NFL opens Pandora's Box by offering All-22 tape to public - <AUTHOR> http://www.nfl.com/news/story/09000d5d82a0b2d8/article/nfl-opens-pandoras-box-by-offering-all22-tape-to-public <comment><USER2> The argument in this article is just ridiculous. Handwringing about giving fans more information because they might not interpret it correctly? Breaking news: A lot of people are already plenty wrong with the current amount of information. They'll be wrong with less, they'll be wrong with more, they'll be wrong if the info level stays the same. This is therefore a null argument.

<comment><USER3> _The argument in this article is just ridiculous_

It's on the NFL site. It's advertorial, marketing disguised as journalism. It's not making an argument, it's just stirring one up to get attention.

<comment><USER4> > _It's advertorial, marketing disguised as journalism._

It's barely even disguised. If it were published by a news organization[1], or really just "someone else", then you would be right.

This is an article on NFL.com about an NFL product. It's straight up advertising. Publishing an "article" to say "this seems 'risky'; why would we even offer this product to you, our fevered fans" is about the thinnest disguise an ad could have.

[1] <http://paulgraham.com/submarine.html>

</comment></comment></comment><comment><USER5> This is very exciting, as there's a lot of strategy to American football that isn't plainly visible when the camera just follows the ball as it does on television. It's not going to showcase technique very well, but it'll go a long way towards explaining e.g. why some wide receivers are always open, why some players always seem to be in the right position to interrupt a pass, etc. I'd actually find it very interesting to see something like a Coursera course using film from this to explain different plays, packages, etc.

However, I'm not sure it's of wide interest to HN. As far as I can tell, I'm the only one here who likes NFL football.

<comment><USER6> _However, I'm not sure it's of wide interest to HN. As far as I can tell, I'm the only one here who likes NFL football._

Nah, there's at least two of us.

#GODOLPHINS

<comment><USER7> I grew up a Lions fan, but man, that HBO show Hard Knocks got me hooked on your team. Now I find myself wanting to watch Dolphins' games and hoping Joe Philbin gets it together.

<comment><USER8> This is surprising to me. Hard Knocks has been a good series, but this year's offering was so much worse than any other year that I wonder if it won't get canceled outright (it doesn't help that teams aren't exactly lining up to participate).

I found Joe Philbin to be insufferably boring. Maybe it's just the contrast with Rex Ryan last year.

At any rate. I'm glad there are so many football fans in the HN ranks.

</comment></comment></comment></comment><comment><USER9> It's incredible that they're offering this tape--especially from a computer vision perspective. With enough data, one could conceivably write a program that predicts a team's next play based on the players' pre-snap formation and the previous plays.

<comment><USER10> Actually, this kind of thing has been around for a long time.

Football Outsiders does game charting and "advanced NFL statistics". People have published papers on using artificial neural networks to predict play calling, success rates, even injuries and stuff like that.

But this does give us the ability to enrich the data quite a bit. When you watch the live film you really can't see who blew a coverage where or why the safety didn't get to the running back in time to make a tackle. I think if you just watch the TV angles then you might not be convinced that pump fakes actually do anything to confuse the defense.

There's a lot to be gained here by statisticians and casual fans alike but it's hard to see that when only 1/3 of the action is visible at any given time.

<comment><USER11> Football Outsiders abuses the use of statistics and engages in data snooping (the "study" on running backs comes to mind) to make their points. They're far, far behind organizations and people who have lent credence to sports analytics, like Baseball Prospectus, Tom Tango, Pete Palmer, Bill James, etc.

<comment><USER10> I agree with you (although your comment sounds almost ranting) but you kinda have to mention them in any conversation about using data to understand football... even if it's not used properly.

</comment></comment></comment></comment><comment><USER12> I never understood the fear of fans wrongly criticizing teams/players/coaches based on the All-22 tape. All other sports make their own equivalent of it available allowing fans to see every mistake made by every player. As far as I know it hasn't resulted in any worse sportsmanship. Football in particular has always had Monday morning quarterbacks and always will. The media has always had access to the All-22 tape and do break down the best and worst plays every week. I'm glad they're finally opening this up but does anyone know what they were so scared of before?

This does open up a huge opportunity for third party analysis, most obviously for sports betting and fantasy football tips. With a much smaller sample size of games and plays football will never become as predictable as baseball but it will be exciting to see what the general public will do with this.

Also for any high school defensive backs who previously had no way to study how the pros play their position, this is huge!

<comment><USER13>
        All other sports make their own equivalent of it available allowing fans to see every mistake made by every player.

What other sports do that?

<comment><USER12> MLB.tv and TNT Overtime(NBA) both allow you to watch games online with your own choice of camera angles. The MLS seems to be lacking this option.

<comment><USER14> I didn't know that, I'm not into american football or baseball, but I like the NBA a lot.

TNT Overtime is probably not available in my country (Uruguay), and most live streams are still mostly unwatchable here, but I'd really like to have the option some day :) .

I really like living in the age when cable tv is being replaced by Netflix and equivalent internet broadcasts :) . Sadly my hope that I could enjoy the same stuff being broadcast in the US, Europe and Japan still hasn't come to pass (they've managed to region-encode the Internet :P and proxies are not a long- term answer)

</comment></comment></comment></comment><comment><USER15> And the first consequence of opening that Pandora's Box would be even more ammunition (not that any more is needed) for fans/writers/anyone with a passing interest in NFL to point out how awful the replacement refs are

refs: [http://espn.go.com/nfl/story/_/id/8394351/the-nfl- official-m...](http://espn.go.com/nfl/story/_/id/8394351/the-nfl-official- mess) [http://espn.go.com/nfl/story/_/id/8393575/replacement- offici...](http://espn.go.com/nfl/story/_/id/8393575/replacement-officials- poor-performance-steals-show-denver-broncos-atlanta-falcons) [http://espn.go.com/nfl/story/_/id/8402489/nfl-replacement- of...](http://espn.go.com/nfl/story/_/id/8402489/nfl-replacement-officials- affecting-vegas-bets)

<comment><USER16> This announcement dates from June, so I believe the footage is already available. So far I haven't heard anyone cite the All-22 footage for anything other than Grantland.com articles.

</comment></comment><comment><USER17> "And therein lies the problem with All-22 tape becoming available to the general public, particularly when it comes to passing plays. Someone will be open and many fans will assume that the quarterback did not make the right read or was locked onto another receiver. Yet in reality there is a progression on every pass play -- based on the coverage -- that a quarterback must rely on to determine who gets the ball. What might appear to be open on the All-22 might not be on the progression."

Hey guy posting on NFL.com, thanks for assuming the entire fanbase consists of complete idiots!

Ask any legitimate football fan if they understand the concept of QB progressions and they'll ask you if you understand how to recursively parse a binary tree in-order (assuming of course you're a programmer).

ESPN/NFL films has been feeding this to us for years using their access to All-22 so I find it hard to believe that when us plebs get access to it we'll suddenly forget that a QB can miss a receiver because he was under pressure from the pass rush or fooled by some defensive scheme.

Literally this past week when Peyton Manning and the Broncos played the Atlanta Falcons on Monday Night, ESPN/Sportscenter kept repeatedly showing us how Peyton Manning was fooled at the beginning by the Falcon's coverage schemes with... All-22 footage. I'm sure there will be fools who will react the way this author describes, but a lot of fans are way more hardcore and want access to All-22 to improve their understanding of the game.

<comment><USER18> "Hey guy posting on NFL.com, thanks for assuming the entire fanbase consists of complete idiots!"

That's Michael Lombardi. Perhaps you are not giving him enough credit as a former NFL executive? He is more than just "some guy".

"ESPN/NFL films has been feeding this to us for years using their access to All-22"

That is a partially correct statement. They would highlight specific plays and break them down for us (Ron Jaworski is great at this). However, for the first time the fans can get these raw tapes of footage and break it down themselves. With no help from the pros.

Easier said than done.

<comment><USER17> My point isn't that he isn't an expert on the NFL. But I would say he does not know much if he thinks giving people more information will make people jump to conclusions they've already made beforehand. Giving people this information is not any more detrimental than broadcasting the game on a TV. You will always have people shouting, "what an idiot" when a QB misses a receiver, adding this will at least give them additional information.

</comment></comment></comment><comment><USER19> I've thought for a while now that the NFL network - their TV presence, the website - is the future of how sports will be. It's an incredibly good product if you're a football fan (as I am - go Niners).

The TV channel is well done for the fan, a mix of informality with information - bunch of faces that make us nostalgic due to their past achievements combined with solid anchors who have personality but don't try to outshine the hall-of-famers who know their stuff.

The website is very well done, interactive, some fun game dynamics. Their apps are good enough - much room for growth but they're getting better.

The all-22 game tape is a nice step forward here.

I think people who want to study the future of pro-sports media in the evolving media marketplace could do a lot worse than watching what the NFL is doing.

<comment><USER13> NFL Redzone is the greatest innovation in sports in the last 20 years, if not ever. I didn't watch a single game on FOX or CBS last season and I won't this year either. I honestly can't believe that the NFL doesn't charge a big subscription fee for it.

[1] <http://redzonetv.nfl.com/>

</comment></comment><comment><USER20> There's already a budding aftermarket...

A gif that demos why Pittsburgh Steelers tight end Heath Miller is such a great run blocker:

[http://cdn1.sbnation.com/imported_assets/1198471/steelers3.g...](http://cdn1.sbnation.com/imported_assets/1198471/steelers3.gif)

<comment><USER21> That is not All-22 footage; it's just standard HDTV footage.

All-22 footage is from "overhead" (at least as high as safely possible in a stadium) and shows about 2/3 of the field at all times. The All-22 footage does not have the onscreen extras such as down and distance nor the generated 1st down yellow line.

<comment><USER22> Also, you can see all 22 players. :)

</comment></comment></comment><comment><USER23> Condescending, elitist BS. OMG, the public will form uninformed opinions, because they don't know what I know, this could be horrible. I do not understand the viewpoint. The public already has uninformed opinions about NFL players, coaches, etc. Big deal. Allow them to be more educated on the game, especially since the NFL would not exist without the public's interest.

</comment><comment><USER24> What I would like is an API to better track players for my Fantasy League. Or a chat feature in the Mobile App to trash talk on Sundays.

<comment><USER25> There is a chat feature in apps (iOS)…it's called matchup smack of league smack or something like that.

<comment><USER24> Android user here.

</comment></comment></comment><comment><USER26> This could be very exciting for amateur analysis of the game. That could potentially have some really cool effects on how we understand the game as data could be recorded and looked at closer, maybe an even greater data based era on the horizon for the NFL.

</comment><comment><USER27> First, I'm so glad that there are so many NFL fans on HN. Now to the article; its going to be like getting your news from blogs. When you make something accessible to the masses, the quality gets diluted .. but I'm certain it makes things much more widely available. I'm willing to bet there are die-hard fans out there who are knowledgeable enough to put out quality analysis ala the analysis on NFL.com. If you listen to all the talking heads, you might not have a great experience. But over time, refine the opinions you consume, and I suspect we'll all come away for the better. I'm all for empowering the masses !

</comment><comment><USER28> This is going to result in a lot of realtime "backseat coaching", especially with the rise of Twitter. Not so great for coaches doing a poor job, but great for the fans and those who want to learn more in-depth football strategy.

</comment><comment><USER29> I think this is going to be fun because you will be able to concentrate on one player. Imagine if they had done this while, e.g., Lawrence Taylor, was still playing?

This is a real treat because we will get the see the attributed greatness* that previously only coaches, players and NFL Films could verify.

* The type of players for which coaches make adjustments, a week before the game, to account for.

</comment><comment><USER30> I'll be the first to admit I'm no aficionado but I can't see how more information is a bad thing. The OP feels as if the unwashed masses, once having access to this font of knowledge, will no doubt arrive at the wrong conclusions. To which I say: ya, well, so what?

If anything this will be a boon for the NFL by only encouraging more engagement with their fan base.

</comment><comment><USER31> The article basically says "A football match is now like a complicated, high- level chess match. It takes deep understanding to know what's going on, so only those parts of the match that most viewers can understand ought to be screened". This is not sound. By extension one could argue that complicated games should not be screened at all.

</comment><comment><USER32> I have it. Never watched it more than 5 minutes. Unless you're a coach that film is boring. NFL is just entertainment to me, so the real game broadcast matters more than the actual tactics and little pieces of blocking details.

</comment><comment><USER33> An interesting thread was on HN last November about this same topic (which at the time I had no idea about): <http://news.ycombinator.com/item?id=3275698>

</comment><comment><USER34> What's weird about professional sports is that the major franchises seem to think they're doing what they do for their own sake instead of entertaining their customers.

<comment><USER35> That's no weirder than lawyers thinking they're doing what they do to win a case rather than to achieve justice. The NFL entertains customers by being a serious, competitive league, just as criminal justice is supposed to work via an adversarial system. (Before anyone else points it out, let's just say the NFL works FAR better than the criminal justice system....)

<comment><USER36> Don't forget: There's an incentive to win your case SLOOOOOWWWWLY, when you're paid by the hour.

</comment></comment></comment><comment><USER37> tldr: "Oh my, the unwashed masses who pay our salaries get to see the full field and are too stupid to make intelligent commentary on it."

I am having a hard time trying to remember a sport that is more about the show than the actual sport as the NFL. MLB and NASCAR seem to get the whole package, but not the NFL.

</comment><comment><USER38> Sweet. This is really gonna help my Madden game.

</comment><comment><USER39> Are we supposed to already know what "All-22 tape" is?

<comment><USER5> Good point. All-22 tape, which is defined in the article, is footage of a football game that shows all 22 players on the field simultaneously. It is almost certainly not the footage you'll see if you watch a game on television, which follows the ball or, more rarely, individual players.

</comment></comment><comment><USER40> Maybe they should open up their games to be viewable online streaming LIVE and then their service might be worth paying for. It's 2012. Get with it NFL. There has been a world cup and a euro 2012 streamed live online successfully. FREE!

Rewind is nice if you missed something, but not so great because if you are watching a later game on rewind it'll spoil all earlier games.</comment>


Ask HN: Building first B2B product, how to reach them to validate?  - <AUTHOR>

I'm looking to build my first B2B product and I want to validate the concept before writing any code. I've started to put together an informative landing page (still in progress) and I believe the copy is simple enough but doesn't get too technical.
I've sat down with some business owners and I believe they "get it."  I haven't shown it to friends or family who aren't in the industry I'm trying to reach.
The core users (hopefully) will be local bars, restaurants and lounges that have high foot traffic centered around entertainment.  What are the best ways to get the word out to them, get them to the site and gauge interest?
One idea I had was to design a postcard, purchase a mailing list and send it to all of the businesses in the area.  Get people to the site and do the email signup flow, offering $10 off when it launches.  This will cost about $600 for the printing and mailing.
Another idea is to buy ad space through Adwords.  This seems more of a gamble as you have to predict what business owners might be searching for.
What have you done to reach B2B users before your product launches? <comment><USER3> 1\. Go to google keyword suggestion tool and check how many people are searching for something you are building. Say, you are building Employee Evaluation Tool - close to 74K searchers are made every month in US and 135K globally. Competition is medium, so there is still some space for new player. So, yes there is some demand for problem I m trying to solve.

2\. List down top 10 blog post links which talk about Problem your product will solve and post comment on all those blogs in 3-4 lines : first two lines about the post, next two about your project & link. So, you will start getting some traffic atleast say 20-30 users daily from all those 10 blogs combined.

3\. Start creating good relations with people who have given you these emails. Tell them something like : "Hi, Thanks for giving me you email. I am building this product where you will be able to choose pre-made Employ Evaluation forms or will be able to edit them too. What more do you think you will need to solve your problem of Employee evaluation. Thanks."

So, with in 2-3 weeks, you will have really good idea if this thing gonna work or not.

@sharmag88

</comment><comment><USER4> Here are a few tactics to try:

\- Create a resource/freebie that would be of value to your target audience. A whitepaper, an eBook, a guide or template of some sort, etc. Offer it in exchange for email signups.

\- Start an Adwords campaign to get people searching for related terms - <USER2> can usually find codes from Google for $100 free Adwords budget after you spend $25. Use the keyword tool to find related keywords, with good traffic, but affordable CPC. Send them to a landing page with a tailored pitch and a request for email signups (possibly in exchange for your freebie above, or a discount coupon).

\- Once you have an email list, send useful things to it, along with marketing-related things. Try to engage with people on the list.

\- Continue meeting people in person. Ferret out their pain points and see if your product would really solve problems, or just be something interesting. Try to really gauge whether they would spend money on your product.

</comment><comment><USER5> Working with economic development groups in your area. They have large rolodexes and are generally well thought of by their clients. Offer reduced cost in exchange for feedback. Helps you get traction and feedback; makes economic dev groups look good.</comment>


Delivery Apps Like Grubhub, Seamless, and UberEats Continue to Hurt Restaurants - <AUTHOR> https://www.eater.com/2019/5/29/18636255/delivery-apps-hurting-restaurants-grubhub-seamless-ubereats <comment><USER2> Ugh. Restauranting is a difficult business even on the best of days. It barely works, and any shift you make (even one with a net benefit) will throw things off.

Adding a delivery service means you can serve more customers without having to add wait staff or tables. But your existing overhead doesn't go down. You still need the same kitchen and the same line cooks (or more). Your insurance doesn't go down, or your heating and cooling costs, or ingredients. Even an uptick in customers doesn't help if it throws off your ordering, and you start running out of one thing and having to trash another because your customer base changes.

I don't know if I'd blame that on the apps, exactly, though it does sound like GrubHub is being sued over some shady practices which do sound a lot like the kind of shady practices "disruptors" like to play. A restaurant can't just add delivery without a significant change to its whole practice. The delivery itself costs money (even if the provider isn't demanding dotcom-level profits, which they probably are), and the savings aren't as immediate or massive as you'd hope.</comment>


YubiKey 5 Series with New NFC and FIDO2 Passwordless Features - <AUTHOR> https://www.yubico.com/2018/09/introducing-the-yubikey-5-series-with-new-nfc-and-fido2-passwordless-features/ <comment><USER3> I think the YK5's biggest problem is that the YK Neo and 4, which have been out for years, were already so good. Unless you really care about NFC at the same time as RSA-4096, I'm not sure I see a big impetus to upgrade. Hopefully the USB-C line won't be plagued with supply issues.

WebAuthn is mostly boring and I think that's mostly a good thing. I'm glad that there's a way to evolve the spec. Some of the changes are arguably improvements; I could see how Direct Anonymous Attestation is better than the old certificate method. On the other hand, that's more exciting crypto than I want to see in W3C specs. But the vast majority of deployments don't care about attestation at all: they just care that you can register a specific U2F key once (say, during employee onboarding), and then you never have to care about attestation again. So other than crypto-nerdery, I'm going to choose not to care much about (EC)DAA.

U2F keys already do WebAuthn (individual sites doing bogus feature detection notwithstanding). Despite the name, at the end of the day U2F is just a way to sign some stuff so that it can't be replayed and you can't get phished. If you really wanted to use it as a single factor, you could.

I'm not sold that the integration of e.g. the browser's password manager into WebAuthn is super valuable, but I'm still happily monitoring what they come up with. That is not a criticism, and certainly not a deprecation. The bottom line is U2F was great, and WebAuthn not convincing me yet is not a good reason to shy away from WebAuthn. WebAuthn is still the best authentication mechanism we (realistically) have by far. Go use it.

<comment><USER4> > the YK Neo and 4, which have been out for years, were already so good

I agree that the keys themselves are good; I just wish that configuring Linux systems to take advantage of them would be easier. I've been working on setting my systems up in bits of my free time for more than a month now. I'm in my last stretch, but I have to do some weird things. Maybe I'm just trying to squeeze more out of the key than most would.

For example, when I'm in my laptop and I ssh to my desktop and use sudo, I want it to use the key connected to the laptop to authenticate me. At the same time, if I walk over to the desktop and use sudo, I want it to seek the key in the desktop. Same if I use gpg or anything else that wants to use the key.

As part of this, to make use of the key as transparent to me as possible, I'm finding myself making a compiled executable to override gpg and gpgconf to unshare the mount namespace and bind mount a socket specified by environment variable over the default gpg-agent socket, because there seems to be no easier way to override the gpg-agent socket path via environment variable. gnupg seems to have no such environment variable, and while other utilities query the socket path via gpgconf, gpg itself seems to just know what it is... You know what... I'm starting to realize that's not going to work... Programs that query gpgconf would connect to the wrong agent. I gotta figure out how gpg knows the gpg-agent socket path... Since it doesn't call gpgconf, I wonder if it shares an .o file with it...

<comment><USER3> Do you care if the auth is GPG or U2F? Seems like you want -L to forward a socket, and GPG_AGENT_INFO to point to it. I tweeted this series a while ago because it's hard to find how that works: [https://twitter.com/lvh/status/966408198558244864?s=21](https://twitter.com/lvh/status/966408198558244864?s=21)

<comment><USER4> Not U2F because it requires the systems to always have an internet connection. I could setup an authentication server on each machine to avoid that, but I think that would make replay attacks possible (nevermind, see EDIT). Also, since GPG is an option for this, it means that I can just depend on that for absolutely everything. If I break the key in two, I can use an encrypted backup of the GPG key to keep working (authenticating, decrypting, and signing) until I get a new yubikey and write the backup to it.

It's an -R forwarding what I want. -L would require the host I'm logging into to automatically login back to the host I'm at. That's something that raises way to many convoluted issues. By using -R and ControlMaster, and overriding ssh with one that sets up the forwarding first if the corresponding control socket does not exist, I can share the forwarding among all the ssh terminals I've opened to the same host.

I saw GPG_AGENT_INFO on the manpage, but it says that it's an obsolete environment variable that's now ignored. In my system, gpg2 is a symlink to gpg. I wondered if maybe gpg decided to ignore or use GPG_AGENT_INFO depending on $0, but from grepping the source I don't think it does. It only appears on documentation and automated tests. Still, it might be a good starting point to check the source of gpg 1.4 to get an idea of how to patch gpg2 to get the agent path from an environment variable. Thanks for the help.

EDIT: I made the U2F comment assuming that it works like OTP, but there is some material online referring to it as a protocol using a challenge-response mechanism. If that's the case, what I said would be false. Still, I feel I'm close to an ideal with GPG, so I'm not sure there would be something to gain by using U2F. Unfortunately, most of the material online about it is about using it to login to specific web services like Google.

EDIT 2: I was taking a quick look at pam-u2f[1], and I found this piece interesting:

> manual: Set to drop to a manual console where challenges are printed on > screen and response read from standard input. Useful for debugging and SSH > sessions without U2F-support from the SSH client/server. If enabled, > interactive mode becomes redundant and has no effect.

I imagine this is in consideration with U2F keys that come with a keypad. Otherwise, terminal emulators would have to be extended to support an escape sequence with which it could recognize when a challenge has been presented to automatically pass it on to the key connected.

EDIT 3: Extending my terminal emulator like that and using pam-u2f (after extending it to use that escape sequence) would eventually lead to solving the problem of using sudo remotely. However, going the route of forwarding my gpg- agent also allows me to use gpg (and dependents like pass) remotely. It also seems relatively easier since the only step left for me to figure out is how to get gpg to accept the agent socket path via environment variable.

EDIT 4: On "U2F-support from the SSH client/server", I don't suppose adding an authentication method like that would work when chaining ssh interactively (calling ssh to another machine from a ssh session), like how you can forward ssh agents with -A. I wonder if it's possible to add U2F support to ssh agents. I imagine the agent works on a challenge-response mechanism too, in a sense. Maybe the agent can be made to work like a proxy to the key. That way, -A can be made to work to forward authentication to the key.

[1] [https://developers.yubico.com/pam-u2f/](https://developers.yubico.com/pam-u2f/)

<comment><USER4> EDIT 5 (can't edit anymore :( ): I imagine that's what gpg-agent does when working as a ssh-agent, and the ssh server has a public key corresponding to the openpgp card that would be the yubikey. Really, U2F seems to do a subset of what PGP can do.

</comment></comment></comment></comment></comment><comment><USER5> I have an iPhone and a Macbook. It's frustrating that I have to choose between USB-C support for the Macbook, and NFC support for the phone. It's odd that they don't make a USB-C version with NFC.

<comment><USER6> The 5C nano is designed to be plugged in the all the time though, so in that scenario what do you really gain from NFC?

<comment><USER3> Because one day we'd like to securely authenticate to things on phones in phone browsers. (I agree that it's not a big a deal as one may think; it only matters if you're logging in to a critical service via the browser and not the app. If you're using the app, it's the app's problem to make sure that you're talking to the Correct Service(TM), so phishing concerns go away.)

<comment><USER7> BLE solutions are going to work much better for mobile devices than NFC I think. Google already supports it for their apps via SmartLock and Advanced Protection on both major mobile platforms. Its the browsers, and namely Safari, thats being the blocker on iOS right now - both for NFC and BLE solutions.

<comment><USER8> > BLE solutions are going to work much better for mobile devices than NFC I > think

Yubico would disagree. According to their research studies BLE devices are harder to use and less robust.

Source: [https://www.yubico.com/2016/06/yubikey-u2f-tracking- bluetoot...](https://www.yubico.com/2016/06/yubikey-u2f-tracking-bluetooth- maturity/)

</comment></comment></comment></comment></comment><comment><USER9> Just to warn you - although you can put Yubikey 5C on a keychain, it's not robust, and the plastic disintegrates after light use in just months. I had two that got destroyed. Unlike the USB-A, which are highly resilient to wear, the USB-C version are greatly subpar! Given how expensive this is and how important is, it's highly disappointing that they didn't put more thought into the material selection process! Or maybe that was the main idea - make you buy a new key every year.

<comment><USER10> Just so you know - I had the same problem but emailed Yubico recently and they said they made some changes because of this defect and sent me a new one for free. It's been at least 2 months and there's been no degradation like my first one.

<comment><USER9> Thanks for the info! I'm glad that fixed this. I will reach out to them today as I migrated off the old key long ago. If they replace it, I will give it to my 10-year-old son, who uses my old keys. :)

</comment></comment></comment><comment><USER11> Technical Manual at [https://support.yubico.com/support/solutions/articles/150000...](https://support.yubico.com/support/solutions/articles/15000014219-yubikey-5-series- technical-manual):

> Like FIDO U2F, the FIDO2 standard offers the same high level of security, as > it is based on public key cryptography. In addition to providing unphishable > two-factor authentication, the FIDO2 application on the YubiKey allows for > the storage of resident credentials. As the resident credentials can store > the username and other data, this allows for truly passwordless > authentication. YubiKey 5 Series devices can hold up to 25 resident keys. If > RSA keys are used, there is a maximum of three RSA with the rest being ECC.

I wonder what the user experience will be like at 25 resident keys, they mention that the YubiKey Manager (ykman) can set/change FIDO2 PIN and reset FIDO entirely, but nothing about managing individual resident keys/credentials.

It seems like it might be a bit challenging to manage this, especially if end- users accidentally register the authenticator multiple times or run out of the 25 slots for some other reason, and be told that they need to reset the whole authenticator and do recovery for all their sites...

<comment><USER12> My understanding is that for udf / fido2 authentication, keys are not stored but rather regenerated with an HMAC

[https://developers.yubico.com/U2F/Protocol_details/Key_gener...](https://developers.yubico.com/U2F/Protocol_details/Key_generation.html)

I'm curious what these resident keys are for.

<comment><USER3> The spec doesn't insist on it, but that's how Yubico devices do it, yes. It's the straightforward thing to do when your scheme eventually relies on ECDH and there's an obvious and performant way to go from a base secret to a specific- use secret (via a KDF, here HMAC) to a public key (via scalarmult). It'd be less straightforward if your key generation is expensive and complicated.

<comment><USER12> If I'm understand correctly, the resident keys can be used in the case of a non-ECDH scheme and otherwise they wouldn't be used? How flexible is the FIDO2 specification on crypto schemes?

<comment><USER3> I don't understand what you're saying. Which resident keys?

WebAuthn adds a number of crypto schemes -- to wit, I think they add RSA. You can certainly deterministically generate RSA keys but it's a lot more of a pain in the neck than x = HMAC(k, "u2f" \+ custom); P = xG :)

<comment><USER12> In the parent comment link to the technical manual it mentions 25 resident keys can be stored.

It is now starting to make sense to me why. As jiveturkey pointed out, it allows usernames to be stored. And, as you're pointing out, it's useful for RSA or maybe other crypto. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER13> Flicking between the comparison tables at [https://www.yubico.com/products/yubikey-hardware/compare- yub...](https://www.yubico.com/products/yubikey-hardware/compare-yubikeys/) and [https://www.yubico.com/products/yubikey-hardware/compare- yub...](https://www.yubico.com/products/yubikey-hardware/compare- yubikey-4-neo/)

it appears like the only differences between YubiKey 4 and Yubikey 5 NFC is i) the addition of NFC and ii) the addition of FIDO 2 support

The differences between Yubikey NEO and YubiKey 5 NFC appear to be i) The addition of docker login support (?!); ii) FIDO 2; iii) RSA 4096 (PGP) support and iv) ECC p384 (not in PGP) support.

With that in mind.... how widely is FIDO2 deployed? I haven't yet found a two factor app supporting app/site that doesn't support my Yubikey 4.

<comment><USER14> IIRC the NEO only does TOTP over NFC. It sounds like the 5 does U2F over NFC, now?

<comment><USER13> Oh, interesting! That's not called out on their comparison chart for the NEO. That would certainly be a tempting upgrade for any NEO users then

<comment><USER15> Now I've only got one problem remaining: how do I upgrade my old U2F-capable NEO on all the websites? Do I have to keep it with me ad infinitum? I cannot really destroy it either, as I cannot be 100 % sure I've remembered to enroll my new Yubikey 5.

This raises a more generic question: What's the proper upgrade path for hardware authentication tokens?

<comment><USER16> > This raises a more generic question: What's the proper upgrade path for > hardware authentication tokens?

This is the reason why I'm still using only a password manager. I agree that a hardware token more security but the lost/stolen/change key problem is really not easy right now.

I hope there will be a new common API to change all enrollment you have done but it seems hard as the key don't even know them.

Maybe in a future version ?

</comment></comment></comment></comment></comment><comment><USER17> It is annoying you have to choose between USB-C and NFC. I was really hoping I could have both in a new device.

I have a 4C and think it is great - the only downside is the lack of NFC and that only a subset of sites support it, but more are implementing it as time goes on.

I'll probably pick up a 5 as one to store on a keyring for mostly NFC use.

<comment><USER18> Just replied in another thread: it's a few months away, but we'll have usb-c + nfc in Solo (open source security key supporting FIDO2). We'll launch the Kickstarter next week: [https://solokeys.com](https://solokeys.com)

<comment><USER19> Interesting. This solves about half of my problems.

I use four devices regularly: a Windows desktop with USB, an MBP with USB-C, a 6th Gen iPad (Lightning), and an iPhone X (Lightning + NFC).

What I'd really like to see is a small device that lets me use USB, USB-C, Lightning, or NFC with the same token without a handful of dongles to deal with. I get how difficult that is, but I've yet to see anything that supports more than one physical standard. Even USB and USB-C in the same device would solve most of my problem, leaving only my iPad to deal with a dongle due to its lack of NFC.

<comment><USER18> As of today most people seem to want a hole to attach it to a keyring. So it's kind of hard to have even usb-a on one side and usb-c on the other side. Let alone lightning.

If you want to give it a try, we'll open source the hardware soon under CC BY- SA. It'd be great to see what you come up with.

</comment></comment></comment></comment><comment><USER20> Is there an "explain like I'm 5" intro to FIDO2 that explains how FIDO2 as the single factor is more secure than the user entering username (not password) and then using a CTAP1 token? (Also, how do you log in to multiple accounts on the same service with FIDO2?)

How many usernames can a Yubikey 5 remember in the FIDO2 mode? CTAP1 requires no storage beyond a token-wide counter.

</comment><comment><USER21> We'll see. There was barely any uptake of FIDO U2F on the web. Sure there were a few major players, like google, but pretty much nothing financial for the public have taken up anything but insecure SMS/call authentication.

Meanwhile telcos are working hard to convince the public they should all throw in with their insecure telecos accounts as a chain of trust after time and time again showing that your telco account is trivial to steal.

Not convinced on FIDO2, either. It means you need TWO of these devices. One as a backup and another as the common case. Why? Because if you lose a single physical key, you'd have to recover your account. Recovering your account will probably end up being insecure SMS auth or easily socially engineered below- US-min-wage outsourced phone support.

<comment><USER3> Some actors doing unsafe things should not preclude us from building safe things in the mean while. Google/GSuite accounts matter. GitHub accounts matter.

<comment><USER21> The problem is that if poor solutions as far as usability are present, you'll have the telecos win.

This is a race against Mobile Authentication Taskforce and their fundamentally insecure accounts. If the solution can't beat them, it'll get trampled.

Those other "unsafe actors" are trying to completely take over authentication, meanwhile you need 2 $50 hardware security keys at a minimum to safely use this tech. This will lose on consumer pricing and consumer uptake to the insecure Mobile Authentication Taskforce and you won't GET the option to use a FIDO2, because you'll have the choice of insecure mobile auth or nothing.

You have to win against the public or they'll be suckered by bad and insecure authentication that is easier to use, and the things you want to use will be insecure anyways.

<comment><USER22> You don't need $50 products. You especially don't need two of them.

Yubico already make a Security Key that isn't also a PGP key store, a TOTP authenticator, bagel toaster and whatever else for about $20. And there are cheaper vendors if price is the main concern.

<comment><USER23> Why do you say you don't need two?

The argument seems pretty straightforward: if you don't trust SMS, you need to disable all backup authentication. If you've disabled backup, you surely don't your physical device to be a single point of failure?

<comment><USER22> My point was that your backup "emergency" token doesn't need all the fancy features of the 5 series.

It's the backup option, it's the reserve, it didn't have to be the best possible thing, just enough to get you back into the game after you lose the main token somehow.

</comment></comment></comment></comment></comment></comment><comment><USER24> Honest question, what happens when you lose one of these ?

<comment><USER25> For 2FA, having multiple of these or some kind of recovery code tends to be the answer, as you can remove the keys from sites you use it on.

I am less willing to use something like this for passwordless logins. These types of devices should be part of the "something you have" part of 2FA, which should always be paired with a "something you know".

Maybe I'm missing a step here, but why would you ever use this for passwordless?

<comment><USER26> Because the something you know part isn't all that secure anyway?

[https://xkcd.com/538/](https://xkcd.com/538/)

<comment><USER27> it is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - <USER2> fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the secret the more of them you should use.

Note that you quickly get to the point where you need more than one person involved. You can compromise one person as much as you want, but if that person doesn't have the complete secret it doesn't do any good.

<comment><USER28> > The third is something you are - a fingerprint.

A fingerprint isn't "something you are", because it can be destroyed while you remain, and information about it can be captured and reproduced by attackers who are not you.

It's just a particularly hard to lose (but easy to discover, and impractical to replace if compromised, at least more times than you have fingers) "something you have." In security factor terms, I'm not convinced the idea of a distinct "something you are" category is coherent, since most candidates seem similar to that.

<comment><USER27> DNA is something you are.

<comment><USER28> The reason DNA is useful as criminal evidence is you leave it everywhere; that makes it a horrible security factor: like fingerprints it's an impractical to replace wheb compromised "thing you have" that you leave everywhere for attackers.

<comment><USER27> That is a very good reason to not use it alone. However when combined with other it provides a good indication that someone was actually there. Either that, or the attacker went through more effort to get the secrets.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> I'm a LastPass user using Yubikey nanos for both my work and home PCs. But I would like to purchase a Windows 2-in-1 that only has a single USB-C port used for charging and thus a nano wouldn't really work out well. Since Yubikeys, including these latest 5 series, do not support bluetooth, most Windows laptops don't support NFC, and LastPass does not support FIDO/U2F (so Google's Titan bluetooth won't work), is my only option to unplug the charger, plug in the USB-C Yubikey, and plug the charger back in every time I want to log into LastPass? I'm kind of an end user with this sort of stuff...

<comment><USER30> LastPass Enterprise supports Duo, which then allows you to use FIDO/UTF there if you enable in the DUO admin panel.

<comment><USER31> SMS as a 2FA method can't be disabled for Duo administrators. Sim takeover or GSM sniffing attacks can take over the whole account. Mentioned this to their support many times. They don't care.

<comment><USER30> Interesting, didn't know that

</comment></comment></comment></comment><comment><USER32> The difference between WebAuthn and U2F isn't really clear to me, but I hope the older generations will continue to work with common browser's FIDO2 implementations for a long time to come. YubiKeys are great, but too expensive to replace on a whim every year.

<comment><USER33> U2F can only be used as a second factor. FIDO2 can be used as a replacement for a username/password, so you can go to a site, insert your FIDO2 key and log in without any other information.

Old Yubikeys only support U2F, and there's a Yubico FIDO2 key. Browser support isn't there yet, I've been trying to write a Django library for it but no browser will support the complete FIDO2 flow as far as I know.

<comment><USER32> Ah, that's perfect. A hardware token as the /only/ factor sounds like a bridge too far anyhow.

<comment><USER33> I don't know, it sounds perfect to me.

</comment></comment></comment></comment><comment><USER34> This is fantastic! I'm super psyched about this.

> _Works on Microsoft Windows, macOS, Linux and on major browsers such as > Chrome, Firefox, Safari, Edge, and Opera_ [1]

I looked everywhere for documentation of Safari support but came up empty- handed. Does anyone know where this is documented? I've been waiting for this since forever.

[1]: [https://www.yubico.com/product/yubikey-5-nfc/](https://www.yubico.com/product/yubikey-5-nfc/)

<comment><USER35> Looks like Webauthn support is being added to Safari.

[https://bugs.webkit.org/show_bug.cgi?id=181943](https://bugs.webkit.org/show_bug.cgi?id=181943)

<comment><USER34> Great find, thank you! This is exactly what I was looking for. Weird that it's nowhere to be found in the Safari 12 release notes.

<comment><USER35> I don't believe support is in 12, I think it will be coming in a future release.

<comment><USER34> Hmm. Yubico claims Safari support exists right now on their sales page.

</comment></comment></comment></comment></comment><comment><USER36> Isn't WebAuthn backwards-compatible with FIDO 1? I was under the impression that it was (based on some of the things I read in the WebAuthn spec).

<comment><USER18> Yes, it. In fact most browser currently still implement U2F.

</comment></comment><comment><USER37> Wow, this looks really cool. Yubikey 4 lacked NFC support so with 5 it's easy to use the same key via USB-A (laptop) and NFC (via OpenKeychain on Android).

It appears that RSA 4096 keys can be used via NFC, no other NFC-capable keys have this.

One issue is that the algorithms did not change compared to 4. No ed25519, probably due to no tamper-resistant parts with this on the market.

<comment><USER38> Also the highest ECC is still p384 and does not support p521.

However it is still really nice that it support rsa 4096 over NFC now.

<comment><USER39> I'd rather they support X25519 and X448 anyway.

<comment><USER40> Maybe their FIPS-140 certification prioritized the NIST curves? (speculation)

</comment></comment></comment></comment><comment> m-p-3 Glad they brought back NFC, I had to choose between NFC (Yubikey Neo) or 4096 PGP keys (Yubikey 4).

I went with the 4.

<comment><USER41> I had same dilemma. I hope one day I'll be capable to read securely encrypted emails on my phone.

</comment></comment><comment> village-idiot I've always been fascinated by these, but never had a justifiable reason to get one.

The only use I could think of was protecting my LastPass account, but I figured my main risk there is their security getting breached, which Yubico wouldn't help with.

<comment><USER42> I have one of the old blue U2F tokens (~20 EUR), and pretty much only used it for GMail so far. That alone is worth it to me because many other passwords can be reset by someone that gains control over my email account.

I personally find the token much more convenient than a TOTP code via app on my smartphone. And the U2F/FIDO part is very interesting as it eliminates phishing as a risk.

I ordered a Yubikey 5 NFC just now to play around especially with the NFC part and see if I can do something useful on my phone with that. I'm still looking for a password manager that could use an NFC Yubikey to unlock it on a smartphone.

<comment><USER43> > And the U2F/FIDO part is very interesting as it eliminates phishing as a > risk.

How does that work? Can't the challenge response be MITM?

<comment><USER44> The browser sends the domain as part of the request to the U2F key; so a MITM would need to be a true network-level MITM and not just a fake website MITM. The user would then have to ignore the cert error as well.

I'm not saying it's not impossible, but the it's not the primary attack U2F is designed to prevent.

</comment></comment></comment></comment><comment><USER45> Wonder what version openpgp their applet support, current app on Yubikey 4 and prior versions doesn't support ECC.

<comment><USER46> This doesn't do it either [0], unfortunately :(

[0] [https://www.yubico.com/products/yubikey-hardware/compare- yub...](https://www.yubico.com/products/yubikey-hardware/compare-yubikeys/) \- "ECC applies to the smart card applet only; does not apply to the OpenPGP applet. ECC P256 is the key type generated for the U2F keypair."

</comment></comment><comment><USER47> How many e.g. gmail accounts can be supported on a single key? I've got probably five gmail accounts.

<comment><USER48> Unlimited! Except for passwordless credentials, which do consume storage space aboard the device. But second factor (U2F style) credentials are stored encrypted on the server, so there's unlimited "space" for them.

</comment></comment><comment><USER49> I look forward for a more robust and durable hardware design. Maybe a ruggerized version?

<comment><USER38> I don't know how much more ruggerized you need it. It's already pretty dam strong. I've had a neo on my keys for years and it shows no sign of ware.

They already are water proof and can be run over by a car. So unless you want to take a hammer to it, it should be rugged enough.

<comment><USER39> I'd be more concerned about general reliability. How long will these last? Because I think they should last at a minimum 10 years. If you only use one for an account, and it breaks on you, you're screwed.

So I would use at least 2, but hopefully websites will allow this, and that will probably be the largest bottleneck in the future. I couldn't care less about "SMS backups" or such nonsense, as that completely defeats the point of using a hardware token. Your account will only be as secure as your phone number is.

<comment><USER50> I configure a second YubiKey as a backup, and disabled SMS-based recovery where possible.

Many sites allow this explicitly, and will let you view details about the last time each key was used to log in.

Some sites that use TOTP only allow for one "authenticator" to be configured. In those cases, I scan the same QR code into each key.

This process requires you to retrieve your backup key from whatever safe place you store it in when configuring 2FA on new accounts, but that feels like a reasonable trade-off; I don't make new accounts very often, and when I do I can wait to configure 2FA until I have access to my backup key.

</comment></comment></comment></comment><comment><USER51> Could a username + U2F token be used as authentication?

<comment><USER48> If the server allows it, sure.

</comment></comment><comment><USER9> I just tried to order one. My credit card got charged twice as I attempted twice, got errors on their website, and the customer service rep Rachel in the online chat is behaving highly unprofessionally. My other attempts with another card were flagged as a possible fraud - obviously, their reputation among the credit card processors is not stellar. I think I'm done with Yubico and will be waiting for my Titan key from Google and consider the open-source SoloKeys as well. I think I've invested enough money in Yubico and what I'm getting back is not enough to justify the costs of this luxury. Their shortsightedness not to offer NFC on the USB-C version and to make the 4C/5C Nano so extremely hard to pull out is a clear sign they no longer are a good choice. And for quite some time, they haven't been the only choice either.</comment>


Kansas man calls for 'trial by combat' for custody dispute - <AUTHOR> https://nypost.com/2020/01/15/kansas-man-wants-to-settle-ugly-custody-battle-with-trial-by-combat-with-japanese-swords/ <comment><USER2> This particular article may seem bizarre, but I believe we need to acclimatize to this.

As the oceans rise and Florida cities are inundated, Florida men will disperse, likely to other coastal areas. But we haven't yet felt the long lasting effects of Kansas Governor Sam Brownback's "grow-oriented policies" that all but defunded Kansas' schools. I predict that "Kansas man" will become the "Florida man" of the 2030s, with "Nebraska man" and "Oklahoma man" as also-rans.

</comment><comment><USER3> Frankly I think this is brilliant and should be commonplace. Ok, perhaps not with swords or guns to the point that someone actually dies, but given the absurdity of my own legal issues, some kind of foam-noodle-whilst-balancing- on-a-moving-object-over-a-swimming-pool type duel would have been faster, cheaper, and more effective judgement.

<comment><USER4> so a person's ability to fight is used to resolve judicial matters?

seems... unfair.

</comment></comment><comment><USER5> They probably watched too much GoT or played too much WoW. That said, I welcome the implementation of Mak'Gora [1] to settle disputes.

[1] - [https://www.youtube.com/watch?v=8NRLuUnpGYg](https://www.youtube.com/watch?v=8NRLuUnpGYg)</comment>


Ask HN: Does this concern anyone else? - <AUTHOR> http://www.alexa.com/siteinfo/ycombinator.com

<comment><USER2> As they say in Samoa, fai fai le mu (: Relax. Sites evolve and change. Small towns get bigger. Eventually you become an old man who yells at neighborhood kids for walking on the lawn. Before you get to that stage, enjoy the fact that these systems evolve, and for every one that gets too big for your own personal tastes, there are a multitude of smaller ones. And then there are even your network of actual friends. Take it easy (:

<comment><USER3> Maybe. But it's still sad to see this site change into a big site with a wider audience. I definitely care less and less for the "discussion" that takes place here, which is frustrating to watch. Perhaps I'm just feeling pessimistic, but it seems like recently the tide of new visitors is too large to be assimilated without permanently changing HN's culture. Damn, maybe I am getting old...

EDIT: I also seem to recall that constant vigilance about the site's quality has always been a topic of discussion here. It's definitely healthy to raise a concern or two every now and again

<comment><USER4> How to say this without getting moderated into the ground...

Look, this site is what you make it. If you do not like the conversations, then start your own by submitting the kind of content that you'd like to see or at least participate.

You've been here almost 2 years, in that time you have not made a _single_ submission and one of your 20 comments in that time is about how you don't like the direction the site is going in.

If you don't like it then take action, change the discussion to contain those elements that you care about and use your mod points to promote the content that you think contributes to the discussion most.

There is an awful lot of 'oh, I really don't like the direction HN is going in' here, as well as 'it used to be so nice'. I don't get that, it's pretty good right now, there is a _TON_ of interesting stuff posted and discussed here.

I haven't been here nearly as long as you have, and I concur there are some 'growing pains' but on the whole it is pretty good. Help make it better!

<comment><USER3> I agree that users should participate if they want to make the site better. And yes, there still are interesting posts. Still, I see people getting modded up for saying "go with the flow," and modded down for questioning the site's direction. First of all, these are OPINIONS, usually not worthy of up _or_ down mods.

I guess what I should have said was discussion about this site's direction used to be an important part of HN, and I wanted to continue that tradition.

<comment><USER2> Introspection is very healthy and worthy, I agree. My response was meant to counteract a little of the alarmism. As for opinions getting mods, that's generally how it works- in a way every post is a poll and you get people agreeing with that opinion or not- everyone understanding that it's really just an opinion. It's certainly rarely meant to be personal.

In short, if someone is modded down for questioning the site's direction, people are indicating that they respectfully disagree for the most part. (Man, I must have reached some kind of zen state today.)

</comment></comment></comment></comment></comment><comment><USER4> Well, first off, alexa.com is to be taken with about a pound of salt because of their way of sampling, even so, obviously something happened (maybe half the HN visitors decided to install the alexa toolbar).

Also, other such institutions can show wildly varying data, for instance have a look at 'compete' for ycombinator.com:

<http://siteanalytics.compete.com/ycombinator.com/>

It tells quite a different story.

The final arbiter here would be the log files of HN or some third party logging service (but HN doesn't use any of those afaik).

The traffic rank that alexa ascribes to news.YC is not in line with what I would expect at all (~5500), at that level HN should be seeing 150K uniques daily and I doubt that from the activity on the forum.

<comment><USER5> Traffic to HN was around 30,000 uniques per day at the end of April (source: <http://ycombinator.com/newsnews.html>)

<comment><USER6> I have a site with 20.000 uniques per day and the 3 month average rank in alexa is 7,771 so it seems pretty accurate.

Before alexa changed the ranking system it used to be on the top 1000.

</comment></comment></comment><comment><USER7> Which part? Concern?

Interestingly, the growth over the last 6 months has been fairly consistent.

Check out the 'max' option, and from the start of the big jump in January, its been quite consistent.

I think things on the site have remained pretty good through the growth, but then again, maybe it is the constant evolving change. I'm curious how different the entries are from last year.

I think there is less a risk of the quality of HN degrading due to the fact that most people don't submit.

It would be interesting to see the stats on what % of users submit, what % leave comments, what % vote, and compare that with overall visits.

I suspect most of the growth has come from readers only. What do you say PG? have you got those stats?

<comment><USER8> I am not sure but I think what has gone unspoken here is the recent decline in quality of content on this site. Perhaps this is why he's concerned?

<comment><USER9> I think the quality of Hacker News is sort of like Escher's "Ascending and Descending" (<http://en.wikipedia.org/wiki/Ascending_and_Descending>).

People perpetually talk about how the quality is going down, when in reality it's not changing much at all.

I attribute it to the "honeymoon effect". New users are excited when they first find HN, but eventually the amazement wears off, even though the site hasn't changed.

<comment><USER10> Possibly - but don't deny that this stuff doesn't happen. You may have been around for Reddit, and that's most definitely changed for the worse since when I started there (I've since quit). Turning into Digg and all that.

<comment><USER8> Reddit is still a fantastic place for discussion. Also it arguably has a better interface i.e. orange mailbox, saved links, etc. Perhaps not for startup stuff, but for politics & pop culture I think Reddit continues to do as good a job as anyone. Also, its tough to criticize Reddit with a blanket statement considering there are many independently moderated subreddits (arguably including this very site).

</comment></comment></comment></comment></comment><comment><USER11> The biggest thing that I've noticed is that it's becoming more and more rare that I'll recognize all the names in the comments.

It used to be that you would go into the comments section and it was the same herd of people talking, which was really useful because you didn't have to judge every comment on its own. You had an idea of where most of the commenters were coming from because you'd read a lot of their other comments. You knew if they tended to get their point across with sarcasm, or that they were really working on a startup that was very similar.

There are people here that I disagree with a lot of the time, but I have a ton of respect for their opinions because I know that they've always really thought about what they were saying and haven't just come in to stir up the pot.

With all the new faces, people get concerned because they don't know all these people so you have to judge every comment on its own.

In a way, it's like a favorite old bar suddenly becoming a hot night spot. The same people are still there, but there are _all these other people_. It's the same bar, but it's a different experience. Either all the new people will mesh well with the old people and it will be good for everyone, or they won't and the old people will find a new favorite place to hang out.

The only certain thing is that it will never be the way it used to be again.

</comment><comment><USER12> I hate to to have to say this, but could we please have more descriptive titles? You can tell from some of the comments that a lot of people, myself included, are trying to figure out what would is so concerning on that page.

Also, the post title seems to be deliberately trying to manipulate readers into clicking through. HN isn't a newspaper that has to grab eyeballs with exciting headlines. Anyone worried about the "decline" of HN should be worried about posts like this.

</comment><comment><USER13> It's highly likely that many startup founders have installed these types of toolbars to boost their own startup's numbers. Because of sampling issues, one additional person coming to this site gets extrapolated out many times over.

Rampant themes in most groups: 1\. It was better before. 2\. Quality has declined. 3\. New people do not respect the rules.

Stop being so paranoid. Or if you can't stop, start a new outpost for hacker- like discussion somewhere else on the web. Only invite good people. When the rest of us realize that this place has gone to hell, we can come join you. :-)

"Oh, my God, they found me, I don't know how, but they found me. Run for it Marty!" - Dr. Emmett Brown

</comment><comment><USER5> It's interesting to note the significant drop-off on weekends in Alexa's data.

<comment><USER14> I think every website on the planet experiences that.

<comment><USER4> It depends. If your focus is 'media/entertainment' you actually go up in the weekend.

<comment><USER15> I can confirm that, I own a computer games-focused site and our peak is on the weekend, too, with Sunday being the busiest day.

</comment></comment></comment></comment><comment><USER16> didn't pg post a HN link, that just shows posts from only old users?

<comment><USER17> news.ycombinator.com/classic only counts votes from users more than a year old

<comment><USER11> At the risk of sounding curmudgeonly, I would really like a 2 year old version of /classic as well.

news.ycombinator.com/getoffmylawn would work if pg needs a URL suggestion.

<comment><USER18> Actually, getofmylawn would omit anything except for "everything was better in the past". Now, statistical analysis of that might yield some interesting results, but otherwise it would be pretty boring.

</comment></comment></comment></comment><comment><USER19> which bit exactly?

<comment><AUTHOR> The 37% increase in volume + some stuff that's showing up on the front-page, I fear HN is under siege

<comment><USER3> Why is this at -2, exactly? All mILK did was respond to a question. If people don't like the response, they should at least post a reply.

<comment><USER20> I didn't downmod it, but I don't feel compelled to "correct" it back to 1. I grow tired of "the sky is falling" comments, and I guess some others do, too.

</comment></comment></comment></comment><comment><USER21> Does <http://twitter.com/newsycombinator> have anything to do with it?</comment>


Writing system software: code comments - <AUTHOR> http://antirez.com/news/124 <comment><USER2> When I interview for jobs, one of the questions I ask is where the team and engineering org stand on code comments and what state of documentation do they have for legacy code. It's a good question because people will use excuses like IP protection to avoid talking about the ugly truth of the state of their actual code, but if you're just asking about comments and documentation, there's no reasonable way they can deflect the question. If they won't answer it, well, you've got your answer.

Any place that takes an attitude of "code should be self-documenting" I just walk away from. That is a type of dysfunction you're not gonna be able to solve. Also places that say, "we're always evaluating new ways to improve documentation practices..." begs further questions to get the specifics out of them.

For most jobs, I know I'm going to have to deal with bad legacy code. But if there is also a culture of not documenting things, arguing against comments or formatted API and function documentation, and it results in documentation spaghetti of Google docs, Markdown files, spreadsheets, emails, confluence pages, etc., then there's no point. I can't help you.

<comment><USER3> I don't care about comments, I care about unit tests and I need to run trough code with debugger. If code is testable I can run piece of code in isolation and understand how it works. Most of the time people do comments:

 _a = 4 //assign value 4 to a_

Of course that is exaggeration but usually they restate obvious things and think it is good comment.

Also I don't trust comments, I have to see commit history, and if I see there was piece of code changed where comments are, without stepping through and debugging I don't trust code is doing what comment is saying.

I do not know how other people are writing code, but I have to run code locally, ideally in unit test or click through in the interface with test data. Maybe others just can run code in their heads and account for what is written in comments. But unfortunately I am not human compiler/runtime/processor.

<comment><USER4> > _Most of the time people do comments: a = 4 //assign value 4 to a_

When I see people arguing against comments, I see this strawman _again_ and _again_ and _again_.

In my multiple decades of programming I have _never_ seen anybody write a blatantly redundant comment like that. It's not "most of the time" that people comment like that, in my experience it's _never_.

Programmers have a job to do, and in my experience generally do not waste their time using comments to "restate obvious things and think it's a good comment". Rather, they comment when necessary to explain the _why_ , or to provide a concise 2-sentence description that would be too long for a function name but lets you skip reading the next 30 lines of code which would take much longer.

I really wish people would stop using this strawman of "most comments are redundant/obvious anyways, therefore don't comment". I mean, maybe you personally did have the terrible luck to work with a codebase that was actually like that... but I personally have never seen it.

<comment><USER3> So you are working with experienced people. It looks I don't have such luck, I have to look at lots of junior code.

Juniors think that they should write comments and then they waste time writing epic descriptions of trivial things. They waste time writing whole story of creating simple piece of code in one commit message. They waste time deliberating if tabs are better than spaces.

<comment><USER5> My personal anecdotal evidence is that they are not junior in the organizational chart. I'm just a contractor. They are a part of the company. Who am I to tell them they shouldn't comment "what" and "how" after every line they write?

This job made me hate inline comments. If I were to ever create a new language, I'd insist in there being no way to write comments in the same line as executable code.

</comment></comment></comment></comment></comment><comment><USER6> A type of comment I miss here are "section headers".

I tend to organize my files into paragraphs or even sections of paragraphs. I often use "section headers" to distinguish these. It is essentially a weaker version of splitting a file across multiple files.

For example, I am working on a very simple pre-processor, and I have split it into 4 sections. The first is unmarked and presents the public interface. After that is a section marked simply by the comment "Lexer", after that is a section marked by the comment "Parser", and finally there is a section marked "TURN BLOCK BACK INTO TEXT". That last one should probably be changed to something like "Process result of parsing".

Sometime, my 'paragraphs' of code also get a short line comment explaining what the entire paragraph does. I guess that would generally fall under the 'guide comment' category.

<comment><USER7> Why not have each of those sections as a separate file?

<comment><USER6> It's a balancing act of-course. The total file is ~200 lines at the moment, breaking it up would create some very small files, and generate a lot of 'including' boilerplate.

Moreover, it would make it more difficult to understand the whole thing. The lexer and parser are closely coupled (by the data type for the tokens) and the parser and 'processor' are closely coupled by the data type of the syntax tree.

I could still see it happen that it does get split, and there are certainly coding styles that would have split this without question.

</comment></comment></comment><comment><USER8> I'll take well-named variables, functions, and classes over code comments any day.

It's a chore and and half to plow through code in which the author has, for whatever misguided reasons, shortened variable names to inscrutable abbreviations, acronyms, and single letter head-scratchers.

Context-switching between comments and code may be easy for the author, but isn't good for the reader.

More often than not, the short-variable tendency points to an even worse problem: the author hasn't though very deeply about the software at a high level and therefore hasn't developed a good vocabulary or conceptual framework around the problem space.

<comment><USER9> The best is the code the more and better the comments usually... No mutual exclusivity.

</comment></comment><comment><USER10> Thank you so much for this article.

Just because a developer thinks their code is a gift from the gods and understandable by all doesn't make it true.

Code is the what. Comments are the why. You can't expect the developer's intent to come out through the code alone.

<comment><USER11> Writing good comments is not necessarily easy task. When you're writing code, everything seems obvious. You can write obvious comments, but they won't help. I think that best comments would be written by someone who came later and had to understand the code from the scratch.

<comment><USER12> I do this:

#1 If anything in a pull request isn't blindingly obvious, ask a "why are we doing this here?" style question.

#2 Encourage all developers to do this on all pull requests.

#3 Get developers to answer those questions in the form of a pushed code comment rather than (or as well as) answering the comment. Make that an iron rule.

IMHO this gives the best comments. I'd usually discourage comments that don't come about like this.

</comment></comment></comment><comment><USER13> Very nice article and good job on the classification of comment types.

For small tools that I have written myself I prefer the guide comments because I usually know the general design of the program but need some help to remember the order of the things done inside a function/procedure/method. But the more complex the application, the more higher-level comments are needed.

Note that the guide comments can also appear in the form of function comments. For example, you see sometimes the networking function written like this:

        ...
        logLinkDisconnectionWithReplica();
        freeQueryBuffer();
        deallocateBlockingStructures();
        ...

In that case the the function comments of the called functions are actually the guide comments (edit). I have the impression that this style of programming is popular among smalltalkers (please correct me if I am wrong).

It is also interesting to see how the comments depend on the expressiveness of the programming language. For example, you can see a lot of "trivial" comments in assembly code because even simple things (like incrementing a counter) sometimes need code that is not easily readable. In Java, you see less comments like "This method throws an IllegalArgumentException if ..." because the programmer thinks that the list of checked exceptions in the method defnition are sufficient. In a language that I just made up for this comment, a procedure with signature

        getPerson : (name : String not empty) -> List(Person) not empty | Nothing

needs less function comments than

        struct list *getPerson(char* name)

<comment><USER14> While true, even staying in the realms of straight C that function could have been improved.

        typedef struct list *person_data_list;

        person_data_list getPerson(const char const *name);

Yes it still does not provide all the necessary information, but it already does provide a bit more.

</comment></comment><comment><USER15> There is a middle way between _code comments_ and _" my code is self- explanatory"_ though, doesn't?

A problem with code comments is that it very easily becomes outdated. And if the same method keep changing for different reasons, the code comments might become rather long.

I believe a good practice is to avoid code comments and document the why in the commit messages and PR descriptions. This way is easy enough to git blame and go to the "why" whenever a code is not self-explanatory

<comment><USER16> There's a particularly good example of this risk in the article:

        /* Unlink the client: this will close the socket, remove the I/O
         * handlers, and remove references of the client from different
         * places where active clients may be referenced. */
        unlinkClient(c);

I wouldn't trust a comment as technically detailed as this one to stay in sync with code changes to unlinkClient.

</comment></comment><comment><USER17> Great article, comments are unfortunately too underappreciated.

I sometimes write in (zSeries) assembly and I use guide comments a lot, on almost every line, to say what is the value that the resulting register will hold.

I also sometimes use backup comments for code that I wrote at some point, but then it wasn't strictly needed, but I still believe it might become useful in the future. You could have it in Git, but then the information that this code is already in Git is lost.

</comment><comment><USER18> Really nice article. While I'd quibble about some of the details, this categorization of comments is really good. Really good discussion around each category too.

Not sure if is a separate category or not, but I often do Quirks type comments especially when dealing with APIs of libraries with links to relevant documentation ( even if though those links may go dead at some point, I'll capture the essence of the quirk in the comment and leave the link )

<comment><USER19> Get a browser plugin to single-click archive the documentation with archive.org, then include that link in your comments. Yes, I do exactly this, I'm not just sniping!

</comment></comment><comment><USER20> I really appreciated this taxonomy! It lines up with my own experience; but I've never thought about it this thoroughly.

One specific type of comment that I've found valuable is a sort of BDD in my tests.

      testMethod() {
        // GIVEN a <specific type of thing>
        <setup code>

        // WHEN the <specific operation is done>
        <do the thing code>

        // EXPECT <specific effect>
        <assertion code for the effect>
      }

These are like "guide comments" but with more structure. I find that they help write tests and also make reading tests transparent.

</comment><comment><USER21> A lot of disagreement and talking past each other in this thread.

One unacknowledged facet: Code with different purposes requires different levels of commenting. If you're (say) implementing a UI, you can often avoid commenting through good naming: `saveDocumentButtonClicked()`. But if you are implementing the C++11 spec, you should provide liberal references to that spec in the comments.

Comments become more important as the code becomes more forced and less natural.

</comment><comment><USER22> From the article: "For quite some time I've wanted to record a new video talking about code comments for my "writing system software" series on YouTube. However, after giving it some thought, I realized that the topic was better suited for a blog post, so here we are."

Kudos! I wish more "content creators" realized this. If you have something useful to say, it is much easier for your audience to read it at their own pace, instead of having to listen to someone talking, sometimes with a weird accent.

If your topic is about something that need the visual presentation, by all means, video is cool (although often a bunch of screenshots, graphs, or other imagery is better), but if you just want to talk about something, it's a waste of everyone's time and resources.

But I guess monetization is better on youtube, huh? _rolls eyes_

</comment><comment><USER23> Great article. I like "debt comments" though, no point hiding defects really.

<comment><USER6> It depends on what kind of code you are working on. Having 'debt comments' in production code could be taken as a suggestion that code should not be in production.

What I really like are "This is fine, but with effort it could be done better like this" comments, which one might also call 'debt comments'. For example, if you have a brute-force search on something that could be done by bisection.

<comment><USER23> Let's rewrite this: there is a point to hiding defects... if you are a contractor or looking for a promotion.

<comment><USER6> Alternatively, one should address defects by fixing them not just marking them.

<comment><USER23> You can't address them later if you've forgotten where they are. Maybe there is no time "now".

</comment></comment></comment></comment></comment><comment><USER24> Great categorization!

Re. Guide comments - I usually try to make a smaller function with an appropriate name and then call the function. So long function become a series of invocations to smaller functions. This eliminates most guide comments IMO.

<comment><USER25> I came to make a similar observation re guide comments, with the difference that guide comments with inline code is better in most cases than a sequence of small function calls.

I've often wondered why my code style is moderate inline blocks with guide comments when I know about the benefits of good naming and self-documenting code. In the end, I find it more effective. By encoding in function names, you've (technically) eliminated comments but now buried what it actually does somewhere else meaning the reader must navigate to verify it does exacty and only what each reader infers from the name. I much prefer having a function of a small-medium logical size that I can hold in my head all at once and see relevant details without navigating away from where I'm reading/editing.

My experience is that less depth and fewer single-use functions aids overall comprehension similarly to how flattening as in list comprehensions or filter/map pipelines buys more headroom. I can imagine building/using DSL where everything is well-named and free of guide comments but I have never encountered such a thing where there are multiple committers using a procedural language.

</comment></comment><comment><USER26> I think code comments should play much greater role in code management - i am trying to get this right - [https://github.com/mikadosoftware/todoinator/blob/master/tod...](https://github.com/mikadosoftware/todoinator/blob/master/todoinator/todoinator.py)

the docstring is my goal ... still waiting for time on the commute to dig in but thoughts welcome

</comment><comment><USER27> This article sums up all the reasons why I think documenting your code is important. But unlike the author, I take my comments one step further and generate documentation from them with my literate programming tool (for C#): [https://johtela.github.io/LiterateCS/](https://johtela.github.io/LiterateCS/)

</comment><comment><USER28> If programmers were half as clever at writing self-documenting code as some of them are at explaining why writing or reading comments is never a good idea, there would be no use for comments.

</comment><comment><USER23> +1

What is this "self-documenting" code and where can you read it?

<comment><USER29> It's either code that is purposefully built to turn into nice documents (using something akin to Sphinx or Doxygen, potentially hosted on readthedocs.org) or a tongue-in-cheek excuse for not writing documentation.

</comment></comment><comment><USER30> Document the why, not the what.

</comment><comment><USER31> Great analysis of comment types. I tend to do all the first six, including the guide comments. I can't understand people who think code should be completely self-documenting. There's always so many edge cases. Are they seriously never puzzled by past code they wrote? Every time I go back to any projects I haven't touched in a couple of months I'm always a little disoriented, and it was all code I wrote! The fewer comments I wrote usually the more I regret it later. Guide comments in particular just make it so much easier to find my place again.

And I'd go as far as to say they're almost mandatory for any math related code with a lot of complicated conditions. It's 100x easier just reading the guide comments. Not that they should repeat the if statement exactly, that's pointless. But describing what's happening (the bigger picture that is) really helps imo, and adding an example is even better. I try to keep them short though, single sentence, usually 1 comment for every 5-10 lines depending on the complexity of the code. For example, I was writing a sort of panel/window manager, it had a ton of conditions that looked like:

       if (area_left < current_left) {/*...*/}
       if (area_right > current_left && area_right < current_right) {/*...*/}

You could probably figure out what was going on if you saw it was inside the resize handler for a panel (current_*) and looping through all the other panels/areas, but something like "// finds any areas that will limit our movement" right above the ~10 line section is so much easier to understand. For more complex situations I might have added a visual description as well: "// e.g. given panels [1][2][3] - when dragging a side of #2, find any limiting panels to the right (#3) and left (#1)", though usually I keep the examples to function comments.

I'm torn about debt comments though, especially for protoypes/beta projects where they're the most common. On the one hand, if they're in the code, it makes finding where changes for certain features should be added easier if you add them consistently. On the other hand, it's then hard to see an overview of them all. Putting them in their own file makes it easier to manage them and helps me remember what I was working on, but then I have to go hunt down all the places the functionality needs to be added to. Maybe some combination would be better. Like naming them something specific: "todo - feature - somefeature" then having the details of somefeature in the todo file. Or another solution might be to use headers as someone else has described, then refer to the filename/headername/s that need to be looked at in the todo list.

Usually imo, the more comments the better, so long as none of them are outdated (working alone though I haven't really found this to be a problem). You can always remove comments, it's much harder to add them in months after you wrote some code.

</comment><comment><USER32> In my world, the test suite is a better "why" than code comments.

<comment><USER13> What was hard to write should be also hard to read! /s

<comment><USER32> Why read the code when you can read the out of date comments! /s

<comment><USER33> If comments are out of date you're not doing code reviews.</comment></comment></comment></comment>


Transformation at Yahoo Foiled by Its Leader's Inability to Bet the Farm - <AUTHOR> http://www.nytimes.com/2015/12/03/technology/transformation-at-yahoo-foiled-by-its-leaders-inability-to-bet-the-farm.html?_r=0 <comment><USER2> > _But that's the trouble: Marissa Mayer wasn't hired to do the safe thing. > She was picked to be bold, and so far, she has failed._

While I agree that Mayer's term hasn't been great...I never got the impression that she was hired to do move fast and break things until Yahoo was back in the game with Google...wasn't the hot take that she could be counted not to screw things up as Yahoo's investors struck it big on the Alibaba investment? Was there ever the implication that the board would be cool with it if she decided to go for broke in such a way to spoil the Alibaba windfall?

However things end up for her, I hope we get to hear a little more about their acquisition strategy. Tumblr seemed like a reasonable thing (though sure, Yahoo doesn't seem to have done much to capitalize on it)...but what about all the other acquihires that were ostensibly done to bring in engineering talent? How many of those engineers stuck around to become pioneers within the company? I think shoveling out millions to bring in unique talent is a great idea...but I'm guessing there's a huge difference between giving a suitcase of $30M in cash to bring in someone like Peter Norvig/Jeff Dean/Guido/etc, versus bringing in a 17-year-old entrepreneur [1].

Yahoo did receive a lot of attention for the money it used to bring in _media_ superstars such as Katie Couric and David Pogue...but speaking as someone who has worked in journalism...that's not a viable strategy for turning around a tech company.

I hope one acquisition Yahoo makes is Foursquare/Swarm...I hear so little about 4SQ that I have to wonder if it's on life support (though maybe I'm vastly underestimating how popular it is in NY compared to SF?)...having another location-based social service between Google and Yelp seems as vital as keeping Tumblr around in the fight between the web and Facebook...and location data and engineering seems like it could find an easier fit into whatever Yahoo's tech strategy is (versus, say, buying Path/TaskRabbit/Lyft/Quora/Evernote, etc)

[1] [http://allthingsd.com/20130325/yahoo-paid-30-million-in- cash...](http://allthingsd.com/20130325/yahoo-paid-30-million-in-cash- for-18-months-of-young-summly-entrepreneurs-time/)

<comment><USER3> _> wasn't the hot take that she could be counted not to screw things up as Yahoo's investors struck it big on the Alibaba investment?_

Why would you hire someone with a background in products if you don't want to see new products?

<comment><USER4> Perhaps it was an acknowledgement that their own product portfolio required a shakedown?

</comment></comment></comment><comment><USER5> it seems like there is a wave of critical articles about Mayer's tenure and results (mostly lack of it). I'd wish it were that people are finally starting to see the reality. Unfortunately, i think, it is just some activist investors causing that wave. A wave of the same pure buzz/hype type that was the "Mayer admiration" wave in the beginning.

</comment><comment><USER6> Seems like these articles can be written by anyone. "She wasn't bold, blah, blah". And if she was bold and failed "She was being too risky, blah, blah".

</comment><comment><USER7> Hindsight is always 20/20, isn't it?

This is an easy assessment to make, to say she didn't do something risky without considering that something risky would have a big chance to fail spectacularly.

The comparison to Apple is particularly interesting. Before Jobs came on board, many people suggested Apple to ditch the hardware business and focus on software, like Microsoft did. In the end, Jobs came in with the unheard of idea of building attractive hardware. Who would have anticipated that?

<comment><USER8> > many people suggested Apple to ditch the hardware business and focus on > software, like Microsoft did.

Xbox and Surface says hi.

<comment><USER7> It was the late 20th century. Xbox and Surface did not exist then.

Well... Microsoft helped destroy Sega with the Dreamcast...

</comment></comment></comment><comment><USER9> This article provides no insights, but it's not wrong either. Shortly after Marissa took over, she became obsessed over minutia like tweaking the Yahoo! logo font[1] and making the homepage _"fresh and dynamic"_ [2]. Oh brother.

Still, she she deserves credit for making Flickr much better, and for shrewd acquisitions like Tumblr.

She made Yahoo! better. No failure in that.

[1][http://humancode.us/post/60431192797/marissas-tumblr- geeking...](http://humancode.us/post/60431192797/marissas-tumblr-geeking-out- on-the-logo)

[2][http://mobile.nytimes.com/blogs/bits/2013/02/20/marissa- maye...](http://mobile.nytimes.com/blogs/bits/2013/02/20/marissa-mayer-puts- her-stamp-on-yahoo-com/?referer=)</comment>