Firefox Developer Tools: Break on DOM Events, Edit as HTML, Codemirror - <AUTHOR> https://hacks.mozilla.org/2013/11/firefox-developer-tools-episode-27-edit-as-html-codemirror-more/ <comment><USER2> Interesting that they're using Codemirror instead of Ace ([http://ace.c9.io](http://ace.c9.io)), which is their progeny.

It used to be called Bespin: [http://blog.mozilla.org/labs/2009/02/introducing- bespin/](http://blog.mozilla.org/labs/2009/02/introducing-bespin/)

<comment><USER3> I thought that was an interesting choice for Mozilla, too. Here is what appears to be the bug report which contains their debate on whether or not to use codemirror.

[https://bugzilla.mozilla.org/show_bug.cgi?id=816756](https://bugzilla.mozilla.org/show_bug.cgi?id=816756)

I would be curious to know if Mozilla is still actively involved with Ace development at this point?

</comment></comment><comment><USER4> Great work Mozilla team. You're seriously making me consider switching back to FF for development. Is this effort to improve the FF dev tools an ongoing effort to quickly add these features, or can we expect the pace to slow down in the coming months?

<comment><USER5> The team here is dedicated to developer tools full-time. We have no intention of slowing down.

</comment></comment><comment><USER6> These additions all look great. I recently was working a bit on an Android app (not an Android developer, was filling in for someone on vacation) and it made me realize how good web developers have it. Part of my normal development process is to edit HTML, make CSS changes, and some times even JS changes at run time and observe the results. With Android anyways the cycle was to edit some XML file, reinstall the application, navigate to where that activity is, observe the changes, scratch head why result wasn't as expected.

<comment><USER7> Yeah, but I'd argue that Android XML layouts are a heck of a lot easier to work with than CSS. They have the benefit of being used for exactly the purpose they were originally designed for.

<comment><USER8> Have to agree. Takes some getting used to, but I find -for simple things - they have much more consistent behavior even across android versions.

</comment></comment></comment><comment><USER9> Can I write Firefox addons that extend Developer Tools functionality? I had some ideas for extending Firebug for specific use cases, but maybe the official dev tools are a better bet.

<comment><AUTHOR> Yes, you can extend the Developer Tools. More information at [https://developer.mozilla.org/en- US/docs/Tools/DevToolsAPI](https://developer.mozilla.org/en- US/docs/Tools/DevToolsAPI) & [https://github.com/victorporof/Restartless- Template](https://github.com/victorporof/Restartless-Template)

</comment></comment><comment><USER10> I love firefox and use it daily for my work. The only time I switch to Chrome is when I use console.log(<some object or DOM node>) and get an [Object object] printed out. Sure I can click on it and get a breakdown (still haven't figured out how to close that view other than closing and re-opening the dev tools pane, BTW), but Chrome handles it much better by logging out a detailed, interactive object.

Still, great job to the FF team and keep up the good work!

<comment><USER11> Firebug does it in a way similar to Chrome, as well. This is really my last withstanding gripe with the Firefox developer tools; if they make logging objects more useful, I will drop Firebug in a heartbeat.

<comment><USER12> You can use console.dir to get an inline browse-able object, does that help?

See this screenshot:

[http://note.io/HxSxmK](http://note.io/HxSxmK)

<comment><USER11> It helps, but the key feature of Firebug for me in this regard is that, if the object is an HTML element, I can click on it and it will take me to that element in the HTML view. The built-in tools don't have this yet.

<comment><USER12> There is the bug for nearly that exact thing:

[https://bugzilla.mozilla.org/show_bug.cgi?id=890402](https://bugzilla.mozilla.org/show_bug.cgi?id=890402)

I linked to this comment in that bug, thanks for the feedback!

</comment></comment></comment></comment></comment><comment><USER13> Excited about some of these changes. I've been debating moving back to FF for my primary dev browser for some time and these look like the changes that will make me do it.

Thanks Mozilla!

</comment><comment><USER14> The tools get better every update. Came in here to complain that it wasn't obvious / possible to copy URLs from inside the network inspector, but thought I'd check the latest version first... and what do you know, there it is.

I don't even use Chrome at all anymore.

</comment><comment><USER15> This is nice... Great work mozilla

</comment><comment><USER16> Sometimes I want to use XQuery in the web console for pages that don't use XQuery. Does anybody know how to dynamically include XQuery on loaded pages to use with the web console?

<comment><USER17> Well, I know you can inject _jQuery_ into any web page using the "jQuerify" button in FireQuery ([http://firequery.binaryage.com/](http://firequery.binaryage.com/)). But I've never even heard of XQuery before now. According to [https://en.wikipedia.org/wiki/XQuery](https://en.wikipedia.org/wiki/XQuery), it seems to be a standard language, rather than a JavaScript library. What library do you use? [http://www.xqib.org/](http://www.xqib.org/) ?

</comment></comment><comment><USER18> Very interesting</comment>


Show HN: Gurn – A fast way to navigate your web at home or work - <AUTHOR> https://www.gurn.io <comment><AUTHOR> Hi everyone,

My co-founder and I have been working on Gurn for the past 12 months or so and thought it was about time we shared it more widely for feedback.

Gurn is a tool that changes how people find and share information, particularly in the workplace where search engines never quite seem to deliver. It is born out of the frustration we and our colleagues experienced working in large enterprises trying to find things and never being able to. This is a problem that we only see getting worse as information becomes more protected and companies are less inclined to expose data to search engines – leaving only the most open data as searchable.

Gurn works by allowing people to link keywords to URLs. These short words or phrases can then be used to navigate around the web. We believe that people understand their organisations best and Gurn is trying to harness that knowledge and make it accessible to everyone. We talk about it as a sort of people-powered search.

There are a few videos on the website showing how to use Gurn, I apologise - they are all a bit boring at the moment - we will spice them up once we can afford a professional.

A rough guide to how it works:

I can add [https://news.ycombinator.com](https://news.ycombinator.com) to the keyword 'hn' or 'hacker news' (or whatever!). Now I can type 'go hn' in my address bar and get taken there straight away. It's as simple as that.

There is a lot more power available - opening multiple websites, searching, collaboration etc and these are shown in the videos. The goal is to put you one step away from wherever you need to be.

We are really keen to get your feedback so that we can make Gurn as useful to as many people as possible.

We're happy to answer any questions!

Thanks

Simon & Rory

</comment><comment><USER2> Very cool product. Lots of exciting applications. What is next big feature guys?

<comment><AUTHOR> Hi jacklucidminds,

Thanks! The critical thing at the moment is supporting all browsers (particularly IE!) but beyond this, we want to dramatically improve how people discover tools and resources in the workplace. Think recommender systems and the like, it would be great to suggest resources to people based on their colleagues' activity for example. We think there is a lot of potential but it's making sure we nail the basics and then deliver any value we can on top.

Simon</comment></comment>


Why should I start my career at Microsoft, rather than a startup? - <AUTHOR> http://microsoftjobsblog.com/blog/dear-jobsblog-why-should-i-start-my-career-at-microsoft-rather-than-a-startup

<comment><USER2> <http://www.google.com/search?q=why+i+left+microsoft></comment>


Ask HN: How do I increase my newsletter subscribers? - <AUTHOR> I am not going to put a link because I really want good answers without coming across is self-promoting.<p>Newsletter topic is front-end development. Current subscribers = 1700 <comment><USER2> Indie Hackers just did a podcast with Scott Keyes of Scott's Cheap Flights on that topic:

[https://www.indiehackers.com/podcast/020-scott-keyes-of- scot...](https://www.indiehackers.com/podcast/020-scott-keyes-of-scotts-cheap- flights)

But in his case, his subscribers mostly came from a story Business Insider did about his two month round-the-world trip on frequent flyer points. The story took him from 300 subscribers to 5000 overnight. (Sounds like he's now over 150,000 paid subscribers). Another takeaway is that he doesn't used paid ads, and puts the money towards on-theme giveaways instead. Since the newsletter is about cheap flights, the giveaway was for free international flights.

In another HN thread, someone suggested looking at the Cooper Press mediakit to compare your metrics, most of their lists are in the 10,000 - 20,000 subscriber range and 'only' grow at 100/week: [https://cooperpress.com/advertising/](https://cooperpress.com/advertising/)

I've been trying to get subscribers to my own [http://indieconference.com](http://indieconference.com) list, but a couple of HN comments are the only traction I ever got. I thought monitoring HN automatically for opportunities to mention would help, but it was a colossal waste of time - lots of noise and very few relevant moments to mention. So don't spend time on that :)

<comment><USER3> It should be emphasized that there is clear value in signing up for this case, with no effort at all for the subscriber. OTOH, even for another developer there is the likelihood of at least time investment in a technical newsletter without tangible return.

</comment></comment><comment><USER4> Hey, the basic answer is:

1\. more site visitors 2\. higher subscribe rate 3\. lower unsubscribe rate

There are dozens or hundreds of things you can do to work on any of those.

Here is some low hanging fruit for most folks:

1\. Ask folks that have linked to your previous projects to link to this one too (SEO & maybe traffic benefit).

1\. Ask current subscribers to share out your site.

2\. Force the email subscribe. Create a landing page or drop down w/ SUPER CLEAR messaging that folks have to fill out or skip to get to the content. Not a popup. You should be able to get subscriptions up to 15 - 30%.

2\. Run a giveaway w/ software like King Sumo.

3\. Less fun answer: create more value. E.g., give them free stuff, insider info, etc.

I wrote a mega guide about this here:

[https://www.michaelalexis.com/10000-subscribers/](https://www.michaelalexis.com/10000-subscribers/)

<comment><USER5> A nice guide to a lot of the things that make me redflag a website and any credibility it could have, before this list, had.

<comment><USER6> So you red flag a website for creating more value?

<comment><USER7> "Creating value" is a vague concept, but from the context we can be pretty sure it entails aggressive self-promotion, which is a nuisance for your audience and does not benefit them. That's why it's a red flag.

</comment></comment></comment></comment><comment><USER8> People already consume too much stuff a day without producing anything. That's why they don't want to subscribe to yet another newsletter. I guess the ultimate baseline of getting subscribers is getting more page visitors with SEO and continuous content production.

I have generated a couple of thousand subscribers with a giveaway ebook. [0] In the beginning, it was difficult for me to get subscribers with only content. That's why I decided to write an ebook to grow my audience, to get exposure and to learn myself more about the topic in detail.

Personally I try to keep the newsletter annoyance low for my visitors (e.g. avoiding popups to signup for my newsletter). My personal opinion is that if you are in for the long run with your website, you want visitors to enjoy the reading experience and in return to come back to your website.

\- [0] [https://www.robinwieruch.de/the-road-to-learn- react/](https://www.robinwieruch.de/the-road-to-learn-react/)

</comment><comment><USER9> Offer something in exchange for emails. Maybe a short tutorial packaged in a PDF?

</comment><comment><USER10> I've been getting a steady stream of subscribers with blogging (150/month on a slow month). Write a blog post, link to signup at bottom, get subscribers.

My newsletter isn't typical "here's a bunch of links every week" thing, though, so possibly easier to go this route: the basic pitch is "if you like this post, here's some more of my writing that will also be useful."

</comment><comment><USER7> Should you have more? Be careful, don't sacrificing the quality of your information/message in the pursuit of gaining subscribers.

</comment><comment><USER11> ...which equates to a click through total of < 100?

Focus on the 'click through' of what 'customers' you already have. Improve on that first. The thinking behind this is that it is easier/cheaper to keep customers than to acquire new ones.</comment>


SteelHouse Sued by Competitor for Click Fraud - <AUTHOR> http://www.businessinsider.com/criteo-vs-steelhouse-click-fraud-lawsuit-2016-6 <comment><AUTHOR> Apparently they spoofed UTM tags by opening hidden iFrames after a shopper clicked a competitors ad. Lawsuit details: [http://www.businessinsider.com/document/575feb558d3eae0d080e...](http://www.businessinsider.com/document/575feb558d3eae0d080edc21/criteo.pdf)</comment>


Show HN: Parsing horse racing charts with Apache PDFBox - <AUTHOR> https://github.com/robinhowlett/chart-parser <comment><USER2> Very interesting! I had never heard of Apache PDFBox before, I must give it a try. I have a similar program that parses horse racing PDFs from sites such as www.racehorserunner.com - which are of a much simpler format, but cause endless problems for me when the PDFs have layout problems. For example, issues like one column being too long and overlapping with another, e.g the last race on [http://www.racehorserunner.com/Archives/ELP/ELP170702.pdf](http://www.racehorserunner.com/Archives/ELP/ELP170702.pdf)

All PDF parsers that I have tried cope very badly with these kind of situations, and often try to be 'too clever' in that they value the final layout of the text over and above the individual strings.

Have you experienced similar problems with PDFBox, or does it handle formatting and layout fairly reliably?

<comment><USER3> PDFBox committer here, if you want even lower-level access to the page content stream, without anything 'clever' at all, check out the PDFGraphicsStreamEngine class, which is a superclass of the text extraction and rendering classes. Gives you access to the raw glyphs. You can override PageRenderer too, for visual debugging, e.g. render glyph bounding boxes. We have an interactive Swing PDFDebugger which does just that.

[https://github.com/apache/pdfbox/blob/6f18d7c4bef4d23a22d/ex...](https://github.com/apache/pdfbox/blob/6f18d7c4bef4d23a22d/examples/src/main/java/org/apache/pdfbox/examples/rendering/CustomGraphicsStreamEngine.java)

<comment><USER2> Thanks for the guidance, I'll take a look.

</comment></comment></comment><comment><USER4> I still don't understand how PDF could become one of the standards for publishing documents. Well structured content gets converted into PDF which loses most of that structure. And then a lot of work is done to guess that structure from PDF and convert it back to a better file format. It just shows that successful solutions don't have to be technically good.

<comment><USER5> The keyword is "publishing" \--- as in, producing human-readable physical copies, not electronic ones. It just so happens that the format was relatively suitable for the latter too (because it actually looks like a printed document rendered on the screen --- unlike HTML or other formats around at the time), which is why that use-case became popular. PDF is basically a descendant of PostScript, which was designed to control printers.

(Its PostScript origins may also explain the bizarre mix of text and binary that constitute the file format. For example, page contents are in a relatively free-form PostScript-ish RPN-like textual language, but are found in "content streams" which may be compressed or encoded into a binary format. Data "object" structures include things like '<<'-delimited dictionaries, '[' arrays ']', textual "/Names", and even provisions for comments(!?).

Then there are things like the cross-reference table of all objects in the file, which is an array of fixed-width _textual numbers_ representing file offsets, e.g. "0000001056 00000 n" refers to something 1056 bytes from the start of the file. Reactions of _WTF!?_ from those working with the format for the first time are not uncommon.)

<comment><USER6> Minimal PDF explained: [https://brendanzagaeski.appspot.com/0004.html](https://brendanzagaeski.appspot.com/0004.html)

</comment></comment></comment><comment><USER7> Very neat, and gets me curious about PDFBox, but every time I see something that converts a consistent-layout PDF back to structured data, I just bemoan the fact that this would all be trivial with an API for these kinds of things.

</comment><comment><USER8> Great job!

I was just looking at collecting race information and historical results data a month or two ago and was struck by the lack of available structured data. Heck, I couldn't easily find any for pay options either.

</comment><comment><USER9> Firstly, what an interesting library. Secondly, this is among the best TLDR readmes I've ever seen! I lack exposure to this area, so I'm actually quite impressed with the complexity of it.

Keep up the great work.

</comment><comment><USER10> As a python programmer, I found R's pdftools to be indispensable for messy text based PDFs. I couldn't find a python lib that worked as consistently across variously different formats.

<comment><USER11> I came across [https://github.com/pdfminer/pdfminer.six](https://github.com/pdfminer/pdfminer.six) recently and was impressed with what it could get done. The documentation can be challenging to parse, so I relied on a code sample from a StackOverflow answer. Have you had a chance to try it out? Curious about how/if it works well across platforms.

</comment></comment><comment><USER12> Impressive! Seems like you can't just use PDFBox out of the box (no pun intended) and need to write some custom code specific to the PDF itself per the chart-parser commits[1]

[1] [https://github.com/robinhowlett/chart- parser/tree/master/src...](https://github.com/robinhowlett/chart- parser/tree/master/src/main/java/com/robinhowlett/chartparser)

<comment><AUTHOR> Author here; well, PDFBox is good for simple text stripping. If I wanted to print all the text on the PDF, that would be very straightforward and not much code. However, the PDF chart here is in essence a representation of structured data. I wanted to get the content in that format so that I could both serialize to JSON plus have an SDK to boot.

</comment></comment><comment><USER13> Crazy! I was just looking in to this topic a few weeks ago, for a friend. Thanks!

</comment><comment><USER14> what I would love is an app that would reformat portrait PDFs as 2-column landscape for reading on my screen

<comment><USER15> Most PDF viewers I am aware of (including my own, PostView) have 2 up modes, are those not sufficient?

<comment><USER14> that's still presenting the pages in portrait orientation. I want the pages to be landscape and for the text to flow in at least 2 columns.

<comment><USER16> PDF is used primarily for pre-paginated media and does not reflow text; if the PDF author wanted the pages in landscape orientation, or using some other paper dimensions, he would have specified that. Same goes for margins and the like.

<comment><USER17> Doesn't mean the author isn't wrong for my reading situation... Or isn't doing it just cause everyone else is.

<comment><USER5> I think what the parent is trying to say is that PDF is not like HTML or text or other formats where the viewer is primarily responsible for a lot of the formatting --- in fact, a PDF page contains not much more than primitive instructions of the form "move to X, Y"; "set font to F"; "draw text 'Some text here'" (some pathological cases issue individual moves and draws _for each character_ ) --- so expecting all PDF viewers to be able to somehow "reverse-engineer" or "decompile" that set of low-level drawing instructions into more semantic entities like lines of text or even words in order to reformat the text is a little too much.

Anyone who has tried selecting text from a two-column PDF page will also quickly realise the nature of the problem.

<comment><USER17> I totally get that; however since these days a standard sheet of papers is no longer the main reading mechanism... I'm not sure it's the best layout for reading. My brother is a PhD and reads papers all day. He hates the two column format and paid for a reflowing reader. PDF is terrible on screens with different ratios than paper... Eg good computers and mobile. As I get older I use my plethora of giant screens to crank the fonts way up and sit back relaxed. PDF is terrible in that situation.

Just a thought... Maybe highly formatted PDFs for paper print shouldn't be the standard anymore. Eg my original point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Can it be used for invoices?</comment>


O'Reilly Radar: Entrepreneurial Proverbs - <AUTHOR> http://radar.oreilly.com/archives/2006/03/entrepreneurial-proverbs.html What every entrepreneur/founder should know
http://radar.oreilly.com/archives/2006/03/entrepreneurial-proverbs.html
Old but gold. <comment><USER2> It's actually surprising how terrible the front page articles are on a weekend. Among the trash today are this tired rehash of useless proverbs, a PDF presentation of UNIX commands, and a pop psychology article from the LA Times.

<comment><AUTHOR> I had not read these proverbs before and found some real insight to them and points I had not considered.

<comment><USER2> I think you're committing a sort of broken-window fallacy. You're seeing what is there, and thinking it's alright. I'm seeing what's not there, and thinking it could be so much better.

<comment><USER3> Good comment. We should add it to O'Reilly's list

</comment></comment></comment></comment><comment><USER4> ...and here is a VC fund manager proverb:

"On my left side nothing is right.

And on my right side nothing is left".</comment>


A record of unsolicited kindness and excessive generosity in academia - <AUTHOR> http://academickindness.tumblr.com/ <comment><AUTHOR> I found this via Twitter [1] and thought that it would nicely counterbalance a bit the academia trashing we had here recently following the YCR announcement :).

[1] [https://twitter.com/AcademicsSay/status/652955506248519680](https://twitter.com/AcademicsSay/status/652955506248519680)</comment>


Ask HN: How to make tech friends? - <AUTHOR>

Hi,
I'm 24 and I don't have any tech friends.
I moved from Europe to US about 4 years ago and basically started my life from zero. I remember when I first came to the US I had only $200, a bag full of clothes and no family or friends.
Well, things have gotten better now. I've managed to evolve a bit. I've been to a community college for 2 years, I've discovered I have some family so I moved to Arizona and I've also made some good friends.
But I do have an issue that really bothers me. I don't have tech friends. And boy, I'm reading HN every day now and the energy and inspiration I get from it is amazing, but I have no one to share it with. I truly want to start my own company, but reading all these articles about how having 2 founders is better than 1 makes me question my chances of success. The idea of starting a company got me thinking that I could never find a co-founder since I really have no tech friends. No one to share my ideas with, get feedback or challenge them.
So my question is how do I find people that are great individuals, smart/talented and passionate about software development to befriend with?
P.S. * I know school is probably the best place to find tech friends, but I just couldn't seem to find anyone smart enough and really passionate about technology at my college. <comment><USER2> Here are a few ways that come to mind:

1) Attend local tech meetups, hackathons, conferences.

2) Contribute to open source projects.

3) Be active in an online tech community, like HN.

4) Start a blog and write about technically intriguing stuff.

5) Build something cool and share it with everyone.

<comment><USER3> LetsLunch.com will match you with one entrepreneur per day to go out for lunch.Its like linkedin with lunch.

PS: I'm a founder

</comment></comment><comment><USER4> <http://www.meetup.com> is a great place to meet developers in your area. There might be more around than you think.

</comment><comment><USER5> Find a nearby hackerspace, and start visiting it. NoiseBridge in SF and Resistor NYC are two excellent examples. <http://hackerspaces.org/wiki/Hackerspaces>

<comment><AUTHOR> Wow. I've already found some cool places in my area. Thanks

</comment></comment><comment><USER6> College.</comment>


Elucidating Cuttlefish Camouflage - <AUTHOR> http://maxplanck.nautil.us/article/350/elucidating-cuttlefish-camouflage <comment><USER2> Oh hey, is this Nautilus the publication that doesn't pay their authors until they sue?

They used to have some excellent work before all the authors wised up...

If you're interested in this type of material, may I suggest mosaic ([https://mosaicscience.com](https://mosaicscience.com)) and Quanta ([https://www.quantamagazine.org](https://www.quantamagazine.org))?

Both are excellent and sustainable (they pay their authors).</comment>


Q&A about Fingerprint Scanning - <AUTHOR> http://tidbits.com/article/14089

<comment><USER2> Apple Gives Security The Finger, by David Sirota

[https://www.nsfwcorp.com/dispatch/security-the- finger/652da9...](https://www.nsfwcorp.com/dispatch/security-the- finger/652da91b5e2de53ed94dd919d73cee363afbe643/#unlock)</comment>


OpenSSH: client bug CVE-2016-0777 - <AUTHOR> http://undeadly.org/cgi?action=article&sid=20160114142733 <comment><USER2> Use the workaround immediately and patch ASAP, both on your workstation and across your infrastructure where SSH is used, which can be in surprising places.

SSH is designed so that, even if you connect to an evil host, the host only learns your public key, not your private key. This leaks your _private_ key to an evil host. You might think "I only SSH into boxes that I own, so I'm good, right?", but if you in the future lose a box to the enemy, they can then use that box to grab your private key, and then use that key to get into _every other box you can access with that keypair._

This turns your sysadmin's photo blog hosted on Digital Ocean into a potential vector into your entire infrastructure, since there is a high likelihood they use the same private key for both.

If you were to mandate a key rotation across all employees and mandate all employees use a keypair prepared for work and no other purpose I would rate those mandates as not being excessive.

You should expect adversaries to add an exploit for this to their rootkits. That would be bad enough since attackers targeting your infrastructure may exist, but this is also plausibly exploitable in a spray-and-pray fashion. Root any server on the Internet, using e.g. a WordPress vulnerability. Install key-stealing malicious SSH server. Forward all keys to your C&C infrastructure. Your infra does a reverse lookup from public key to Github account (trivial -- try "ssh whoami.filippo.io" if you don't believe me) and immediately optimistically tries to use the stolen key to log into the web tier of any site listed in their email/bio/Twitter profile/etc, pinging the attacker when it succeeds.

<comment><AUTHOR> This may be a start:

      Host *
      IdentityFile ~/.ssh/%h

_Comment:_ One key per host, named after the host you connect to

<comment><USER3> You also need to set

        IdentitiesOnly yes

if I remember the config setting correct. Note however that this only limits the offered keys during the authentication phase. If you use AgentForwarding, this still has the entire keyring available afterwards.

<comment> semi-extrinsic Does anyone know how this interacts with ProxyCommand? If I fix this in ~/.ssh/config on my laptop, and I ssh to hostB through hostA using

      Host hostB
        ...
        ProxyCommand ssh hostA -W %h:%p

in the config on my laptop, do I also need to fix it on hostA?

<comment><USER4> CVE-2016-0777 doesn't interact with ProxyCommand in any special way. That said, after connecting to hostB with your example config above you will have 2 ssh sessions:

1) from your client to hostA

2) from your client to hostB

So to answer your question - no, vulnerable client on hostA is not a problem (or at least not in this particular use-case).

<comment> semi-extrinsic > Vulnerable client on hostA is not a problem.

Ok, that's what I was wondering. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER5> Does it strike anyone else as bizarre / poor form for an experimental feature to be enabled by default in OpenSSH, which is normally very conservative with option defaults?

<comment><USER6> It just sounds like a big code-base fuckup. They more or less admit it: "Server side was disabled/gutted for years already, but this aspect was surprisingly forgotten."

Sounds like this was put in at one time, forgotten about, and the code lingered for a long time until someone pointed it out. SSH as a protocol is pretty crazy. Everyone loves it, but its a lot of things in one, which ironically goes against the unix philosophy. Its a remote terminal, a file transfer server, a network tunnel server, a socks server, etc. There's a lot of stuff in there and I imagine difficult to work with sometimes.

No word if this is enabled in Putty, but I imagine it is if its using openssh libraries.

<comment><USER7> Pretty sure this is OpenSSH only. PuTTY and SecureCRT, at least, are reported not to be affected.

<comment><USER8> We use WinSCP also, a file copying utility; it would be useful to know whether that's affected if anybody has that info.

<comment><USER9> Last time I looked WinSCP used PuTTY components or a fork. Would appreciate additional verification of this, though.

</comment></comment></comment></comment></comment><comment><USER10> Someone tweeted this, the roaming code doesn't seem to be very well managed: [https://twitter.com/marver/status/687644904575627264](https://twitter.com/marver/status/687644904575627264)

Edit 1: Here's some relevant commits too [https://marc.info/?l=openbsd- cvs&m=145278217421101&w=2](https://marc.info/?l=openbsd- cvs&m=145278217421101&w=2)

Edit 2: This mailing list post seems to discuss the vulnerable feature [http://www.gossamer- threads.com/lists/openssh/dev/49018?do=p...](http://www.gossamer- threads.com/lists/openssh/dev/49018?do=post_view_threaded#49018)

Edit 3: Got a better description of actual impact of the bugs:

>Experimental roaming code in the ssh client could be tricked by a hostile sshd

>server, potentially leaking key material. CVE-2016-077 and CVE-0216-078.

>Prevent this problem immediately by adding the line "UseRoaming no" to

>/etc/ssh/ssh_config.

<comment><USER11> So the real question is, can a MITM intercept connections to boxen you frequent to exploit this? Or is it limited to connecting to hostile honeypots?

<comment><USER12> Apparently not possible with MITM.

"The authentication of the server host key prevents exploitation by a man-in- the-middle, so this information leak is restricted to connections to malicious or compromised servers."

[https://lists.mindrot.org/pipermail/openssh-unix- dev/2016-Ja...](https://lists.mindrot.org/pipermail/openssh-unix- dev/2016-January/034680.html)

<comment><USER11> ... and those that you haven't established TOFU with yet

</comment></comment></comment></comment><comment><USER7> Workaround (yes, it's client-side):

      # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config

Disclaimer: won't work on all operating systems, shells, etc. YMMV. Consult a doctor before following any advice you get from the Internet. Void where prohibited. Restrictions may apply.

 _Edited per comments below_

<comment><USER13> Presumably you would have to connect to a malicious host to be effected? Or perhaps a MITM on your connection to a legit host can exploit you somehow.

<comment><USER14> From the updated OP:

> The authentication of the server host key prevents exploitation by a man-in- > the-middle, so this information leak is restricted to connections to > malicious or compromised servers.

<comment> jon-wood Malicious, compromised, or new servers. Because really, how many people check the host key for a newly spun up EC2 instance?

</comment></comment></comment></comment><comment><USER15> If you have a mac (Yosemite), it looks like you want to add " UseRoaming no" under the "Host *" line in /etc/ssh_config (as root). You can test it before and after with this:

ssh -v -T firstname.lastname@example.com 2>&1 | grep Roaming

debug1: Roaming not allowed by server <\- bad

ssh -v -T firstname.lastname@example.com 2>&1 | grep Roaming

(no output is good)

<comment><USER16> On El Capitan the file is /etc/ssh/ssh_config

<comment><USER17> On Mountain Lion it's /private/etc/ssh_config.

<comment><USER18> /etc points to /private/etc on OS X, so it's all good.

</comment></comment></comment></comment><comment><USER19> Testing the ssh client config workaround:

       ssh -v user@localhost 2>&1 >/dev/null | grep -i 'roaming'

returns "debug1: Roaming not allowed by server" when vulnerable, and nothing when not. YMMV, only tested on a few machines, etc.

<comment><USER20> does this require a ssh server running on localhost?

<comment><USER21> Yes, that command is connecting to an ssh server on localhost, but you could connect to any ssh server that you trust...

      ssh -v -T email@example.com 2>&1 | grep -i 'roaming'

</comment></comment></comment><comment><USER22> Since this is a client side issue, can this be used to exploit those automated scanners who try to break into your SSH machine?

<comment> Stefan-H Authenticated scanners that use key auth like Qualys' security appliances could have private keys that are valid across the organization, and if using an affected client version, could leak this information to a malicious system on your network.

</comment></comment><comment><USER23> Release is here, with many more details, and other security issues fixed: [https://lists.mindrot.org/pipermail/openssh-unix- dev/2016-Ja...](https://lists.mindrot.org/pipermail/openssh-unix- dev/2016-January/034680.html)

</comment><comment><USER24> Details: [http://www.openwall.com/lists/oss- security/2016/01/14/7](http://www.openwall.com/lists/oss- security/2016/01/14/7)

</comment><comment><USER4> Does anybody else find this eerily reminiscent of heartbleed?

Obscure broken feature that nobody uses (or needs) is enabled by default and allow private keys to leak.

<comment><USER25> It is OpenSSH, the clown car of bugs in obscure features nobody uses.

Does anybody know if LibraSSL has released an SSH client yet? I can't code well enough to make security code safe, so I won't be able to help them out on it, but it sounds more and more like OpenSSH can't either.

<comment><USER26> You seem confused. The LibreSSL people released a SSH client years ago, called OpenSSH. Which is not the same as OpenSSL, which suffered Heartbleed.

<comment><USER27> I can't blame him, considering that people have been encouraging this sort of attitude towards the OpenSSL maintainers. It's time they tasted their own medicine.

</comment></comment></comment></comment><comment><USER28> My hardened ~/.ssh/config on OS X 10.11:

      Host *
        Ciphers firstname.lastname@example.com,firstname.lastname@example.com,firstname.lastname@example.com,aes256-ctr
        MACs email@example.com,firstname.lastname@example.com,hmac-sha2-512,hmac-sha2-256
        KexAlgorithms firstname.lastname@example.com,diffie-hellman-group-exchange-sha256
        HostKeyAlgorithms ssh-ed25519,ssh-rsa
        ChallengeResponseAuthentication no
        UseRoaming no

If you only connect to newer servers you can further restrict ciphers to only use AEADs (only list the chacha20-poly1305 and aes-gcm ciphers). I assume using AEADs-only makes the MACs keyword obsolete, is this correct?

Config is based on tips from [https://stribika.github.io/2015/01/04/secure- secure-shell.ht...](https://stribika.github.io/2015/01/04/secure-secure- shell.html)

<comment><USER29> > I assume using AEADs-only makes the MACs keyword obsolete, is this correct?

Correct. You can test this by running SSH with -v/\--verbose and observing these log lines:

        debug1: kex: server->client firstname.lastname@example.com <implicit> none
        debug1: kex: client->server email@example.com <implicit> none

When using a cipher that does not support AEAD, the 2nd field will include the MAC instead of <implicit>

        debug1: kex: server->client aes256-ctr email@example.com none
        debug1: kex: client->server aes256-ctr email@example.com none

I wasn't sure what the 3rd "none" field is, but after some digging it appears to be the compression algorithm: [https://github.com/openssh/openssh- portable/blob/master/kex....](https://github.com/openssh/openssh- portable/blob/master/kex.c#L818)

And I confirmed this with ssh -C:

        debug1: kex: server->client aes256-ctr email@example.com email@example.com
        debug1: kex: client->server aes256-ctr firstname.lastname@example.com firstname.lastname@example.com

</comment></comment><comment><USER30> Having been through some difficult times when i had been let down by everyone around me, i came across Brandon Reid who is a hacker its actually impossible to put in words how much of a Genius he is and also cant stop thanking him for helping me through my divorce, and also my Nephews grades. He is a Blackhat hacker and very capable of almost and everything, he is actually one of the best out there and also shows you proof before charging you, in my own case the money wasnt the problem and i can gladly say every money spent was so worth it. I have reffered a number of people who will prefer not to be named to Brandon and all have been immensly satisfied with the Top Notch hacking service Brandon offers.To whoever who is lucky enough to read this its a new year and i am only doing this for those genuine people out there who would want the services of a hacker please as i said before be careful how you speak to him his a BigFish. He can be contacted on his services email email@example.com or text +1 813 379 2141 . Do mention the name Jade

</comment><comment><USER23> Roaming feature has been in OpennSSH code for a while, but is undocumented: [http://superuser.com/a/826734/47771](http://superuser.com/a/826734/47771)

<comment><USER10> AFAIK the roaming feature has been disabled on the server side for a while, but mistakenly left enabled on the client.

<comment><USER12> Seems correct: [https://marc.info/?l=openbsd- cvs&m=145278217421101&w=2](https://marc.info/?l=openbsd- cvs&m=145278217421101&w=2)

</comment></comment></comment><comment><USER31> How does a client bug end up leaking private key material to the server if the private key is in an entirely different process (the agent)? Or is this only an issue if you are loading your identity directly in the client?

<comment><USER32> I would love to hear from someone who knows the answer to this. Does this affect ssh-agent? I am rotating my keys regardless, but I am curious.

<comment><USER33> According to: [https://news.ycombinator.com/item?id=10902833](https://news.ycombinator.com/item?id=10902833) it does not:

> Finally, for these three reasons, passphrase-encrypted SSH keys are leaked > in their encrypted form, but an attacker may attempt to crack the passphrase > offline. On the other hand, SSH keys that are available only through an > authentication agent are never leaked, in any form.

</comment></comment></comment><comment><USER34> So, if there was forgotten code in OpenSSH (which, how the fuck does that happen?), where else might there be forgotten code?

Also: this is a really great example of why you should _never have undocumented features in your code_.

</comment><comment> ygjb-dupe While the bug doesn't expose a user to mitm attacks in general, am I correct in thinking that folks using "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" have basically opened the door for that?

[https://github.com/search?q=-o+UserKnownHostsFile%3D%2Fdev%2...](https://github.com/search?q=-o+UserKnownHostsFile%3D%2Fdev%2Fnull&type=Code&utf8=%E2%9C%93)

<comment><USER35> Ughhh, that's insane.

<comment><USER36> > Ughhh, that's insane.

Not really. This is for deploy systems which deploy to a trusted environment (for instance through VPN, network security etc.).

<comment><USER37> Even if you are using some kind of prebaked images to deploy, you should be generating individual keys using the SSH PKI features per machine as part of your individual host configurations.

This allows you to verify hosts while having never seen their keys. Just totally shutting off verification is a horrible idea.

<comment><USER36> If someone can actively MITM in your network you have other problems.

<comment><USER37> That argument has been shown to be nonsense for years, it can apply to any mitigation technology or privilege reduction technique. The point is to reduce the amount of harm that can be done, because "just write software without bugs" isn't a solution at all.

<comment><USER36> > That argument has been shown to be nonsense for years, it can apply to any > mitigation technology or privilege reduction technique. The point is to > reduce the amount of harm that can be done, because "just write software > without bugs" isn't a solution at all.

I don't disagree with this, but if you can MITM my traffic then impersonating SSH is the least of my worries. The chance that I will randomly SSH into a machine is pretty small to begin with whereas the deployment tools themselves for instance will push out code changes in regular intervals throughout the cluster. My point is: if you can actively MITM my traffic or anything similar in severity, then there are much more interesting targets than SSH.

</comment></comment></comment></comment></comment></comment></comment><comment><USER38> As far as I know, this will affect any OSX, am I right ?

<comment><USER39> It will affect any OSX that is new enough to have that code in it. Same is true with other OS. For instance, on an older, patched FreeBSD 7.2 system, we see this result:

      /root/.ssh/config: line 1: Bad configuration option: UseRoaming
      /root/.ssh/config: terminating, 1 bad configuration option

... which means that sshd predates the roaming code. I haven't tested, but I'll bet my snow leopard workstation also predates that code.

So ... if that line:

      UseRoaming no

produces no errors when you ssh as that user, then you had the problem and you fixed it. If it produces the error above, you never had the problem in the first place (although with an older sshd like that, you should make sure you're not exposed to other, older vulnerabilities).

<comment><USER39> Ok, an update - snow leopard is indeed too old for this to be relevant. SL with the last and latest software updates still doesn't have the roaming code in sshd and therefore you don't need to fix anything (at least wrt roaming...)

</comment></comment></comment><comment><AUTHOR> The most terrible thing here is that OpenBSD usually does some full disclosure. This is sure going to be a nasty bug.

<comment><USER40> Why is this terrible? In any case, the software is open source so any security fix commit can also be considered as full disclosure.

<comment><USER11> But they didn't disclose the bug yet. The implication is that this bug is /so bad/ that it justified breaking the normal "just disclose it" approach.

</comment></comment></comment><comment><USER41> [http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/010_ss...](http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/010_ssh.patch.sig)

<comment><USER42> Leaking private keys seems to be all the rage these days.

</comment></comment><comment><USER43> I'm curious how typo and bit squatting would come into play here, and if attacks leveraging them could collect private keys at a dangerously high rate before people can patch their clients.

Products like heroku, or the stripe CTF, or other things that come to mind that operate over SSH going rogue a bit scarier. If one were to be compromised it would be a case where mass amounts of private keys could leak. AWS, github, all cloud VPS providers, etc.

Multifactor is relevant as a defense with a vulnerability like this.

</comment><comment><USER44> This wasn't the only feature that was activated without much documentation. MaxSessions has a significant impact on any systems using 2FA (as the default allows bypassing it if you are phished).

Just like unrestricted sudo, people have because accustom to the bad default behavior of MaxSessions being 10 and allowing un-authenticated multiplexing. (meaning, you auth once, and my trojan can use your session without authentication)

</comment><comment><USER45> For the single other ChromeOS user (how many of us are there?), note your SSH client is also based on OpenSSH. Add '-o UseRoaming=no' to your arguments.

Watch this repo for updates (or submit a PR?) [https://chromium.googlesource.com/chromiumos/platform/assets...](https://chromium.googlesource.com/chromiumos/platform/assets/+log/master/chromeapps/ssh_client)

</comment><comment><USER46> This is a surprisingly bad fail. I've never seen or heard of this option before. In fact, my vimlint for ssh_config doesn't even show it as a valid option!

</comment><comment><USER47> Check me on this, so this is a client-side problem only, so ssh-ing into only know servers shouldn't be an issue and clients cannot cause problems for servers?

<comment><USER48> If an enemy takes control of just one of the hosts you ssh into, he will get your private key and can use it to ssh into any other box where you use RSAAuthentication.

<comment><USER47> I already added the mitigation, but I wondering if my servers can be patched on the weekend.

<comment><USER49> There is nothing to patch on the server side. You need to ensure the ssh client is updated on the machines you are sshing from.

<comment><USER47> ok thanks, that's what I figured, but it I was getting a bit worried that I was missing something.

</comment></comment></comment></comment></comment><comment><USER50> Some good news was added to the updates:

> The agent will never send a private key over its request channel. Instead, > operations that require a private key will be performed by the agent, and > the result will be returned to the requester. This way, private keys are not > exposed to clients using the agent.

</comment><comment><USER7> _ETA: I was way off... you can ignore this..._ :-)

cf. section 3.3.5 [0], which describes "Roaming (Suspend/Resume)". This is documentation for an application by a company called AppGate (later acquired by Cryptzone) that wrote {some|most} of the code in OpenSSH's "roaming_client.c".

This gives a hint of what the ramifications may be: basically, a MITM, who observed the initial session negotiation, can disconnect the client and hijack an active session.

> _Roaming is a feature which allows clients to suspend the connection to the > AppGate server and later to resume it again. The user does not need to re- > authenticate when reconnecting. Indeed, the entire process can be completely > automated and nearly invisible to the user. All established connections will > remain alive while roaming. This feature is intended for mobile users who > move around between networks._

> _Technically, roaming is accomplished by closing the TCP tunnel when the > connection is suspended. When resuming, a new TCP connection is made to the > server and the SSH data stream is continued through this new connection. The > user does not need to authenticate again, instead the client authenticates > to the server, without user interaction, with the help of a random password > which was made up when the user authenticated at the start of the session. > In addition to knowing this password, the client must also know the > encryption keys and encryption state to be able to reconnect. It is > therefore impossible for a third party to break in and take over a suspended > session._

I particularly like that last sentence.

[0]: [http://download.cryptzone.com/files/download/AppGate-10.2.3/...](http://download.cryptzone.com/files/download/AppGate-10.2.3/doc/manual_chunked_html/ch03s03.html)

<comment><USER10> That's not correct though, MITM cannot exploit this. A malicious SSH server can exploit this during a connection though, but only after host key verification.

</comment></comment><comment><USER51> Could we say it partially because of mono-culture? Almost no one uses GNU lsh as a client/server, dropbear is mostly used as a embedded system sshd. OpenSSH has to many thing integrated and enabled by default.

</comment><comment><USER52> CentOS/RHEL 6.7 has:

      $ ssh -V
      OpenSSH_5.3p1 OpenSSL 1.0.1e-fips 11 Feb 2013

So... not vulnerable? Posted article says: _This affects OpenSSH versions 5.4 through 7.1._

</comment><comment><USER53> Does this affect mosh?

<comment><USER42> No, the roaming in Mosh is unrelated to OpenSSH's roaming feature.

<comment><USER54> But authentication in Mosh still relies on OpenSSH, so auth could be intercepted by an attacker after which Mosh is completely open to them:

[https://mosh.mit.edu/](https://mosh.mit.edu/)

> However, in typical usage, Mosh relies on SSH to exchange keys at the > beginning of a session, so Mosh will inherit the weaknesses of SSH—at least > insofar as they affect the brief SSH session that is used to set up a long- > running Mosh session.

</comment></comment></comment><comment><USER55> Is there an explanation of why the roaming feature was removed from the server? It sounds like a useful feature to me and I run into this all the time.

</comment><comment><USER56> For shells where echo is a builtin that does not know about -e:

printf 'Host *\nUseRoaming no\n' >> /etc/ssh/ssh_config

</comment><comment><USER57> Am I correct that YubiKey users are unaffected by this vulnerability? As I understand it, the private key never enters into memory.

<comment><USER58> I guess it depends on what you mean? I have yubikey 2FA on my servers for SSH, but also have SSH keys. I use SSH keys when I can, and yubikey when I don't have my SSH keys handy.

I suppose if you're doing yubikey+password auth and don't have _any_ keys configured for your ssh client you're fine because... you don't have any keys? :)

<comment><USER59> You can use a Yubikey _NEO_ to handle key authentication on your computer's behalf:

[https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey- NEO](https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO)

<comment><USER58> Sure, but this capability isn't unique to Yubikey. The question was just worded confusingly. Really it's just "ssh key on a smart card".

<comment><USER57> Yes, my bad on the wording of the original question.

</comment></comment></comment></comment></comment><comment><USER60> Does it affect RHEL 6, using openssh 5.3?

</comment><comment><USER61> Is there an easy way to verify that the workaround is effective? ssh -v doesn't display anything related.

<comment><USER62> ssh SOMEHOST -v 2>&1 1>/dev/null | grep -i roaming

A vulnerable client will show:

debug1: Roaming not allowed by server

</comment></comment><comment><USER63> So how does the exploit actually work? How can a malicious sshd actually use this to acquire the private key?

<comment><USER64> Yet another direct-link post to a cryptic CVE for those of us who aren't in the know on security issues. Upvoting is a great shibboleth to show that some posters "get it", while the rest of us are left in the dark on severity, left to wade through the comments section to try to get a sense of what the real impact is.

From what I can tell, if I accidentally SSH to the wrong server (or a compromised one), my private key can be obtained. I have no clue if that's actually the correct interpretation.

<comment><USER65> Oh, come on. The issue is very clear. Your interpretation is correct.

</comment></comment></comment><comment><USER66> Note: this actually means that everyone should regenerate all their key-pairs after updating.

</comment><comment><USER67> Patch for OS X: echo -e 'Host *\nUseRoaming no' >> ~/.ssh/config

</comment><comment><USER68> What was this experimental / undocumented roaming feature even suppose to do?

<comment><USER69> Complete guess: handle changes of ip address on the client side.

<comment><USER7> Allow a mobile user to reconnect to a disconnected session without (user) re- authentication.

</comment></comment></comment><comment><USER70> After edit config file , Do we need to rotated/genrate ssh keys also?

</comment><comment><USER70> After adding in config, Do we need to rota/generate ssh keys also ?

</comment><comment><USER65> So has anyone run git-blame yet? Who did this?

</comment><comment><USER71> theo must be mad.

Shaming people for leaving useless non essential feature in their code that results in security breach.

And now the jewel of his crown has been compromised.

The funniest part is now that his jewel has been tarnished, maybe people will understand what he was saying.

And maybe too, people that believed privacy can be achieved on the internet will finally look at the problem of believing the 2 general paradox can be solved without at least 2 different constant link on different plans. And the problem is belief is a poor substitute for thinking - critical thinking.

And maybe people will discover the sad truth of the internet.

Security requires a perfect world, where human beings neither makes mistakes nor are corruptible.

Errare humanum est, perseverare diabolicum

Oh! Some says that is what 2 factor authentication is.

I will answer, my intuition is telling me that 2 factor is good for a fixed amount of time/information and that using it correctly would annoy people to the utmost points.

Then people would say well let's accept that fraud exists. Business first. (costs/benefits)

Then I say giving 3% of all e-commerce to the bad guys is like admitting organized crime have a strong budget for even more crime ... and that we are fucked.

Unless you don't understand that ISIS is basically a startup. A startup that overthrow a state to make even more money and industrialize crime.

<comment><USER72> What Theo (and other OpenBSD developers) have been saying all these years is that it's impossible to /not/ make mistakes, which is why sane design and exploit mitigations are important.

Mad ? Maybe, I wouldn't know. On the other hand, I bet he's really glad all that effort to have ASLR by default was made, because it makes it more difficult for an attacker to exploit vulnerabilites such as this one.

<comment><USER71> ASLR makes exploits more difficult as long as you have true randomness. It is just a mitigation ... for another problem.

In this case the elephant in the room is stack injection and dynamic libraries. If processes where confined to a well known address space that was self contained ASLR would be useless.. But dependency management would be hellish.

Back to the case. OpenSSH has been openly criticize by 9plan teams for exactly the same reason openSSL has been criticized by openSSH team : too much complexity (not to say plan9 came to anything usable and were right (2 wrongs do not make a right)).

[http://harmful.cat-v.org/software/ssh](http://harmful.cat-v.org/software/ssh)

I do have a feeling as a physicist that the S in CS stands for Shortness of thinking. What is obscure is not profound.

And, at the opposite of engineers I don't believe that security is achievable at all on computers. It is like believing there exists a way to avoid triangulation with one strong radio source.

Computers leak to much information (especially in the physical world), and C is a map that is taken too much for the territory. Every bugs are exploiting a wrong mapping of concepts to implementation.

Modern security is like string theory, admired by everyone because it requires great technical knowledge to master, understood by none because it is way to complex for our "human" brains. We live in an era of belief in solutions.

A bit of critical thinking and of distrusts of experts and stuff that you cannot understand without devoting your life to a subject is at my opinion a must.

I distrust mathematicians for their capacity of dealing with the real world and its uncertainties, and cryptography (as much as functional programming, big data, algorithmic, IA, machine learning) is math driven in a pure Aristotelian world. Where perfection and harmony is the pillar of thinking.

I come from micro-electronics, I only see wires (that are antennas), oscillators, multiplexers, gates and basically a dumb automat I can automatize in respect to time of propagation of signal, and I know that modern computers under the hood are in the physical realm of relativity with approximate answers.

I theorize, build, measure, and retheorize ad nauseum until the product is measured to work the way I expect it to in the domain of validity with a good enough confidence and margins of errors are always on my mind to be controled.

Security requires a zero margin of ambiguity. Physical world is bound to heisenberg equation and coupling. Purity does not exist and this cannot be mitigated. The postulate of cryptography are wrong from the core. Real world always win at the end.

Aristotle way of thinking must die. Math is not science.

<comment><USER73> What in the hell are you on about?

<comment><USER71> The base of science : critical thinking as opposed to expertise and "commonly accepted wisdom".

Trust, but check.

And if cannot check, I cannot trust.

Their map (model) is very nice, very detailed and self consistent. But is is not the territory (implementation) and the more complexity we stack the greater we prove the map diverge from the territory. And also the less it can be audited.

Don't expect normal people to trust what they cannot check. It is faith security experts are expecting from users, not trust.

I do my part of the contract as stated by common accepted risk management "best practice" regarding computer security.

I do not trust blindly.

</comment></comment></comment></comment></comment><comment><USER74> If it's not obvious, don't just add that config option, you have to also restart it.

Actually wait, is this only affecting the ssh client and not the server/daemon ?

<comment><USER7> Yes, it's client-side only. Server-side, it's disabled (cf. readconf.c).

</comment></comment><comment><USER75> We went to other way and kissed SSH goodbye a long time ago in favor of immutable infrastructure and automation: [https://boxfuse.com/blog/no- ssh](https://boxfuse.com/blog/no-ssh)

<comment><USER58> you've never had to debug anything in production, have you?

<comment><USER75> It's not 2006 anymore. For the vast majority of the cases there is no need for SSH when it comes to logging, profiling and debugging.

</comment></comment></comment><comment><USER76> Just a note: the default AWS Linux AMI doesn't seem to have this problem on the server side. Connecting to one of my EC2 instances with verbose on I get the following message:

      debug1: Roaming not allowed by server

Yeah! AWS Linux for the win. :)

<comment><USER77> OpenSSH server doesn't support roaming. This is a client only issue. The problem is that your connection could be MITM'd by someone looking to exploit this bug.

<comment><USER78> > your connection could be MITM'd

MITM isn't a risk, if I understand this statement in the undeadly.org announcement:

       The authentication of the server host key prevents exploitation
       by a man-in-the-middle, so this information leak is restricted
       to connections to malicious or compromised servers.

<comment><USER11> Unless it's your first connection to a legit uncompromised server, yes? (AWS instance, etc)</comment></comment></comment></comment>


Bayes Theorem: A Framework for Critical Thinking - <AUTHOR> https://neilkakkar.com/Bayes-Theorem-Framework-for-Critical-Thinking.html <comment><USER2> The problem I leap to is that this article seems to suggest that our thinking process is Bayesian. That is unlikely.

We update our beliefs based on new information, but the whole point of Bayesinaism via Bayes Theorem is updating it by a very specific amount based on evidence strength. Nobody is approximately Baysian in their thought process, and I doubt most people can even be trained to be. Statistics is a pen & paper exercise for the most part.

In my experience, which is not negligible, is the hardest part of statistics is talking people down from beliefs they have settled on because of something that looks like statistical evidence, but in fact is not.

<comment><AUTHOR> Fair point, the beginning section does seem to suggest that. I have a note in the middle explaining this is not the case.

I make the connection to demonstrate that Bayes is not some arcane statistical artifact, but qualitatively in line with intuition, albeit miscalibrated. This opens up avenues to _then_ move towards ideal bayesian-ness.

<comment><USER2> Ah, hey, didn't see you were also the submitter. I enjoyed your writing; it is interesting to run across systems thinkers.

And just to fill up the word count; if you haven't read up on the major statistical paradoxes it is possible you'll enjoy them. [https://en.wikipedia.org/wiki/Category:Statistical_paradoxes](https://en.wikipedia.org/wiki/Category:Statistical_paradoxes) for your attention. If you are playing with stats for the framework then the other half of the fun is delving into the paradoxes; knowing them by heart is a great trick for interpreting evidence. Simpson's, Berkson's and the Elevator Paradox explain a lot of life.

<comment><AUTHOR> Ah, yes indeed! Thank you.

I really enjoyed this explanation of Simpson's Paradox: [http://michaelnielsen.org/reinventing_explanation/](http://michaelnielsen.org/reinventing_explanation/)

<comment><USER3> A better, more satisfying explanation for Simpson's Paradox comes from Pearl et al.'s work in modern causation theory, in which they point out that the paradox exists only because we fail to consider the causal structure that generated the apparently paradoxical data. If we take that structure into account and are clear about the causal question we are trying to answer, the paradox disappears. For a recent example involving COVID-19, check out this blog post:

[http://causality.cs.ucla.edu/blog/index.php/2020/07/06/race-...](http://causality.cs.ucla.edu/blog/index.php/2020/07/06/race- covid-mortality-and-simpsons-paradox-by-dana-mackenzie/)

<comment><USER4> Hi Tom I used to enjoy your blog a lot and your posts on G+ pray continue blogging.

</comment></comment></comment></comment></comment></comment><comment><USER5> Controversial opinion: Bayes Theorem is overrated. In real life usually we have no idea about priors, and we have close to zero chance to get any good estimate of the true probability of something. But we can still get by fine for the most part, by focusing on limiting possible loss and staying on the safe side with large margins.

Many of the claimed cognitive biases go away under this view. One textbook example of Bayes theorem is how doctors overestimate the probability of being positive for a disease. But what are the priors? Maybe those who visit the doctor did something risky the day before or are feeling funny. Maybe the cost of false positive is negligible compared to the cost of a false negative, etc. People are less stupid than what the TED talk crowd claims.

<comment><USER6> It is an advantage that priors must be explicitly chosen.

There is always a prior. The question is how aware you are of it.

<comment><USER7> How is explicating the prior an advantage? If the prior is arbitrary anyways you could also stick to your unknown prejudice. This shouldn't change any results and if it does you are in trouble anyways, no matter if you explicitly state your prejudice. I'm still suspecting that Bayesian statistics is just kind of a hack to make results look more convincing.

<comment><USER8> > If the prior is arbitrary anyways you could also stick to your unknown > prejudice

One way to think about a prior is to make your prejudices transparent rather than unknown.

<comment><USER7> But, this might be negative, because you can't consciously tweak an unknown prejudice. But, you can tweak a prior until your results support your hypothesis. In that sense, Baysian statistics might be more transparent, but less honest.

<comment><USER8> Bayesian approaches are more transparent regardless of them being "honest" or not.

<comment><USER7> True, but the question is if transparency is desirable. I would say it is dangerous for three reasons. First, you might be tempted to tweak your prior until your posterior confirms your hypothesis. Second, using Bayesian reasoning, you make it seem that the first procedure is justified. And third, if everyone does the tweaking for example within in a scientific community, nobody would complain, since everyone automatically would confirm their hypothesis with higher posterior probability.

<comment><USER4> I might be tempted to walk to dangerous places, lets avoid walking, I would say it is dangerous because it can be abused.

<comment><USER7> I didn't say that you should avoid Bayesian statistics.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Others have already raised this point... but let me try to reiterate. The problem of getting priors is not just one of "acquiring more information". In many cases it's not even clear what such a probability means. For example, you believe that Trump is the 45th POTUS...and you assign it a prior of 0.8...what does the probability mean in this case? In the case of rolling dice it's clear what each probabilities mean, but not in this case. And in any case, how much should you update your probabilities for any given piece of prior? All of these questions (how to assign priors, how much to update them etc.) are the _crux_ of Bayesianism and Bayesianism itself has little to say about it. The founders of Bayesianism itself were aware of these issues. For a more substantive critique read the following.

[https://www.jstor.org/stable/20079192?seq=1](https://www.jstor.org/stable/20079192?seq=1)

Bayes is a good _tool_ but to me it's a very small one and it doesn't and _cannot_ do most of the heavy lifting of how to live my life. Suppose I want to decide what I should do next week, Bayes is close to useless for that. And that is certainly something "critical thinking" should help me with.

Keywords to search for "small worlds vs large worlds Bayes"

<comment> john-shaffer The book "Probability Theory" by E.T. Jaynes is absolutely amazing at explaining how to actually think about Bayesian probabilities, how to assign priors, and the implications of different priors and posteriors. He explains it far better than I can, but one of the major points is that the prior becomes increasingly irrelevant with less data. If we have a lot of data, then we can assign just about any reasonable prior and still get accurate results. If we don't have much data, then the prior has a large influence. In this case we can't be as confident in the accuracy of our posterior probability, but we can calculate just how much confidence we can have in it.

Your example is hard to get into because it just doesn't make sense. The probability of Trump being the 45th President is 1. Garbage in, garbage out applies here.

If instead we step back to 2016 and say that we know the next president will be blue or red, then it's reasonable to assign the maximally uninformative prior of 0.5 to each outcome. Each additional piece of information modifies the probability. If we learn that the red candidate has been caught on tape speaking about groping women, we would calculate a new, lower posterior probability. How much lower depends on what we can determine about how much this hurts his election chances. We will get better results if we can estimate this factor accurately. This won't be much of an issue if we have many other pieces of data so that this one piece doesn't have a huge influence, but if this is our only piece of data then its accuracy will have a huge effect on the accuracy of our conclusion. For the sake of example, let's say that we our best information provides us with a posterior probability of 0.25. This posterior will be our prior when the next piece of information comes in (i.e., it's no longer an uninformative prior because it now contains past information).

Now suppose we see on TV that Trump has won the election. We don't have any money riding on the exact percentage, so let's just estimate the probability of the TV report being correct at 0.99. If we plug this in to Bayes' Theorem with our prior of 0.25, we get a new posterior of 0.97. We're not very confident in this posterior because we used an uninformative prior with 2 very weak updates, but if we really care about accuracy then we can seek out more and better data and get a far more accurate posterior. Moreover, we can calculate the confidence we have in the posterior based on the prior and the data.

Now in 2020 when the election can no longer be challenged, we update our posterior again, but it's not very interesting. Bayes' Theorem still applies, but since we know for a certainty who POTUS 45 is, the prior (0.97) factors out. We get a posterior probability of 1. Yet even though we've only used 3 pieces of data, we can calculate our confidence in our posterior as being extremely high since one our data points was so strong.

I don't know how much it can help you decide what to do next week, but if part of that decision involves calculating or reasoning about probabilities, than you absolutely should understand Bayes' Theorem. It's helpful to know how to think about it even if you can't assign exact numbers in the same way that understanding geometric or logarithmic curves is useful.

</comment></comment><comment><USER10> Very interesting topic. Glad the OP took it on. I've unsuccessfully tried to teach non-statisticians to think this way.

Brings to mind the quote attributed to Samuelson and Keynes: "When events change, I change my mind. What do you do?"

<comment><USER11> I agree with this, but to play devil's advocate (and something I have not resolved internally yet):

Assume a model states there is a 99% likelihood something will occur.

Now the data changes, and the likelihood drops to 1%.

Was the original model "correct" insofar that there was a 99% likelihood of something occurring (given the information it had at the time)? Or should it have "priced in" the fact that data may change substantially, and 99% was far too overconfident?

How are we supposed to interpret variability in model estimates? Do we throw up our hands and say "the data changed"? Or do we hold the models somewhat accountable, saying - no, you weren't "right at the time, given your data". If your estimates are changing so strongly, you are wrong. A 99% estimate that drops to 1% is simply, undeniably "unreliable."

In this case, we somewhat care about "model robustness", but how does this extrapolate to situations where the data changing _should in fact_ impact the model substantially?

I suspect the answer necessitates a deeper look into the nature of probability, risk and uncertainty.

<comment><USER12> In general there are rigorous ways to quantify those kinds of model deficiencies. From an informal perspective: if the change in data is small and the change in model output is large, your model is poor (and in particular, possibly overfit).

Formally what you're describing is the bias-variance tradeoff.[1] You can assess this by looking at the conditioning of your model, which measures how sensitive it is to changes.[2] Roughly speaking, the condition number of an estimator (or generally, function) measures how large the change f(x) -> f(y) in the range for the change x -> y in the domain, where x and y are close. That will give you variance. If you try to minimize bias too much, you may overfit your model and it would exhibit high variance in cross validation. If you try to minimize variance, you may fail to capture relations in your underlying data, which would exhibit higher bias.

Practically speaking, for your specific example: if a relatively small change in the sample data resulted in the model adjusting its prediction to 99% from 1%, I would assume your model is severely overfit (I can't quantify exactly how small without more context, but let's agree it's small). From a meta Bayesian perspective, it would take quite a lot of further cross validation for me to drop that belief ;)

_____________________

1\. [https://en.m.wikipedia.org/wiki/Bias–variance_tradeoff](https://en.m.wikipedia.org/wiki/Bias–variance_tradeoff)

2\. [https://mathworld.wolfram.com/ConditionNumber.html](https://mathworld.wolfram.com/ConditionNumber.html)

<comment><USER11> What a great answer. Thank you so much!

</comment></comment></comment></comment><comment><USER13> "It is very important to understand the following point. Probability theory always gives us the estimates that are justified by the information _that was actually used_ in the calculation. Generally, a person who has more relevant information will be able to do a different (more complicated) calculation, leading to better estimates. But of course, this presupposes that the extra information is actually true. If one puts false information into a probability calculation, then the probability theory will give optimal estimates based on false information: these could be very misleading. The onus is always on the user to tell the truth and nothing but the truth; probability theory has no safety device to detect falsehoods."

G. L Bretthorst, "Baysian Spectrum Analysis and Parameter Estimation," Springer-Verlag series 'Lecture Notes in Statistics' # 48, 1988, p30-31.

</comment><comment><USER14> 3Blue1Brown came out with a fantastic explanation of bayes theorem: [https://www.youtube.com/watch?v=HZGCoVF3YvM](https://www.youtube.com/watch?v=HZGCoVF3YvM)

</comment><comment> greyface- Also, very possibly the basis of our neural function [https://en.wikipedia.org/wiki/Bayesian_approaches_to_brain_f...](https://en.wikipedia.org/wiki/Bayesian_approaches_to_brain_function)

</comment><comment><USER15> This article confirmed by prior beliefs, so I like it.

</comment><comment><USER16> I think there is something to be said for when one first discovers Bayes; not least because its often presented like this article as a sort of enlightenment. Perhaps the finest work on the topic is probability theory by Jaynes; if the underpinning of the Bayesian sect was to have a bible that would be it and BDA3 would be its practical counterpart. I say this both owning and having read both and having invested a a lot of time purveying, learning and applying the Bayesian perspective.

What Bayes makes possible, from an applied statistics perspective, is a kind of unification of a large variety of modelling approaches into a single framework _fitted in the same way_ : simple regression yes, but also hierarchical models, mixtures, pooled, partially pooled, hurdle, regularised, horse shoe, and so on. So when you learn Stan or PyMC3 or Nimble or whatever, you're enabled to go forth and make myriad custom models: this is powerful, and it is enough to respect Bayes.

Various results show that lots of other models can in principle be expressed in a Bayesian way given the right prior; hinting in some theoretical sense that Bayes is a universal modelling approach: the panacea you've been looking for young statistician.

However, Bayes has many epistemological problems and for the actually interested reader see here for a summary:

[https://plato.stanford.edu/entries/epistemology- bayesian/](https://plato.stanford.edu/entries/epistemology-bayesian/)

There are thus lots of reasons to believe that we do not think and _should not think_ in a Bayesian way.

For other mind expanding papers consider Andrew Gelman (very prominent Bayesian) and Cosmo Shalizi (of 3 toed sloth fame):

[https://arxiv.org/abs/1006.3868](https://arxiv.org/abs/1006.3868)

and Breiman (of random forest fame):

[https://projecteuclid.org/euclid.ss/1009213726](https://projecteuclid.org/euclid.ss/1009213726)

For those, like myself, that are out there (like Breiman was) trying to actually solve real world problems; you find yourself quickly limited by the Bayesian approach. The data generating process of the real world is totally not obivious MOST of the time but you are forced as a Bayesian to pretend otherwise. As much as I love problems where Bayes does work well; they are fairly few and far between for me.

So as a closing comment; lets not "Bayes all the things", as tempting as it is. It is in many respects the first part of the journey for many avid evangelists and self confessed "how I became a Bayesian" converts, but its not the end all.

<comment><AUTHOR> Author here. I agree with some of your concerns.

From the post:

> The mind doesn't always work like Bayes Theorem prescribes. There's lots of > things Bayes can't explain. Don't try to fit everything you see into Bayes > rule. But wherever beliefs are concerned, it's a good model to use. Find the > best beliefs and calibrate them!

The one concern I'm really interested by, and don't understand, is this:

> There are thus lots of reasons to believe that we do not think and should > not think in a Bayesian way.

Can you give an example that can serve as motivation to read the entire paper linked?

<comment><USER16> See here:

[https://plato.stanford.edu/entries/epistemology- bayesian/](https://plato.stanford.edu/entries/epistemology-bayesian/)

Section 6.2 gives a very concise list of problems.

For further reading have a go at para-consistent logic for more total upheaval of the Jaynesian view of the centrality of predicate logic as the principal language of science (of which Bayes is a probabilistic relaxation according to Jaynes).

</comment></comment></comment><comment><USER17> Bayesians is a textbook example of a sect.

This is just an abstract framework superimposed on some aspects of reality and has nothing to do with its processes.

Let me repeat: a superimposed set of abstractions. Nothing more.

<comment><USER16> I think you're quite right about that which is not to say Bayes can't be very useful but I do agree that it has been elevated to the level of religion.

<comment><USER12> Yeah. Further context, for other readers: it's important to distinguish between Bayesianism the intellectual movement and Bayesian modeling as it exists in the professional and academic statistical community.

There are communities which pick up Bayes Theorem in isolation (i.e. without any other statistical education or knowledge) and apply it to every debate and discussion under the Sun, often pontificating about how rational they're being about "updating their priors." But using Bayes theorem qualitatively instead of quantitatively - and without regard for its pitfalls - often leads to confirmation bias in which someone lends a veneer of rigorous probability to something they already unconsciously believed anyway. It's also sometimes used to dress up pseudoscience with intellectual polish, and it takes work to unpack those errors.

Bayesian probability is not a panacea, and does not displace frequentist probability. The two paradigms are fully compatible (you can move from one to the other via inversion of the estimator function). But they answer different questions, both of which are important. It is also easy to make statistical errors in both paradigms.

<comment><USER16> This.</comment></comment></comment></comment>


SurveyMonkey to Lay Off 100 and Retool Business Product - <AUTHOR> http://recode.net/2016/03/01/surveymonkey-to-lay-off-100-and-retool-business-product/ <comment><USER2> Worked there from 2007-2010, through the sale etc. I had no idea they were up to 750 employees, and can't guess why they've gotten so big. There were 10-15 employees, 2 engineers in 2008 and that company was printing its own money, lots of it. I'm sure revenue is much higher today, but that profit amount isn't a big jump from where the company was headed pre-buyout, on momentum alone. Really have to wonder what they are spending it all on (besides payroll tax).

<comment><USER3> Judging from the article, the cuts were mostly in B2B sales. I could definitely see sales bloating up a SaaS company's headcount very fast. (That's something I'm having to watch out for in my current company.)

<comment><USER4> Correct me if I'm wrong here, but don't B2B sales people pay for themselves (assuming you are smart about LTV modeling, commissions and quotas)?

Or is it more that the capital is more profitably invested in other areas of the business?

<comment><USER5> Sales people are really good about selling themselves, but generally not so great at actually selling the thing you are hiring them to sell.

<comment><USER4> Right, which is why you let them go if they don't hit quota. What they do is the most measurable part of the acquisition funnel. Laying off a large group of them speaks to financial issues/improper planning vs. just regular weeding out if poor performers.

<comment><USER5> Quotas are fine for an enterprise with a decades old sales process that has data to measure. SurveyMonkey was entering a new market and growing the sales force quickly and before they even knew what a reasonable quota was.

You could say that's bad planning, you could also say it's throwing spaghetti at the wall to see which sales person sticks. Data gathering, if you will.

</comment></comment></comment></comment></comment></comment><comment><USER6> I'm honestly kind of surprised SurveyMonkey had over 100 employees to begin with. I always thought of SurveyMonkey as a more fully featured version of something like [http://strawpoll.me/](http://strawpoll.me/) with more analytical features and such. I never would have expected them to be a company of nearly 1000 employees.

<comment><USER7> Totally agree! It seems like many of the other comments here make similar points.

</comment></comment><comment><USER8> Not calling it "SurveyMonkey" would be a good start for a business product.

For me, and when I try to put myself in others' shoes, I find it hard to see how a professional organisation linking to "SurveyMonkey" can do anything but create a negative impression. The product seems good, I'm just surprised the name has lasted this long.

Does the name stick because the brand recognition is stronger than the features -- when compared to competitors? What happens when a name like this has "stuck"?

<comment><USER9> Heh I'm pretty sure we started using a different survey system purely because everyone hated sending out 'surveymonkey' links.

They should call their business side 'engage<something>' or whatever...

<comment><USER10> How about EngageMonkey?

</comment></comment></comment><comment><USER11> _Founded in 1999, SurveyMonkey is valued at $2 billion_

Given the stated revenue of $200M and the recent atmosphere around SaaS multiples, is a 10x valuation realistic here? (I'm not throwing shade - genuine semi-naïve question.)

<comment><USER12> It's high for even for a b2b saas company. I think another consideration that should probably bring SurveyMonkey's down is that they have great competitors.

<comment><USER13> who are their great competitors? would love to find some alternatives

<comment><USER14> typeform

<comment><USER15> Wow, cool to see Typeform being randomly mentioned on HN!

I'm one of the early developers working at Typeform, if you have any questions about it, feel free to ask right here.

</comment></comment></comment></comment></comment><comment><USER16> Recently signed a deal for 210,000 square feet of office space, 4x the size of their University Ave space just a year after they moved in with a $6.6 mil/year lease.

[http://www.bizjournals.com/sanjose/news/2015/08/17/exclusive...](http://www.bizjournals.com/sanjose/news/2015/08/17/exclusive- palo-alto-based-surveymonkey-is-moving.html)

</comment><comment><USER17> _" The cuts amount to about 13 percent of SurveyMonkey's workforce of about 750. The cuts were made primarily among the sales team devoted to SurveyMonkey for Business."_

</comment><comment><USER18> Actually not too surprised. The customer service of SurveyMonkey (and Fluid Survey that they acquired recently) is of D grade now. Getting some rudimentary information about service and internals took years. Now we are looking for other tools as my work publishes few surveys everyday. Their product has not changed in years and seems likes company is confused about the future direction.

</comment><comment><USER19> The thing I find surprising is that they have that many staff and yet the surveys themselves are still so ugly - the visual design has really changed since about 2002 from what I can see

</comment><comment><USER20> I was surprised to see that Google Capital is an investor in SurveyMonkey - Google Consumer Surveys is a direct competitor:

March 2012 - Google launches GCS

January 2013 - Google invests in SurveyMonkey

Is it common for Google to invest in competitors? Why would they do this?

<comment><USER21> Google Ventures (early stage) and Google Capital (late stage) are focused solely on profit, rather than strategic alignment with Google. Google's Corporate Development group is what does investments for alignment and potential acquisition by Google.

</comment></comment><comment><USER22> How can that company have more than 100 employees i don't understand.

<comment><USER23> Very likely a lot of it was support/sales.

When you're working with business clients who are not technical, a lot of support can come in, even if it's just to help onboarding. In a lot of B2B SAAS, the long term value of each customer means it's totally worth having support staff spend a day helping out.

Here it seems like they were trying the B2B SAAS route, and they decided against it, so are firing basically the team on that.

</comment></comment><comment><USER24> I am shocked that A SaaS survey would ever need 100 people never mind having 100 it was able to let go.

</comment><comment><USER25> Does anyone know if this is something Dave Goldberg opposed and has finally gone through?

</comment><comment><USER26> They've discussed moving from Palo Alto to Menlo Park, so the layoff may be related to that.

<comment><USER7> I thought they were moving to San Mateo... [http://www.bizjournals.com/sanjose/news/2015/08/17/exclusive...](http://www.bizjournals.com/sanjose/news/2015/08/17/exclusive- palo-alto-based-surveymonkey-is-moving.html)

</comment></comment><comment><USER27> i've heard there is a lot of "(re)invented here" syndrome in engineering at surveymonkey. if so, that's a shame

</comment><comment><USER28> Oh, god. My sister was literally hired last week...</comment>


Ask HN: What do use to create slides? - <AUTHOR> What is your setup to create slides?<p>Do you use something like KeyNote and then export to PDF, to use in something like speaker deck, or maybe you create a web version from the beginning? <comment><USER2> LaTeX with packages like beamer.

Treating documents as source code for purposes of version control, collaborative review, and separating content implementation units from display units is just too important. In fact, I think this approach to document and word processing should be taught in schools from a young age, to eliminate most of the excuses people have for preferring wysiwyg enterprise tools, like some sort of hyperbolic discounting function when deciding that the short term cost of overcoming the LaTeX learning curve is not worth it in each situation (so that it ends up never being worth it under that inconsistent model of net present value of the "quick and easy" wysiwyg system).

</comment><comment><USER3> I use pdfdeck, a client of the Deck package [1,2]. Samples [3,4]

pdfdeck reads deck markup, and generates the PDF. The markup is created by hand or generated by other programs, for example the dchart [5,6] client.

I tend to avoid templates and work from a blank canvas.

[1] [https://github.com/ajstarks/deck](https://github.com/ajstarks/deck) [2] [https://speakerdeck.com/ajstarks/deck-a-go-package-for- prese...](https://speakerdeck.com/ajstarks/deck-a-go-package-for- presentations) [3] [https://speakerdeck.com/ajstarks/go-for-information- displays](https://speakerdeck.com/ajstarks/go-for-information-displays) [4] [https://speakerdeck.com/ajstarks/a-view-of-design-and- user-e...](https://speakerdeck.com/ajstarks/a-view-of-design-and-user- experience-designing-for-people) [5] [https://github.com/ajstarks/deck/tree/master/cmd/dchart](https://github.com/ajstarks/deck/tree/master/cmd/dchart) [6] [https://speakerdeck.com/ajstarks/dchart-charts-from-deck- mar...](https://speakerdeck.com/ajstarks/dchart-charts-from-deck-markup)

</comment><comment><USER4> Powerpoint.

I had to use google sheets for comercial offers, and I really bate it.

Why?

Latencies.

When you have to submit a proposal in a few hours you need something that reacts very fast.

Having to wait 1/4 second adding an object to a slide is not tolerable for salespeople (or anyone under heavy pressure).

If speed matters, go native.

</comment><comment><USER5> Keynote to PDF is good enough for me, but note that I make slides max 3 times a year. I don't think I have any templates or anything. I've tried Slides.com and it's great as well.

</comment><comment><USER6> It depends upon the context of the presentation. For most professional talks I draft them out on paper and go right to creating them in beamer. If it's something very informal I've used asciidoc+reveal.js for a presentation or two. In my opinion beamer does a great job at building nice slides and it integrates nicely with tables/figures extracted from the source publication written in LaTeX.

</comment><comment><USER7> The last year, I started using [https://gitpitch.com/](https://gitpitch.com/) and I'm very happy. Writing markdown based presentation with code highlight is a big plus, the time that I was investing preparing presentations was reduced a lot, specially when updating the code.

</comment><comment><USER8> To _create_ slides: PowerPoint. And if I'm presenting I bring my MacBook Air and a handful of adapters to mate up to the presentation system.

For sharing: either export to PDF and put them on my blog or upload them to Dropbox or Google Drive and share a link as the in-web viewer is good enough for going over details in the slides that I wish to share.

</comment><comment><USER9> I user hacker slides as a local docker installation. creates pdfs as well and lets me write all the slides in mark down. See here: [https://github.com/msoedov/hacker-slides](https://github.com/msoedov/hacker- slides)

</comment><comment><USER10> switched from Microsoft powerpoint to google slides. it took a little getting used to but its pretty good with the ability to share, comment and auto revisioning

<comment><USER11> I've used Power Point and Keynote before recently switching to Google Slides. It's gone well and there's even a publish mode to embed them on your site. It did take some getting used to, but I'm happy I made the move now.

I'd previously been using Slideshare for the embeds but it has been glitchy for me lately.

</comment></comment><comment><USER12> It depends mostly of my mood ( and laziness ) most of time i just go with google docs, but sometimes, strut.io

</comment><comment><USER13> Libreoffice. Google docs.</comment>


Ask HN: Is this called creativity? - <AUTHOR>

I just read a post :http://mashable.com/2010/11/01/microsoft-wants-you-to-manage-your-gmail-from-your-hotmail/
I often see many idea's are copied from one competitor to another. I can understand if someone copies must have feature in their product but many times these big players like google, oracle, MSFT are just copying things from one another to compete but not delivering creative addons.
If you are an entrepreneur or a member of product management team what would you call this strategy ? <comment><USER2> HN frowns on shortened URLs - [http://mashable.com/2010/11/01/microsoft-wants- you-to-manage...](http://mashable.com/2010/11/01/microsoft-wants-you-to- manage-your-gmail-from-your-hotmail/)

Creativity? No. It is just like any other industry where you have to match the base feature set that people demand and then from there you sale based on your uniqueness (which could be creative add-ons, pricing, or branding).

</comment><comment><USER3> You shouldn't use URL shorteners at HN. People here generally want to see where a link is going before clicking it.

<comment><AUTHOR> sorry for shorten url...</comment></comment>