Beyond Passwords: 2FA, U2F and Google Advanced Protection - <AUTHOR> https://www.troyhunt.com/beyond-passwords-2fa-u2f-and-google-advanced-protection/ <comment><USER3> We implemented 2FA on our logins in the past year. I'm also looking at implementing U2F. We'll probably add this once there is enough of a user base.

IMHO the UX for all this stuff is very confusing to non technical users. People lose their phones, don't print out the codes, or simply don't understand how this works and do silly things like trying to use codes from the wrong account.

Since introducing 2FA , requests of people to reset their 2fa are a very regular thing for our support people. Especially when it concerns paying users, saying no is not really an option. So, resets are a common thing. I've since educated our people to at least not do this blindly but obviously, social engineering is a big problem with all this stuff. If this happens to us, you can bet it is an extremely regular thing for basically everything that has 2fa.

But my biggest worry with this stuff on my own accounts is somebody talking support into resetting 2FA on my accounts. I can do everything right and still get compromised because some underpayed support contractor falls for some social engineering hack.

<comment><USER4> It would be great if sites had an option to remove reset support for your account permanently. One that is literally impossible to reset. But I'm not sure how to do that without implementing complete user data encryption.

<comment><USER5> > It would be great if sites had an option to remove reset support for your > account permanently.

That falls apart pretty quick when you attach things like recurring billing to your account. Nobody is perfect and at some point somebody, somewhere is going to want to cancel that billing but not have access to their account _and_ checked your "never reset this account" box.

How do you deal with that very real edge case? Especially since that edge case can easily escalate to a lawsuit depending on the account in question.

<comment><USER6> You empower support to be convinced over the phone to cancel recurring billing, but not to reset 2FA.

That way in the very worst case if support gets socially engineered into removing the credit card details from the account the customer will get mildly annoyed as they have to login and reset it, but their whole account won't be taken over.

<comment><USER7> And then eventually the account will delete itself if you can verify billing info as part of removing billing.

</comment></comment></comment></comment></comment><comment><USER8> I went through the Google Advanced Protection setup a few weeks ago. My only advice is that if you use Android, download the Smart Lock app _before_ enabling Advanced Protection. If you don't, you'll get signed out of your Google account on your phone without a way to log back in (the Play Store won't work without a linked Google account).

If you make this mistake, you need to then disable Advanced Protection, re- login to your phone, then download the Smart Lock app, and THEN re-enable Advanced Protection to get things working. Otherwise you'll be locked out of your phone.

<comment><USER9> I've been looking for a new Android phone for a while now, and my primary selection criterion has become NFC because advanced account protection uses U2F over it. It's frustrating when otherwise decent products are unusable due to the lack of a common feature.

<comment><USER10> I carefully chose a phone supporting NFC as well. But then installed LineageOS and, as it turns out, it now does not pass Google's SafetyNet test and Google Pay refuses to work.

Does the phone need to pass SafetyNet to use a Yubikey over NFC with it?

<comment><USER11> it work fine just use magisk to pass safety net and in Hide panel check google pay. i'm using it everyday

</comment></comment></comment></comment><comment><USER12> Clearly an improvement but let's face it - once you loose/break the keys you will have to go through an extensive verification process (up to 3 days according to google) and there is no guarantee you will pass that stage either. Let's be mindful that more security is at the expense of less accessibility and in some places this is simply not going to cut it.

<comment><USER13> Generally having backup keys is recommended so you don't have this single point of failure.

<comment><USER14> If you are in a foreign country and your mobile phone was stolen...

<comment><USER13> How often does that happen? For the average user this is very very unlikely.

<comment><USER15> The average person worries about plenty of things that are very very unlikely to happen to them, but it still worries them enough to pick an option that is more likely to harm them, but in a less scary way.

</comment></comment></comment></comment></comment><comment><USER16> Too bad someone has to use only Chrome for U2F access. I wish Firefox was able to handle it in the same.way of Chrome's way. Not even Chromium can work with it, at least not on Linux.

<comment><USER17> You can enable u2f in Firefox if you go to about:config and toggle the security.webauth.u2f property. Been using it for a couple of months and it's working great.

<comment><USER18> I tried that this week, and Google still complains that "you must use Chrome" when I tried to register it. The Yubikey works OK on other pages, also with u2f (e.g. gitlab & github). I read somewhere that one can do the registration on Chrome once and later use Firefox to login. But I _don 't want to install Chrome even once_, that's why I am using Fx in the first place!... :(

<comment><USER19> Yup, I can confirm that it works fine once enrolled, I use Firefox for work and they require MFA so I enrolled the FIDO token on my keychain, I don't run Chrome.

I don't like how fragile this situation is (not being able to use my preferred systems to enroll) so I did not enroll my non-work accounts, whereas for systems like GitHub where Security Keys just work fine, of course both my work and personal accounts are enrolled.

</comment></comment></comment></comment><comment><USER20> Can someone confirm, what is actual market coverage of U2F/Yubikey? I am reading about it for some time now and it looks to me that only few web pages and/or applications is actually supporting it. If that's only to get secure access to Google or GitHub then it seems an overkill to me. Am I missing something?

<comment><USER21> [https://twofactorauth.org/](https://twofactorauth.org/) has a list of websites which support two-factor authentication, including using hard tokens.

<comment><USER22> This is a nice site but people need to know that half of listed resources will only work in Chrome and its derivatives. Firefox does support U2F for example but Google, Facebook and others does not support U2F via FF on their resources. This situation is at least 1-2 year old and I suspect will keep like that for a long time.

<comment><USER23> What about other Chromium-based browsers such as Brave, Vivaldi, Opera?

</comment></comment></comment></comment><comment> daniel-s Why is SQRL [1] not more popular?

[1] [https://www.grc.com/sqrl/sqrl.htm](https://www.grc.com/sqrl/sqrl.htm)

<comment><USER24> Reference source in assembly, sponsor not particularly popular or known in the silicon valley. It's a pity because I think the concept is really smart and practical. I would not run it on a windows machine though.

<comment><USER25> I assume it could be implemented on a secure USB stick for key storage, too.

<comment><USER26> I think Steve mentioned Yubikey was looking at implementing SQRL once it was complete

</comment></comment></comment></comment><comment><USER27> FIDO U2F has a great anti phishing mechanism by incorporating the hostname.

However:

It's too difficult to setup FIDO U2F for your own webserver. There is still no Apache module or nginx plugin that allows you to protect a directory of your document root.

Also U2F is not available for PHPBB. There is a plugin that appears to be unfinished and buggy since 2015.

<comment><USER28> Using an OpenID connect provider with one of Hans Zandbelt's plugins for Apache (mod_auth_openidc) or Nginx (lua-resty-openidc) would give you centralized authentication which could use U2F or any other supported 2FA mechanism.

<comment><USER29> I can echo this comment. Protecting websites with lua-resty-openidc was very easy and required no changes to the actual application code.

</comment></comment></comment><comment><USER30> > The value proposition of a U2F device like the YubiKey is that not only must > you have it present, it's not subject to the TOTP being disclosed like with > tokens that require the user to enter a password into a third-party service > which could still be a phishing page

Could someone shed some light on this? What is it that prevents a phising page from basically proxying the crypto challenge from the website to your key and present your answer back?

<comment><USER31> U2F is a two step process - you need to register the device first (through challenge-response process called ENROLLMENT), then you can use it by issuing authentication challenge (U2F authentication is NOT the same as user authentication, they labeled the process as ENROLLMENT - AUTH process).

During registration you receive several pieces of info, such as keyHandle, public key you use to verify future device responses and an attestation certificate so you can verify the device vendor.

The interesting part is this: when you challenge the u2f device to sign AUTHENTICATION request, what it does is keep a counter tied to your appId (the domain where the .js that deals with this is executed) and it produces encoded json which is signed by the device, using an EC private key.

The counter increases every time the device is challenged by that particular appId. The response is signed using the counter and a private key that's on the device (which you can't tamper with).

So, the phishing / mitm should have the value of private key and the moving part (counter) that's tied to a specific appId. That's difficult since it SHOULD do this during enrollment process and every subsequent authentication request.

What's important that not only does it protect against phishing but from replays too. Naturally, the u2f device isn't standalone responsible for this, the verifying server implementation is a crucial part of the process.

Disclaimer: I'm not affiliated by Yubico, but have implemented U2F (the dreaded js part and backend part) in 2015, several months after Chrome 38 has been released, the first version supporting u2f protocol.

<comment><USER32> Last time I checked (more than a year ago) most of the websites didn't care about the counter value.

(If you use a Ledger device for U2F and subsequently restore a new (or a reset) device from your private seed the counter will be reset. Trezor has the same issue but allows you to manually set the counter to work around it.)

<comment><USER31> I haven't got any info on websites caring about the counter value. It seems.. pointless to use U2F if you just disregard the counter value. You need to extract it from the response in order to construct the binary data to verify the signature. If one disregards the counter value, they can just outright drop the whole U2F.

<comment><USER33> > If one disregards the counter value, they can just outright drop the whole > U2F.

It's not pointless. Disregarding the counter only enables replay attacks, that is: the attacker must previously have captured a challenge/response. The phishing resistance is still retained because it relies on the browser passing the origin to the u2f device and the browser can't be fooled by similar URLs while a human entering a TOTO token can.

<comment><USER31> U2F isn't as trivial to implement as RFC4226 OTP. It takes effort. Implementing the counter check is trivial. Disregarding the counter and stating "that only enables replays" is absolutely unacceptable. If one is so irresponsible to the point they're enabling a replay attack - then there's no excuse and no valid argument to support the use of U2F at all. If you (not YOU, personally) can't implement the protocol fully, don't half-ass it and plant mines. That's my take on it, and anyone who implements this protocol to secure people's accounts MUST (not SHOULD) think the same. There is NO excuse for deliberate irresponsibility.

</comment></comment></comment></comment></comment></comment><comment><USER34> I wish that SmartCards were used more for this purpose [https://github.com/OpenSC/OpenSC/wiki](https://github.com/OpenSC/OpenSC/wiki)

There's an applet you can load into your own JavaCard presumably [https://github.com/LedgerHQ/ledger-u2f-javacard](https://github.com/LedgerHQ/ledger-u2f-javacard)

<comment><USER35> The JubiKeys support a smart-card functionality.

There is a similar thing in SIM-cards, but that is under-utilized as well.

<comment><USER36> > There is a similar thing in SIM-cards

Got any good resources on this subject? I'd be interested to know more :)

<comment><USER34> I'm not entirely sure what he means by that, but SIM-cards are smartcards.

[https://en.wikipedia.org/wiki/Subscriber_identity_module#/me...](https://en.wikipedia.org/wiki/Subscriber_identity_module#/media/File:GSM_SIM_card_evolution.svg)

And you can buy smartcards in this formfactor e.g. [https://www.cardomatic.de/epages/64510967.sf/en_GB/?ObjectPa...](https://www.cardomatic.de/epages/64510967.sf/en_GB/?ObjectPath=/Shops/64510967/Categories/SmartCardHSM)

</comment></comment></comment></comment><comment><USER37> For some reason Google Smart Lock doesn't allow you to use a U2F Yubikey as a backup to the phone-based prompt. Seems totally absurd as a Yubikey is the perfect backup to a lost phone.

Also did I mention that if you use 2FA, Google's "find my phone" functionality asks you to use your phone to authorize the login before you can find it?

Yes. You heard that right. Use your phone to find your phone. Don't ask me how I know.

<comment><USER38> Well, presumably you are using 2FA because you don't want anyone that stole your password to be able to access your account, so do you really want anybody with access to your password to track your location?

<comment><USER39> Isn't the that, in the lost phone case, you can never answer that query?

<comment><USER19> Google prompts you (maybe even requires) to enable at least two distinct ways to get in. Now, of course it's possible you've tied both of those to your phone, but I put it to you that this makes it your fault.

If my other method works, even if it's a huge pain (e.g. maybe my other FIDO key is at home and I've flown to Tokyo) then I do still have options. Maybe not options I _love_ but that's security for you. If you have a massive house fire that both destroys your bank documents and leaves you so badly burned you can hardly talk let alone sign your name, good luck the first time you try to withdraw cash from that bank account.

If you set Advanced Protection both distinct ways have to be FIDO Security Keys, and whilst it's conceivable you could own a phone that functions as _one_ FIDO key (I would expect Apple to do this for example) it doesn't make any sense to have a single phone serving as _both_ your keys, even a non- technical person can hopefully spot that.

</comment></comment></comment></comment><comment><USER40> Really hope apple adds u2f (native/safari) support at some point in the nearish future.

</comment><comment><USER41> I'd like to see another article showing the steps to go through if you lose your keys.

<comment><USER42> This is my biggest concern about 2FA. On Google I have TOTP 2FA enabled, with my phone number as a backup. But everything goes through my phone - I'm not really worried about some stealing my phone to gain access, but what happens if I break or lose my phone.

A few years ago I was travelling abroad and had my suitcase stolen - which had my laptop (with FDE) and passport inside. Fortunately I had my phone and wallet on me, otherwise I really don't know what I would have done - <USER2> probably wouldn't even have remembered the name of the hotel I was staying at that night.

<comment><USER43> Google allows you to print a set of codes [1] that can be used to access your account if your device is lost. I printed a set and have them stored in a secure place at home. Some people keep them in their wallet/bag/similar.

[1] [https://support.google.com/accounts/answer/1187538](https://support.google.com/accounts/answer/1187538)

<comment><USER44> According to [1]

      Advanced Protection uses a stricter implementation than
      Google has offered in the past: Only those physical
      keys—along with a password—will unlock your account. If
      you lose them, you can't use a printed out backup code

So, no printed backup codes for Advanced Protection users!

<comment><USER43> (Presumably your [1] reference is this: [https://www.wired.com/story/google- advanced-protection-locks...](https://www.wired.com/story/google-advanced- protection-locks-down-accounts/) )

Good point, although I think the parent comment was about Google's existing 2FA rather than the new advanced protection setting.

</comment></comment></comment></comment></comment><comment><USER45> It continues to be an annoyance that we have this great technology in the form of U2F, but Office365/Azure (where troyhunt.com's MX records currently point by the way) doesn't support it. In fact their UX still strongly pushes you towards SMS if you don't know where to look.

</comment><comment><USER46> $20 for one in a bundle? Why is it so expensive? I get a 4-core 1.3GHz 1GB RAM SBC I can run desktop and all the crypto in the world on, incl. shipping from China for less than the price of a single U2F knob.

I'd pay $2-3 max per piece. Especially since you need more than a few in order not to cause yourself more trouble than this is worth (to someone who already uses random unique passwords and emails for services).

<comment><USER47> The goal is really nonclonable key storage with a minimal CPU and purpose specific firmware, i.e. a sim card. The USB u2fs are about $10 which is pretty reasonable for a newish card with ECC algorithms.

<comment><USER46> Why is it a goal though? I don't care.

U2F to me is useful for protecting from stolen credentials on the web. These attackers will never have physical access to my u2f device to clone it.

If you fear people getting physical access to your u2f, they can simply use it if they also know the password. No need for cloning. And if they don't know the password, it's still useless. From that attacker's perspective, your security was reduced to password only. Which is still good, if you take care of your passwords.

</comment></comment></comment><comment><USER48> Does anyone know if Google allows registering more than 2 keys?

Like what if i want to register 3 or 4 keys for advanced protection?

<comment><USER8> Yep, they do. I've registered 6 without a problem.

<comment><USER10> Six seems like a lot. Why do you need so many?

<comment><USER8> It's cheap insurance against getting locked out of my Google account forever.

<comment><USER10> Sure but you're diluting the second factor. The more tokens you have, the easier it is to get one and without you noticing.

<comment><USER8> There's always a tradeoff between convenience and security, but I'm relatively unworried about someone, say, breaking into my bank compared to someone spoofing my phone number.

</comment></comment></comment></comment></comment></comment><comment><USER49> > Now, hopefully the problem here is already self-evident but let's just be > crystal clear anyway: adding a second step to authentication should not be > seen as an excuse to weaken the first step. I'm hesitant to call this guy's > approach 2FA (if it's true MFA at all), it's more like 1.5FA or something > thereabouts. The point is, use the approaches above as additional security > controls, not as an excuse to weaken existing ones!

Well, right now I use passwords of the form j6lqPKQKQ1RHv87PES4iy5; it'd be nice if using U2F meant that I could securely switch to something like 'correct horse battery staple' instead …

</comment><comment><USER50> Amidst all the potential ways in which even 2FA can be compromised, I am surprised no one is mentioning the biggest benefit of using 2FA- the ephemeral nature of 2nd password. Not only it protects against misuse of stolen credentials, but it also allows to centrally disable the 2nd password should any leak occur. Is this one of the stated goals of 2FA design?

In my view, this makes 2FA an essential security feature, not just a nice improvement over 1FA.

</comment><comment><USER51> Here's what I'd like to see in a 2FA "something you have" device: You could just leave it in your pocket, and you wouldn't have to interact with it. It would also unlock your computer when you sit down at your desk and lock it when you leave.

<comment><USER52> You mean like an Apple Watch does with a macOS machine?

<comment><USER51> An app that would turn an Apple Watch into a U2F 2FA device would be great. It would also need to work as such a device for logins to Google and AWS.

<comment><USER52> Well you can use the Authy Apple Watch app for TOTP but I am not aware of anything that works like Microsoft or Google's prompt system.

</comment></comment></comment></comment><comment><USER53> Does anyone know if Smart Lock for iOS works with the new Yubikey 5 NFC, or is it still necessary to use the Feitian Bluetooth device?

<comment><USER54> Smart Lock on iOS does not support NFC currently. BLE only.

</comment></comment><comment><USER55> This is complicated(even for developers) and requires additional devices. People hate extra devices. Verdict: fail!

</comment><comment><USER56> Has anyone seen external reported audits of code & hardware for keys like Yubikey, Google Titan?

</comment><comment><USER57> I wonder if he'll do an article on webauthn... that seems fairly promising as well!

<comment><USER58> WebAuthn is the spec that enables U2F tokens in browsers. When he adds the keys to his account in Chrome, and when he logs into Gmail on Chrome, that's all utilizing WebAuthn in the background as a technical detail.

</comment></comment><comment><USER59> Am I correct in seeing that U2F can't be enabled for G-Suite accounts yet? I can't find the setting in the Admin panel.

<comment><USER54> U2F can, but the Advanced Protection program can't currently.

<comment><USER19> Advanced Protection changes your relationship with the administrators (Google). But for GSuite the administrators are some other member of your organisation, so Google can't make a web page that changes that relationship.

If your company decides that the New York employee named "Steve Smith" and the London employee "Stephen Smith" are the same person, and either should be able to request account password reset for firstname.lastname@example.com, both of these chaps are going to have a bad time. Google can _tell_ them this is a terrible idea, but GSuite is a company product, so ultimately it's their terrible idea if that's what they want to do.

The _technical_ features of Advanced Protection seem to be mostly: Use FIDO Security Keys (U2F/ WebAuthn), disable stuff we know is useful but insecure. You can opt into those technical changes for your GSuite, either for everybody or a selected group e.g. "Company Security Nerds" or "Executive Level Employees" or "Everybody except Pamela. Damn it Pamela". But the non-technical feature is hard and probably just not replicable at all.

<comment><USER54> Yes essentially the issue is that it's possible to permanently and irrecoverably lose access to your account with the Advanced Protection program enabled. But that clearly wouldn't work when your account admin can just reset things.

So you can have an equivalent set of options configured, but it isn't exactly the same.

</comment></comment></comment></comment><comment><USER60> > Password and SMS

I see no mention of SS7 attacks, is that a solved problem?

<comment><USER61> "SIM porting"

<comment><USER60> How will SIM porting help in such attacks?

<comment><USER62> It doesn't help: it exemplifies the full scale of the problem which is bigger than ss7. SIM porting attack is social-engineering. You don't even need to "fix" ss7 to port out of some carriers, because humans are in the loop to do it for you because tears on the phone.</comment></comment></comment></comment>


Google Earth Discovers Woman Trapped On Deserted Island For 7 YEARS - <AUTHOR> http://www.sunnyskyz.com/good-news/592/Google-Earth-Discovers-Woman-Trapped-On-Deserted-Island-For-7-YEARS

<comment><AUTHOR> My apologies, further research into this indicates it is fake, and a lot of the text is actually pulled from here: [http://www.dailymail.co.uk/home/moslive/article-2289607/Amaz...](http://www.dailymail.co.uk/home/moslive/article-2289607/Amazon- explorer-Ed-Stafford-Stranded-He-survives-60-days-desert-island-Pacific.html)

</comment><comment><USER2> The comments below the original story indicate it's fake.

</comment><comment><USER3> This story is fake.

<comment><USER4> And a dupe from about 2-3 hours ago. [https://news.ycombinator.com/item?id=7430306](https://news.ycombinator.com/item?id=7430306)

</comment></comment><comment><USER5> Flagged for being fake.</comment>


Microsoft is developing a Google Glass competitor - <AUTHOR> http://techcrunch.com/2012/11/22/microsoft-patent-shows-its-working-on-a-google-glass-type-device-of-its-own/ <comment><USER2> What these things really need is some way of being controlled directly by the brain.

I don't want to be wearing goofy glasses and telling them to guide me to the pub. I just want to conjure up a rabbit to follow.

<comment><AUTHOR> Hehe, I suppose that wont be hard in the nearby future (25 years). The glasses could have neuro-censors that would be in constant contact with key parts of both sides of the brain.

<comment><USER3>
      The glasses could have neuro-censors

That's a frightening typo!

<comment><AUTHOR> Lol, frightening indeed. My bad.

</comment></comment></comment></comment><comment><USER4> Am I the only one who thinks Google Glass is a bad idea?

We already trusted our virtual life to google (emails, what we do, etc). Are we sure that we are ready to trust our real(physical) life too?

Don't get me wrong... It seems like a cool project but I wouldn't use it, maybe I am getting too old :/

<comment><USER5> It doesn't bother me much for a simple reason: Sutherland's wheel of reincarnation applies to cloud computing. Right now there isn't enough processing power or storage on a portable device to store everything you would want out of a thing like this, but give it time. And then it's hardware, it doesn't _have to_ be ad supported -- the device can know all about you, but it's your device.

So that's one possible future. And the tech they're developing is pretty agnostic to whether the information it collects is stored in the cloud or just on the device, so let's try not to be too pessimistic about something cool just yet.

<comment><AUTHOR> True, then again the temptation for them to start feeding you personalized real time ads, were your whole life is their ad canvas, might be too great to resist. Lets wait and see.

</comment></comment></comment><comment><USER6> > Microsoft Patent Shows It's Working On A Google Glass Type Device Of Its Own

It only shows that Microsoft calls dibs on this newfangled idea of wearable display. I don't see any invention described there. Rather just an idea.

</comment><comment><USER7> Is Microsoft really developing or simply trying to get some patent to fight with google?

<comment><USER8> It looks like this was submitted (May 2011) before Google announced Project Glass (Apr 2012)

<comment><USER9> And people have been thinking about augmented reality for decades.

[http://en.wikipedia.org/wiki/The_Sword_of_Damocles_(virtual_...](http://en.wikipedia.org/wiki/The_Sword_of_Damocles_\(virtual_reality\))

</comment></comment></comment><comment><USER10> we don't even know what Glass is going to be, how can it have competitors? so far all we know is that it's a network connected display inside a pair of glasses. but that's been available for purchase for a couple of years now ([http://www.reconinstruments.com/products/snow-heads-up- displ...](http://www.reconinstruments.com/products/snow-heads-up-display)).

people have been working and experimenting on wearable computing and HUDs for decades ([http://bits.blogs.nytimes.com/2012/08/07/one-on-one-steve- ma...](http://bits.blogs.nytimes.com/2012/08/07/one-on-one-steve-mann- wearable-computing-pioneer/)), I'm really curious to see what Google can come up with, being probably the first major company trying to make a general consumer product, and Glass may well end up being an awesome revolutionary product but so far I fear that it's being hyped so much that it may end up being the next Segway.

</comment><comment><USER11> Can a product have a competitor if it hasn't actually launched yet?

<comment><USER12> Not only that, but the market has not been established either. The product has not real solid use case except getting Facebook/G+ notifications on the go.

<comment><USER13> And head mounted camera, and hands free walking/biking directions and augmented reality.

<comment><USER12> Head mounted camera is only of use to a niche of users. Walking/biking directions can still be seen on a mounted mobile on bike and mobile in hand/voice directions on headphones. Augmented reality is not a specific use. There are not many things that augmented reality can be used on in real world by casual user right now. And there won't be any until someone (like google) creates it.

</comment></comment></comment></comment><comment><USER14> Maybe I'm way off, but I think this is kind of what Google intended in some sort of way with their Google X lab. They're exploring innovative and new ideas but I think it's with the intent of spurring on this competitive spirt with the other tech giants. One company exploring these ideas is innovative but may not make much progress; having a bunch of companies compete to come up with the best version of these ideas may make the progress on these technologies increase rapidly.

<comment><USER13> Google would prefer if MS Monocle ran Android. They aren't a charity.

</comment></comment><comment><USER15> Microsoft's current strategy with everything seems to be:

"me too! me too!!!"

<comment><USER16> As was pointed out elsewhere, this was applied for a year before Google Glass was shown at all.

<comment><USER15> However, patents versus material commitment are very different. The latter requires some effort.

<comment><USER16> So MS is copying Google on this, despite that they put in this patent application over a year ago, and despite that these types of devices have been discussed for decades and only now practical? This is very obviously not a "me too" effort, but even if it was... who cares? Competition is a good thing.

</comment></comment></comment></comment><comment><USER17> Not sure if they plan on 'competing' with statements like this: _The device described by Microsoft is a little less ambitious_

</comment><comment><USER18> I believe Google Lense would have a more bright future, than Google Glass. Google Lense may be a wireless lens screen which communicates with the smart device in your hand or pocket to show you app windows in multiple screens.

<comment><AUTHOR> And the lenses would be installed into any glasses or how do you envision it?

</comment></comment><comment><USER19> I love the spin. This is a non story.

This is how invention and innovation works; multiple parties come up with the same idea. Not to mention that the idea of augmented reality glasses has probably been a childhood dream for many.

</comment><comment><USER20> Seems related to the big Xbox roadmap leak from earlier this year. 'Fortaleza' was the codename I think if anyone wants to do some digging.

</comment><comment><USER21> I was really hoping they would call it Microsoft Monocle.

</comment><comment><USER22> Knowing Microsoft they'll come with a keyboard

</comment><comment><USER23> of course they are </sarcasm></comment>


Thorium, the New Green Nuke - <AUTHOR> http://www.wired.com/magazine/2009/12/ff_new_nukes/ <comment><USER2> Finally this is getting attention! The politics of nuclear energy are so messed up that thorium reactor technology got buried under radioactive piles of propaganda, because, you know, if it's nuclear it must be bad.

<comment><USER3> It's due noting that India didn't ignore Thorium, holding 25% of the worlds reserve it saw well in advance that Th232 has a half-life as long as the known universe and gives the country energy independence. With current estimates, India essentially holds as much energy in its thorium reserves as the world has uranium reserves, meaning it itself could sell enough energy to likely run the world for 100 years, or run itself (at present demand) into the next millennium without a concern.

The US is presently worrying about where to find its energy independence, while India has already found its independence for the next 1,000 years.

<comment><USER4> I'm not sure where you got the 25% number, but thorium deposits exist all over the world. In the US, the carolinas are an available source. It's about as common as lead, so i'm not really sure we're predicting any shortages anywhere yet.

<comment><USER5> The USGS Minerals Commodity Summary for Thorium indicates that Australia, the US, India, and Norway have 80% of the world's thorium reserve base.

PDF warning: [http://minerals.usgs.gov/minerals/pubs/commodity/thorium/mcs...](http://minerals.usgs.gov/minerals/pubs/commodity/thorium/mcs-2009-thori.pdf)

<comment><USER4> Thanks. Interestingly enough it seems that Australia, not India, is the winner in Thorium reserves, both economically exploitable and total. In total, the US and India have equivalent reserves, while India has more economically exploitable.

</comment></comment></comment></comment></comment><comment><USER6> The Wikipedia article for Thorium as a fuel is surprisingly detailed: <http://en.wikipedia.org/wiki/Thorium_fuel_cycle>

</comment><comment><USER7> This is also a great video (google talk) about the technology: [http://www.youtube.com/watch?v=WWUeBSoEnRk&sn](http://www.youtube.com/watch?v=WWUeBSoEnRk&sn) \- shortened to 16 minutes, very well worth watching.

<comment><USER8> A little fast paced, but very good stuff, thanks. Do you know of any more in- depth videos on Thorium reactors?

</comment></comment><comment><USER9> "Fuel input per gigawatt output: 250 tons raw uranium?"

Come on, Wired. 250 tons is a quantity, and gigawatt is a rate. Is it supposed to be a gigawatt times the lifetime of the plant?

<comment><USER10> it's probably 250 tons / year for a 1 gigawatt plant

<comment><USER11> Probably not... re-fueling is a very time-intensive process. (The reactors I worked on were designed to be re-fueled every 25-30 years.)

250 tons for a 1 gigawatt constant output seems more likely to me.

<comment><USER12> I can clarify this. It's 250 tonnes of raw uranium, from which we get 35 tonnes of 3% enriched uranium, which give one gigawatt-year of electricity in a typical light water reactor.

</comment></comment></comment></comment><comment><USER13> Anyone interested in doing a startup which could help push thorium energy forward? I know and understand nothing about physics, but maybe there's room for programmers to carve out their niche in something useful here.

Energy is the biggest problem humans face today.

<comment><USER14> You would probably require a ridiculous amount of VC funding to even make a plant. Also, you are competing with people with PhD's in the field doing research.

<comment><USER13> _competing with people with PhDs_

Yes. This is the tragedy of programming and computer "science": you know everything about making tools and writing code to other people's specs — and nearly nothing about solving actual real-world problems. That's why I mentioned carving out a niche. I didn't intend to build a whole plant, but a company which comes up with software which helps people building plants might have a fighting chance.

<comment><USER4> Sounds like a solutions searching for a problem. Let's wait for the US to decide to build q new reactor first.

You would also probably require experience writing real-time, fail-safe systems (like vxWorks) and a very high government security clearance.

</comment></comment></comment></comment><comment><USER15> I wonder how many wind/solar/bio energy proponents are even aware of this.

</comment><comment><USER16> I remember listening to a talk by ex-CERN director Carlo Rubbia pushing accelerator-driven Th reactors sometime in the early 90s.

It's not new. Maybe it's the Betamax of nuclear technology... ;-)

</comment><comment><USER17> Interesting. Just a few days ago a friend sent me a link to a site he's involved with on this subject. www.thoriumenergyalliance.com

</comment><comment><USER18> This is fascinating. A left of field approach to the problems of uranium based nuclear power. Let's hope that opportunity meets preparedness here and this can make it to an inflection point.

</comment><comment><USER19> Another good source of information about Thorium:

<http://thoriumenergy.blogspot.com/>

</comment><comment><USER20> This article is a little bit silly in the way it portrays Thorium reactors as being pushed aside for only a few reasons. Even aside from the nuclear weapons angle (quite important during the cold war) in 1973 Uranium/Plutonium reactor technology was vastly more mature than Thorium reactor technology (that is still true today). When the choice is between funding a well-known nth generation commercial reactor design (using Uranium) and sinking unknown quantities of R&D dollars into a program to develop a commercial reactor design (using Thorium) the choice is obvious.

We should probably be investing considerably more money into Thorium reactor designs (though the same applies for Uranium reactor designs as well), but the picture this article portrays of a more worthy underdog being sidelined for petty reasons is very misleading.

</comment><comment><USER21> Thorium is the fuel of the future. Thorium is safe to handle. Thorium energy technology is totally emissions free! Thorium has an energy density of 292 time that of Hydrogen. One gram of thorium is equal to 20 million grams of coal or 7350 gallons of gasoline.</comment>


Show HN: Small .NET core static site generator - <AUTHOR> https://github.com/acardboardrobot/piaine <comment><USER2> Just FYI. I am using Graze, that uses Razor templates as the backend: [https://github.com/mikoskinen/graze](https://github.com/mikoskinen/graze)

</comment><comment><AUTHOR> piaine is a small static site generator I have been working on for the past few days. It runs on .net Core and uses no dependencies outside of the System library.

The project implements two very basic parsers that generate html from a given template and a separate content file. The parsers are the main point of interest for me in the project, mainly using Bob Nystrom's excellent Crafting Interpreters book.

Loop support for the indexing page is the next feature to be added, but other than that, the project already does 99% of what I need it to do, and it has been a hugely satisfying itch to scratch.

I am not a professional programmer, this has been done on lunch breaks and before/after work over the past few days, so any critique would be very much appreciated.</comment>


What real life good habits has programming given you? (2008) - <AUTHOR> http://www.stackprinter.com/export?service=stackoverflow&question=168805&printer=false&linktohome=true <comment><USER2> Programming has learnt me nothing but bad habits. A tendency to read HN instead of doing proper work. Constantly forgetting to go to bed in time, staying up all night in stead, constantly being woken up by the all too bright hypnotising monitor. A habit of contacting people by sms, e-mail or facebook rather than in real life. The list can go on forever.

<comment><USER3> One think that I've been noticing over the years is that my brain has been rewired to find problems in things.

Whenver someone shows/tells me something I instantly start to search for holes in it. I don't actually think about it. It just happens, my wife complains a lot about it.

<comment><USER4> I describe myself exactly the same way. For me, I think it's two separate components:

\- For an existing system (of any kind - mechanical, legal, social...), I automatically look for things that can be improved.

\- When discussing a new idea, I'm always mentally jumping ahead to the implementation phase, where potential problems quickly jump out at me.

I've considered it to be just part of my personality rather than specific to programming, but since I first learned to program at age 7 it's difficult for me to distinguish the two.

</comment></comment></comment><comment><USER5> Programming has taught me not to be content with vague ideas. It's always easy to give hand-wavy solutions. Formalize it or you haven't solved it.

<comment><USER6> Reminds me of my boss's favorite quote:

> "Everything is vague to a degree you do not realize till you have tried to > make it precise, and everything precise is so remote from everything that we > normally think, that you cannot for a moment suppose that is what we really > mean when we say what we think." — Bertrand Russell

</comment></comment><comment><USER7> Biggest thing for me is to stop prematurely over-engineering things. Need something done? Just get it done, however possible. If, in future, you need to do it many more times, you can gradually optimize the process as you go. As opposed to letting the perfect kill the good in the first place.

</comment><comment><USER8> Practice as a habit.

Practicing something repeatedly, preferably every day, is the best way to get better at something. I started programming every day after being inspired by a blog post by John Resig that got posted to HN [1]. I started a game that I've been working on for 245 days straight. I started with almost no knowledge of game programming and now have, I dare say, a playable game. Github really helped with this because you get a nice display of your commit history over the past year that gives an incentive to not break the chain [2].

I've been able to apply this to other skills I've wanted to get better at: relearning how to play the piano, making music, working out, etc. and have seen great results.

1\. [[http://ejohn.org/blog/write-code-every- day/](http://ejohn.org/blog/write-code-every-day/)] 2\. [[http://i.imgur.com/6zq1IbJ.png](http://i.imgur.com/6zq1IbJ.png)]

</comment><comment><USER9> Clearly specifying what I mean and using precise language. I never understood the importance of that until a few years of programming.

<comment><USER10> This. I'm still a young gun with only a few years under my belt but the combination of writing code and working with clients who need code written has made me realize the importance of communication. I've been able to take the precise communication that I'm forced to use in my work (be it with a system or with a client) and use it in my hobbies and organizations I'm a part of.

</comment></comment><comment><USER11> I've been programming since I was 8, and I'm now fast approaching 40. This makes it a bit hard for me to isolate the specific influence of programming on my life habits. That said, I do have a couple thoughts on how programming might have been helpful.

For context, the systems I work in are typically nowhere near perfection. This leaves me with a continual list of things to be done that ranges around 5-10 person years of effort to complete. Because of this fact, I have had to learn to be tolerant of the imperfections, organized enough to keep a long-term plan in focus, and tactical enough to fix things in a sensible order. It's also been useful to develop an understanding of when costs are sunk and when ideas aren't worth further development.

I'd say that all of this has been useful in my day-to-day life.

Something that's come to me more slowly is the human aspect of software development. My earliest programs were all one person affairs: I'd be the only author, reader, and user of the software I wrote. The older I've gotten, the more interesting it is to write software that other people can contribute to, understand and use to better their life. Learning how to build systems that do that is teaching me a lot about design, empathy, and how to think outside my own head. This is still a work in progress, but it's been very rewarding.

</comment><comment><USER12> For any problem I face in real life, I start to break it down to make it more manageable pieces. Eg, my wife would say the bank is over charging us in their bank feeds. I would break that down to what fees are we talking about, how are we using the accounts to cause the fees etc. It drives my wife nuts.

One bad habit that could be attributed to programming is that I don't remember much anymore. I just jump into SO or wikipedia etc to get the information, and I also keep a bunch of notes in my pocket for "all the things I need to remember".

</comment><comment><USER13> Not to sit around speculating about how something may work or what may be faster when a test case can be built that quickly proves which works or is faster.

</comment><comment><USER14> Mirror/cached version : [http://webcache.googleusercontent.com/search?q=cache:4RhIBeM...](http://webcache.googleusercontent.com/search?q=cache:4RhIBeMizh4J:www.stackprinter.com/export%3Fservice%3Dstackoverflow%26question%3D168805%26printer%3Dfalse%26linktohome%3Dtrue%26utm_source%3Ddlvr.it%26utm_medium%3Dtumblr+&cd=1&hl=en&ct=clnk&gl=ca)

</comment><comment><USER15> I no longer just believe what I'm presented with - I have to debug, dig deeper, look beneath the covers and find out what is causing the phenomenon. My wife often complains, but once I get that debugger fired up and start .. slowly .. stepping things through, it all comes out in the end.

<comment><USER16> _My wife often complains, but once I get that debugger fired up_

How are you attaching the debugger to your wife?

<comment><USER6> +1, I am also curious. All attempts to debug my wife so far have been frustratingly inconclusive.

<comment><USER17> It's easy to blame an upstream bug, but in most cases, it's usually an implementation error on your part.

<comment><USER6> Indeed, I am guessing this is most likely the case.

<comment><USER15> Hint: Batteries not included.

</comment></comment></comment></comment></comment></comment><comment><USER18> Programming taught me to stop wasting time theorizing and arguing with anecdotal evidence when I should be implementing and testing my hypothesis. It taught me that sometimes extensive planning is not as important as being able to react and respond to problems as they come.

</comment><comment> V-2 Attention to detail, eg. an eye for typos.

Learning by doing > learning by reading (although it cannot replace the latter).

Not getting emotionally attached to my solution only because it's mine.

</comment><comment><USER19> Patience and trust.

When others say something will take longer than I would expect, I trust them more. They're the ones who are doing it; they know the details that I don't. And it would take too long to make them explain all the details to me. And as they work on it and realize it will take even longer, I have sympathy because boy have I've been there myself.

</comment><comment><USER20> \- Leave something in better condition than you found it

\- Take a little extra time to be thorough

\- Nullius In Verba (On the word of no-one) i.e. See for yourself

</comment><comment><USER21> I question the top answer as being a good habit at all. It's like saying "there's probably some magic going on that I'll never understand". There's a reason why you're wrong. You should probably find out and absorb the reason instead of pretending like the world operates in some mysterious way.

<comment><USER22> I don't think that's what he's saying at all. It's closer to following a scientific approach; what you "know" is simply a more or less wrong model of the reality. You may study something "magical" until you understand it completely, but you _still_ must be prepared to revise your knowledge if suddenly you learn something new that goes against it.

<comment><USER21> Programming systems can be treated scientifically, but they can also be treated deductively (like math). It's possible to have full knowledge of what's going on if you treat it like a deductive system. If your primary way of learning is through experiment, then yes, you will be wrong a lot of the time. But then I would never claim you had a good reason for believing anything.

I can't view the stackoverflow link right now, but the top answer basically claimed "I feel strongly about my reasoning, but nevertheless, I could be wrong". How could that be unless you made a mistake? The system is logical!

</comment></comment></comment><comment><USER23> Good things:

\- thinking in graphs and dependencies

\- intuitive understanding of 3d vectors and matrices operations

\- a few really useful tricks when troubleshooting anything (this thanks to debugging a lot)

\- reading and writing in English

Bad things:

\- laziness (I already know how to do this, what do you mean I actually have to do it, too?)

</comment><comment><USER24> Learn the hotkeys/keybindings, and the equivalent in real life applications.

In other words, invest some time in learning the most efficient manner to do seemingly mundane things. It pays off in the long run.

</comment><comment><USER25> Spelling and grammar are an obvious one. Less obvious is an improved ability to think critically and spot flaws of logic in arguments.

</comment><comment><USER26> I am a walking logic gate. Everything is binary for me.

Every choice is a decision tree and every action is an algorithm.

<comment><USER27> –Honey could you check if we've got any milk and go to the store to buy some?

 _Programmer logic mind interpret_

      if(fridge.contains(Consumable.milk) &&
         legs.walkTo(location.getMarketNearest(this.location))
      {
          store.buy(Consumable.Milk);
      }

Well since we didn't have any milk I'll just go back to idling.

<comment><USER28> I was about to point out the "bug" in your "code", but then I reread the sentence. And now I need to use this as a joke with my wife. I'll probably get punched jokingly for this one, as with all my bad jokes :P

</comment></comment></comment><comment><USER29> Reading this thread, it becomes obvious that we have all picked up one bad habit: OCD.

</comment><comment><USER22> Yeay, another opportunity to rehash the tired discussion on SE's policies. I'm sure it won't be filled with the same arguments as all the other threads /s</comment>


Apple Crushed the Dreams of Developer by Copying Their App and Launching in WWDC - <AUTHOR> https://medium.com/@hisureshg/apple-lost-innovation-copies-the-developer-app-and-launches-in-wwdc-breach-of-trust-with-bce9595ee025 <comment><USER2> If you're against software patents, you should be against boo-hoo articles like this too. Coming up with a software idea first shouldn't give you an exclusive right to that idea, either in the court of law or the court of public opinion.

</comment><comment><USER3> This is silly. Apple definitely has a track record of killing small companies every WWDC, but in this case the 'stacks' feature has been in and out of OS X betas for many many years. IIRC they have patents on the feature.

</comment><comment><USER4> This article has been deleted

</comment><comment><USER5> What's new?</comment>


The Ethics of Neuroscience (2017) - <AUTHOR> https://lens.monash.edu/@a-different-lens/2017/12/04/1268065/the-ethics-of-neuroscience <comment><USER2> I contribute to an effort to run a clinical trial for applying statistical models to drug-resistant epilepsy, for patients who will undergo surgery. The results are complex both scientifically and morally. We saw a patient undergo a "failed" surgery in the sense that seizures continued but GPA shot up to 4.0. That patient is coming back for another surgery, but clinicians aren't sure what to do. Not to mention that total cost is something like 50k+ euros: what other pressing problems could be solved with a large budget?

Outside of invasive neurosurgery, it's also difficult to draw the line between stimulation & behavioral protocols, which can rewire the brain, that are good and those which are bad (for whom? by what metric?). The questions have little to do with neuroscience imo.

<comment><AUTHOR> The other day I was joking about "fixing" conservatism by frying their amygdalae. I'm pretty sure it's unethical, but, boy, it sure would solve a whole lot of problems.

Just to be clear, I wasn't serious as I am not being serious right now. Amygdalae are useful to prevent us from doing stupid dangerous things.

<comment><USER3> It's interesting that brain damage or impairment reliably causes "liberal" and atheistic feelings in the laboratory.

<comment><USER4> >reliably causes "liberal" and atheistic feelings

I'm sorry, where are you getting this from? That seems contradictory to common knowledge in this subject, and if you want to do a silly thing like label certain behaviors "liberal" or "conservative" in the context of U.S. politics.

<comment><USER3> Don't shoot the messenger, I'm just relaying what the research says. [http://journals.plos.org/plosone/article?id=10.1371/journal....](http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0052970). There are other studies that electromagnetically impair amygdala function which induced hyper empathy and atheism in the lab, but sadly I haven't been able to find them again on Google.

<comment><USER4> That study doesn't even remotely support what you said. If that's all you can find you're basically just making stuff up.</comment></comment></comment></comment></comment></comment>


Fork: Fast and Friendly Git Client for Mac - <AUTHOR> https://git-fork.com <comment><USER3> I can't even test the functionality because it won't let me pass the first screen because I don't have config user.email set in my gitconfig.

[http://imgur.com/a/T4s4o](http://imgur.com/a/T4s4o)

I have a pre-commit hook that is installed on all new repo's I create/clone that warns me, and then I set an email address PER REPO. This way I can work on both $WORK and open source projects on the same machine while having different email addresses per repository.

The assumption that a user needs to have user.email set globally breaks my entire work-flow.

<comment><USER4> Hi. Didn't even think about such a requirement. In next version I'll make credentials optional (with a warning though).

<comment><USER5> People shouldn't use git without having configured that. It would prevent incorrect commits landing in public repositories. Actually git defaults to some made-up local git author if it's not set, and that's less useful and sometimes invalid, provoking git-fsck errors.

<comment><USER6> Git explicitly shows a "Committer" line when typing the commit message if it chooses a default, so I also find not setting one globally and getting this reminder to be more useful:

      # Please enter the commit message for your changes. Lines starting
      # with '#' will be ignored, and an empty message aborts the commit.
      #
      # Committer: Ben Alpert <email@example.com>
      #
      # On branch master
      # Your branch is up-to-date with 'origin/master'.
      #

</comment></comment></comment></comment><comment><USER7> I love [https://www.git-tower.com](https://www.git-tower.com) but it isn't free. However, you can try before you buy.

</comment><comment><USER8> I have been using atlassian sourcetree for quite a while. It has very similar look and feel :)

[https://www.atlassian.com/software/sourcetree](https://www.atlassian.com/software/sourcetree)

<comment><USER9> Yeah, I had to do a double take because it's almost screen for screen the UI of sourcetree.

<comment><USER10> All of the Mac Git clients pretty much look the same, though.

<comment><USER9> I sort of wondered about that thinking maybe there's only one logical way to design a git GUI on osx, but then even within this thread people brought up a few other examples that look totally different:

[http://gitup.co/](http://gitup.co/)

[http://gitboxapp.com/](http://gitboxapp.com/)

But I do agree there are lots of very similar UIs for various git GUIs. And I'm sure SourceTree borrowed lots of their layout from others as well.

<comment><USER11> [https://www.gitkraken.com/](https://www.gitkraken.com/) is also different.

<comment><USER12> I switched from SourceTree to GitKraken, I don't know all the internal issues of what transpired at Atlasian on the SourceTree team, but to me it's just not the same product that the old Mac app was when they where independent.

I really like GitKraken and the team is taking feedback applying it constructively and putting out an impressive product. The part I really like is it's the same app on OSX, Linux and Windows using Electron to build it was a smart move on their part. My favorite feature has to be dropping a branch on another branch to create a pull request. I don't fanboy stuff much these days but I am a pretty big fan of their's right now.

</comment></comment></comment></comment></comment></comment><comment><USER13> This looks sweet! I use git quite lightly right now as I'm currently the only developer on my project. Gitup.co is the benchmark of Git apps for me right now. I barely need anything more than it and it's so incredibly light feeling. Like the app goes out of the way so that I can do what I need, such as reviewing lines to be staged.

It hasn't been receiving many updates unfortunately. I'm happy that another app has popped up! Looking forward to try it out.

<comment><USER14> Another gitup user here. What kind of updates were you hoping for? Seems pretty solid to me.

<comment><USER13> Looking at the website I see there's quite a few features I didn't know about! Maybe there's not really any update I would need after all.

</comment></comment></comment><comment><USER15> I'm a Tower user, not really seeing a compelling differentiator here (tabs look interesting however), but perhaps someone is seeing something I'm not.

<comment><USER16> tabs are coming to Tower very soon. They are already part of the 2.5 beta :)

</comment></comment><comment><USER17> What will this will cost once it's out of beta? Do you have any plan to open source the codebase?

</comment><comment><USER18> I suggest not using the magnifying glass icon for the repo favorites. It is confusing especially because you have a search field already on the right hand side. Might I suggest a star icon or a list icon for the list of repos?

<comment><USER4> I use the magnifying glass icon for the "Open quickly" window.

It's supposed to be something like Spotlight search in OS X ([https://dl.dropboxusercontent.com/s/vopjz0e9tp1k1ul/2016-08-...](https://dl.dropboxusercontent.com/s/vopjz0e9tp1k1ul/2016-08-29%20at%2022.30.png)).

<comment><USER19> The idiom is magnifying glass representing search.

The star icon more closely aligns with quick access to something used often.

</comment></comment></comment><comment><USER20> i have been using GitBox ([http://gitboxapp.com](http://gitboxapp.com)) for quite awhile now, but it seems like it doesn't get much in the way of updates, so i tried this.

Very first thing it does is write a file called "gitclient.log" to my home directory. i deleted it, and it came back the next time i started the app. I see nothing in the prefs that allows you to move the file somewhere else.

call me picky, but this is is a deal-breaker for me. _nothing_ gets to write files to the root of my home directory. Right into the trash.

<comment><USER4> The developer is here. I've already mentioned, I wasn't ready to be on HN today (I'm not the OP), and that's why I missed logging. Anyway, I'm really sorry for that.

Right now I'm making a new build with the fix. Thanks for letting know.

<comment><USER20> Good on you for fixing it. I'll have another look after you put up a new build.

<comment><USER4> It's fixed now. I released new build. It's available on the website. All the users will receive the update automatically tomorrow. Thank you

</comment></comment></comment></comment><comment><USER21> I use tig ([https://github.com/jonas/tig](https://github.com/jonas/tig)) because it doesn't require me to leave the terminal and I find it does everything I need from a git UI without getting in the way

</comment><comment><USER22> Yet another Git GUI front end :-)

The homebrew version of the Git is bundled with two Git GUI frontends called gitk (invoked with `gitk`) and git-ui (invoked with `git gui`)

<comment><USER23> It's not just homebrew, they're part of most standard git distributions (fully cross platform!)

<comment><USER22> I suspected but I was sure if that's the case or not.

</comment></comment></comment><comment><USER24> What's an argument for switching from Sourcetree? I recently tried Git's own Mac client and was running back to Sourcetree within a few minutes...

<comment><USER25> Do you really need one? Sourcetree is awful. Slow. Bloated. It even fails to dim non-available UI elements all over the place. Doesn't know how to use checkbox widgets correctly.

I love the 5-6 seconds of waiting for its UI to gradually, slooowly, update itself after you do virtually any operation, no matter how simple.

<comment><USER24> I guess I haven't had any UI issues with it as far as asset popping, although going through their "big update" and the related auth problems left it pretty much unusable for a full week.

</comment></comment></comment><comment><USER26> I normally use the command line for everything but I do use a graphical git UI (magit). It's so much better for staging and rebasing/fixups.

</comment><comment><USER27> The only thing that jumps out at me is the visual of the git tree diagram on the left - other than that why not just use the command line?

Am I missing something?

<comment><USER4> When you use a git GUI some console actions can be made easier:

\- I can stage/unstage/reset my changes line-by-line

\- I can observe the whole repository structure as it was at the moment of commit

\- Gui client automatically keeps my submodules in the valid state so I don't need to check their state after each checkout

\- I can quickly review the whole repo history (sometimes it can be useful when I am involved in a new project)

\- I can see clearly the commits which are going to be pushed

<comment><USER28> All of these things are readily available from the native interface. Hmmm... Maybe a GUI man page browser could replace hundreds of these projects...

</comment></comment></comment><comment><USER29> If it doesn't include interactive rebase, it's not worth the cash because I'll have to go back to the CLI before I merge anything.

EDIT: Fork looks wonderful, I didn't mean to be so cold—just pointing out that it's hard to write a replacement for the original tool, and that I value it when it happens. I believe Sourcetree supports it.

<comment><USER15> > it's not worth the cash

Well, it is free :-) (at least while in beta)

<comment><USER30> Will it be paid after the beta? It's important to be upfront about these things.

<comment><USER4> I'm planning to keep the main version free. However, having a premium version with some _extra_ features is also possible.

</comment></comment></comment></comment><comment><USER31> I can't live without line by line commits. It's the only reason I use a GUI over the command line to begin with.

<comment><USER32>
        git add -p

</comment></comment><comment><USER33> I wish someone would maintain a list of all current (and past, abandoned) Git UIs, including a feature grid. This would both help the community using them, and help people who think "oh, I'll write a Git UI!".

<comment><AUTHOR> All of the ones I'm aware of are either cross platform (i.e. the user experience on single platforms is less than ideal) or closed source.

</comment></comment><comment><USER34> The web page lacks any screenshots of the change staging screens.

<comment><USER35> Yes. I looked for that too. Those are the screens that bring by far the most value for me in gui clients... (instead of "git add -p")

<comment><USER4> Thanks guys. I'll add them soon.

</comment></comment></comment><comment><USER36> Neat. But please check if a name is taken, so we don't have to tell people that we used Fork to checkout a copy of the Linux source tree, and fix a bug in Fork.

</comment><comment><USER37> For anyone looking for a Mac graphical git client, I should mention GitBox here ([http://gitboxapp.com](http://gitboxapp.com)) as I've used it for years to augment the command line. Not all the GUI clients for git are useful, but I really like GitBox. Right mix of features.

</comment><comment><USER38> This is awesome, and might actually finally replace GITX for me.

Needs a CLI to open repos with.

For now I'm using echo /Applications/Fork.app/Contents/MacOS/Fork > /usr/local/bin/fork && CHMOD +x /usr/local/bin/fork

which is not super ideal

*edit - <USER2>

<comment><USER39> Same boat. Everything beyond GitX has too much clutter.. This is basically Gitx with tabs which is all I ever wanted :)

</comment></comment><comment><USER40> Reminds me of gitx (a good thing!) :)

Is there a way to only view commits that belong in the current branch (like git log)? The commits from the other branches are distracting when you're trying to read the history of a particular branch.

<comment><USER4> Not yet. This is a very popular request. I'm going to implement that next week.

</comment></comment><comment><USER41> For an open source alternative, remember there's also the forked version of GitX:

[https://rowanj.github.io/gitx/](https://rowanj.github.io/gitx/)

<comment><USER42> This. I can't really tell how much time of doing "git commit -p" GitX has saved me. It's a much easier way to visualize, stage and group changes into commits when you've made a bunch of unrelated changes.

</comment></comment><comment><USER43> I'm surprised no one has mentioned GitKraken yet (gitkraken.com). Cross- platform and beautiful. Edit: oh and free!

<comment><USER44> And super slow and lacking basic GUI functionality like multiple file selection and individual line staging.

<comment><USER12> It has had both for several releases now.

</comment></comment></comment><comment><USER45> Shout out to SmartGit. Syntevo has being making version control that don't suck for over a decade. Tried and true.

</comment><comment><USER46> i'd like to add Git Extensions ( [https://gitextensions.github.io/](https://gitextensions.github.io/) ) to the list. Open source, free, and with lots of features and plugin

</comment><comment><USER47> Git itself is Free And Open Source; so I just use Free And Open Sourced clients for.

</comment><comment><USER48> Do any of these clients support side by side diff? Why is that such a rare feature?

<comment><USER4> I also miss side-by-side diff and hope to implement it when I finish high priority features.

</comment></comment><comment><USER49> I don't get it, it doesn't do anything but crash. Whatever I do.

<comment><USER4> The Fork developer is here. I received few crash reports today, fixing them right now.

P.S. I wasn't ready to be mentioned on HN today :).

</comment></comment><comment><USER50> Love the GitX-style tree view!

</comment><comment><USER51> How much faster is it than competitors?

<comment><USER34> Yeah, not sure what "fast" refers to.</comment></comment>


Tesla's stock just hit a record $420 - <AUTHOR> https://www.cnn.com/2019/12/23/investing/tesla-stock-420/index.html <comment><USER2> The stock is blazing!

Weed jokes aside, the market has finally caught up to the fact that Tesla is years ahead of their competitors. I bought my Model 3 18 months ago and it _felt_ like buying a car from the future. I think my feeling was correct.

2019 saw a number of serious competitors (Audi, MB, VW, Porche) release their first EVs and they've all been somewhat disappointing. Very solid first releases taken in isolation, but the market expectations were that the "Big Boys" were coming in and were going to wipe the floor with Tesla. Turns out they couldn't, Tesla's head start is real and consequential.

If you go out and actually try to put down $40-50k on a car and judge all EVs on a collection of attributes (range, efficiency, safety, charging options, tech, etc) Tesla clearly stands out. It's tough to convince yourself to put down a nearly-equivalent amount of hard-earned money for another brand, so it is no coincidence that they outsell other EVs by a very wide margin.

<comment><USER3> > the market has finally caught up to the fact that Tesla is years ahead of > their competitors.

Incorrect. The stock value is being pushed up by:

1\. Unexpected quarterly profits in October;

2\. Tesla planning to open a new factory in China and securing a 1.4 Billion dollar loan to do so;

3\. Apparent strong interest in the Cybertruck and the impending announcement of the Model Y;

4\. USA and China are easing the trade war, which is pushing the whole stock market up (there have been "records" left and right in the past few days).

But the big one is number 2. Tesla moving into China means that they can tap into the humongous Chinese market.

<comment><USER2> Well, TSLA is a very sentiment-heavy stock, so it's hard or impossible to say what exactly caused this recent run.

For example, they've been guiding Q3 and Q4 profitablity since ~Q2 or earlier. They started building the Shanghai factory in Q1, the Model Y was announced in March, the Truck's been talked up since forever, etc.

What's really changed is that the Taycan is no longer a mystery, but a real car with a real price tag and real range. The ID.3 is almost-real and struggling with software issues. The E-Tron, new Leaf, new Bolt, etc have real sales figures. When these were unknowns, you could be reasonably skeptical of Tesla's claims, but that's increasingly untenable.

Or, as the great Silicon Valley philosothoughtleader Russ Hanneman said: [https://www.youtube.com/watch?v=BzAdXyPYKQo](https://www.youtube.com/watch?v=BzAdXyPYKQo)

</comment></comment></comment><comment><USER4> Besides all the funding secured and pot jokes, can anyone explain what has happened to this stock recently? Over the last two months it has gone up roughly 30% after already having a big immediate jump after the last earnings. Is this mostly related to long term shorts finally closing their positions in the wake of those earnings? Or was there some big Tesla news that I missed that changed the perception of the company's financial position?

<comment><USER5> It's probably not one single reason. Tesla has had a lot of good news lately, from reports about Elon behaving a little better (and winning that defamation lawsuit), to competing EV from companies like Mercedes and Audi not really selling well and securing a large area for GF4 near Berlin. The most impressive feat for me was how quickly they built GF3 and started production in China, but my tiny contribution to the stock price was earlier this year (late May), the return to profitability in Q3 probably impressed many investors as well.

<comment><USER6> Other smaller stuff too:

      - Porche's Taycan EV is supposed to be the closest direct competition for Tesla cars, but its having production issues.
      - Tesla just pushed a new software update that includes a lot of useful features (voice keyboard/commands, an official camping mode, saving camera clips on honk, etc)
      - A lot of miscellaneous positive press is cropping up from the end of the year and end of the decade type reporting - Time for example put it as one of the "best gadgets of the decade".
      - They recently released and presumably are testing a paid software update to boost M3LR off the line acceleration, which is an interesting situation to obtain revenue from already sold cars.
      - Internally they're pushing to sell a lot to break sales numbers before EOY.  Some places are reporting that they're even selling showroom floor models.
      - They secured a US$1.4B loan from Chinese banks for GF3 acceleration, which was already ahead of schedule.
      - They closed on the land for GF4 and are reportedly looking to start building Jan 2020.
      - The recent news of possibly reinvigorating the EV tax credits in some way probably also helped.
      - Solar is ramping up as well.

</comment></comment></comment><comment><USER7> WSB is going bananas over this:

[https://www.reddit.com/r/wallstreetbets/](https://www.reddit.com/r/wallstreetbets/)

</comment><comment><USER8> Just for reference, the claim that "420" comes for a police code for marijuana possession is completely incorrect:

[https://en.m.wikipedia.org/wiki/420_(cannabis_culture)](https://en.m.wikipedia.org/wiki/420_\(cannabis_culture\))

<comment><USER9> Seems like a strange thing to go around correcting people on. I didn't even know it was supposed to be a police code, it's just some silly code word for weed that like 85% of American english speakers understand to mean weed.

<comment><USER10> I, for one, always thought 420 was a reference to a police code for possession (similar to 187 for homicide).

Eidiran's post just led me to a few posts about it, and I found this article where you can see a video of the guys back at the exact place of their high school they met at 4:20. I really enjoyed this.

[https://www.sfchronicle.com/bayarea/article/The-420-code- The...](https://www.sfchronicle.com/bayarea/article/The-420-code-The-high- larious-definitive-story-12849127.php)

Depending on how one spent their high school afternoons, it might bring back memories :)

</comment></comment></comment><comment><USER11> > 420 often refers to the police code for cannabis possession

Hah, this journalist is so out of touch with the joke. 420 is the time to blaze it!

<comment><USER12> 420 was the California Bill for medical marijuana legalization (and of course the time to blaze it).

<comment><USER13> > 420 was the California Bill for medical marijuana legalization

"420" was established term for weed before SB 420 of 2003 was introduced; the slang didn't come from the bill but the bill was introduced on a timing to exploit the slang.

Also, Medical Marijuana was legalized by Prop 215 of 1996, SB 420 of 2003 was a measure to revise some provisions of the regulatory regime.

</comment></comment></comment><comment><USER14>
      Funding secured.

</comment><comment><USER15> It was just at $140 a month or two ago I feel like. Incredible

<comment><USER16> It hasn't been at $140 since 2013. It dipped to $150 in 2016, and $185 in the spring after a long, slow decline early in the year. If you'd bought it during that dip it would have been a big win.

</comment></comment><comment><USER17> Every Tesla stock price increase story is always followed by the mandatory story of Tesla short sellers getting crushed.

<comment><USER18> Because it's the most shorted stock in history relative to its float/market cap?

</comment></comment><comment><USER19> [https://techcrunch.com/2019/12/23/tesla-lands-1-4-billion- fr...](https://techcrunch.com/2019/12/23/tesla-lands-1-4-billion-from-chinese- banks-to-build-out-its-shanghai-gigafactory/)

</comment><comment><USER20> Tesla finally seems to be focusing on building cars in volume. Not making heavy-truck prototypes. Not talking about "transportation as a service". Not claiming self-driving. Just making electric cars at a profit. That's good for the stock price.

<comment><USER18> >Tesla finally seems to be focusing on building cars in volume.

That has always been the case. Perhaps you meant "Media and markets know focus on Tesla's building cars in volume". It takes time to build plants, install machine them and organize the whole logistics/delivery part. They've always been focusing on this, and had to run the show so people would be ready to take delivery by the time they reach mass production.

</comment></comment><comment><USER21> I cannot believe that the significance of the $420/share price just now occurred to me.

</comment><comment><USER22> Take that shorters!

</comment><comment><USER23> stocks (on average) tend to always go up...

<comment><USER24> Except for those that go down, of course.

</comment></comment><comment><USER25> Funding secured.

</comment><comment><USER26> The shorts on twitter are particularly venomous today. I have to wonder if they're too emotionally involved in this. Tesla is seriously flawed but "fraud" is truly ludicrous.</comment>