Digital Tools I Wish Existed - <AUTHOR> https://jborichevskiy.com/posts/digital-tools/ <comment><USER2> The "Queue Management for Inbound Content" section is _exactly_ what I really want as well, so much that I've just started building it instead of waiting and hoping.

For me, this is the lynchpin:

> "all content I think my _future self_ would appreciate me consuming." > (emphasis mine)

Current content feeds are optimized for engagement (ie. advertisement load) and thus won't conceive of a "future self", only what your current self will look at and click on _right now_.

I think that content feeds need to incorporate goal-orientation and move away from right-here-right-now orientation. For those wanting to do anything difficult they need to optimize their information diet over a very long time- scale, like years, so content-feed tools should be aware of human-scale timelines (eg. high school, college, career, parenting).

Humans thrive on learning and growth but so many platforms choose to see their users as merely inputs to an ad-delivery optimization system.

> I have little visibility into required time investment and foundational > context until I've opened it and started thinking about it.

This is another thing that really annoys me about our current media ecosystem, and is really also a symptom of not properly conceiving of a person's personal development over time and a person's changing needs over time.

\---

To look at this blog post from 1000 feet up, I'd say that Jonathan is unfortunately deprived of these tools because our media software ecosystem is madly building things for users who want to look at things and not think, as such platforms are heavily consumeristic and thus fantastic for advertising revenue and monetization generally (eg. Instagram, Snapchat, TikTok, Pinterest, Canva).

<comment><USER3> I have been emailing links to myself tagged with a one word keyword for the last decade. They focus on things that I or my (unconceived, unborn) son or daughter would like to read, learn or understand "later". I have about 10k sitting in my inbox (including this one) that I plan to convert into a critical path and consumption order once I take a sabbatical.

Sometimes the best systems are the simplest.

<comment><USER4> What kind of algorithm/system do you think you'd use to convert them into a consumption order?

<comment><USER3> Create a rough dependency graph and perform a topological sort, potentially skipping, down weighting, or skimming nodes that are onerous to consume but of dubious value (e.g. a link that's a review about a long textbook that isn't fundamental to a space).

</comment></comment></comment></comment><comment><USER5> This is taking your digital life very seriously.

I feel like saying he should have less screen time and live in the real world cause such details don't matter at all.

But what a hypocrite that would make me.

<comment><USER6> It can also be a case of wanting the means to that end. Some have certain minimal needs either professionally or simply personally and the more efficient that process, the more time there is for everything else.

</comment></comment><comment><USER7> I have been thinking about these questions as well. The gist is, it seems we need tools to manage data created from all the applications that we use. Today, there's so much data, that the most important tools are those that separate signal from noise.

Some things that I have considered: \- I like to read long articles on my e-paper reader, there are several services to do this. \- I need all quotings from articles, books and my personal notes to be accessible in one place, indexed and searchable. \- My whole knowledge base should be easily shared with other people. \- I want to find others with similar interests to mine.

Some interesting technologies that have the potential of bringing this to reality is the Beaker browser and the Dat format for sharing. Also, I really like World Brain's memex for web annotation, searching and sharing.

It seems we are getting closer, but we need to connect the different tools into a widely used workflow.

<comment><AUTHOR> > My whole knowledge base should be easily shared with other people. - I want > to find others with similar interests to mine.

Yes! And I think this paves the way for an interesting collaborative knowledgebase as well.

Agreed on a missing workflow to bind everything together. Do you keep your annotations + notes in Memex? If so, do you add an external annotations (say, from ebooks) into it?

</comment></comment><comment><USER8> It's interesting that your "tool" revolves around you... in other words, Revolves around a single user. What I see happening in the content ecosystem are two things: 1. Easier to make content than ever before and 2. Variety of content is collected by topic, not by user.

1\. Social Media and all web content tools are always making it easier to make stuff. This might not be very good, but it's good. Yes we get more noise than signal, but in time there should be tools to cull that noise. The numbers are astounding, 500 new podcasts are started, a day. Millions of YT videos uploaded a minute. Medium made it fast to write.

2\. Platforms, even medium and social media, allow you to collect around topics. Yes hashtags, but also publishers/pages. I can search IG through #technology or follow @technology. Same name different stream of content.

If you'd like a mix of audio, video and writing, there needs to be a publisher that creates on a single topic. Digital publishers a plenty. PopSugar, Bustle, Jalopnik, The Athletic, etc. These will continuously get better and worse as their revenue models mature. There will be a hybrid of ads and fees. But the "best" ones, the higher signal to noise will be ones you pay for. $50 a year for The Athletic is a steal right now if you want it. Trade pubs, The Information, Business of Fashion, and the like are multi-medium publishers.

Spending $200 a year between 4 trade pubs that help me be a better person, saves a couple days total of ads for me and supports 20 journalists do the best work they can. Sounds like a good deal to me.

</comment><comment><USER9> Thanks for writing this. This is awesome.

What I see missing is an ecosystem of interoperable tools.

It would be great if I could have a location/format in which all my digital knowledge is stored. And then be able to use different tools which support multiple processes/flows:

* a flow for discovering content

* a flow for archiving the highlights I take on the web

* a flow for writing notes

it would be great if I could change any tool while keeping the flow intact.

The only thing that somehow mirrors this is Evernote + Readwise + IFTT. There are tons of integrations that allow you to populate Evernote from tweets, Highly, Kindle highlights, etc. What I would love is if I could easily swap Evernote with any other editor (e.g. Bear) without changing much.

I wouldn't mind paying for these tools I would just like this personal knowledge software to work in a way in which you can natively add blocks/functionality to it. Most of them have huger vendor lock in.

<comment><AUTHOR> I like your abstraction of the different flows. Definitely agree the key is not a one-size-fits-all approach but instead much improved interoperability between the user's preferred tools.

</comment></comment><comment><USER10> This is what I want as well.

I feel as if this is the kind of thing Google might still be able to get right; "to organize the world's information and make it universally accessible and useful" is still the company's mission, after all, although it's been diluted by ten years in the wilderness of developing products in what seems like all directions.

If Google had not strayed Keep would be this. Assistant would be this. Honestly Assistant and Keep would be one and the same thing, perhaps: a single Assistant that is about remembering what you need to remember, finding what you need to find, helping you do what you need to do. This parallel universe Assistant has an open API that nerds like you and me can really use to set up complex workflows. We then are able to share our workflows with each other, and eventually perhaps even build products (apps) on this platform for the less technical users. Split the revenue in an Assistant Store. It could smoothly diversify into Mechanical Turk territory, but with more and better automation.

While Google is asleep, startups can revolt.

Disclaimer: I work for Google but the opinions expressed here are personal and not those of my employer.

<comment><USER11> The issue with Google is, that Google doesn't care about privacy and randomly changes its behavior, like recently closing thousands of accounts for using the live chat in YouTube. This company isn't trustworthy.

I'd prefer such applications to run offline with automatic instant synchronization, so no company can tell me what to do or not to do.

<comment><USER10> I understand why you think that, and you might be right. But I also know there are _a lot_ of good people at Google, and I dream of the company waking up as a group again and focusing on its mission responsibly. Doing the right thing, openly.

Having said that, I personally also think that social networks and other internet technologies should run on a federated protocol: my current (early stage) proposal for the kind of thing we should try to do with this technology is [https://flancia.org/agora](https://flancia.org/agora). I see it as compatible/synergistic with the post we're discussing.

</comment></comment></comment><comment><USER12> Hode[1] (the Higher Order Data Editor), which is free, solves some of these problems. (I wrote it. It's still evolving but it works already.)

> metadata is hard

Hode lets you encode and search any kind of information -- entities, relationships bewteen entities, relationships between relationships, relationships of any arity (number of members).

Hash, the language in which one adds and searches for data in Hode, is very close to natural language. I'll give examples below, based on the article's author's wishes.

> Let me compare my reading list with another to see overlap

This is the "and" operator. (There are also "or" and "difference" operators.) The query in Hash would look like

      /find (/eval /it #is-in (reading list #of mary))
      & (/eval /it #is-in (reading list #of peter))

> Allow me to tag books instead of placing them into static lists

Hode lets you do even better than tags -- you can classify the meaning of the tag. For instance, here are two commands that would add two tags to a book:

      /add The Wisdom of Crowds #was a best-seller
      /add The Wisdom of Crowds #(helps understand) finance

> Be tied to my highlights, annotations, and bookmarks in a non-proprietary, > searchable, and shareable format

Hode is free software, and the data format it uses is dirt-simple.

Hode permits encoding and searching just about anything I can think of. Hode cannot yet create the data for you to search, though -- so far you've got to enter the data yourself.

> Let me query this tool like a relational database. For example: show me all > books about scaling startups recommended by people I follow on Twitter or by > people they follow.

      /find (/eval /it #(is about) scaling startups)
      & (/eval (/eval I #follow /it #on Twitter) #recommends /it)

> Help me deal with prioritization

Hode lets you order your search results according to any transitive binary relationship -- "read before" or "is more important than" or "was written before", whatever you want.

[1] [https://github.com/JeffreyBenjaminBrown/hode](https://github.com/JeffreyBenjaminBrown/hode)

<comment><USER13> This looks interesting. If I may ask a naive question, why did you decide to build this as a text editor rather than tooling on top of an existing text editor (the parallel that occurs to me being Emacs and org-mode)?

<comment><USER12> Not naive at all! Making it a console app was easier just easier. I'd love it if Hode plugged into Emacs.

</comment></comment></comment><comment><USER14> Obair ([https://chrome.google.com/webstore/detail/obair/jffaiidojfhf...](https://chrome.google.com/webstore/detail/obair/jffaiidojfhflballoapgofphkadiono)) is a variant of the memex idea mentioned. It's not quite a universal memex for your digital life (which by the way is really inspiring) but rather made specifically for work docs across different work tools.

Disclaimer: I'm working on it and it's really early in the process :) Should I make Obair more broad?

</comment><comment><USER15> There was recently a post in HN called "There is too much stuff". It revolved around the massive amount of unnecessary physical goods we need to shift through to find what we are looking for. I believe the same thing happens with content.

There is way more content out there that I would like to consume than my time allows. Is not rare to make my way through an article or a 1 hour talk and think 'oh well, that was a waste of time'. Or content that has pieces that I do find interesting, but is so padded that makes the whole investment not worth it. Currently I am reading Domain Drive Design, and I didn't find insights that I consider useful after well over a third into the book (500+ pages total).

I do believe that content curation is one of the most promising fields in the near future, and it will involve a mix of human and technological solutions. This might include not only the act of recommending content, but possibly modifying said content for the user (e.g. summaries, highlights, etc.). In comparison, current recommendation systems are a pure joke.

<comment><USER16> Off topic, but is Domain Driven Design suddenly coming into vogue? I just heard of it for the first time this week and went into a rabbit hole of research. I see that the books are not new by any means. I've heard and seen it pop up so many times just this week, including from your comment!

<comment><USER17> It seems to me that a lot of people are mixing DDD and functional programming concepts, since DDD meshes well with the concept of "functional core imperative shell".

</comment></comment></comment><comment><USER18> From 2014 to around 2018 I was part of a team that was _heavily_ invested into bringing these concepts to reality. What we accomplished was amazing and I still use some of them tools day-to-day, unfortunately we had to stop.

What I wanted to share is that it was extremely hard (and ultimately impossible for us) to accrue a critical mass of people that is willing to use these things AND pay for them. We reached a few hundred paying customers; but we were 6 guys working on this full-time, so that means salaries and overall we were losing money like nothing else.

That aside, I would do it again if I could, particularly now that the "standard tools" of the internet have become useless with time. Example, Google never gives me what I want anymore and they're removing the URLs now from the results (why?).

If someone reads this and want to kickstart some kind of "internet renaissance" with me, you can reach me here: alex@<HN-username>.com

</comment><comment><USER4> I haven't read the entire article thoroughly but I think "Queue management for inbound digital content" is something implemented in an SRS app called SuperMemo. The way it's intended to work is that you have content and over time break it down and through the scheduling system you eventually end up with extracts small enough to be made into SRS cards (though it's more complicated than that in actual use). It has a lot of weaknesses, mainly because a lot of it is based on features from IE (thus poor PDF support) but I still find it extremely useful. If I find any article that looks interesting I just throw it there and eventually I'll import it, go through it with incremental reading ([https://supermemo.guru/wiki/Incremental_reading](https://supermemo.guru/wiki/Incremental_reading)) and eventually dismiss it.

Edit: I also ought to mention, it has a very good priority/interval system for scheduling when I see things. Essentially things I give lower priority are less likely to show up and when I'm going through my material/doing my reps I'm more likely to see high priority material. There's a general issue that you find the thing you see soonest most shiny and thus a strong likelihood of overprioritizing new material but SuperMemo helps intersperse everything to prevent that.

It sort of can do the central search thing too to an extent, I can search through my collection of imported articles/cards and find stuff that's generally relevant to my interests. Though how useful it is depends largely on how long you've used the app. I am also reminded of the brain ([https://www.thebrain.com/](https://www.thebrain.com/)) but I'm not super familiar with it.

Have you heard of Ted Nelson's Xanadu? I've only looked into it a little but I was reminded of it when you talked about better reading.

<comment><AUTHOR> Thank you for bringing up SuperMemo - I remember reading through Piotr's article on Genius [0] and thought it was a wonderful piece on the balance of creativity and memorization.

I've looked through SuperMemo's features and while I completely subscribe to the idea of spaced repetition (I have used Anki for some periods) I was put off by the user interface; perhaps I should try it again.

> There's a general issue that you find the thing you see soonest most shiny > and thus a strong likelihood of overprioritizing new material but SuperMemo > helps intersperse everything to prevent that.

I really the idea of this approach to keep everything at its proper priority level. Thanks for linking the brain as well - I haven't come across it.

I am vaguely familiar with Xandu as well but it warrants another deep dive for sure.

0 - [https://www.supermemo.com/en/archives1990-2015/articles/geni...](https://www.supermemo.com/en/archives1990-2015/articles/genius)

<comment><USER4> I love that article, it changed a lot of my thinking regarding people's potential for success. Woz has a lot of other articles you might also find interesting here: [https://supermemo.guru/wiki/SuperMemo_Guru](https://supermemo.guru/wiki/SuperMemo_Guru). I've especially read through a lot of his articles on sleep and memory and found them invaluable.

SuperMemo's interface was not designed with the beginner in mind. When I first started trying it even basic operations frustrated me to no end. But now that I use it as a high(er) level user, it feels very very intuitive and you start to understand why it was designed in a way that looks so unappealing at first. If you do decide to try it again, I would highly recommend joining the SM discord server ([https://discordapp.com/invite/pB7jcSK](https://discordapp.com/invite/pB7jcSK)). There are a lot of very helpful people there.

</comment></comment></comment><comment><USER19> _> Content is published in a variety of formats including but not limited to images, sound files, videos, Google Drive docs, diagrams, long-from paywalled articles, PDFs, powerpoint presentations, and base 64 encoded blobs._

One of the great disappointments I've had working in tech for 20 years now has been the way we've transformed the entire spectrum of human expression, which includes wildly different forms of art and media each of which we used to engage with in its own unique way, into an undifferentiated slurry of "content."

Every time I hear a child say they want to grow up to be a "content creator," I die a little inside. _Aspire to be a musician, or a painter, or a dancer,_ I want to tell them. _A filmmaker, a poet, a sculptor. Dream of finding your art and mastering it, not just extruding more gruel to fill some corporate pipe._

<comment><USER20> > Every time I hear a child say they want to grow up to be a "content > creator,"

Do kids really say this? If so I'm going to kill myself.

<comment><USER21> I got a rope if you want, and yes, where I used to live at least, most kids wanted to be a "steamer" or a "youtuber"

there is no hope for humanity I'm afraid

</comment></comment></comment><comment><USER22> There are only few types of digital formats I use really. Text, audio, still photo, video and maybe 3d description of a place or an object, but the last one is still quite marginal.

It would be nice make arbitrary collections of these, add metadata such as place, time and author and send them to other users or bots.

If you want to go crazy you could add permissions and encryption which would enable private conversation and message board / social media style structures. Pick boring standard file formats that are "good enough" for consumer use (one lossy and one lossless for each media)

Maybe I am dreaming of hypertext. The webserver-client structure of internet makes things easily very siloed and the ways to share documents you come a cross in the net are very clunky because everyone needs to reinvent the format and the player for everything more complicated than simple text or image.

</comment><comment><USER23> What purpose does this collection of information really serve? I like having things organized neatly and easily accessible, but I have a hard time seeing what goal thousands of scattered annotations, text bookmarks, podcast bookmarks, etc. serve.

<comment><USER12> Yes -- but it's the scattering that's the problem, not the thousands. I believe the author wants what I want -- a system in which you can easily add any kind of data or meta-data, and easily search and sort those data in whatever manner you'd like.

In another comment[1] I describe software I've made that solves some of these challenges.

[1] [https://news.ycombinator.com/item?id=21665255](https://news.ycombinator.com/item?id=21665255)

<comment><USER23> I think, I have a hard time seeing the big use from such software, because my work doesn't really require such a reference library.

A searchable collection of data is great if you have a use case that actually depends on such a collection, like writing a paper, news article or doing (academic) research on some topic.

Maybe to ask a better question, what data do you want to collect and what are you using the data for exactly?

<comment><USER12> The details of what I record (in another comment[1]) might be idiosyncratic and uninteresting to you. Those details aren't important. The important point is that so much information belongs in multiple places. A single statement, let alone article or book, might regard all of economics, justice, common sense and beauty. It might be about parsing, Haskell, and keeping data types flexible. I'd like to be able to search based on any of those things.

If there were a clean distinction between entities and tags, existing solutions would be enough. But what if you want to draw a relationship between two relationships? Most sentences longer than three words, after all, are higher-order relationships. ("Birds #avoid beetles ##because beetles #are hard to digest", for instance, is a second-order because relationship joining two first-order relationships.)

The searches Mr. Borichevskiy imagined are, I think, good arguments for why you would want to be able to encode arbitrary higher-order information. I believe Hode is the simplest solution possible that allows it.

[1] [https://news.ycombinator.com/item?id=21665698](https://news.ycombinator.com/item?id=21665698)

<comment><USER23> How often do you look stuff up that's older than say a week?

Personally, I'm kind of glad to soak up information as I go and being able to just forget everything else. As opposed to constantly feeling the need to tag, sort, archive, reference, cross-reference, keep track of information, that future self will to 99.9% never actually need.

Yet, I wonder whether use cases start to materialize, once you start using it...

<comment><USER12> Projects and how-to notes, pretty regularly. Abstract concepts like comedy, maybe yearly. It's definitely an art, knowing what to bother ingesting into the system. I have erred on both sides.

Federation could reduce the hurdle -- both reducing the need to ingest, and the difficulty of doing so. Borichevskiy (author of article that generated this thread) nods at the idea of using someone else's index of books. Such labor-sharing could be much more general.

I don't want to suggest, though, that ingesting something is a waste of time if you don't review it. That's true of boilerplate metadata like ISBN numbers. But for original ideas, or for paraphrased insights gleaned from reading online, I find that sticking it into the graph produces value at the moment it's done. The rigor of compressing an idea to a few words, and determining which adjacent concepts it bears on, and how, has helped me understand things.

(Teachers often ask their students to state things in their own words. It's like that, but faster and harder. Like punk rock for essays.)

</comment></comment></comment></comment></comment></comment><comment><USER24> It's sad that RSS is fading away. It simplified ingestion a lot. At the end of the day it focuses on content and a feed provides a quick overview of all the new content that has been published. I don't really understand why people are not into it anymore. Blogs and news sites don't even need to provide HTML pages loaded with JS and CSS when they provide RSS. Why would I bother loading so much stuff when I can get the data straight away without the bloat

</comment><comment><USER25> Kinda fits into this discussion, but I want playlists for netflix, prime, disney+, hulu, what ever, but not just running down a season, but for example a set of Christmas episodes. FXX has done some of this with the Simpsons, but I want to see other viewers lists and the possibility of across shows.

</comment><comment><USER26> Agreed with all points, but especially the queuing system. I started my journey towards becoming a programmer to build something like that. Its been a long and winding road, but it might be time to follow up on that, unless somebody can point me to a project that already exists like described in the post.

<comment><USER4> I would check out the IR feature of SuperMemo ([https://supermemo.guru/wiki/Incremental_reading](https://supermemo.guru/wiki/Incremental_reading)). There is a very steep learning curve and when you are a beginner you'll think it looks antiquated but if you ever up becoming proficient in it it will all just quick.

</comment></comment><comment><USER27> GoodReads ([https://www.goodreads.com/](https://www.goodreads.com/)) might not be perfect; but I think it at least comes close to a book log and recommendation system.

</comment><comment><USER28> LiquidText on iOS seems to enable pulling out images, snippets, etc. as the author seems to want. Not sure what happens when that app eventually dies thought.

</comment><comment><USER29> I remember I used to have unlimited browser history with a never expiring, searchable cache, but for some reason its not possible anymore.

</comment><comment><USER30> I can't help thinking that resurrection of Google Reader (and RSS readers in general) and del.icio.us might help.

<comment><USER31> How popular was Google Reader really? I don't think many people I know irl ever used it. There's a handful of known or referenced RSS readers now. Combined they just aren't that popular. I have a hard time buying that Google Reader was super popular.

There's a few bookmarking services now. Some startups like linked in the article. And Pinboard has been around for a long time. Delicious isn't needed anymore. I use Larder.io and Pinboard.in myself

<comment><USER30> The demise of Google Reader signalled the end of RSS.

RSS used to be a big thing in the 90s and early 2000s

<comment><USER31> That's my point. It's a huge talking point amongst geeky crowds. Is there any data to point to that though? It has always felt to me that Google Reader was never that big. Niche crowds made it seem like a huge deal though. I could be wrong. I'd just like something concrete.

Or are you saying it was a signal of the end for the specific niche geeky crowds? If so then I guess that's my point. Google Reader doesn't and never did move the needle that much.

</comment></comment></comment></comment><comment><USER32> re augmented memory, from 22 years ago, [http://alumni.media.mit.edu/~rhodes/Papers/wear-ra- personalt...](http://alumni.media.mit.edu/~rhodes/Papers/wear-ra- personaltech/)

Is what got me interested in wearable computing.

</comment><comment><USER33> Perkeep fits some of these cases

<comment><USER34> Huh. This is fascinating project, this does tick some of the boxes for me. Thanks.</comment></comment>


Evolution of Promiscuity in Angiosperms - <AUTHOR> https://www.microryza.com/projects/evolution-of-promiscuity-in-angiosperms

<comment><AUTHOR> I find the idea of crowdsourcing scientific research really fascinating. Not sure if it is a scalable model, but I love to see good science funded.

<comment><USER2> Kickstarting the next version of the Large Hadron Collider might be fun. Every person on the planet gives a dollar... Project Funded.

<comment><AUTHOR> It could fund good projects, and a side benefit is that scientists would have to connect what they are doing to real value for people. Might be healthy for the industry as a whole.</comment></comment></comment>


How to use FIDO2 USB keys with SSH - <AUTHOR> https://www.stavros.io/posts/u2f-fido2-with-ssh/ <comment><USER2> I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: [https://news.ycombinator.com/item?id=23689606](https://news.ycombinator.com/item?id=23689606)

<comment><USER3> Here's a browser compatibility matrix (I know, OP is about SSH).

FIDO2/U2F Just Works in:

        Chrome on Windows
        Firefox on Windows
        Chrome on Mac
        Firefox on Mac
        Chrome in Ubuntu 20
        Firefox in Ubuntu 20

Wall of shame (FIDO2/U2F does not Just Work in):

        Safari

EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

<comment><USER4> In a _browser_ what you want is WebAuthn, U2F is an older never technically standardized hack and should _not_ be used for new implementations.

New web sites should do WebAuthn to enable this functionality, here's a guide someone else wrote that I found helpful in talking about the moving parts to actually implement this: [https://webauthn.guide/](https://webauthn.guide/)

Firefox's WebAuthn implementation isn't as complete as it would ideally be, but it does have a nice feature of _asking_ the user whether to give out the somewhat privacy-infringing "attestation" from a FIDO2 device when it is requested by a web site. IMNSHO ordinary web sites, especially where a second factor isn't even mandatory, should _not_ be asking for attestation and I always refuse.

<comment><USER5> Care to elaborate how attestation is privacy infringing?

As far as I understand, private attestation is a specific design goal of WebAuthN, achieved by either sharing an attestation credential with at least 100 000 instances of a given authenticator or via cryptographic means.

There have been instances of authenticator vendors getting this wrong, but I remember reading that browsers will detect it and strip any attestation response in this case.

<comment><USER4> Not everybody is comfortable that 100 000 is enough.

Is that extreme? Yes, but the _upside_ to giving out attestation data just isn't there in most scenarios. It's like I have to step over broken glass to get a stale bagel. Yes these boots mitigate the risk from the glass very well but I don't even want a stale bagel anyway.

There are some scenarios where attestation makes sense. If you issued every one of your employees a genuine Yubico Yubikey then I guess it could make sense to insist on checking with attestation that nobody is using some homebrew device they built instead. But for general use? Even the tiny risk isn't justified, so it should be "off".

Here's someone _much_ smarter than me proposing something you could do _if_ you really care about the features from attestation but don't want people to give up privacy. If you insist on offering stale baked goods, here is how to clear up that glass:

[https://www.imperialviolet.org/2019/01/01/zkattestation.html](https://www.imperialviolet.org/2019/01/01/zkattestation.html)

</comment></comment></comment></comment></comment><comment><USER6> EDIT: I misunderstood the post, and what I describe below is not true!

I'm incredibly excited about FIDO2, but this is quite underwhelming honestly. I'd like to SSH with a credential on my Yubikey, not by a credential or configuration _already stored on my computer_ that is unlocked by my Yubikey. I'd like to be able to plug in my Yubikey anywhere and go. My Linux desktop, my Macbook, my Windows desktop, my Android phone.

\- Yubikey with GPG/PIV for SSH: your Yubikey stores your private key. You can take it anywhere, plug it in, [have to go through all the setup required for your computer to talk GPG/PIV], and log in.

\- Yubikey with FIDO2 for SSH: your Yubikey stores a symmetric key to unlock your private key on your computer. [You _cannot_ take it anywhere], plug it in, don't have to set anything up if your client and server have this (eventually), and log in.

FIDO2 is solving a lot of authentication convenience problems, but not this one I think. I get that this pretty nice when integrating with Windows Hello or Apple's TouchID, but I don't think FIDO2 USB key with SSH is that great.

<comment><USER7> You misunderstand how FIDO2 works. Read the article, it details how to do exactly what you say it can't. You can resume your excitement now!

<comment><USER6> In that case I'll need to update my understanding, but this still requires you to do manual configuration for your SSH key - the id_mykey_sk file in your example.

> ssh-keygen -t ecdsa-sk -O resident -f ~/.ssh/id_mykey_sk

I know this is just a reference, but it's still manual configuration. On a host with an SSH client that can speak PIV [this is a challenge], I can just plug in, enter the PIV PIN code, and go.

<comment><USER8> Read farther down, you don't need this key, you can delete it if you want. You'll just have to run `ssh-add -K` every session if you do, so your agent reads the key from the device.

<comment><USER6> Ah I missed that. My apologies, I learned something new!

<comment><USER8> No problem, it's a fantastic way to use SSH, I'm just glad it exists.

</comment></comment></comment></comment></comment></comment><comment><USER9> I managed to make this work today as described in the article, after installing and configuring the software dependencies.

Client-side hardware dependencies:

* USB token with U2F (FIDO) support. FIDO2 is optional. Any old YubiKey or similar will work.

* For the resident key feature only: USB token with FIDO2 support.

* To avoid confusion, only a single USB token should be connected when ssh-keygen is run. (When ssh is run, multiple USB tokens work, the user can touch the wrong one many times, and authentication succeeds after the user touches the right one.)

* ED25519 support in the token is optional. (`ssh-keygen -t ecdsa-sk ...' uses the NIST P-256 curve, which works with all U2F tokens.)

Client-side software dependencies:

* For communicating with the token over USB, OpenBSD or (Linux with udev).

* OpenSSH 8.2p1 or later.

* OpenSSH client (ssh) compiled with `configure --with-security-key-builtin'. Without this, eventually authentication will fail locally with `internal security key support not enabled'. It's possible to work around this by compiling an .so file and specifying it with `ssh -o SecurityKeyProvider=....so', but it's complicated.

Server-side software dependencies:

* OpenSSH 8.2p1 or later.

* Default OpenSSH server (sshd) settings (without PubkeyAcceptedKeyTypes), or PubkeyAcceptedKeyTypes in /etc/ssh/sshd_config containing firstname.lastname@example.com and (optionally, for ed25519-sk keys) email@example.com .

<comment><USER9> FYI Another client-side software dependency: libfido2 >=1.3.0. It doesn't work with libfido2 1.2.x or earlier.

Also, if it doesn't work on your client system only because OpenSSH 8.2 was compiled without `configure --with-security-key-builtin', here is how to make it work: [https://github.com/pts/external-sk- libfido2](https://github.com/pts/external-sk-libfido2)

</comment></comment><comment><USER10> I was able to get this going, but it took awhile as I use a non-standard working mode.

All of the docs I have read assume that you are logged in locally on the system, but if you are not (like me) then things fall apart.

I am running a Windows 10 desktop, and then SSH into my local Linux box from Windows. Both systems are sitting next to me and I can press the Yubikey easily.

My local Linux system is running Fedora 32 and I did the following to enable a user connected via SSH to use the Yubikey.

Created a user group for yubikey users, which in reality only has me in it.

Created a /etc/polkit-1/rules.d/99-pcsc-yubikey.rules file which gives smartcard access to the 'yubikey' group. Without this then 'ykman list' would not work.

Created a /etc/udev/rules.d/99-yubikey.rules to give access to the 'yubikey' group. I used /lib/udev/rules.d/69-yubikey.rules as the starting point for my file. I had to add my two Yubikeys USB IDs (lsusb to see them) as they weren't present.

Made sure to log out and back in to have the 'yubikey' group be active for my user. I vaguely remember a command that would do it, but I forgot it.

After all of that I got it to work :)

</comment><comment><USER11> _> be extra careful when using SSH forwarding (the -A option), as the server can then ask your computer to authenticate to other servers on your behalf._

That would require an extra press of the token's button for each extra authentication, right?

<comment><USER12> I would assume the agent caches the key for signing.

Would someone please confirm this? If it did require another key press that would be pretty huge.

<comment><USER4> > I would assume the agent caches the key for signing.

For that to happen the agent would need to have some way to get the key out of the FIDO authenticator, which is deliberately not intended to be possible. I will now go away and confirm that this behaves as I expected and update this message shortly.

Update: Yes, the OpenSSH agent just has code to go talk to the authenticator each time it needs to sign something. The authenticator may or may not (most seem to not) allow this to happen without verifying user presence (e.g. via a button press or touching a contact) _but_ even if your device does allow this the _signed payload_ says whether the user was present, so a remote SSHD can (if it wanted) demand to see signed evidence of user presence or refuse login, and I think a SSH agent can't fake that without help from the FIDO authenticator itself.

<comment><USER13> > _... so a remote SSHD can (if it wanted) demand to see signed evidence of > user presence or refuse login, ..._

I'd like to be able to, server-side, 1) require that the private key used for authentication be stored on a hardware device and 2) require user presence, but I've never read or heard that this is possible (granted, I haven't looked into too much).

If you have links to any documents that discuss how to implement this, I'd appreciate you sharing them. The only relevant documentation I can find is regarding FIDO/U2F support and even the release notes for 8.2 mention that "OpenSSH does not currently make use of this [attestation certificate]".

<comment><USER4> So there's two parts, let's take them separately.

> 1) require that the private key used for authentication be stored on a > hardware device

So for this you're going to need the attestation data, which as you observe OpenSSH currently doesn't do anything with. It _is_ willing to stash it in a file, and because it's a _certificate_ it's safe for the token's owner to send this somewhere. So you could construct a mechanism to examine the attestation file and decide whether to accept the proffered public key based on that attestation. e.g. "This is a genuine Yubikey 5C, so OK" or "This is a Crap Corp Funky Fake, no thanks".

I expect this would be a bunch of work, and I don't expect Free Software people to help build something to do it any time soon. But from what I can see it's possible with the components that already exist. Maybe somebody who really wants this will do all the work and put it on GitHub.

> 2) require user presence

The FIDO "options" bitflags have a flag for "user presence" (sometimes labelled UP). If this isn't set, user presence was not checked by the authenticator.

The FIDO authenticator includes this options parameter as part of the message it's signing.

So this means if a SSH client/ agent sends you an options field with UP set, but actually user presence wasn't checked it won't be able to provide a signature that matches. The SSH server doesn't need to do anything special except look at the UP bitflag if it cares (all WebAuthn servers are required to check this, it's on the long list of steps to perform WebAuthn authentication properly).

To be fair this isn't OpenSSH (though I'm sure they have at least somebody paying attention) it's FIDO itself that designed the signatures to also sign the user presence indication, they couldn't have avoided it.

<comment><USER13> > _I expect this would be a bunch of work, and I don 't expect Free Software > people to help build something to do it any time soon._

That's basically the conclusion I ended up at but I was hoping you were aware of some recent progress that I didn't know about! Thank you, though, I certainly appreciate the response.

</comment></comment></comment></comment></comment></comment><comment><USER14> I've been using my Yubikey in GnuPG smartcard mode for years to do the same thing, from what I can see from this tutorial FIDO2 seems a bit easier to setup initially but it also seems much less widely supported at the moment. Are there other tradeoffs to consider?

<comment><USER8> I think those are pretty much the only ones, the Yubikey in GPG smartcard mode was always too fiddly for me and interfered with my agent in other ways, but this is trivial to set up and use.

Also, a big draw of the USB SSH key for me is that I can plug it in to other computers and connect to my servers, which smartcard mode didn't do, so that was a big drawback for me.

<comment><USER15> You can't do that easily, you still need the public key file on disk.

<comment><USER8> Not with resident key mode.

<comment><USER15> Sort of. The keys have limited space on them (20 for some Yubikey models) for resident keys. You wouldn't want to be always using them for everything.

<comment><USER8> That's why I'm excited about SoloKeys v2, they (will) come with space for thousands of resident keys.

</comment></comment></comment></comment></comment></comment><comment><USER16> I've waited 10 years for this.

<comment><USER17> Waited 10 years? Why didn't you just use a yubikey in PIV mode, or the yubikey with gpg, or a smartcard, or… I've been using a yubikey PIV for, hmm… at least 5 years.

Sure, a FIDO key is cheaper.

<comment><USER18> OpenSSH doesn't do X.509, how would PIV mode or a smartcard help?

<comment><USER19> Yubikeys work in PIV mode with openssh, it just requires the necessary module and some invocation dance with ssh-agent [https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...](https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html) or Filippo Valsordas yubikey-agent [https://github.com/FiloSottile/yubikey- agent](https://github.com/FiloSottile/yubikey-agent)

<comment><USER17> What invocation dance?

This works:

"ssh -oPKCS11Provider=/path/to/opensc-pkcs11.so firstname.lastname@example.com"

Or you place that in your ~/.ssh/config

Host *

      PKCS11Provider /path/to/opensc-pkcs11.so

</comment></comment></comment></comment></comment><comment><USER20> Is this instead of typing a password to unlock the ssh key?

<comment><USER21> If you wish. You can decide if you want a passphrase on the generated key or not, just as you can with a classic SSH key. It's probably best to use a passphrase and have ssh-agent remember it for you until you shut down the computer. That way you enter your passphrase the first time using SSH with that key after logging in, and ask you to tap the physical U2F key, and only ask for the interaction with the physical key afterwards.

When I SSH to a host configured like this, the Yubikey U2F key I am using blinks to ask me to touch it. It's really quite neat.

</comment></comment><comment><USER22> been looking forward to seeing FIDO gain traction for more use cases. i interviewed at a company where there's work being done on a FIDO-enabled smartphone approach:

[https://www.hypr.com/passwordless-ssh-linux-fido- login/](https://www.hypr.com/passwordless-ssh-linux-fido-login/)

</comment><comment><USER23> Am I missing something? The commands for resident and non-resident appear to be identical.

Edit: They fixed it.

<comment><USER24> they have the addition of -O resident

from ssh-keygen:

           resident
                  Indicate that the key should be stored on the FIDO authenticator itself.  Resident keys may be supported  on
                  FIDO2 tokens and typically require that a PIN be set on the token prior to generation.  Resident keys may be
                  loaded off the token using ssh-add(1).

from ssh-add:

            -K     Load resident keys from a FIDO authenticator

<comment><USER8> I had the same command in both by mistake :/

<comment><USER25> You still do?

EDIT: I see it now.

<comment><USER8> It just takes a while for the site to deploy.

</comment></comment></comment></comment></comment><comment><USER26> @StavrosK do you have a writeup on how you put together your blog infrastructure?

<comment><USER8> Not really but it's just Lektor and Netlify, hosted on Gitlab. I also have Gitlab CI deploying the site on Neocities ([https://neo.stavros.io/](https://neo.stavros.io/)) as a backup/just to see if I could.

</comment></comment><comment><USER15> Be aware literally nothing supports this unless it's your own kernel.

Gitlab? No. Github? No. My gateway with a hand built gentoo kernel? Yes.

It seems functional, but you've also got to be aware that `ed25519-sk` and `ecdsa-sk` have sort of spotty support in the devices too. `ed25519-sk` does not work on a Yubikey <5, for example.

<comment><USER8> > Be aware literally nothing supports this unless it's your own kernel.

Ubuntu 20.04 and later supports this, and, since that's LTS, it means that quite a few servers and machines will be supporting it already.

Github/Gitlab aren't supporting it yet, but given how great it is for security, I think they have a big incentive to speed up support.

> ed25519-ek does not work on a Yubikey <5, for example.

That's no problem, since you can just generate an ECDSA key instead, but yes, not all keys have hardware support for all algorithms.

<comment><USER21> Debian 11 too, out of the box. It took a bit of work to use a newer openssh- client on my Ubuntu 18.04 laptop, but that was manageable.</comment></comment></comment>


The Urban Bike is the One  - <AUTHOR> http://www.coolest-gadgets.com/20080804/the-urban-bike-is-the-one/ <comment><USER2> This is artwork, not engineering.

All of the weight of the rider is being borne on the tiny pivot joints between the circular bits and the "boxes". The rear circular bit would have to be hollow to contain some kind of drive chain, and I I can't imagine how you would get any kind of gearing to fit in there. There are no handbrakes.

And it doesn't steer! I guess you're suppose to lean left or right? But even then, the forward wheel will be reverse-castering, making that an unstable process (the bike will try to steer harder the more it tilts).

Definitely cute though.

<comment><USER3> This is engineering, not artwork.

All of the weight of the rider is being borne on the tiny pivot joints between the circular bits and the "boxes". The rear circular bit would have to be hollow to contain some kind of drive chain, and the rear wheel would need hub gears. Internal break cables, or breaking by pedaling backwards.

Steering pivots on the middle joint, so the front circular bit turns too.

Definitely ugly though.

;)

</comment></comment><comment><USER4> I already have a working urban transport. I regularly ride a Xootr scooter (<http://www.xootr.com/>) for a working commute of about 2.5 miles, mostly on flat terrain. It takes 20-30 minutes. I can take it into the gym and fit it in a half-height locker.

Caveat: It reacts poorly against upward elevation - parallel cracks like those between the gutter and the bike lane are likely to throw you. I got a stitch in my knee from exactly that situation. I stay on the sidewalk now.</comment>


SpaceX test firing the Falcon 9 - <AUTHOR> http://www.spacex.com/webcast.php <comment><AUTHOR> Also just to manage some expectations.. the rocket will not fly.

This is just a firing of the engines I believe.

<comment><USER2> They REALLY need to say that on the page. This has the opportunity to spread virally and the crowd doesn't manage expectations very well :)

<comment><USER3> Which part about "STATIC FIRE TODAY" did you miss?

<comment><USER4> For an enthusiast, it may not be clear exactly what "Static Fire" means. While Static means non-moving, it also means the hissing noise on mis-tuned analog connections, and it's not inconceivable that it has another overloaded meaning.

<comment><USER5> > _For an enthusiast_

I think you're misusing that word. A space flight and/or specifically SpaceX enthusiast would recognize the terminology instantly.

Assuming you mean something like "amateur" or "layman", thinking anything without the word "launch" in it is in fact a launch still seems a remarkable leap of illogic.

<comment><USER6> In my dialect, enthusiast == amateur and parent used it appropriately.

<comment><USER5> I'm afraid your dialect is rather singular.

<http://www.merriam-webster.com/dictionary/enthusiast>

<comment><USER6> <http://thesaurus.com/browse/amateur>

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Linking to the press release : <http://www.spacex.com/press.php?page=20120427>

Would have prevented some confusion. The good news is that the test appears to have gone as planned so they are still on track for the May 7th launch.

</comment><comment><USER8> The mission to the ISS is scheduled for May 7th [1]. Exciting times!

[1] [http://cosmiclog.msnbc.msn.com/_news/2012/04/30/11472882-wat...](http://cosmiclog.msnbc.msn.com/_news/2012/04/30/11472882-watch- spacex-fire-falcons-engines?lite)

<comment><AUTHOR> Yes this was just a little tease before that grand event. I hope all goes smoothly.

</comment></comment><comment><AUTHOR> Countdown was halted at 47 seconds... Team reviewing data... Now clock reset to 13 minutes. Test fire possibly aborted?

<comment><USER9> From their twitter: "May recycle and try again today, watch for update."

<http://twitter.com/#!/spacex>

<comment><USER2> Just in: Flight computer aborted rocket hold down firing. Anomaly addressed. Cycling systems to countdown

Might not be long now?

</comment></comment></comment><comment><USER10> there are entrepreneurs. and then there is Elon Musk.

</comment><comment><USER11> Just my luck to switch to this and see the top comment:

      elonmusk Woohoo, rocket hold down firing completed and all looks good!!
      41 seconds ago · reply · retweet · favorite

bugger, I always seem to just miss the boat. Oh well, I guess it wasn't too spectacular from the comments here.

<comment><USER12> It fired for two seconds. There really wasn't going to be much to it anyway, unless something went tragically wrong.

Still nice to see them proceeding through all the hoops, though.

</comment></comment><comment><USER13> Countdown has resumed (~12 minutes)

</comment><comment><USER14> Here it is:

<http://www.youtube.com/watch?v=OJKs0dEbyEk>

</comment><comment><AUTHOR> Countdown sequence resumed! now at 13:50

</comment><comment><USER15> Looks like they got over some of the difficulties

"Final Readines Poll in progress"

Countdown sequence resumed at T-13

</comment><comment><USER16> I just tuned in, and it looks like the clock is still holding at T-13.

<comment><USER17> It's moving again... T-12

</comment></comment><comment><USER18> Was the test successful? Rather underwhelming visually.

<comment><AUTHOR> Hehe yeah not quite as thunderous as a Saturn :P But consider this like the rocket version of a Prius :)

<comment><USER7> And with Saturn V once you turned it on, you were going to burn through all the fuel whether that was a good idea or not :-)

<comment><AUTHOR> I can't imagine how the astronauts felt sitting on top of that behemoth. I don't think I'm exaggerating at all by saying that I would've shit my space- diapers long before the countdown reached zero.

<comment><USER7> I saw a fascinating talk last week from the guy who heads up the NASA vibration lab. According to him there is so much vibration of your head during launch that its damn difficult to read the gauges much make intelligent choices about what to do next. This was a real concern for the Constellation program which had a lot of vibration issues.

</comment></comment></comment></comment></comment><comment><USER19> The antici ...

pation.

<comment><USER20> Looks like its back on, countdown is at just under 12 minutes.

</comment></comment><comment><USER21> T-00:03:30..

</comment><comment><USER22> That was it?

<comment><USER23> Yeah I kinda felt that too, but then I thought "that's a _spaceship_!"</comment></comment>


Google to sell eBooks - <AUTHOR> http://www.nytimes.com/2009/06/01/technology/internet/01google.html

<comment><USER2> _Google has scanned more than seven million volumes from several university libraries. ... The settlement ... provides for a way for Google to sell digital access to the scanned volumes._

The authors and publishers said Google is stealing our content, violating our copyright. So Google replied that their intent is benevolent. They didn't want to harm the publishers or take their money, they didn't even want to make money. They said they were scanning these books to create searchable knowledge. Then they strike up a settlement so they can sell those scanned in books? Now they want to compete with Amazon to sell ebooks...

It was a lie from the start. They were just scanning in these books because they knew they'd be selling them one day. They wanted a head start. They lied about the race to give themselves an advantage over Amazon now. This doesn't sound "not evil" to me. Lying is not "good." Maybe it isn't evil, but is "not being evil" the standard now? Shouldn't companies rise above merely "not evil" ??

They lied, they violated the law and the copyright holders and now they are going to be allowed to profit from this illegal behavior.

Their words are not matching their behavior and that is a real negative sign in my opinion.

<comment><USER3> I don't think it's quite like that. Google still has to pay royalties and depending on how much the royalties end up being publishers would probably be happy.

There's no need to make this out to be a conspiracy, though.

<comment><USER4> >There's no need to make this out to be a conspiracy, though.

You don't generally keep up with the times, do you?

<comment><USER4> People took that seriously or was it too low class humor?

(Is it just me that hears conspiracy theories much more often now than, say, ten years ago?)

</comment></comment></comment></comment><comment><USER5> If google can offer for sale a significant fraction of the books they currently serve, I will be happy. However, The current state of the ebook market is unexciting. There are too many proprietary formats, often tied to some specific piece of software. Furthermore, ebooks often do not carry a significant enough discount over the print edition to make up for the restrictions in my opinion. I've come to this conclusion myself after I purchased an ebook, found a passage revelatory and wanted to show it to a friend, but realized that I did not have printing rights. So I was forced to go out and buy a hard copy.

I think ebooks will go the same way as digital music. Once the market becomes mature enough, consumers will demand the wares without draconion DRM restrictions which currently make the e reading experience unpleasant.

<comment><USER6> _There are too many proprietary formats, often tied to some specific piece of software._

Kindle books are just HTML with the extension changed and some trivial "encryption" on top. The encryption is there to give the publishers some illusion of security -- but if you want to read your books on a computer or other device, it's easy to remove the DRM. Once you do that, open your web browser on the resulting file, and enjoy. (All of your indexing tools that take HTML input files work quite nicely.)

DRM is "evil" and all that, but I don't worry about it since it's so trivial to remove, and always will be. If you can see it, you can copy it.

<comment><USER2> Maybe it's the removing of the DRM that is evil? I mean, it is there to protect the producer and help the producer ensure a stream of revenue and an incentive to produce more content for you in the future.

Would you want a future without content worth buying? Why can't you just live with the DRM?

<comment> bjelkeman-again And how do you create a DRM that doesn't suck?

Dead tree books have DRM which works, albeit in a shape which isn't digital. It is a pain to copy a 300 page novel, but you can do it (there are of course copyright limitations). But all DRM systems implemented fail in comparison. Of course, comparing the two directly is hard as they are very different media.

Books work well because: \- they don't stop working when the DRM vendor goes out of business (see all the music sites now gone) \- you can give them and lend them without problems \- they are compatible (i.e. you changing to a new computing platform doesn't mean that you can't now read your books)

When the convenience of electronic distribution with DRM overcomes the drawbacks then you are going to see some uptake, but the drawbacks seem too large at this point.

To have a future with content worth buying, then maybe the business model needs to change? However, book readings aren't quite as attractive as touring bands. So that is going to take some good thinking. :)

<comment><USER2> How do you create an honest society? Which is easier, DRM that doesn't suck, or consumers who don't "share?" I don't know the answer.

I think we are entering an age of consciousness. The realization that we can lie is a natural stage of maturation, a later stage is the realization that lying has negative consequences. Maybe we as a digital society need to go through a similar stage of honest consumerism. Buying things, not because we are forced to, but because we want to give producers an incentive to produce.

We could all smash windows, steal cars, bump locks... security is an illusion. We can defeat it if we want to, but we don't have to. We can all win. Life is not a zero sum game.

A balance will be achieved. If it is not achieved, then the producers will simply stop producing and life will be worse for all of us or at least for the producers or perhaps the distributors.

I don't have the answers, but we are raised to know that stealing is wrong. Honesty is the best policy. Golden rule.

Sounds simplistic, perhaps naive, but maybe that's the answer. Personally, I stopped stealing music a long time ago. Now I listen to streaming radio online or I flip through Youtube videos from the distributors' channels or that kind of thing.

My point is, there are "honest" alternatives to stealing products, digital or otherwise.

I don't know why we create this sense of us versus them. We share this planet. If you make my life better, I want you to be around to continue making it better and I know you need to eat. I think that's the answer. Build a sense of community around the product, the producer, the consumer and the future where we all benefit from our shared existence.

<comment><USER7> > How do you create an honest society?

How about wiping out all forms of artificial scarcity?

</comment></comment></comment></comment></comment></comment><comment><USER8> "allow publishers to charge consumers the same price for digital editions as they do for new hardcover versions."

Really? And what happens when customers refuse to pay the same amount? I've always said, that ebooks are still too expensive. Personally, if an ebook is $10 less than a hardcover version, then I prefer it. Otherwise, not much of a difference.

</comment><comment><USER9> The fact that google is going to leave the pricing structure to the publishers disappointed me. While the flexibility draws in more publishers the publisher acceptable pricepoint will not be competitive with the likes of Amazon.

</comment><comment><USER10> I have no interest in buying e-books but, if I did, I would probably continue to use Amazon since I can just order the print copy when there's no e-book version available and have the option of using them on a Kindle. (again, if I wanted e-books which I really do not)

</comment><comment><USER11> I think one class of mistake we are going to hear all the time is that arguments from music applied to ebooks.

One example is the case for against copyright protection for authors.

</comment><comment><USER12> hehe, It makes me laugh when they say they expect a "secure format" from google. Once in screen format, it takes a minute to copy automatically a book to a bitmap, and then do whatever you want with it(OCR).

About the same price for a book than an ebook, I suspect they are drunk. People is not going to pay the same price for something that has been manufactured, transported, and stored, for something that cost pennies to sell.Period.

</comment><comment><USER13> This isn't about selling the books they scanned, but a separate project.

This sounds remarkably like when they tried to reach out and do print, video and radio ads. Even though it looked like something that was related to their core offering, it flopped hugely.

They are overreaching.

To get legs under an ebook-selling project, a company has to devote a lot of resources to promotion, the ecosystem, and making users happy.

That's why Amazon's gotten a much higher adoption rate for the Kindle than Sony has for the Reader. Sony was like "Eh, we'll make an ebook reader" and (seemingly) didn't invest much in the service and ecosystem. The device was fine. But the Kindle whoops its ass because you can order books from anywhere in, what is it, 49 states? And people are used to buying all their books from Amazon already.

I don't really see Google doing things that differently from Sony. They have so many projects going on already that seem neglected.

I think this is a strategy that's going to fail.

</comment><comment><USER14> ...at 99cts.

Now that's disrupting.</comment>


Ask HN: What tools/apps/etc. are out there in support of antiracism? - <AUTHOR> This has been touched on in the last few days:
https://news.ycombinator.com/item?id=23394972: Ask HN: How can a programmer help with current events? https://news.ycombinator.com/item?id=23388597: Ask HN: Technologies to help prevent abuse of power?
I am re-asking because there isn't a lot of information. I'm aware of the ACLU's Mobile Justice app (https://www.aclu.org/issues/criminal-law-reform/reforming-police/aclu-apps-record-police-conduct). What else is out there?
I'm specifically interested in whether or not tools exist to help hold police accountable. I'm interested in developing something similar to the Mobile Justice app. Similar to the idea of sousveillance, I think there is an opportunity to catalog instances of injustice in order to hold individuals accountable. I am imagining an app that has a real-time, location-aware feed of media references to such instances to corroborate and publicize, potentially supported by facial recognition of offenders to gather evidence of repeat abuse. <comment><USER2> > I think there is an opportunity to catalog instances of injustice in order > to hold individuals accountable

Maybe. But after enough years of catching police on camera strangling and killing black people it has quickly become clear that accountability is not the issue. It's that the system in which they operate (brought to you by your tax dollars) protects officers who abuse their power to a superlative degree. Don't forget the police unions are there if the officer is fired, furthermore, they can just start up at the police force in the next town over if it really comes to that (which it _rarely_ has).

I feel like HN has a hard time groking this but there is no app to fix institutional racism and inequality. The tools for this are called law and community organization. Just today, protests and organizing across the country have elevated the charges against the officer who murdered George Floyd as well as his three accomplices. Can you pitch an app or tech tool that can do that?

Only with community organization and changing the law can you create a new reality where people are held accountable. Voting is a good place to start. I'm not saying technology can't help, but it is not the pure means to the end.

<comment><AUTHOR> Well said. But I could also argue that, were it not for a video of George Floyd being killed, we would not be seeing the community organization we are today. I won't disagree that the community organization is what is driving change though.

</comment></comment><comment><USER3> > I'm specifically interested in whether or not tools exist to help hold > police accountable.

I'm interested in this too. And haven't been able to find much of anything.

> I am imagining an app that has a real-time, location-aware feed of media > references to such instances to corroborate and publicize, potentially > supported by facial recognition of offenders to gather evidence of repeat > abuse.

I think the implementation and specific measures need careful consideration. Remember justice according to Rawls is a form of fairness among all members in society. What about the injustice going on that the police are tasked with stopping on a daily basis and their respective part in ensuring a just society? What about injustices against the police themselves? If we ignore such data points and issues, society will develop a false impression and injustice will supplant the justice we are striving for. IMHO any social justice software should be "context aware" in as broad a sense as possible (history of officers actions - good, bad, everything in between) and probably a history of the "offenders/recorders" public actions (again good, bad, everything in between) as well as specific encounters. Of course, this brings problems such as rights of privacy, among others.

A software which only captures specific encounters, and only makes them public when they are negative is something that on the whole might not be a net benefit for society. I'm unsure and I think it needs some consideration at the least.

<comment><AUTHOR> Thanks for the thoughtful response. I have discussed the fact that there are repeat offenders on both sides. Nobody has the right to incite mob violence, for example. That could be captured by the same application.

I'm still early in my thinking around this, but welcome the discussion. From my early research and discussions, there is a solution that is needed, but there is a lot of definition that has to happen around what exactly that is in order to take into account issues like the ones you describe.

</comment></comment><comment><USER4> The thing about racism is that it is used to infer information about individuals.

Cops in America use race as a proxy. They are far less likely do something to an old grandma because they know she doesn't represent the same threat as a young male in his 20s.

There are two approaches to deal with it, but only one is highlighted:

\- Either make them not use race for any information

\- Or help them identify the problematic individuals better

The first approach is what is actively being pursued by most people today, but it hardly solves the problem and it's fighting a rising tide. The more cops are weirded out by judging a black kid out of fear of racism, the more panicky they would feel while dealing with him because they'd be waiting for other pieces of information. For instance, Philando Castile was immediately shot when the cop discovered that he was armed. In a different world, he would have tried to analyse whether this man with his partner and kid in the car was scared of getting arrested or not.

By running a major antiracism campaign cops are now left to use any piece of information other than race to determine the threat level, and this turns out to badly because their internal compass of threat assessment is distorted.

For the second approach, pro-racial training can be made regarding threat assessments. Better databases can be built regarding information on individuals (obviously a problem for most people, but this is a great way to deal with this issue). China style facial recognition technology and going full on surveillance state can clearly help with this issue. In other words either do Israel style profiling or do China style surveillance, but both these things will have major resistance from Americans (but surprisingly arming cops with military weapons is ok).</comment>


Lenovo updates ThinkPad with Intel 8th-gen processors, USB Type-C power adapters - <AUTHOR> https://venturebeat.com/2018/01/03/lenovo-updates-thinkpad-lineup-with-intel-8th-gen-processors-and-usb-type-c-power-adapters/ <comment><USER2> I cannot tell from the photos, but sadly I bet they didn't return the far superior 7-row keyboard to us stalwart ThinkPad owners.

The latest (sucky) layout doesn't even have a Fn toggle to use a 10-key numeric overlay so using extended (ALT+<n> chars) practically impossible. And no Pause/Break key kills me. Every. Single. Day. </rant>

Tip: If you're shopping/researching Thinkpads (or any consumer Lenovo gear), the "Product Specifications Reference" — aka 'PSREF' — documents are the bee's knees. (Last rev. was 20 Dec 2017, so this new stuff is not yet listed.). Link, [http://psref.lenovo.com/](http://psref.lenovo.com/)

<comment><USER3> Well, I for one prefer both the current Thinkpad USB keyboard and the keyboard built into my X1 Yoga to the classic keyboard in my old Thinkpad X220.

You get [Pause] by pressing [FN] + [P], btw.

</comment></comment><comment><USER4> Are Intel's 8th gen processors affected by Scepter and Meltdown?

<comment><USER5> Yes

</comment></comment><comment><USER6> The X220 has the superior keyboard and really isn't underpowered unless you're interested in gaming. Coreboot allows all sorts of upgrades beyond the OEM firmware.

</comment><comment><USER7> Before I switched to Mac, I was a major ThinkPad adherent. It was the best laptop hardware. Anyone have experience running Linux on one of their recent models?

<comment><USER8> I run Ubuntu out-of-the-box on a ThinkPad Yoga X1 and everything works pretty well, including the docking station, the digitizer, touch screen, hotkeys, battery life. Same was true with my older Thinkpad T420 (which had Nvidia Optimus). The good hardware combined with the good drivers is the reason why I did not yet switch to Mac.

</comment></comment><comment><USER9> No removable battery on the x series. Lenovo is really trying really hard to kill the brand.</comment>


Ask HN: Is there a way to bill automatically for a metered service? - <AUTHOR>

If you sell a metered service, like Heroku or AWS do, are there automated ways of billing your customers' credit cards?
Normally, using any one of a number of recurring-billing options would do the trick. But it seems like these are largely intended for cases where the amount that gets spent doesn't change month-to-month.
What if the amount does change month-to-month? Are there processors or payment services that can accommodate that sort of business model? <comment><USER2> Braintree and Stripe both allow you to store card numbers without creating a subscription. I would either go the prepayment route (allow the customer to re-load a balance, then draw it down with usage), or set billing/time thresholds (bill the balance every X days or whenever the total hits $Y). I use several API services that use the reloading method, and Google Adwords does the billing/time threshold.

</comment><comment><USER3> Yes, AWS can be metered and charged automatically with Amazon DevPay. One potential issue with DevPay is that a customer cannot open multiple accounts on your service with one same Amazon account.

[http://aws.amazon.com/devpay/](http://aws.amazon.com/devpay/)

</comment><comment><USER4> A lot of payment processors will let you store a card number once and then charge that card multiple times.

</comment><comment><USER5> Yes, a wide variety of them: Stripe, Litle, Chase Paymentech, Cielo, ...

<comment><AUTHOR> It seems like many of these services want you to use metered billing as part of a subscription, though. That's not really my use case.

I guess I could hack it by making a $0 subscription and charging the metered portion there?

</comment></comment><comment><USER6> Try something like Mashery?</comment>


Are We Living Inside A Black Hole? - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2010/08/23/AR2010082303622.html

<comment><USER2> "When the density of matter reaches gargantuan proportions (more than about 1,050 kilograms per cubic meter)"

I assume there is an a missing exponential in there (10^50?), since lead is an order of magnitude more dense than 1050 kg/m^3

Kind of nitpicking, but with an error like this I have to wonder about how well any of this is actually being explained. (Actually, given the accuracy rate of news articles on a science topic I'm very familiar with, I think I know the answer, unfortunately).

</comment><comment><USER3> Seeing as Einstein's theories are based on math + the observable universe (and that they explain events as we see them in our universe), how can we say that our universe is governed by a specific part of Einstein's theory, namely the behavior of spacetime inside of black holes?

Seems fairly circular to me.</comment>


Product Hunt Gets $6.1M Series A Funding from A16Z and Alexis Ohanian - <AUTHOR> http://techcrunch.com/2014/10/08/product-hunt-gets-6-1-million-series-a-funding-from-a16z-and-alexis-ohanian/ <comment><USER2> I am _really_ not a fan of PH because I don't _trust it at all_ (previous longer rant: [https://news.ycombinator.com/item?id=8362759](https://news.ycombinator.com/item?id=8362759)). Votes are gamed when everyone is _spamming_ for upvotes on Twitter ([https://twitter.com/search?f=realtime&q=product%20hunt%20upv...](https://twitter.com/search?f=realtime&q=product%20hunt%20upvote&src=typd)) although Ryan mentioned in replies to previous rant that he would "write a bullet point in the FAQ about asking for upvotes," which won't stop it at all.

Addiitonally, there's an unusual amount of pandering, to use an apt word, to Product Hunt / Ryan Hoover in submissions to PH ("We have special Product Hunt functionality/branding in our product and Ryan took a quirky selfie while using it! That means we're awesome!") The problem with that this distracts from _actually objectively good products_ , a counterpoint to PH's mission to "find the best products," and it shouldn't be a surprise that many top PH submissions end up fading into obscurity, which is a disservice to everyone.

<comment><USER3> Isn't this a problem that can be easily fixed in the same way that HN looks for vote rigging? Seems like one week of work in putting in a fraud detection / collusion / vote weighting system. Also seems to be just a minor growing pain, a feature just ignored so far because it hasn't been important to work on, but once it becomes a bigger concern by the community, I can't think of a good reason why it wouldn't be resolved.

Pandering is hard to stop, but again as the community matures, you'll likely see counter culture develop in the community in the same way HN commenters complain about the first comment to any article being a negative response about the submitted content ;)

<comment><USER4> We have anti-vote-ring and anti-vote-spam in place. Similar to HN actually. They and also people of the reddit team help us a lot.

Additionally we have a moderator team that additionally looks for in-balanced behaviour.

I understand that a lot of people are asking on twitter for upvotes - so far we are able to filter those in the rankings. We are considering to communicate the policies even more public - but step by step.

Disclaimer: CTO @ PH.

<comment><USER2> Interesting. This needs to be stated publicly and transparently.

Your assertion that "HN/Reddit are secretive" doesn't work for PH since PH puts a larger emphasis on real-life identity and impact. (HN has recently been more public with how it operates too.). Case in point, my parent post has 12 points. This _is_ the perception of Product Hunt.

<comment><USER4> I didnt disagree with you. And also you are right about the fact that we need to better communicate our policy regarding upvote requests.

So far we have had the upper hand with ranking adjustment. But the fact that you believe it's mainly gamed - shows that we have to do a lot of work in improving our communication.

</comment></comment></comment></comment></comment><comment><USER5> So just as a data point, I actually co-founded a YC startup a few years ago that was working on a similar problem. On paper it seems like a promising space because there are 300 - 500k new consumer products launched each year in the US, not including media titles.

What we found though was that probably 98% of these products were completely commodified, as in a new brand of 2% milk or a new kind of paperclips. We would go to industry events with, say, 20,000 CPG food products, but of those there were maybe only 5 - 10 per year that were interesting enough to actually be worth talking about. And even reaching out to contract manufacturers directly to get new products at the very beginning of the pipeline yielded limited results.

We were actually offered funding, but ended up shutting down the startup instead because we found that while we could make money doing bespoke projects for companies with large budgets, the market just wasn't there to build the products that we initially wanted to build. If Product Hunt can innovate on the lead gen though then it's definitely cool space, and I'm excited to see what they can come up with.

</comment><comment><USER6> I have two things to say.

1\. I agree with what minimaxir said. It seems like friends of friends of friends control the entire place. HN seems less "controlled" than PH. Even Ryan himself went above and beyond to make sure that Alexis' friends were able to comment right off the bat. ([https://twitter.com/rrhoover/status/489931085048860672](https://twitter.com/rrhoover/status/489931085048860672)) In hindsight, this paid off since he got funding and I don't blame him. But to the average user who has been waiting to comment - it's incredibly frustrating.

And why the heck is commenting disabled by default anyway? Why does it sound like a good idea to only allow friends of friends a voice to comment? Provide some type of "participant threshold", and then allow everyone to comment and block those who abuse it.

2\. They got 6.1M in funding. I am not from the startup "funding" ilk, but that sounds like a ridiculously high number to me. What could they possibly be building that requires that much capital? The site and premise of it now is fairly simple to implement and code. Perhaps they have grand plans that are way above my head?

<comment><USER7> > 2\. They got 6.1M in funding. I am not from the startup "funding" ilk, but > that sounds like a ridiculously high number to me. What could they possibly > be building that requires that much capital? The site and premise of it now > is fairly simple to implement and code. Perhaps they have grand plans that > are way above my head?

The only thing I can think of is competing with AngelList as it operates in a neighboring market with alot of customer overlap.

People interested in VC, Startups, Jobs @ Startups.

<comment><USER8> They have to be rolling out Product Hunt for X. There are a lot of verticals where it will be way bigger than this one. They'll need a lot of capital to roll these verticals out before everyone else does. Look at Stack Overflow and their large network of somewhat independent niche sites.

</comment></comment></comment><comment><USER9> _How is Product Hunt any different from HN?_ HN has already created a culture of upvoting the best tech products from people who know their shit. I may be naive but how can the PH experience improve upon the already exceptional HN experience?

<comment><USER10> Product Hunt is about Products, Hacker News is about News.

<comment><USER2> That's a false dichotomy. There's a reason "Show HN" exists and has existed for years.

<comment><USER10> "Show HN" is for showing your own work.

It's not for submitting cool products you find, like PH is. People would hate it if "Show HN" turned into Product Hunt, and the submitters weren't always behind what was being shown there.

<comment><USER2> Given the amount of terrible Medium posts which try to compare traffic from Product Hunt and Hacker News, I wouldn't argue that difference: [https://hn.algolia.com/?q=product+hunt+hacker+news#!/story/s...](https://hn.algolia.com/?q=product+hunt+hacker+news#!/story/sort_by_date/0/product%20hunt%20hacker%20news)

</comment></comment></comment></comment></comment><comment><USER11> Lol, 6.1M for a HN-alternative for products (and the HN original has been created by one guy solely).

That's pretty sick :s

<comment><USER11> PS. I made a HN with Tags and custom input fields (it's not completely finished yet)... I thought about selling it for 8 K. (already have a client)

But if anyone want's to give a million, i can get arround the NDA.

Fyi, it's made with Asp.Net MVC, a JS View Engine and i'm not kidding either. Lower bids are also welcome.

</comment></comment><comment><USER12> Key questions I have: Does product hunt generate any revenue currently ? (I know it isn't directly related to valuation, just curious) How big is the current team?

<comment><USER13> not sure about any revenue. But I guess they are 9 right now. Ryan sent out a blog article about his journey in his newsletter today : [https://medium.com/on-startups/the-artifacts-of-product- hunt...](https://medium.com/on-startups/the-artifacts-of-product- hunt-11682e9e01dd)

</comment></comment><comment><USER14> Something tells me they try to avoid saying the name aloud

</comment><comment><USER15> This is the same play as PandoDaily. Free channel of press for VC's and their connections.

</comment><comment><USER16> My frustration with Product Hunt is that it gives underperforming biz folks a whole new shiny label to add to their resume: Product Nerd!

'Product Nerd' = professional opinion giver = get back to work!

</comment><comment><USER17> I browse PH everyday, however it seems like I only need to do it once. The list seems stagnant; it looks the same at 9am as it does at 5pm. So unlike HN, reddit, FB I spend maybe 3-4 minutes on PH. I would like to see their metrics on site visitation to see if perhaps others share this issue.

</comment><comment><USER18> Congrats to Ryan. Am assuming there's a biz dev play here, what do we think? Affiliate revenue, "featured" products, native advertising curated lists (e.g. Samsung sponsors a list of cool Android apps...)?

<comment><USER19> featured products make the most sense. In the end, they're all a form of native advertising.

</comment></comment><comment><USER20> I love ProductHunt. A lot. Many lots. I take a look at it most days.

At the end of the day though it's just a good list. There's no barrier to entry and as soon as they add in any revenue streams that justify a huge valuation (which I certainly can't figure out anyway) then what's to stop "Product Hunt - No Ads" from stealing the "market"?

</comment><comment><USER21> the third highest voted product on the page right now is a $125 monitor stand....

<comment><USER20> the second highest voted product is a newsletter

</comment></comment><comment><USER22> Am I having a deja-vu or did this already happen a month ago?

<comment><USER23> They raised $1m about a month ago: [http://techcrunch.com/2014/08/21/product- hunt-announces-seed...](http://techcrunch.com/2014/08/21/product-hunt- announces-seed-funding-round-launches-ios-app/) .. so I'm guessing total is now $7.1m with the newly announced $6.1m? (Unless they were separately announced parts of the same round.)</comment></comment>


Nine trillion Google Checkout Webgoof ($9,223,372,036,854.78) - <AUTHOR> http://webgoofs.blogspot.com/2008/02/nine-trillion-google-checkout-webgoof.html

<comment><USER2> That's astonishingly close to the US national debt.

<http://www.brillig.com/debt_clock/>

</comment><comment><USER3> Is the Federal Government processing its budget with google now? :-P</comment>


Demand for Skilled Workers Has Been Declining Since 2000 - <AUTHOR> https://www.frbatlanta.org/-/media/Documents/news/conferences/2015/1001-secular-changes-labor-market-outcomes/green.pdf?d=1&s=blogmb <comment><USER2> I noticed that when I submitted my resume for jobs after 2000 that I would get rejected and the cause for the rejection was "overqualfied". They'd usually hire a younger less skilled worker instead.

Just for grins I applied for the position of CEO at a few companies and still got the "overqualified" rejection. It was like HR just noticed on my resume that my college degrees were earned a long time ago and my job history is too skilled and they just rubber stamp "overqualified" for people like me.

<comment><USER3> This seems like a terrible excuse, especially for CEO positions. Who else should you hire, but someone who knows the field inside and out?

<comment><USER2> They don't want to pay the extra money for a skilled person. PCs and programming have gotten easier over the years so they can hire someone with less skill for less money.</comment></comment></comment>