Why We Age, Part III: Can We Live Forever? - <AUTHOR> http://mitchkirby.com/2015/06/02/can-we-live-forever/ <comment><USER3> If you're talking about engineered longevity and you're not talking about the brace of technologies that fall under the SENS umbrella [1], or even the Hallmarks of Aging catalog [2] then you're missing the most important part of the field. All of the meaningful advances of the future are going to emerge from repair of the causes of aging, not from tinkering with the operation of metabolism to try to recapture some fraction of the benefits of calorie restriction. Or even, hell, five times the benefit of calorie restriction. That won't move the needle far in humans. You'll be a lot healthier, but still die on much the same schedule as your parents and grandparents.

It costs two billion dollars or more to push through one drug candidate for a given desired effect. Current estimates suggest you could implement the entire SENS program of rejuvenation treatments in mice for that amount of money over 10 years. Those are technologies with potentially unbound gains on healthy life span; not just slowing down aging, but actually reversing its causes. Periodic repair has no limit on the degree to which it can extend life, and is far more effective for old people than merely slowing aging. Given the options here I know what I'd rather see the research community focusing on, but getting more R&D to focus on repair over metabolic tinkering is an ongoing process of persuasion and disruption.

You might look at senescent cell clearance for an example of a SENS technology that is slowly breaking into mainstream research notice. Oh so slowly. It's almost painful to watch so much time and effort being directed to old-style mine the natural world drug discovery for marginal treatments unlikely to move the needle when we're in the midst of a biotechnology revolution and so much more is possible.

[1]: [http://sens.org/research/introduction-to-sens- research](http://sens.org/research/introduction-to-sens-research)

[2]: [http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3836174/](http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3836174/)

<comment><USER4> Sorry if I don't articulate this well. I'm very much in favor of life extension and SENS but I get the perception that it's still a "fringe" science or maybe it's not perceived as well by the broader community. Can you speculate why there isn't more money and effort being directed to this research if it has so much potential?

<comment><USER5> 1) Lack of visibility; how many people even know this research is going on, and that it's potentially close enough to not classify as science fiction?

2) A perception as "natural", together with the naturalistic fallacy. The black plague and cancer are "natural" too, but we have no qualms eradicating them; yet for some reason, people romanticize death, especially when thinking primarily about it applying to other people rather than themselves.

3) Related to that naturalistic fallacy, aging afflicts a less sympathetic group. Given a disease that strikes down the "young and healthy", or the affliction hidden behind such thoughtless and abominable phrases as "it was their time" or "natural causes", the former will tend to attract more funding.

4) In a word, spirituality, whether spoken of or otherwise.

5) Too many crackpots through history have tried to peddle life extension, creating guilt by association.

</comment></comment></comment><comment><USER6> I've always found the social issues surrounding extending life to be chilling after reading Kurt Vonnegut's take on it in "Tomorrow and Tomorrow and Tomorrow" ([http://en.wikipedia.org/wiki/Tomorrow_and_Tomorrow_and_Tomor...](http://en.wikipedia.org/wiki/Tomorrow_and_Tomorrow_and_Tomorrow_%28short_story%29)). What would a future look like where there is very little room for young people to grow?

<comment><USER5> Those temporary social issues (and they will be temporary, just while society adjusts) cannot _possibly_ compare to the travesty of a hundred thousand people dying every day.

<comment><USER7> People dying is beneficial to humanity in countless ways.

People not dying is the "travesty", and preventing death is probably one of the worst things you could do to humanity.

<comment><USER8> No, death is a travesty. While it may be true that overpopulation is worse, death is awful. Painful, slow degeneration over decades as your body systems shut down and your loved ones watch.

What a gain it would be to have people continue their productive lives for decades or centuries longer.

The costs: we would give up having children. The replacement rate for an immortal race must be very low. The weight of old, bad ideas might be harder to shake off.

<comment><USER9> > The weight of old, bad ideas might be harder to shake off.

This sort of thinking seems to me a consequence of assuming that brains are somehow separate from the rest of the body, almost bordering on dualism.

They might be _easier_ to shake off, and I suspect this to be the case, if all human brains are rejuvenated brains with 25 year-old physiology. It is not clear that "old people set in their ways" is a result of minds that have simply been around a long time, regardless of their physical condition (i.e. immortal or not), as opposed to a consequence of a physically aging, deteriorating human brain.

So we might find ourselves with the equivalent of a population composed entirely of twenty or thirty-somethings, except some of them happen to have many decades (eventually centuries and millenniums) of experience. We may well be much better off than now.

</comment></comment></comment></comment></comment><comment><USER10> I suggest reading "The Idea Factory - The great age of American Revolution". The book talks about the experiences of all these exceptional engineers and scientists that were brought together under the umbrella of Bell Labs and as a result a plethora of technologies came out of it (digital computers, networks etc etc). What we need today is another similar revolution but in the field of bioengineering and health sciences.

[http://www.amazon.com/The-Idea-Factory-American- Innovation/d...](http://www.amazon.com/The-Idea-Factory-American- Innovation/dp/0143122797)

</comment><comment><USER11> After reading Wait But Why's treatise on Graham's Number, I'm not sure I want to. [http://waitbutwhy.com/2014/11/1000000-grahams- number.html](http://waitbutwhy.com/2014/11/1000000-grahams-number.html)

ETA: the article gives a sense of vastly hugely mind-meltingly large numbers; when considering a number so staggeringly gargantuan is just an infinitesimal speck at the mere beginning of "forever", the thought of living that long becomes crushingly daunting. I suggest potential downvoters read the link first.

<comment><USER12> Those are some huge numbers for sure, but how does that have any bearing on whether or not you want to live forever?

You should be worried about far smaller numbers that relate to the explosion of the sun, and the heat death of the universe.

EDIT: Sorry, I just finished reading the article :P He talks about death briefly at the end. I still strongly disagree, and would jump at the chance to live forever, although it's definitely scary to think about. I would always want to have suicide as an option, for unexpected events such as a life in prison, or never-ending torture.

The human brain is definitely not equipped to think about timescales on the order of Graham's number, but I would probably only be "human" for an infinitesimally small period of time, relatively speaking.

One day someone from the future might stumble upon these comments and laugh. I hope we make it that far, as a species.

</comment></comment><comment><USER13> Old is Gold:: When I was a kid my grandpa told me that each person has a bowl of food reserved for him by God and when you finish it you will die, so if you want to live longer eat less.

<comment><USER14> What about anorexia?

<comment><USER13> INHO, eat less does not exactly mean starve yourself to death.

</comment></comment></comment><comment><USER3> As a reminder, this is an area of medical research where you don't have to stand to one side and hope. Providing meaningful support to specific early stage research programs in rejuvenation research is well within the capabilities of most people making average developer salaries.

Look at the few hundred people who joined the Methuselah Foundation's 300 [1] over the past decade, and collectively their individual contributions of $1000/yr helped to launch early SENS research and provided seed investment in Organovo, now a successful tissue engineering concern and whose founders are a steadfast part of the New Organ initiative [2].

Or look at the crowd centered around Longecity [3] who have raised $10,000 here and $20,000 there for discrete projects in aging research, ranging from exploratory laser ablation of lipofuscin (not a success, but a worthy attempt at a technology demonstration) to a SENS project to demonstrate allotopic expression in two mitochondrial genes (did quite well, thank you). Early stage research is cheap, falling over yourself cheap. Meaningful cutting edge projects can run for a few tens of thousands of dollars over six months - <USER2> just have to know who to fund.

Fortunately there are good, responsible, aggressive research organizations out there like the SENS Research Foundation [3] that are coin slots for rejuvenation research and advocacy: you can be sure that money goes to good uses, funding areas of research that need unsticking and accelerating, picking those programs that have the best expectation values. You can put in a few thousand and be in good company with hundreds of other people, many from the tech industry, who have decided that it is well worth giving a small fraction of what you make each year to help ensure that when we are old there will be treatments to prevent the medical conditions that presently harm our parents and grandparents.

What use is it making a good wage, enough to greatly influence the medical technology of your future, while sitting on the sidelines and doing nothing but hoping? Who else is going to make a difference if not you? You have the choice of living the same life as before, and suffering and dying in great pain at the end, or making a better future for everyone. It really seems like a no-brainer to me. There are few places where so little money can produce so great a beneficial outcome at this time.

[1]: [http://mfoundation.org/300](http://mfoundation.org/300)

[2]: [http://neworgan.org](http://neworgan.org)

[3]: [http://longecity.org](http://longecity.org)

[4]: [http://sens.org](http://sens.org)</comment>


Scientists are leaving Amazon reviews of products used for science - <AUTHOR> https://www.washingtonpost.com/news/speaking-of-science/wp/2018/01/30/fits-neatly-inside-a-lizards-cloaca-scientists-are-leaving-amazon-reviews-and-its-amazing/ <comment><USER2> I had trouble reading the article because of adblocker-blockers - it was fun when I got there but if anyone else has trouble it's mostly a selection of highlights from this twitter thread and related hashtag #reviewforscience : [https://twitter.com/DaniRabaiotti/status/958227887915786241](https://twitter.com/DaniRabaiotti/status/958227887915786241)</comment>


Peer-to-Peer Based Social Networks: A Comprehensive Survey - <AUTHOR> https://arxiv.org/abs/2001.02611 <comment><USER2> I haven't read the whole paper yet so I might be missing the reason for this, but I'm surprised that the most significant P2P social networks I'm familiar with and actually use aren't included: Patchwork & Firechat. After a quick scan of the paper, the ones included have some various attributes that are presumably interesting from an academic research point of view, but I'm naturally curious to hear an academic's view of the above _more actually useful_ (personal value judgment) apps, especially in comparison with the ones they included ....

<comment><USER3> Yeah, it seems like they're using "P2P" to mean "federated", which is backward. I'm surprised that they didn't think to include Secure Scuttlebutt in their paper.

Disclaimer: I work on Patchwork and SSB in general. :~)

<comment><USER4> Yup, SSB is a major one missing. Admittedly I was looking for my own network, Aether, which has more users and nodes than some of those listed — but if SSB is missing, then all bets are off.

I've honestly never heard of most of the things in that list and I spend a lot of time in P2P circles. Interesting.

<comment><USER5> Aether has such a compelling pitch that I was going to install it despite the Electron bloat it'd introduce on my system, but then saw that you used snaps, which was really unfortunate.

Have you considered something like AppImage instead? While not ideal, it minimizes your effort _while also_ being compatible with every other distribution without requiring your users to install a large, complicated piece of software/package manager like Snap.

<comment><USER4> Aether is a Go app, we use Electron just for the GUI. We do no processing in it - we do the processing in the go backend daemon. It's pretty snappy and light.

I tried AppImage first, it didn't work.

</comment></comment></comment></comment></comment><comment><USER6> Is anyone here a fan of Darius Kazemi? He's one of the people who I believe has a pulse on the future of the internet. He has a great document on how to roll your own federated social network:

[https://runyourown.social/](https://runyourown.social/)

<comment><USER3> Darius is great! I love to see that recommended.

One of my favorite visions for the future of the internet, Zach Mandeville's modular essay The Future Will be Technical: [https://coolguy.website/writing/the-future-will-be- technical...](https://coolguy.website/writing/the-future-will-be-technical/)

<comment><USER6> Interesting way of framing it. I need to reread this at the beginning of the week, instead of Friday at 5:11PM!

</comment></comment></comment><comment><USER7> Notice:

This is about FEDERATED networks, not P2P.

Mastodon, Diaspora, etc.

Also, it is not comprehensive:

Matrix (9M users), SOLID, D.Tube, etc. not mentioned

Examples of P2P:

WebTorrent, GUN (11M+ users), SSB, etc.

<comment><USER6> What's the difference? Is it that P2P lacks a central server but federated is distributed servers (i.e. no single central server, just a bunch that can authenticate against each other)?

<comment><USER8> Federated: there's a distinction between clients and servers.

P2P: there are only nodes.

<comment><USER9> No.

P2P: leaf nodes can communicate directly to each other. The network can be flat or structured. There can be more important nodes or not.

</comment></comment></comment></comment><comment><USER10> Can someone list all the p2p social networks that we know about?

Honestly, have been trying to find ones that are truly p2p and not federated.

</comment><comment> lota-putty Has anyone used Utopia : [https://u.is/en/](https://u.is/en/) ?

<comment><USER10> Wow what is this? It is so cyberpunk! Is this legit?

</comment></comment><comment><USER11> They misspelled "Pleroma" in that main table.

</comment><comment><USER12> No one wants to talk about IRC?

<comment><USER13> IRC is not P2P.</comment></comment>


Umberto Eco, the Art of Fiction No. 197 (2008) - <AUTHOR> http://www.theparisreview.org/interviews/5856/the-art-of-fiction-no-197-umberto-eco <comment><USER2> My favorite part (Foucault's Pendulum is a fun book too):

INTERVIEWER: Have you read The Da Vinci Code?

ECO: Yes, I am guilty of that too.

INTERVIEWER: That novel seems like a bizarre little offshoot of Foucault's Pendulum.

ECO: The author, Dan Brown, is a character from Foucault's Pendulum! I invented him....I suspect Dan Brown might not even exist.</comment>


Ask Sama: Do you plan any major changes with HN and YC - <AUTHOR>

ok, i just wanted to make the first "such" post, just ignore :-) Congrats to Sam Altman going forward <comment><USER2> Actually, as a clarifying question... will pg continue to maintain HN separately from YC? It's always appeared to me to be two separate projects with congruent goals, operated by the same person, rather than HN as a YC sub- project.

</comment><comment><USER3> probably a lot of minor changes that all together will help us grow a lot.</comment>


Workman Keyboard Layout (2010) - <AUTHOR> https://workmanlayout.org/ <comment><USER2> I too suffered from wrist pain and fatigue in the past. The experimentation with different layouts helped a little but it felt like micro-optimization. What actually resolved the problem was switching to an unorthodox ergonomic keyboard where none of the keys required straining or unnecessary effort (kinesis advantage, using a different one these days). Also, most common problems were caused by placement of special keys (shift, ctrl, backspace, enter) and that's not something colemak, dvorak or their friends seem to be addressing.

I see analogy to guitar playing here. No matter how well you figure out finger positioning for a complex passage, you won't be playing with ease unless your elbow, wrist and spine are also positioned properly.

<comment><USER3> This is so true!

There are so many quick wins to improve posture before the high-effort micro optimization of changing layouts:

\- split the keyboard for better shoulder posture (eg ultimate hacking keyboard but don't stop here)

\- Get a column staggered board with more thumb keys instead of row staggered for better finger movement (ergodox or iris keyboard)

\- Get rid of the num row and limit movement for fingers to one key in any direction using layers to simulate the missing keys (corne or kyria)

\- A sculpted and tented keyboard allows the arm to untwist. These keyboards are dish shaped which moves keys closer to your fingers. Examples are the kinesis, dactyl, or Tightyl (my own creation).

I think the sweet spot for most people is the column staggered split layout.

<comment><USER4> 100% this.

I'm using an ergonomic keyboard with the two halves of the keys at a slight angle and column-staggered design, and I can't imagine ever going back to a normal keyboard. Being able to enter every symbol without even moving the wrists is just too comfortable.

It's more expensive than any standard keyboard and I had to solder it myself, but it's basically customised for my fingers. I'm not typing faster, but I have much more fun doing it and fewer issues with my shoulders. I would say it's a much more important upgrade than changing away from QWERTY(which actually isn't that bad, there are a few false myths floating around about it).

</comment></comment></comment><comment><USER5> An oversight in the layout, in my mind—the human hand is better at typing in certain directions… the hands very naturally roll towards the center, but it is less natural to rotate away from the center. This is… somewhat covered in the article under SHU…

> It is much more efficient to ride the momentum of a single arm or wrist > stroke and type a combo rather than just one key.

Try ASDF versus FDSA on a QWERTY layout. ASDF feels much more natural, doesn't it?

So, I'm concerned about the sequences like TH in the Workman layout. It looks like Workman is optimized more for minimum distance, and less for other factors. I think this is what happens when you optimize for the metrics that are easiest to measure! The thing about Dvorak is not just which keys press the fingers, but how you alternate.

So if you write THE on Dvorak, your right hand naturally rolls TH using strong fingers, and then you type E using the left. On Workman, you are rolling away from center, which is less natural.

Some clumsier words in Dvorak: SPHINX. PIX are all left 2nd digit, but they alternate with the right hand, to give the 2nd digit on the left time to move.

I may be biased. I switched to Dvorak in high school and it fixed my RSI. Dvorak is also available everywhere. I can sit down at an unfamiliar computer and change it to Dvorak within a minute. The alternation, to me, means that my fingers have more time to move and can move more slowly and gently at the same typing speed.

As a technical note—you should not be changing capslock in your layout like this on Linux. The option to choose a keyboard layout like US QWERTY or US Dvorak is a separate choice from the choice to map capslock to something else, and they shouldn't be combined.

I'm also a bit surprised that the bottom row is ZXMCV. This is so close to ZXCV… why not just use ZXCV?

<comment><USER6> > Try ASDF versus FDSA on a QWERTY layout. ASDF feels much more natural, > doesn't it?

It doesn't for me. Is it significantly more difficult/awkward? Maybe I'm used to it from playing scales on piano?

<comment><USER7> Same, I can type FDSA 3x as fast than I can type ASDF with my left hand.

<comment><USER8> Weird. I think any stereotypical image of a person drumming on the table with boredom, their fingers roll from the pinkie to the index finger. Looking at gifs on Google Images, I couldn't find any going the other way.

That makes me think that an inward roll is much more natural. I can type ASDF almost as fast as I can type A by itself, quite literally. It's like a drumroll.

1\. [http://3.bp.blogspot.com/-wuJ87jox608/VEHZPg9Fo7I/AAAAAAAAGg...](http://3.bp.blogspot.com/-wuJ87jox608/VEHZPg9Fo7I/AAAAAAAAGgE/H1hcOqJYSzU/s1600/20141017_Waiting_Patiently.gif) 2\. [https://i.pinimg.com/originals/a7/d9/52/a7d952cccac40f9949bf...](https://i.pinimg.com/originals/a7/d9/52/a7d952cccac40f9949bfd9dda968438f.gif) 2\. [https://www.cinemacats.com/wp- content/uploads/gifs/finncatty...](https://www.cinemacats.com/wp- content/uploads/gifs/finncattyfingers.gif) 3\. [https://66.media.tumblr.com/33c922620e578affa28ad2b15634c870...](https://66.media.tumblr.com/33c922620e578affa28ad2b15634c870/tumblr_p2rwwuRhot1v30a5jo1_500.gifv)

</comment></comment></comment></comment><comment><USER9> A lot of keyboards optimize the wrong things at least as far as programming is concerned. All the optimizations seem to focus on letters but most of the time an editor or shell can auto complete keywords or identifiers. A ridiculous number of symbols seem to be a very long way from the home keys on weak fingers with modifiers required to access them. If I had to write huge amounts of plain prose and had RSI I think I would just dictate it rather than try and optimize the alpha layout.

I have been tempted to get a large ortho (lots of modifiers suck) and setup a split qwerty with a heap of symbols in the center columns between them. I type '"[]{}().=<> all day so I don't get why they should be marginalized. It is like expecting an accountant to use the 1-0 row instead of a numpad.

<comment><USER10> I don't recommend it.

I too tried this with an Ergodox, but the keys you want to have your symbols on are just so far away anyway. The center columns for example are quite far.

Instead I think it's better to use layers (holding down a key to change what other keys do) and place symbols close to your home row. You can even have a numpad right under your fingertips.

This is why ergonomic keyboard users are generally moving towards boards with fewer keys, not more.

Look for QMK programmable keyboards where you can do this and much more.

<comment> jon-wood As an example of how this works, here's my current keyboard layout (it tends to change every few weeks as I find something else I want sitting on a layer): [https://configure.ergodox-ez.com/ergodox- ez/layouts/xbLyp/la...](https://configure.ergodox-ez.com/ergodox- ez/layouts/xbLyp/latest/0)

Holding the key labelled "OSL1" will switch the layout to the "Symbols" tab. The blue keys are dual-function, tapping them will enter the character on top, holding will turn it into the modifier key below. Finally the Gaming layer, toggled by the bottom right key on the keyboard, turns off all the special mappings and turns it into a standard QWERTY keyboard, because my muscle memory for game controls is too deeply entrenched to deal with in the middle of a fight :)

</comment></comment></comment><comment><USER11> I think typing efficiently on a keyboard is akin to playing the piano with good technique.

I often see musicians playing piano (or keyboard synths) with improprer technique. They move their wrist a lot, bend their finger backwards to apply pressure, and tense their fingers by laying them flat. This causes stress in the motion and fatigue over time.

All (or most) the pressing power should come from the tip and the phalanges (?). You use each finger like its own little hammer. It requires a bit of training but not much really. You just need to strengthen those tiny muscles over time by consciously moving the finger only.

Of course the rest of the hand can move a bit but it shouldn't tense any muscle at all. The wrist should only hover around the piano/keyboard to move closer to the target keys. And the rest of the arm and shoulder should of course not move or tense at all.

If you can play the piano like this, you can type on a keyboard the same way. No tension in the hand. Only a bit in the finger when it's pressing, but none otherwise. As a result, you'll likely prefer like me keyboards with very low travel. I have the Apple Mac keyboard which has a slight angle and very low travel. It's very easy to "hammer" the keys with low effort. I've never had any wrist pain in 20 years of being both a musician and a developer.

<comment><USER12> Similar experience here, and in fact I use a floating typing style more akin to playing a piano instead of sitting on the home row. I actually did end up with bad RSI for a year, however, caused by typing on a laptop, but I now realise that was due to the extension of my arms.

For a while I used Workman on an Ergodox keyboard, and it was very nice. But I learnt that I actually love QWERTY when I type in my floating style, and ultimately moved back to it and a Topre keyboard instead (which is a nice mid- point between non-mechanical and mechanical boards).

I've just taken the piano back up after 18 years, and so far don't seem to be overly straining myself, so I'm hopefully on the right track with my technique. Years of playing diatonic accordion have hopefully used many of the same muscles!

</comment></comment><comment><USER13> Looks very interesting, but re-learning how to type is so painful, not to mention devastating to my productivity at work, that I think I can only afford to do it once in a lifetime...

I recently made the switch from QWERTY to Dvorak, during a 2 week period while I was in between jobs, and it was one of the most frustrating things I've ever done. Over a month later and I'm back up to a plodding 60 WPM (from a glorious 120 with QWERTY). Not to mention how shot my vim keybindings are!

Maybe if I eventually switch again it will be less painful, but the experience has taught me that typing is almost 100% an exercise in muscle memory.

Anyway, my point is, I wish I could be the kind of person that could type fluently in multiple keyboard layouts, if nothing else then just for the heck of it, but I'm not sure I'll ever have the kind of time to make that happen. Cool project though! There are certainly words and bigrams that are needlessly hard to type in Dvorak.

<comment><USER14> I was curious about vim as well. I wonder if the defaults of vi are somehow optimized for QWERTY.

This thread convinced me to try switching to Dvorak but I'm a bit scared after reading your comment. It's not clear from your comment, did you switch back to QWERTY or are you still giving it a shot?

<comment><USER15> > I wonder if the defaults of vi are somehow optimized for QWERTY.

Only hjkl for movement. Everything else is fine.

I still wouldn't make the switch again. You'd get more millage from spending the ~2 weeks doing a bunch of speed typing practice with qwerty.

<comment><USER16> The problem is that most of the typing in vim is based on muscle memory ... thinking about it I have no idea what the keys I use for commenting out code.

I tried to learn Dvorak and later Neo ... Not being able to use Ctrl-C, Ctrl-V like I was used to was annoying ... not being able to use vim anymore was the reason I stayed with QWERTY (QWERTZ in German).

<comment><USER17> That Ctrl key muscle memory is why Colemak made the explicit decision to leave all of ZXCVB in the same place as QWERTY.

A lot of Vim is mnemonic and while relearning the muscle memory is tough, relearning the mnemonics can be useful to reinforce what you know about Vim.

(Just maybe don't make the mistake I made at one point of trying a "remap the world" configuration, learning entirely new mnemonics for classic operations, and then realizing maybe too late I'd prefer a smaller remapped config. Unlearning the wrong mnemonics is hard.)

</comment></comment></comment></comment></comment><comment><USER18> DON'T DO IT*

I absolutely love Workman. It's gorgeous. I spent months learning it, getting fast with it. I even got the supercool matrix style keyboard, I was so into it.

But now I use QWERTY, and I sold my matrix style keyboard. Why? 1\. Using the standard is useful. Other people's computers use QWERTY. Terminals for typing things in airports use QWERTY. When you have to do first aid stuff on your system, you're not going to get to change the layout. 2\. QWERTY actually isn't bad. Yes, the home row is largely wasted, but other than that, it's not as ludicrous as you've been reading. For evidence, look up who the fastest typists in the world are - plenty of them use QWERTY.

* if you think it's going to make you more efficient. If it's for fun, go for it. For me, it was worthwhile, because I got to forget QWERTY and re-learn with proper touch typing, not whatever 3-finger nonsense I was doing before.

<comment><USER19> It's not about being faster, but to not suffer from RSI. QWERTY forces your hands to stay in abnormal position which can cause wrist pain. Ergonomic layouts (and column-staggered or ortholinear keyboards) are designed with that in mind.

<comment><USER18> I should have said in my post that I have nothing to say about what you should do if you have serious pain from typing - from the other posts here it sounds like lots of things might help, including an ergonomic layout. I had minor pain and I did find it went away with the switch, but in retrospect, that was probably because I also focused on efficient touch-typing as I learned Workman, so I improved my posture, I think. I feel as comfortable typing now with QWERTY as I did with Workman.

</comment></comment></comment><comment><USER20> Keyboard layouts are incredibly fascinating. For the amount of typing that is done today it feels like we are collectively still in the Dark Ages of textual input.

A while ago on HN there was link to a talk from a stenographer (the people who do court reporting and other live transcription). They achieve the highest WPM by using a smaller keyboard and pressing "chords" of multiple keys at the same time, which map to sounds or words. Over time each individual customizes their "dictionary" to meet their usage/needs.

From there it's easy to imagine a future where children are given devices that fit their hands like gloves or wii-motes that convert motions to text, with a system that adapts and grows with them over time.

<comment><USER21> One argument goes: Stenographers need to optimise for input speed, almost everyone else doesn't have that requirement.

Another argument goes: we don't know what creativity might be enabled if everyone had that option / ability.

I've always thought fingertip and finger joint implants would make good contacts for chord-like input. Ideas are cheap though.

<comment><USER20> _Stenographers need to optimise for input speed, almost everyone else doesn't have that requirement._

Right, max WPM isn't necessarily everything (though it's a pretty good proxy for overall effectiveness of the tool), what's more interesting is the way the device can adapt to the user. The programmers complaining about the symbol keys could create mappings that make those easier/more natural (combined with a device with a more ergonomic form factor). Technically you can kind of do this with a regular keyboard via macros/expansions/remapping but it would work a lot better if the with a device that was designed with that in mind.

</comment></comment></comment><comment><USER22> For people looking to try a new layout, I recommend a Carpalx optimized layout. They have very detailed analysis on the layout:

[http://mkweb.bcgsc.ca/carpalx/?full_optimization](http://mkweb.bcgsc.ca/carpalx/?full_optimization)

I've been using it on my Kinesis for a while, and it's totally worth it:

[https://github.com/qmk/qmk_firmware/blob/master/keyboards/ki...](https://github.com/qmk/qmk_firmware/blob/master/keyboards/kinesis/keymaps/carpalx/readme.md)

<comment><USER23> > and it's totally worth it

How would you characterise it? Speed, comfort, typo rate, something else?

What layout(s) did you touch type on before carpalx?

I might be interested in switching (after 15 years of increasingly customized dvorak).

<comment><USER24> I've been using qgmlwb for 4 years or so. It's difficult to compare with qwerty, since I didn't type properly before, but it feels pretty comfortable and effortless. I feel like my right hand is overused, but I doubt it has anything to do with the layout, I just don't like using my right pinky; or, rather, it doesn't like to be used.

</comment></comment></comment><comment><USER25> A few years ago I took the plunge and started learning Colemak after extensive typing left me with pain in my hands. I haven't had any typing related issues since so personally I can recommend learning an alternative keyboard layout (whether that be Workman, Dvorak, Colemak, or other).

Using qwerty on other people's computers has never been an issue since I use my own machine most of the time. I do have to look at the keyboard when typing qwerty but it's quick enough so I don't really mind.

If you're curious what it feels like to type Colemak, I wrote a small app a few years ago which simulates Colemak for someone on a qwerty keyboard:

[http://mmlkrx.github.io/colemak-typing- simulator/](http://mmlkrx.github.io/colemak-typing-simulator/)

</comment><comment><USER26> One thing that often goes unmentioned when I see discussions about these sorts of alternate layouts is that, particularly for programmers, the keyboard isn't just a simple device for entering text, it's the mechanism through which we interact with our computing environment, and most tooling is either specifically or unintentionally designed to enhance the productivity of people typing in QWERTY. Whether it's simple copy and paste, vim keybindings, shell commands, etc., using these sorts of tools from other layouts often feels much more tedious than it does in QWERTY. So I'd caution against adopting a new layout naively, unless you're also willing to accept that you may have to also begin adapting your environment to your new layout in addition to learning the new board.

<comment><USER27> To be honest I never have any problem with that sort of thing with Colemak in terminals.

The only issue I have is in games, where WASM is a religion.

<comment><USER17> As much as I hate rebinding WASD in every game ever (and no two games share anything like a similar remap tool; every game's settings are a unique snowflake), it does at least amuse me every time that Colemak's replacement is WARS. It seems more appropriate for games, it spells out a vaguely appropriate word and R for Reverse actually makes sense mnemonically. (Walk, Around, Reverse, Sideways ;)

Though nearly universal support of Xbox gamepads and made me more of a gamepad by default player, saving WASD remapping for rare cases.

</comment></comment></comment><comment><USER28> I'd love to see a rigorous analysis of whether this type of keyboard layout really reduces repetitive stress injuries. The metrics presented are interesting, but the reduced finger movement could be a bug rather than a feature. Small micro-stretching by having to reach for keys could actually be beneficial.

<comment><USER29> It would be very difficult to get enough people to switch layouts to do any kind of study. But you can probably look to gaming, where they optimize the layouts of the keys/gamepads and there's plenty of RSI. I think changing keyboard layout is unlikely to have any benefit. Especially since you need to spend an extra hour or two a day on typing drills to become productive. That must offset any benefit.

<comment><USER27> Depends on your definition of "benefit".

You can drop regular practice after a while, so the penalty on speed and accuracy is effectively capped; while the benefit on wrist health is not, because it will stay with you for life. Imho a month or so of lower productivity is worth the long-term effects.

</comment></comment></comment><comment><USER30> I agree modifier keys are the devil. Laptop keyboards are not designed for ergo at all.

I use an ergodox ez and have various layers. Layer for directional keys. Layer for all my vscode shortcuts (you can do Marcos). Layer for symbols. Even a layer to control mouse, however I don't like or use this

I use thumb clusters for the most common modifiers like space, enter, backspace, command

What's great is that I can define alternative keys when the keys are pressed down. So I use them to activate various layers

I also use auto shift feature so holding down a a key will get your the shifted option. Great for gets Caps version etc

Here is what my layout looks like [https://configure.ergodox-ez.com/ergodox- ez/layouts/RlxdW/la...](https://configure.ergodox-ez.com/ergodox- ez/layouts/RlxdW/latest/0)

</comment><comment><USER31> I'm using a similar layout (Norman) that was derived from the Workman analysis. [https://normanlayout.info/about.html](https://normanlayout.info/about.html)

It was a bit easier to learn because most of the keys are on the same finger as on qwerty, but with the rows swapped. For me the biggest problem with using an alternate layout is that the hjkl vim movement keys are scattered.

<comment> a-p-o I consider my .vimrc-fu as only beginner, but can't you remap the keys so NIOH act as HJKL?

<comment><USER32> Which becomes pretty annoying if you regularly work over remote SSH sessions to large number of hosts where you may not be the only person on a given user.

(You could have some local shorthand to copy over your vimrc and explicitly start vim with a different copy, at which point you'll only have problems with shared tmux/screen sessions)

</comment></comment></comment><comment><USER33> > Try typing "The" with the T capitalized on Colemak and hopefully you'll see > what I mean. Try typing "The" with the T capitalized on Colemak and > hopefully you'll see what I mean

Why is he shifting with his right hand instead of his left? It seems obvious, but maybe isn't: you should shift/ctrl with the opposite hand that is going to type the letter.

<comment><USER34> This is going back into the dark ages (we were taught on electric typewriters!) but when I did a typing course I was told only ever to use my left pinky for shift and right thumb for space.

<comment><USER33> Is there a rationale behind that?

<comment><USER34> Not one that I'm aware of, and a quick check of modern online typing resources doesn't share the same bias. I guess it was either the teacher's preference or something she was taught in typewriter school.

<comment><USER27> I think "in the dark ages" it was more common to end up using keyboards with only one Shift key - think "nuclear reactor control panel" and stuff like that. So it probably made sense to bend touchtyping theory for practical purposes when preparing kids.

</comment></comment></comment></comment></comment><comment><USER35> I've been using Workman for 5 years now and it has been wonderful for reduced stress. The difference between QWERTY and workman has been so dramatic that I haven't needed to take any additional steps at managing forearm/wrist stress.

People seem to pontificate about micro-optimizations but the fact is that you're reducing your overall motion of typing by more than half. An ergo keyboard is another way to do that but you still have awkward motions.

Everyone has different sized hands. My fingers are a bit short for my average size. It works well for me.

<comment><USER36> I've been using workman for a few years, and using a keyboardio model01 for about a year.

Both have given a similar and drastic increase to the comfort of typing.

</comment></comment><comment><USER37> A few years ago I was stuck between workman, norman and colemak. I decided to go colemak for ease of transition.

Being a longtime qwerty typer, my hands came to favor a more left hand typing ratio.

I later realized colemak tends to be more right hand. My qwerty wpm rate went from avg 130 down to 80.

My hands feel more comfortable typing colemak for long durations compared to qwerty.

The placement of the letter H and E didn't really bothered me. I've since picked up a modified version of colemak that fixes some of the short comings of colemak.

Maybe one day I'll pick up workman due to having a more even left/right hand distribution.

<comment><USER36> I was in the same position, and picked workman.

In the end, portability didn't matter, because I can just use my programmable keyboard everywhere.

</comment></comment><comment><USER38> Instead of using an alternate keyboard layout, I found the alternative finger positioning described here works great for me: [https://typingsoft.com/typing.htm](https://typingsoft.com/typing.htm) The trick is to keep you wrists straight

<comment><USER39> Since I (was) a gamer my left hand rests on WASD. It's just a natural position for me :)

</comment></comment><comment><USER40> Very nice work, I'd like to see the result not with books, but with programming languages.

The problem is but you loose a very valuable thing: the ability to use any keyboard. You won't be able to pair program. You'll be very slow when using your mother's computer. The ability to use any keyboard is more valuable than increasing your WPS.

<comment><USER41> Some people are able to use two keyboard layouts fairly well so long as they practice both. Having and using a traditional keyboard layout on a laptop in addition to your heavily-customized desktop setup is a good way to do both.

</comment></comment><comment><USER42> This is dope, I love how the author took a rigorous approach towards analyzing how much effort could be saved through this keyboard

<comment><USER43> Well, you are going to spend all the saved effort in ensuring you have the layout working everywhere.

I am contractor, most of the time working on corporate PC. I use dvorak and it is already a huge PITA to explain to yet another corporate drone I need to be able to set up my own keyboard layout. Windows does not have Dvorak layout with polish accents so I have to either use my own driver or, more likely, write without polish accents.

Another problem is that Windows can have different keyboard layout when logging in and different when unlocking the machine which might cause additional login failures. Some applications try to be smart (which rarely works) and control keyboard layout. At one bank the remote desktop app would switch keyboard layout periodically (like every 5 minutes) depending on my locale settings.

So this is with Dvorak, which is popular enough. Try with a completely unknown layout and you are pretty much screwed if you ever need to be able to use computer that is not your own.

<comment><USER36> This is why I just bring my keyboard everywhere. I get everything I want without inconveniencing anyone else.

I've considered building something extremely small like a Planck just for the extra portability.

<comment><USER43> I am currently building a keyboard from scratch. Will have matrix (ortholinear) layout and will be running my completely custom controller software so that I can play with the mappings and functionality to my heart's desire. In particular I was thinking about putting sd card slot where I could put steno dictionary and have steno built in the keyboard. Mainly because I typically work on some high sec corporate computers where I am unable to install any custom software.

<comment><USER36> That's a neat idea.

</comment></comment></comment></comment></comment><comment><USER44> I'm going on paternity leave soon and hoping to use the opportunity to learn a new keyboard layout but I'm having a tough time picking which one to learn. I've already got an ergonomic keyboard (Iris) but I still hate the feeling of querty's layout. I run into so many words that just feel bad to type.

I think I've narrowed it down to two options (but I'm open to suggestions): Colemak mod-DH and Dvorak. They both take pretty different approaches that both seem to have merit. I like the ubiquity of Dvorak but I don't really predict it'll be difficult for me to get Colemak on any computer I use. Dvorak seems great but the placement of L and S seem very awkward to me. Colemak mod- DH seems to make more sense but I'm skeptical of the promise of finger rolls.

<comment><USER36> When I was at this stage, I tried dvorak, colemak, workman, and norman.

I got sick of typing ls -l with my pinky, so I decided against Dvorak.

I really liked the feel of digraphs in workman and norman.

In the end, I decided I didn't like the h placement in Norman.

After typing with workman for a few years, I'm very glad I learned. Every time I type, I am reminded how much more comfortable it is.

I would recommend you look at what's available, and choose whatever one you like best.

If you are on the fence about two or three, just start learning all of them, and drop the ones you don't like.

</comment></comment><comment><USER45> I've been using this for a few years now. I deliberately only used it on a kinesis advantage (and typematrix I tried out for a while - lack of ergonomically placed modifier keys killed me though...). I deliberately use QWERTY on laptops and so on, so my fingers retain some memory of that and let me switch back and forth easily.

It took a while to get fast enough to be productive - it's a pain switching layouts.

The nice thing about using a kinesis advantage is that as it re-maps the keys in the keyboard, the computer isn't aware of keyboard mapping at all.

When I was trying out things like the typematrix or a MS keyboard that required drivers etc, it was always a pain getting things like BIOS passwords, login screens, etc. to work reliably.

</comment><comment><USER46> I use the Neo layout since 2013. In my optinion, it is optimized for the German language and for programming. I really love it.

On Linux this worked perfectly for me, but on Macs there are some (Electron?) applications which have their own idea of keybindings. Notably MS Teams. They have their own idea of keybindings and assume some kind of quertz layout. Which using neo makes typing a questionmark, which works using "layer 3 key" (caps lock) and what is "h" on querty impossible. So I end up mostly just typing :question in chat, which produces a questionmark emoticon. Talk about workarounds. Oh yeah, it does not work because Teams opens the "help" window instead.

</comment><comment><USER3> Learning a new layout takes months of training. If you want to improve ergonomics, I would take the following steps;

1\. Get as split keyboard for better shoulder posture (ultimate hacking keyboard)

2\. Get a column staggered board instead of row staggered for better finger movement and more thumb keys (ergodox or iris keyboard)

3\. Get rid of the num row and limit movement for fingers to one key in any direction using layers to simulate the missing keys (corne or kyria)

4\. A sculpted and tented keyboard which allows the arm to untwist and is shaped like a dish to move keys closer to your fingers like the kinesis, dactyl, or Tightyl.

I got used to a kyria board in a week and it's helped hugely to improve my back pain. Never going back to a non split keyboard!

<comment><USER47> >Learning a new layout takes months of training.

This is completely false. If you go cold turkey and actually work at it you can actually memorize a keyboard layout in a single afternoon, though you will be slow as hell. If you keep at it without switching back you can get up to like 30 wpm in a week. I did it with both colemak and beakl 15.

The problem isn't that it takes months, the problem is that it is incredibly tedious and you have to really want to do it because you will hate your life for the first couple of days.

<comment><USER3> I'm not saying it's impossible or that you shouldn't do it. I'm saying it's not the first thing you should improve.

If you compare switching to colemak the other improvements I listed, it's by far the most effort. I am practicing colemak which mentally exhausts me a few times a week and I'm only up to 18 wpm. Picking up a split keyboard will take maybe an hour before you are back up to speed and you will gain the benefits instantly.

When you're "back up to 30wpm after a week of training" you're still typing at crippled speeds. It takes a significant amount of effort to learn a new keyboard layout.

<comment><USER47> I actually agreee. The conclusion I came to at the end of it was that learning a new keyboard layout was basically a waste of time for most people for a number of reasons. First of all there's no actual science that proves it's ergonomic efficacy and if it does actually accomplish anything it's negligible compared to other things you could do instead. On top of that it makes interfacing with other people's computers an absolute nightmare. It also has random bugs and quirks if you use software based implementations where it randomly won't work in vnc or a virtual machine or whatever. I actually did it just because I'm a technical masochist and it was fun, not because of some delusion of actually fixing anything. I wound up switching back to qwerty in the end.

As for picking up a split keyboard being easy, that isn't necessarily the case depending on how messed up your typing is. You may need to relearn how to properly type to use them. That said I would agree that you would get MUCH more ergonomic benefits from switching to a split keyboard than you would from learning a new keyboard layout with a fraction of the work required.

>When you're "back up to 30wpm after a week of training" you're still typing at crippled speeds.

This definitely isn't true. You are actually just under the average typing speed. Also if you are doing stuff like programming or many other things your 70+ wmp typing isn't actually doing anything for you because your are already bottlenecked by thinking and other such things. Typing at 30wpm isn't nearly as bad as you think it is. Also you continue to improve from there.

<comment><USER3> I totally agree!

</comment></comment></comment></comment></comment><comment><USER48> Only partly related, but if you are an aging programmer like me you should consider using a vertical mouse. They are a total eyesore, but switching from a normal mouse is almost seamless and they can dramatically reduce wrist strain.

</comment><comment><USER49> I used hunt and peck for years before learning to touch type. After four years of touch type I'm still fairly crap. If I try to speed up i commonly get the letter order wrong of two successive letters. I'm a lot better than hunt and peck but I'm kind of disappointed. Would it be a major job moving to Dvorak and can you expect big improvements? Also is it better for the keys programmers use that others don't use so much like += etc

<comment><USER23> > Would it be a major job moving to Dvorak and can you expect big > improvements?

Don't expect improvements in speed. For me it's all about comfort.

What's a major job for you? You can memorize the layout in a day, type painfully slow for a couple days, start to feel rather comfortable in a week or two tops (still likely slower, depending on how fast you were, but now you're accustomed to the pace you type at on your new layout). Getting to the 80-100 WPM range takes weeks.

This, of course, assumes that you put in the effort (do drills and memorize the layout first of all; keep doing drills daily, and _don 't switch back to your old layout when it feels convenient_).

<comment><USER49> Thanks for the replies everyone. The sense I'm getting is there's are no magic bullet keyboards out there and the best thing to do is stick with Qwerty and take some lessons. BTW I've seen a kid touch typing one handed at a phenomenal speed, the other hand being taken up with the mouse.

</comment></comment></comment><comment><USER50> I used Workman for a year back in 2013. I even submitted it for inclusion into the Xorg project (perhaps a little prematurely). [https://bugs.freedesktop.org/show_bug.cgi?id=56998](https://bugs.freedesktop.org/show_bug.cgi?id=56998)

Overall the layout felt great and relieved a lot of pain. I have two issues with it. The first one is that vim keybindings are terrible. This could easily be fixed by remapping keys in vim. The second issue is typing PO and OP sequences. This wasn't really noticeable until I hit around 60-70 wpm, then it stuck out like a sore thumb. If you don't typically type faster than that, this probably isn't an issue.

I have also typed Colemak and Dvorak (current layout) at a high level. Colemak was the the most painful for me as my index fingers just felt overloaded all the time. Dvorak was also a little painful on the right pinky until it got stronger. Dvorak was also the hardest of the three layouts to get used to.

All three are way better than Qwerty when it comes to typing comfort.

</comment><comment><USER51> I don't use my computer for writing epic novels, I'm using it to play games (key placement doesn't matter) and programming. So how much easier/difference is there for programming in different languages? I know for a fact that PHP made the choice for the namespace separator based on availability on certain keyboard layouts.

<comment><USER36> Hopefully you are writing comments and documentation.

You just wrote a whole paragraph on HN.

In my experience, there is a huge increase in comfort to be had.

</comment></comment><comment><USER52> Many years ago I too had pain in my wrists while doing lots of programming work. For me the game changer was using Vim and mapping ESC to jj in both the editor and the shell (via .inputrc). In fact I mostly use Vim because of the provided ergonomics, the fast editing capabilities are just the cherry on the cake.

In my opinion the main culprit are modifier keys (e.g. by default the shell uses emacs bindings and you do a lot of ^A, ^E, ^R, etc.), but using jj mostly solves the issue as you just have to reach for Ctrl when you require SIGINT or copy/pasting in different environments that do not support vi keys. There are also people that remap it to Caps-Lock, but I just don't like to use my pinky that often.

Of course, everybody is different, but it makes sense to think about a setup that suits you and your health.

<comment><USER36> Modifier keys suck on traditional keyboards.

Modifier keys are great when they are put under your thumbs.

<comment><USER52> It's true, I don't have any problem with using SPACE via left thumb, but I have never encountered a layout or keyboard that let's me use the thumb for modifier keys. Do you have an example?

<comment><USER36> I'm using a keyboardio Model 01 ([https://shop.keyboard.io/](https://shop.keyboard.io/)) right now.

The thumb (and thumb knuckle) keys are my favorite design point, but the entire design is excellent. They are out of stock, but the designs are open source, and there are a lot of other great DIY designs around.

The Ergodox has thumb clusters similar to the Kinesis Advantage. There is also the Dactyl, and many many more.

If you want to go down this rabbit hole, reddit is a good place to start: [https://www.reddit.com/r/ErgoMechKeyboards/](https://www.reddit.com/r/ErgoMechKeyboards/)

</comment></comment></comment></comment><comment><USER53> Agree with Workman's criticism of Colemak, that the letters D and H are placed sub-optimally.

I find moving O to reduce the use of the right pinky to be pointless, and self-contradictory since A is not moved, and remains under the left pinky.

I also find the movement of C and V to be a non-starter for me.

It looks like the Norman layout tries to address the DH issue of Colemak without messing up common shortcuts.

Although the DH issue is not enough for me to abandon Colemak. Probably because I have large-ish hands and thus don't make any wrist movement when typing HE, as the Workman author does.

Although, for those still on QWERTY, switching layouts in general is just not worth it. Remap capslock to a backspace and be done with it. And maybe get an ergonomic keyboard that doesn't mess too much with the placement of modifier keys.

<comment><USER17> DH was an intentional compromise that Colemak took to increase QWERTY compatibility and Colemak documentation has always acknowledged that, so I respect it isn't perfect, given trade-offs, but as Workman acknowledges changing DH has a knock-on of changing a lot of things that I like about Colemak.

I think Colemak also better optimized some trigraphs over Workman's digraph focus.

That said, the difference between Workman/Norman/Colemak/Dvoarak is all rather "slight" compared to the respective distance between Qwerty and any of them, so some of these distinctions truly are "micro-optimizations". Most people would do better to learn any of them than keep with QWERTY whether or not they can tell which one micro-optimized better.

</comment></comment><comment><USER54> I appreciate such efforts and consider QWERTY more or less a historical accident. But how do you actually use these layouts? Do you pull the keys from your keyboard and rearrange them physically? But what about notebooks then where this is often not possible? Or do you train you brain to remember the key positions so that it doesn't matter what character is printed on a key? But how do you _learn_ the layout then?

The longer I think about it the more I come to the conclusion that you have to hammer the new layout into your head, since there are many situations, like the keyboard of a colleague, where the physical layout wouldn't match. But again: how to learn it efficiently without a lot of frustrating typing errors?

The best would be some kind of official standard and the introduction of a new layout in schools.

<comment><USER55> I learnt Dvorak 6 years ago and now type exclusively in Dvorak on QWERTY keyboards (currently a Microsoft Ergonomic). I have never used a keyboard with a Dvorak printed key layout. I think my Dvorak typing speed is still slightly slower than my old QWERTY max, but it feels much more comfortable typing for long periods, and less effortful.

The printed keys don't mean much - to learn to touch type correctly you shouldn't be looking at the keys anyway. I used a few typing games to start and then switched cold turkey for a few activities that didn't require speed (like responding to emails). It was, indeed, very frustrating.

That said, I don't recommend switching for most people, because you will get much worse at QWERTY and when you occasionally need to type it (like on a colleague's keyboard) you will appear incompetent; you will ruin your muscle memory for keyboard shortcuts; and, because standard Dvorak is not great for programming IMO due to the position of the [{ and }] keys. But now I'm in too deep, and I know from experience how hard it is to switch so I don't want to switch back!

<comment><USER56> I switched to Dovorak maybe more than 15 years ago. But I found it put too much load an the pinky fingers (which already are pretty loaded doing enter, backspace, shift). Also typing german is very awkward with Dvorak.

I then switched to NEO layout [1] which is optimized for german, programming and english. I never regretted that. For programming, NEO is superb. It gives you 3 different shift keys (each present two times on both halves of the keyboard) thereby allowing a lot of punctuation and other special keys being typed blindly without much moving of the hand.

Switching back to occasionally work on a qwerty keyboard was impossible at first. But eventually I got used to that and I can now go forth and back and adjust within minutes. Though qwerty typing speed and accuracy is much lower than my NEO speed and using qwerty generally feels frustrating.

[1] [https://www.neo-layout.org/](https://www.neo-layout.org/)

</comment></comment></comment><comment><USER57> I had some pain in my right pinky and it made me realize tons of programming symbols and Enter are over there. I've been strongly considering remapping them somehow, though after wrapping my pinky and ring finger together for a couple weeks I was fine.

<comment><USER23> I have sticky modifiers on the top alpha row on middle fingers. So E+JK give me (), E+M, give me {}, E+UI give me [], E+H gives =. I+QWERTASDFGV give me numbers, I+U gives & and so on.. (actually I use a custom dvorak, but it's probably less confusing to explain this in terms of qwerty). Every symbol is bound this way. Shifts are also sticky so I don't need to tense up my hand so much for every capital letter.

I'm still using too much pinkies for ctrl, but I think only a new keyboard will fix that (I need a proper thumb cluster, kinda like I had on my kinesis advantage).

<comment><USER57> Yeah I've been considering something like that; I'm pretty concerned with training myself away from QWERTY, but if I had some additional custom binds that seems workable.

</comment></comment></comment><comment><USER58> On normal keyboard layout you press so many keys with your pinky. I think it's ridiculous.

I design my 40% keyboard (vortex core) layout[0] according to 3 principles:

1\. do not assign pinky to any key need you press and hold (ctrl, shift, alt, etc.)

2\. do not assign pinky to any key you press frequently

3\. try to assign these keys to you thumb or bottom part of the palm (hypothenar?)

So I assign space to the left palm, ctrl to the right palm, alt, cmd and shift to the left thumb, pn (modifier to enter numbers/symbols) to the right thumb.

Enter is assigned to pn+n, esc is assigend to right pinky because I'm not a vim user.

[0]: [https://imgz.org/ih6XktnR/](https://imgz.org/ih6XktnR/)

</comment><comment><USER59> I'm amazed that people are able to quickly "try out" new keyboard layouts. I'm not a particularly good typist as it is. I feel like a new layout would take months of infuriating practice and lost productivity to learn.

<comment><USER36> Successfully "trying out" does not involve proficiency.

I tried out several layouts before deciding I liked workman the most.

</comment></comment><comment><USER60> Slightly OT, but I just now realized that I rarely actually use my pinky finger to type (particularly on the right). Left pinky: ctrl/shift (and sometimes but not always "a"), Right pinky: enter and "/".

I usually shift my ring/middle finger around to compensate. If you asked me yesterday if I touch type "correctly" I would have said yes, but apparently I'm pretty sloppy with what fingers go where and my brain fills in the gaps without me realizing it.

</comment><comment><USER40> My favorite keyboard improvement is Ten Key Less (TKL), and buying a separated numpad. Your hand will be nearer the mouse. Less movement is more comfortable.

</comment><comment><USER61> Here's a good PyCon presentation from someone who switched to voice input for programming.

[https://www.youtube.com/watch?v=Wpv-Qb- dB6g](https://www.youtube.com/watch?v=Wpv-Qb-dB6g)

I hadn't thought about it until this thread, but one of the biggest barriers for me using it was that we have a really quiet open office, but now that we are WFH...

</comment><comment><USER62> > Typing 'HE' (in Colemak) forced the hand to make a very unnatural sideways > twisting motion from the wrist and then back again.

Perhaps I have larger hands than the average, but I don't experience this. I can even type DE with the index and middle finger of my right hand. Anyone have video of how this is uncomfortable? I'm having trouble imagining it.

<comment><USER8> I was stuck on that as well. For reference, this is typing the combination HK on a Qwerty keyboard. I shift my index finger over for the H, and then use my middle finger for the K. Watching my wrists, they don't move at all.

I thought the rest of the article and the approach very interesting and rigorous, though, although I thought the text-only effort results of all the different books impossible to grok as text, and would have appreciated a simple chart.

</comment></comment><comment><USER63> I use a modified Pok3r layout and dumping the caps-lock in favor of another modifier is one of the best keyboard hacks.

</comment><comment><USER64> I'd really love to see some serious work go into studying keyboard layouts to see if they actually make the differences claimed.

Not that I'm sceptical more that I'd like to be able to quantify the difference they are worth. I'd love to try one out but not sure it's worth the time investment.

<comment><USER36> There has been a lot of effort put into quantifying potential results.

At the end of the day, workman is much more _comfortable_ , and that makes me happy.

</comment></comment><comment><USER65> For people who write code rather than novels it would be really handy to see a corpus from github or somewhere.

</comment><comment><USER66> Cool idea. "Database" is sadly still a primarily left-handed word, but I understand that's because the goal is not to change anything about querty that doesn't need to be changed. I think moving the 'e' to the right is a good idea.

</comment><comment><USER67> Interesting. But perhaps similar to re-inventing spats to use plastic instead of celluloid - too little, too late. Perhaps more useful to work out making thumb-typing on a phone better.

</comment><comment><USER68> As enraging as I find switching back and forth between English and German keyboards, I fear I just don't have the emotional fortitude for something like this.

</comment><comment><USER69> interesting this was explicitly designed for programming but the travel tests were for books. reproducing some open source program seems more relevant

</comment><comment><USER70> been using dvorak for 15 years and i'd do it again in a heartbeat. so smooth.

</comment><comment><USER71> This article is from (2010)

<comment><USER47> are keyboard layouts like a time sensitive matter? qwerty is from the 1800's and dvorak is from the 30's. By comparison this article came out yesterday.

<comment><USER71> Not really - but I thought this was something new when reading the article.

</comment></comment></comment><comment><USER72> First you have to get rid of the absurd Euro/ISO keyboard layout. [http://i.stack.imgur.com/j4xYE.jpg](http://i.stack.imgur.com/j4xYE.jpg)

Only then can we talk about moving the vowel keys.

</comment><comment><USER73> Or get a gyro ball and avoid the wrist problems altogether.

</comment><comment><USER74> Is it just me or is it missing arrows entirely?

<comment><USER43> Not all keyboard layouts use arrows.

Long time ago keyboards did not have arrows. Nowadays, some keyboards use function key to switch some keys to their alternative function, including arrows. This is true especially with 40% keyboards where there is just no real estate for arrows and to some extent with 60% keyboards.

<comment><USER75> Vi was made for a keyboard without arrows, which is why it has hjkl instead.

<comment><USER76> Actually, vi was made for a keyboard with arrow keys - the arrow keys were non-dedicated and used the HJKL keys.

[https://en.wikipedia.org/wiki/Arrow_keys#HJKL_keys](https://en.wikipedia.org/wiki/Arrow_keys#HJKL_keys)

</comment></comment></comment></comment><comment><USER77> I have done testing of my own on personalized keyboard lay-out by keylogging myself. My initial interest in keyboard layouts was piqued years ago with the CarpalX project [1], so I started keylogging myself in 2017. I am a researcher, programmer, sysadmin, and work in a multilingual environment (Python, English, Dutch, R, Java, French, Spanish), so I was expecting some interesting results.

I put 3 years worth of keylogs into Patorjk's Keyboard Analyzer app [2] used by OP (after sanitizing passwords and personal identification). Here are my personal results:

      Programmer Colemak      59.06
      Colemak                 59.02
      CarpalxQ                56.02
      Workman                 57.43
      Workman for Programmers 57.16
      Simplified Dvorak       54.71
      Programmer Dvorak       53.96
      personalized            53.53
      QWERTY                  46.61
      AZERTY                  44.83

I did build an Ergodox but never got around to learning it, so here are Ergodox scores:

      Colemak Thumbshift      63.12
      Ergodox/Colemak/Cub     60.93
      Ergodox Colemak v1      60.13
      Ergodox/Workman/Cub     59.27
      Ergodox Colemak v2      57.07

For me, Colemak variations seem to come on top over Workman and CarpalX in this test. Note that Patorjk's Keyboard Analyzer [2] does not have a ergonomic typing effort modeled in as much detail as the CarpalX model which takes into account full stroke path. It is very much possible that CarpalX will come out in front of Colemak using the more CarpalX model. Other interesting layouts can be found at the Keyboard-Design.com ranking [3] which uses [2] on different (programming) language inputs. For me personally, I will start learning Programmer Colemak on my regular keyboard and Colemak Thumbshift on my Ergodox.

OP argues against Colemak based on added typing effort due to horizontal and diagonal stretching. If Workman is better in this regard, PatorJ's Keyboard Analyzer [2] as not as good a tool as CarpalX to reflect this advantage. CarpalX takes into account finger travel distance, hand/finger/row penalties and stroke path. PatorJ's tool does not model stroke path or allows for penalization of horizontal and diagonal movement. I would like to have seen an analysis using CarpalX as that could have strengthened your argument for Workman. Additionally, OP puts a lot of focus on the common monolingual English keystrokes (HE) which is not necessarily relevant for multilingual programmers.

A personalized approach is necessary because most standard lay-outs are based on monolingual text datasets of books as is in the OP. Everyday typing of an IT-professional does not resemble natural language text in the slightest, so actual keylog input is required for any layout analysis IMHO.

Overall, I very much appreciate the effort OP put into Workman, it looks great! It seems Workman is a serious contender for first place alongside Colemak and CarpalX.

1\. [http://mkweb.bcgsc.ca/carpalx](http://mkweb.bcgsc.ca/carpalx)

2\. [http://patorjk.com/keyboard-layout-analyzer](http://patorjk.com/keyboard- layout-analyzer)

3\. [https://www.keyboard-design.com/best-layouts-by-average- rank...](https://www.keyboard-design.com/best-layouts-by-average-ranking.html)

<comment><USER36> Thanks for sharing your stats. It's really neat to see that context.

I've been using workman for a few years. I chose it over colemak and norman after trying them all and picking the one I enjoy the most.

<comment><USER77> I am not writing off Workman or CarpalX just yet. Will try them all three and settle on one. They're close enough in score.

</comment></comment></comment><comment><USER78> I use BEAKL v15.</comment>


How to Hide a Billion Dollars - <AUTHOR> https://www.economist.com/leaders/2019/10/10/how-to-hide-a-billion-dollars <comment><USER2> Here's a perverse aside, I suspect once you get much over $10k to hide, each 10x increase in the amount actually makes it easier, not harder. Reasoning: if you've got a small amount, transaction costs eat it up quickly and there's little incentive for others to get involved.

If you've got $100m there are entire ecosystems of consultants offering to "help you put that money to work." Identifying the more "cooperative" ones willing to look the other way or sidestep certain barriers is probably not too hard. And with $100m to hide, if it costs $5m to get the job done, that may seem like a good deal.

Back when I sold my startup to an F500 acquirer, within days of the acquisition hitting the news I started getting calls on my non-public, pretty closely guarded, mobile number from financial advisors, investment bankers and consultants. Everyone from Goldman Sachs on down. One of them pitched me on how I could "shelter" funds. I asked him how and he walked me through a byzantine scheme that seemed pretty shady - and I didn't even have anywhere close to "real" money compared to even a fledgling banana-republic despot.

<comment><USER3> 150k+ range should get easier. Anything less fees still eat you up. At lower amount you basically be looking to mingle with entrepreneurs that have capital and are willing to exchange at a percent equal to their risk.

<comment><USER4> Less than 150K is cash or gold.

Pretty easy to put coins in your pocket (or several pockets) with change.

Carefully thought through, I'd bet you can put $100,000 into the change cup at the airport security line and nobody would have a clue.

For instance, the Canadian Loonie [0], and the Canadian Gold Maple Leaf coin [1] have similar color the same face on one side.

You can get more esoteric if you go with collector coins. Take a 1932 US Quarter, with a value up to $15,000. [2] I guarantee you could put ten of those in your pocket and nobody would notice!

[0] - [https://en.wikipedia.org/wiki/Loonie#/media/File:Canadian_Do...](https://en.wikipedia.org/wiki/Loonie#/media/File:Canadian_Dollar_- _obverse.png)

[1] - [https://www.walmart.com/ip/Canada-1-oz-Gold-Maple- Leaf-9999-...](https://www.walmart.com/ip/Canada-1-oz-Gold-Maple- Leaf-9999-Fine-Random-Year/740050376)

[2] - [https://www.ngccoin.com/coin-explorer/washington- quarters-19...](https://www.ngccoin.com/coin-explorer/washington- quarters-1932-1998-pscid-38/1932-25c-ms-coinid-15790)

<comment><USER3> I will just say the government is petty. Your scenario seems easy but the percentage you lose converting coins in and out would add up. I have witnessed civil forfeitures in the amount of; 3k money orders, 5k money orders, 4.5k, 7k cash, 11k cash, 19k cash, 58k cash, 240k cash, assets, bank accounts. Never charged with a crime. They keep a closer eye on this then you would think and FYI TSA gets a bounty on cash collected along with local agency's in most counties. I like the coin idea though. I can ensure you its not the first time I have heard it and ironically the first solution Ive heard from a couple of engineers when broaching the subject.

</comment></comment></comment></comment><comment><USER5> >Prosecutors are mystified as to what military purpose might be served by the upper deck's jacuzzi.

Actually South Africa's former crooked president solved that.

You see it's not a swimming pool. It's a firepool. A source of water in case of fire. Making it a safety feature and thus legitimate expense to guard the president.

And to prove it they - I kid you not - made a youtube video about it:

[https://www.youtube.com/watch?v=TH2PWsn1qu8](https://www.youtube.com/watch?v=TH2PWsn1qu8)

<comment><USER6> That's actually a legitimate feature of a swimming pool if the building doesn't have another water supply (e.g. mains water or a pond) nearby.

In Australia they are a tax deductible expense as a water facility: [https://www.theland.com.au/story/4330059/cool- pool-20k-tax-w...](https://www.theland.com.au/story/4330059/cool-pool-20k-tax- write-off/)

<comment><USER7> Quite ingenious low cost reuse of a half container with prefab fibreglass inlay. Even without the tax incentive.

[http://shippingcontainerpools.com.au/](http://shippingcontainerpools.com.au/)

[https://www.instagram.com/shippingcontainerpools/](https://www.instagram.com/shippingcontainerpools/)

</comment></comment></comment><comment><USER8> A good modern day story of how not to hide $4 billion is Jho Low: [https://en.m.wikipedia.org/wiki/Jho_Low](https://en.m.wikipedia.org/wiki/Jho_Low)

The book that chronicles (Billion Dollar Whale) is a real page turner, with lots of it being unbelievable.

Seen The Wolf Of Wall Street? He funded its production with his stolen $... :)

<comment><USER9> Agreed. I also enjoyed this short summary write-up about part of the book... [https://philip.greenspun.com/blog/2019/09/08/how-to-steal- bi...](https://philip.greenspun.com/blog/2019/09/08/how-to-steal-billions/)

</comment></comment><comment><USER10> > Chatham House, a British think-tank, estimates that $582bn has been stolen > from Nigeria alone since it won independence in 1960. [1]

[1] [https://www.economist.com/middle-east-and- africa/2019/10/10/...](https://www.economist.com/middle-east-and- africa/2019/10/10/african-kleptocrats-are-finding-it-tougher-to-stash-cash-in- the-west)

<comment><USER11> Not just a developing country problem. Look at the money that cannot be account for during the Bush wars of the early 2000s, with Halliburton being given costs+profit contracts and being able to say without oversight what there costs where.

Same for a lot of developed countries with the 2008 banking crisis with billions unaccountable

</comment></comment><comment><USER12> [http://archive.is/frnY9](http://archive.is/frnY9)

[https://web.archive.org/web/20191014191405/https://www.econo...](https://web.archive.org/web/20191014191405/https://www.economist.com/leaders/2019/10/10/how- to-hide-a-billion-dollars)

</comment><comment><USER13> Article cites gulf royals and king of Swaziland as examples of corruption but neglects to mention the UK's own royal bunch who are just as wealthy or even more so with no good explanation for how and why they're entitled to so much of the country's wealth. A one-eyed take if you ask me. Typical of the economist.

<comment><USER14> The UK Royal family is wealthy because they acquired land through a combination of warfare and marriages many centuries ago. If they're unique, it's in the lengthy tenure; other medieval kingdoms have mostly overthrown their kings and seized their assets.

That's _completely_ different from rulers who are actively looting their nations today.

<comment><USER15> Of course it's different but I fail to see how it is "completely" different given that the UK Royal family did actively loot ancient Britain. Tomeito tomato if you ask me.

<comment><USER16> Yes we need to demand reparations from France oh no wait the Normans came from Scandinavia.

</comment></comment></comment></comment><comment><USER17> This is the simple but not obvious way to hide a billion dollars. While you are still looting resources of your country, make sure you are friendly to United States of America and allow them to also loot. They won't touch you. No-one will go after your loot if the US is also benefiting from the looting.

</comment><comment><USER17> What is the difference between Mswati and the Queen of England? eSwatini also have a Prime Minister. Just like Britain. We can say the same thing about the Queen of England and other royals. He is living like a King because he is a King of eSwatini, not an elected leader. Just like the Queen of England.

</comment><comment><USER18> > Mo Ibrahim, a Sudanese-British telecoms tycoon, has endowed a $5m prize each > year for an African president who governs well and retires when his term is > up. You can live quite well on $5m. Yet for seven of the 12 years since the > Ibrahim prize began, no worthy recipient has been identified.

</comment><comment><USER19> Here's me expecting an intricate and convoluted article on how to split the billions in lower sums on different accounts and banks, use bitcoin and sorts, make investment funds and bogus charities (like US billionaires) and instead I get...this?

</comment><comment><USER20> > Yet for seven of the 12 years since the Ibrahim prize began, no worthy > recipient has been identified.

The last sentence was truncated.

</comment><comment><USER21> Kudos to Mo Ibrahim for putting his money where his mouth is.

</comment><comment><USER22> These articles always focus on poor countries, but shouldn't we treat such places as Switzerland as corrupt, given that the money always seems to end up there or it is used as a stepping stone so that mineral wealth can be siphoned off cheaply (and thus pay less taxes)?

<comment><USER23> Before blaming Switzerland, perhaps best to take a look at places such as the U.S. and Delaware, which gets even more of the world's shady business.

<comment><USER24> Because it isn't true? Delaware doesn't charge state corporate income tax and has a specialized business court system. It does nothing to shelter you from international taxation.

<comment><USER25> The only reason people believe this non-sense is because of how we are going into another election cycle and pundits like to stoke people's ignorance of international finance/taxation. If you repeat a lie enough, it becomes reality and then you can use that new reality to push your agenda through with the support of the ignorant masses.

<comment><USER26> For someone railing against "ignorance," your comment is certainly lacking in knowledge. Some useful information would be helpful.

</comment></comment></comment></comment></comment><comment><USER27> If you have substantial _liquid_ wealth, the best ways to hide it include art (portable/small objects with stable/increasing prices) and foreign real estate in desirable areas in municipalities with strong property rights.

<comment><USER28> How is art liquid? I don't know much about art but my gut feeling would be that it is very illiquid by default. Also very hard to value and difficult to know which pieces will actually have value 10 years from now.

</comment></comment><comment><USER29> [http://archive.is/frnY9](http://archive.is/frnY9)

</comment><comment><USER30> Bitcoin!

(Loud chorus of laughter)

<comment><USER31> That could be an article titled how to lose a billion dollars.

<comment><USER32> Tether it is then. \s

<comment><USER33> That's how to _steal_ a billion - related but not quite the same thing.

</comment></comment></comment></comment><comment><USER34> just ask the Biden's on how to do it

</comment><comment><USER35> This article is doing it wrong.

It should be an instruction manual on laundering it.

It instead lists how state actors messed up and defend the asset forfeitures in court.

From my travelling amongst the supposed wealthy in various countries, some cultures are just less flashy and more private than others.

The online lists of top 100 wealthiest people are 95% wrong. As in they only correctly list 5 people, in approximate order, and dont even have the names of the other 95.</comment>


What upsets you about current note taking applications? - <AUTHOR> I'm prototyping what I'd envision a note-taking application to be and would love to open up the pool of ideas <comment><USER2> Their flexibility. I'm using Wunderlist & bear currently, however, I wish Wunderlist had better integration for note taking and I wish bear could do task managment, but I wish both would support Markdown.

</comment><comment><USER3> The problem I have is too many applications, not that the applications are not good enough.

To move the needle you need to address fragmentation.</comment>


How I Hacked Facebook and Found Someone's Backdoor Script - <AUTHOR> http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/ <comment><USER2> This is Reginaldo from the Facebook Security team. We're really glad Orange reported this to us. On this case, the software we were using is third party. As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook. We do this precisely to have better security, as chromakode mentioned. After incident response, we determined that the activity Orange detected was in fact from another researcher who participates in our bounty program. Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access.

<comment><USER3> _" As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook."

"Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access."_

From the write-up:

> After checking the browser, the SSL certificate of files.fb.com was * > __.fb.com …

You left a wildcard cert on this random internet-facing unaudited 3rd party linux box with no protection against data exfiltration, or an HTTPS proxy in front of it, or anything? I know it's not as critical as facebook.com, but this is still bad. Priv escalation CVEs for Linux come out like every month.

At the very least, using this cert, anyone could run a MITM on any * __.fb.com service and compromise without ever breaking in. From the article that could include VPNs, Outlook Webmail, Oracle E-business and MobileIron. I 'm hoping you did actually have a proxy in front of it and Orange just didn't catch that.

<comment><USER4> Figure that was probably a CDN, and you don't know the origin configuration

<comment><USER3> I hope it was. But if it and the other services Orange found are just random internet-facing appliances, it's unlikely they would configure a CDN to get access, because CDNs are for public traffic typically. Nobody uses a CDN to open their outlook web mail to the Internet, for example. But they might have had a regular SSL proxy in front.... maybe.

</comment></comment></comment></comment><comment><USER5> It's buried in the bottom of the post, but I'm happy to see that Facebook paid a bug bounty of $10,000 for this. In the past we've seen Facebook refuse to pay bug bounties when the hacker goes beyond scope. Interesting that going beyond the usually scope of bug bounties actually discovered a latent exploit and _helped_ Facebook. Maybe this will result in change of policies for bounty scope.

</comment><comment><USER6> I'm not sure I understand some of the comments here claiming that 10k is not enough money for this. It clearly is enough money because Orange found the problem and reported it.

These arguments always remind me of people claiming that certain professions are not paid enough. They forget that there is a market for labor and in this case the labor is finding vulnerabilities. People will either be willing to work for the posted price or not. In the case of pen testing facebook I'd be willing to bet there are plenty of people out there looking for bugs who aren't even really concerned with what the final payout is going to be.

Yeah, they could have gotten completely owned if he didn't report this. But to him reporting it and getting 10k in compensation was sufficient. Why would facebook pay him a million if he was willing to take 10k?

<comment><USER7> There is no free market of labour. Under penalty of death you are forced to sell your labour. Ultimate buyers market.

<comment><USER8> Companies die without employees too!

A little more seriously, somehow we have to find language for different types of coercion. Otherwise we'll end up lumping the whole complicated world into one lump.

</comment></comment></comment><comment><USER9> I really think 10,000 for serious exploits like these is just not enough money. Even if OP only spent an hour or two on finding this out (although highly unlikely), they should pay based on seriousness/potential damage of the bug. Great writeup though. Super interesting stuff.

<comment><USER10> common response to why companies don't pay a ton of money for these exploits [1]

[1]: [https://news.ycombinator.com/item?id=11249173](https://news.ycombinator.com/item?id=11249173)

<comment><USER11> And I still think that line of thinking is bullshit.

The bottom line is that the dollar value for this stuff is arbitrary, and Facebook arbitrarily picking $10,000 for getting COMPLETELY OWNED and exposing any selection of personal data (in the case of the other bug, this one seems to have the potential to be even worse due to credential stealing, although it's murkier) is pretty gross IMO.

I don't know what the number should be - again, it's arbitrary - but in my personal book $10,000 is about 10x too low.

<comment><USER12> Facebook didn't get COMPLETELY OWNED. A third party product they were using for some backend line of business process that lived in a DMZ got COMPLETELY OWNED, and the researchers were unable to escalate privileges beyond it.

<comment><USER13> Doesn't Facebook's policy prohibit privilege escalation? The write the following:

 _You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.)_ [0]

It's no wonder other bounty researchers didn't find further vectors for exploiting their privileges. There was a researcher not too long ago hit by the book for this.

[0] [https://www.facebook.com/whitehat](https://www.facebook.com/whitehat)

<comment><USER12> That's an oversimplification. What actually happened was: a researcher found a serverside bug in a random backend box, got RCE, logged in, _scraped and banked all the creds off the box_ , reported the bug, and then a month later during a dispute used the creds he stored to attack other Fb properties.

Dumping directories from machines and banking their creds isn't "escalating privileges". If you did that on a pro red team project, saving the creds to use a month or two later, you'd get fired.

<comment><USER13> The case (or however one wants to construe what or how things really happened) isn't too interesting to me. Do you read FB's whitehat rules of engagement differently?

I dug up the mentioned case, and FB's first contact with the researcher included, "Please be mindful that taking additional action after locating a bug violates our bounty policy." Between FB's whitehat policies and that, I'd be pretty sure not to escalate privileges.

<comment><USER12> Me too.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> This isn't the first time files.fb.com has been publicly reported as having been breached: [http://www.nirgoldshlager.com/2013/01/how-i-hacked- facebook-...](http://www.nirgoldshlager.com/2013/01/how-i-hacked-facebook- employees-secure.html) .

</comment><comment><USER15> Nice write up. Of course, this would be the team member whose photo is merely an Orange. Paranoid security people haha...

Part that jumped out at me, aside from obvious goodies, was this:

"FTA is a product which enables secure file transfer, online file sharing and syncing, as well as integration with Single Sign-on mechanisms including AD, LDAP and Kerberos"

...followed by...

"...web-based user interfaces were mainly composted of Perl & PHP... PHP source codes were encrypted by IonCube... lots of Perl Daemons in the background"

Wow. That inspires a lot of confidence in the "secure" product. I'd have doubted Facebook relied on such a system had I not known they built their empire on PHP. We all know its reputation. Their "secure, file-transfer appliance" fits right in.

</comment><comment><USER16> Article is exactly as headline advertised, and a well-laid out write-up. Neat to come across it.

</comment><comment><USER17> Nice work, very detailed. However this is hack of Accellion's Secure File Transfer. How should Facebook, or anyone for that matter, protect themselves in these cases? I mean other then some obvious ones like not running as root, limiting file access, limiting network access to other servers...

<comment><USER18> Reason about the software as if it has already been compromised. Think about how user credentials and private keys the server touches can be used to attack other internal services, and try to limit the scope as much as possible.

<comment><USER12> Which is apparently exactly what Facebook does with this thing.

<comment><USER19> To be fair it looks like they aren't purely using SSO which is what provided the credential scrapping attack vector that was used by someone else.

</comment></comment></comment></comment><comment><USER20> I know nothing about pen testing, but this was very interesting and easy to follow regardless. Thanks so much for sharing!

</comment><comment><USER21> This is the same researcher that found a RCE in Uber: [https://hackerone.com/reports/125980](https://hackerone.com/reports/125980)

Shameless plug but if you like that kind of articles I suggest signing to my newsletter: [http://bugbountyweekly.com](http://bugbountyweekly.com). A free, once–weekly e-mail round-up of news and articles about Bug Bounty.

</comment><comment><USER22> Fascinating. Looking for a hackable system and finding someone beat you to it.

<comment><USER23> The author and Facebook, Inc are lucky that the earlier hacker was just a regular spam criminal, not some bigtime "Nation-State Hacker". The Nation- State Hacker probably would have been a great deal more careful and not left easy-to-spot PHP backdoors lying around.

This also points out a weak area in our knowledge of hacking - how often does a given exploit get rediscovered? This and other anecdotes show that it happens at least once in a while. Prevalence of rediscovery could put lie to the NSA's "NOBUS" assumption, though. So we're likely to never see the results of such research.

</comment></comment><comment><USER24> This is a great write-up. I know little about pen testing, yet I was able to follow along easily.

</comment><comment><USER25> Seems like two factor authentication here would have helped.

<comment><USER26> How?

<comment><USER27> Because the backdoor was logging fb developer credentials. The stolen creds would not be useful with two-factor required every time.

<comment><USER28> If the attacker has control of the box, he can just man-in-the-middle a two- factor token.

It would certainly require the attacker to be a little more proactive, but it would hardly stop the credentials from being useful.

<comment><USER29> But he did not have access to the box with the 2FA. The attack just had access to a box hosting software from a third party, completely isolated from FB's infrastructure.

With the passwords, however, he might have gotten access to the VPN or services. 2FA would have certainly helped.

This is of course only interesting if the passwords were reused (even the most security minted folks do that). If a third party vendor does not support 2FA, or when dealing with legacy code, it believe it is good practice to only use randomly generated passwords by password managers.

</comment></comment></comment></comment></comment><comment><USER30> If there is someone to be upset with in this situation its accellion the vendor who backs files.fb.com.

Looking at how egregious their security mistakes are they dont appear to take security seriously.

This is the same company that (last I was down there) had a billboard on 101 that says "Secure".

Many echos of oracles "unbreakable" ad campaign while being an aggressively bad at security company

</comment><comment><USER31> So Wes got only 2.5K after successfully proved he could access signing and api keys,after he was threatened with a lawsuit.

How does setting up a shell and collecting credentials and then downloading them later give you a pat on the back?

Is this some kind of a joke?

</comment><comment><USER32> emreayben23

</comment><comment><USER33> Why do you use so much emoticons in your article?

</comment><comment><USER34> Quite clever find! Good write-up, too! Kudos!

</comment><comment><USER35> Only $10000? What the hell do you have to find to qualify for that "million dollar bug"?

<comment><USER36> If you can find a way to use their backup tool to download an arbitrary user's profile, and they don't pay you out at $1M, "BS" can be safely called.

</comment></comment><comment><USER37> So since they were unable to pivot laterally, you pat them on the back and call it a win. But last time someone did successfully pivot laterally, you threatened his employer? You guys are really sending mixed messages! Are they allowed to escalate or not? And if that's the new policy, shouldn't you pay the other guy who did escalate?

<comment><USER12> That's not what that person did, and you know that, because you were on the thread where this was picked apart.

The person who had problems with Facebook didn't "pivot laterally".

He popped a shell, _dumped and banked directories from the server_ , held them secretly, and used their contents more than a month after reporting the bug to Facebook as a cudgel in a dispute over a bounty.

<comment><USER31> I just went to that thread, read both articles and the HN thread. Your post is completely inaccurate.

</comment></comment></comment><comment><USER38> i hacked facebook and someone saw me hacking and siad why are you hacking and so that's how i hacked facebook</comment>