SSH: Best practices - <AUTHOR> https://blog.0xbadc0de.be/archives/300 <comment><USER3> The article didn't make mention multiplexing and MaxSessions defaults in OpenSSH. The default is 10 which means you auth once, and all subsequent logins are without auth and without syslog entries. If you manage secure systems and have 2FA, this allows bypassing 2FA and logging.

All I have to do is trick your folks into testing a ruby / python / perl / bash script for me that will drop a key on your machine, fire up ssh using that key and tunnel back to my host. Now I have full control of your secure (banking, government, eCommerce) environment, completely bypassing 2 factor authentication. Just one link to one of your email distros and up to 10% of your folks will run it.

Combine this with sudo credential caching and now I have root on all of your systems without having to bother finding vulns.

Thx to Prandium for the demo of this simple social engineering exploit.

<comment><USER4> so... your point is "don't run untrusted code"?

<comment><USER5> You run untrusted code whenever your browser loads a web page that uses javascript. With more and more of the web requiring javascript to work, running untrusted code becomes less and less a real option if you want to get any work done.

Arguably, plain HTML is also untrusted code, and I certainly don't trust every single one of the authors of my operating system and all of the os-level utilities and all the applications that I use, especially not Microsoft or Apple. But I'm forced to use them for work.

A year or two ago there was some hoopla about Canonical collecting some information about Ubuntu's users or something like that (don't remember exactly) and a lot of people were up in arms about how they don't trust Canonical. Canonical's reply was one of the most insightful I've ever read on the internet. They said something like, "um... but we've got root".

That's a great point. The makers of your OS, the builders of your apps, they have a lot of power over you that you grant them simply by using their stuff. You're effectively trusting them, even if you don't trust them.

You could react by not using anything that anyone you don't trust writes, or by thoroughly auditing all the source code of everything you use (you do use only open-source software which can be audited by you directly, right?). But this is not really practical for 99% of everyone on the planet.

<comment><USER6> > They said something like, "um... but we've got root".

Which is incredibly misleading.

Sure, they could put malicious code in their distribution. It could do whatever they want. And then it would be on your machine, where you can potentially discover it and publish what you've discovered and allow others to verify your discovery. Which could cause Canonical to _not_ have root anymore, because people would immediately switch to Debian or CentOS or something else.

But if they _send data_ from your machine to their servers, no one has any ability to determine what they do with it from there, how well they secure it, who they give or sell it to, etc. It's a completely different situation because it goes from trust-but-verify to blind trust.

<comment><USER5> How many Ubuntu users actually verify everything Canonical sends them? I'd say very close to none, especially for the binaries.

Sure, in principle you could verify. You could read through all the source, you could even disassemble the binaries and read through the assembly (and don't forget to verify the hardware too). Again, who actually does that? Virtually no one.

So the two cases are a lot closer than you paint them to be.

Also, corporations do stupid, illegal, and unethical stuff all the time, even when it's clearly (especially in hindsight) not in their long-term interest to do so. Even when it will clearly destroy their reputation if the public found out they even considered it.

Even if you trust "the system" (which is more of a hope that if there's something malicious, someone out there will detect it sooner or later), there are many cases of vulnerabilities in even open source code going undetected for years... nevermind vulnerabilities in binaries that you don't have code for and who the authors of aren't generous enough to clue you in on.

Canonical (or whatever source you actually get your OS or apps from) could also send you some specially crafted something that no one else gets. Now who's going to verify it for you if you don't do it yourself? How are you ever going to find out, if you're not one of the ultra-paranoid and super-skilled 0.001% of Ubuntu users with infinite time and determination who actually verifies 100% of what Canonical sends them? You just won't. And if you did, there'd be a hundred new Ubuntu versions out by the time you finished verifying even one of them.

People trust, but they very rarely verify. The size of operating systems and applications and the skill to verify have all just grown too large to make it practical for the overwhelming majority of people.

I do see your point about Canonical doing whatever they want with the data they collect. That's certainly problematic. But that doesn't mean that there aren't major privacy or security issues with trusting Ubuntu (or any other OS) not to have malware on it.

<comment><USER6> > Virtually no one.

Which is not the same thing as no one. And it only takes once to ruin your reputation forever (see also Sourceforge, Lenovo, etc.) Moreover, the probability of detection doesn't have to be very high at all because the cost to Canonical would be catastrophic, so any possibility whatsoever acts as a deterrent. And more so in this context because of the nature of the user base.

Your argument seems to boil down to the position that it doesn't hurt anything to go from detection not perfect to detection not possible.

</comment></comment></comment></comment></comment></comment><comment><USER7> Developer laptop compromise is probably the biggest security risk that any startup company faces, because the developer laptop is an uncontrolled environment with a lot of "attack surface" which may have been previously compromised.

In my view there are emerging best practices in this area. There are two ways to reduce this risk and both are controversial:

1\. Force developers to only develop software using an SSH terminal (by first connecting to a developer VPN via 2FA and then sshing into their secure development environment where may use tools like tmux, vi, and their programming language of choice to get the job done). In this scheme copying source codes or security credentials to a developer laptop is considered a violation and becomes a fireable offense no questions asked.

2\. Require all developers to run a private USB-bootable linux desktop shell which is known to be clean. In this case they remain free to utilize modern desktop editors and code emulators (such as android simulator). It's even possible to setup secure persistence in these environments so that the developer's browser configuration, network/vpn config, dotfiles, apt installs, etc are stored on an encrypted filesystem on USB device. The reason why a USB image is preferred is because it's annoying to ask a new employee to repartiation her personal harddrive.

My suspicion is that as more of the tools developers need to rely on are cloud-based: (example: github, cloud9, jenkins, etc) we will eventually see these modern best practices against client-side attacks being adopted more broadly. The quality and reliability of hot-bootable ultra secure cloud operating systems has gone thru the roof over the past couple of years and I assume this trend will only accellerate due to the fact that Google Chrome OS continues to penerate more of the market and consumers are getting used to it.

TLDR: ssh keys existing on developer harddrives is an info-sec anti-pattern, they should only ever exist in system memory or in an encrypted partition on a USB stick.

<comment><USER8> (Disclaimer, unicorn employee.) I'm confused. Are you implying people write company code on personally owned laptops? That's insane!

1\. Company walks you through setting up FileVault (with key escrow) and VPN client, generating and uploading SSH public key immediately after unboxing laptop.

2\. OneLogin + Duo (or pick your SSO/2FA scheme) for everything - <USER2> webapps, GMail, etc.

3\. SSH keys managed by Puppet.

4\. 2FA verification of SSH logins (using pam-interactive), through a bastion (provided .ssh file makes it transparent), with OSX's default SSH agent, with pretty much all of those best practices configured except smartcards/certs.

5\. Engineers have SSH access only to utility/development boxes. You can deploy code to production through a webapp (identifying the commit ID) but you can't get a shell as your application's user, and certainly not root.

6\. Webapps moving behind a VPN.

In the rare case that you need to debug in production beyond what you can get from metrics/logs, you pair with a "blessed"/senior sysadmin type.

<comment><USER7> Thank you for this. I suppose I should have included the caveot that my rant applies mostly to early stage shops which are aren't ready to build out and ship a shiny new dev machine for every employee. Another problem for smaller startups is that if you're not careful almost everybody ends up being "blessed". And simply being a senior sysadmin type doesn't mean that you're automatically immune from all forms of social engineering attacks. I suppose your point is that even very early companies should opt for standardized hardware, I think you're right.

I <3 Duo Security.

</comment></comment></comment><comment><USER9> Cached version [https://webcache.googleusercontent.com/search?q=cache:BZ3Zeq...](https://webcache.googleusercontent.com/search?q=cache:BZ3ZeqaqyLAJ:https://blog.0xbadc0de.be/archives/300+&cd=1&hl=de&ct=clnk&gl=de)

<comment><USER10> yeah - the link seems to be hugged to death or something

<comment><USER11> I just noticed this an hour ago. Bad config on the server and too little ram. The link should work better now.

</comment></comment></comment><comment><USER12> The part about gateway hosts says:

      > Host B
      >   ProxyCommand ssh -W B:22 A

That could be improved:

      > Host B
      >   ProxyCommand ssh -W %h:%p A

Then you can use wildcards for B ("Host 10.11.12.*"), and use custom ports ("ssh -p 2222 10.11.12.13").

<comment><USER13> I just read this [https://glandium.org/blog/?p=3631](https://glandium.org/blog/?p=3631)

</comment></comment><comment><USER14> I thought using per-service SSH keys was an useful mitigation against e.g. GitHub public keys being exposed:

\- [https://blog.benjojo.co.uk/post/auditing-github-users- keys](https://blog.benjojo.co.uk/post/auditing-github-users-keys)

\- [http://arstechnica.com/security/2015/06/assume-your- github-a...](http://arstechnica.com/security/2015/06/assume-your-github- account-is-hacked-users-with-weak-crypto-keys-told/)

\- [https://news.ycombinator.com/item?id=9645703](https://news.ycombinator.com/item?id=9645703)

<comment><USER15> Public keys being exposed isn't something I think needs to be mitigated. That's the whole point, they're public.

<comment><USER16> Security is not binary. In this case it depends on whether disclosing your identity to the servers you connect to is a problem in your threat model.

Saying "they are public so it's ok" is technical oversimplification.

<comment><USER17> > Saying "they are public so it's ok" is technical oversimplification.

It's not. The whole idea of the scheme is that you can publish them everywhere with no risk.

<comment><USER18> In case of Bitcoin pubkeys you don't want to publish them anywhere for privacy reasons (that turn into real physical security reasons once you have enough BTC). Also, notice how pubkeys are normally hidden under hashes and revealed only at spending time. This drastically limits attacks on ECC if/when some weakness in curve math is discovered. And if quantum computer is invented tomorrow, people can safely transition funds to a new signature scheme by introducing 2-phase commitments to safely reveal (now crackable) ECDSA pubkey after another transaction was made with commitment to concrete signature (preventing double-spend attempts using a cracked key).

</comment></comment></comment></comment></comment><comment><USER19> Here's a brief guide for setting up SSH with YubiKey as a smartcard which complements this article nicely - [https://github.com/drduh/YubiKey- Guide](https://github.com/drduh/YubiKey-Guide)

<comment><USER17> Looks like I'd need to configure gpg to use it locally first.

One of the main uses of smartcards is to use it on other machines (eg: not mine). What's the added benefit of adding one if I'm logging in from my local machine?

<comment><USER20> For what it's worth, most smartcard applets don't typically store GPG objects but RSA keys (and also usually X.509 certificate objects that go along with them, as well as less-used RSA public key objects).

I use PIV (NIST SP 800-73) compliant smartcards with a PKCS#11 module I wrote (CACKey), it just works with "ssh-add -s /path/to/libcackey.so", then SSH away.

Additionally, there is a fork of OpenSSH called PKIXSSH that adds X.509 certificate support (in addition to the relatively recent, compared to the fork, support for OpenSSH certificates) and then I can authenticate to remote systems using my certificate -- which is helpful when my card is replaced, or if my certificate is revoked the CRLs can be used.

</comment></comment></comment><comment><USER21> Good advice, except the "remove all system passwords" part. Do not do this. It's a really bad idea. There are occasions where you _do_ need to authenticate using a password, most importantly on the local console - what if your server lost network access?

And that sudo workaround is bad since it requires agent key forwarding, which you shouldn't use for the reasons the author himself noted a few paragraphs up.

</comment><comment><USER22> Weird, where I work we're not allowed to use key auth. They claim it's for PCI since they can't enforce that the keys are passworded/encrypted.

<comment><USER23> That's an odd tradeoff. I'm going to have to disagree with the sibling noting that "compliance != security".

Here's the thing: they say they can't enforce users to encrypt passwords (hogwash; you can have a local agent that checks that), but do they check that users are providing good passwords? I have much more faith in a randomly generated key than I do in a human-generated password. The former pretty much _requires_ compromising the machine; the latter I can just take pot-shots at the server with. (They _do_ rate limit your SSH password attempts, right? right?)

Even if we assume that the password is good, and that the server won't allow infinite tries to guess it, the security is only equivalent: compromise of the user's local account will reveal the password (just sniff the password) or the key (just read the keyfile, and sniff the password if it is encrypted). I don't see any world in which a password is _more_ secure than a key.

<comment><USER24> The parent comment is discussing encryption of the private key with a password, not passwords for connecting to the server.

<comment><USER23> The parent is discussing both, and I am too; specifically, the parent says,

> _we 're not allowed to use key auth._

i.e., they're using password based auth.¹ The point of my post is that while certainly users leaving the private key unencrypted isn't good, trading that for password auth leaves you in a worse state overall (IMO).

¹Of course, they could be using an auth scheme that is neither password nor key based. But given that the parent didn't come out and _say_ that, my gut says that's not the case here.

</comment></comment></comment></comment><comment><USER25> I bookmarked something similar: [https://stribika.github.io/2015/01/04/secure- secure-shell.ht...](https://stribika.github.io/2015/01/04/secure-secure- shell.html)

<comment><USER26> The same link is somewhere in this guide, too. This guide has a broader scope, though.

</comment></comment><comment><USER27> Also, move sshd to a random & rarely-used TCP port. Won't help much against a skilled & determined targeted attack, however the "security through obscurity" is not entirely worthless. Using something other than 22 is quite effective at avoiding spray-n-pray scans and exploits.

For extra credit, set up port knocking.

<comment><USER7> Choosing to only bind SSH to a VPN interface is another option. If you can utilize a VPN that incorporates 2FA then that's even better. Projects such as zerotier are going a long way towards making this kind of thing easier to setup.

<comment><USER21> Then the VPN breaks, and you're out of luck.

</comment></comment></comment><comment><USER28> SSH's new AuthenticationMethods directive is extremely useful for pairing SSH keys with a password and/or 2FA. You should absolutely use keys everywhere, and encourage your users to encrypt their keys, but enforcing a password as well ensures that logins are "something you have" (the SSH key) and "something you know" (the password) as a sort of 2FA.

As a cherry on top you can put the password in LDAP or RADIUS server and hook up traditional 2FA (Google Auth, Yubikey, Email, SMS) for that legendary 3FA (ah... "something (else) you have"). Sounds hokey, but defense is best in depth.

<comment><USER29> Something you have plus 2 things you know does not turn 2FA into 3FA. It's still 2FA - it's just somethings you know instead of something you know.

3 FA is :

* Something you have (normally one OR MORE user IDs)

* Something you know (normally the associated password or passwords for the user ID(s))

* Something you are (normally biometric)

[edit: technically, it's multi-factor when using multiple user/passwords - here's a useful link [https://pciguru.wordpress.com/2010/05/01/one-two-and- three-f...](https://pciguru.wordpress.com/2010/05/01/one-two-and-three-factor- authentication/)]

<comment><USER5> I look at biometrics as just another category of of the 2nd factor: things you have.

You have your fingers. You have your eyes.

In fiction and movies, these things that you have which could be taken from you (your fingers severed, your eyes plucked out) and used for getting past biometric scanners.

In real life there are easier, stealthier, and less gruesome methods for getting those things: just copy them. (gummy bear fingerprints, anyone? [1][2][3])

[1] - [http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_f...](http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/)

[2] - [http://www.cryptome.org/gummy.htm](http://www.cryptome.org/gummy.htm)

[3] - [http://www.it.slashdot.org/story/10/10/28/0124242/aussie- kid...](http://www.it.slashdot.org/story/10/10/28/0124242/aussie-kids-foil- finger-scanner-with-gummi-bears)

<comment><USER11> Unfortunately biometrics are near to useless for remote authentication. The only context in which biometrics work is when the whole authentication chain (reader, cable, computer, network) is tamper-proof. When one of these elements can be tampered with (e.g. unplugging the fingerprint reader and sniffing to the USB traffic), it becomes "something you know, that anyone can collect, that you can reproduce with an HD picture, and that you cannot revoke without losing your physical integrity".

I think biometrics may have a place in tamper-proof devices like iphones (infamous error 53) or biometric smartcards (need fingerprint to unlock secrets).

</comment></comment></comment></comment><comment><USER30> Org question. We use a shared key and a shared account to manage our servers. When someone leaves the team we have to regenerate the key for the account. I'm sure it's not recommended, so what's a good way to manage ssh access in a team setting? I'd like avoid sharing the key so that access can be revoked from user without regenerating the key for everyone?

<comment><USER11> Have each team member generate his own key. Copy everyone's key in a folder and have a script to generate an authorized_keys file. Use puppet or chef (or anything else) to dispatch the authorized_keys on every server.

A single shared key is a security disaster waiting to happen.

<comment><USER31> did you read the article? ssh certificates with revokation are a much more workable solution

<comment><USER32> There's the up-front cost of setting them up, and perhaps tool support (pubkey/agent auth is widely supported; X.509...not so much).

<comment><USER31> ssh certificates are not x.509, though they are designed around a PKI.

<comment><USER32> Thanks for the correction.

</comment></comment></comment></comment></comment></comment><comment><USER33> > f=$(mktemp) && ssh-keyscan korell > $f && ssh-keygen -l -f $f && rm $f

> Unfortunately ssh-keygen does not support input from stdin, so this example > is slightly more complicated than it should.

Any shell that supports process substitution can fix this for you with something like;

ssh-keygen -l -f <(ssh-keyscan korell)

</comment><comment><USER34> How about [https://github.com/ccontavalli/ssh- ident](https://github.com/ccontavalli/ssh-ident) ? Is that still a "best practice", since the author doesn't mention it in this blog entry?

<comment><USER11> I didn't know that tool. Having different agents for different projects may be useful, especially if you're using Agent Forwarding.

I don't like that you have to alias ssh or replace /usr/xxx/bin/ssh with a symlink to make it work.

</comment></comment><comment><USER35> Great post!

BTW, you can also now use hardware devices (like TREZOR and KeepKey) to perform "ssh-agent" functionality in hardware, with minimal setup work.

Blog post: [https://medium.com/@satoshilabs/trezor- firmware-1-3-4-enable...](https://medium.com/@satoshilabs/trezor- firmware-1-3-4-enables-ssh-login-86a622d7e609)

Source code: [https://github.com/romanz/trezor- agent](https://github.com/romanz/trezor-agent) (the README has several demo screencasts).

</comment><comment><USER36> I remember reading about a tool Instagram used for SSH management, but that might not be a "best practice". ([http://instagram- engineering.tumblr.com/post/11399488246/sim...](http://instagram- engineering.tumblr.com/post/11399488246/simplifying-ec2-ssh-connections))

</comment><comment><USER37> And yet we still see things like [https://blog.binaryedge.io/2015/11/10/ssh/](https://blog.binaryedge.io/2015/11/10/ssh/)

</comment><comment><USER38> It would be a cool to have a `forward agent connection once` option to ssh. when I know I'd have to `git pull` once on the server but don't need the agent forwarding after that.

</comment><comment><USER39> >Do not SSH cross-server

This doesn't make sense. You can safely setup SSH agent forwarding to ssh from server to server without storing your ssh private key anywhere but your local host.

<comment><USER40> If the server you're forwarding your agent to is compromised it can now talk to your agent. This point could also be 'assume gateway servers are compromised'.

<comment><USER39> If your gateway servers are compromised to this degree you have a much larger problem than your ssh agent being compromised.

</comment></comment></comment><comment><USER41> Has anyone used ProxyCommand to chain through 2 or more gateways and has a config example to show?

<comment><USER42> I had one a long time ago, from before ssh -W, which I updated for the occasion:

Host <asterisk>+<asterisk>

ProxyCommand ssh -W $(echo %h | sed 's/^.<asterisk>+//') $(echo %h | sed 's/+[^+]<asterisk>$//;s/\\([^+%%]<asterisk>\\)%%\\([^+]<asterisk>\\)$/\2 -l \1/;s/:\\([^:+]<asterisk>\\)$/ -p \1/')

Use with:

$ ssh login1%host1:port1+login2%host2:port2+login3%host3:port3+host4:port4 -l login4

[https://glandium.org/blog/?p=3631](https://glandium.org/blog/?p=3631)

Edit: there is apparently no way to escape asterisks, so I replaced them with <asterisk> (hopefully I didn't miss one), but you'd better check out the link.

</comment></comment><comment><USER17> What amazes me about these articles is that they keep recommending NOT to use password-based logins for SSH: Why are people still using that?

<comment><USER32> People are still using _FTP_ , for what it's worth. In other words, the same old: ignorance ("we've always done it like this") and/or apathy ("meh, we're not a cracker target").

</comment></comment><comment><USER43> Still a big fan of the BetterCrypto guide: [https://bettercrypto.org/](https://bettercrypto.org/)

<comment><USER44> I'm not sure what there is to recommend about this Applied Crypto Hardening guide, which seems to be in draft form. The section on SSH is just a couple of snippets from sshd config files with no explanation about the choice of parameters. And copy-pasting config file snippets from a random guide book hardly consistutes security best practice.</comment></comment>


Ask HN: Best resources to start with systems programming? - <AUTHOR> I am a web developer that recently got interested into systems programming through the Rust programming language.
The language seems like a challenge and suits my decision to expand my technical knowledge by tackling a different environment and paradigm.
However, even though I can learn the language, I find it difficult to think of some simple systems programming projecst to practice. In addition to that, whenever I check any Rust-lang repos (i.e. Servo) to potentially contribute there are many alien concepts to me and technical terminology related to low-level programming, making me feel like a beginner.
And so I wonder, are there any books or resources to get used to systems programming (APIs definition, architecture, best practices, tutorials...) to have a better context and knowledge?
Surely there will be aspects common to web development and any kind of programming. However, systems programming seems quite like a different world to me. <comment><USER2> There was a recent tweet from a game developer how to go about learning rust. i have been struggling with rust too. i guess to start anything interesting in rust on should have some what good understanding of lifetime, ownership and how to properly handle data.

from what i have learned. one cannot brute force into rust. 5 months ago i started a project using rust. i thought i will just go over few things it's gonna be fine. turns out i ended up hurting my brain. take your time to learn rust star small.

Link to the tweet: [https://www.reddit.com/r/rust_gamedev/comments/9hikxm/really...](https://www.reddit.com/r/rust_gamedev/comments/9hikxm/really_good_thread_on_learning_rust_from_ready_at/)

<comment><AUTHOR> Thank you for the response!

I am currently reading the "Programming Rust" book. My problem is not on the concepts themselves but on applying them: I am finding it quite hard to think of some small project to apply the learning. In addition to this, my thinking is that systems programming requires a different approach to coding/architecture of applications (because it lies closer to the OS layer than other kinds of apps such as web apps).</comment></comment>


The Earth is round, and other myths, debunked by the flat Earth movement - <AUTHOR> http://www.latimes.com/nation/la-na-colorado-flat-earth-20180115-story.html#nt=oft12aH-2gp2 <comment><USER2> Why does it seem like there's far more effort being spent by non-flat-Earthers discussing flat-Earthers, than there is by flat-Earthers attempting to spread their beliefs?

<comment><USER3> The odds are better for people rejecting the ranting against a Flat Earth than accepting the concept on it's own. So flat-earthers must be Bayesian.</comment></comment>


Ask HN: Why not just quarantine old people and risk groups? - <AUTHOR> I am curious to hear your Corona solutions? My suggestions:
1: Only quarantine old people and risk groups (>65y or pre-conditions of lung/heart). They get free delivery everything.
2: Let others work and spend money, as long as they are not in crowds.
3: World War II style industry mobilisation: Government buys x% of hotel bedrooms and turns them into war hospitals. Increase capacity of life-saving things by factor 100 (eg ventilators, masks).
Meantime:
- Test 1000 random people per region, weekly, to get true death rate - Don't forget negative consequences on health/additional deaths from increased poverty, if economy is hit too hard <comment><USER2> _Everybody_ is in the risk group. (Nobody has any immunity.) Everybody is a carrier/spreader.

Many deaths have been people in the under-65 age groups.

Your system would lead to many thousands of sick people very quickly. That would 'heighten the curve' and overload the health system.

On the other hand, it would lead to a rapid spread of the virus, most people would get it very quickly. Some people would die, yes. The rest would recover and the wave of 'plague' would be over quickly also. It would pretty much be a copy of the progress of the Spanish-Flu pandemic of 1918-1920.</comment>


Google's AMP Poised to Take the Lead from Facebook's and Apple's Walled Gardens - <AUTHOR> http://www.mondaynote.com/2016/01/18/googles-amp-poised-to-take-the-lead-from-facebooks-and-apples-walled-gardens/?utm_source=Sailthru&utm_medium=email&utm_campaign=UK%20Daily%202016-01-19&utm_term=Digiday%20UK%20Newsletter <comment><USER2> (The article said to "try any page from The Guardian with '/amp' to test its performance")

Oh my: [http://tools.pingdom.com/fpt/#!/bniZiH/https://www.theguardi...](http://tools.pingdom.com/fpt/#!/bniZiH/https://www.theguardian.com/world/2016/jan/20/bacha- khan-university-explosions-heard-as-gunmen-attack-pakistan/amp)

"Such mobile performance, wow". 4 megabytes of video(Preloading two different videos. Why?), maybe 10 different domains, downloading JS before downloading images...

And this is the _showcase_ for AMP.

It's almost as if "there is no silver bullet" for web performance, and "actual programming skill" is still a requirement.

There is a difference between AMP and non-AMP, yes: [http://tools.pingdom.com/fpt/#!/bAnV7C/https://www.theguardi...](http://tools.pingdom.com/fpt/#!/bAnV7C/https://www.theguardian.com/world/2016/jan/20/bacha- khan-university-explosions-heard-as-gunmen-attack-pakistan)

But at this point in time, it seems that installing an ad blocker has about the same impact as "conceding to view a crippled AMP-redesign of the page that doesn't even have navigation".

<comment><USER3> Using the same tool, I can see that my website loads in 440ms in the Netherlands. The homepage is 140kb, makes 6 requests, leverages caching and http/2 thanks to nginx etc.

Which is great and everything, but for a reader in Texas, that becomes 1.2s thanks to the fact that my site is hosted in London.

As you point out, AMP pages which weigh in at 4MB can be loaded in a seemingly underwhelming time: ~800ms. However, I think the important takeaway from this is that the pages load in ~800ms in two different continents.

The articles I publish on my blog use AMP-HTML. I don't include media or ads at all, just text and fonts. These pages fully load in 200ms.

I conclude that the free CDN offered by Google is, frankly, a very attractive feature.

<comment><USER4> You can always put Cloudflare in front of a site to get the same CDN benefit.

<comment><USER5> How do you know Cloudflare or other CDNs are participating with advertisers somehow, or responding to government tracking requests?

If the government can subpoena data from Google, are we sure they're not doing the same or more with CDNs, which don't seem as transparent as the consumer- facing companies.

<comment><USER6> Cloudfare publishes a transparency report [https://www.cloudflare.com/transparency/](https://www.cloudflare.com/transparency/), whether you trust it is another thing. Personally I have given up on privacy and now just hope that it can be made so that we are all equally naked.

</comment></comment></comment></comment></comment><comment><USER7> ok, just to get this straight

if a publisher want to do everything right in todays internet, they need

      * a responsive website
      * with views for desktop, mobile and tablet
      * optimized for search, social and conversion
      * optional: augmented with schema.org
      * an iphone app (one or more)
      * an android app
      * optional: tablet/ipad app
      * facebook channel
      * twitter channel
      * youtube channel
      * pinterest presence
      * whatsapp presence
      * snapchat presence
      * one or more newsletter
      * constant A/B testing

now add

      * facebook instant articles
      * google amp pages

did i forget something?

yes page bloat, third party crap and webperformance is a serious issue for users and publishers, but solving it with throwing another half baked technology at the publishers will not work.

it's cHTML all over again [https://en.wikipedia.org/wiki/C-HTML](https://en.wikipedia.org/wiki/C-HTML)

AMP solves the right problem with a non solution.

<comment><USER8> The second point is a restatement of the first:

* a responsive website

* with views for desktop, mobile and tablet

#3 and #4 are similarly redundant

#1 makes all of the apps unnecessary, along with AMP and Facebook Instant. See also the dismal return on the sunk cost for developing apps: [http://techcrunch.com/2015/07/23/i-dont-want-your- app/](http://techcrunch.com/2015/07/23/i-dont-want-your-app/)

The real omission, however, should have been #0: "high-quality content". Sure, you see the NYT, NPR, Guardian, et al. post a lot on Twitter, Facebook, etc. but they were already some of the most popular content on the web and would have been widely shared either way.

<comment><USER9> franze probably intended "responsive" to have its dictionary meaning - "not sluggish".

<comment><USER8> It's possible but in the context of web design "responsive" has had a specialized meaning for many years, going back to a very influential article in 2010 which grouped older practices under that term:

[http://alistapart.com/article/responsive-web- design](http://alistapart.com/article/responsive-web-design)

It's somewhat unlikely that anyone working in front-end development in 2016 would assume the generic usage.

</comment></comment></comment></comment><comment><USER10> Keep in mind that the AMP caching infrastructure will also be able to serve as a tracking platform because it records every single IP address. This effectively grants Google and associates a defacto monopoly in terms of an unblockable mobile tracking platform in a world where ad-blockers are becoming ubiquitous.

I think it's a smart move on their part actually, but what I assume will eventually happen is other providers will come along and provide a similar free infrastructure but without retaining logs and then everyone will migrate to that. Google will have gotten the ball rolling, and benefited for a number of years from the data, but ultimately people on the web prefer not to be tracked.

<comment><USER11>
        but ultimately people on the web prefer not to be tracked.

It's curious because most people on the web pay lip service to this preference but their actions typically indicate that they don't really care all that much. The folks on Hacker News are in the minority of users whose actions indicate they truly care.

<comment><USER12> Nah, I think they don't have the time to get up to speed enough to even understand what it means to have their IP tracked, let alone understand the lengths they would have to go to avoid being tracked.

Most of my non-technical friends are super concerned, and frequently tell me how scary it is not knowing what to do or how to avoid it.

It's an active role the current ad-based industry takes to convince their users that the tracking either doesn't matter or somehow empowers the user, which are both demonstrably false.

</comment></comment></comment><comment><USER13> From the F.A.Q:

 __Accelerated Mobile Pages are just like any other HTML page, but with a limited set of allowed technical functionality that is defined and governed by the open source AMP spec __

And from the Spec:

 __Enable the AMP runtime to manage the loading of external resources, which may slow down the initial render or cause jank. Allow AMP authors to include functionality above and beyond standard HTML, while maintaining the security- and performance-minded requirement that no author-written JavaScript is executed __

Appears we won 't have access to Canvas2D, WebGL, WebRTC, Fetch and other HTML5 Web APIs. AMP's subset of declarative elements and caching will be great for longform-y "static" content. The kind of articles I find myself reading more of on Mobile Chrome during down times in transit. Thinking of Medium confessionals and NewYorker dispatches, etc.

But how do you implement something like ChartBeat? Snapshots of dynamic chart images and data pre-rendered on the server and pushed out to the cdn? Sort of eliminates the performance benefits of geospatial caching doesn't it...

I do take heart however in Tony Haile's pull quote from the ampproject.org homepage:

 __The mobile open web experience is terrible and some have suggested it 's too slow to compete. We can choose to see the mobile open web as a relic of its time and flee to the warm embrace of closed platforms and apps. Or we can say that the open web means something important to the world and if it's broken it's our job to fix it. I think we should fix it. __

</comment><comment><USER14> The web is getting bigger, there is no denying that. People developing responsive sites irresponsibly, adding large images, videos and JavaScript libraries and frameworks.

What I don't understand is why search engines don't punish those individuals with larger pages rather than move everyone to something new? Is this taking us back to the mobile site days?

I love the concept of getting core content to the user fast but what is stopping someone adding a 2MB amp-img to their page and then we are right back where we were before?

</comment><comment><USER15> Past all the considerations of content ownership and all, it seems to be quite the technical feat, the impact on page load is real (or maybe my testing was partial or biased).

<comment><USER16> I'd argue it is more of a social feat than a technical one. It is still HTML, after all.

The real underlying issue that AMP solves is ad bloat. Online newspapers tend to include that one more ad library that tracks a particular thing that one ad partner or one analytics team wishes to have, let alone visual bloat such as "share as", "like", "comment" and other social widgets all implemented as iframes with their own separate trackers, and the sum of it all has a large impact on both download sizes and performance, since they are seldom optimized. Oil on fire is the fact that there is generally no incentive to remove libraries that no longer have a use.

AMP forces newspapers and other content providers reliant on advertising to play nice. It gives them an incentive (through caching and better indexing) which costs them the bloat.

</comment></comment><comment><USER17> Even more centralization and single point of failure. If this continues the web as envisioned will be entirely replaced by a centralized system of walled gardens with big companies controlling access.

This is why we need IPFS sooner rather than later.

<comment><USER17> The case for IPFS to combat these walled gardens:

[https://m.youtube.com/watch?ebc=ANyPxKqMiNbStnEQHC- kiEBSd1jI...](https://m.youtube.com/watch?ebc=ANyPxKqMiNbStnEQHC- kiEBSd1jILZqa0BT0CONnIPhZaJx8DboPmzg3vqia97Wk1XMENc3rY3Bjtz6iTqoZ-lK- mWqsshiIyQ&time_continue=3&v=HUVmypx9HGI)

</comment></comment><comment><USER18> Big fan of what AMP is doing, but I'm a little surprised by the statement that:

> Today, multiple web metrics providers are on board, including Moat (who > partner with Chartbeat), Nielsen, ComScore, Parse.ly, ClickTale, Adobe > Analytics

As far as I know, our (Snowplow's) PR into AMP is the first and only (so far) from a non-GA analytics vendor:

[https://github.com/ampproject/amphtml/pull/1358](https://github.com/ampproject/amphtml/pull/1358)

Maybe I'm looking in the wrong place?

</comment><comment><USER4> In order to make my completely static non-JS site AMP compliant do I have to include the amp JS library or is Google smart enough to realize my site is plenty fast enough as-is?

<comment><USER19> It looks like you don't have to use AMP specifically - speeding up your site is valid however you do it.

"Google made clear that AMP wasn't the only way to speed up mobile pages." [http://searchengineland.com/google-amp-coming-rank- fast-2380...](http://searchengineland.com/google-amp-coming-rank-fast-238046)

</comment></comment><comment><USER20> I tried the AMP versions mentioned in the article on an iPhone 6 connected to wifi and I am not impressed at all.

Something which loads _really_ instantly is D's forum, it's incredibly how fast it is and it's written in D:

[http://forum.dlang.org/](http://forum.dlang.org/)

(I am not into D, just found this thing recently on reddit/programming)

</comment><comment><USER21> From the article: _"...most ad servers (not just Google-owned DFP) will be able to send ads in AMP pages. Some work remains to be done on the formats that will be deemed acceptable in AMP pages."_ Deemed acceptable by who, and doesn't this indicate it will become another walled garden?

<comment><USER22> Not sure why you were down-voted as it is a legit question.

I'd honestly be pretty surprised if they didn't just opt to support all IAB- approved ad formats. The one format I could see being a big question mark is "native ads." Outside of their increased Gmail ad presence, Google has been curiously absent from the native advertising landscape.

<comment><USER23> > Google has been curiously absent from the native advertising landscape. > Compare: [https://stratechery.com/2014/peak- > google/](https://stratechery.com/2014/peak-google/)

<comment><USER22> Ah--love Ben's blog and podcast (listen to it several times a week during my commute).

His point is a good one. In terms of feeds of potential branding interest, beyond Youtube, Google's big (and mostly untapped) opportunity is in Gmail.

They made a stride to first assert control and doing users a favor by moving things to the Promotions tab. Now they have their ads in the email "feed" in that tab. The Inbox product, IMHO, was their attempt at redefining email into an fully algorithmically-curated feed ala FB, Twitter and Reddit.

My personal bet is that Inbox was a proof of concept and they will force Gmail to shift to that approach in the not too distant future. If users don't leave en masse, I would not be surprised at all to see Google forcing advertisers to pay to get into the inboxes of Gmail users--even users who have explicitly asked for promotional emails. That was FB's brilliant gambit (that somewhat blew up in their face). They convinced advertisers to invest in building an audience on the FB platform (so FB owned the audience), let them see revenue from it, and then switched from a "communicate all you like to everyone who Likes you for free!" model to a "pay us on an auction model if you want to reach anyone" model. Many advertisers consider it a huge bait-and-switch play, but I can't deny that it seems to have been successful. And that is why I won't be surprised to see Google follow suit there.

</comment></comment></comment></comment><comment><USER24> From: [https://www.ampproject.org/docs/support/faqs.html](https://www.ampproject.org/docs/support/faqs.html)

> The reality is that content can take several seconds to load, or, because > the user abandons the slow page, never fully loads at all. Accelerated > Mobile Pages are web pages designed to load instantaneously – they are a > step towards a better mobile web for all.

That's kind of dishonest of Google. The "content" doesn't take longer to load. The website does, but its because of Ads, pointless JS scripts that are spying on the user and a whole host of things that are _NOT_CONTENT_.

In any case, even if creating a new standard, or reduced-HTML, or w/e made sense, I'd be less skeptical if it wasn't controlled by an advertising company.

</comment><comment><USER25> I'm fine with it long as all content/analytics don't pass through Google, but I imagine many content sites will be lazy and let Google handle everything.

<comment><USER26> I wonder what happens when you combiner AMP pages and something like uBlock Origin? Do you get fast page loads AND minimal tracking?

<comment><USER27> Probably a blank screen since AMP requires this in your pages: <style>body {opacity: 0}</style><noscript><style>body {opacity: 1}</style></noscript>

<comment><USER26> uBlock blocks tracking, not scripting.</comment></comment></comment></comment>


Ask HN: Wrote a Blog Post, Comments? Critiques? Constructive Criticism? - <AUTHOR> http://blog.adamallidina.com/2012/05/11/intro-to-ssh-tunnelling.html

<comment><USER2> \- The font looks terrible on my screen. No subpixel hinting or what that fancy stuff is again. I see colours around the characters I think.

\- The font is big and bold and the lines are long. Hard to read.

\- The date is in that lunatic format where the date is not clear. Use DMY ordering or write out the month.

\- Waterloo?

\- The site could use some layout. I actually thought you were abusing Javascript for that because it looked so plain and so I enabled it to check (with no changes).

\- The text has a lot of words, no visible structure and a lot of mentions of AWS which to me is not related to the headline. I gave it one quick scanning but could not really figure out what you are on about (the code parts are trivial) so I lost interest.

\- Are you just trying to get referrers to Amazon? If so, make sure the links are actually visible.

<comment><AUTHOR> Hey, thanks a ton for your feedback. I really appreciate it. To address your comments:

1\. I'm actually concerned about this, it doesn't look obscenely bad on any of my test setups (OS X, Windows 7 and Arch). Could you elaborate on what you viewed the post on (Browser, OS, etc.?)

2\. I'm open to more suggestions on fonts :)

3\. :(

4\. Waterloo, Ontario - Where I happen to be writing the post

5\. I'm not much of a designer but I'm working on it. The site is just statically generated HTML and CSS (yay Jekyll)

6\. The post really isn't intended for the tech savvy readers of Hacker News, it's really just an instructional guide on how to setup AWS to tunnel your browser traffic for you.

7\. No referral links :)

Thanks again for your feedback, it's a great metric for me.

</comment></comment><comment><AUTHOR> Hey HN, I just finished writing my first real blog post and I was hoping to get some feedback. I would really apprecatie it if you guys could quickly skim through it and give me any comments you have on it. The post itself is just a simple guide on SSH tunnelling through an EC2 machine.

Thanks!

<comment><USER3> looks great.

</comment></comment><comment><USER4> What you've wrote is great! Add another post for the prerequisite of the AWS instance and link it there too.

Later, include more content on what you want to become an expert and surely the end result will be nothing more than satisfactory! Go ahead.

</comment><comment><USER5> You may also wish to add -C2qTnN[1]. At least -C2 for compression.

[1] <https://calomel.org/firefox_ssh_proxy.html>

<comment><AUTHOR> Thanks! Great tip.

</comment></comment><comment><USER6> It is DMCA, Digital Millennium Copyright Act. Not DCMA

<comment><AUTHOR> Ooops. Thanks for that.

</comment></comment><comment><USER7> The page claims to be a "guide". It reads like an article. That is to say, walloftext. If you aim to teach people how to do something with their computer, it is generally good to cut down on the text and include some helpful pictures, information on alternatives, and briefly address common problems.

It isn't a bad post, but I don't know that I'd call it a guide.</comment>


Ex-Napster exec fatally struck by sheriff's patrol car while biking - <AUTHOR> http://www.latimes.com/local/lanow/la-me-ln-cyclist-napster-killed-sheriffs-20131209,0,7243462.story <comment><USER2> As a biker in NYC, police cars are the most dangerous thing on the road for you. They roll through red lights, never use blinkers, cut you off without looking, park in bike lanes, and occasionally just drive down one way streets. All this without running their emergency lights, just as matter of everyday driving.

<comment><USER3> Sounds a lot like the observed behaviour of most bicyclist. No surprise to me that the two collided.

I must have struck a nerve.

<comment><USER4> The evidence so far shows Milt was inside the bike lane at all times and the stretch of road was straight and easy to navigate.

<comment><USER3> Oh wow, that totally disproves my comment while explaining the downvotes, doesn't it.

</comment></comment></comment></comment><comment><USER5> People complain all the time about the subset of bikers who disobey road signs but the fact is that mistakes and negligence on the part of drivers are always far more dangerous than on the part of bikers. More so, the arrangement of "bike lanes" as well as the laws themselves typically make it very, very difficult for bikelrs to get from point A to point B without at some point either putting themselves in excessive danger or effectively violating the law.

Rule makers typically just assume that bikers can either safely blend themselves into normal vehicular traffic or teleport across gaps in properly laid out bike access areas (which tend to be rare and never fully connected with each other). It's a ridiculous and unsafe situation that we've become accostomed to existing merely because it's the status quo. And then we wonder why not so many people commute by bike in most cities.

</comment><comment><USER6> How long until the stolen lives of bicyclists are treated with the same respect as pedestrians and drivers?

A 'police car' hits a person, not the person driving the vehicle? The police officer's injuries detailed, yet no actual details of the accident of quotes from witnesses? Lets see if charges are pressed for this _potential vehicular manslaughter_... or even a criminal investigation! You know it would be if this were a pedestrian or other driver. My law-abiding friend, during a group ride in the bike lane, was struck and killed last month on Highway 1. The cops let the driver off, his illegal speeding and loss of control of his vehicle being simply 'an accident.'

So, who wants to bet this cop will face charges?

<comment><USER7>
          How long until the stolen lives of bicyclists are treated with the same respect as pedestrians and drivers?

How long until bicyclists stop pretending that traffic rules don't apply to them? Or that they don't get to pick and choose when they're vehicles and when they're pedestrians -- if they're on the road, they're a vehicle? Or that, they too, have to come to a stop at a red light or stop sign? Or that they also have to respect pedestrians in crosswalks and can't just barrel through them?

<comment><USER8> You're attempting to say that because a subset of cyclists don't obey traffic rules therefore it's okay to not treat cyclists who are killed in traffic accidents as human beings.

Stunning work.

<comment><USER7> That isn't at all what I'm "attempting" to say. If the GP wants to complain about the law not being "enforced" to punish the cop perhaps they should complain about the lack of enforcement on cyclists too

<comment><USER6> Let me know when a cyclist last killed a cop and lets talk about who got charged what.

Also, you still are equating Failure to Stop's (which sure, could maybe someday cause some sort of fatal whatever someday whenever)... with the actual, real, actual loss of life.

Insultingly vile.

<comment><USER7> Hey look, a recent example of a bicyclist not only injuring but killing a pedestrian because they chose not to obey the law.

[http://blogs.kqed.org/newsfix/2013/08/15/107079/Chris- Bucche...](http://blogs.kqed.org/newsfix/2013/08/15/107079/Chris-Bucchere- Sutchi-Hui-bicyclist-pedestrian)

I hate the pedantic bullshit of elitist cyclists like yourself

<comment><USER6> Just to close this out, out of respect for the lives of Milton, the cop, Josh all others cited above... I'm not really a cyclist. I like it, its fun, and I ride safe on the handful of rides I have each year.

But I might be a pedantic little shit. ;)

<comment><USER9> You're not a pedantic little shit. You're arguing with a jerk.

Equating cyclists running stop signs to drivers killing cyclists in bike lanes is ridiculous, especially given that the cyclist in the example pled guilty to homicide and drivers are - literally - never prosecuted for killing cyclists.

Don't be so quick to demean yourself in the face of asinine attacks.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Was anyone else a bit put-off that it was the patrol car that killed the cyclist, and not the person driving the patrol car (as it would have been reported had it not involved an officer)?

</comment><comment><USER11> "The impact smashed the patrol car's windshield, leaving the deputy with cuts on his arm and glass in his eyes."

Clearly the peace officer was the victim of the cyclist's irresponsible road behaviour here!

<comment><USER12> It's a vehicle accident, do we have to turn this into a "f the police" (censored, for the kids) discussion?

<comment><USER13> Not yet, but...

[http://www.wftv.com/news/news/local/no-charges-opd- officer-a...](http://www.wftv.com/news/news/local/no-charges-opd-officer- accused-hitting-homeless-ma/ncDdm/)

</comment></comment></comment><comment><USER14> The cyclist was in the bike lane at the time. More info:

[http://losangeles.cbslocal.com/2013/12/08/bicyclist- struck-a...](http://losangeles.cbslocal.com/2013/12/08/bicyclist-struck-and- killed-by-sheriffs-radio-car-in-calabasas/)

[http://www.bikeforums.net/showthread.php/925411-Bicyclist- hi...](http://www.bikeforums.net/showthread.php/925411-Bicyclist-hit-and- killed-by-Sheriff-in-Calabasas)

<comment><USER15> There's no possible excuse for this, the office should be fired and arrested for man slaughter.

<comment><USER16> Not even civilians face criminal charges for running over cyclists.

<comment><USER17> This is the saddest part. The NY Times recently ran an op-ed "Is It O.K. to Kill Cyclists?"

[http://www.nytimes.com/2013/11/10/opinion/sunday/is-it-ok- to...](http://www.nytimes.com/2013/11/10/opinion/sunday/is-it-ok-to-kill- cyclists.html)

It appears that the answer is "yes, almost always".

</comment></comment></comment></comment><comment><USER18> Looking at the map where that happened, that's an incredibly bad part of the road. There is a hill with very little visibility of what's in front of you as you pass it. There is a bike lane further down, but I think at the hill the road narrows and there is no bike lane or protected area.

And of course people go flying through that section. Cops aren't the only offenders there, but they sure don't make it any safer.

</comment><comment><USER19> Thought of a couple recent tragic tech star fatalities:

\- Former Amazon CFO Joy Covey was killed by a car while bicycling in September: [http://postcards.blogs.fortune.cnn.com/2013/09/19/joy- covey-...](http://postcards.blogs.fortune.cnn.com/2013/09/19/joy-covey- amazon/)

\- Oculus Rift co-founder Andrew Reisse killed in August in the crosswalk during a police chase. Not on a bike, and not in normal traffic conditions, but tragic nonetheless: [http://www.forbes.com/sites/insertcoin/2013/06/02/oculus- rif...](http://www.forbes.com/sites/insertcoin/2013/06/02/oculus-rift-co- founder-killed-as-bystander-in-police-chase/)

<comment><USER20> I don't know about tech 'star', but there was a pretty high profile employee at GroupOn killed a few months ago in Chicago traffic;

\- [http://www.suntimes.com/news/metro/20566657-418/groupon- hono...](http://www.suntimes.com/news/metro/20566657-418/groupon-honors- staffer-killed-in-bike-crash-with-donations-for-protected-lanes.html)

</comment></comment><comment><USER21> I think the most disappointing part about this is that the person that was hit had to be an 'ex-napster exec' to get any notoriety.

I am very sorry to hear there was an accident involving a bike and a car though, at apparently such a high speed that it broke in the window...

</comment><comment><USER22> Reminds me of this piece: [http://www.nytimes.com/2013/11/10/opinion/sunday/is-it-ok- to...](http://www.nytimes.com/2013/11/10/opinion/sunday/is-it-ok-to-kill- cyclists.html?_r=0)

"We do not know of a single case of a cyclist fatality in which the driver was prosecuted, except for D.U.I. or hit-and-run," Leah Shahum, the executive director of the San Francisco Bicycle Coalition, told me."

Cycling is just going to get more common, at what point will the having less rights bias end? Will it take someone of David Byrne's status getting hit to actually do anything about this?

<comment><USER23> That is a great article. It's important to look at the language used by media in these cases, for example look at this local news article about the ex- Napster person's accident, the headline is: "Bicyclist dies after hitting patrol vehicle in Calabasas" which implies that the cyclist was the one who hit the police car, even though he was rear ended. "The man was riding east on the road when he crashed into a patrol car traveling in the same direction, officials said."

[http://www.vcstar.com/news/2013/dec/08/bicyclist-dies- after-...](http://www.vcstar.com/news/2013/dec/08/bicyclist-dies-after- crashing-into-patrol-in/)

<comment><USER24> Wow, those quotes are awful. It looks like the article was rewritten since your comment, though.

</comment></comment></comment><comment><USER25> And this is why I don't ride a bicycle. Despite the health and cost savings benefits, it just isn't worth putting myself mere feet from all the crazy drivers with no concern for my safety.

</comment><comment><USER26> RIP Milt. He was one of the good guys.

</comment><comment><USER27> "Authorities did not say whether the deputy was on routine patrol or responding to an emergency call"

Why wouldn't they release this information?</comment>


Understanding JavaScript Modules of 2016 - <AUTHOR> https://blog.conf.fi/understanding-javascript-modules-of-2016-4d3024d37867 <comment><AUTHOR> I'm the author of the article. I apologize if it's frowned upon to submit one's own content. What's done is done, and I welcome all feedback. I'm not an expert on the subject, so if the writing contains mistakes, please let me know.</comment>


A Tiny Reef Fish Can Recognize Itself in a Mirror - <AUTHOR> https://www.scientificamerican.com/article/a-tiny-reef-fish-can-recognize-itself-in-a-mirror/ <comment><USER2> This happens because the surface of the water is essentially a big mirror.

All fish can recognize reflections because if they didnt theyd be constantly assaulted by a doppelganger from up above.

</comment><comment><USER3> It's possible that ants too can do that: [https://www.rifters.com/crawl/?p=6822](https://www.rifters.com/crawl/?p=6822)

<comment><USER4> Peter Watts is really interesting, here's the talk

[https://youtu.be/v4uwaw_5Q3I](https://youtu.be/v4uwaw_5Q3I)</comment></comment>


Show HN: Get a recruitment page for any website, find the best candidates - <AUTHOR> https://rukshn.github.io/hiring/ <comment><AUTHOR> Hi, I just want to test this idea before I start working on this.

What you will get - A beautiful page to replace your hiring page on your website. Candidates can easily submit their resumes through the page.

You will get a dashboard where you can analyze all the responses and pick the best candidate that suits your job.

Like I said earlier I just want to make sure whether there is any market for such an idea? If at least 10 companies/people are interested in this, I will start working on this.</comment>


A 16th-century engineer whose work almost defeated the Ottomans - <AUTHOR> https://arstechnica.com/information-technology/2017/05/a-16th-century-engineer-whose-work-almost-defeated-an-empire/ <comment><USER2> A personal anecdote from a non-historian:

Some years back I took a holiday in Malta.

Taking the ferry to Valletta, climbing the ramp up from the dock, I was shocked to see the scale of the fortifications. I knew it was a strategically important place, but what surprised me was how obviously the entire walled peninsula of Valletta seemed to have been constructed first and foremost as a fortress. It's easy to forget the scale and scope of historical conflict and the effort that went into it, and this was a stark reminder.

The other thing that surprised me was that they had the old suits of armor of the commanders of the order, and I was surprised how big they were. I'm pretty tall (6"6) and was surprised to see the suits were close to my height. Presumably bigger than the men that wore them, but what occurred to me was "these are the guys who made it to the the top of their organization, the commanders, and they must have been very big for their time. This is probably an organization that values brute strength."

I don't know if that's a valid inference or not, but Malta definitely left the impression it was created by folk who mean business.

This linked article is really interesting context, makes me realize why Malta was built so well.

<comment><USER3> Isn't there still a correlation between status and size these days? Tall with good hair and you're already leadership material...

It's amazing how much of that story could have been written yesterday. Tunneling is still used in the middle-east as a war tactic. North Korea tunnels to South Korea. The value of engineering ;) Embargoes are essentially siege tactics.

<comment><USER4> > Isn't there still a correlation between status and size these days?

Yes. The wage gap between short men and huge men makes any perceived gender based wage gap between male and female look very, very puny.

<comment><USER5> Sorry for the nitpick, but:

Why do you present the height-based wage gap as a fact, while presenting the gender-based wage gap merely as "perceived"?

Is there more evidence for the former wage gap than for the latter? Or, is the one type of discrimination more acceptable than the other?

<comment><USER6> Not the original poster, but:

A number of the gender based wage gap studies that have made a splash in the press have neglected to account for multiple facets of employment and occupational risk leading to conclusions showing an outsize pay gap... They've documented inequal outcomes in the market based on equivalent experience or education across sectors without controlling for inequality of physical- demands and employment distribution... The popular press then extrapolates these findings inartfully, leading to a shared sense of gender discrimination that is not borne out by the broader market.

I know this is something of a hot button topic, so I'll be extra clear: women and men are of equal value, and deserve equal pay for equal work, naturally. But we have to own the fact that, statistically, men _really should_ be earning more at work as long as men are doing the majority of high-risk occupations and women are taking more time off of work when having children. There are a lot of different studies, but last I dug into this when you start comparing more apples-to-apples you find that the gender gap is nowhere near the oft cited 0.75 cents on the dollar.

There is a gender pay gap, though it's quite difficult IMO to pin that gap on broad sexism given a few cultural factors. Namely men being 6 times more likely to ask for a raise at work, men being more likely to measure self-worth at work through money and not peer approval, societal pressures for men to be a 'provider', and for men to measure self-worth almost exclusively through career success.

While we're looking at why young men are more likely to find themselves doing EOD work or high-voltage wire repair than women, lets also remember that the physical difference between the sexes can, in fact, be a life or death matter in some occupations... And if we want to compare employment outcomes by _years_ of education taken, we really need to quantify how dirty and dangerous jobs oriented towards physical labour would ideally be gender-represented in the market. Ie Sewer repair technicians and plumbers and construction skew male and high paying compared to white collar positions with the same length of training - are we really going to expect 50% female representation in those fields?

Height based studies, on the other hand, are much easier to setup controls for. Outside of the far extremes height doesn't fundamentally impact employment opportunities, and demographically are much easier in terms of experimental design. As long as those studies control for certain kinds of physical work which self-select towards large/small people we should be able to get a reasonable grasp of how the world responds to taller people. Last I checked a few inches in height meant a significant increase in yearly takehome pay, management opportunities, and attractiveness as a mate.

Bottom line: easier studies that aren't politically loaded tend to give us better data than harder studies that are rich with social and political subtext... Women should get paid as well as men, but we can't pretend that Geese and Ganders are one and the same. Deep sea welders get paid a _lot of money_ and jobs like that will create a statistical gender pay gap as long as they are not equally distributed among the genders.

<comment> pow_pp_-1_v This comment, at the very least, should make think a bit more critically when reading or listening to stories about the gender pay gap. Thanks!

</comment></comment></comment></comment></comment></comment><comment><USER7> Suleyman was not only a great military mind, but an extremely astute politician as well. One thing the article fails to mention is that Suleyman didn't just let the people of Rhodes "go free" after their defeat, the Knights Hospitaler had to hand over their fortresses in Kos and Bodrum as part of the deal. This was a smart move as the castle in Bodrum was much better fortified, and Suleyman got it without, in essence, firing a shot. For this reason, the castle in Bodrum is extremely well preserved and a must see if you want to get a sense of crusader architecture.

<comment><USER8> I liked this part of the article:

 _" Suleiman was respectful and generous in victory. The citizens of Rhodes were to be exempt from both taxation and conscription for the next five years. Tadini was allowed to leave. He went to the colonies of Genoa, where he again fought invading Ottoman forces and again lost.

The Order of St. John was allowed to leave in peace and build a new fortress elsewhere. They did so on Malta, where their walls could be built on stone and therefore could not be undermined. Toward the end of his life, Suleiman sent a force to conquer Malta. This time the siege failed, in part because he was not there to keep order or impose his implacable will."_

This kind of graciousness in warfare does not seem to exist in modern times. Weird, considering how brutal war in those times looks compared with today.

<comment><USER9> > This kind of graciousness in warfare does not seem to exist in modern times. > Weird, considering how brutal war in those times looks compared with today.

Well, there was a ton of brutality then as well. Probably even much worse than today.

<comment><USER10> I think so too. In our recent conflicts when you were caught you might get shot, the ancients used torture-killing so cruel I can't even read about it without feeling sick. Not even the Nazis used something like the Brazen Bull ([https://en.wikipedia.org/wiki/Brazen_bull](https://en.wikipedia.org/wiki/Brazen_bull)), and that's just a simple device and procedure, they were much more inventive than that in the past. 1000 years ago those involved in the assassination attempt on "Der Führer" would have faced far more horrible deaths than they actually got. It seems to me even the most evil Nazis didn't have 1% of the imagination of the ancients (possibly excluding Dr. Josef Mengele, but he didn't think a about how to create pain, he just didn't care if his subjects did).

</comment></comment></comment></comment><comment><USER11> There's a fantastic book by Roger Crowley called _Empires of the Sea_ that covers the Habsburg-Ottoman war for control of the Mediterranean. The early chapters go into great detail on the Siege of Rhodes, including Tadini's efforts, and how the lessons learned there would set the stage for later battles (particularly Malta and Lepanto) and the end of Ottoman supremacy. For anyone interested in this article or the era in general I can't recommend it enough.

<comment><USER7> Definitely adding that to my reading list. My understanding is that the Ottoman strategy for controlling the Mediterranean was to go the "long way 'round" and control as much of the surrounding ports, as opposed to the Knights Hospitaler, the Genoese, and the Venetians who took the approach of building unmatched naval strength.

As an example, during the siege of Constantinople, the Genoese and Venetian navies were ultimately defeated when the Ottomans literally _carried their ships over land_ to get behind the other's defensive line.

</comment></comment><comment><USER12> Interesting note. It's a funny thing that in the current climate nobody mentions the underpinning of the conflict depicted in the article, hundred of years of struggle between Christianity and Islam.

Wikipedia: >According to Ottoman understanding, the state's primary responsibility was to defend and extend the land of the Muslims and to ensure security and harmony within its borders within the overarching context of orthodox Islamic practice and dynastic sovereignty

<comment><USER13> That's the state propaganda. Turkic people in that area are later arrivals, and the Ottoman Turks basically pinned their legitimacy on the religion of the region. Suleiman was "generous" because the state propaganda of the time was "Ottoman Justice".

Consider a hypothetical history with Persian empire not falling to Muslims and Byzantine also enduring. Best buddies forever or likely the same pattern of pull-push on borders and a cultural clusters boundary condition?

Geography is the key here, not people's misunderstanding regarding the meaning of it all.

<comment><USER14> As if almost anything written about events in history is not propaganda. There is barely any complete truth. English Wikipedia in general just spews same thing western historians words, others do the same to fit their agenda. History is a joke.

<comment><USER13> Well, not really what I was saying. More like 'geography is history' ala 'character is destiny'.

</comment></comment></comment></comment><comment><USER15> For people who love alternative history stories, the "Ring of Fire" series (starting with "1632", which you can get for free at [http://www.baen.com/1632.html](http://www.baen.com/1632.html)) is highly recommended.

The Suleyman portrait there (in [http://ericflint.wikia.com/wiki/Ottoman_Empire](http://ericflint.wikia.com/wiki/Ottoman_Empire)) is also rather astute.

<comment><USER16> Great series of books, I'll second this recommendation

</comment></comment><comment><USER17> Great read!

"...an early genius of military engineering, Gabriele Tadini." But more than 1500 years before him there were others such as Archimedes and Caesar.

I wonder if Tadini was a polymath similar to other great military engineers like Archimedes and Leonoardo who would have been living at the same time as him.

<comment><USER18> I'd wager that everyone back then who made a name for himself with intellectual pursuits was a polymath. Simply because knowledge was hard to come by and you couldn't specialise so much that you remained ignorant about the grand scheme of things of everything else, like it is possible today.

<comment><USER19> Or alternatively, the breadth of human knowledge was small enough that one person could hold most of it in their head.

<comment><USER20> One of my favorite party questions is, "Who was the last man who knew _everything_?"

<comment><USER21> I doubt, that there ever was such a man.

For example knowing about plants and animals. We as whole humanity are still far from knowing them all on the earth, so how could somebody from history knew them all?

And even if you only count "everything" as the whole current knowledge of humanity, then also no, as there are for example tribes in the jungle who know about plants or hunting technics the genius in europe never heard of.

<comment><USER22> > I doubt, that there ever was such a man.

I've heard this question before. I think it's more useful to think of it as "When was the last era when it was possible for one person to know everything that's known?"

Doubtful that there ever was such a particular person, at least because of geography, as you point out, and different concerns in different parts of the world. But there must have been such an era; I don't know when that was.

</comment></comment></comment></comment></comment></comment><comment><USER23> > or crenelations for releasing boiling oil

In various trips to the UK and dozens of castle walking tours, almost to a guide they said (paraphrasing) "no one used boiling oil. It was way too precious a commodity." Water, sure.

</comment><comment><USER24> > Villiers (the leader of the defenders) had ignored the many warriors who > told him the same (that the city was no longer defensible), but listened to > the engineer (Tadini).

This made my day. :)

</comment><comment><USER25> This event was covered in part II of Extra History's series on Suleiman the Magnificent:

[https://www.youtube.com/watch?v=JGZSkLq3Eng&list=PLhyKYa0YJ_...](https://www.youtube.com/watch?v=JGZSkLq3Eng&list=PLhyKYa0YJ_5Be8gG49Sh7rsW_fFNcbGOE)

</comment><comment><USER26> Most people casually interested in the crusader period know about the Knights Templar. But it turns out the Knights of St. John are just as fascinating, still exist, and have sovereign status similar to a nation-state. They built the impressive fortifications at Rhodes, which have technically never been defeated (they surrendered after a six month siege and only with the word of Suleiman the Magnificent that the survivors would be granted safe passage off the island). Then moved to Malta where they built an even more impressive set of fortifications and civic structures.

The Knights were composed mostly of nobles from Europe and thus brought tremendous wealth with them. Initially they set up hospitals in the 12th century to care for pilgrims traveling from Europe to the Holy Land. That role grew into a militarily defensive role and then grew some full-on military features by the 14th century.

Being composed of rich Nobles, the order at one point may have had access to more wealth than the entire rest of the Roman Catholic Church during this time period. During the early Malta period of the 16th century, the Knights built one of the most incredible and beautiful buildings I've ever seen. The outside isn't much to look at, but the inside is one of the most decorated buildings I've ever been in -- pictures don't really do it justice. The local "real" Cathedral built by the Catholic Church looks positively spartan in comparison even though it also is a beautiful building.

[http://www.maltacultureguide.com/admin/images/stjohn_04_big....](http://www.maltacultureguide.com/admin/images/stjohn_04_big.jpg)

[http://www.divine- name.info/worldwide/malta/mdina/Mdina2.JPG](http://www.divine- name.info/worldwide/malta/mdina/Mdina2.JPG)

The order survived into the modern age, and over the ages did a number of works, continued to administer Malta, and happened to colonize parts of the Caribbean. Weakened during both the Protestant Reformation and the Napoleonic wars, but returned to the roots as a human welfare and religious group. They eventually changed their name to "the Sovereign Military Order of Malta" (SMOM) which they keep to this day as the oldest surviving order of chivalry.

Amazingly it actually is a "sovereign" order, meaning they're viewed in many circles to have power equal to that of a minor nation-state even though they have no territory at all -- the only example in the world today. For example, SMOM is a permanent observer in the U.N. [1] and maintains diplomatic relations with 106 countries. It can enter into treaties, issue passports, coins and postage. Their headquarter buildings in Rome are treated as Embassies and enjoy diplomatic extraterritoriality.

1 - [https://www.un.int/orderofmalta/](https://www.un.int/orderofmalta/)

2 - [https://en.wikipedia.org/wiki/Sovereign_Military_Order_of_Ma...](https://en.wikipedia.org/wiki/Sovereign_Military_Order_of_Malta)

</comment><comment><USER27> But I'm sure, by the scale of successful conquests on the ottoman side; there are several successful engineering innovations at their end as well. What makes Tadini's work note-worthy is the usual 'David vs Goliath' emphasis and also Ottoman Empire did not survive; history is written (mostly re-written) by the victors !

<comment><USER28> Usually a claim is most effective if it has some substance, for example some proof. Could you please provide some references to those innovations instead of shaming another culture, who is remembering one of its lost ones?

Also the knight orders have not survived. Should I blame the victors (whoever they are, as in this story the Ottomans won, for example), for writing history?

</comment></comment><comment><USER29> I will have to remember to mention this article to the next person I play Stratego with.

</comment><comment><USER30> Oh, the last sentence reveals the purpose of the article"

"See, kids, the reason mass surveillance ala Snowden has to exist is because the other side mines and we undermine, its always been like this."

<comment><USER31> I up voted this post because I think the greater conversation regarding astroturfing and media conditioning us to accept certain policies needs to be had, but I think you could have found a better way to say it.

</comment></comment><comment><USER32> It seems that mining is still used today: [https://www.youtube.com/watch?v=zwTj0tWMh2A](https://www.youtube.com/watch?v=zwTj0tWMh2A)

</comment><comment><USER33> Interesting subject, but why does it feel like I'm reading a passage from a standardized test?

<comment><USER33> Followup: why the downvote? This article has a bizarre and amateurish ending:

      "Despite Tadini's losses, his methods have continued to
      influence combat into the present. Mining and
      countermining, with all their attendant surveillance and
      engineering, are still staples of warfare."

This is actually worse than a passage from a test -- it sounds like a student essay written in response. It's little better than:

      In conclusion, Tadini's mining is still influential today.

which is vague, abrupt and unsubstantiated -- the article makes no mention of mining in the current day. Am I the only one who finds this odd?

<comment><USER34> I notice you're new to HN. Welcome! [https://news.ycombinator.com/newswelcome.html](https://news.ycombinator.com/newswelcome.html)

To understand what makes HN different from other sites, you may want to familiarize yourself with the guidelines: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

In particular, we try to write comments that are interesting to read. That rules out swipes and one-line dismissals: calling something amateurish, or complaining about downvotes.

HN has a lot to offer as a community, and we started out as a tight-knit group of refugees from sites like Reddit. This place has grown up a lot since then, but those fundamentals were the reason for HN's success.

Your second comment was better than your first -- a substantive dismissal is always preferable. And you can write comments like that if you really want to. I usually find it's more productive to focus on what's cool about a piece. There's usually something.

However if an article is mistaken, that's worth calling out. Some of the best HN comments are refutations. Though you'll want to be certain you're correct, or else you'll get called out yourself. :)

<comment><USER33> Thank you for the reply. Having lurked on HN for a while, I'm used to some negativity, or at least very critical, comments. So when most of the comments for this piece appeared positive something seemed off.

Anyway, I appreciate the environment on HN and the steps users like you take to preserve it.</comment></comment></comment></comment>