tmux Privilege Escalation - send-keys https://markdownbin.com/bin/20190711/1ef089bd715cf91fb0d6.html <comment><AUTHOR> Do we consider it a vulnerability to put "alias sudo=sudo rm -rf /" in your shell config too?

How about ptrace(), depending on how your system is configured, an attacker running under your own user account could do similar damage to _any process you run_ , make your browser display fake login forms, steal saved application passwords, etc.

Once someone has access to your the user account of someone with sudo it's game over, there's just too many ways to elevate, I couldn't even name them all. They could even just straight up "tmux attach -d" and steal your logged in root shell.

<comment><USER2> I mean we do consider ptrace a vulnerability which is why there's a kernel switch to turn the ability off.

> there's just too many ways to elevate

That's a problem that a lot of different people are trying to tackle because there's a lot of holes to plug.

* Wayland is plugging the Xorg hole where an app can listen or send keystrokes to other applications.

* sudo plugs this hole (by default) by requiring your password and binding your ticket to a single tty.

* Polkit plugs this hole (with Wayland's help) by having privileged dialogs and authenticating individual applications (i.e. dbus clients) instead of the user as a whole.

* The kernel switch plugs the ptrace hole.

* Flatpak and other namespacing frontends are working on the filesystem/network holes by keeping apps in their own little world unless allowed out.

* SELinux also lives in this space but it's a step removed preventing compromised apps the ability to use various escalation tricks in the first place.

We're closer than we've ever been. Now is pretty much the worst time to throw up our hands and say it can't be done.

<comment><AUTHOR> No, we aren't, there's still so so many more!

\- Even if you use the kernel switch you can still ptrace an application on startup, do you read the code for every .desktop composing your launchers?

\- You can trivial add say, a modified web browser or terminal emulator to a user's PATH.

\- You can add aliases to a user's shell configuration

\- You can change a user's entire shell to a shim designed to fool them into thinking things are normal

\- You can replace that desktop update notifier with a tweaked one that logs that root password first

\- Wayland too will fall when you replace a user's compositor with a customized one, must of Wayland's security improvements have actually just been moving things from display server to compositor. Simply re-configuring the user's session choice will likely be enough to do this. Just like changing your shell.

\- The PolKit "hole plugging" you suggest only works if there's no way to recreate a dialog which would look exactly the same, so I'm not sure how it has any relevance here

\- SELinux more prevents problems _between_ user accounts, as the isolation is designed to work, not within them and not for authorized escalation tools like sudo

\- In the case of desktop systems it's also important to remember that most if not all of the important data will be in the user's home directory. [https://xkcd.com/1200/](https://xkcd.com/1200/)

This will not be possible, as long as the same user controls their own configurations for core stuff like shell and launchers. User accounts weren't designed for this level of isolation. Make a separate user if that's what you want. This is why most distros run all servers under different user accounts out of the box. If you're concerned about the security of say, your browser, you should probably consider adding user account isolation to it too, on Android every single app gets it's own account.

If your threat model involves giving untrusted users access to a sudoer, you're not going to have a good time. User accounts are still the primary form of isolation on Linux, it's not a sandboxed mobile OS, maybe Flatpak will change that someday, but for now we have barely even started on this sort of switch to an entirely different security model.

<comment><USER2> > you can still ptrace an application on startup

You can only ptrace an application when you are its _parent_. Modifying system-wide desktop files is a privileged operation and flatpak's filesystem namespacing prevents applications from messing with the launchers in your home directory.

> Messing with environments variables and shell files.

Not when you don't have access to their home directory and all your file accesses are via XDG portals.

> You can change a user's entire shell

There are a number of access controls preventing this. First, modifying a users passwd entry is a privileged operation and using `chsh` requires the user's password.

> replace a user's compositor with a customized one

The compositor is the security boundary. Of course if you replace it the model is broken but if you have a POC where a program running as the user can change a users entire compositor to a malicious one I would love to see it.

GDM launches your session and is outside your control as an unprivileged user and if the compositor dies so does your session. You can't 'swap' it and your malicious compositor can never be shown as a choice in GDM since those preferences require root to modify.

> SELinux...

SELinux isn't designed to stop you from calling sudo. But it does make sure that the scope of a what compromised application running as your user is limited. It's not directly related but MAC is a piece of the puzzle.

> if not all of the important data will be in the user's home directory

Yep, which is why apps won't have access to it except for the files the users chooses to give the application via a system dialog.

<comment><AUTHOR> > Not when you don't have access to their home directory and all your file > accesses are via XDG portals.

> Modifying system-wide desktop files is a privileged operation and flatpak's > filesystem namespacing prevents applications from messing with the launchers > in your home directory.

Okay, but let's jump over to reality for a second, no one uses Flatpak and your desktop shortcuts are on your desktop, not the system one, so are your other commonly invoked applications, due to the unnecessary complexity Flatpak introduces I feel it's unlikely to see widespread adoption in the near future.

> GDM launches your session and is outside your control as an unprivileged > user and if the compositor dies so does your session. You can't 'swap' it > and your malicious compositor can never be shown as a choice in GDM since > those preferences require root to modify.

Did they change it so GDM no longer prefers your ~/.xinitrc if available?

You may also be able to LD_PRELOAD the compositor from your ~/.xprofile, but I haven't done any experiments there.

> Yep, which is why apps won't have access to it except for the files the > users chooses to give the application via a system dialog.

This entire concept is nothing more than an annoying joke not widely deployed on any desktop system today.

Consider also that such an extreme level of sandboxing could also prevent malicious access to your tmux session and prevent this issue entirely in such a case, so why would this even be considered a problem if you're talking about that level of sandboxing?

Perhaps I was a too dismissive of it - but in any case it's a complete change of security model and its not clear that tmux is what would be at fault under such a model or if something else would be expected to protect it's session from access. Maybe some magic Flatpak garbage should be blocking access or something. Just slap more layers on it, I'm sure that'll fix it and not annoy the hell out of anyone.

</comment></comment></comment></comment></comment><comment><USER3> Something running with your privileges could similarly use your existing sudo ticket, or manipulate the memory of your terminal emulator, or modify your shell to grab your credentials the next time you authenticate (and pass those to sudo), etc.

This isn't tmux's fault; this is fundamentally the sort of thing that's possible under the security model of modern Linux desktops.

<comment><USER4> It's worth pointing out that tmux is part of the OpenBSD project, where this would be mitigated by the replacement of sudo with doas.

<comment><USER5> > Do you mean this > [https://github.com/tmux/tmux](https://github.com/tmux/tmux)? That is the > source for the portable version of tmux, wrapping the native kqueue version > developed for OpenBSD with libevent.

Tmux is part of the OpenBSD base system.

Tmux is not an officially developed program by the OpenBSD community.

It was imported June 1 2009.

Here is Theo de Raadt's post:

> By Theo de Raadt () on 2009-07-07 04:37

> The most impressive thing about tmux, in my view, is how frustrating the > code audit was. In 2 hours, I found only one or two nits that had very minor > security consequences.

> It was not accepted into the tree based on license alone. It is high quality > code.

[1] [https://en.wikipedia.org/wiki/OpenBSD#Subprojects](https://en.wikipedia.org/wiki/OpenBSD#Subprojects)

[2] [https://undeadly.org/cgi?action=article&sid=20090707041154](https://undeadly.org/cgi?action=article&sid=20090707041154)

<comment><USER4> As best I can tell, tmux is developed primarily by Nicholas Marriott for OpenBSD and made portable with libevent. The original paper uses OpenBSD, and here[1] he says: "I preferred to work on it in base: I felt tmux would be improved by being part of OpenBSD."

[1] [https://www.undeadly.org/cgi?action=article&sid=200907121904...](https://www.undeadly.org/cgi?action=article&sid=20090712190402)

<comment><USER6> The author developed tmux on OpenBSD because that is what he used, but it was never part of the OpenBSD Project. It was a port prior to being included in the base install. This is no different that how FreeBSD includes software in its base install, yet this doesn't make the code part of the FreeBSD Project.

The tmux GitHub repo is the reference implementation. As an example, OpenSSH is developed internally to OpenBSD and the project creates a separate portable version. tmux is the opposite, it is developed independently of OpenBSD and the project maintains its own implementation.

<comment><USER7> You are incorrect, tmux is part of OpenBSD and the OpenBSD CVS tree is the main repository.

Edit: because there is occasionally confusion on this point I recently documented it here: [https://github.com/tmux/tmux/wiki/Contributing](https://github.com/tmux/tmux/wiki/Contributing)

</comment></comment></comment></comment></comment></comment><comment><USER4> This feels like using "keyboard privilege escalation" to mean an attacker could type on your physical keyboard to access a terminal logged in as root to execute commands.

<comment><USER8> Haha. I thought the same. But here, what is interesting is that, an attacker could easily run a background process which quietly monitors the tmux panes, and execute privileged instructions once a root pane has started. The user would never even know.

<comment><USER9> An attacker could also ptrace into a shell, do mitm with an extra pseudo terminal when the user types su or sudo, and grab the password.

The permission model used in UNIX is just that weak. This is why there's so much going on around capability-based operating systems (mostly built around 3rd generation microkernels such as seL4), like Genode.

<comment><USER10> And if a user _couldn't_ ptrace the processes they invoked? Congratulations, you've just made malware authors extremely happy.

Unix does have a decently strong, capability-based permission model. On the one hand, you have file descriptors which are literally anonymous resources to ad hoc system objects. Capsicum only required small tweaks to the Unix API to round it out.

On the other hand you have UIDs, GIDs, along with SUID and SGID bits on executables. A good example of how this can be used is BSD Auth, the BSD answer to PAM. Unlike PAM, which heavily relies on root permissions--typically by the authenticator itself--in BSD Auth authentication methods are implemented by binaries under /usr/libexec/auth/, most of which either have the SUID or (more typically) SGID bit set so the module runs with the necessary permissions to access the credential database without giving those permissions to the process initiating the authentication. Whether you use SUID or SGID depends on whether you want to restrict authentication; if so you limit execute permissions by GID and use SUID to switch roles, otherwise better to just use SGID.

BSD Auth shows the power of the Unix UID.GID model, but it's woefully underutilized. Which hints at a larger problem. Our software sucks because we're all bad programmers. We keep rehashing things without understanding and making use of the tools at our disposal, and of course even when we use the correct architectures our software is buggy.

To my mind seL4 and, to a lesser extent Genode, isn't really about permission models. It's about being able to separate correctly written programs from broken programs. Until you can _absolutely_ trust the core software, obsessing over models and architectures is pointless. The reason Administrator and root permissions are so commonly used, and why privilege separation not more commonly applied, is because software is so buggy and broken that if you took away the ability for people (directly, or indirectly through another layer of software) to introspect/supplement/hack _privileged_ software, people would flock elsewhere because of the usability nightmare. I mean, this is how we ended up with VMs and containers, which are at _best_ a totally lateral move in terms of architectural and practical security.

seL4 and formal verification is about breaking that cycle so we can begin laying down a layer of trusted software upon which we can _consistently_ and _meaningfully_ make use of better security models. The capability models employed by seL4 are principally directed toward that end, not toward the end of making writing secure software easier for your typical C++ or Node.js developer. The capability and ACL models best suited for those developers will look and operate differently, and in all likelihood look very much more like the Unix-based models for various reasons--path dependency, practicality, and the fact that they're quite capable, especially if made more consistent (see, e.g. Capsicum wrt capabilities, Plan 9 wrt to namespace visibility, both of which are heavily based on file descriptors and the Unix UID/GID model). From a usability standpoint the key hurdle is figuring out the best semantics for the capability _broker_. L4 doesn't really address the broker problem directly; Unix and Plan 9 and various other systems do, which is simultaneously the source of their convenience and flaws.

</comment></comment></comment></comment><comment><USER11> And any program running in an X11 session can fake keystrokes and thereby escalate privileges in a similar fashion. It's not exactly a vulnerability unique to tmux.

<comment><USER12> True, I bet you can do the same with screen ;)

</comment></comment><comment><USER13> If someone has access to your user account and you're running tmux, they can just attach that tmux, they don't need to mess around with send-keys.

If send-keys didn't exist, a script could attach tmux in its own pty instead.

Detach/attach is a fundamental part of how tmux works, everyone must understand that it is fully available to anyone with access to your user.

GNU screen also has a similar feature to send-keys (they call it "stuff").

It has always been good practice to detach long-running root programs by starting a new tmux as root rather than running them in a non-root tmux, and to use sudo rather than su to run root commands inside tmux the same way as you would outside.

</comment><comment><USER14> ... only if you have another pane with root logged in or with sudo authorized.

<comment><USER15> Which is normal if you want to maintain only a single ssh session to a remote machine.

</comment></comment><comment><USER16> This is absolutely not a "privilege escalation" vulnerability, of course.

</comment><comment><USER17> Not a vuln. If someone pwns the session you use to run stuff as admin, she's admin, period.

For completeness, the same can be done with screen:

screen -S session_name -p window_number -X stuff "whoami^M"

</comment><comment><USER18> TL;DR Do not run untrusted nor not-fully-understood software as a user which is allowed to do anything, or maybe ever.

<comment><AUTHOR> Isolation is always key. Remember, sudo can also be used to de-escalate priviledges to a different user account where it's harm is more limited.

Or better, if you wanna run malware for fun, run a VM with an isolated network connection that only routes out to the world via a separate VM that pipes all traffic over a crappy commercial VPN service or Tor. That way if you piss off any script kiddies they can't DDoS you.

</comment></comment><comment> send-keys > A script run as user in tmux can under some circumstances execute commands > as root.</comment>


Ask HN: Where to start with UX - <AUTHOR> I'm looking for everything that worked for you: books, online courses, YouTube channels, podcasts, blogs, etc. <comment><USER2> I highly recommend the book "The Design of Everyday Things."

It makes me constantly think about the decisions that went into designing things around me, what works, and what doesn't. Very helpful when making design and UX decisions of my own.

</comment><comment><USER3> Apart from those already mentioned ("The Design of Everyday Things" and "Don't make me think") I can recommend this online course about various aspects of design:

[https://hackdesign.org/](https://hackdesign.org/)

While not about user experience alone it's a great collection of useful articles about matters such as design in general, typography, user interfaces and user experience design.

</comment><comment><USER4> The book "Don't make me think."

</comment><comment><USER5> Well, [https://www.interaction-design.org/](https://www.interaction- design.org/)

</comment><comment><USER6> Definitely check this out also: [https://lawsofux.com](https://lawsofux.com)

</comment><comment><USER7> an actual drawing class, unrelated to software. understand how line, color, and visual illusions affect humans.

the rest i just google, "design pattern for x" and take my pick.</comment>


Recycled plastic waste made into 3D print filament for developing regions - <AUTHOR> http://www.fastcoexist.com/3059311/in-tanzania-this-startup-will-pay-for-plastic-trash-and-make-3-d-printer-filament <comment><USER2> Love this!!!</comment>


How the UK Security Services neutralised The Guardian - <AUTHOR> https://www.dailymaverick.co.za/article/2019-09-11-how-the-uk-security-services-neutralised-the-countrys-leading-liberal-newspaper/ <comment><USER2> As I understand it, the Guardian had previously always considered D-notice requests and had usually acquiesced. However, it decided that Snowden was so important that it took the pretty unprecedented step of ignoring them.

This made the intelligence services particularly dischuffed.

Post-Snowden the status-quo was re-established.

It remains to be seen whether the Guardian would ignore D-notices again, if something else of the magnitude of Snowden came along - I hope it would use its judgement and do so, if necessary. I'm not _necessarily_ against newspapers considering requests from the intelligence service not to publish something for good reason - it can end up with people dying. It's a tough decision an editor has to make.

<comment><USER3> "dischuffed"?

Surely "nonchuffed"? "Dischuffed" suggests that they had been previously chuffed with the Guardian.

<comment><USER2> You raise an interesting point which I shall have to ponder.

But can't I be disappointed by a particular movie, without being previously ... appointed ... by another from the same fim maker?

<comment><USER3> I'm pondering this too, and I'm willing to be wrong on it, but I would have said that you can't be disappointed by a movie without having had some sort of raised expectation about it. If you thought it would be rubbish you wouldn't be disappointed.

"Dis" always suggests to me some sort of removal, rather than just the absence of.

<comment><USER4> My dislike of mornings does not, I hope, suggest I ever liked them. A disability isn't always an ability that's lost. etc.

So many exceptions, I sometimes wonder how others ever end up learning good English. :)

</comment></comment></comment></comment></comment><comment><USER5> The article clearly demonstrates that The Guardian has become a shadow of its former self - pro-Establishment, anti-Assange, anti-Corbyn/Labour, all of its trustworthy intelligence reporters having left. Something of an open secret to be honest, how it now arrogates to pretend to still be "Left"-leaning but is nothing of the sort, under editorship veering from amateurish to clearly complicit.

<comment><USER3> I suspect that there going to be a divergence between "left-leaning" and "liberal-leaning" in Britain. The British Labour party isn't inherently liberal (as they have shown with their anti-semitism and resistance to gay marriage). I think they will continue further down a path of non-liberal socialism, alienating a lot of people who hadn't previously considered that "left" and "liberal" were different concepts.

<comment><USER6> [________] anyone who just finished reading the article and checked the references will think you are trolling if you re-accuse the Labour party for anti-semitism...

EDIT: removed "Did you even read the article?" per the site guidelines

<comment><USER7> The article says Labour doesn't have an anti-semitism problem and therefore it doesn't?

And yes, I checked the references, and they are not wholly convincing. A statement that only 0.06% of the Labour membership have been investigated for anti-semitism (which firstly still seems kind of high to me, and secondly obviously not being investigated for anti-semitism does not mean one is not anti-semitic) and an independent inquiry by the person who was subsequently made Labour's shadow attorney general?

I'm not saying Labour is overrun by anti-semitism but let's try not to just believe the last thing we read, ok?

<comment><USER8> Mo, the facts say that Labour doesn't have an anti-semitism problem.

There has been absolutely no evidence provided by any source to prove institutional anti-semitism.

There is really no evidence at all that stands up to even the most basic common sense assessment.

For example - if Corbyn is an anti-Semite, he's been remarkably quiet about it. In fact he has somehow managed to stay friends with various Jewish individuals and organisations in spite of his alleged burning hatred for them. Perhaps someone should let them know?

If you compare Labour's record of "anti-semitism" with the many easy-to-find examples of outright unapologetic racism of the British (and US) Right, there's no comparison.

There have however been public statements by Israeli diplomats explaining that "anti-semitism" is used in a calculated and cynical way to undermine politicians who do not support Israeli nationalism. And also evidence of Israeli influencers working to "take down" \- their words - British MPs.

[https://www.theguardian.com/world/2017/jan/08/israeli- diplom...](https://www.theguardian.com/world/2017/jan/08/israeli-diplomat- shai-masot-plotted-against-mps-set-up-political-groups-labour)

Meanwhile the Labour MPs making the most noise about anti-semitism also happen to be the old Blairites who were horrified when Corbyn was elected leader.

As you say - let's try not to just believe everything we read on this topic, ok?

<comment><USER7> Anti-semitism (and prejudice in general) exists on a much wider spectrum than just "burning hatred", and it is entirely possible to be friendly with members of a group that you are prejudiced against. If, perhaps, you believe that Jewish people do not integrate fully and are not "properly British", it does not prevent you from also getting on perfectly well with your Jewish next door neighbour, but you're still anti-semitic.

And just as a tip, claiming that accusations of anti-semitism are a Zionist conspiracy is somewhat self-defeating.

<comment><USER9> 43% of tory party members wouldn't vote for a Muslim leader. That's endemic institutional racism. Labour party members have no such issue with Jews. The anti semitism accusations are purely about the Israel lobby throwing a fit.

<comment><USER10> That and the number of Labour members prepared to insist every Jewish person complaining about their treatment or objecting to the disciplinary body ruling holocaust denial memes OK is part of the "Israel lobby throwing a fit"...

<comment><USER9> Most of the ones whose complaints get into the media have links. E.g. members of Labour Friends of Israel like Margaret Hodge who went on a junket to Israel specifically to apologize to Isaac Herzog (he who said "race mixing between Jews and non Jews is a 'tragedy'") about the UK Labour party's "anti semitism issues".

It's frankly quite disgusting the level of Islamophobia some of these people are endorsing simply because they consider it politically expedient to throw their support behind a foreign government.

It's not that anti semitism doesn't exist at all in the Labour party. It's just vanishingly rare and literally nobody - NEVER MIND a leader - has said anything close to as disgusting as what Isaac Herzog or Boris Johnson has said.

<comment><USER10> Newspapers have also covered unambiguously factual stuff such as heads of disciplinary panels writing emails excusing the posting of holocaust denial memes from far right websites as "out of context", whilst Labour's own investigation looked at university kids being bullied - did they all have "links" too?

When your first resort upon hearing people complaining about a particular form of racism is to search for dirt on some of the more prominent members of that minority, I don't think you're in any position to lecture others on endorsing disgusting levels of racism...

<comment><USER9> Digging up memes shared by nobodies and reinterpreting them as racist (seen this a few times now) is used as a means of deflecting criticism of obvious Islamophobia by prominent leaders like Herzog. That's the worst part of this pseudo scandal: it's trumped up for and on behalf of islamophobes.

like I said: it's not like anti semitism doesn't exist in the labour party. it's just that the boy cried wolf countless times, and they cried wolf to protect racists.

this is quite apart from the time members of this community decided that they spoke for all Jews when they attacked a Holocaust survivor.

<comment><USER10> Nobody in the UK cares about "protecting" rarely-discussed foreign opposition politicians like Herzog - they're utterly irrelevant to people objecting to heads of disciplinary panels defending unambiguously racist stuff like this[1] as "out of context" and demanding their reinstatement to run for public office

[1][https://www.thejc.com/image/policy:1.461236:1521729565/.jpg?...](https://www.thejc.com/image/policy:1.461236:1521729565/.jpg?f=16x9&h=576&w=1024&$p$f$h$w=a4c2c21)

Nothing demonstrates the nature of racism problem the Labour Party has quite as much as arguments such as yours that objecting to stuff like this is "reinterpretation" as part of a shadowy Israeli conspiracy to protect Islamophobes

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> As a small aside, I'm always surprised to see that BBC is the most (?) common go-to source for run-of-the-mill non-technology news here at HN. If you think the Guardian is compromised as a neutral source, then let's talk about the Beeb sometime.

<comment><USER12> Well, sometimes the Beeb's gov status is a protection, though. The Guardian can be more or less shut down by imperium, as a private company in this weird kingdom, and its employees can be sued into oblivion; the BBC works under different rules. After the Kelly affair, for example, the head was forced out, but as far as I know actual reporters were not touched. Compared with barging into an office and literally smashing all tools, it's easy-going.

It is true that this situation comes at a cost, every government _leans_ somewhat on its news desk (particularly on political issues), but in many ways that's actually easy to discount.

<comment><USER13> A protection from some things but not others. Since 2016 the editorial direction of the BBC is set by a board of 13, where 11 are appointed by the government: [https://www.theguardian.com/media/2016/mar/13/government- cho...](https://www.theguardian.com/media/2016/mar/13/government-choose-bbc- board-john-whittingdale)

</comment></comment></comment><comment><USER14> So in summary:

\- The Guardian is more Blairite than Corbynite. This one is not a surprise.

\- Relations between MI6 and The Guardian got worse with Snowden, and then got better again. This isn't shocking.

The UK is running out of top-tier independent media platforms. This is concerning. But the dominance of millionaire-owned right-wing tabloids, and the failure to implement any of the recommendations of the Leveson report is far more concerning.

</comment><comment><USER15> There are interesting bits in this article, but on the whole it is not well written and clearly slanted. For example, section about Guardian's reporting on Corbyn has 8 long paragraphs about other media reports like it has any bearing on Guardian's.

I don't like much of Guardian's reporting, but it is difficult to evaluate how much credence to give to an article that is also problematic.

<comment><USER16> I followed the Guardian's reporting on Corbyn. It was clearly aiming to damage him on the basis of very flimsy evidence. I worked on this page compiling a list of Guardian articles showing the extent the Guardian had gone to to paint Corbyn and Labour as antisemitic. [https://theguardian.fivefilters.org/antisemitism/](https://theguardian.fivefilters.org/antisemitism/)

Now if the charges were true, you'd think it would continue to be a problem, especially now that a general election is getting so much closer. As Media Lens pointed out recently, it seems the media has lost interest in that particular attack: [https://twitter.com/medialens/status/1169157686300217345](https://twitter.com/medialens/status/1169157686300217345) \- which would suggest there wasn't much to it in the first place.

<comment><USER12> Guardian editors have definitely decided Corbyn is the lesser evil, most of the hypercritical coverage is gone. The first year it was a non-stop barrage.

The rest of the press is still mostly at it, though.

</comment></comment></comment><comment><USER17> Just wondering, why leak the documents to a select few newspapers that can be silenced instead of the whole world, if the goal is to tell the truth to the people at large? I'd love to see these goons go after every single one of the tens of thousands of seeders in hundreds of different countries if the documents were leaked on a popular torrent website.

<comment><USER18> Credible journalists can reveal key facts derived from the leak while keeping other details secret.

For example, a journalist could verify a leak came from a real FBI agent by checking their badge, and assure their readers of that, but keep the agent's name secret.

Or a journalist given a list of secret base addresses could report the number and countries without revealing the precise addresses.

Also, newspapers might be happier to make a big splash reporting an exclusive, but be less motivated if every other newspaper got the same stuff at the same time :)

</comment></comment><comment><USER19> This is some real investigative journalism that should overtake the pro- establishment propaganda that passes for 'news'.

</comment><comment><USER20> If Guardian has been compromised by anything it's surely by editors that are trying to turn in to a social justice organisation.

Number of pages mentioning "white men" as indexed by Google:

Guardian: 7840 / 3,680,000 (0.21%) BBC: 623 / 4,720,000 (0.01%)

Some headlines of the Guardian that come to mind are "All landlords are scum" and "Maybe white men should just disappear for a while". In the case of the latter it was an interview with the USA's female national soccer captain and that line was something she just joked at the very end and the editor decided to make that the title of the article (if I'd have been her I'd have been furious).

Another rage inducing article was one that nailed David Attenborough to the cross for daring to suggest climate change activism could benefit from separating it from left/right politics.

This is all not directly related to politics, but it's pretty telling. The website / usability is great but the spin they (are pressured to?) put on the content is nauseating.

<comment><USER21> There are severe problems with how we handle land ownership so I don't find that hyperbole rage inducing / infuriating.

The idea of white men "disappearing for a while" is new to me and it sounds like an amazing idea. How better to shake up entrenched power structures? Spread around the leadership roles and experience, and then once that settles combine everyone back and you can end up with a much better mix at all levels.

<comment><USER22> Your racism is showing.

<comment><USER21> Power structures are objectively unbalanced. Wanting to shake them up is not a slight against any particular race.

</comment></comment></comment></comment><comment><USER23> Ctrl+F Greenwald ... No results Ctrl+F Intercepted ... No results

The question "Can you write an article about Snowden and The Guardian without mentioning Glenn Greenwald" has been answered.

[https://www.theguardian.com/profile/glenn- greenwald](https://www.theguardian.com/profile/glenn-greenwald)

</comment><comment><USER24> I have a stupid question: how does this committe know in advance what a newspaper is about to be publishing? I mean in order to give advanced notices they need to know what the newspaper is up to?

<comment><USER25> Credible journalists contact governments, businesses, individuals, and any other subjects of articles, ahead of publication to ask for official comment, interviews, on-the-record explanations and confirmations, and so on.

It's basic due diligence to speak to both sides of a story. However, it can tip off organizations and folks that they are about to be a headline...

</comment></comment><comment><USER26> """ An error occurred during a connection to www.dailymaverick.co.za. Peer using unsupported version of security protocol. Error code: SSL_ERROR_UNSUPPORTED_VERSION """

In Firefox 69...

</comment><comment><USER27> Fishy! This site requests access to _all_ passwords in my KeePassXC Firefox addon. Never seen quite that level of blatancy before.

<comment><USER16> Can you elaborate? How does it do that? And why would that level of access, even if a website wanted it, even be a feature of a password manager? Genuinely curious.

<comment><USER27> You're right, I should elaborate. The site causes a normal KeePassXC-Browser popup, "www.dailymaverick.co.za has requested access to passwords for the following item(s). Please select whether you want to allow access."

Then comes the weird stuff. It may not actually be _all_ my passwords, but it sure is a lot of them, the long list ominously beginning with my bank and a mobile payment solutions.

It's probably a bug of some kind. But sure looks scary.

On my way to work, and on phone only for next many hours, so not able to look further into.

<comment><AUTHOR> Please do. The editorial staff seem like a really well intentioned bunch, but of course there could be something nefarious going on.

<comment><USER28> Or it could all be FUD, spread by MI6 _raises eyebrow_

</comment></comment></comment></comment></comment><comment><USER29> Not many people care about these atrocities in the west.

</comment><comment><USER30> This website shows a popup about adblockers and the close button says "Naaah...journalists should go hungry."

"Let me try to peddle some malware to you, you don't want me to go hungry, do you?"

<comment><USER31> I personnaly thought it was a clever way and prefer that than an AdBlocker Wall.

You can either :

\- Buy a no-ads pass.

\- Disable your AdBlocker

\- Click on "Naaah...journalists should go hungry."

<comment><USER32> or

\- Context Menu->Delete Element

</comment></comment></comment><comment><USER33> This is load of crap. Just Google what they kept writing about cannabis. Independent... all press feeds off big pharma.

</comment><comment><USER34> The one sentence below the article makes me sceptical:

> Daily Maverick will formally launch Declassified – a new UK-focused > investigation and analysis organisation run by the authors of this article – > in November 2019.

This would give them a strong motivation to write a biased or even non-factual article to a) generate attention and b) paint themselves as more credible, or at least a direct competitor as less credible.

</comment><comment><USER35> >An error occurred during a connection to www.dailymaverick.co.za. Peer using unsupported version of security protocol. Error code: SSL_ERROR_UNSUPPORTED_VERSION

How can you test so little on Firefox that it doesn't even connect? (FF Nightly, Linux)

<comment><USER16> Works fine in my Firefox.</comment></comment>


FreeSewing: 1-Page PDF Face Mask Pattern - <AUTHOR> https://freesewing.org/blog/facemask-frenzy/ <comment><USER2> It's been pointed out to me that one should check with local facilities before setting off on this project, to verify that they in fact want any. My partner is a clothing designer and gets this forwarded to her a couple of times a day, and she did some research and found that local facilities were not requesting or accepting homemade masks and the nearest ones that were were many hours drive away and required for some reason in-person dropoffs, in addition to having "enough for now."

<comment><AUTHOR> This comment is a typical HN anecdata focusing on one small issue while ignoring the many ways this is useful.

1\. Mailing facemasks to where they're needed is one of the few good uses of the mail system right now. There's absolutely no reason this has to be a local effort. I'm sure there's a hospital somewhere that would accept these.

2\. Ideally, there would be enough facemasks for _everyone_ to wear a facemask. Prioritizing healthcare workers is a smart move right now, but even if there aren't healthcare facilities accepting these, there's no downside to giving masks to the general populace.

3\. Building on #2, if we can get face masks to people, that might prevent people from buying up all the medical-grade masks that are in short supply right now.

<comment><USER2> If you're sure, please suggest a medical facility currently willing to accept homemade masks via USPS.

<comment><AUTHOR> I know of one place near me, but if I go posting that all over the internet, they'll be inundated and stop accepting them. It's better that people do their own legwork to keep this decentralized. An alternative would be for someone to do the legwork of calling a lot of hospitals and create a comprehensive list of where masks are needed, which is something I'd be totally into if I weren't inundated with work right now.</comment></comment></comment></comment>


"Hey", an interruption tracker written in Scheme - <AUTHOR> http://interrupttracker.com <comment><USER2> > just type hey <person's name>

> ...

> To invoke that just type hey graph

Boss: meet your new coworker, "graph".

Oh no.

<comment><USER3> i'm not getting something about this comment. Is the implication that someone would show the boss the graph of the interruptions by the new coworker?

<comment><USER2> The intended joke was that a new coworker would be named "graph", which then would break the perfect tracking system put in place by the narrator (given that the command is unusable for this coworker); the narrator would then utter "oh no", thinking about the inescapable flow of interruptions that would come from "graph" in the future, for which he or she could not have any possible mean of retaliation. The whole thing is of course a little bit absurd, and fun I guess, because "graph" is not a realistic name. The "oh no" parts refers to [http://webcomicname.com/](http://webcomicname.com/).

<comment><USER3> ahh. yes i should have gotten it. thanks for the explanation. I actually used to have a command, or was about to make one that did intersect with a not so common name. I forget what it was now. So I pretty much hit this exact problem.

</comment></comment></comment></comment><comment><USER4> Thanks for sharing! This is fascinating and I want to try it out. Might be an excuse to learn Scheme, too; something I've been meaning to do.

Funny, I see only 6 comments at [https://news.ycombinator.com/item?id=15795468](https://news.ycombinator.com/item?id=15795468) , but [https://hn.premii.com/#/comments/15795468](https://hn.premii.com/#/comments/15795468) shows 7. Maybe that 7th was moderated?

The comment was way heavy on snark, maybe even mean/rude. But I think it is important because it captures how I'd feel if I walked up to ask someone a question and I saw them type "hey adam" on the command line. Going heads-down is important, but so is overlap, banter, and face-to-face communication. And not all of that should be organized/scheduled. Just let folks know you are going heads-down by putting on headphones, setting your status in your chat/presence app, or blocking out time on your calendar.

The comment was:

"This tool is specifically designed to help you be less helpful, less friendly, more cold, more passive aggressive to friends and colleagues.

I know so many developers who are going to love it."

<comment><USER5> That comment sounds a lot like my latest performance review. It was actually the constant interruptions that caused me to be less helpful, less friendly, more cold, and more aggressive toward my colleagues. A tool that could help mitigate these interruptions would probably improve my relationship with them a lot. I don't think people realize how disruptive minor interruptions are when multiplied by the size of their team. I can't have impromptu face-to-face chats with 30 people every day and still do my job.

<comment><USER6> There was a previous role where I was alternating both dev and devops hats and it is easy to wonder if I had tracked interruptions and task switching a bit more formally if I'd have more ammo for a performance review that seemed to come out of nowhere for me. I was told that people thought I wasn't being helpful or communicative enough, but I felt unproductive and like I was doing almost nothing but helping other people most of the time. (In the long view that situation worked out in my favor, surprisingly, but it's an interesting thing to wonder about.)

<comment><USER5> Your situation sounds very similar to mine. How did it work out in your favor? Right now it looks like I just have to give up completely on productivity to get a promotion.

<comment><USER6> It's not a way I can generally recommend, sorry. In that particular case the extra scrutiny meant I was in the first wave of layoffs, and they almost ruined my vacation doing it (I almost got word of the layoff right before heading off on a cruise), but I got a full severance unlike some of the following waves. The first wave was to make the quarter profits more appetizing for sale to new owners, and eventually over the next couple of years the new owners entirely laid off all software development in the region.

It seems preferable in retrospect to get a full severance and plenty of time to find the next role (even as stressful as that was in the moment) than to hang on for an ownership change and eventual layoff anyway. Some of my friends hung on and regretted it.

Anyway, like I said, that's not generally applicable to every situation, though. I hope you get some good luck or find a way to make the extra scrutiny work for you.

Sometimes that extra scrutiny means they care for you and want you to ultimately succeed (and may even depend on you succeeding) and you both need to work together to figure out how to make that happen. That was the case in a further previous role, though in that case that was mostly a sign to me that it wasn't going to work in the long term (a lot of my "bad" behavior were symptoms of stress and ethical anxiety), and I needed to move on.

</comment></comment></comment></comment></comment><comment><USER7> I can't seem to get this installed. I followed the directions and installed Chicken Scheme with brew. It then says to run the installer.sh, but that seems to be looking for some additional files that don't exist (they are part of the source code, however). Also the URL in the README.md of the installer package has the wrong URL.

Seems like a cool idea but I'm just not invested enough to track down the issues here and get it working!

<comment><USER8> Specifically the install script is looking for

source bash_files/ask.sh source bash_files/install_cli_tool.sh

<comment><USER3> message me on twitter (@masukomi) or email me at email@example.com and I'll let you know when there's a new version with simpler setup and / or help you get the current version working. I'll try and fix that in the current version.

</comment></comment></comment><comment><USER3> author here: wasn't expecting this to show up on HN... sadly, it's kinda bad timing. A couple folks here have commented on problems getting it installed, AND there are some issues with large data in graphs which i've addressed locally but not pushed yet because.... I'm in the middle of rewriting this in Crystal so i can just give folks a statically linked binary to run and have better test coverage and many other good things (like cleaning up a codebase that kind sprawled out of control.... was just a quick hack that kept growing)

So: if you're interested in this please message me on twitter (@masukomi) or email me at firstname.lastname@example.com and I'll let you know when there's a new version and / or help you get the current version working.

<comment><AUTHOR> Sorry for the inconvenient posting.

I have a friend who _constantly_ gets interrupted by his supervisor just talking about random stuff--like his home improvements or his stock portfolio --so I thought this was a pretty fun idea.

<comment><USER3> no worries. I appreciate the visibility even if the timing is bad. i should have been aware of the bug, and i should have had a note on the site while i fixed it (I do now). It's nice to have found that others find the idea valuable. Also confirms that i need to finish the rewrite because easy install is one of the most important things to me, and this app is failing on that, despite my repeated attempts to beat that install script into submission and work on multiple platforms. So, it's good in the end. thanks.

</comment></comment></comment><comment><USER9> I apologize if I sound overly negative, but why not just tell people to send you an email/message instead of interrupting you? You can even have a "do not disturb" sign on your door. I'm sure slack has some functionality for turning off notifications when you're busy.

<comment><USER10> The purpose is tracking who is interrupting and why, not stopping interruptions, with the aim of finding patterns.

In previous places I worked, it might have been quite useful if I kept a record of what questions people interrupted me to ask, so I could look back on that and work out parts of my software than needed to be made easier to use or have documentation added. If I was using OP's tool to track this, I'd probably include "interruptions" where someone sent an email or slack message as well as those where someone came over in person.

<comment><USER3> exactly right. I've been wanting to figure out how to get every message i receive on slack piped into a script so that i could then extract "interruptions" from that. but yes I track everything that wasn't a "planned interruption".

</comment></comment></comment><comment><AUTHOR> This is _masukomi_ 's baby. I figured it would come in handy as an evidence- builder if you have to report to someone.

" _Why isn 't it done yet?_"

Run _Hey!_ , turn monitor to face boss.

That, and just knowing where your time goes can be a real life-changer.

<comment><USER3> yeah, that was definitely part of the thinking when i wrote it, although i'm happy to say it was more ME wondering why things took as long as they did than my boss.

</comment></comment><comment><USER11> From the documentation:

" hey kill <name>

(Note: No humans will be harmed in the execution of this command.)

Deletes that person from your database, and removes them from any events. If there are events that only involved that person, they will also be deleted. "

Good sense of humour

</comment><comment><USER12> This looks fantastic and I'd love to start using it. Unfortunately it seems to be written in a particularly obscure Lisp dialect and the build script is... temperamental at best.

<comment><USER3> yeah. i'm sorry about that. I'm in the middle of a rewrite that'll address that. setup's been a pain and i don't want people to have to install chicken scheme just to use it. message me on twitter (@masukomi) or email me at email@example.com and I'll let you know when there's a new version that should "just work"

<comment><USER12> Thanks! I love the idea most of all, and knocked up a very rough and ready Python version this afternoon so that I could start using something similar straight away. I'll definitely keep an eye on the project's progress :-)

</comment></comment></comment><comment><USER13> A nice idea, thanks for sharing.

I do something similar in emacs with org-capture. I use a capture template that enters a row into a table in an org file. In that file I have some org- babel blocks that computes my histograms and displays a nice graph for me.

Although emacs isn't exactly user friendly for most people. I hope your project gets out there more. It's a useful tool to have.

(As a manager of an software development team my job is to be distracted and handle them effectively... a tool like this has been invaluable.)

<comment><USER3> i'd love to know exactly what graphs you've found to be valuable. I've been finding that many of the things i _thought_ would be valuable to see graphed end up looking more like modern art than useful data (people by hour for example) .

<comment><USER13> There are two I use the most;

1\. Histogram of frequency by distraction type [0]

2\. Histogram of frequency by distraction type filtered by person [1]

[0] This lets me know what is distracting me the most. If I find a particular type is a clear leader in frequency then it prompts me to find a way to reduce that particular type of distraction.

[1] When I'm investigating [0] if the type is not descriptive of the cause I look to this graph to determine the person who causes it the most.

For example the "codehelp" type tends to be pretty strong over all. When we launch a new feature or introduce a new software component on the back end I tend to see a spike in these coming from the junior members on the team who need extra guidance understanding the feature or technology. However when it starts to move away from the average by looking at [0] I'll sometimes look through each person using [1] until I find that there are one or two team members that need extra guidance.... then in a week or two I usually see [0] return to "average."

</comment></comment></comment><comment><USER14> I feel like there was an opportunity missed to make a Navi the Fairy reference.

"Hey! Listen!"

</comment><comment><USER15> Genius. Adding a bidding/auction process would be nice too.

<comment><USER3> ...er... what? I assume you're joking, but even so it doesn't really make sense. I could imagine that in a calendaring app. I'm not sure how it applies to something that tracks interruptions. I'd honestly like to know because sometimes those jokey ideas have a little value hidden in them.</comment></comment>


Ruby is not web scale - <AUTHOR>

Don't believe me?  Have a look for yourselves.  https://www.healthcare.gov/ <comment><USER2> The design is not scaling, not the language.

</comment><comment><USER3> Still don't believe you.

</comment><comment><USER4> What are you trying to say? I don't get it.</comment>


The Importance of Giving a Damn (in people and software) - <AUTHOR> http://blog.danilocampos.com/2010/10/04/the-importance-of-giving-a-damn/ <comment><USER2> Nice post.

I've always thought that the people who gave a damn were the ones who instinctively understood that energy given is not energy given away. It's energy given _and_ kept.

Those who appear to not give a damn are the ones who think that if you expend energy on your customers, you lose that energy and become weaker. Ironically, they become weaker by _not_ expending that energy.

A programmer going the extra mile by writing great customer facing software is like lighting a candle lighting another candle. At the moment they touch, _both_ become brighter and then you have twice the light.

Thanks for the great examples. I love Zappos and hipmunk, too.

<comment><USER3> It feels like there is something pressing against me when I give a damn. I mean, the result is appreciated, but I feel like the culture around me hates me for being willing to make the sacrifice necessary to get there.

<comment><AUTHOR> There _is_ something pressing against you. The apathy of everyone else around you. Few things are more painful than being around people whose give a damn isn't aligned with your own. You'll spend a lot of time advocating things that seem alien at worst and wasteful and best.

<comment><USER3> This sounds like the story of my life. The best way to deal with it is to...leave?

<comment><AUTHOR> It may be. I can only speak for my experience. For me, being around people who don't share my values is utterly draining. Time you could be spending making magic happen gets spent on convincing other people that magic is worth something. It can be exhausting.

You absorb the energy of the people around you. And if the people around you fail to give a damn about the things you care about, you run the risk of losing own energy for it, too.

I don't, in the end, know the best solution for your case. But whatever you do, protect that spark that makes everyone look at you like an ear is growing out of your forehead.

</comment></comment></comment></comment></comment><comment><USER4> One thing I like about Hipmunk's interface is that it doesn't need two extra clicks to make the calendar inputs appear.

</comment><comment><USER5> Same reason Apple's products are loved so much by their users - made with keeping the users in mind, not the shareholders.

Not that Apple's shareholders have any reason to complain.

<comment><AUTHOR> I challenged myself to write this without touching Apple but I agree entirely.

Apple gives a damn about the user experience from the very moment you walk into an Apple Store, and it continues through opening the box and first-run of your hardware, all the way to your day-to-day usage.

<comment><USER6> They do and always have. But the problem with them giving a damn is that they have a certain type of user in mind. And to give a good user experience to that user, they need the control.

If you happen to be the type of user who wants maximum control in your hands, and not in Apple's, then Apple's giving a damn has a negative impact on you.

It's why I stopped using Apple after growing up using their stuff and switched to running linux on PC hardware. I wanted my control back from Apple.

And since Linux is open source, I get the benefit of having control and having a product (software at least) made by people who give a damn!

</comment></comment></comment><comment><USER7> Nice post, but I wish hipmunk gave a damn about graphic design and had an excellent designer touch-up that eyesore of vector illustration and the poorly anti-aliased text of "flight search", or maybe it's an intentional statement - we care so much about good search that we don't care about design.

<comment><USER8> I'll gladly send you the .eps of the hipmunk if you'd like to un-eyesore it.

<comment><USER9> Now that's throwing down the gauntlet:)

</comment></comment></comment><comment><USER10> Total agree, giving a damn is probably the best filter ever. Of course, the converse can be applied effectively too; not giving a damn to things that you're not willing to invest wholehearted in, streamlining your productivity instead of trying to give a damn with everything.

</comment><comment><USER11> "Design like you give a damn" - Cameron Sinclair

<http://www.ted.com/speakers/cameron_sinclair.html>

</comment><comment><USER12> i have been impressed by your blog/comments, etc. what are you working on/where do you work at?

<comment><AUTHOR> That's very kind of you, thanks.

Right now I'm learning Rails, along with Ruby, to work on a web app I've been imagining. I spent a decent chunk of time on iPhone development but always felt the gap in not knowing how to do server-side stuff.

I love making things for other people to use. That's the thing I have, since childhood, given a damn about, and why I learned how to program. I'm a product manager at Aurora Feint these days, but I often miss being more hands-on.

I also consult on mobile UX when I've got time – and will consider writing iOS code for the right clients.

I'll be at Startup School – if you're attending, it'd be great to meet up. (That goes for anyone else going, too!)</comment></comment>


Why clean code matters - <AUTHOR> http://samheuck.com/code/why-clean-code-matters/ Wanting to write clean code is not simply an expression of developer idealism, it saves money and prevents headaches. <comment><USER2> Personally I think this is related to the reason why zero comments is BAD. You need to have comments that express the intent of your code so that future developers, who are reading your code, can compare your expressed intent with the actual code that is executed. Names of things are just a special kind of comment.

So this is just a special case where a clean coder would have compared the intent and the code, and realized that the commment/name needs to be changed to match the change in intent.

It's like the old British sailing ships that Horatio Hornblower sailed on. The master gave an order, the first mate repeated that order, the second shouted that order and so on, until one of the navvies translated the order into colorful language that a lady would blush at.

Just as we need to express our code in two different ways for the main codebase and the test codebase, we also need to express our intent in two different ways. One way is a complete set of comments and great names, and the other way is in the code itself.</comment>