Discovering Two Screens Aren't Better Than One (2014) - <AUTHOR> http://www.nytimes.com/2014/03/20/technology/personaltech/surviving-and-thriving-in-a-one-monitor-world.html?_r=0 <comment><USER2> People can waste just as much time with less screen real estate. If you're not working when you have two monitors, having one isn't going to change that.

I have a multiple monitor setup on every system I use, and I find it essential for much of my work.

If you're not using your second display properly, that's on you, not the second monitor.

<comment><USER3> I also think that having a tiling window manager helps at making sure that you're filling up all the available space with things that make you more productive. It makes it harder for the time sinks to seep into view.

</comment></comment><comment><USER4> I used two 24"-27" monitors for several years to do web development, but then I stopped. There was a definitely advantage to having an entire web page visible while I was working on CSS. It was also great to compare full code windows side-by-side (like when refactoring).

The problem for me was neck and shoulder strain. Constantly turning to the left or right always gave me problems. My posture degraded as I naturally moved farther back from the keyboard to take things in.

I dropped the second monitor a few years ago. My physical problems have gone away. I enjoy looking straight ahead now, and as others have mentioned, using a laptop on the train to code no longer feels limiting.

<comment><USER5> So you say that second monitor caused neck and shoulder strain and then you say that you use laptop for coding? I notice some mutually exclusive points here.

I worked about a year on a laptop and also used laptop at home a little. It was a horrifying experience, neck and back strain was really big because of terrible posture behind a laptop - low placed screen, too close screen to keyboard and yourself, narrow and unergonomic keyboard, small screen estate.

<comment><USER4> For me the constant side-to-side, combined with mouse usage was the problem. Trying to re-orient my field of vision (I wear glasses with a strong prescription as well). Looking down or straight ahead has never caused me problems.

I should also point out that on the train, I have a table where I sit (not in my lap, that sucks). I also try to use a stand-up desk more for all-day laptop usage.

</comment></comment></comment><comment><USER6> I can't work properly without a second screen when it comes to web development.

By the way I have some of my colleagues that use the second screen to display their gmail inbox, that's a great loss in productivity...

<comment><USER7> True that. Web development from my laptop seems like a total chore compared to my 2 monitor rig at work.

What's interesting to me is that someone who uses a work computer mainly for word processing (like the author) would think he could be more productive on two screens in the first place. Did other professions imitate web developers by using more than one monitor?

<comment><USER8> You have to make a distinction between someone who's writing a research paper, and therefore constantly checking sources, and someone who's writing fiction. For the latter, a single monitor is less distracting, but for the former, a second monitor for the sources can be beneficial.

</comment></comment></comment><comment><USER9> Utter BS just to be contrarian. This says enough:

> "I have no research proving you'll find as much benefit from a single > monitor as I did."

But, the author does call upon a "professor", who then states:

> "But most people have their email up on the second screen"

Are you f-ing kidding me?

What we have here is the anecdotal evidence of one single journalist who's job clearly doesn't require having multiple screens.

This is just cheap clickbait.

</comment><comment><USER10> Not two, but three screens if you can.

Most of the windows managers are optimized around maximizing a window on a single display. So often you would have one screen maximized with one thing, second with another, and even better third. Simple as that.

If you are a game level designer, or builder, scripter, modeler, etc. you need one screen for the game, one for the edito, one for something else - it might be docked out windows from your editor.

Even coding - debuger, terminal, browser, or log viewer, etc.

Then you have people having irregular screen orientations - one screen rotated sideways - maybe for coding, or logs, the other one - for visualizing things.

I was firm unbeliever in more than one screen, until I was finally sold...

<comment><USER11> Three is great for coding. Documentation, requirements, and planning on the left. Terminal w/ vim in the middle. Results of what I'm working on in the right (auto-running tests or auto-refreshing a web page).

</comment></comment><comment><USER12> I find the more effective the window manager is, the less I find the need for multiple displays.

Some tasks benefit from multiple displays. High end CAD / CAM / CAE very clearly do, as one example. Graphics, video production, simulation, visualization, are all potentials for similar reasons.

One thing I find extremely annoying in the Windows window manager is this idea of click to focus to top in order to do just about anything. On IRIX, the 4DWM window manager allowed a quick highlight, cut, paste, copy operation without actually bringing the window forward. The same is true for text input. Options like this are available in many *nix + X Window system window managers. They rock hard.

Couple that with virtual desktops, and it was entirely possible to have a ton of things going on, have them well organized, task switch with relative ease and manipulate and move information in various ways, often across applications, with a minimum of focus and context changes. There are times when I would leave the IRIX box logged in for weeks at a time as several complex tasks got worked through. Just pile 'em on virtual desktops and switch as makes sense.

Windows 8 moved away from this and toward very rigid window management schemes, and it's a significant loss when operated as intended. One can still get to the desktop and carefully avoid the massive context changes associated with metro and do OK.

But I have to ask, "why?"

I get it on tablets and phones. However, my Samsung Note 4 actually does a window / icon display and I've often used it to have several things displayed at once with the intent of using information from several different things at once to get a task done not unlike how I would have done it on 4DWM. Spiffy, if you ask me!

Doing this on an Android that really doesn't have any window capability is crazy! Lots of context switches, and lots of interactions needed for tasks that might otherwise just be a few. I find that aspect of Android and the Metro UX paradigm crippling.

Where these ugly things are in play, using more than one display is basically buying a window and all that goes with having multiple windows. Doesn't have to go that way, and I would argue, shouldn't as a default for computing.

<comment><USER13> I'm with your here. The whole purpose of virtual desktops is to have more...desktops. No need to turn your head...just a flick of the fingers.

<comment><USER12> Yep. They are great. Some of the better ones allow for moving a window to another desktop easily too. Perfect for that, "but I need this for a minute" type use cases.

There is a trend toward minimalism going on. I'm not sure it's to our benefit.

</comment></comment></comment><comment><USER14> I have developed a loathing for think pieces which put forward the ludicrous proposition that all programming, or worse yet all "tech" work, is somehow more or less identical and thus requires the same workflows and benefits from the same advice.

</comment><comment><USER15> One of the key advantages of single-screen is you don't cripple yourself whenever you're at a conference/on a train/etc. If you get yourself used to working on a highly portable machine like a macbook air, it's like there were chains connecting you to your desk and suddenly those chains just fall to the ground.

<comment><USER16> That seems illogical to me. I spend 90% of my time at my desk with a 2-monitor setup. When I have to use a laptop I do, but it would be counter-productive to use it all the time. IBM Model M, mouse, loads of screen vs poor keyboard, trackpad, tiny screen. I don't get it.

<comment><USER15> At the moment, I'm working mostly remote, and I have a small child at home. Under these circumstances I'd be six feet underground by now if I was anchored to a desk like that. But yeah, if I didn't have the kid, and had the luxury of just calmly sitting down to code in an office without distractions, a second monitor could have its uses.

</comment></comment></comment><comment><USER17> I went from two 22" screens and an Aeron, neck ache, back ache and eyestrain to one 12" screen at 1280x800 and no problems. I RDP to the big workstation connected to the monitors and use my laptop as a terminal.

I get to move around all the time and sit in different positions and can just grab the thing and tether off my phone for a bit. Thursday I went and sat in Kew Gardens (£62/year for an office with a nice view!).

The lack of fatigue and general wellbeing that comes with this flexibility has been orders of magnitude more productive than window layouts.

Everything is just full screen with alt-tabing. I have open Outlook, two word docs, one excel sheet, 6 visual studio instances, hyper-v manager, PuTTY, Paint.net, about 40 FF tabs, keepassx and PowerShell ISE.

The only time I hit the desktop machine is when I need to frig a large image.

Note: The only negative is bird shit.

</comment><comment><USER18> The trend I see is developers moving away from two monitors to one big one. Less head movement, fewer cables, and fewer software driver issues seem to be the reason.

<comment><USER19> This is exactly what I've done - the Philips BDM4065UC is a 40" 4k monitor, so the overall pixel density is about the same as a 24" 1080p. It's like having 4 x 1080p monitors in a block. Also it runs at 60hz over a single displayport cable if your output supports it.

<comment><USER20> I went to one 28" 4K monitor. Just as many pixels as before, all compressed into a higher PPI...it is beautiful. I can't wait for 5K. Not having a second monitor is annoying for real estate management reasons, but Windows 10 (and OS X.next) will support tiling on the desktop, so no prob in the long term.

</comment></comment></comment><comment><USER21> As far as I can tell, his argument boils down to "having two screens hurts your productivity if you use the second screen to watch YouTube instead of work." Gosh, really?

</comment><comment><USER22> I just started a new job in meteorological model development and even though the company is now quite large, everyone in my team is running Ubuntu with only one 24" monitor. At first I felt it was cramped but now I feel that it allows me to finish off small micro tasks first before I interchange between windows. Using two monitors, I'd often leave things/code unfinished because I'd shift all my attention to another screen.

</comment><comment><USER23> I use i3wm on a 15" laptop and usually have applications running on all nine virtual desktops.

I moved away from two screens with OpenBox because the window juggling was still killing me. Having two screens didn't cut it down that much, and tapping two keys to switch desktops and move apps in front of me is a lot simpler and quicker than translating between screens.

</comment><comment><USER24> This depends upon how you use the second screen! If you keep your email client open at all times and in view then of course it will distract you. However, if you keep several source files open at the same time then you can quickly switch between them.

</comment><comment><USER25> Using keyboard shortcuts to quickly switch work spaces seems to be the best of both worlds. It allows you to keep distractions out of sight while requiring minimal effort to quickly access other screens/windows when needed.

</comment><comment><USER26> Both at home and at work, I have two monitors, but I keep the second one off maybe 75% of the time since I'm doing things that don't require the additional screen real estate and I don't want to get distracted. It's still totally worth having it available for the 25% of the time when I'm doing tasks that really require it, though.

(At work I really only need to see one window most of the time. At home I do more stuff that requires multiple windows, but I use a tiling window manager which helps get the most out of the first monitor before needing to add the second one into the equation.)

</comment><comment><USER5> I don't know about writing long stuff or focused debug sessions but for QA two big monitors is real physical need. For example I need one or two instances of web interface that I test, several shells for logs, cli and support linux PCs, rdp, two analyzer programs, QC with test cases and stuff, any number of needed docs (specs, plans, general tech publications), some notepad with highlighting and the list goes on. And this is not including two work email clients and two work messengers.

Actually I use two monitors and laptop screen, so in total three monitors and on each I tab between several applications.

</comment><comment><USER27> No less than 9 peer-reviewed studies have shown that more real estate is better for productivity.

The NY Times should do some basic fact checking before publishing op-eds like this :-(

[http://skeptics.stackexchange.com/questions/1700/do- bigger-o...](http://skeptics.stackexchange.com/questions/1700/do-bigger-or- more-monitors-increase-productivity)

</comment><comment><USER28> I think the big caveat, or really, necessary adjustment to the title, is "if all you're doing is writing and you've got your email client up on the other monitor like a chump".

I was honestly expecting this to be a study, some sort of university eye- tracking experiment that had some evidence. Instead I got:

> I turned off the extra screen on my desktop computer...I found something > increasingly elusive in our multiscreen world: focus...I have no research > proving you'll find as much benefit from a single monitor as I did.

Oh, ok.

> While extra monitors might increase productivity in certain situations — the > sort of situations that can be easily tested in a research setting — they > seem to do so at a high cost, by displaying a stream of digital splendors, > constantly vying for your attention.

Or, perhaps the sort of situations where the user is _trying_ to be productive? "Digital splendors"? If you're using your second (or third, what have you) monitor for fucking YouTube videos, no, you're not going to be magically more productive.

Then we have the biggest non sequitur I've seen in "print":

> ...people using a dual-display machine to do a text-editing task were 44 > percent more productive than those who used a single monitor.

Good so far.

> But for most people, the time spent juggling two windows or scrolling across > large documents isn't the biggest bottleneck in getting work done. Instead, > there's a more basic, pernicious reason you feel constantly behind — you're > getting distracted.

Yes, being distracted can indeed be bad. We haven't established why dual monitors would inherently create distractions though.

> Studies show that office workers are interrupted every four to 11 minutes by > external distractions including phone calls, email and people who stop by > your desk to chat about the weekend.

Phone calls, the number of emails you receive and people coming over to your desk is not going to change with additional monitors. These distractions lay outside the domain of the concern of a second monitor's impact on productivity.

> Then there are self-motivated distractions, when, for no apparent reason, > you quit working on your project and do something else — for instance, jump > into the rabbit hole of the web.

Which can be done just as readily with a single monitor.

> "The second screen can also be an inviting entry-way for self-distraction," > Ms. Mark said. That's because it's an ever-present, available canvas calling > out for you to fire up a web window and find solace in the latest thrills on > YouTube.

Is your second monitor an empty "canvas"? Listen, if you're going to visit YouTube, you're going to do that with or without 2, 3 or 4 monitors.

Anyhow, this reads like click bait, I think I've spent too more time critiquing the article than the author spent writing it. As a front end engineer, and with 2 Thuderbolts and 1 Macbook Pro, I use all my screens to their maximum potential. This morning while working on our public site I had my localhost site running fullscreen on one thunderbolt, my code in vim running on the other, and the photoshop comp on the Macbook. When strictly in JS mode I'll typically have the same setup but docs or gitx running on the laptop.

If you're choosing to be distracted, no, a second monitor isn't going to somehow change that.

</comment><comment><USER29> I like using just the laptop screen.

However, I find OS X's animations between screens distracting. I wish there was a way to instantly switch between screens, without the animation.

Early Linux had these F1 F2 macros that would allow you to jump between terminals. That's what I want on my Mac.

Also I want 16GB on my MB Air, but that is another story.

</comment><comment><USER30> Working on Web apps needing a terminal window, Web page, Web console, and editor up simultaneously makes 2 monitors almost a necessity for decent productivity. If I'm not using both monitors, I shut one off - easy.

</comment><comment><USER31> I don't use second screen much but from time to time I keep some stuff there (most often remote or virtual desktops) and when I procrastinate I do in on main screen anyways.

</comment><comment><USER32> Two horizontal 16:9 screens are usually awful. Two vertical screens, on the other hand, let you see more and don't extend as far out of the center of your vision.

</comment><comment><USER33> anyone use a 21:9 screen? like these [http://www.lg.com/uk/ultrawide- monitors](http://www.lg.com/uk/ultrawide-monitors)

<comment><USER34> I picked a 29" one up a month ago. I haven't done any development work on it, but for the other work I've done it was much nicer than a single 16:9 and less annoying to manage than multiple monitors.

</comment></comment><comment><USER35> It depends on how you use the second screen.

Using [http://focusr.co](http://focusr.co) exclusively on a second screen has been effective at getting me to focus.

<comment><USER36> I can't even tell what that app(?) does from the website. Something about focusing. Will it feed me adderall?

</comment></comment><comment><USER37> But what about three screens?

<comment><USER38> I have three, upgraded from two. It's very useful when doing electronics layouting (one for schematic, one pcb routing, one full of toolbars). But I got the 3rd basically for free when a colleague upgraded, the quality of the toolbar monitor is unimportant.

</comment></comment><comment><USER39> tldr; How you use the computer / manage application windows is more important than multiple screens for productivity. If the way you interact with windows and applications isn't cerebral then you're doing it wrong.

First of all, I'd say his argument is perhaps less applicable if you're a programmer. If all you're using a word processor and a browser, then maybe you can get by. If you're doing programming and designing, and need a couple of applications as well as a few terminal windows — then maybe it's not so applicable.

However, I do find this subject matter really interesting. I've been thinking and observing about this a lot just this last year, and I think it's not so much about screens as it is how poorly most people use computers.

I think the main productivity killer is the cursor and how people do window management: focusing an app, resizing, moving, shifting screens and so on.

As an example, say you as a professional need to use three applications, and most of the time you use these applications in a maximized state — taking up most of the screen space.

Now, if you want to shift attention between these applications, there are a couple of alternatives. You could alt-tab, which is imprecise and slow, since you have to mentally go through the alt-tab stack of applications and find the one you're looking for. Of course, you can use alt-tab to toggle between two specific windows, but if you slip up and press it twice then you bring focus to some other application. It's just not really a good way of switching windows.

Another way is of course to use some graphical element targeting a specific application. Maybe the bottom menu (the dock on OSX). This is also imprecise and tedious. Windows tries to fix this with having the order of the applications correlate to shortcuts. So the first one can be activated using Windows Key + 1, the second one with Windows Key + 2 etc. This still leaves you with the problem however that you lose state between toggling applications since your cursor isn't where you left it for that particular application. There's also not a good way of toggling between _windows_ for an application: say you have two chrome windows, and you want to switch between them.

Or maybe you have multiple screens, and you now have to drag the cursor between the windows. Super slow and imprecise, and maybe the cursor even gets caught between the screens since one of them is in portrait mode and the other is in landscape — now you have to spend even more mental effort just to get it to where you want to go.

The way I've solved these issues — which has given me a huge productivity boost with a laptop in particular but it's also very tangible on desktop computers with multiple screens as well — is to create a really smart system to jump between applications where it remembers where the cursor was for that particular window, and if the cursor is in some nonsensical place when you jump to an application window then it's instead reset by centering on that particular window. It also uses a graphical element surrounding the cursor which shows for about half a second, so I don't have to spend any mental effort to find it. I also have a very nice system to manipulate windows which sort of works like Divvy where using the keyboard I can on the fly define a grid on the screen, and move or resize the focused window inside of that grid.

Using things like this makes it cerebral. I don't have to think, or spend mental effort targeting things. It's all super precise and I don't even think about windows and screens most of the time, it's all mechanics that have become invisible to me when I work.

I'd bet with this setup I'd be a lot more productive with one screen than someone with two screens without a similar setup.</comment>


A Deep Dive into Internet Censorship in Russia - <AUTHOR> https://censoredplanet.org/russia <comment><USER2> That's pretty sad to see as someone who grew up in just the right time to see the spark of the internet hit the world and uniting so many people. I just hope that the people unite at some point and create a community driven network like freifunk or eduroam.

</comment><comment><USER3> Their China analysis: [https://censoredplanet.org/assets/Marczak2015a.pdf](https://censoredplanet.org/assets/Marczak2015a.pdf)</comment>


Interesting concept bicycle design by Bradford Waugh - <AUTHOR> http://www.behance.net/gallery/bike/111883 <comment><USER2> Dear design students:

The standard upright bicycle has looked almost exactly the same for over a century, for very good reason. The basic diamond-frame design is very close to perfect. A derailed-chain drivetrain can exceed 98% efficiency, is cheap to build and is trivially easy to repair and maintain. I love folders, I love recumbents, I love full-sus mountain bikes, but for 99% of riders and 99% of journeys, precious little has changed since the baby boom.

There have been four meaningful breakthroughs in bicycle design in the last fifty or so years. Shimano's indexed derailer gears, Rohloff's SpeedHub, Mike Burrows' Compact Geometry and Andrew Ritchie's Brompton Bicycle. All of them were painstaking developments that took years of work. Burrows' Compact Geometry is a change as trivial as sloping the top tube on a standard frame, but it took years to get right.

I see dozens of these bicycle design concepts every year and every single one I have seen has been absolutely terrible. In the case of this design, the wheels would be so lacking in lateral stiffness as to make the bicycle frightening to ride and the epicyclic rear wheel would be lucky to go ten miles before self-destructing on road debris. Won't work, never will work, never should have been committed to paper.

The designer had seemingly no interest in the century of development behind the modern bicycle and no inclination to investigate why the status quo is as it is. He bumbled in and designed something cool-looking but useless, because he obviously has no interest in such trivia as the laws of physics. Personally, I think that these bicycle concepts embody the antithesis of good design - a useless, style-led attitude that rarely leads to anything but last year's model wearing this year's tailfins.

If you want to design table lamps and dribbly teapots, keep churning out this hogwash. If you want to change the world, start designing with your brain, not your felt tip pens. The world is full of vital, urgent, life-or-death design problems, but they need substance, not style.

<comment><AUTHOR> I can't tell if you're saying that bicycle design is a 'solved problem' or if everything that can be invented has already been invented. Either one is a perfectly valid excuse for not looking at anything in an entirely different way, I suppose. People thought that fire solved all their energy needs for thousands of years, right?

Though the seat does look a little far off the center of gravity to me.

<comment><USER3> I think he's saying that the designer should've started off with understanding _why_ the components of the modern bicycle exist in their current form, in order to more effectively find ways to truly improve them.

</comment></comment></comment><comment><USER3> Not sure how the rear wheel won't be getting sheared off. Same with those cranks -- a single bolt like that for each arm looks like it wouldn't be tight enough. And that bottom bracket doesn't look terribly serviceable.

Where's the front brake?

What happens when a sideways pressure is applied to either wheel?

How much weight will end up being added to the frame and wheels in order to keep them stiff? Removing tubes from the normal diamond frame design mean you need to make up for the support they provided elsewhere.

<comment><USER4> Some group of students actually built a bike similar to this and posted it on Reddit in 2009 or so.

What I never understand is how people imagine the drive on the rear wheel. You'd need an impossible gearbox to spin the gear that interfaces with the rim, and even that gear would need to spin like 10 times for every revolution of the wheel.

To me, that kills the fantasy so thoroughly that it isn't even fun to look at a picture of the device and imagine it in perfect world scenarios.

</comment></comment><comment><USER5> hubless wheels are _stupid_.

<comment><USER6> Why? No chain is a pretty nice feature. I think a lot of casual commuters would be willing to accept quite a bit of downside to get their hands on a chainless bike (that isn't a penny-farthing or a unicycle).

<comment><USER7> What problems do people have with chains? They're dirty? Well, yeah, you have to keep them clean or put them in a chaincase. They break? Never happened to me, but keep a $5 chaintool in your bag and you can remove the faulty link more quickly than you can fix a flat tire. The gearing doesn't work? Don't ride a geared bike if you don't know how to shift, and don't ride a racing bike when you're commuting. Get an internally geared bike and you will never have gearing problems again.

The chain is one of the least problematic of any bicycle part. But then again, there aren't really any problematic parts on bikes, which is why people like them so much.

Also, the reason why a hubless wheel is stupid is because there is nothing keeping the wheel round. The hub and spokes on your wheel are not there to look good, they are there to give the wheel strength. A metal rim like the one in the article will be bent unusably seconds after someone mounts the bike. A carbon fiber rim will just break explosively the first time you go over a bump.

Anyway, what I've learned from this article is that people associate all the problems they've ever had with bikes with the traditional design, and want a non-traditional bike because they think it won't have problems. The actual solution is to get a traditional bike that's setup for actual use instead of racing. Racing bikes are not fun to ride to work. Commuting bikes are.

<comment><USER8> Chains have very real problems and frustrations that crop up often- when used on motorcycles. When it comes to bicycles though, I suspect it is the other problem with chains that drives people;

They aren't pretty, symmetric, or aesthetically pleasing. Strangely, this is apparently a _very_ serious problem for many people.

Note: All the problems with a motorcycle chain apply to a bicycle chain, but motorcycles travel massively greater distances, at higher rates of speed, through tougher environments, while transmitting anywhere from 20-400x as much power as a bicycle chain.

</comment></comment></comment></comment><comment><USER9> I just look at this and hear a loud SNAP as the whole thing falls apart when you sit on it.

</comment><comment><USER10> Evolution of the venerable Slingshot MTB and not necessarily one that will survive

<http://www.slingshotbikes.com/>

</comment><comment><USER8> My favorite part is wondering how exactly the front wheel is supposed to support any weight. Besides the part where the hoop will buckle from the weight being applied at the top-dead-center, how exactly is the force transfered!?

Not to mention the rake looks too small (aka zero), and the axis of rotation of the handlebars is not centered with the actual axis of rotation of the front end. That will be fun to pilot.</comment>


Maximizing Revenue Through Magic Levers and Three Dimensional Pricing Plans - <AUTHOR> http://justinvincent.com/page/1767/maximizing-revenue-through-magic-levers-and-three-dimensional-pricing-plans

<comment><USER2> This is such an interesting idea. 3 different audiences = 3 different sets of plans. Look forward to seeing how this turns out.</comment>


Show HN: Email Signature Generator - <AUTHOR> http://signature-maker.net/email-signature

<comment><USER2> I really dislike this type of things, I prefer plain text on email, HTML adds bloat to an otherwise small email. The site, and end result, though, looks nice!

If your service becomes known at work (a university) I will have to block it; my users (faculty, that is) will swarm it like bees to a hive. :-)

<comment><USER3> OMG, you got the username right.

Talk about getting a stomachache from stuff other people eat. But, whatever :-)

<comment><USER4> Signatures attract attention.

[https://en.wikipedia.org/wiki/Alt.fan.warlord](https://en.wikipedia.org/wiki/Alt.fan.warlord)

> alt.fan.warlord is a Usenet newsgroup dedicated to the dissection and > flaming of signature files (sigs) used in other Usenet groups. The newsgroup > was best-known during the early and mid-1990s, and can no longer be > considered active. In its time, it was a notable "underground" Internet > phenomenon.

> For the most part, alt.fan.warlord targeted sigs that violated a principle > of Usenet netiquette known as the McQuary limit — i.e., the rule that a sig > should be less than 80 columns wide (preferably 72 or less), and no longer > than four lines. This limit kept Usenet messages reasonably short, > conserving bandwidth, and ensured that an 80-column terminal — the most > common display type — could display the sig properly without text wrapping > to the following lines. The McQuary limit, sometimes referred to as the "McQ > limit" and often misspelled "McQuarry," was named after George F. McQuary, a > frequent contributor to alt.fan.warlord.

</comment></comment></comment><comment><USER5> Email should be plaintext

You should add a way to generate a plaintext signature that looks nice

<comment><AUTHOR> Thanks for suggestion. Added to TODO.

<comment><USER5> Cool, a plaintext sig generator would be very welcome

<comment><USER2>
      --
      The Feld
      HackerNews Extraordinaire
      email@example.com
      "Growing Turnips, one at a time!"

There, all set! :-)

<comment><USER4> it's dash dash space!

Outlook Express had a bug for years where it would correctly add the signature seperator, but then strip whitespace and strip the trailing space.

Usenet used to hate it.

<comment><USER2> I added the space, I believe HN trimmed it.

</comment></comment></comment></comment></comment></comment><comment><USER6> Hosting images on dropbox might be an issue. Maybe you should use data url so the signature is "self-hosted".

</comment><comment><USER7> What if Richard Stallman wants to contact me?</comment>


"An almond doesn't lactate:" FDA to crack down on use of the word "milk" - <AUTHOR> https://arstechnica.com/tech-policy/2018/07/an-almond-doesnt-lactate-fda-to-crack-down-on-use-of-the-word-milk/ <comment><USER2> I double checked the URL to make sure I wasn't walking face-first into Poe's Law. As funny as that quote is, I can't think of anything that is a more pointless use of the FDA's time.

Almond milk isn't even a potentially confusing idea anymore; everyone is aware of what it is (enough that it is a well-accepted term) and no one is going to buy it thinking it comes from a cow. In fact, it _not_ being a dairy product is what drives it's consumption, so it is not in the interest of the manufacturers to try to have almond milk be confusable with normal milk for consumers.

<comment><USER3> Unfortunately I think you're underestimated how uneducated some of the population is. I think everyone knows it's not dairy, the confusion comes in if it's nurturing like milk. When people say "milk" the first thing that comes to mind (usually) is a mother's milk (any mammal.) So when they see "almond" and "soy" milk they probably think they are equal alternatives which just isn't true.

<comment><USER4> Right, the almond milk doesn't have the hormones to help a baby cow grow big and strong.

You absolutely should not raise a calf on almond milk.

<comment><USER3> I don't know if you're being sarcastic, but there have been cases of parents feeding their babies almond or soy milk instead of regular milk. Some people still actively encourage it; without any supplementing of actual milk this is quite dangerous.

<comment><USER4> The sarcastic point is, cow milk is not a replacement for human milk or infant formula either.

</comment></comment></comment></comment></comment><comment><USER5> Reminds me of the "melloream"[0] nonsense that happened in New York. Oat milk creamer became significant competition for the dairy industry. Then a law was passed that classified non-dairy milks as "melloream", required that they be regulated exactly like dairy products and also be pasturized. Of course nobody knew what "melloream" was, so it doesn't sell. Just a protectionist law that only helps keep up some businesses' profits.

A similar story is Unilever and the Egg Board's squabbles with Hampton Creek over "Just Mayo" and whether it was actually mayonnaise. [1]

[0] [https://books.google.com/books?id=JkrdDAAAQBAJ&pg=PT98&lpg=P...](https://books.google.com/books?id=JkrdDAAAQBAJ&pg=PT98&lpg=PT98&dq=new+york+melloream&source=bl&ots=bwfC4n7FjI&sig=hGTHia20ueqxI6-4AefLl6xYHcY&hl=en&sa=X&ved=0ahUKEwi- mP-uhK7RAhUE2mMKHR-nDsoQ6AEIVjAN#v=onepage&q=new%20york%20melloream&f=false)

[1] [http://fortune.com/2016/10/10/american-egg-board-hampton- cre...](http://fortune.com/2016/10/10/american-egg-board-hampton-creek/)

</comment><comment><USER6> Personally I think we could push back on the dairy industry and instead force them to label all their milk as 'Cow Milk'.

The dairy industry does not own the word.

</comment><comment><USER7> Will they regulate milk of magnesia too, or is it cool cause they're a megacorp?

<comment><USER8> Mega corps... As opposed to all those little boutique outfits making almond milk?

<comment><USER7> Out of curiosity, I researched it. Blue Diamond Almonds do about 1b in revenue every year. Philipps is owned by Bayer, which does 35b.

Both are large, but I think one has more leverage than the other.

</comment></comment></comment><comment><USER9> This might be related to the upcoming arrival of 'clean milk'. That is milk 'brewed' with yeast: [http://www.perfectdayfoods.com](http://www.perfectdayfoods.com). I personally think this is going to be a game changer. The dairy industry is ripe for disruption and is not sustainable at all.

<comment><USER10> I doubt that has anything to do with the startup du jour. Are you connected to them somehow?

If you pay attention to shelves, almond and soy milk are gaining in popularity. The dairy industry is attempting to slow the momentum of an extant product class.

<comment><USER9> I'm not connected to them, but do admire the idea. They just secured a 24M funding and are partnering with some of the bigger players to substitute animal based milk proteins with yeast based proteins: [https://www.theguardian.com/environment/2016/sep/13/animal-f...](https://www.theguardian.com/environment/2016/sep/13/animal- free-dairy-products-move-a-step-closer-to-market) . I think that yeast based proteins should be cheaper compared to animal based proteins and this would be one of the reasons why all the way down in the chain they will be replaced.

</comment></comment></comment><comment><USER11> Clear case of good regulation vs bad regulation.

Sorry! As much as I try to avoid any comments of a political nature, my capacity for self-restraint wasn't up to the task this time.

</comment><comment><USER12> Finally I'll have the FDA on my side when I refer to soy juice as soy juice.

</comment><comment><USER13> Guess we better outlaw the term "peanut butter" too then..

<comment><USER9> Actually in The Netherlands for this reason peanut butter is actually called peanut cheese (because the word butter is only supposed to be used with products that contain actual butter).

<comment><USER14> So from one dairy product to another?</comment></comment></comment>


Understanding the first imperative of a commercial Certificate Authority - <AUTHOR> https://utcc.utoronto.ca/~cks/space/blog/web/CAFirstImperative <comment><USER2> > relatively long duration certificates are one area where they have something > that Let's Encrypt doesn't.

For some time recently, AlwaysOnSSL[1] was issuing automated, free and trusted certificates with 12 months validity via HTTP or DNS DV. They've since disabled new registrations (who knows why), but I'm still able to get these on my existing account.

Comodo is issuing 12 months certificates for cPanel servers, and 3 month certificates for all domains on any licensed cPanel server (without the rate limits imposed by Let's Encrypt). In fact, the cPanel Comodo CA is currently the second largest CA with some ~13-14% of all currently trusted certificates, in front of Comodo with 8% and behind Let's Encrypt with ~66% [2].

So, I'm not sure that it's strictly true that commercial CAs will refuse to do anything that cannibalizes their own sales. I think there are some mixed models that can work (RIP StartCom), and I hope we see more of them for the sake of the WebPKI. Overwhelming reliance on a free CA that is funded purely by donations doesn't seem like a good thing to me.

\--

1\. [https://alwaysonssl.com/issue.php](https://alwaysonssl.com/issue.php)

2\. [https://censys.io/certificates/report?q=tags%3Atrusted&field...](https://censys.io/certificates/report?q=tags%3Atrusted&field=parsed.issuer.organization.raw&max_buckets=50)

<comment><USER3> > So, I'm not sure that it's strictly true that commercial CAs will refuse to > do anything that cannibalizes their own sales.

 _Someone_ (ie. _some_ CA) had to cross-sign Letsencrypt root certificate (or its direct derivative). Turns out that CA is IdenTrust, a bank consortium. [1]

I'm not disagreeing its a good rule of thumb though.

[1] [https://en.wikipedia.org/wiki/Let's_Encrypt#Technology](https://en.wikipedia.org/wiki/Let's_Encrypt#Technology)

<comment><USER4> Alternatively they could have tried to get the browser vendors to include them as an authority. That may have been hard but now that they are so large they would probably succeed.

<comment><USER2> Well, they are directly included in most root programs now (ISRG Root X1). The cross-signing was a bootstrapping and compatibility solution (e.g. Windows XP).

It seems likely at some point that they will drop the cross-signing.

<comment><USER5> But still not Microsoft's programme. It would be interesting to know (but we'll probably never be told) if there's any particular reason for it taking so long...

[https://crt.sh/?caid=7394](https://crt.sh/?caid=7394)

The top row of "Valid¹" items with one "No" and one "Defer to OS" is the trust you care about, whether ISRG is trusted for the Web PKI. "Defer to OS" is what Chrome says by default about almost everything - basically Google prefers to let your OS vendor pick what's trusted unless they feel the need to step in and override.

I have no idea why Apple trusts ISRG for things ISRG doesn't do and has no intent of starting to do, my instinct is to label it "incompetence" but I've never been an Apple fan, I'm sure they have some excuse.

On the other hand, at least Microsoft has a comprehensive and reliable update process, so there's a good chance most of their population of systems can be upgraded in months rather than years once they do make a decision.

All but one of the programmes listed is a closed door operation, we have no idea how they decide what to do, and only a cynic like me would suggest that it's because they mostly react to events after the fact...

The exception is Mozilla, which makes all these decisions in public in the newsgroup m.d.s.policy

</comment></comment></comment></comment></comment><comment><USER6> I went down the rabbit hole one day when discussing how certificates work. To me trust was a vague concept considering what was at stake. I ended up at Auditors but even then it feels odd that so much trust comes down to a few people.And even worse those auditors use computers that use certificates of companies they audit.

I used to work in a casino and Compliance/Regulator (a type of audit) would check the settings I input. After much employee churn it got to the point where the regulator was just a warm body with a clipboard. I'd enter a setting say jackpot limit $1,200, the auditor asked me to show him, they checked it off. But the regulator used my copy of the data so they were telling me what I had input was right but they were using the exact same data. The regulator should have used a separate source of data (they used to), what if my data was wrong? It's happened before many times.

Anyway that's what CA auditors reminded me of.

<comment><USER5> Audit ought correctly to be a last resort, we should only audit things because the superior options were impractical (or outright impossible). Auditors are invariably conflicted (not giving a clean audit is bad for business) and other actors must work to mitigate this problem.

Part of the failure of Symantec (causing them to exit the CA business last year as a result of financial pressure) was that rather than having in place their own effective oversight they had increasingly relied upon audits from the Big Four to confirm that things were being done correctly at their "partner" companies, even though the wider PKI community had seen repeatedly that audit is not very effective and should not be a substitute for oversight roles.

As a result when problems with CrossCert were identified, Symantec found they didn't have the records that ought to have existed, and ended up asking CrossCert for them, of course CrossCert did not have such records. This situation couldn't have happened if Symantec had effective oversight, since necessarily this oversight role would examine the (non-existent) records.

Individual audit companies may prove either incompetent or corrupt too. Mozilla concluded that the Hong Kong EY (Once "Ernst and Young" but short names are cool now apparently) was either incompetent or corrupt and told its parent that it will no longer accept audits from this outfit. This was part of the problem with StartCom, their audits don't mention things that should have been evident at the time to a competent auditor.

A central purpose of Certificate Transparency is to reduce the need to rely on auditors. With all the signed certificates made public, independent researchers can interrogate data once only accessible to auditors. For example, the question "Were any certificates issued for Debian Weak Keys?" is something we might once have resolved with audit - let's ask the CA "Do you check for weak Debian keys?" and if they say "Yes" that's a pass. But today researchers can simply download all the public keys, and memcmp() them against Debian Weak Keys. Upon finding one, they raise it as a Problem Report. Sure enough the CA discovers that although of course they believed they were checking for these weak keys, for a brief period the check was disabled and they issued a certificate. Oops. Observatory tools like Censys might have helped, but Certificate Transparency gives us guaranteed coverage.

Nevertheless, audit is a necessity for some practical questions. Auditors physically visiting a facility can verify that it is indeed physically secure (are the data centre fire doors left open onto a shopping centre car park?) and that documentation physically exists (are there, in fact, binders full of procedures? It's funny, when they know nobody follows the procedures humans are often too lazy to even bother writing them down...). Likewise auditors must attend certain ceremonies e.g. to create a new private key. It would be very expensive for representatives from the major Public Trust Stores to be sent around the world to do this, and it's clearly not acceptable to just insist that all CAs must be physically located in Northern California.

<comment><USER6> >Individual audit companies may prove either incompetent or corrupt too...

I agree. I've experienced both situations. KPMG did an audit of my former workplace and I was amazed at what they found and so fast. It was a single receipt that a cashier rang in but the supervisor had forgot to log off the POS. The cashier didn't notice and rang in that one item under the supervior's login. The KPMG auditor caught it on paper not electronic they had gone through four year's of paperwork for one department and spotted it (on the first day of the audit too!).

After that Deloitte or KPMG seemed to be mailing it in. I knew some departments in the place where I worked had greatly slipped in following protocol and none of it was discovered by the auditors. Or I should say I wasn't aware of any discoveries since I was not directly involved in the process.

</comment></comment></comment><comment><USER7> The central thesis of the article is rather naively assuming (or asserting) that CAs profits come primarily and directly from selling certs, rather than eg value-add services. It might be very well that it is the case, but before going any further I'd like to see the claim backed up by something

<comment><USER8> The central thesis of the article seems to reject all market forces that aren't directly controlled by the CA. For starters, CAs have to compete to maintain the trust of the browsers. The author glosses over this as if it's barley relevant, but the browsers essentially decide whether CAs are allowed to conduct business at all. CAs also have to compete for the trust of their customers. The author seems to think that CAs publishing a bit of fud somehow entirely negates the customers ability to assess their trustworthiness. I'd say that any actor who makes decisions about trust based only on marketing content probably doesn't care very much about the integrity of the CA system. The existence of commercial insentive doesn't intrinsically make a system corrupt. The CAs product is essentially trust, if their product isn't good enough, then they won't be able to sell it. Especially since there's a number of different supervising bodies to ensure they're doing a sufficient job.

<comment><USER9> I disagree. A CA's actual product (what you pay money for) is some magic bits that put a padlock in the browser URL bar or, alternately, allow you to do HTTPS with browsers without your visitors getting scary warnings from the browser (and attackers being able to MITM your visitors). Since it is extremely rare that CA's are de-trusted by browsers, especially on short notice, any CA that can create this good today is basically as good as any other CA. 'Trust' doesn't come into it as such, and to the extent that you must trust your CA, you cannot feasibly verify that it actually is trustworthy and will remain trustworthy, and thus that certificates it has signed for you will remain trusted by browsers for their duration.

(DigiNotar was trustworthy right up until people discovered that it had been compromised. StartComm actively hid that it had been bought by WoSign; it took people some digging to turn this up and verify it. Other CAs have routinely denied that they had problems when they did.)

Even if you could, picking an especially trustworthy CA doesn't add any extra security for your website, because you are actually dependent on the security of _all_ of the CAs out there, any of which can in theory mis-issue a TLS certificate for your site. Sure, there's CAA records, but this only helps if the CA actually follows the rules properly; CAs can fail here at both a technical and a business level. (One CA recently proposed that it should be allowed to ignore CAA records if the domain owner told it to.)

Even attempting to do basic checking of a CA probably doesn't make sense at a business level unless you're buying certificates in bulk. Suppose that you're buying four TLS certificates and the best price you can get is $30 per certificate per year, or $120 in total for a year. How much engineer time does it make sense to spend in order to pick the most 'trustworthy' CA (ie one that is likely to remain trusted by browsers for a year), given that CA de-trusting is an extremely rare event and if it happens, you're only out another $120 to buy certificates from the next CA?

(I'm the author of the linked-to entry and as you can tell, I have opinions on CAs and the TLS ecosystem. One of them is that Certificate Transparency is a really big deal because it removes a lot of the 'trust me' from the whole CA ecosystem.)

<comment><USER8> I'm not sure if you intended to or not, but you've perfectly proven my point. DigiNotar and StartComm were both forced out of business because people couldn't trust them.

I can generate a set of magic bits on my own computer without any input from a CA, and I'll be able to use them to encrypt a TLS session. What I can't generate on my computer is some trust, which is what I get when I buy a cert from a CA. Also, as a customer of CAs, I have a selection of different companies to choose from, and I base that selection mostly on trustworthiness. It's not so difficult for me to determine which CAs have had the least number of trust-undermining incidents.

To your point of likelihood around CAs being de-trusted, something that happens even less often (as fas as I'm aware), is relying parties claiming on the relying part warranty, so I don't think appealing to likelihood is an especially valid point here.

<comment><USER9> My apologies for not being clear about my DigiNotar and StartComm examples. What I intended to point out here is that in neither case were these failures something which one could have discovered in advance by reasonable amounts of checking how trustworthy the CA was. DigiNotar's compromise was (as far as I know) completely unpredictable and appears to have come from a state-level attack; StartComm actively hid itself and took significant work to uncover. Both CAs would have passed most people's checks done beforehand.

If advance warning is nonexistent, there's no point in even trying to check. If advance warning is hidden, you have a cost/benefit tradeoff to make, and I believe that in most cases (ie with low amounts of money involved), it's not good use of scarce and expensive engineer time to try to assess the state of a CA.

(This is especially the case if your company doesn't already have an engineer who is relatively expert in the CA ecosystem and knows where to even start looking. Without that expertise, would something like StartComm's quiet sale to WoSign have raised any alarms even if you discovered it?)

As far as magic bits go, the one thing that self-generated magic bits can't do is insure that a complete first time visitor can't be MITM'd by an active attacker. Whether this matters (or matters more than the scary browser warnings) depends on circumstances.</comment></comment></comment></comment></comment>


GitHub internal A/B test failure? - <AUTHOR> https://gist.github.com/taf2/0032e9089f0f896ab77627fa68f8cbd9 <comment><AUTHOR> It was short lived but I was unable to push code for about 10 minutes.

</comment><comment><USER2> i just had a similar problem... saw the same thing while trying to commit. and was unable to commit.

</comment><comment><USER3> Seems to be back to normal now

</comment><comment><USER3> same here :\</comment>


Sudo vulnerability - <AUTHOR> https://www.openwall.com/lists/oss-security/2019/10/14/1 <comment><USER2> This is already two week old news, and it affects an extremely limited number of systems. Almost nobody should be using a configuration that is vulnerable, so the number of impacted systems is negligible. You don't have to care about this bug, really.

The bug can be more simply restated as follows: if you allow a user to sudo to the unnamed user ID '-1', you also allow them to sudo to root.

Since the user ID -1 isn't a real thing, this only ever happens if you allow a user to sudo as _anyone_ , including root. Then for the bug to matter, you have to _explicitly exclude_ root. This is an extremely weird configuration. It makes little to no sense.

In fact, it's quite likely that if you're using such a config, you're already vulnerable to privilege escalation anyway, without any sudo bugs. For example, on many systems, the 'adm' user can write to raw disk devices, and thus give itself root access by directly modifying the filesystem. If you use an 'anyone but root' rule on such a system, then it's trivial to escalate to root anyway.

</comment><comment><USER3> For anyone with a modicum of C spending any amount of time in the sudo codebase, this isn't much surprise. It's the scariest piece of organically grown security-sensitive code I'm aware of still in popular use. It's jam- packed with features you've never even heard of, and has quite surprising functional changes across versions that never make the changelog and require diffing to discover.

It's hard to quantify that "this code is obviously wrong" feeling, for example liberal intermixing of concerns within a single procedure in many places of the code. Options with little to no security value (requiretty) documented as if they do, the ability to pass control to user-supplied policy plug-ins from a setuid binary, etc. There is just far too much going on to expect it not to regularly break

Ignoring the implementation, I think it's fair to say sudo is broken in concept, simply by trying to have this kind of expressive policy language in the first place. The set of skills required to safely expose some subset of functionality to an untrustworthy user is perfectly distinct from those involved in typical sysadmin.

<comment><USER4> > Ignoring the implementation, I think it's fair to say sudo is broken in > concept

IMO you're not going far enough. The whole UNIX setuid notion is fundamentally broken to me. The ability to execute a file should logically have nothing to do with the permissions granted to you when doing so. Windows gets this right.

<comment><USER5> How does Windows get it right? Windows has User Account Control for UI apps, which is a "security" feature that they refuse to fix bypasses in.

<comment><USER6> Which UAC bypasses have they refused to fix?

<comment><USER4> He's probably referring to [1], but he's wrong about UAC (note the sentence _" UAC is not a security feature"_ on that post—the fact that he himself had to put quotes around "security" is itself telling), and moreover, I never claimed anything about UAC in the first place. He's ignoring my point and changing the topic, so I'm not inclined to reply.

[1] [https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94...](https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105)

<comment><USER5> I don't know why this reply is so hostile, but I was curious what part of Windows you were referring to if not UAC, because I don't know of anything else.

There is an almost comical list of bypasses in built-in AutoElevate programs that Microsoft does not triage as security bugs because as you note they don't call UAC a security feature. I think this is a rather silly deflection that users are unlikely to understand, for good reason.

<comment><USER4> I wasn't referring to a "part" at all. What I said Windows gets right was a very fundamental _architectural design_ : the decision to _not_ grant privileges to a process based on the file it's executing (the callee), but rather based on the caller's execution context.

Note, in particular, that there was _nothing_ in my comment that depended on the existence of UAC. Had I written my comment before UAC even existed (say, in the XP era), it would've been exactly the same.

Yet somehow you managed to change the subject of discussion to a very specific feature UAC, a feature that was only introduced around the Vista era and which I had not even mentioned in my comment once. Then you bashed it based on a premise that you already _knew_ was incorrect and therefore had to put in quotes, and then continued as if the point I had been making in my comment all along was to somehow _endorse_ the use of this controversial feature I never mentioned for a purpose that it itself had _not_ been intended. This is _not_ a faithful representation of what I wrote.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I love the logo for Sudo

[https://www.sudo.ws/sudo/images/sudo- logo-65.png](https://www.sudo.ws/sudo/images/sudo-logo-65.png)

<comment><USER8> It's a reference to [https://xkcd.com/149/](https://xkcd.com/149/) right?

<comment><USER7> Damn... that makes it even funnier.

</comment></comment></comment><comment><USER9> Sudo has too much surface area for a suid utility IMHO, unnecessary pile of features, config parsing, etc.

I still just use `su` with the wheel group membership executable requirement for gaining root privileges from my regular user.

But sudo has become quite entrenched, almost every software deployment guide I see expects sudo, many scripts outright break on the assumption of sudo being present.

Do you know the list of suid binaries installed on your machine?

`find / -perm -4000 -printf '%#m %u %p\n'`

<comment><USER10> We have an ever changing group of about 60 engineers who need the ability to do rooty style things on about 500 different machines (very few of which are the same, so things like ansible don't work too well). While only a handful actually do, the rest need to be able to, and they're trusted to make the call.

However we still want to know what's going on, and sudo fires back a message to syslog with who did it and what they did. Far more useful than "joebloggs went to root at 03:14 and logged out at 09:15"

<comment><USER11> If you take the time (once) to configure it correctly, _auditd_ can tell you much, much more than just what commands were executed (and "hiding" the commands you ran via _sudo_ is fairly trivial, if one is so inclined).

<comment><USER10> Wouldn't that simply say "root did this at this time", and maybe "on this pts", and then I'd have to marry that up with who was logged on at the given pts at that time?

Either way we don't sue sudo to enforce security -- anyone could go and reboot the machine physically in any case, we use sudo so we remember what we did, or can quickly find the person who did it. Same with physical security, we don't stop people from pulling the plug, but if the plug is pulled we can see who was probably in the room at the time. You can work around it (by going in with a colleague) if you wanted to hide your tracks, but people don't hide their tracks.

Of course the other benefit of sudo is to reduce the number of terminals logged in as root, where accidents can easilly happen.

</comment></comment></comment></comment><comment><USER12> It's interesting to me that sudo is so ubiquitous versus the alternatives. I remember "super" being a somewhat popular alternative in the 90's, but that faded.

Some others: [https://www.sudo.ws/other.html](https://www.sudo.ws/other.html)

<comment><USER13> Company I used to work for had an elevated user they'd create on supported customer systems literally called "backdoor". Needless to say, that raised some eyebrows during the audits.

</comment></comment><comment><USER14> For the curious, this is the patch that fixes it: [https://www.sudo.ws/repos/sudo/rev/83db8dba09e7](https://www.sudo.ws/repos/sudo/rev/83db8dba09e7)

</comment><comment><USER15> I have a hard time understanding this explanation:

> For example, it can be used by a local user who wants to run commands as > root — the windows equivalent of admin user.

"root" is the "windows equivalent" of "admin user"?

But then he talks about rules where you give someone the "sudo" permission to run a command as anyone _other_ than root

> jacob myhost = (ALL, !root) /usr/bin/chmod

> This entry means that user jacob is allowed to run "chmod" as any user > except the root user, meaning a security policy is in place in order to > limit access — sounds good, right?

So that means "sudo" is a way to run a command as a different user, which may or may not be root depending on policy.

<comment><USER16> > "sudo" is a way to run a command as a different user, which may or may not > be root depending on policy.

Correct.

Letting a normal user run commands as root is the most common use-case for sudo, which is why it was mentioned as an example earlier.

The bug does not trigger in this common setup, only in a quite unusual one mentioned later. Perhaps that should have been said explicitly.

</comment></comment><comment><USER17> The underlying issue in my opinion is the terrible interface of setresuid(2): [http://man7.org/linux/man- pages/man2/setresuid.2.html](http://man7.org/linux/man- pages/man2/setresuid.2.html)

</comment><comment><USER18> No date at all in the article. It helps to have that for context.

<comment> bad-joke That confused me too. Internet Archive has earliest at 10/17/2019[1] and the page contains a link[2] to the Sudo team security alert on 10/14/2019.

[1] [https://web.archive.org/web/20191017233613/https://resources...](https://web.archive.org/web/20191017233613/https://resources.whitesourcesoftware.com/blog- whitesource/new-vulnerability-in-sudo-cve-2019-14287) [2] [https://www.sudo.ws/alerts/minus_1_uid.html](https://www.sudo.ws/alerts/minus_1_uid.html)

<comment><AUTHOR> Does Web Archive screenshoot all the webpages out-there every day? If there is few days gap between each site screenshoot it might be the answer

</comment></comment></comment><comment><USER19> How should Mac OS users update sudo?

<comment><USER20> I am pretty confident in stating that this bug impacts roughly zero macOS systems globally.

</comment></comment><comment><USER21> The original announcement email does a much better job of explaining the actual vulnerability, and the configuration under which its an issue (using ALL and !root in the runas part of the sudoers entry)

[https://www.openwall.com/lists/oss- security/2019/10/14/1](https://www.openwall.com/lists/oss- security/2019/10/14/1)

This writeup does little to explain the issue beyond showing a config line that is vulnerable (but doesn't really explain which part makes it vulnerable). It also incorrectly states the issue is sudo failing to parse the value correctly.

> the function fails to parse all values correctly and when giving the > parameter user id "-1" or its unsigned number "4294967295", the command will > run as root, bypassing the security policy entry we set in the example > above.

Which is incorrect, sudo parses the value just fine, the issue comes from the `setresuid` and `setreuid` calls. Both treat -1 as a special case that means the corresponding value should not be modified.[0][1]

I mean, sure this article gets the key point that -u#-1 gets you root, but if you're explaining a vulnerability I'd expect the technical details to be correct.

[0] [http://man7.org/linux/man- pages/man2/setresuid.2.html](http://man7.org/linux/man- pages/man2/setresuid.2.html)

[1] [http://man7.org/linux/man- pages/man2/setreuid.2.html](http://man7.org/linux/man- pages/man2/setreuid.2.html)

<comment><AUTHOR> I googled the writer name ( Daniel Elkabes, Lead Security Researcher ) Found his Linkedin and sent him a screenshoot of your feedback

That's the kind of feedback that can improve the writing skill of the author

Edit: Now I'm actually thinking that not every person know how to accept negative feedback and see it as something positve

I know that I would like to see this feedback if I was the author so I felt like sending it.

<comment><USER22> You should be safe to assume anyone sitting in a lead role should be very comfortable with negative feedback, I'd not stress.

<comment><USER23> It would be nice to imagine the world as it should be, but I don't think this is actually super common.

</comment></comment></comment></comment><comment><USER24> Pretty big oversight to not handle -1 or 2³².

</comment><comment><USER15> How can bugs like this be prevented? Is Linix/Unix "sudo" security model simply flawed?

<comment><USER23> Not rust, but the OpenBSD folks wrote doas(1).

Also I am not sure how rust solves this bug, I don't think it's about memory safety is it? This is about passing -1 from a config file to a syscall, and sudo not validating the value or it being written without the understanding of what -1 means to that syscall. Nothing is mis-parsed, no buffers overflowed, etc.

<comment><USER2> It's a type confusion mistake (-1, meaning "no user ID", being the same type as an actual user ID). Idiomatic Rust would largely prevent this kind of mistake (you'd use an enum type, with a distinct value for "no user"), as long as someone first writes an idiomatic Rust wrapper for the syscalls.

Obviously, if you write the Rust the same way you'd write the C, then yeah, the mistake is equally likely to happen. Rust _encourages_ style that avoids this kind of problem, but it can't enforce it.

<comment><USER23> So supposing you have a type that can either be a uid_t or no value... Can you specify that the high bit on the uid_t cannot be set? I.e. prevent an explicit stuffing of negative values (or unsigned values that are bit-identical to negative ones in the corresponding signed types) into such a type?

That is the most explicit way I can think of to block this with a type system. If uid_t is 32 bits, you need a type that can either contain 31 bits or no value, to prevent that 32nd bit being stuffed into the syscall somehow.

</comment></comment></comment></comment><comment><USER25> Personally I'm amazed that this is only discovered today. Wink wink nudge nudge.</comment>


Ask YC: What do you think of Boulder Colorado as a startup hub? - <AUTHOR>

What are the highlights of Boulder Colorado as a startup hub? <comment><USER2> its a good environment. much better than most. i know a few people working on startups there. there's VC and incubators there, as well as a tech sector.</comment>


Against Intellectual Property (1995) - <AUTHOR> http://www.uow.edu.au/~bmartin/pubs/95psa.html <comment><USER2> Intellectual property is an Americanism that metastasized. It's a global idea not because of it's own merits, but because it was propelled by American treaties and diplomacy during an era when America was dominant.

One irony in that is the fact that the Framers were skeptical of intellectual property. In fact, they didn't call it intellectual property. Even less did they call it "intellectual property rights." It was a temporarily granted monopoly. It was not considered to be a right.

How is that? All your actual rights are assumed to exist. The Bill of Rights explicitly says it isn't the List of Rights. That's because your rights predate any laws and constitutions. You simply have them, and governments are more or less just in observing that you have rights and in not trampling them.

This is key to making the US constitution future-proof. It carves out a set of legitimate powers. It doesn't enumerate your rights: to travel by car or jet- pack, or space-warp, to use unbreakable codes, to marry the person you love, etc.

Patents and copyright monopolies, on the other hand, are explicitly granted, and, unlike your rights, they expire. The congress could at a whim change patent and copyright terms to a week, a day, a nanosecond, and there would be no constitutional case against that law. Because these grants of monopoly are NOT rights.

<comment><USER3> Can you see an argument for how both physical property rights and intellectual property rights are both government granted rights?

<comment><USER4> Yes, but... there's a difference in what happens when you try to do away with them. Society without physical property rights requires everyone to abide by fair evaluation of what they need and what others need; otherwise, anti- communal individuals take things in order to enrich themselves. The people they take from are either non-violent and end up not being able to feed or clothe themselves—limited only by the conscience of the person taking unfairly—or else there's extra-legal armed conflict. Even if everyone agrees to the principle of equitable sharing, a communal ideal, there are still mismatches in different people's evaluation functions of need and ability.

I think the drug market can be viewed as a microcosm of that. There are no state-enforced property rights in drugs, at least none that anyone outside the drug trade takes seriously. It doesn't turn out very well for anyone involved in the market. Even those who get rich from it are at greatly increased risk of turning up dead.

Abolishing IP would affect income streams, but so does outsourcing, automation , and change in particular job markets or industries... the onward march of progress. I don't see that as a reason why it shouldn't be done.

</comment></comment></comment><comment><USER5> I find it interesting that we commonly regard "Intellectual Property" as non oxymoronic. I find the concept of Intellectual Property an impossible situation as:

        It's not possible to *own* a concept.
        You own a *monopoly* on the sale of the *application* of a concept.

A better name might be Intellectual Monopoly Rights.

I realize that I'm arguing semantics, but I think a further look at the semantics help reveal the true nature of the system and enlighten the discussion. Intellectual Monopoly Rights are only granted by societies for the benefit of their citizens. Does our current set of Intellectual Monopoly Rights benefit us? Can we make them better?

<comment><USER6> But property property is also a monopoly right, enforced by the state, so your semantic redefinition really gets us nowhere. It's worth considering what things should be propertized... One solution is that things subject to the tragedy of the commons should be properties, especially when to deny one person the use of a good entails violence against their person. These goods are _rivalrous_ \- if I take your bike by pushing you off of it, I deny you the use of said bike. Note that this doesn't apply to intellectual property without appealing to entitlement language ("An artist is entitled to compensation " \- who decided what is art and how much to give for it)

<comment><USER5> That property can be taken from me. You can't physically take my ideas or concepts from me. They cannot be property.

<comment><USER7> The only thing that can be taken away is the government-granted monopoly on applying the "IP".

<comment><USER5> Agreed.

<comment><USER5> Who downvoted me responding to a comment in my own thread?

<comment><USER5> ?

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> So, semantics and rhetoric aside, what is _really_ this thing called "intellectual property"? In the real world, in actuality.

A big game of Who Has The Best Lawyers.

Nothing less, nothing more. An expensive game, normally better played by big corporations, sometimes by small optimized "companies" (trolls), completely uncorrelated with any notion of fairness or economic sense. Another thing that exists not necessarily because is a good idea, but because of enormous inertia, like many other things we do "because that's how things are", even if they are completely stupid. A legal meme.

(As an aside, I'm personally totally OK with trade secrets; I'd accept a sane, limited version of copyright as useful; and I think patents should be abolished. All of them. Software patents are just the most aggressive and vicious strain)

<comment><USER9> Well said.

</comment></comment><comment><USER10> Historically, intellectual property was the crown's desire to raise unconstitutional revenue by getting money out of those who would buy a statutory monopoly at the net present value of the royalties that could be extracted. The monarch issued a _writ patent_ , that is a royal decree, and the monarch raised money at the expense of society.

In 1620 after an outburst of patenting to raise extra Parliamentary revenue by James I, Parliament passed the Statute of Monopolies which stated that only Parliament might grant monopolies in statutory form and that only for new inventions. The principle written into the law was that the only valid or legitimate use of the otherwise dangerous mechanism of the statutory monopoly was for new discoveries and that for a limited time.

That was then. Where we current live at is that this 400 year old legal concept of statutory monopolies is used not to secure new discoveries, but to have government act in the market. Companies want to prevent cheaper or better products by competing firms from entering the market, and "intellectual property" is one of the better tools used to achieve this end. This is obliviously wrong, so it is up to government to step up like they did in 1620 and stop the abuse, but so far the trend has been to add more abuse, more government involvement in the market, and ever increasing number of royal decrees.

</comment><comment><AUTHOR> I just posted a link to the above paper in a comment here:

[https://news.ycombinator.com/item?id=7496154](https://news.ycombinator.com/item?id=7496154)

But it's such a good article, that I think it warrants reconsideration given the "Abstract Ideas Don't Deserve Patents" article in the New York Times (linked in that above comment thread).

This paper really changed my mind on the notion of IP. And if you've got a view on the subject, it's worth reading.

<comment><USER11> Please consider to upvote this as well: [https://news.ycombinator.com/item?id=7498995](https://news.ycombinator.com/item?id=7498995) It contains a more thorough overview of the history and effects; Chapter 9 is particularly excellent for breaking down why the pharmaceutical industry should hardly be considered a "crown jewel" for IP advocates.

<comment><USER12> Seconding the suggestion to read through chapter 9.

</comment></comment></comment><comment><USER13> The author quotes someone named Hettinger who lists five justifications for allowing intellectual property and, fairly neatly, dismisses four of them, allowing only that it might be that IP protections encourage the production of innovation. A more important argument would be the discouraging of trade secrets (if you invent something and patent it, your invention is protected; if you rely on trade secrets then others can still reverse engineer and copy your work).

I'm not sure I disagree with the author (or Hettinger) but they have missed an important counter argument.

<comment><USER14> This was one of the original arguments for patents. It is actually the reason they're called patents (opposed to "latent"). There had been, in UK, cases of formulas for making certain things, which had been lost because they were kept secret to preserve then-defacto monopolies.</comment></comment>


Show HN: Enter your URL to see CVEs matching your stack - <AUTHOR> https://secalerts.co/security-audit <comment><USER2> that is pretty awesome. Nicely done

<comment><USER3> Seconded!</comment></comment>


Forced by the EU: Microsoft puts its browser selection site live. - <AUTHOR> http://www.browserchoice.eu/

<comment><USER2> Millions of people are going to find out about fringe browsers through this selection dialog. If I were in charge of such a project, I would have put some serious effort into improving the icon and copy text the minute this opportunity was made public.

Right now most of the non-top-5 browsers look like crap or spyware. Avant is definitely shortlisted for the "ugliest 145*50 banner image of 2010" award.

<comment><USER3> I don't think it's going to make a difference for the fringe browsers. My reasoning is that I had to scroll to the right to see the remaining options, and there is no indication that there are more options other than the scrollbar. I'm pretty sure not too many people are going scroll and see the remaining options.

<comment><USER2> This selection dialog is going to be around for a while. Even if only 1 in 20 users does scroll to the right, that should mean millions of viewers over the coming years... Whatever the exact numbers may be, it eclipses the exposure that these browsers could get through any other means.

It's a bit like having your iPhone app in the lower part of the Top 20 on the App Store. It won't be visible on the iTunes front page, but it's still much more powerful than any other kind of free marketing you could hope to get.

</comment></comment></comment><comment><USER4> Legally, I don't know how I feel about the EU ruling. Something feels off to me about forcing a company to offer alternatives to something it is offering its users for free.

In terms make the internet a better place, the EU ruling is full of win. The more people that use browsers that actually rely on web standards, the more people will be forced to build web sites to web standards. If enough sites are built based on actual standards, Microsoft might actually have to make its own browser standards compliant. Not to mention the simple fact that more people will be exposed to Explorer's competitors will force Explorer to actually, you know, compete.

</comment><comment><USER5> Next year EU is going to demand that MS put up a site offering competitors to the packaged Solitaire game.

<comment><USER6> No. Because Solitaire is not a platform. What Microsoft is being punished for is abusing its desktop OS monopoly (which was, BTW, acquired through all sort of shady backroom deals) to hijack and prevent technological advancements that could render its clients independent of its desktop software, thus inflating its profits by artificially reducing competition.

Sorry for the humorless reply, but this is an important subject and it has been shown, over and over, any misconception about it is abused to portrait Microsoft in a more favorable light.

</comment></comment><comment><USER7> Is it just me or is the html for this page _really_ ugly?

Code like this gives me horrible flashbacks to the frontpage days:

      td id="_description_1"

Not to mention a meta tag outside of the html block and class and ID names that make Hungarian notation look pleasant.

<comment><USER8> If I was Microsoft I would have made it just as bad.

<comment><USER9> It's certainly consistent with their other online properties.

</comment></comment></comment><comment><USER10> Quite sad, it looks like something from the nineties... Are we sure that this site has been built microsoft (no reference found)? there is also a browserchoice.org that is a bit nicer.

<comment><USER9>
      browserchoice.eu  - Doesn't resolve :/ why not
      www.browserchoice.eu - OK, force me to put www you idiots

      > HTTP/1.1 302 Redirect
      > Location: http://go.microsoft.com/fwlink/?LinkID=178663

      OK, lets go visit microsoft.com :/

      > HTTP/1.1 302 Found
      > Location: http://www.browserchoice.eu/BrowserChoice/browserchoice_en.htm

      Oh so now you want me to go back again. Fine.

I'm guessing they wanted to use their existing link tracking stuff on microsoft.com

<comment><USER11> [http://www.browserchoice.eu/BrowserChoice/browserchoice_en.h...](http://www.browserchoice.eu/BrowserChoice/browserchoice_en.htm) Welcome to Tautology Club

</comment></comment></comment><comment><USER12> I totally give Microsoft high-fives for placing their browser above all others even if, technologically speaking it isn't. I don't see the EU saying anything to Apple about Safari. I don't see them really addressing the problems with the whole OS + bundled stuff picture. I, unfortunately, don't have a worthwhile solution for it either. I guess it's a start, though.

<comment><USER13> _I don't see the EU saying anything to Apple about Safari._

The difference, of course, is that it has been established in court that Microsoft have a monopoly in the desktop OS market, and that they have abused said monopoly by bundling their browser, media player, etc. with the OS, giving them an unfair competitive advantage in those markets.

<comment><USER6> Not only bundling. You forget all kinds of shady deals that effectively increased OEM licensing fees if any other browser was to be included.

</comment></comment></comment><comment><USER14> Cool. How do I get my browser on this page?

It's called "billpg is an attention whore browser". It's just a rebranded firefox with the home page set to billpg.com that can't be changed. All my easily bribed friends love it!

</comment><comment><USER15> As a side note, it's quite interesting how the first 5 browsers tag themselves-each tag line really reflects the market strategy of the respective organization:

IE: _Internet Explorer is the world's most widely used browser, designed by Microsoft with you in mind._

You're familiar with us-you see us all over the place. You know Microsoft. You've been using us for a while-why change?

Safari: _Safari for Windows from Apple, the world's most innovative browser._

We're Apple. We make shiny, cool stuff. Safari's also shiny and cool.

Chrome: _Google Chrome. A fast new browser. Made for everyone._

Simple message just like our home page and everything else we do. It's fast just like our home page. Made for everyone = easy to use (just like our home page)

FF: _Your online security is Firefox's top priority. Firefox is free, and made to help you get the most out of the web._

IE has problems (security holes/spyware/viruses/identity theft-all the things everyone tells you to be scared of). Download us instead and have less problems.

Opera: _The powerful and easy-to-use Web browser. Try the only browser with Opera Turbo technology, and speed up your Internet connection._

We have feature x. Feature x is cool! Come try feature x!

</comment><comment><USER16> Nice how IE flashes up in first position for a moment before the randomisation. Once again Microsoft forces me to ask: evil or incompetent?

<comment><USER17> actually all 5 have a fixed position that can be seen for a fraction of a second right before being reshuffled: IE, FF, OP, GG, SA

<comment><USER18> I'm surprised this isn't a violation of the EU ruling -- I would have thought the randomisation was mandated for all users (server side).

</comment></comment></comment><comment><USER19> This is nothing but thuggery by the EU. Microsoft never put a gun to anyone's head to sell their OS or browser. And if they did they should be taken to court for that--not antitrust. Sure they made aggressive deals with OEMs, but OEMs could have walked away anytime and face the consequences with their customers. At the end of the day, consumers have a choice what they buy. That choice does not include imaginary products suppliers don't want to deliver whether rationally or not (e.g. an OS without a browser, an iPhone with Flash, etc.).

Antitrust is insulting to peoples' intelligence. It puts politicians (and the private parties that lobby and manipulate them) in charge of the marketplace.

Vote me down, flame and pillory me all you want. But get ready when your private property is the next to be deemed too socially important for you to fully own anymore. You'll deserve it when it happens.

</comment><comment><USER20> Can someone clarify how this actually shows up to the end-user? When a user gets a new computer and first turns it on, does this show up in a standalone program, within IE, or some other way?

<comment><USER11> Via Windows Update

</comment></comment><comment><USER21> Random placement to avoid "from memory" selection.. Nice.

Or maybe just another way to confuse the hell out of web users.

<comment><USER22> Not totally random as the first 5 seem to stay in the top 5.

<comment><USER9>
      >> aBrowserOrderTop5.sort(RandomSort);
      >> aBrowserOrderRest.sort(RandomSort);

</comment></comment></comment><comment><USER23> Why is this hosted by Microsoft? (e.g. the links go to go.microsoft.com)

<comment><USER23> ok, I see that Microsoft uses this to track the links people are clicking. But, still why is this hosted by Microsoft. I would expect it to be a EU site.

</comment></comment><comment><USER8> this whole site is EU law gone mad.</comment>


Learning From Data - <AUTHOR> https://www.edx.org/course/caltechx/cs1156x/learning-data/1120

<comment><USER2> This course was previously offered, though I think it was an ad-hoc offering and not through EdX. Did anyone take it, and do you have a review?

<comment><USER3> You can view the old videos here: [http://work.caltech.edu/telecourse.html](http://work.caltech.edu/telecourse.html) It is worth watching a few to see how well it is taught.

It is more mathematically rigorous with an emphasis on the theoretical fundamentals, especially compared to other online offerings that are more applied. It may not cover as many learning algorithms.

Here is a previous discussion [https://news.ycombinator.com/item?id=4206445](https://news.ycombinator.com/item?id=4206445). And, a comment about the book [https://news.ycombinator.com/item?id=6353736](https://news.ycombinator.com/item?id=6353736)

And, here are some of the impressive comments about the professor:

> Yaser Abu-Mostafa was (by enormous margin) the most effective professor I > had at Caltech. Despite being such an expert in the field, he understands > clearly when a concept is particularly challenging--and what about it makes > it so. [...]

>What Andy says is absolutely true. This machine learning class was easily the best class I took at Caltech. Prof. Abu-Mostafa got a standing ovation at the end of the course the term I took it. I wish I could have taken more of his classes. \ It was also fairly difficult -- the assignments were hard, but at every step, you could look at what you'd done and say "I know why I'm doing this, and I can see how this works." \ I remember at the end of the term he took several students' notes and made copies of them, so that he could compare the students' notes with what he was trying to convey, and could know if he wasn't teaching certain parts of the class well enough. [...]

[https://news.ycombinator.com/item?id=3704782](https://news.ycombinator.com/item?id=3704782)</comment></comment>


Patreon CEO says the company's generous business model is not sustainable - <AUTHOR> https://www.cnbc.com/2019/01/23/crowd-funding-platform-patreon-announces-it-will-pay-out-half-a-billion-dollars-to-content-creators-in-2019.html <comment><USER2> Patreon:

You have too many employees. You are trying to do too much. You are not a tech company. Your business model should be that you facilitate transactions between multiple parties. To do this, you take a small cut, on top of the transaction fees the banks take that you pass on.

Stop being greedy.

<comment><USER3> > _You are trying to do too much_

What I'm trying to figure out is, what ARE they doing? From the patron end of things at least, I barely see any new features at all.

If they were adding like streaming support, their own patron chat (instead of just linking to Discord), video hosting (instead of everyone using unlisted YouTube videos), etc, then I'd agree they're trying to do too much, but I don't even know what they ARE doing?

<comment><USER2> I'm really just referring to their aspirations -- the thing justifying their funding, hiring and size.

I feel like you could run that whole company with 20 people.

<comment><USER4> You have clearly not worked in payments, just dealing with the fraud at that scale is more than 20 people.

<comment><USER5> That sounds like a great start up idea. Cloudflare of payment fraud.

<comment><USER6> It's called Sift [https://sift.com/](https://sift.com/)

</comment></comment></comment></comment></comment></comment><comment><USER7> _The company is also on track to pay out $500 million to content creators in 2019... 90 percent of funds are paid directly to content creators. Patreon takes 5 percent, and the remaining 5 percent covers transaction fees._

By my rough maths, that suggests Patreon runs on $25-$28 Million a year. I'd love to know what is costing them so much to be unsustainable (Customer support? Fraud department?)

<comment><USER8> An army of censors kicking off deplorables.

</comment></comment><comment><USER9> It seems odd that they would have profitability issues since they are just a wrapper around PayPal. They should be pocketing the 6-7% after PayPal's cut and the payout to creators for 90%.

I thought that this was one of those 4-hour-work week businesses where it was just the founder registering domain names and planning marketing.

It also seems odd that creators don't just use PayPal directly and ask for scheduled transactions.

<comment><USER3> > _It also seems odd that creators don't just use PayPal directly and ask for > scheduled transactions_

I'd love to see the breakdown of Patreon subscription amounts.

Personally, I support around 15 YouTubers each with $1/mo, meaning I pay $15/mo for my YouTube content. If I paid them individually with PayPal, the fees would be 30% and the creators would only get 66 cents. Since Patreon bundles the payments, the fee is only 5%, Patreon takes their cut and the creators get 90 cents.

To me, Patreon is basically a micro-transaction bundler.

<comment><USER10> I thought rewards at these amounts were entirely gobbled up by fees...

</comment></comment></comment><comment><USER11> Maybe I'm missing something here but just taking a cut of the transaction I would think would make profitability pretty easy with some discipline...

</comment><comment><USER12> I had such a good laugh that CNBC called them a crowdfunding site after I got admonished by Patreon for thinking they were a crowdfunding site. Internally, they've convinced themselves they're a membership site and they can't figure out why they have a messaging problem...

</comment><comment><USER13> Not that long ago they started banning accounts that posted lewd art, even though half of the point of patreon is to be a paywall thing for lewd art.

</comment><comment><USER14> What the hell are they doing with all that money??

</comment><comment><USER15> Sure it is. Scale back.

Or, face competition.

And generous? Who is doing the work?

Notice the focus on all the money paid to content creators?

They need it.

So much always going to the top is not generally sustainable. Unrest is all over the place.

If we can't figure out how to pay working people enough to actually make it, this whole thing is going south.

Not just Patreon.

Frankly, Patreon was one of the ones I felt better about. Now I don't and will immediately find ways to contribute to content creators I support directly.

And doing that is just not that much work.</comment>


Example: Maximizing Rails on Minimal Hardware  - <AUTHOR> http://damao.net/vhosts/node.to/wordpress/?p=29

<comment><USER3> I have been hacking away on a Rails app for the past while, and in about a months time it will be ready for public beta - I have no idea how much server power I am going to need.

Any YC'ers got any advice here - I cannot see it being overly popular, but I want it to be able to withstand a bit of a load spike.

I was thinking getting a VPS from Slicehost and see where it gets me. I was also going to start with Mysql, Apache and Rails all on the same VPS. On my box at home, I get 50 requests per second on most actions (I am the only user - no load simulation) - there is no way I will be serving that many requests from day one, or quite possible ever!

I know its very much an 'it depends' answer, but how far do you reckon a gig of RAM and a single CPU will get you in Rails terms (with zero page caching as all pages are logged in pages)?

<comment><AUTHOR> That should get you pretty far, depending on how big your database gets. Not knowing much about your application, I can't really say much else, though. We started out with a server much like that and were able to deal with a good techcrunching on it. The first thing you'll want to do when you get more users, though, is get a separate database server so you can have more available ram for things like query caches, buffer pools, and etc.

<comment><USER3> Thanks for that - I figured something like that would get me far enough - <USER2> guess if you need to scale beyond a single server it is a sign of at least some success!

<comment><AUTHOR> totally - they keep telling me "that's a good problem to have."

</comment></comment></comment></comment><comment><AUTHOR> The real take-away from this article is the default rails configurations and many of the recommended capistrano recipes just won't cut it in heavy load situations with complex apps.</comment>


Ask HN: I've spent the better part of a year writing a market making crypto bot - <AUTHOR> And now I am essentially out of funds to get it running with which is extremely frustrating to say the least.
Basically when I started working on it a year ago, I had significant personal wealth in the form of various crypto currencies I had mined around 2010/2011.
I was dabbling around with perpetual contract trading on bitmex and ultimately losing my shirt due to human emotion.
I kept seeing profitable exit points regularly but held onto them longer than I should have for example.
Fool me once...
So I got to work on an algorithmic trading bot...
Re-wrote it what seems like 50 times so far over the past year...
And I am finally ready to let it loose on some live markets! Which is amazing! I am extremely happy with my work!
It's traded over $1m USD worth of contracts on the testnet bitmex platform over the past 24 hours with no errors and no liquidations and has the ability to absorb an extremely large market movement in an extremely short period of time without liquidating.
The only problem is that it needs about $10,000 or 1 BTC to really do it's best work... and I don't have that available to me anymore.
I have about $4,000 worth of crypto left in stable coins, and I could probably sell my car for about $3000 but I need it to get around.
I could ask my friends who actually have a few BTC left kicking around but I've always been told it's never wise to mix money and friendship.
There are platforms out there that allow you to sell "alphas"... essentially working algorithms... to richer buyers who can afford to use them... but I don't trust those platforms not to steal my code and pay me nothing for it.
What would you do in this situation?
Thanks for reading.
I am off to yoga class now to meditate on this... I will definitely respond when I get in! <comment><USER2> I would get a job and save up. Shouldn't take too long to make $6k for someone with your skills.

<comment><AUTHOR> That's good advice. I'll probably take that route. Thank you.

</comment></comment><comment><USER3> You need to test it a whole lot more than 24 hours before you go live...

<comment><AUTHOR> Yes of course. I've been testing it for months.

I just meant the final iteration's test has been live for 24 hours now.

I know all of this code like the back of my hand at this point.</comment></comment>


Latest Remote Jobs Aggregated from Twitter: Search and Apply at Find Remote Work - <AUTHOR> https://findremotework.co/ <comment><AUTHOR> To stay on top, there is an option to sign up for a weekly newsletter.</comment>


Tinymail.me - simple email protection service against harvesting bots - <AUTHOR> http://tinymail.me Good service? Tinymail.me is an email protection service to keep bots from spamming or automatically harvesting your email from forums or classifieds. <comment><USER2> Recaptcha already does this: <http://mailhide.recaptcha.net/>

Didn't you basically just reimplement that?

<comment><AUTHOR> Didnt know about that :-/ too bad

thanks for your feedback

</comment></comment><comment><USER3> I prefer <http://www.10minutemail.com>

</comment><comment><AUTHOR> Feedback would be nice ;)</comment>