the biggest success stories on the Web. Bayes _is_ the tech innovation story of the Web.

Ironic that a site run by Paul Graham would have this problem.

<comment><USER11> Ironic that a site run by Paul Graham would have which problem?

The title of the submission is just the title from Hank's blog. So, wouldn't be a problem with his blog, and not news.YC?</comment></comment>


Sample programs in the Piet programming language - <AUTHOR> http://www.dangermouse.net/esoteric/piet/samples.html <comment><USER2> For those using Piet in production, what async web framework do you favor? Warhol seems pretty popular, but Schiele has me impressed with its expressiveness. We're currently using Dali, though I'm a bit dissatisfied at how surreal its API is.

<comment><USER3> We are using Apache Van^Gogh. But it's trendy to use Hirst though.

<comment> michael-the1 Love Van^Gogh in combination with a Munch cache. Recently went to the Van^Gogh conference where they had a great talk on this topic. [0]

[0] [http://www.vangoghmuseum.nl/en/whats-on/exhibitions/past- exh...](http://www.vangoghmuseum.nl/en/whats-on/exhibitions/past- exhibitions/munch-van-gogh)

<comment><USER4> I really love this kind of conferences, where things are almost hands-on and you can see the actual source code of all(!) presented projects.

They even _embrace_ showing source code, and all discussion is centered around a specific piece of code.

These are qualities I miss at most conferences.

</comment></comment></comment></comment><comment><USER5> An "actual" piet quine:

[http://mamememo.blogspot.hu/2009/10/piet- quine.html](http://mamememo.blogspot.hu/2009/10/piet-quine.html)

For me the image doesn't load, it's archived on stackexchange fortunately:

[https://codegolf.stackexchange.com/questions/23193/output- an...](https://codegolf.stackexchange.com/questions/23193/output-an-image-of- your-source-code-not-quite-a-quine)

        $ ../npiet-1.1/npiet quine.gif > quine2.gif
        $ diff quine.gif quine2.gif

It's freakin' impressive.

</comment><comment><USER6> I had an interesting time writing a JIT for Piet some time ago. Piet is a pretty weird language in a few non-obvious ways. From what I remember:

* Execution moves between blocks of colour. Flood fill algorithms are a valid compiler optimisation!

* Execution can move left/right/up/down. You can't necessarily tell what will be executed without doing it. The 'codel chooser' stuff means you can exit a colour block in two different ways depending on program state (plus left/right/up/down, so 8 ways total...).

* Instructions are encoded in the difference between colour blocks.

* Piet is otherwise a fairly straightforward stack machine.

</comment><comment><USER7> I wouldn't trust these programs to work. The fibonacci one certainly doesn't.

When the explanatory line in the fibonacci example first hits the left hand side of the program, the Direction Pointer appears to be being rotated anti- clockwise.

Were it rotated clockwise, as-per the spec, it would go up, hit the black block above, and eventually end up in an infinite loop.

The command executed on entry to that block is PUSH (pale to normal yellow), so it shouldn't have any effect on DP.

</comment><comment><USER8> I'm wondering if there is a practical use of such a graphic language. I am thinking of printing the pictures associated with the code, put them somewhere, and other people could take some photos of those pictures with their smartphones and run the corresponding code. That might be useful for a game but I can't think of anything yet.

<comment><USER9> Like a qr code but without needing internet. Could be cool for geocaching

<comment><USER10> QR codes don't need internet. They just get less reliable the bigger you make them, so often people just put URLS in them and put the real info at the URL. There are plenty of "historical site" QR codes around here that have a short paragraph of info in them.

</comment></comment></comment><comment><USER11> I was going to attempt a humorous comment of "I prefer a language that supports recursion, so I use Escher". But then my brain went, "think there already is an Escher". There is one, it's from 1995.

Are programming languages about to hit the same problem as musicians, thinking up that cool but unused band name?

</comment><comment><USER12> The Pi calculator gave me the rest.

<comment><USER13> [http://www.dangermouse.net/esoteric/piet/piet_pi_big.png](http://www.dangermouse.net/esoteric/piet/piet_pi_big.png)

> _Richard Mitton supplies this amazing program which calculates an > approximation of pi... literally by dividing a circular area by the radius > twice. Richard says:_

        The output is printed without the decimal
        point after the 3.

        Naturally, a more accurate value can be
        obtained by using a bigger program.

</comment></comment><comment><USER14> Any museum wants to host an exhibition?</comment>


Show HN: Raspberry Pi Temperature Sensor Project - <AUTHOR> https://github.com/DWiechert/pi-temperature

<comment><USER2> I hate to be "that guy" but if this is what passes for an interesting project these days, I could flood github with all the miscellaneous crap I have on my testbench.

Temperature is the most commonly measured process variable. Measuring it in most cases is _trivial_!

Show me an RPi project that calculates the temperature of a blast furnace by measuring the air pressure and the speed of sound in the vicinity and I'll change my mind.

<comment><USER3> Embedded guy here as well. I have to chuckle when I see a mountain of Java code to do a simple sensor operation but, hey, at least they're _trying_ to understand how to make it all work.

What's distressing is that these folks will win in the end, and IoT wind up being quad-core devices @ 800Mhz because everyone is writing their system nodes in node.js or running a JVM. Small and tight just isn't worth the effort anymore.

<comment><USER4> Hell, Java is too much of a pain to build and deploy (especially for something like this that requires custom hardware). I built a similar project 2 years ago in Python and it's good enough.

Embedded hardware still has its place though. General purpose kernels like this can't handle timing-sensitive operations well, so there will always be a need for small and tight real-time programming. Other solutions exist such as binding a separate microcontroller to the host OS, but they're clunky and require additional drivers/libraries.

But you're right, IoT will end up being quad-core devices running some version of Linux because it's an easily accessible development platform that provides TCP/IP and a bazillion actively maintained drivers. And why not? The silicon is getting cheaper every day.

</comment></comment></comment><comment><USER5> I like this project :). I made a similar temperature alert system with Raspberry Pi called Fido. It supports the Temper1 USB sensor and the Temperature/Humidity Pro sensor for GrovePi board that attaches to the R-Pi.

See the page for farmers -> [http://farmhack.net/tools/fido-temperature-alarm- sends-text-...](http://farmhack.net/tools/fido-temperature-alarm-sends-text- messages)

Code here -> [https://github.com/fidoserver/Fido](https://github.com/fidoserver/Fido)

<comment><USER5> Also, I got funded today by the Knight Foundation to work on the Open Pipe Kit which should be a more modular version of Fido. The goal is to make it dead simple for anyone to send data from sensor to anywhere on the Internet.

Blog post -> [http://www.knightfoundation.org/blogs/knightblog/2015/2/10/k...](http://www.knightfoundation.org/blogs/knightblog/2015/2/10/knight- prototype-fund-supports-10-new-data-storytelling-projects/)

Project page -> [http://farmhack.net/tools/open-pipe- kit](http://farmhack.net/tools/open-pipe-kit)

</comment></comment><comment><USER6> Tomorrow I might post our 3D printer operating system, which includes calibrated temperature readings and SMS alerts among many other things (webcam, motor control, and printing objects remotely)

</comment><comment><USER7> I see no mention of calibration.. Calibration is important. Even if you don't do it you should be aware of what the error might be.

<comment><AUTHOR> Thanks for the suggestion - I've added a note to my issues list about this.</comment></comment>


Chat Bubble Blindness - steve-benjamins https://www.atlistmaps.com/in-good-company/chat-bubble-blindness <comment><AUTHOR> Removing an annoying element of the internet, an unprompted hello from a chat bot, is such a win IMO.

</comment><comment> steve-benjamins An Indie Hackers thread about this post was posted on HN: [https://news.ycombinator.com/item?id=24059438](https://news.ycombinator.com/item?id=24059438)

This is the original post though.</comment>


Fullscreen API iPad - <AUTHOR> https://bubblin.io/blog/fullscreen-api-ipad <comment><USER2> Didn't know bubblin.io before, that's a really great site! Thanks for building & sharing!

A lot of the (free) books seem to be old enough to be freely available; how did you manage to make others freely available (for example the books from Michael J. Sullivan)?

I haven't seen any non-free books yet? How do you keep the service available?

<comment><AUTHOR> Hi thanks for the compliments!

We live in Northern Virginia and so does Michael J. Sullivan. Met him and he was kind enough to license two of their best works for free to our initial readers—we're now in middle of starting premium books (/pricing) and that is how we intend to keep the service and growth going. :-)</comment></comment>


Working memory at 5 is a better predictor of academic outcome than IQ [abstract] - <AUTHOR> http://www.ncbi.nlm.nih.gov/pubmed/20018296 <comment><USER2> Thanks to the citation shown in the abstract submitted here, I was able to gain online access to the full text of the article through my alma mater university. The key issue here is that designers of IQ tests have known for a while that their empirically designed tests didn't tap all of the human abilities that might properly be called human "intelligence." The submitted paper test children with the WISC-R IQ at time 1, and the WISC-III IQ test at time 2. But now the Wechsler Intelligence Scale for Children (WISC) has gone into its fourth version, the WISC-IV, and the current Wechsler IQ test includes tests of working memory.

[http://psychcorp.pearsonassessments.com/HAIWEB/Cultures/en-u...](http://psychcorp.pearsonassessments.com/HAIWEB/Cultures/en- us/Productdetail.htm?Pid=015-8979-044)

Intelligence researchers get this. The older versions of IQ tests didn't have a broad enough variety of item content to tap important cognitive abilities such as working memory. Working memory is very important, and is a hot area in intelligence research in the last several years (as this paper reflects). The latest versions of the currently used tests are already taking this into account, and include working memory items in the item content of the tests, and subscale scoring to identify which test-takers have the most problems with working memory.

Another comment in this thread asked,

 _Does anybody know of a good introductory text about these various theories of memory? I'd love to learn more about them, but following references is a bit time consuming._

See

[http://en.wikipedia.org/wiki/User:WeijiBaikeBianji/Intellige...](http://en.wikipedia.org/wiki/User:WeijiBaikeBianji/IntelligenceCitations)

for a guide to background reading on these issues. The Alan Kaufman popular book IQ Testing 101 is a very good book, easy to read and quite up-to-date, on these issues.

</comment><comment><USER3> I read a study some time ago which was examining the cognitive load required by humans to parse various natural languages. I cannot find any references to it at the moment, but the gist of it was that the grammatical structure of some lanuguages required the speaker/listener to keep more information in their working memory before the meaning could be extracted from the sentence (e.g. all the verbs at the end of the sentence). In computer analogies, think of it as being required to push the whole sentence onto a large stack which then needed to be completely popped before meaning was extracted, instead of pushing and popping in pieces as some natural language grammars allow.

This article thus had me wondering whether people who are raised speaking such languages natively have an inherent advantage in life because they are exercising their working memory earlier on and thus increasing it's capacity, which appears to convey more general advantages.

<comment><USER4> > (e.g. all the verbs at the end of the sentence)

Can happen in German. But I find written English actually worse, because it is often so ambiguous to parse---so you have to keep the words in mind and not just the partial abstract syntax tree (or whatever it is that my brains stores for complete sentences).

</comment></comment><comment><USER5> And what is 'academic outcome' a predictor of?

<comment><USER6> Future income, among other things; more generally, success. It's actually fairly good at that. Don't let outliers and bias fool you.

</comment></comment><comment><USER7> The other day there was an article about the importance of motivation in intelligence and success. From my understanding of what this article is, that's a glaring hole in the theory.

<comment><USER8> This is a highly relevant point. The article you're referring to discussed the effect of motivation on IQ tests: motivated subjects did meaningfully better, which undermines the use of IQ as a test of general intelligence.

At 5, children will differ hugely in how motivated they are to do well on an IQ test, and parental influence may well play a large role.

A 5 year old won't exhibit much working memory if they're not concentrating on the test, and if they're not test-motivated by 5, they're less likely to be so when they're older.

</comment></comment><comment><USER9> This is hardly a surprise. Most "learning" in school is actually memorization. This is a skill I do not have and have not been successful at improving. For example: My short term memory is limited to two or three unrelated pieces of information. When I was working at Subway, I managed to improve this to four or five after months of daily practice. I left Subway to go to an out of state college. My short term memory went back to normal within a month. I went back to Subway for the summer, I was not able to regain that skill before school started again.

I'm definitely biased but I find memorization to be pretty useless as a primary method of learning. Unfortunately, testing actual learning would require the teachers to fully understand the material they teach and have the time recognize when someone was faking knowledge on examination. It's far, far easier to test memorization.

<comment><AUTHOR> This is not about memorization, but working memory is like the memory cache (or registers?) of our brains.

There are more theories correlating working memory to IQ, specifically look at the dual n-back brain game.

<comment><USER10> Registers are the immediate computer analogy that came to mind for me as well.

Does anybody know of a good introductory text about these various theories of memory? I'd love to learn mire about them, but following references is a bit time consuming.

<comment><USER11> _"... Does anybody know of a good introductory text about these various theories of memory? ..."_

You might try, DeBono Edward, (Professor of Investigative Medicine at Cambridge when he wrote the book), _"The Mechanism of Mind"_ ISBN 0224617095 January, 1969 ~ [http://www.amazon.com/Mechanism-Mind-Edward- Bono/dp/03179055...](http://www.amazon.com/Mechanism-Mind-Edward- Bono/dp/0317905597)

I've read it, it's old but forms the basis of DeBonos ideas on thinking. The book goes into detail on the physical formation of memory ~ <http://c2.com/cgi/wiki?EdwardDeBono> & <http://en.wikipedia.org/wiki/Edward_de_Bono></comment></comment></comment></comment>


Make your own quadrille, graph, hex, etc. paper - <AUTHOR> https://github.com/mcnees/LaTeX-Graph-Paper <comment><USER2> Once upon a time, I had a 600 dpi Apple laserwriter printer, and it occurred to me that scalable graphics were suboptimal. I wanted to directly access and control every dot at full resolution without letting something else rasterize for me. I eventually figured out how to print my fractals and magnetic field diagrams that way, although I've forgotten the details now. Seems like this would be a good way to do graph paper - make sure you were printing lines exactly one pixel wide.

</comment><comment><USER3> I am using this as a web interface to make my graph paper : [https://incompetech.com/graphpaper/](https://incompetech.com/graphpaper/)

It works pretty well given my 'reds, and at least I do not have to tinker with LaTeX and Tkiz

</comment><comment><USER4> What's the license for this code? Looks cool! I'd be interested in creating a web interface for it.

</comment><comment><USER5> Love it</comment>


McGill will double your password if you don't do it first - <AUTHOR> http://www.mcgill.ca/it/channels/news/faculty-and-staff-mcgill-will-double-your-password-if-you-don%E2%80%99t-do-it-first-238834 <comment><USER2> The fact that they're _able_ to "double your password" is a bad sign. Here's what this implies to me:

* McGill had a database of everyone's password in plaintext at the time of Heartbleed

* McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once

* Despite this concern, McGill _still_ has a database of everyone's password in plaintext. Oh, and a large proportion of them are still the possibly-compromised ones.

* They're comfortable announcing this fact to the Web, for some reason.

I really hope the first thing they do after doubling the password is put it into a password-hashing function and throw away the plaintext, and then make those users change them anyway, because the doubled passwords are still compromised. It sounds unlikely.

<comment><USER3> I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your password. They could just update the application logic to check that your password is of the form <pw><pw> if your last change date is before X. Then to check the password, they just take the first half and check that against the hash.

<comment><USER4> This would break passwords like "foofoo", since they'd think it was already doubled, they'd check "foo" against the hash and it would fail. Then again, you can get around that with doubling it again after checking, so I don't know.

<comment><USER5> Why is this a problem? If your password is "foofoo" and was set after the cutoff, then it won't be halved; if it is "foofoo" and was set before the cutoff, it will be halved, and then not match the password in the database, as intended.

<comment><USER4> You have to have stored the last password change date, which many systems don't do.

<comment><USER6> If they didn't before, they can start storing it to implement this.

</comment></comment></comment></comment></comment></comment><comment><USER7>
      The McGill Password length has also been increased from exactly eight
      characters to a variable length of eight to 18 characters.

So they're not using bcrypt (usable length 72). Even PBKDF2 would have been acceptable, but my guess is that they were sold a "layer over" on their stack with this. I can already tell this is a hacky patch.

      Every year, about 1,200 to 1,500 McGill accounts are compromised in
      one way or another.

Phishing + guessing. I know someone who gets about 2-3 emails a week asking to enter their login info into some site in Brazil or the Czech Republic.

If every site properly salted and hashed passwords, reuse isn't even a problem. But as we know :

      - Most people choose crappy passwords.
      - Most sites use crappy hashing schemes (if they hash at all)

When other sites are compromised, there's an easy list of ready passwords to try against other potential targets.

McGill's problem isn't Heartbleed.

<comment><USER8> On the plus side, they're telling people about the limit. I visit so many websites that will happily take passwords of arbitrary length without complaint... until you try to log in and your password doesn't work because the password you entered was too long and it truncated it.

<comment><USER9> I have an auto loan with a company which truncates the username. It's bizarre because they'll happily let you key in the entire username when you go to log in, but it truncates when you first set your account up.

Why on earth would you ever need to truncate a username?

<comment><USER10> In addition to the frontend issue mod mentioned, it often happens accidentally without any errors or warnings when using a VARCHAR in a relational database, which have a maximum length. If the username field is VARCHAR(20), the application ignores database truncation warnings, and the developer didn't think to check the username length before storing it in the database, it'll truncate a 21-character username without you knowing. This comes down to the devs using sensible field lengths and handling edge cases.

<comment><USER11> I think mysql is the only database that auto truncates varchars isn't it?

</comment></comment></comment></comment></comment><comment><USER12> No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first half of the input correctly match the hash, but the first half the input should match the second half.

<comment><USER13> How is that helpful for mitigating security issues though?

<comment><USER14> Because it annoys the holdout users into changing their passwords.

<comment><USER15> Back in my day ( _old man grumble_ ) the system would force you to change your password on next login. Simple, effective.

This approach is just a dumb prank.

<comment><USER16> I dislike being forced to change password without notice, I need some time to come up with a secure, typeable one. Change on next login just results in me reusing an old password or adding a "2" to the current one.

</comment></comment></comment></comment></comment><comment><USER17> Everyone is guessing if they are storing in plaintext or not. But that isn't the actual issue to learn from their mistake. They have publicly asserted what they are doing (which is great information for a hacker), and chose a bad way to attempt to force users to reset their passwords because of a compromise. I would feel better if it was an email directly to mcgill faculty / staff. If you are building out a user management system, you need a way to disable accounts and force a password reset.

You never want to convey any information about the usernames, password, or state of the account _ever_. This is true for error messages during login, but can be applied to any messaging.

</comment><comment><USER18> Doubling the password is cute, but it would be even more effective to change the password for you by appending constant text to it.

The only challenge then becomes what constant text to add.

I would suggest something like, _ishouldlistentosecurity_. :-)

</comment><comment><USER19> This must be some security joke. I would worry more about passwords not being hashed than the fact that some users didn't change them.

</comment><comment><USER3> After all of this effort, they're still limiting passwords to 18 characters? Why would they do that?

<comment><USER20> I't because they are still storing passwords in cleartext... If they were hashing passwords (which is the correct way to do it) there would be no limit.

<comment><USER21> That is simply not true. I used to think the same but real world experience showed me that a lot of websites hash the passwords but they still set a limit to password length. You should read this : [https://www.reddit.com/r/gfycat/comments/2m7ddd/how_does_gfy...](https://www.reddit.com/r/gfycat/comments/2m7ddd/how_does_gfycat_stores_the_passwords_of_its_users/)

<comment><USER20> makes sense... hopefully this is their reason instead of the former.

<comment><USER22> it doesn't actually... limit to 1k chars or something, not 20 if you worry about stuff like that.

</comment></comment></comment></comment></comment><comment><USER23> Looking at a (failed) login flow, it looks like they are using Oracle SSO

        Markers:
        * Cookie named site2pstoretoken
        * Http header: Oracle-Application-Server-10g/10.1.2.3.0 Oracle-HTTP-Server
        * Layouts are still done via <tables>

</comment><comment><USER24> This strange rule could coexist with hashed passwords:

      if(hash(password) != passwordHash) return false;
      if(passwordUpdateTime < heartBleedTime) {
        changePasswordHash(hash(password + password));
        return false;
      }
      return true;

</comment><comment><USER25> I'm not sure it improves security significantly, but the weak link is using passwords as security in an environment like a university.

Getting users to confirm to good password practices is nearly impossible when they are mature, paid employees with money and valuable IP on the line, and at organizations with legal/regulatory security requirements. Imagine accomplishing that with thousands of college students. (I'm not sure there's a good, cost-effective solution, other than to provide more secure options to users who want them.)

</comment><comment><USER26> Here at UBC all accounts (students, faculty, staff) must have their passwords updated every year. They force you to do it with 3 "skips" available (for if you really don't have time).

</comment><comment><USER27> Am I the only one alarmed by the general inability of websites to protect sensitive information? There isn't almost a day without a major service leaking passwords or personal details. If we don't get a LOT better at this there will be some major reaction sooner or later, either legislative or in term of public behaviour. Like the government establishing a system of licenses to have the right to handle personal data, or with regular costly audit. But we can't continue at the current pace.

</comment><comment><USER28> Is this effective at stopping attacks (given that it is public knowledge), or is it mostly a measure to annoy users into updating their passwords to something less cumbersome?

<comment><USER12> I think this is to annoy the users.

</comment></comment><comment><USER29> This is the same thing as blackboard, they store every password in plain text, nobody seems to care. I've been trying to bring attention to it.

</comment><comment><USER30> I think that the goal here is not to increase password strength, but to make typing your old, short password so annoying that you pick a different one (that complies with the current password strength rules). That is, this isn't aimed at attackers; it's aimed at users.

If so, it's pretty clever.

<comment><USER31> Then why not just force them to change the password on login?

<comment><USER30> One possible answer: Because tenured faculty can call up the helpdesk and get policies reversed, because they're tenured and the helpdesk isn't.

Another possible answer: Many systems can't prompt for password changes, and will just continue to log you in (because, especially for remote-access systems, that's better than denying access and hoping you find another way to get logged in). Probably the lazier of the users also don't use very many of the computing facilities, and may just use a few legacy systems.

<comment><USER32> what's tenure got to do with it? if tenured dinosaur faculty leave, that's a huge win for the budget.

</comment></comment></comment></comment><comment><USER33> this is in no way more secure.... there's a bijection... any password that an attack wants to try they just double so instead of bruteforcing [aab, aac,aad] just [aabaab, aacaac, aadaad] the only reason this makes sense to do is to annoy users into changing their password

</comment><comment><USER34> Unacceptable. They should have AT LEAST trippled the passwords.

<comment><USER35> That's maybe the next step to prompt the user to change!

Or even better make it forwardssdrawrof though that feels a bit evil. (forwards then reverse)

</comment></comment><comment><USER36> Although highly suspect and troubling, this does not necessarily require that they have all users original passwords stored in plain text. If they had originally used a hashing function that obeyed the following:

Hash(pw) + Hash(pw) := Hash(pw + pw)

(NB: Where '+' above is really just a stand-in for any pair of combining functions, not necessarily arithmetic addition or string concatenation.)

But, I agree with many others here that the likelihood of stored plain text passwords is very high.

</comment><comment><USER31> They need to hire some competent IT people

</comment><comment><USER37> How can they double the password using the hashes? Are they storing password in plaintext? :O

</comment><comment><USER38> >The need to change passwords arose in April, when the Heartbleed vulnerability was revealed. Heartbleed makes systems vulnerable to data theft since attackers can use it to gain access to systems and then proceed to access and steal information without leaving a trace.

>Even though our central IT systems are protected against Heartbleed, any accounts that have already been stolen still pose a security risk. Almost 20,000 members of the McGill community did change their McGill Password, but thousands more did not, and so additional actions have become necessary.

So, ff the people who got the passwords read this post then all they need to do is double the passwords they got with HeartBleed to gain access?

Perhaps they should quadruple the password? /s

<comment><USER39> The point isn't to make their system more secure, it's to annoy the users into changing their password.

</comment></comment><comment><USER29> what the actual fuck

<comment><USER21> this is hilarious

</comment></comment><comment><USER40> RIP Security.

</comment><comment><USER41> Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.

<comment><USER42> There are several ways this can be done without that.

Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.

<comment><USER43> >> Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.

>There are several ways this can be done without that.

>Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.

Not quite. What you'd need to do is _halve_ the user's entered password if it's older than the cutoff date. If the user enters "foobarfoobar" then you'd halve it to "foobar" before hashing and comparing it to what's stored.

If you only have the old hashed password stored then you don't have the hash of the doubled password, nor can you can infer it.

This whole approach is silly of course. They should just force everybody to reset their passwords.

<comment><USER35> The reason to inconvenience rather than force is users in a rush will pick the worst passwords, even as paid employees where their password is the thing between the outside world and highly confidential stuff.</comment></comment></comment></comment>


Technology ain't everything - <AUTHOR> http://briancarper.net/blog/technology-aint-everything

<comment><USER2> Technology _is_ everything, in terms of quality of life. Without the invention of technologies like the wheel, masonry, the printing press, electricity, sewerage, the light bulb, the computer.. we wouldn't be as safe, warm, educated, and sanitary as we are today.

 _Is it really that hard to turn a handle for 10 seconds?_

No, Mr I'm Not Disabled. It's not hard for _us_ to get up and change the channel on the TV by hand or to walk a mile to WalMart and carry our groceries home each day either.

 _Do we really need computer-controlled robotic can-opening devices?_

Did we really need to go to the moon? Not really, but the effort of doing so spawned a number of significant industries.

Did _pg_ really need to set up a small system for us to post links and stories? Not really, but the relationships and knowledge that have come from it greatly eclipse his plans for it at the time.

Did Linus Torvalds need to play around with making his own small operating system? Not really. We all know what came of that, though.

With technology, intentions don't count for much; the unintended results can easily reach a long way. Perhaps the e-book or the robotic can opening device will inspire unrelated inventions.

<comment><USER3> Still, I liked his can opener analogy. Yes, robot can openers might help the disabled, but I bet that was not why they were invented. Let's call robot can openers for the disabled a completely different product than robot can openers for non-disabled. Then his point still stands.

But: nothing against tinkering, a ka creating robot can openers just because we can.

<comment><USER2> Automatic transmissions weren't invented for the disabled either. Would his point stand for those? After all, driving stick is only a little extra effort.

<comment><USER3> I am not a driver, but I assume automatic transmission make driving easier. The can openers in his example made opening cans more difficult. I don't think he is arguing against technological progress in general.

Anyway, I see it more as a poetical piece. People will vote with their feet/money anyway.

<comment><USER2> _The can openers in his example made opening cans more difficult._

Yeah, but his point was nonsensical (or at least hyperbole). He said:

 _and usually the can ends up half-open, half-bent up to the point where it's un-openable short of dynamite._

Automated can openers _usually_ spoil cans? If that were true, people wouldn't use them because most of their food would go to waste.

<comment><USER3> Still, why do people buy automated can openers, or electric pepper mills? Unless they are disabled, it just seems to be such a waste.

His experience was that the can openers never worked, but his parents kept trying and buying new models. Maybe by now they work. Still I don't see why anyone would want to have one. Call me a treehugger, but why waste energy and produce toxic waste for something you could easily do manually.

</comment></comment></comment></comment></comment></comment><comment><USER4> His two usage problems - reading in the bathtub and in bed are easily solved.

Bathtub: Zip lock bag. x2 for the safety conscious.

Bed: bent wire hanger <http://blog.xkcd.com/2009/04/13/the-pursuit-of- laziness/>

The bigger thing to me is how the cell modem in the Kindle changes the dynamics of books. An example: In conversation, one of my friends tells me about a book they recently read.

Rather than a quickly forgotten mental note to look into it the next time I make it to the bookstore, I can download the sample (if available) and start reading. If I'm enjoying it, I can buy it and simply continue reading.

</comment><comment><USER5> Flamebait. Some technologies are better hits than others, and anecdotes about can openers and books don't seem like enough to generalize to the statement "Technology for the sake of technology is a waste of time", which I personally disagree with.

My own anecdote about can openers: I use an old-fashioned one, though my friend's little old grandma has a cool electric one under which she just has to hold the can while it magnetizes the top and cuts it off. She could probably use the old-fashioned can opener, but arthritis is still annoying.

</comment><comment><USER6> People create a lot of this "excess" technology not for its usefulness, but because someone out there will buy it from them.</comment>


At 18, I've just launched my first company - <AUTHOR> https://reactivefusion.co/

<comment><USER2> I'd like more information (I'm in the market for a service like yours at the moment, so this isn't just a ShowHN feedback).

Is it pure mobile app? Web too? Do you just design the View in MVVM/MVC? What languages and platforms do you use? Do you deal with web service integration? How do you communicate with customers? How do you structure and provide timelines for a job? Can you give some specifics about what your contracts are like?

<comment><AUTHOR> So we develop iOS Applications (objective-c) with a supporting backend web architecture (Node.js/PHP + MongoDB/MySQL or Parse) if necessary. We can indeed deal with web-service integration given the service has an existing API.

</comment></comment><comment><USER3> Good luck to you! I'm currently setting up my own company now, it's a lot of work, so I take my hat off to you :)

<comment><AUTHOR> Best of luck with yours too! Same industry?

<comment><USER3> Thanks!

Not quite, I'm working on Cachet; [https://cachethq.io](https://cachethq.io) but I'll be doing consulting as well :)

</comment></comment></comment><comment><USER4> Good luck!

<comment><AUTHOR> Cheers Andy!

</comment></comment><comment><USER5> great looking site

<comment><AUTHOR> Thank you!</comment></comment>


A new take on the 'Was my password stolen?' - <AUTHOR> http://wasmylinkedinpasswordstolen.com/

<comment><USER2> This was my exact thought about leakedin. One of the easiest and best methods of scraping real passwords. Even if it is just the hashes.</comment>


An Open Letter to Wikipedia (2012) - <AUTHOR> https://www.newyorker.com/books/page-turner/an-open-letter-to-wikipedia <comment><USER2> Wikipedia is not the sum of all knowledge. It's an encyclopedia. Many people seem confused about what that means.

Primary source: I say $foo! (blog, YouTube, opinion piece)

Secondary source: neilk said $foo. (The New Yorker)

Tertiary source: Reliable, fact-checked publications, such as The New Yorker, have said that neilk said $foo. (Wikipedia)

Wikipedia is a tertiary source. At best WP represents the range of viewpoints that learned people have. If many published articles in reputable outlets give credence to something false, and there's no good refutation in print, there's not much that Wikipedians can do.

Roth always had an option, one that he seems unaware of. There is an exception for primary sources for exactly this sort of thing.[1]. All he had to do was publish a blog post or a tweet or have his publishers do so for him.

[1] [https://en.wikipedia.org/wiki/Wikipedia:Identifying_and_usin...](https://en.wikipedia.org/wiki/Wikipedia:Identifying_and_using_self- published_works#For_claims_by_self-published_authors_about_themselves)

<comment><USER3> Wikipedia probably falls more in the secondary source category.

In fact, I'm quite certain it does. If you think about the numbers between the amount of information and citations on wikipedia, vs. the amount of information that is on "reliable, fact-checked publications", it becomes obvious that there is an immense amount of first-party information and citations.

<comment><USER4> The vast majority of citations are secondary sources.

</comment></comment></comment><comment><USER5> A large fraction of accepted knowledge about history and events is simply false. Just read a newspaper account about an event you have personal knowledge about. Sloppiness, inaccuracy, omission of crucial facts, bias, fabrications, etc., are commonplace.

It's why historians continuously churn out new books on the same topics. How many biographies of Abe Lincoln are there? I get 10,000+ hits on "Lincoln Biography" on Amazon :-)

</comment><comment><USER6> Things like this are the reason I stopped contributing to Wikipedia. People with no knowledge or expertise are able to change facts at will, maliciously or otherwise.

Someone once compared looking things up on Wikipedia to asking a question of ten random strangers at a bus stop. I think it's gotten much worse since then.

<comment><USER7> > Things like this are the reason I stopped contributing to Wikipedia. People > with no knowledge or expertise are able to change facts at will, maliciously > or otherwise.

Have you stopped _reading_ Wikipedia though? That seems like the real test. Who cares if you "contribute"? Is it your go-to source for random research or is it not? It is for me. If it's not for you, then what is?

"Things like this" are just evidence that encyclopedias are not reliable sources for items[1] involving controversy or interpretation. They never have been and they never will be. That's what analysis is for. The job of the encyclopedia, if it's done right, is just to document the existence of an argument and the lack of consensus (and in the modern world link to the relevant conflicting sources). And... it seems like Wikipedia did its job here?

[1] Like the apparrently apocryphal inspiration for _The Human Stain_ \-- honestly this seems like a genuine item of controversy here. Artists are _not_ , in general, considered authoritative sources for their own works and for good reason. History is filled with great works where the author lied about them a little.

<comment><USER6> _> Have you stopped reading Wikipedia though?_

Almost entirely, yes. The only thing I use it for now is looking up wether certain celebrities are alive or dead.

 _Who cares if you "contribute"?_

Wikipedia should care when anyone with above average knowledge of a certain field is turned away. The result is people filling those gaps with less- accurate information.

My point is that if I've given up contributing to Wikipedia, then it's not a stretch to think that people even better/smarter than me have, as well. Wikipedia's arrogance and other flaws are making it a repository of mediocre information, not the best available information. Which brings us back to the bus stop analogy.

 _Artists are not, in general, considered authoritative sources for their own works and for good reason_

You should tell that to whomever it is that organizes the hundreds of thousands of guest lectures from artists that are held around the world each year.

<comment><USER7> > Almost entirely, yes. The only thing I use it for now is looking up wether > certain celebrities are alive or dead.

But where do you look up where crabs sit relative to scorpions and spiders in arthopoda? Or when Kubernetes was released? Or for a quick refresher on who exactly Samson was in scripture? Seriously, those are just my wikipedia hits for the _last few hours_. I mean, yeah, I could surely find that info elsewhere. But I click on the wikipedia link because I know it's going to give me good information in a format I understand and can rely on.

> You should tell that to whomever it is that organizes the hundreds of > thousands of guest lectures from artists that are held around the world each > year.

How is that responsive? "Have something important to say" and "should be trusted above all other sources" are rather different criteria (and, to be clear: make up pretty much a precise microcosm of our current argument!). Listen to artists, their opinions are important. They still occasionally lie about their own junk and those controversies deserve documentation too.

<comment><USER8> > I know it's [Wikipedia is] going to give me good information

It's not good information, though. You don't know if it's good or bad, which rationally makes the info almost useless for anything serious. In fields I have expertise in, it's often wrong, politically biased, has serious omissions, or elevates trivia to importance.

> where do you look up where crabs sit relative to scorpions and spiders in > arthopoda? Or when Kubernetes was released? Or for a quick refresher on who > exactly Samson was in scripture?

Encyclopaedia Britannica is a great source IME (though maybe not for Kubernetes), written by experts. If you hit the paywall, then pay (good info isn't free and free info isn't good); or if you are desperate find the page in your favorite search engine and open it from there.

There are many other authoritative sources in their fields. The one thing Wikipedia is good for is the footnotes, which will identify many of them for you.

</comment></comment></comment></comment></comment><comment><USER9> I'm dying to know, were they able to use this New Yorker article as a secondary source and fix the Wikipedia entry?

<comment><USER10> It appears so:

[https://en.wikipedia.org/wiki/The_Human_Stain](https://en.wikipedia.org/wiki/The_Human_Stain)

>Roth described in a 2012 piece for The New Yorker how his novel was inspired by an event in the life of his friend Melvin Tumin, a "professor of sociology at Princeton for some thirty years". Tumin was subject to a "witch hunt" but was ultimately found blameless in a matter involving use of allegedly racial language concerning two African American students.

...

>In the reviews of the book in both the daily and the Sunday New York Times in 2000, Kakutani and Lorrie Moore suggested that the central character of Coleman Silk might have been inspired by Anatole Broyard, a well-known New York literary editor of the Times. Other writers in the academic and mainstream press made the same suggestion. After Broyard's death in 1990, it had been revealed that he racially passed during his many years employed as a critic at The New York Times. He was of Louisiana Creole ancestry. However, Roth himself has stated that he had not known of Broyard's ancestry when he started writing the book and only learned of it months later.

<comment><USER11> Which proves that despite the naysayers it's actually easy to fix mistakes in Wikipedia: you just need to become a quintessential American novelist and then have the _New Yorker_ publish your letters to that effect.

<comment><USER12> Really, you just need to find a published source for your claim. He would have suffered the same challenge trying to have his Brittanica entry changed.

</comment></comment></comment></comment><comment><USER13> This is why Everipedia has "Verified Accounts" \- so that Roth can have his say on the wiki page, and people know it's coming from him...

One of, like, 100 Wikipedia problems that Everipedia solves, simply by mimicking other, more modern websites like instagram/twitter.

<comment><USER8> Everipedia seems far less reliable than even Wikipedia (which I don't trust). Based on what I read on their website, it's a mix of fake information and paid-for propaganda. Some excerpts from their website (EDIT: from last December, maybe the text has changed since then):

* Header for their footnotes sections: _All information for ... [this topics 's] wiki comes from the below links. Any source is valid, including Twitter, Facebook, Instagram, and LinkedIn. Pictures, videos, biodata, and files relating to Everipedia are also acceptable encyclopedic sources._

* _Celebrities have verified accounts. Not only does this allow them to have conversations with their fans on their own page, but they can also contribute information to their own pages... without having to rely on secondary sources!_ [Yes, they really used an exclamation point!]

* The Premium Service they offer to the subjects of pages (e.g., to celebrities and companies, not to users): _Features Offered / \- Verified Page and Account / \- In-house Editors write the content / \- No ads / \- 24/7 Prioritized customer support / \- Social Media Promotion / \- Link to Website of Your Choice_

</comment></comment><comment><USER14> People, the author included seem to think it's wrong in some way that the author is not just assumed to be an absolute authority on his work, though I think it's quite appropriate and that this example illustrates exactly why you would want the author to provide his oppinion and statements in a manor that is referencable.

If he had been allowed to simple change the page at will, then he could at any time in the futur decide to change the statement after the fact of what the inspiration was, as it stands now even if he change me his mind the New Yorker story can be referenced as a fact that he at that time made these claims.

</comment><comment><USER15> Of the several prior discussions, the one at [https://news.ycombinator.com/item?id=4678352](https://news.ycombinator.com/item?id=4678352) is definitely worth reading.</comment>


Why aren't we using SSH for everything? - <AUTHOR> https://medium.com/@shazow/ssh-how-does-it-even-9e43586e4ffc <comment><USER2> For one thing, SSH performance for large transfers is abysmal over high- latency links. SSH uses a small TCP window size because it was optimized for quick response, not bulk transfers. (After all, it was designed to be a remote shell protocol, not a generic file transfer protocol; scp and sftp were added after the fact.) And unfortunately you can't currently specify a different buffer size even if you wanted to.

More information can be found here: [http://www.psc.edu/index.php/hpn- ssh](http://www.psc.edu/index.php/hpn-ssh)

<comment><USER3> Are there any plans to patch this into OpenSSH? It looks like they have a great solution for the problem you highlighted.

<comment><USER4> Those patches are old. My understanding is that the parts that are reasonable have been implemented and the parts that aren't (plaintext modes) have been ignored.

If you need to transfer large files around a lot use what the supercomputing centers use: GridFTP.

<comment><USER5> I'd never even heard of GridFtp before. It looks pretty good. I've taken to not installing ftp on servers at all and just using ssh, but this might make me think again.

</comment></comment></comment></comment><comment><USER6> Something else worth mentioning; SSH has built-in support for single-sign-on, via SSH agent forwarding. As long as my public key is available anywhere (and that's exactly what it's designed for), then I can be authenticated by any system, anywhere. Thus, a problem which is so vexing in so many other scenarios, is very cleanly addressed by SSH.

Fundamentally, a password is a shared secret. So you send your password to a server, you are trusting that server not to lose or misplace it. In contrast, an SSH public key doesn't require nearly such careful management.

<comment><USER7> SSH agent forwarding is extremely risky. Anyone with appropriate permissions (legitimate or illegitimately gained) on a machine you have connected to can use your credentials to open a new connection to any machine you have access to.

<comment><USER8> > on a machine you have connected to

Don't you have to be actively connected to the machine for this to work? i.e. the server I haven't connected to for a few months has no way of opening connections on my behalf at this point, right?

<comment><USER9> You are right.

But once you connect, a year later - in those 3 minutes before you disconnect, the attacker might have authenticated as yourself to 100 other machines -- and appended their own key to .ssh/authorized_keys on these machines, so that the compromise no longer needs you to be connected.

</comment></comment></comment></comment><comment><USER10> Isn't there a problem when you tunnel TCP over TCP with increasing window sizes (auto throttling mechanism meant to prevent packet fragmentation)?

Every time I've tried to keep a long-running ssh tunnel for printing / http, the connection degrades after a while. I'm sure there are some flags that can be set, but I thought this was the major show stopper for the "everything over shh" (since ssh uses TCP protocol)

<comment><USER9> Simple port tunnelling (-L and -R command line arguments) do not suffer from TCP over TCP. And if you want VPN-style usage, look into sshuttle. It is one way only, and that's a good thing! (Most of the time you only need connections going one way and none going the other way). If you do want two way, either use two sshuttle connections (one each way) or OpenVPN.

The only thing about sshuttle that I've encountered that exposes it's non- VPNness, is that the connection truly originate from the remote system - e.g. if you connect through sshuttle to your peer, the connection go from the peer to the peer on 127.0.0.1. That may or may not be a problem (e.g., logging is much less useful this way).

Try sshuttle. I've stopped using VPNs since I started.

<comment><USER11> I have to agree that VPN's are usually a bit too much; generally speaking, VPN's are a chainsaw when a scalpel is more appropriate!

</comment></comment></comment><comment><USER12> _Why aren't we using SSH for everything?_

Because "Use X for everything" is a terrible design decision? SSH uses flexible transport with some desirable features and may be underutilized in practice.

This question is starting to feel like people who want to staple every pie in the sky idea to the bitcoin blockchain because it too has a set of desirable properties.

<comment><USER13> You're right, we probably shouldn't use SSH to microwave our food.

But a lot of things where we use HTTP today, we could be using SSH if we had better library support. Some more ideas towards the end of the post.

<comment><USER14> > we could be using SSH if we had better library support

It's the firewall rules, not library availability.

<comment><USER15> Tunnel SSH over HTTP, best (worst) of both worlds :)

(I have tried this; it is both useful and terrible)

<comment><USER16> Or you could just run `sshd` on port 443.

<comment><USER17> But this would fail on many proxies, and any firewall that was aware of the protocol.

</comment></comment></comment></comment></comment></comment><comment><USER18> Neat trick, if you're so inclined to use such tricks:

        $ cat .ssh/authorized_keys
        command="tmux new-session -A -s base" ssh-rsa [...]

Automatically creates or joins a tmux session named base, and disconnects the SSH session when you disconnect from the tmux session.

So, yeah, why don't we use SSH for more?

<comment><USER19> It's multiplexing support uses static sized windows, which even on modern LANs means you usually only see 3-5 mb/s transfer rates where you should be able to - even with encryption overhead - achieve almost gigabit NIC speed.

Fortunately the HPN-SSH patches exist to solve this problem - but I really want to know why their's so much resistance to adding them upstream.

<comment><USER20> > which even on modern LANs means you usually only see 3-5 mb/s transfer rates > where you should be able to

On a WAN, sure, but even a mid-2000s gigabit LAN could routinely hit 800+Mb with scp as long as you had tuned the underlying TCP stack (Linux was poor and OS X/*BSD worse in that era) and weren't using something slow like 3-DES.

> Fortunately the HPN-SSH patches exist to solve this problem - but I really > want to know why their's so much resistance to adding them upstream.

Looking at the patches, I'd be surprised if the problem wasn't the fact that they change other things with security or reliability implications. Seeing something like "Dynamic Window and ability to use NONE encryption" suggests that it'd be better to break it up into some smaller generally-useful patches and a separate patch for people in controlled environments who need as much performance as possible.

<comment><USER19> It is broken up into separate patches as well (scroll down the homepage).

But the NONE encryption makes a lot of sense in a "use SSH more" perspective. When you need to move piles of totally non-private data, but want to use a secure authentication mechanism (and message authenticity system) for issuing shell commands...

</comment></comment></comment></comment><comment><USER21> Because SSH requires several seconds to initiate a session, even on a local LAN.

Does anyone know why this is the case? Its always baffled me.

<comment><USER22> A delay of several seconds every time when connecting via ssh is usually due to the remote host trying to look up your IP address and timing out. Change the remote host's sshd_config file to include the line "UseDNS no" and connecting will be much quicker from then on.

</comment></comment><comment><USER23> Key management is pretty primitive. It would be nice if SSH integrated better with PGP/GPG. I recently spent too much time messing with monkeysphere, keychain, gpg-agent, gpgsm etc. trying to use GPG derived keys for SSH. While I could cobble something together I didn't feel that it was a solution I could recommend to others as a general "best practice" because it involved too much installing and configuring and was still somewhat brittle (eg. providing key names to gpg-agent in my .bashrc file).

<comment><USER24> But SSH keys really don't matter.

In PGP/GPG, key persistence matters _because you 're using them to decrypt messages. Long after content was created you may need the key to decrypt it.

For SSH, the key is only strictly necessary during the session. Key _distribution* (of your public key to systems you need access to) is a bit of a pain, but between having your private key(s) where you need them, and authorized keys on various servers, there's not all that much to worry about. Host keys, perhaps, if you want to be rigorous about security.

</comment></comment><comment><USER25> It's not clear to me how SSH differs from SSL/TLS conceptually. It seems to me both achieve similar goals (encrypted tunnel, client/server authentication). Perhaps we should take the best bits of both protocols and create a new one? But then, I am reminded of [http://xkcd.com/927/](http://xkcd.com/927/).

<comment><USER26> SSH is designed to serve a single service on a single host. It distributes its host key on the first connection and caches it indefinitely, assuming it will never change. SSH is designed with a limited set of protocol features, and everything else is kind of hacked on top of proprietary client/server pairs. SSH is designed as a loose encrypted session (kind of like a pipe) for an application on a host.

TLS is designed to serve multiple services on multiple hosts. It depends on your browser trusting an intermediary host which validates the host key, so (in theory) the initial connection can't be MITM'd, and so the key can change at any time or there can be multiple keys (which is needed for hosting multiple services on multiple hosts). TLS is designed to integrate tightly into an application.

When you compare the two protocols, TLS is clearly superior to SSH. But in terms of the features they support (tunneling, authentication, etc), it's up to the server to add missing features outside of the protocol to provide for what the client wants to do.

For example, the SSH protocol basically provides an encrypted connection through which you can do whatever you want, similar to TLS. To do IP tunneling with SSH the application server activates extra functionality to connect the encrypted session to a driver which opens an IP tunnel. Or to authenticate your ssh session against a kerberos server, the ssh server does the actual kerberos authentication; the protocol just informs the client of what 'basic' methods they can use, and the client tries to use one that works with the server's methods.

Incidentally, TLS the protocol supports client certificate authentication, which provides similar functionality to SSH's public keys. The HTTP protocol also does certificate pinning.

<comment><USER27> Maybe it would be nice then if TLS would somehow cache host keys, too? Like my browser caching the relationship:

www.bank.com is 188.8.131.52 with pub key XYZ

Or is this already implemented and I am too stupid to find it?

<comment><USER26> Since this kind of goes against the point of using an intermediary to verify the host key, and multiple services and hosts make this much more difficult to support, it's not built into TLS. But the application can add support for it. There are experimental web standards and methods for various OSes/applications here [https://www.owasp.org/index.php/Certificate_and_Public_Key_P...](https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#Examples_of_Pinning)

</comment></comment></comment></comment><comment><USER28> I wonder if his chat server has been hit by a botnet yet trying to ssh in and then sending tons of shell commands

<comment><USER13> Lots of people spamming/flooding/DoS'ing "for fun", but no clueless bots stumbling in accidentally yet.

Btw previous HN thread about ssh-chat here: [https://news.ycombinator.com/item?id=8743374](https://news.ycombinator.com/item?id=8743374)

</comment></comment><comment><USER29> It was difficult for me to get past the self-referential (and reverential) tone of the writing, which felt more like an advertisement for the author's cleverness than a real discussion of the pros and cons of SSH, but it could be I woke up on the wrong side of the bed this morning.

</comment><comment><USER30> Somewhat relevant: I think Mosh solves a few problems that SSH lacks. This article: [https://news.ycombinator.com/item?id=8252093](https://news.ycombinator.com/item?id=8252093) made it on Hacker News a bit ago. The video is wort the watch imo.

</comment><comment><USER31> SSH can really be used for almost everything. It's a different thing if it actually _should_ be used for everything.

My favourite one: [http://en.wikipedia.org/wiki/SSHFS](http://en.wikipedia.org/wiki/SSHFS)

Whenever I'm developing for my mobile phone I actually have the contents mounted on my desktop via sshfs as an actual filesystem.

What that means? Don't bother with FTP servers. ssh access to your server is all you need.

</comment><comment><USER32> If you rephrase this question like this, the answer is evident:

"Why aren't we using a protocol designed to add encryption to pseudo-devices emulating a real text terminal device [1] for _everything_?"

1: [http://en.wikipedia.org/wiki/Pseudo_terminal](http://en.wikipedia.org/wiki/Pseudo_terminal)

</comment><comment><USER33> Would be great to do this for mosh - mosh-chat It improves over SSH by handling intermittent network connections.

<comment><USER15> mosh isn't a data stream tool like ssh though, it's actually more like VNC -- the reason it performs better is that it sends snapshots of the terminal over UDP, allowing random packets to be dropped

</comment></comment><comment> ezequiel-garzon What surprises me is the lack of total CLI control, potentially through SSH and ideally using keys, of your hosting provider's control panel. Whether it's CLI or some form of TUI, it's bound to be faster and more convenient for many developers.

<comment><USER34> Cloud providers nowadays usually have some sort of CLI clients. OpenStack comes with a full suite[1]. Google rolled out their own for Google Cloud[2]. And if there's nothing official, there are often tools built by users available for interacting with the API.

Authentication is based on some sort of shared secret rather than keys though, yes.

[1] [http://docs.openstack.org/user- guide/content/ch_cli.html](http://docs.openstack.org/user- guide/content/ch_cli.html)

[2] [https://cloud.google.com/sdk/gcloud/](https://cloud.google.com/sdk/gcloud/)

</comment></comment><comment><USER35> Interesting idea, but isn't ssh very sluggish when it comes to throughput and latency? Doesn't it cost quite a bit more in CPU? I'd hate to make ssh the protocol replacement for http for a busy site.

<comment><USER36> It depends on the clipher you're using and the implementation/hardware.

<comment><USER2> It depends more on the TCP window size; OpenSSH uses a small one by default and it cannot be changed.

See also [http://www.psc.edu/index.php/hpn- ssh](http://www.psc.edu/index.php/hpn-ssh)

</comment></comment></comment><comment><USER37> MOre interesting question: Why aren't we using SSH-style authentication for everything? And although they can be used with SSH, I do not mean certificates.

<comment><USER38> I don't see why client side certificate authentication is excluded? You can easily self sign and create your own CA. There aren't really any downsides. Putty with cryptoapi support exists.

</comment></comment><comment><USER26> What the...? Does the author just not know anything about SSH, or web browsers? Why would we use SSH for everything?

On top of the fact that they're entirely different protocols and tools designed for entirely different purposes, browsers already support virtually everything SSH does. File transfers, authentication, client certs, multiplexing, key pinning, etc. There is no need to use SSH, and if you did, it would be slower, less secure, and generally more annoying than using the existing tools built into browsers.

I find it aggravating when users read the manual to some software and think they have discovered fire.

<comment><USER39> What does this even mean?

Your browser supports those things because it implements protocols, like HTTP, TLS, and others. Your browser, or other tools, __could __support SSH, which I think is the point of the article.

<comment><USER26> This means the author doesn't know what they're talking about, and is asking a dumb question.

The article's title is "Why aren't we using SSH for everything?", not "Why don't browsers support SSH?". Both make no sense. It's like asking why FTP clients don't support Voice-over-IP.

</comment></comment></comment><comment><USER40> I read somewhere that SSH can be MITM'ed by a global adversary on the first visit (before it establishes the secure connection). Is that true?

<comment><USER41> Yes. It does not have any centralized certificate system like HTTPS so unless you can manually verify the host's public key, you will not know whether your first visit is being proxied. Of course, if the first one is proxied, so may subsequent ones, and you would only get a warning if the proxy was removed or if it's key changed.

<comment><USER13> SSH supports CA-style key signing, and it also supports server fingerprint validation over DNSSEC (search for SSHFP DNS).

Unfortunately neither of these things are commonly used yet. Cloudflare is adding DNSSEC support soon, so hopefully that will change.

<comment><USER42> It's going to take a lot more than Cloudflare adding DNSSEC support to make SSHFP records viable. Every system running an SSH client will need to run its own validating resolver. If you leave validation to an upstream server you lose a significant amount of security.

<comment><USER43> Not to mention that if your adversary is the Global Adversary, DNSSEC is mostly useless.

</comment></comment></comment></comment></comment><comment><USER44> > Why aren't we using SSH for everything?

Because it doesn't support virtual hosts. And I can't afford 30 IPs for my server.

Otherwise, it's a great protocol.

<comment><USER45> Couldn't you use the same IP and different ports? There's nothing magic about port 22 - and in fact on production servers you should almost certainly change 22 to something else.

</comment></comment><comment><USER46> If you believe Jacob Appelbaum, we probably should not be using SSH for anything [http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_...](http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_- _saal_1_-_201412282030_-_reconstructing_narratives_-_jacob_- _laura_poitras.html#video)

<comment><USER13> Yea I was fairly confused about that announcement as I couldn't find anything damning in the released docs about SSH. Do you have a reference to a specific document/slide?

<comment><USER47> My guess is that, at least, some router ssh implementation is insecure, possibly not by accident.

From the slides:

Page 19: "SSH [...] Potentially recover user names and passwords" Page 36: "SSH - often have router configurations and user credentials [...]"

[http://www.spiegel.de/media/media-35515.pdf](http://www.spiegel.de/media/media-35515.pdf)

<comment><USER13> Right, I saw that also. Is it referring to routers that happen to run SSH with default root/admin passwords or something? I couldn't find anything more concrete.

</comment></comment></comment></comment><comment><USER48> There is something about Finnish products that make them very strong, Nokia, SSH, Rovio.

</comment><comment><USER49> Because schools and filtering software

</comment><comment><USER13> Sorry the title has been revised to "Why aren't we using SSH for everything?" in case mods see this.</comment>


DC "technologically challenged"? - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2008/05/10/AR2008051000122.html?wpisrc=newsletter&wpisrc=newsletter&wpisrc=newsletter

<comment><USER2> I started feeling that way also a while ago. Before the tech boom hit full- swing, the government contractors were the place to be to work with new technologies. It was at SAIC that I was able to get our division to implement a major project in Java.

In the past few years, though, the government contracting industry in DC has grown, but at the same time mired in ever increasing bureaucracy and antiquated tools, systems, and applications. The talent pool shifted quite a bit as well; before the tech boom, there were lots of technies in government, after that, most of them had moved on to commercial work, in many cases elsewhere.

It's nice to hear that there is something going on that will (hopefully) change that, but for now I'm enjoying the fact that Seattle has a much more vibrant tech community than DC, and Seattle's tech community isn't largely classified. :)

</comment><comment><USER3> I studied in Washington, DC during the last four years where the campus was rife with students interested in politics, non-profits and finance. Maybe it was my school, but I didn't meet any "techies" until my Junior year, and that was only a handful.

The article points to a reason why I left DC post graduation: technology, any type of technology, has some relation to politics. It wasn't the right place for me.

</comment><comment><USER4> There were a lot of people at SocialDevCampEast who are working on changing that; there were lots of people there who are doing impressive things.

<comment><AUTHOR> I noticed that -- cool. Better news than seeing the NYC Tech Meetup sold out and expanding from 400 to a bigger venue that could support 600, while DC Tech Meetup hovering around 20. NYC/DC ratio can't be that bad!</comment></comment>


Bill Gates: I'll rid the world of spam (2004) - <AUTHOR> https://www.theguardian.com/technology/2004/jan/25/billgates.spam <comment><USER2> "But he confirmed that Microsoft is investigating three different solutions to rid inboxes from the clutter of unsolicited bulk emails. Although he did not give any details, Gates's pledge - that he would rid the world of spam within two years - will be welcomed by computer users."

Do we know what any of these 3 different solutions were? Or did it just amount to "use Exchange and let Microsoft sort it out"?</comment>