A (Terrifying) Traffic Analysis of Windows 10 - <AUTHOR> http://www.disclose.tv/news/a_terrifying_traffic_analysis_of_windows_10/121544 <comment><USER2> Word of caution, linked server aeronet.cz is well known for spreading pro- russian propaganda[0], conspiracy theories and fake news.

[0]: [https://cs.wikipedia.org/wiki/Aeronet.cz](https://cs.wikipedia.org/wiki/Aeronet.cz)

</comment><comment><AUTHOR> I am not sure how legit is the source. It would be great if others could confirm these findings too.

<comment><USER3> As eager as I am to hop on the Windows 10 hate bandwagon, I've gotta agree with you. The author should disclose the original source if nothing else.

At this time, the closest thing to a source is "Some Czech guy did a traffic analysis of data<link to an unrelated disclose.tv page> produced by Windows 10, and released his findings the other day."

This is just appalling journalism if nothing else, and hurts both sides of the case.

EDIT: I retract some parts of that. The link to the source (in Czech) is tucked away discreetly at the bottom of the page: [http://aeronet.cz/news/analyza-windows-10-ve-svem- principu-j...](http://aeronet.cz/news/analyza-windows-10-ve-svem-principu-jde- o-pouhy-terminal-na-sber-informaci-o-uzivateli-jeho-prstech-ocich-a-hlasu/)

<comment><USER4> And that "Czech" source is a Russian-affiliated propaganda mill that has a vested interested in making US companies look bad.

<comment><USER3> Source on this?

<comment><USER4> This came up the last time this article was posted on HN (that time, it was a Google Translate of the aeronet source).

It was discussed in the top comment and the replies to it: [https://news.ycombinator.com/item?id=10053420](https://news.ycombinator.com/item?id=10053420)

<comment><USER3> Thanks for providing a source. The translated link you provided doesn't inspire a lot of confidence in their reliability. I'll believe what they're saying once they provide the exact methods they used to get these results in order to corroborate them.

</comment></comment></comment></comment></comment></comment><comment><USER5> What, really? Your source is "some Czech guy?" I mean maybe it's true and maybe it's not, but at the same time an article that presumably doesn't link the original article because they don't want people just going directly there and which might be quoting the most lunatic fringe conspiracy theory is not worth taking particularly seriously. A five-minute search tends to indicate that this guy:

[https://systemoverlord.com/blog/2015/08/16/so-is- windows-10-...](https://systemoverlord.com/blog/2015/08/16/so-is- windows-10-spying-on-you/)

hasn't been able to reproduce the traffic analysis on casual inspection.

Edit: Here's what I believe to be the original source of the claim:

[http://aeronet.cz/news/analyza-windows-10-ve-svem- principu-j...](http://aeronet.cz/news/analyza-windows-10-ve-svem-principu-jde- o-pouhy-terminal-na-sber-informaci-o-uzivateli-jeho-prstech-ocich-a-hlasu/)

And the translation:

[http://localghost.org/posts/a-traffic-analysis-of- windows-10](http://localghost.org/posts/a-traffic-analysis-of-windows-10)

<comment><USER6> I highly doubt the source was a Czechoslovakian guy because Czechoslovakia no longer exists. Maybe someone from the Czech Republic though.

<comment><USER5> Ah, good point -edits-

</comment></comment></comment><comment><USER7> Here's another well-researched article suggested by this highly credible news source:

[http://www.disclose.tv/news/The_Russian_Sleep_Experiment_dur...](http://www.disclose.tv/news/The_Russian_Sleep_Experiment_during_world_war_II/103410)

(creepypasta if you don't recognize it)

</comment><comment><USER8> I am not sure that I buy this story. A second source would be good.

I was really enjoying Windows 10 and got beat up on HN after defending it last week. That said a few days ago I switched from having 3 linux laptops and 1 windows 10 laptop to having 4 linux laptops.

I think that Microsoft, after fixing some privacy issues, has a winner in Windows 10 but I decided to just make my life simpler.

</comment><comment><USER9> Saw this claim the other week, while I've already disabled many of these things, the largest point of concern to me here is the microphone transmission and it's one I've been unable to independently verify or deny. Anyone done any deeper digging on this?

</comment><comment><USER10> This is straight up blogspam. Notice how all the links in this article link to the same website?

Here's the original source (In fairness to OP, it's not in English.) [1]

Here's a summary of his findings in English by a guy that isn't trying to drive in ad-traffic. [2]

Now that that's out of the way, here are my thoughts:

Some of this is certainly true and they don't try to hide it-- just last weekend I showed my father the above version of this article. He's a pretty pro-microsoft/anti-FOSS/internet-privacy-is-a-ridiculous-idea guy, but even he was a little shaken to see that we could open up control panel and disable something like the reporting of all of your keystrokes-- assuming it actually disables it.

With regards to data collection and report that users have no control over, I think it's probably true that Windows 10 is capable of this and has code in place to do it, but the idea that it's actually doing this at a large frequency on every user is pretty ridiculous. If it were truly as bad as he's painting it it would be as easy as opening Wireshark, right? We can look at blobs in Windows 10 and find hardcoded strings, and while we probably can't figure out what it's doing with them, we can at least confirm that this guy didn't make it all up. So why hasn't anyone?

I dunno. But IMO the implications of this being true are moot. We already live in a world where Chome is telling Google what you're saying to your microphone[3], where OSX is telling apple where you are and what you're typing into spotlight[4], and where the most popular Linux + GNU distribution is putting out releases that tell Amazon what you're searching for in a default install[5]. Is Microsoft jumping on this same wagon really such a monumental shift when other operating systems and browsers are already doing it?

I'm glad that people are upset at the idea though, and if you're with me so far I'd like to make the case that if you're upset about this you ought to be upset about a possible future that is much worse. I'm willing to eat these words 10 years from now if I'm wrong, but I truly believe that two imminent events are going to be catastrophic for software freedom.

1\. From a software-engineering standpoint, LLVM is superior to GCC. It is well-engineered and will inevitably outperform GCC to a great extent. It's modular and that means that adding new languages and targets are far easier. The future of compiler development is decidedly LLVM-like compilers. But this modular nature (and the license) allows ARM/Intel/NVidia/Ati the ability to simply put out blobs that extend LLVM. Nvidia/CUDA already do this. [6]

2\. Moore's law is dying, and it's going to result in a transformation of hardware. (Cannot recommend this article enough, though my conclusion from his reasoning is the opposite.) [7]

I know it sounds ridiculous at first thought-- "LLVM is under a FSF-approved license", you say. "Even if it wasn't, nonfree tools have never meant that free tools cannot exist besides them." "The author of that article made a pretty compelling case that we're headed towards more open hardware, not less."

And that's all true.

But consider Apple's iOS app-store lockdown and how anti-developer it is. A $100 fee to even begin developing apps? Approval processes? It's completely appalling that we develop backends for services on the shoulders of free software and yet we're at the whims of Apple when we wish to actually get it in the hands of users. But that's the small price we pay to be able to get our software in the hands of the common man's iPhone.

The fatal assumption in the IEEE article is that developers decide what languages or architectures we wish to target. I don't think we do. The market does; rest of society does. We make software for the products they choose. Open hardware is something that we care about, but the market doesn't. Accessible development tools are something that we care about, but the market doesn't factor that into their decisions. Compare the iOS app-store to Google play-- one has free development tools available for all platforms and costs $25 (to keep spam away). One is available only on OSX and requires a $100 fee to debug on real hardware. If the market cared at all about these things, that difference would have lead to Android dwarfing iOS. That has yet to happen.

So what happens when Moore's law slows down and every device is able to roll their own slightly-different architecture? What happens when the only way to compile on it is to use their linked library for LLVM? What happens when you're forced to pay $100 for that? $1000? $10,000? What happens when microkernels become mainstream and you're forced to compile for EC2/Google Apps/etc. using their blobs? Can GCC be expected to stay relevant? [8]

Reading this over, I don't know if I've made as compelling of a case as I felt I had before I started writing, but I do think that the future of software freedom is unsure and that the more we are willing to put up with their demands the worse the outlook gets. [9]

[1]: [http://aeronet.cz/news/analyza-windows-10-ve-svem- principu-j...](http://aeronet.cz/news/analyza-windows-10-ve-svem-principu-jde- o-pouhy-terminal-na-sber-informaci-o-uzivateli-jeho-prstech-ocich-a-hlasu/)

[2]: [http://localghost.org/posts/a-traffic-analysis-of- windows-10](http://localghost.org/posts/a-traffic-analysis-of-windows-10)

[3]: [http://www.zdnet.com/article/google-listens-after-you-say- ok...](http://www.zdnet.com/article/google-listens-after-you-say-ok-google-to- your-desktop-chrome/)

[4]: [http://arstechnica.com/security/2014/10/mac-os-x-yosemite- re...](http://arstechnica.com/security/2014/10/mac-os-x-yosemite-reportedly- leaks-location-search-data/)

[5]: [https://www.eff.org/deeplinks/2012/10/privacy- ubuntu-1210-am...](https://www.eff.org/deeplinks/2012/10/privacy- ubuntu-1210-amazon-ads-and-data-leaks)

[6]: [https://developer.nvidia.com/cuda-llvm- compiler](https://developer.nvidia.com/cuda-llvm-compiler)

[7]: [http://spectrum.ieee.org/semiconductors/design/the-death- of-...](http://spectrum.ieee.org/semiconductors/design/the-death-of-moores- law-will-spur-innovation)

[8]: [https://lwn.net/Articles/582241/](https://lwn.net/Articles/582241/)

[9]: [https://www.gnu.org/philosophy/can-you- trust.en.html](https://www.gnu.org/philosophy/can-you-trust.en.html)</comment>


I Went Vegan Keto. Here's What Happened to My Body - <AUTHOR> http://blog.insidetracker.com/vegan-keto-body-changes <comment><USER2> Good overview of a lot of related factors and a complex conclusion. A problem in the first paragraph though: glucose is not the same thing as ATP.</comment>


Ask HN: Do you use a tablet? - <AUTHOR> Everyone around me seems to have a tablet these days. I have never used one and I don't see the need to.
I've been thinking about getting one lately, maybe for note taking or web navigation when I don't really need to code.
Do you use one? Why? Why not? And if so what model do you recommend? <comment><USER2> I use an iPad primarily for 3 things

1\. Music production/performance. The iPad does few things objectively better than Android and touch responsiveness when it comes to playing music apps is one of them. There's a 100-400ms delay with Android for some reason. I had heard they'd gotten better recently but my girlfriend just got a Galaxy S5 and even though it's a last generation phone it's unplayable for being on time.

The iPad has a lot of great emulations of older synths and exciting new apps that aren't available anywhere else. Some big names have also made apps, like Korg, Propellerheads, and Native Instruments. Check out iPolysix, iProphet, Animoog, DM1, Auria, E.L.S.A., Beatsurfing, Impaktor, BIAS Amp, Audiobus, Swoopster, Sparkle, Galileo, Thumbjam, Steel Guitar, Arpeggionome, Orphion, Xynthesizr, Glitchbreaks, Loopy, and Gadget.

2\. A second monitor. Duet Display lets me plug in my iPad as a second monitor to my MacBook. This is convenient for coding on the go.

3\. Casual laptop use replacement. About the only thing I can't do easily on just an iPad is code or write a lengthy bit of text. If I bring a Bluetooth keyboard I can conceivably do the latter. Possibly the former but I hear the coding apps are still "meh". But if I travel lightly and I want to read, answer email, check the news, play music, or watch some videos, then an iPad suffices over a laptop, and I don't need a heavy power brick. If I want better speakers I can either use headphones or a Bluetooth speaker. If I want a bigger screen there are converter cables or apps that let me do that.

<comment><USER3> _Music production_

Do you write actual songs on it or rather just work out some melody or beat or so? Just asking becasue I cannot imagine doing the former, especially handling sequencer-style ui's on a tiny screen with touch seems problematic.

<comment><USER2> Depends on if that's all they know or if they come from a workflow where that's foreign. Or depends on how flexible they are mentally.

I use it mostly as my guitar amps, guitar effects, and drum machine. I have a lot of synths on there that I sequence with a separate app or have someone play with at MIDI keyboard controller. My new favorite thing is to get Xynthesizr (sequencer) in random mode but in a certain key to talk to a synth app and have that be a background bleep-bloop thing that is every changing while I do heavy reverb and echo drenched ambient guitar stuff.

</comment></comment></comment><comment><USER4> I have a surface pro 3 that I use exclusively for note taking. I'm a physicist and hand written notes are absolutely crucial. The fat iPad style stylii have way too thick a tip for anything useful. Surface Pros, Lenovo tablets with digitizers, and Samsung Galaxy notes are very popular among people who do calculations

<comment><USER5> Any thought of using iPython Notebook as a lab notebook? I ask, because I'm a physicist too (albeit in industry, not doing real physics research), and am experimenting with doing so myself.

<comment><USER4> I use ipython notebook daily for data processing and interacting with simulations. Works great. The problem is that I need SOMETHING that lets me draw diagrams and write equations by hand,

</comment></comment></comment><comment><USER6> I use my iPad exclusively at home. I now never take my work laptop home and it had dramatically made my life better. iPad forces me to be much more switched off but I can still email if need be. It's honestly one of the best things for my work-life balance that's ever happened to me.

<comment><USER7> To disconnect I got a blackberry curve. Still has email and wifi feathering if I need it. Other than that it sucks and I love it.

I might replace it with a "tomorrow m5" phone; a feature phone the size of four stacked credit cards.

</comment></comment><comment><USER8> I have an iPad Air 2 and use it every day. My main use cases:

1\. Reading. I love reading the old, free PDF books available from Google books and archive.org. The OCR doesn't work well, so you really need to read the original scanned image version, which requires a big screen and a fast enough processor (a phone or older model tablet won't cut it). I also moved from using my Kindle to the iPad for reading ebooks, since it is much faster to thumb through the repetitive parts of non-fiction books using the iPad.

2\. Playing games with my girlfriend. Our favorite date activity is going to a bar or hanging out on the patio, having a drink, and cooperatively playing some trivia or puzzle game on the iPad.

I previously had a Nexus 10, but it was too slow to read scanned PDF's and it crashed all the time. The iPad Air 2 is much, much better.

</comment><comment><USER9> I used to, but after buying an iPhone 6 plus, I realized that I was doing all my reading, browsing, etc, in that device, and that I just set my iPad mini aside. I gave it to my mom as a gift, now I don't use a tablet, just my phone.

<comment><USER10> Same here. My iPhone 6+ feels like a small tablet but is more convenient and always with me.

<comment><USER11> I'm the opposite - I feel that smartphones, even 6" ones, are too small to comfortably enjoy using for more than very basic activities, so I just got a Nexus 7 and a very cheap dumbphone which lasts a week on a single charge, all for <100€.

</comment></comment></comment><comment><USER12> During my ugrad 2005-2008, I had a convertible tablet pc and took most of my class notes using it in tablet mode. But it had a Wacom pen and no distracting touch input. And when I needed a keyboard, I could just flip around and have a full laptop.

To me, modern tablets seem like toys, except maybe the Surface pro (expensive). I have a Samsung Galaxy Note 8 and barely use it. The screen is uncomfortably small for taking notes, and the note taking software is exceedingly basic compared to the 13-year-old Windows Journal (which is itself quite basic, like a notepad for pen-input, but powerful enough to take decent notes and making drawings).

<comment><USER13> That's intriguing to me. I love my Galaxy Tab A 8.0 (the successor to the Note 8). S-Note has improved a lot since the Note 8 came out, you can now cut & paste and resize parts of your drawing. I think the screen is larger as well (it's now a 4:3 ratio, not the 16:10 of the Note 8).

I've never tried Windows Journal though, so I'm not sure which features I'm missing out on. S-Note could definitely be improved more.

<comment><USER12> In journal drawings, are vectors: you can zoom in a lot, you can copy paste/resize them, you can erase individual strokes completely by tapping one part of them (if you set the eraser to vector).

In journal you can specify your own background; I like little squares to draw and take notes rather than college-book style lines. In S-Note they pre- defined a few paper templates, and the only thing that comes close ('idea notes' or something) uses a beige back-ground, which looks ugly when putting on a webpage. Thus I use an imagemagick script to fix those (cumbersome).

Journal makes it a bit easier to manage notes, they live in a proper file system; pages within notes are easier to manage (that page-management sub-tool in S-note is very cumbersome). Journal allows searching in notes based on text recognition, per file or per folder.

I found exporting easier with journal, but that may just be because you are on a proper operating system where you can copy and paste quickly; on the Note the normal modus operandi for copying seems to be to 'lasso' stuff, which you can't put on a website nicely (images are rectangles, not hand-lassoed loops).

Is there a way to update S-Note? (If not, that could be sort of another complaint: lack of updates)

<comment><USER13> Sounds like the new S-Note has addressed some of your concerns. Strokes are vectors, and you can resize/ move individual strokes. You can zoom in & out of the page too.

You can change the notes background, including to backgrounds saved in your own image library. So you could create your own forms to fill in, but there's no guidance on how to design those background images. They're now a mix of Paper (background color/texture) and Pattern (eg repeating lines for writing on, or grids / dots for graph papers).

S-Note files are also in Android's file explorer, but I don't know of any program that can open them. You can export to PDF. Text searching is via Evernote, and I'm not sure its handwriting recognition is reliable with S-Note. Page management is still a pain. There's an option to convert your lasso into a square now & save it to your Scrapbook, but it isn't as easy as a crop tool.

I don't think there's a way to update S-Note, unless Samsung updates the whole tablet (ie to Android 5). Frustrating! The new S-Note would make your Note 8 much more powerful if there's a way to hack it onto there.

<comment><USER12> Thanks for the useful hints, I'll try to check it out. Maybe I'll just upgrade the device itself; the form factor seems more useful (although software upgrades will always be an issue...)

Actually I couldn't find the new galaxy tab in 8" with the pen, only the 10" is available with pen on Amazon.

Is the text searching possible among multiple notes (e.g. a folder, or multiple folders?)

<comment><USER12> Actually it was possible to install the new S-Note via the Galaxy App store (Samsung's eco-system layer on top of Android.. ugh).

The new S-Note is indeed better, I appreciate the copy/paste/resize features. Gotta make a graph paper template (cumbersome). So thanks for the hint!

It's still not as good as the more than ten-year-old journal. One can zoom to only 200%. And the drawing is pretty laggy (if you draw slowly at max zoom, it updates like 2 times per second). Laggy drawing makes good penmanship very hard, and drawing accurately painful and slow.

It's also odd that the app overrides the screen brightness to full, and there doesn't seem to be a way to stop it from doing so.

</comment></comment></comment></comment></comment></comment><comment><USER14> I found that I hardly used my nexus 7 and my toddler pretty much made it his own. I use my work MacBook for everything I couldn't or did not want to do on my phone.

At some i began to feel like I needed an in betweeen device and a tablet which is essentially a bigger phone was not the answer. Enter the Asus chronebook flip. Its a thin 10 inch chromebook with a touchscreen that flips all the way around and becomes a tablet. It seems to fill that void. Once Google opens up the ability to install more android apps on chromeos, it will be even more useful.

<comment><AUTHOR> I just found a nexus 7 (2013) being sold around the corner by a guy that never even opened the box for 150$. Should I pass if I'm going to use it for web + note taking ?

<comment><USER15> My nexus 7 (gen 1) is very slow these days, just something you should be on the lookout for...

</comment></comment></comment><comment><USER16> My iPad (air 2) works for me as the perfect "consumption" device wherever I are. Reading blogs, kindle app for books (prefer it to the old kindle device by far), twitter, facebook, mails, and so on. Also a few games like fallout shelter for the 5 minutes in between, or even stuff like deus ex, quite immersive gaming experience for a tablet.

For when I want to "produce" things, I grab my 13" mbp pro.

Actually I have always both, my ipad and my macbook, in a bag with me.

Bonuspoint for developers: the iPad can serve DashDoc remotely when coding on your mac! :D

<comment><USER17> My wife started working for Apple retail a year ago. During training, they asked what an iPad would be used for, and my wife gave pretty much exactly your response -- it's for consumption. WRONG! There was an ad campaign at the time, showing iPads as an important tool in writing music, climbing mountains, etc. They were trying _very_ hard to convince people that iPads were for people doing things, not couch potatoes. I'm not sure they really convinced anyone.

<comment><USER16> Of course you _can_ be productive on an iPad, no question. I have a keyboard- case for it, so writing a few letters or stuff like that is fairly straightforward and without much hassle.

It comes down on what "producing" means for you. I am a developer. Yes, I can code even on my iPhone (code editor, ssh client, git client is installed), but i'm much more productive on an actual mac.

If you're kinda office worker that uses mainly office software (word, excel, ...) and messaging (mail, slack, ...), an iPad with optional keyboard is perfectly capable as a primary working device, plus it's extremely portable and may even have mobile data plans attached.

<comment><USER17> The question was what people actually do on an iPad. And the consensus among people who don't get paid by Apple seems to be: couchsurfing.

</comment></comment></comment></comment><comment><USER5> Tell HN: There are probably a lot of people, myself included, for whom a keyboard is integral to our work, due to coding. If this is the main obstacle to using a tablet, maybe someone should develop an on screen keyboard with layouts that can be customized for the different languages. I'll take one with all of the vital symbols for Python on one layer.

Right now I have a tablet that can be used with or without its detachable keyboard. It was given to me, so I have nothing invested in it. Aside from the obvious uses of surfing and note taking, I've got iPython Notebook on it. That's become my primary "terminal" for most of my technical work these days, so I can't live without it.

In all due honesty, I'll have to admit that the motivation for having iPython Notebook on a tablet, is to occupy myself during meetings. I've settled on not trying to compose big codes, but use the time to learn more about Python and general programming by surfing the web for cool tutorials and interesting new packages.

A tablet seems to be pretty much the biggest thing that I'm willing to actually carry around. The keyboard has the drawback of requiring me to have a horizontal surface to put it on. My little Moleskine notebook still wins for note taking.

</comment><comment><USER18> _tl;dr: I use the Galaxy Note 3 for my phone and tablet. I use it because it 's got just enough real estate to check out Reddit/Twitter/websites while on the go, but I wouldn't personally recommend it for note-taking._

\--

I had an iPad for a few years and then sold it somewhere around 2013. I just didn't use it enough, because my laptop was so much more useful for what I was doing, which was mostly coding and writing emails.

I have a Kindle now, but am honestly thinking about selling that too, if only because the DRM really freaks me out. It's so much easier than lugging books around, but I've never had to charge my book and it won't disappear should Amazon go out of business one day.

I was going to say that I don't have a "tablet" anymore, but then I realized I have a Galaxy Note 3 for my personal phone, and that's a tablet compared to pretty much any phone before it.

The thing made me nervous when I bought it because I was worried it was going to be too big, but I'd do it again in a heartbeat. It's big enough for web browsing, even for a guy with terrible eyesight like me, but I can still toss it in my pocket. I'd feel like a tool if I did that with an iPad, and I can't figure out why. It's totally normal to see someone fiddling with their phone in a waiting room or on line at the DMV or something, but an iPad looks silly in those situations, for whatever reason.

One downside to the "phablet" revolution: When someone calls me and I don't have headphones handy it looks like I'm holding an LCD TV to the side of my head. But I spend way more time staring at this thing than talking on it anyway.

<comment><USER19> >I realized I have a Galaxy Note 3

Notice any drawbacks to it, after using it a while?

<comment><USER18> Some funky problems with displaying certain characters after it's been too long since a restart, but otherwise I really like it. I've probably only used the "S-Pen" a dozen times or so, and the little pen-specific apps can be frustrating to use, but that's a really small part of my use.

</comment></comment></comment><comment><USER20> I have a dell venue pro 8 attached to a repurposed drafting table articulated lamp to hold it in place in front of my couch as a media center remote / quick web browser, so I don't have to find a place for it when I'm done using it and I don't have to check all the places I could have put it when I want to use it, it just "floats" either out of the way or right where I need it.

</comment><comment><USER21> They're great for on lounge/bed browsing. Also for travel to consume media in downtime or work information if you don't have to type too much. And if you have kids they are almost a must for easy entertainment.

As a workstations I don't think they would suit most computer dependent roles.

I'd say overall they are great to have and use mine a bunch, but they're a luxury not a necessity. If you can afford this level of disposable income Id say get a reasonable one and try. Cheap ones tend to lag from reviews and disappoint from performance. If your budget is tight Id put the money into a more quality laptop/phone. Also cost wise tablets tend to last longer than phones in my experience. If you buy a decent one you might get 4/5 years out of it vs 2/3 for a phone.

I'm sticking to iPads for the moment. I use Android and Windows phones so definitely not a fanboy. I would be open to a cheaper Android/Windows if they have improved tablets UX but last Android one I used 12+ months ago didn't seem to work as well as the iPad.

</comment><comment><USER13> I love my tablet. I specifically got one with an S-Pen for handwritten notes & diagrams. I got a "Samsung Galaxy Tab A 8.0 With S-Pen", perfect size & cheap enough that I wouldn't feel I'd wasted too much money if it didn't work out. But I love it & just bought another one for my parents.

It has replaced all my loose paper notes. It synchronizes handwritten notes with Evernote, so I can search across all my devices. I use it to take notes while on the phone or during web conference calls. I also use it to write notes while reading Kindle, though Kindle doesn't work in split-screen mode yet. My other uses are Pocket, Duolingo, Toodledo (to-do list), but I could do all of those on my phone. I am dying for a decent Project Management app that works on a tablet with the S-Pen.

Before that I had a Nook Color running Cyanogenmod, but I never used it except to test apps. Pocket wasn't a compelling enough use case; the S-Pen is what made a tablet compelling for me.

</comment><comment><USER22> I used to, but once I got a bigger phone (Samsung Notes and iPhone 6 Plus) I ended up finding the phone and tablet could become the same thing, so now it's just big phone + MacBook for me on the move. Nonetheless, I do recommend having a tablet because you might find it really works for you - we're all different.

</comment><comment><USER23> I have an iPad and i really only use it as my portable spotify pad and streaming station for music for my receiver.

edit: i very much prefer my kindle to read books, and for everthing else i still use a laptop or a smartphone..

</comment><comment><USER24> I have a Nexus 9. I can't say that I need a tablet, I don't use it a lot, but it's still nice to have one. I use it for netflix in bed, ebooks, check the news whenever there is a commercial break on tv or to google something from the sofa, a couple of fun games, get access to my notes if I reinstall linux or do something that can break my computer. Stuff like that.

My opinion is that for reading and simple point and click stuff it is ok. Whenever I try to write a little more text than 3 - 8 keywords on google or to chat with people, it gets slow and wonky.

</comment><comment><USER25> I was in the same boat, ended up then getting iPad mini. It's great, but I wouldn't buy it again. I think I would buy a Windows tablet next, just for OneNote and making sure it had stylus support.

</comment><comment><USER26> Yeah, I use my iPad all the time. I play a bunch of games on it, read Feedly/Facebook/Twitter/Tumblr, read books, occasionally watch TV shows. It's my go-to device when I'm riding the El. I have the iPad Air 1st Gen, and it's great. My girlfriend has the Mini, which I like more for reading, although it's not great for watching videos. I think they're about to get even better with the iOS 9 ad-blocking capability; that's certainly the biggest issue with browsing on mobile now.

</comment><comment><USER27> I picked up a Nexus 7 years ago but found I wasn't using it consistently enough compared to my laptop or kindle, so I gave it the boot.

But last year I bought an iPad to replace by broken Kindle. Between reading and deciding to put more consumption apps on it and stop using those on my laptop – Twitter, Facebook, Yelp, etc. – I started to get more use out of it.

In the end I have a tablet out of convenience of separating leisurely activities from work ones. Other than that it hasn't provided significant value for me yet.

</comment><comment><USER28> I use an iPad for :

\- read HN or Reddit, an app with reddit and safari with HN, it is nice to be on the couch and do the same thing I would on my chair

\- play games: hearthstone a card game like magic, a tablet is the perfect medium for it.

\- read technical papers or CS books in pdf, the best way to read rich text book with being distracted.

\- a DJ app with spotify integration, nice UI, tactile feeling, and quite fun for parties

I had an Nexus 7 and I hated it, I really like the ipad last gen.

</comment><comment><USER29> I'm surrounded by tablets (iPads), but only pick them up when I'm checking out a website layout. Tablets are too limited for me, often missing features or content due to responsive design practices. The mobile web treats them as second class citizens and apps are not always designed with them in mind either. I'll stick with a handy phone and a laptop when I need a larger screen.

</comment><comment><USER30> I have a first gen Kindle Fire. I'd use it, except it requires a US credit card for a bunch of app store stuff and I can't be bothered to go through the faff of getting a US credit card.

There's the possibility of rooting it, which I'm looking into.

I think making it easy for users to root / reuse devices would help drive sales to new devices by providing a more vibrant second user market.

</comment><comment><USER31> Got a LG Gpad 8" last year. Used it for reading comics and playing strategy/RPG games (unplayable on my 5" nexus due to screen size).

However, I hadn't used it long, and I'm thinking about selling it. A good device for consumption, but I always have a computer near me (at home or work), so useless for productive work. And I can read on my computer too. And play games.

</comment><comment><USER32> I have a Microsoft Surface, but I only use it with the keyboard so next time I'm going for a small laptop instead.

</comment><comment><USER33> I found it useless until I bought one, being a musician I can easily follow chords on it. I use it too for web development (checking responsive design), Android development and Reading (very important as HN user!). I hadn't spent a lot of money, it's a chinese tablet with same iPad specs.

<comment><USER11> Yeah, with a decent holder, they're particularly great as "help screens" for doing manual activities. Having a circuit diagram when I'm soldering or a recipe when I'm cooking, which I can easily touch to zoom in or clarify some term, is extremely helpful.

</comment></comment><comment><USER34> I don't. I even have been gifted one a couple of times but it just ends picking up dust. Laptop or smartphone seem more suitable for me in all circumstances for now. A tablet is either too big for the job or lacks a physical keyboard. For reading I either use the phone or an ebook.

</comment><comment><USER35> I bought a B&N Nook 9" tablet and put CM on it. It is decent for reading. Later I bought an XPS13 laptop and I find myself using it much more often. Similar weight, great battery life but allows me to surf or code, whatever I feel like at the time.

</comment><comment><USER36> I use a Galaxy Note Pro 12.2; it's a more comfortable platform for reading, note taking, some kinds of browsing, etc., than a notebook, and with the keyboard case it's pretty generally useful.

</comment><comment><AUTHOR> OP Here: So iPads are kind of ruling this area. I just found a brand new Nexus 7 for 150$, do you think it is still relevant in 2015? Or should I just save a couple of hundreds more and get an iPad?

<comment><USER37> I've had an iPad, iPad Mini, and Nexus 7. My next tablet will be the Nexus 9, I recommend checking it out.

</comment></comment><comment><USER38> I have an iPad 3 and use it only to read content and browse online. Everything else is done with the laptop (content creation).

IMHO the iPad is the best at what it does, especially if you have Apple HW lying around.

</comment><comment><USER39> I inherited my wife's old iPad but very rarely use it. Just hate on screen keyboards. Maybe I'll watch something on Netflix with it, but that's about it.

</comment><comment><USER40> I bought an iPad mini with cellular and enjoy it. I commute on the train and mainly use it for reading HN, Kindle, email.

</comment><comment><USER41> My iPad Air 2 lags way too much for any serious work on iOS8, so I just use iBooks on it and read books.

<comment><USER42> Lags? How exactly and what is serious work? I have the last non-Air iPad and it still Senna snappy to me. I'm normally pretty critical of UI performance.

<comment><USER41> Mostly reading, sketching and writing. I couldn't ever get my iPad to work for anything major other than these three things. While individual apps work fine, app switching almost always results in an app-refresh.

I'm guessing you have the iPad 3 (the 'new iPad'), which had significantly better specs than the iPad 2 (along with a better screen, I think).

EDIT: Just realized I wrote "iPad Air 2", instead of just "iPad 2 3G".

<comment><USER42> I have the iPad 4th generation, often forgotten slight upgrade on iPad 3. Both have double the memory of iPad 2, which probably explains the app refresh difference. However, I had the iPad 1 too, and currently have iPhone 4S. Both seemed to get worse with time having been snappy to start with though. We are talking about 4-5 year old devices, possible just more OS functionality and bigger apps use up that memory.

</comment></comment></comment></comment><comment><USER43> I use one of the new, lighter iPads almost exclusively for reading programming books & documentation. My iPhone 6 is used for the same purposes when I'm waiting in traffic or in a line somewhere.

</comment><comment><USER44> i got one several years ago for reading but stopped using it when i got a phone with a nice ips screen.

</comment><comment><USER45> TV replacement...

<comment><USER46> Likewise for my family. I also use it to browse the web,but very little. It's an iPad mini. There are other tableta in the house (androids) but I loathe using them.

</comment></comment><comment><USER47> It's all about use cases. I have many tablets that I use for a variety of purposes. They all fit a certain need.

I have one in the garage that I use as a Sonos (whole-house music system) controller and to occasionally look up shop-related queries (IE - "what is the torque spec on the axle bolt for my bike?").

I have one next to the couch that is also a Sonos controller and I use for weather and "2nd screen" duties. IE - "Why does Con Air's cinematography style look so much like Michael Bay movies?"

I've got one in the home office I use for hacking, many other gadgets I use have tablet-based interfaces.

I have a retina iPad on the nightstand for reading, checking the news/weather/sports/social networks and to control my house lights - part of my bedtime routine.

My most compelling use though is for when I need a light computer for travel. Two years ago, I went to Hawaii for a week on two carry-on bags (including big camera and diving gear). I had my iPad with me and, while there, work had a serious server outage. I was able to SSH into the server, initiate repairs, and get everything fixed while sitting on the balcony in the sun. I did not carry (and could not have fit) any normal sized laptop in the carry on. I also used to it check out various tourist destinations and find places to eat while I was there (which I could have done on a smartphone, true).

I'm an extreme geek, I have embraced the culture of technology, my house is filled with many gadgets that have served me well and others that have served only to drain my bank account. I have no hesitations about buying something if I have even the slightest inkling that it would improve my life/workflow.

In the above, all but the iPads were cheap Android tablets that I dont think I paid more than $200usd for (none of those needs required a whole lot of horsepower).

To speak to your specific interest, tablets are awesome for casual web navigation and almost awesome for note-taking. I have yet to duplicate the ease and awesomeness of a pen on paper for note-taking with any tablet app/stylus combo. Many tablet note-taking apps have great features, but the actual 'feel' of a quality ballpoint pen on wood pulp has yet to be duplicated - for me, I've spent far too much time being 'constrained' by computers to be able to think as freely as I can with a pen and paper. Switching will almost certainly be a painful adjustment. That said, if 'computers' are your native medium, then note taking on a tablet can be a powerful thing.

For example, Microsoft OneNote is an amazingly awesome note-taking app for computer-savvy folks. They really nailed the balance between digital data entry and analog notation while presenting it in a fairly intuitive interface. I've only ever used it on PC, I'd _love_ to see as brilliant an implementation on a tablet. Not sure it's possible without a mouse-'mindset' interface.

Though really, as long as you don't need big horsepower and aren't on an extremely constrained budget, it's not too hard to get your feet wet in the tablet world cheap. I just saw a not-horrible import Android tablet for <$40 on a sale site.

</comment><comment><USER48> No.

</comment><comment><USER49> no

</comment><comment><USER50> Every day I see the top comment in a thread being a typical middlebrow dismissal, the type that adds nothing to the discussion. With that in mind, it's really surprising to me that this comment was downvoted. Before I upvoted it, it was grey, and after I upvoted, it was still grey. Who are these people who downvote a perfectly good comment like this? It puzzles my mind.

At the time of writing this comment, at least 10 comments in this thread were grey. There are a lot of comments in this thread being downvoted for no particular reason - moderators, what's going on?

<comment><USER51> We detached this subthread from [https://news.ycombinator.com/item?id=10174991](https://news.ycombinator.com/item?id=10174991) and marked it off topic.

<comment><USER50> Woaha, I didn't know you could do that. In the future, when there are suspicious downvotes, where do you want the community to report it? In-thread like this or by emailing email@example.com or by some other means?

Thanks for your hard work and for a perfect response, as usual!

<comment><USER51> Thanks—that's nice of you to say.

You should definitely email that kind of thing to firstname.lastname@example.com, because then (a) we're guaranteed to see it, and (b) it won't dilute the threads.

</comment></comment></comment></comment><comment><USER52> I only use Windows tablets, where I enjoy the freedom of installing whatever I want. I have a Dell Venue Pro 8 running Win10 for light duty & reading, I have a Surface Pro running Win8 at a client's site for a remote workstation and my wife and I both have a Surface Pro 3 as our main workstation. We also have an iPad but nobody uses it since it's got a much more limited and locked down OS.</comment>


Coronavirus: Death toll climbs to 106 as China tightens measures - huy-nguyen https://www.bbc.com/news/world-asia-china-51275896 <comment><AUTHOR> See realtime-dashboard: Coronavirus spread and mortality

[https://gisanddata.maps.arcgis.com/apps/opsdashboard/index.h...](https://gisanddata.maps.arcgis.com/apps/opsdashboard/index.html#/bda7594740fd40299423467b48e9ecf6)

</comment><comment><USER2> So about 3% mortality rate, I'd say that's pretty scary...

<comment><USER3> From what I read, insensive care was needed for about 20-25% of cases as well. I'm not sure how valid this information is but it's pretty nasty if so.

<comment><USER4> If you read it, please let us at least know where. Speculating doesn't assist anyone.

<comment><USER3> Speculating assumes it's not valid information. Not having a reference on hand, having a valid reputable reference, and having and invalid reference are not one in the same so not sure what's being implied.

Anyways, I googled it for you: [https://www.who.int/docs/default- source/coronaviruse/situati...](https://www.who.int/docs/default- source/coronaviruse/situation-reports/20200123-sitrep-3-2019-ncov.pdf)</comment></comment></comment></comment>


DIY Single Sign-On for SSH - <AUTHOR> https://smallstep.com/blog/diy-single-sign-on-for-ssh/ <comment><USER2> We use smallstep in production and it is great. We have Okta groups that control who gets access to what in our infrastructure. This makes onboarding and offboarding users to our large number of production deployments super easy. If anyone has pain around managing shell users or they want to use SSH certificates without the pain of running your own CA definitely check out smallstep.

<comment><USER3> Smallstep founder here. Thanks Joe!

Heads up, Joe is using our hosted product which you can find at [https://smallstep.com/sso-ssh/](https://smallstep.com/sso-ssh/). It's $3/host/mo (actually $0.0041/host/hr) with a 30 day free trial.

The linked blog post explains how to do single sign-on for SSH yourself using our open source toolchain. Choose your adventure!</comment></comment>


LastPass stores passwords so securely, not even its users can access them - <AUTHOR> https://www.theregister.co.uk/2020/01/20/lastpass_outage/ <comment><USER3> The article went up an hour and a half ago, at the exact same time as [https://status.lastpass.com/](https://status.lastpass.com/) updated to say they were investigating. In under an hour, they acknowledged, identified, fixed, and verified the issue.

The fix went out less than half an hour after they learned about it, and this HN submission was posted 1 hour ago, so no one learning of the issue by means of this HN submission will have been able to reproduce the problem.

Also, if you've enabled offline access to your vault (which used to be the default IIRC, and would be smart regardless of your password manager of choic) this won't affect you.

<comment><USER4> That's bullshit.

In reality (I was affected by this and it's now fixed), this happened 3 days ago, and I kept watching the status to see if they would identify it.

I had to upgrade to premium support for them to even respond to the issue. I filed the issue on Friday or Saturday, and they got back to me on Sunday. And it looks like they have fixed it now.

This was not a quick response time, don't give them credit for this one.

<comment><USER5> It's a nice trick that many companies use.

The best way is to build small agents to monitor the service you depend on to know whether they truly respect their SLA. In case of LastPass they don't even have an SLA....so good luck with an updated status.

<comment><USER6> I learned another nice trick from GCP the other day; Stackdriver log ingestion was down, at least for me and a number of people on Twitter, and they simply put a yellow warning at the top of status.cloud.google.com while fixing it instead of making an official incident.

Magic, 100% uptime!

<comment><USER7> If the service is down for a limited amount of individuals I consider it still up. This does beg the question of how many constitutes "down". I think the nature of the problem and quantity of users affected is important.

<comment><USER8> I disagree. The SLA ought to be made on a per-customer basis. 1% of users affected would mean 1% of users would be entitled to refunds/remedies that the SLA prescribes.

<comment><USER9> GCP has different SLAs for each product, but the ones I've seen are per- customer. The details vary by service, but they generally define downtime, like x% errors for y% amount of time, and then have financial penalties for z% downtime[1]. There are sometimes clauses requiring retries with exponential backoff[2].

Their SLAs are short and readable. It is worth reading a few of them, especially if you have a SaaS and are thinking about your own SLAs. Just search Google for [google $product sla] to find them.

[1] [https://cloud.google.com/stackdriver/sla](https://cloud.google.com/stackdriver/sla)

[2] [https://cloud.google.com/datastore/sla](https://cloud.google.com/datastore/sla)

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> So glad I switched to 1Password, haven't had an issue since. They provide an easy transfer of your passwords from LastPass, you can just follow their guide and be done in 5 minutes: [https://support.1password.com/import- lastpass/](https://support.1password.com/import-lastpass/)

<comment><USER11> I was a longtime LastPass customer, but the service just kept getting worse and worse, to the point where a year ago I realized I was spending more time fighting the user interface than it was saving me. And their support was absolutely useless.

So I also switched over to 1Password, and never looked back. It is such a refreshing and trouble free experience compared to LP, and the few times I needed to ask a question, their support team got right back to me with the correct answer the first time.

<comment><USER12> I've never used LastPass, why do people use it (or other password managers) instead of the built in browser password manager?

<comment><USER13> Until not so long ago, the browsers' password storages provided absolutely zero security. They are better now, but still password managers offer some advantages. For me the most important is the ability to use multiple browsers. But there's other stuff: random password generator, ability to store custom key/value pairs, 2FA, etc.

<comment><USER12> > provided absolutely zero security.

I've been encrypting my Firefox password store for so many years I can't even remember.

Is that not secure or something?

<comment><USER14> Yes, actually. [https://palant.de/2018/03/10/master-password-in-firefox- or-t...](https://palant.de/2018/03/10/master-password-in-firefox-or- thunderbird-do-not-bother/)

(Maybe they've fixed this since, I'm not sure. It doesn't seem like security is being taken very seriously in any case.)

</comment></comment></comment></comment></comment></comment><comment><USER15> So in response to this story I decided to delete my (premium) account with them. After confirming multiple times (good thing), I was shown this error: [https://i.imgur.com/4dpn6d5.png](https://i.imgur.com/4dpn6d5.png)

How does error handling like this even make it to production?

I got an email as well confirming my account deletion and I can no longer log in.

But all in all this clearly does increase my trust in Lastpass's security competence.

<comment><USER16> I got the same error while deleting my account over a month ago when it was announced that their parent company LogMeIn had been bought by private equity: [https://www.zdnet.com/article/logmein-sells-to-private- equit...](https://www.zdnet.com/article/logmein-sells-to-private-equity-firms- for-4-3-billion/)

So the deletion process has been erroring in that way for at least a month now.

</comment></comment><comment><USER17> If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.

<comment><USER18> Switched from LastPass to BitWarden over the weekend. I have 1,200+ passwords, and the transition was seamless. I even set up BitWarden on one of my web servers so that I can control my data -- even that took less than 30 minutes, thanks to BitWardenRS docker container.

The only thing I have yet to figure out for BitWarden is how to get a little icon to show up next to user/password fields in forms. I just have to right click and go to BitWarden (FireFox) to get there, which it just slightly more work. Still worth it.

Why would I pay $36/year (LastPass) for something that I can control for free?

<comment><USER19> Is there an exporter available for BitWarden then? I'm guessing your 1,200 password had a seamless transition because of some tooling the project provides? Is that correct? Cheers.

<comment><USER20> Not the person you're asking but you can export your passwords to CSV from LastPass and BitWarden can import the CSV. The only issue is that the LastPass export can be a bit sketchy and have a few errors you need to manually fix.

</comment></comment></comment></comment><comment><USER21> I continue to use `pass` [0].

Luckily I'm technically minded, so it's not too hard to manage my GPG keys or manage syncing the git repo every now and then.

What it lacks in swish UI and automagically-configured browser extensions it gives in configurability, privacy, control over data, and freedom.

[0]: [https://www.passwordstore.org/](https://www.passwordstore.org/)

<comment> yjftsjthsd-h I really want pass or something like it, but the two times I've tried, I got stuck trying to figure out the gpg part. I suppose I should go and learn that properly anyways, since in spite of its UX it's still an extremely widely used and powerful tool, but it's a lot higher barrier to entry compared to "type in password, unlock vault".

<comment><USER21> The gist of it is that you need a keypair (a public and private key), which GPG can generate for you.

Then whenever you insert something into the `pass` database (which is just a directory tree full of encrypted plaintext files) the tool uses the public key to encrypt the password (or anything else):

        pass generate --no-symbols shopping/ebay 16

Later, when you want to read a password, you ask pass to decrypt the file using the private key from your keypair:

        pass shopping/ebay 16

The difficulty is really all in managing the keys, which can be quite a faff to set up and then manage. If you're only using gpg for `pass`, IMO it's easiest to copy the keypair (which gpg generated) to all your other machines.

A quick web search brought up a gist [0] which shows how to quickly get up and running on a single machine.

If you want to use it on another laptop/desktop/*nix-like machine you'll need to export both your public and private gpg keys and then import them on the other machine. When using a phone you have to do something similar. The Android clients were fairly straightforward, but Pass for iOS had a very, very clunky way of getting the keys across. Regardless, it boils down to this: get the gpg keypair on all of the devices and then get them all using the same git repo for pass.

[0]: [https://gist.github.com/flbuddymooreiv/a4f24da7e0c3552942ff](https://gist.github.com/flbuddymooreiv/a4f24da7e0c3552942ff)

<comment> yjftsjthsd-h Thank you:) That gist does look like what I need; I'll have to try it out!

</comment></comment></comment></comment><comment><USER22> On a side, am I the only person that doesn't like The Register write style, especially the headings? Yeah, irony and fun all that you want, but it ends up looking like a gossip/tabloid magazine

<comment><USER23> It is very "British" with wit, puns, long running silly gags, in-jokes, smart headlines, sarcasm, and self-deprecating jokes.

However, The Register is usually technically correct and regularly breaks important news (good journalism). Minor technical (or grammatical) errors will be lambasted in comments.

Essentially, the style meshes well with it's target readership, and they are _very_ happy that anyone that doesn't like the style auto-excludes themselves from the readership/community.

<comment><USER22> Didn't mean to question the story quality, but even given the British humour, I still don't like The Register style.

</comment></comment></comment><comment><USER24> Why one shouldn't use cloud-based services. I'm sticking to keepass. (I'm syncing the keepass file over a cloud, but I still have a local copy on all my devices against cases like these)

<comment><USER25> I'm sorry, what is your justification for not using cloud-based services?

Lastpass (like pretty much all of these online password managers) will work offline, so if the service goes down, you can still access your data locally.

<comment><USER26> Not the OP and personally less radically against cloud-based services... But storing something as critical as passwords with a SAAS company which is obviously going to be target of attack and may or may not have the engineering resources to provide a reliable quality of service... seems like a bad idea.

Google(Drive) at least I trust to have the engineering resources to keep data secure, perhaps not from government secret services but at least random hackers

<comment><USER27> They don't really store your passwords, just an encrypted blob that's openable with your master password (more accurately, a key that is derived from it using an expensive operation so that brute-forcing is unfeasible.)

You do need to trust them enough that they will never sniff your master password (AFAIK even the web vault is local only) but eg. the command-line client is open source, so you can at least verify their protocol.

That said, I might switch to bitwarden at some point purely because it can be self-hosted.

<comment><USER28> I just don't want to store my passwords in exactly the same way everyone else does. I'm not a high value target, so my threat model is a 3rd party getting screwed / screwing us. Just a little bit of customization should be enough to throw off whatever tools attackers will build to mass harvest.

</comment></comment></comment></comment></comment><comment><USER29> Some alternatives:

      * https://keepass.info/
      * https://bitwarden.com/
      * https://1password.com/

<comment><USER30> Yeah they'll never go down. Why don't these systems support local storage as well? Is there greater security risk in syncing to a local device?

Edit: I do not mean browser localStorage

<comment><USER31> 1Password does support local storage, cloud is used for syncing to local storage so obviously in case of an outage you wouldn't be able to sync updates. But you would be able to access and modify locally and then it would push when things came back online.

<comment><USER32> It also lets you sync via alternative services like Dropbox/Mega.

</comment></comment></comment></comment><comment><USER33> LP has a history of problems, but my company forces us to use that crappy product. I've complained about it for years. I use keepassx for personal, 1password for work, and lastpass for anything that I need to share with coworkers. I always wondered who got the kickback from LP.

<comment><USER34> >LP has a history of problems, but my company forces us to use that crappy product.

I've been using them the better part of a decade, I've never had an issue and find calling it a 'crappy product' to be shocking.

What sort of issues have you had?

<comment><USER35> LastPass is riddled with problems, and the quality has dropped precipitously since their acquisition by LogMeIn. For a sampling of their problems I suggest searching this site for their name.

[https://hn.algolia.com/?q=lastpass](https://hn.algolia.com/?q=lastpass)

<comment><USER36> I've used them for a long time. I noticed zero change in the service.

<comment><USER35> Ok man if it works for you then keep on keeping on. I have chosen to leave the service due to a huge drop in reliability and several major security and service incidents.

</comment></comment></comment></comment></comment><comment><USER37> LastPass' UI is so clunky, confusing and under performant that storing passwords securely is the least path of resistance for end users. I dread using it daily at the office.

</comment><comment><USER38> Been using LastPass for years. Couldn't imagine living without it, with the gazzilon of passwords we have to handle. There's other services of course, but I've never felt compelled to leave. But I'd much prefer to not have to deal with any passwords at all in any service;

</comment><comment><USER39> KeePass/KeePassXC on each device. Complex keyfile manually copied to each device (never in the cloud). Password database protected by the keyfile and a memorable complex password stored in your cloud folder of choice synced to your devices. You now have a free, open source, secure, cloud synced password service.

For additional security, you can manually copy the database between devices as well. Or keep a separate manually copied database with your most secure logins.

<comment><USER40> OK but can you tell my 80 year-old mom how to do this?

<comment><USER39> You can set it up for a non-techie and then just let it do its thing. I've set this up for a few people who don't have a clue what a key file is.

</comment></comment></comment><comment><USER41> Wait, are they saying that the clients don't store a local copy? Or that the local copy is inaccessible without the servers working?? That seems incredibly irresponsible and I can't imagine a single reason for doing that.

Or is there something else going on that corrupted the users' local copies? If the system is properly secure (i.e. data is encrypted and verifiable with the user's password-derived key) this shouldn't be possible, right?

</comment><comment><USER42> I switched to Bitwarden after certain grievances with LastPass which I don't even recall what they were now.

<comment><USER43> The final straw for me was LastPass being very late on going WebExtension for Firefox. Not having a working password manager was not an option and the move to Bitwarden was very smooth.

</comment></comment><comment><USER44> keepassxc (just a simple encrypted password file) + syncthing (copies that file to all your devices) has been working pretty well for me on Linux/Android. I believe there's still no syncthing client for iOS unfortunately.

[0] [https://keepassxc.org/](https://keepassxc.org/)

[1] [https://syncthing.net/](https://syncthing.net/)

</comment><comment><USER45> This will probably get buried, but this story had me shudder at the possibility of being locked out of my 1password vault in a similar scenario. In case anyone is in the same boat:

* My airplane-mode test passed both on my mobile device and browser (1password X).

* The team is aware of the situation with LP and wrote a very thoughtful response: [https://discussions.agilebits.com/discussion/comment/544136/...](https://discussions.agilebits.com/discussion/comment/544136/#Comment_544136)

* From the response above, 1password is SOC2 certified, so availability is taken very seriously.

</comment><comment><USER46> I never see the app I am currently using for my password manager on HN password manager threads so I will recommend it now.

I have been using Safeincloud [https://www.safe-in- cloud.com/en/](https://www.safe-in-cloud.com/en/) for I feel like forever. The dev is quick to add new features, like autofill on android, and windows hello on windows.

It's a one time payment on android and IOS, Desktop apps are free.

I know that 1password is prob better and more secure, but I can't afford the monthly rate.

</comment><comment><USER47> Not actually related to the article, but the headline makes me think of the "Muddy Puddle Test" for crypto, which goes like this:

1) Drop your device(s) into a muddy puddle (destroying them).

2) Slip in said puddle so you hit your head. On waking up you're absolutely fine, but are entirely incapable of remembering your passwords or encryption keys.

3) Can you get your cloud data back?

If you can, then it's not actually secure.

<comment><USER48> What about biometrics?

<comment><USER47> Biometrics are good for usernames but not passwords. It's much harder for someone to get something out of your head than cutting off your thumb. - <USER2> as playeren says, it's impossible to change it.

[http://news.bbc.co.uk/1/hi/world/asia- pacific/4396831.stm](http://news.bbc.co.uk/1/hi/world/asia- pacific/4396831.stm)

</comment></comment></comment><comment><USER7> Given the possibility of software failure, would it be wise to use multiple password managers? I have the feeling this is a .45 vs 9mm question that doesn't have a real answer. More software exposes risk of data being exposed vs redundancy. I do not use software managers. I use a password protected spreadsheet(100 passwords). I hope they are safely encrypted.

<comment><USER49> A seccond PW manager? Not necessary, an offline backup? Great idea. Most PW managers allow you to export in some way shape or form. Doing so and encrypting said file is a great idea, but also something that's hard to do enough for _most_ people that I don't have a good solution.

<comment><USER7> Excellent points.

</comment></comment></comment><comment><USER50> I like Enpass (enpass.io):

\- non-subscription version available

\- multi-platform (IOS, Android, MacOS, Linux, Windows)

\- offline access (local DB)

\- sync via non-Enpass servers (eg use dropbox, google drive, iCloud, box etc)

\- actively maintained

I have been using for ~3 years on a revolving door of devices and have _never_ experienced any issues - just works.

(Not affiliated in any way with Enpass)

<comment><USER51> Mobile free version limited to 25 items. That's not really free for 99% of people.

</comment></comment><comment><USER52> Not even a mention of Password Safe?

[https://en.wikipedia.org/wiki/Password_Safe](https://en.wikipedia.org/wiki/Password_Safe)

It's what I've been using for Windows-running non-savvy relatives for decades.

</comment><comment><USER53> I have been using and paying LastPass since it launched with no serious issues and a few minor ones.

The Register article makes gives no indication as to the number of users having trouble with the current issue.

My single issue with LastPass is that they don't offer an APK download options separate from the Google Play store, so my slow and steady migration will require, at some point, migrating to a different password manager.

I made a trouble ticket regarding this issue and they informed me they have no plans to offer a separately downloadable APK.

</comment><comment> jagged-chisel I feel like there have been enough incidents with LastPass that no one should be using them. Am I biased due to reporting, or is it the case that they can't be trusted?

<comment><USER34> I've been using them the better part of a decade, I've never had a single issue and am quite surprised to see so many people complaining about them/mentioning issues in this thread.

</comment></comment><comment><USER54> As an alternative, lately, I've been using Passfindr. It's web-based but they have an offline solution so that as long as you have made a backup. This kind of crap won't shut you down. It will read out of the backup file through the browser. And I use it for a lot more than passwords. I pretty much use it for any kind of access. Works good.

</comment><comment><USER55> SAASPASS personal password manager and Authenticator works offline (with cloud syncing options). You can also use it for teams or companies (online and offline options set by admin) and it is by default protected by 2FA.

www.saaspass.com

(I work for an IAM SI/consultancy and we use and implement SAASPASS for IAM needs including enterprise password management, 2FA, directory services and SAML-based single sign-on).

</comment><comment><USER56> What's the best (translation: easiest) password manager for non-technical users with Windows and iOS devices? I'm trying to find a good solution to help protect the accounts of my older parents. I use a legacy non-subscription 1Password version for myself so I'm not up to date about the subscription model or product changes of recent versions.

<comment><USER51> I moved myself and the whole family to the often-mentioned Bitwarden 3 years ago. It's been fantastic.

</comment></comment><comment><USER57> My recommended alternative to LastPass: Bitwarden at [https://github.com/bitwarden/server](https://github.com/bitwarden/server)

The ability to host it yourself is a big kudo to me, then we are no longer constrained by LastPass like this case here.

</comment><comment><USER58> Based on this news, I just looked around and discovered that LastPass has a way to export a CSV file of all the passwords in plaintext. I just did that and have a PGP'd archive of my passwords stored locally. Not a bad thing to do with any password manager.

<comment><USER59> I think I did this once with one password service and was surprised that they don't even send a warning email to inform me, that that just happened... very scary.

</comment></comment><comment><USER60> Am I the only one using Google's own password manager? Ideology aside I can't think of someone with more engineering resources to prevent hickups and breaches. Are there any benefits of other pw managers I'm missing out on?

</comment><comment><USER61> What is unclear is if it was an application bug or server bug. In the first case it is not so bad. Since you can downgrade. In the second case it may be disturbing that LastPass requires server connection at all...

</comment><comment><USER62> Yeah I will never trust a third party password system. Writing down on paper works great. For most unimportant accounts use oauth or make up a random password and forget it - if you need it again reset the password.

<comment><USER63> I'm sorry but that is just ridiculous and time prohibitive.

<comment><USER64> You can use a manager that stores an encrypted database locally and prints it out for backup.

Is this generally considered to be not viable?

</comment></comment></comment><comment><USER65> An alternative to avoid electronic systems entirely: [https://www.tindie.com/stores/russtopia/](https://www.tindie.com/stores/russtopia/)

</comment><comment><USER35> One of the best things I've done in my personal software life recently is getting off LastPass. The only other piece of software I have seen decay in quality so rapidly and markedly is PocketCasts.

<comment><USER34> Ugh, they ruined PocketCasts when they bought it and did that major 'update'. Fortunately I found Podcast Republic the day mine updated and haven't looked back.

</comment></comment><comment><USER66> Another open-source, open-pgp based password manager worth mentioning is [https://www.passbolt.com/](https://www.passbolt.com/)

</comment><comment><USER67> I'd rather be locked out for a while, than to have my passwords stored unencrypted. I've been using LastPass as a paid user for about 5 years.

</comment><comment><USER68> I've migrated to Bitwarden. LastPass has been lacking in quality for a while and this outage was the last straw.

</comment><comment><USER58> I was just thinking, it may be a good idea for me to print out my vital passwords and put them in my safe....

</comment><comment><USER69> A lot of people here are saying this is why you shouldn't trust cloud services for password management. And I agree. I use Keepass myself, however, that is not a viable solution for most of my family and friends. They need something dead simple, which is what cloud services like LastPass, Bitwarden etc. offer. I think the LastPass user interface is horrible, though...

</comment><comment><USER70> I'm shocked to see a post of such low quality on hacker news. It reads like an instagram post or twitter replies. I'm not familiar with "theregister.co.uk" but I honestly think it's the lowest quality article I've ever seen on this website

<comment><USER35> > I'm not familiar with "theregister.co.uk"

Then you're not qualified to be discussing software or the tech industry, frankly.

<comment><USER71> Or we're in an era where that sneering prototype for clickbait blogs is being rightly consigned to the dustbin of history.

When faced with a link to an article on The Register, searching for the source it's been copied from is a good first step.

<comment><USER64> I never go out of my way to look for their articles, but their shtick is mildly amusing and they seem like an institution. As long as they are at least a bit different from the rest of the tech press, something would be lost if they went away.

</comment></comment></comment></comment><comment><USER72> Does anyone here use LessPass? I've been using it for a while now and am very happy. No storage needed. One master password to generate reproducible passwords based on the site's domain.

</comment><comment><USER73> Longing for the day that passwords become obsolete.

</comment><comment><USER74> Let's put our passwords on a remote server which convinces us they're secure. How did we even get here that such information leaves our control?

<comment><USER75> Most people access services from more than one device and are not capable of rolling, managing, and securing their own synchronized password database. That's how.

It's not the best option, of course, but certainly better than weak and reused passwords, right?

<comment><USER74> Is convenience more important than security? That's what you're saying here.

<comment><USER76> Before using a password manager: I'm using short, memorable (often repeated) passwords that are rarely, if ever, changed.

After using a password manager: I'm using long (generally 64 characters), unique passwords, and if one is compromised, it's a 30s job to change it on all of my devices.

Convenience _enables_ security. I could probably roll my syncing solution, but I would _not_ be convinced it is secure (I don't have that level of expertise), and I would probably end up using a third party anyway (Dropbox/Digital Ocean). I'm not going to sync it manually to the 6 or so devices I regularly use, plus others I use less frequently (it may be more secure, but it's not practical). Because it's low friction, I end up using it more, so it's a _net_ gain in security, even if it isn't perfect.

</comment></comment></comment></comment><comment><USER77> Keepass - choose your own way of syncing, can never go down, works without the internet etc etc.

Cloud services...lol

</comment><comment><USER78> I'll never forget when I was issued a new computer at a new job with LastPass installed. It kept popping up a modal dialog (modal to the entire browser) with some inscrutable network error message. I never even bothered trying to use it after that.

</comment><comment><USER79> The reactionary nature of the typical HN poster is on full display here.

Lastpass had a bug that affected a small percentage of users. They identified and fixed the bug within several days. What more do you want?

Is there really a competing product out there that guarantees NO BUGS? So, then, why the extreme nod to #CancelCulture for what appeared to be just a temporary issue?

<comment><USER40> Probably because of the way the handled it (or didn't for a few days, as was the case here). Just guessing.

</comment></comment><comment><USER44> IMO[0] everyone should have at most one password - to their email account. Everything else should be something along the lines of (in order of preference):

1) SSO (federated! Not the Google/Twitter/Facebook/GitHub oligopoly nonsense we have now), using email addresses as ids.

2) Emailed login links, a la Slack's magic links.

Email addresses aren't perfect, but they're the globally unique, federated IDs we have, and good enough. Plus they have the advantage of years of figuring out how to handle of realities of federation.

[0] I am biased. I recently launched a service in this space: [https://emauth.io](https://emauth.io)

<comment><USER80> I hope that emailed login links cease to exist.

I work at a large company. As a combination of lots of security scanning and, I think, intentional slowdown for virus spread mitigation, external email can take minutes to be delivered.

More than 50% of the time I receive such a link (including from Slack, for example), it has timed out before it gets to me.

Just let me use a good, long, randomly-according-to-a-recipe-generated (and, if needed, 2FA) for services and I'm happy.

<comment><USER44> Seems pretty specific to large organizations though? That's a completely different thread model than someone wanting to log in to their social network to share cat memes. You're completely right that it needs to be handling differently and appropriately. But for everyday use, I've never had an issue with delivery on commodity email providers.</comment></comment></comment>


Man guilty of hate crime for filming pug's 'Nazi salutes' - <AUTHOR> http://www.bbc.com/news/uk-scotland-glasgow-west-43478925 <comment><USER2> In the video Mark prefaces the joke explaining that his girlfriend thinks her pug is the cutest thing in the world, and he's clearly miffed by this (you can imagine the arguments between them) as his personal opinion is that pugs are the perfect example of why humans shouldn't be trying to breed animals. So he set off to train the pug to do the most decidedly least cute thing possible, which was to raise its paw on the command of "Sieg Heil". [1]

The concerning thing here is that the hate crime statute in the UK is based not on the intent of the speaker or the state of mind of the speaker, but how anyone hearing the speech decides that _they_ feel about it. In fact, even lacking an actual complainant is no burden, the state merely claims that is could be offensive and concerns some community afforded special protection therefore it is hate speech.

You can argue about the comedic quality or value, but it's pretty clear watching the video it's highly sarcastic and dark humor and a hell of a prank, but not hate speech under any reasonable definition.

And this of course is exactly the problem with so-called "hate speech" and various laws (untested by the Supreme Court in the US as far as I'm aware) that have come up against it.

In the USA thank god we still have the right to offend, but clearly this is something which has been lost to the UK and appears to becoming weaponized to surpress political activism as well (see recent stories of Tommy Robinson at Speakers Corner).

This comes on the heels, earlier this week, the London Police had to amend their website after claiming that _people can be "charged" with an "offence" if their actions are within the law but their "reasons for doing it" are perceived as illegal hate by others_. Thankfully that's not actually true under statute. But as we see here, the thought police is still alive and well.

[1] - [https://www.youtube.com/watch?v=SYslEzHbpus](https://www.youtube.com/watch?v=SYslEzHbpus) (NSFW - Viewer discretion advised)

<comment><USER3> _In the USA thank god we still have the right to offend, but clearly this is something which has been lost to the UK and appears to becoming weaponized to surpress political activism as well (see recent stories of Tommy Robinson at Speakers Corner)._

You can't lose what you never had, and the UK doesn't have the 1st amendment. They don't have freedom of speech and expression (at least not In such absolute terms) and never have.

For example, super-injunctions and (I shit you not) hyper-injunctions.

<comment><USER4> That's a strange way to think of it, that the state can supply that as a right. The people of the UK, and anywhere, have the freedom to say anything they'd like...if the state intervenes, they are removing the individual's existing liberty to do so. The first amendment is not a right provided to the people, but rather a restriction placed on the state, removing its own capability to impede upon an inherent liberty.

I never think it's a good idea to think of a state as affording you a liberty which you had to begin with.

<comment><USER2> In fact this is exactly the argument many of the framers had _against_ the bill of rights — that they were so natural and inherently obviously not to be infringed that listing a few of them might make people think anything that might have been left out was not in fact a natural right of the people!

Can't say how glad I am they decided it better to put a few key ones down on paper. Imagine if "they are so natural as to go unwritten" had won the day?

</comment></comment></comment></comment><comment><USER5> Just 9 days ago, the UK held Lauren Southern under schedule 7 (terrorism act) and then refused her passage through the tunnel into the UK.

[https://twitter.com/Lauren_Southern/status/97310042441993420...](https://twitter.com/Lauren_Southern/status/973100424419934208)

That is not a free country.

<comment><USER6> Hate speech and incitement to violence is not welcome in the UK, and quite rightly so.

<comment><USER7> And who decides what is hate speech and incitement to violence?

The country which Orwell called home should know better than this.

<comment><USER8> Lol, you should ask Indians about that.

<comment><USER9> Ouch.

</comment></comment></comment></comment></comment><comment><USER10> What can be done to help this guy? It's incredibly unjust and sets a terrible precedent.

<comment><USER11> We can start by de-Nazifying his dog.

<comment><USER12> I hope you are joking and not seriously suggesting a Pug that alerts on the word "jews" is a danger to anyone.

</comment></comment></comment><comment><USER13> He should have known not to offend jewish people. In a country where you can be imprisoned for questioning history (the Holocaust specifically), it does not surprise me an anti-Semitic joke leads to inprisonment.</comment>


What are some good text books or resources on streaming and queues? - <AUTHOR> I have never used Kafka or had to maintain queues with more than a hundred jobs per hour. Most of the jobs queues I've had to maintain are doing simple things like sending emails or updating a third party API.
I've always resorted to simpler distributed redis based job queues such as kue [0], bull [1], celery [2] or resque [3].
I would like to learn more about distributed queues and architectures from first principles. Where is a good place to go?
[0] https://github.com/Automattic/kue [1] https://github.com/OptimalBits/bull [2] http://www.celeryproject.org/ [3] https://github.com/resque/resque <comment><USER2> A good start is this article by Jay Kreps (Apache Kafka co-creator and Confluent co-founder) :

The Log: What every software engineer should know about real-time data's unifying abstraction : [https://engineering.linkedin.com/distributed- systems/log-wha...](https://engineering.linkedin.com/distributed-systems/log- what-every-software-engineer-should-know-about-real-time-datas-unifying)

</comment><comment><USER3> [https://book.huihoo.com/pdf/confluent-kafka-definitive- guide...](https://book.huihoo.com/pdf/confluent-kafka-definitive-guide- complete.pdf)

[https://dataintensive.net/](https://dataintensive.net/)

<comment><USER4> Huge +1 to Martin Kleppmann's "Designing Data-Intensive Applications." It's the best single-volume introduction I've seen to the fundamentals of databases, queues, and the complications inherent in making those systems distributed.</comment></comment>