Save your eyes, start using f.lux - <AUTHOR> http://stereopsis.com/flux/ <comment><USER2> This thing gets a lot of love by a bunch of folks here, so I gave it a good half year of trying. But it's just too annoying.

Around 5pm, your display turns pinkish orange and it becomes a lot harder to see anything. Code gets harder to read, colors display wrong, video just fades to black. None of the advertised happiness ensues.

The second half-year it remained installed, my only interaction with it was to notice it screw up my display, then right-click the tray icon and disable it.

Needless to say, I didn't install it on the new box I bought this year. I don't understand why people like it.

<comment><USER3> Whenever Flux gets mentioned, there's two groups of people:

1: Doesn't understand it, hates the "wrong" colors. Can't get used to it.

2: Appreciates the candle-like colors, says it helps them sleep in the evening or relaxes their eyes.

I wonder if there's some sort of genetic difference? Maybe some people just aren't sensitive to bright light in the evening?

<comment><USER4> I would take this a step further and say it happens when any project or software gets mentioned on HN. There are always two groups of people: Those who like it, and those who don't. Those who don't are usually composed of a lot of people who don't actually care, but just thrive on contradicting people.

I'd say it's more of a personality phenomenon, but acknowledge the possibility you present as well.

<comment><USER5> Part of the problem is the people who like it insist that everybody must like it and anybody who doesn't like it just doesn't get it. I don't get upset when people talk about things that made their lives better, I get upset when they make unqualified statements about my life.

</comment></comment></comment></comment><comment><USER6> Two (related) things about f.lux from my experience:

1\. With only one exception I can think of, every instance of insomnia I've had in the last several years I can trace to not having f.lux enabled for some reason.

2\. The reason that happens is that I often won't notice if f.lux dies for some reason, because I am so thoroughly used to it now.

I was having real sleep trouble several years ago, and f.lux is part of a battery of things I did (along with cutting caffeine completely after 12:00PM every day, getting some aerobic exercise, not coding after ~9:00PM, and taking over getting the kids out the door in the morning to force myself to get up) which more or less eliminated those problems.

<comment><USER7> Is there any science on this? I've had a similar experience but have no idea if it's just a placebo effect.

<comment><USER6> <http://stereopsis.com/flux/research.html>

If I wasn't clear: I can _trace_ insomnia to f.lux being disabled; I'm not aware of it at the time, but then the next day or so I'm like, "oh, yeah, f.lux was off, shit." It's not like 11:30PM rolls around and I realize f.lux is off and suddenly I can't sleep.

</comment></comment></comment><comment><USER8> On Linux, you can use Redshift: <http://jonls.dk/redshift/>

<comment><USER9> Well, you can use f.lux too. I prefer redshift because of its CLI nature.

<comment><USER10> Does anyone else here use f.lux on Linux? I installed the Ubuntu version but not only does the "pause/unpause" option sometimes do nothing at all but other times it simply forgets to change the colors.

<comment><USER11> I tried f.lux a month or so back on Xubuntu, and it just flat out wouldn't work for me. So I tried redshift, and it worked just fine.

</comment></comment></comment></comment><comment><USER12> I love f.lux and can't recommend it enough for software developers who work with code.

If you're a designer then you probably can't use this. Desginers need colors to display properly.

Set the transition to slow and you won't get blindsided by the temp change when it's dusk; use your machine for an hour or two and by 22:00 turn off f.lux and see how bright your monitor is. It's the sun! That's why I love f.lux.

</comment><comment><USER13> If you happen to have a /sys/class/backlight/acpi-video0/brightness file on your system (e.g., linux laptop). Here's a light weight and easy to customize option.

First make this file writable.

        chmod o+w /sys/class/backlight/acpi-video0/brightness

Then add something like the following to your crontab. I'm constantly doing this manually, and never thought to crontab it until this article.

        0 17 * * * echo 14 > /sys/class/backlight/acpi_video0/brightness
        0 18 * * * echo 13 > /sys/class/backlight/acpi_video0/brightness
        0 19 * * * echo 12 > /sys/class/backlight/acpi_video0/brightness
        0 20 * * * echo 11 > /sys/class/backlight/acpi_video0/brightness
        0 21 * * * echo 10 > /sys/class/backlight/acpi_video0/brightness
        0 22 * * * echo  9 > /sys/class/backlight/acpi_video0/brightness
        0 23 * * * echo  8 > /sys/class/backlight/acpi_video0/brightness
        0 00 * * * echo  7 > /sys/class/backlight/acpi_video0/brightness
        0 05 * * * echo 12 > /sys/class/backlight/acpi_video0/brightness
        0 06 * * * echo 13 > /sys/class/backlight/acpi_video0/brightness
        0 07 * * * echo 14 > /sys/class/backlight/acpi_video0/brightness
        0 08 * * * echo 15 > /sys/class/backlight/acpi_video0/brightnes

Note: 15 is the max brightness for me, not sure if that is standard, just cat the file to see your current level of brightness.

</comment><comment><USER14> Summary of feature requests so far: \- default to a slower transition \- support dimming too \- Add an API \- Sunset is fine, except in the winter

Most of these are on our list but it is all good feedback!

<comment><USER15> I'd also request testing on multi-monitor setups. When plugging my MBP into an external display, sometimes flux transitions to the external monitor, sometimes it doesn't.

<comment><USER16> I have a color profiled MBP and also see unreliable transitions now and again. Opening System Preferences > Displays > Color and flipping two profiles back and forth fixes it.

</comment></comment></comment><comment><USER17> Surprised nobody brings up the line in the footer, which seems pretty important:

> F.lux is patent pending.

So they're applying for software patents on this so-far-free piece of software that has an open-source linux equivalent?

<comment><USER18> Why not?

<comment><USER17> Not sure if that's sarcastic or trolling or not. In the event that it's earnest, software patents are relatively frowned upon by most non-corporate entities: <http://en.wikipedia.org/wiki/Software_patent_debate>

<comment><USER19> _Using_ patents is frowned on.

Given the existing system, it's silly not to participate. It's not a case where a boycott would help, and by holding the patent you ensure that no one else uses it against you.

<comment><USER20> > and by holding the patent you ensure that no one else uses it against you.

A - Wouldn't they be protected due to f.lux being prior art? B - Would a competitor be able to get a patent on this in the first case? (due to A)

<comment><USER19> We all know that prior art can be missed when issuing a patent -- I'd assume having it already in the patent system makes that less likely to happen, and easier to deal with when it does happen.

</comment></comment></comment></comment></comment></comment><comment><USER21> The last time I checked, this wasn't open source. I don't like running foreign binaries on my system. This doesn't rule it out completely for me, but puts me off enough that I haven't tried it.

<comment><USER22> Redshift is an open source equivalent for Linux and Windows: <http://jonls.dk/redshift/>

<comment><USER23> Doesn't work on my Windows. :(

>Display device does not support gamma ramps. >Failed to start adjustment method wingdi. >Trying next method... >No more methods to try.

</comment></comment></comment><comment><USER24> For all my fellow f.lux windows fan, I created a little app (in Delphi) : Reflux.

You can download it here (There is also another package with source) [https://skydrive.live.com/redir?resid=CD51CF0B626581E!134...](https://skydrive.live.com/redir?resid=CD51CF0B626581E!134&authkey=!AN- BuQXlbgpR3Qc)

Basically, you can configure it to kill f.lux (and thus get your precious color back) when certain applications are executed. When all the "killer" applications are closed, f.lux is restarted automatically. It's barebone (there is no GUI) and I tried to keep it light (CPU & memory wise)

Reflux quick readme :

\- It's windows only

\- If you want reflux to start on windows startup you have to do it yourself. (I personally added an entry in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run)

\- I recommend putting the exe and the ini in the same directory than flux.exe (on my computer C:\Users\YourUsername\AppData\Local\Apps\F.lux

\- In the ini (open it with notepad), you can add a list of "f.lux killer" in the KILLERPROCESSES part. ie: KILLERPROCESSES=mpc- hc64.exe;photoshop.exe;vlc.exe

\- There are 2 other options.

\- If you didn't put reflux.exe in the same directory than flux.exe you can add a FLUXPATH entry. ie: FLUXPATH=c:\flux\flux.exe

\- The process (by default) is executed every 2500ms. If you find it too slow or too quick you can add a CHECKINTERVAL entry. ie : CHECKINTERVAL=5000

Hope you guys enjoy it

<comment><USER25> Nice to know someone is still using Delphi :) I had a lot of fun with it as a kid.

</comment></comment><comment><USER26> F.lux is the reason I jailbroke my iPhone. It really is an awesome program. You can feel your eyes adjust if you disable and re-enable it. It definitely helps on the phone because it is usually the last screen I look at before bed...

<comment><USER27> Adding flux to my iPhone fixed my insomnia.

</comment></comment><comment><USER28> I love f.lux. It does take a bit of getting used to, but if you wait it out, you'll enjoy it. And, the research they've done on light is quite impressive too: <http://stereopsis.com/flux/research.html>

That being said, this has been around for a while, so I wonder why it's trending now. They haven't put out any recent updates afaik

<comment><USER29> I just wish it would go based on ambient light if you have a webcam rather than what the sun is doing. Where I work, I'm not always exposed to natural sunlight, and I don't always work during the day going into the night where I'm going to want my screen to adjust to me trying to fall asleep halfway through a second-shift schedule.

<comment><USER30> It's hard to measure ambient light correctly for something like this, because in a dark room, most of the ambient light is actually coming from the screen itself.

</comment></comment></comment><comment><USER31> I've tried to use it for a while, but couldn't get used to it and deactivated it again.

It's just been unusual to me that my screen was being tinted/shaded..

<comment><USER32> Both my wife and I use it. I don't work with images at all so it works out fine. I now find the slight tint very pleasant.

</comment></comment><comment><USER33> I setup f.lux on all my machines to always use the darkest settings. Might as well spare my eyes the effort of absorbing any light that they don't have to!

In a similar vein, one someday project is to setup a vector-based (HUD-style) display using a laser projector (<http://www.amazon.com/gp/product/B005D6D6DY/?tag=hn2013-20> [affil]) and its SDK (<http://www.picop.org/distros> discovered <http://news.ycombinator.com/item?id=4827130>).

Always looking for ideas on reducing eye strain -- looking forward to my Oculus Rift! [http://www.kickstarter.com/projects/1523379957/oculus- rift-s...](http://www.kickstarter.com/projects/1523379957/oculus-rift-step- into-the-game)

</comment><comment><USER34> I've been using this for about a year and a half now... Protip: the fast transition speed is a little jarring, I found. If you really want to "set it and forget it"... set the transition speed to slow and you won't even notice that it's changing over time. Also, make sure that the color temperature it goes down to is correct. Otherwise you will have a noticeable color cast at night. I have mine set for fluorescent lighting since that's what's around my desk.

The goal here is to essentially forget that flux is running yet reap all of the benefits of it.

</comment><comment><USER35> User for 3 Years here. Some Tips for new users to help smooth the transition.

-Install during the day.

-Use the Slow Transition Method

-Don't go all the way down to 3400k for night time if you think it'll bug you. I personally love it.

<comment><USER36> The slow transition is the biggest difference I've found when introducing people to it. It's actually pretty hard to notice it taking effect.

</comment></comment><comment><USER37> Flux is a great first approach, but I think that something like this needs a lot more tweaking (on the hardware side as well) to become viable. The issue with flux is that it just creates a color overlay on your monitor - it doesn't actually reduce the brightness of your backlight. This is understandable because very few desktop monitors and video cards support dimming the backlight via software. This is tremendously annoying to me as a designer, because on one hand I would love to have my displays dim automatically to save my eyes (and more importantly, to save me time as I end up manually dimming each of my 3 monitors at home every night as I'm working; something that eats up a few minutes because I have to navigate through the annoying on-display menus) but sadly flux isn't an option because it reduces the dynamic contrast of the monitor as well as the number of possible colors that the display can output.

Flux works decent for reading/coding/web browsing/etc, but it needs access to the backlight levels to truly be fantastic.

</comment><comment><USER38> I hated f.lux on my old MacBook with a TN panel, however on my retina MacBook with an IPS panel it's unnoticeable except when I look at another screen.

My neighbour has a MacBook Air with a TN panel, and when I put my computer next to his with f.lux on, his screen looks like a gradient from purple to green with yellow in the middle, while mine has a uniform warm feeling (not yellow at all).

</comment><comment><USER39> Some macbooks have a light sensor, It would be great if this app used that. Sometimes you are at a dark room, even if it is daytime...

</comment><comment><USER40> I used f.lux for a few months last year, I did not stick with it because:

• It overrode the brightness settings on my screen, so it was actually much brighter than I would normally have it.

• Whenever I needed to work on anything with colours (most design tasks) I would have to turn it off to get hues correct.

The first one may have been sorted out by this point though.

<comment><USER41> F.lux is unusable on my work external LCD (junk panel), since I have the brightness/contrast/gamma turned way down in the display driver panel. I don't see any option to tweak this in f.lux unfortunately. I'll have to try it on my home LCDs, though.

</comment></comment><comment><USER42> I also use Nocturne for mac (<http://www.blacktree.com>) at night when I am reading something in bed. It turns the screen basically red and black, and is useless for anything besides text. Watching videos is impossible, so I just finish what I'm reading.

<comment><USER43> As far as I can tell all this does is enable High Contrast mode.

</comment></comment><comment><USER44> I tried it and the only effect is that I get sleepy/tired when it gets darker.

I seem to need my harsh cold 6300K in the night ;)

<comment><USER45> Isn't that completely the point of f.lux??

<comment><USER44> Oh, I thought it should just reduce eye strain. But if it's all about making people sleepy then they've written a damn good piece of software :)

</comment></comment></comment><comment><USER4> For Linux users, redshift has better multi-monitor support.

<comment><USER46> Thats what I read elsewere, but it didn't work for me either. Running fglrx.

<comment><USER4> :(

</comment></comment></comment><comment><USER47> I've tried f.lux and while it's great for ios devices(if jailbroken), the colors seem to come out weird in most situations.

What I use now is a Chrome extension called "Hacker Vision" and I highly recommend it to anyone reading this. It flips the colors of websites so you get a white text on a dark background. It's really great in a dark room or sitting next to someone at night AND I can turn my MacBook Air's backlight down to 2 and read everything clearly; that resulted in an extra 30-40minutes of battery life!

Here's the link: [https://chrome.google.com/webstore/detail/hacker- vision/fomm...](https://chrome.google.com/webstore/detail/hacker- vision/fommidcneendjonelhhhkmoekeicedej)

</comment><comment><USER48> I happened to start using f.lux on my macbook 3 days ago, and I'm loving it. Where I am (south west England) sunset is around 4pm, and I usually work until 5 or 6pm. Having a much warmer screen tone as the sky gets darker really feels nicer on my eyes.

I think you really have to use the slow transition (1 hour) mode, 20 seconds is quite jarring.

I program in Aptana with coloured text on back background, and I don't find it any harder to read in night mode. Overall, I can't recommend f.lux enough.

On a related note I've just started using <http://www.protectyourvision.org> to remind me to get up and move around every 20 minutes, also a highly recommended tool.

</comment><comment><USER49> Haters gonna hate, I guess?

Mine is set to 4500K nighttime and I hardly notice it changing 4-5pm when the sun goes down. If I'm working on something that requires color accuracy, I use "disable for an hour" or I quit it.

So: When it (rarely) gets in the way, it's easy to swat away

</comment><comment><USER50> I used it. Didn't really notice much difference for a few days and then saw that it was maxing out one of my cores to I got rid of it. Might try redshift at some point, but I guess I can probably do without as I mostly code 9-5.

</comment><comment><USER51> In my opinion, it really depends on the brightness of your monitor(s).

My iMac screen is rated at 350 nits, a.k.a. super-bright, so when Flux kicks in, I don't mind it if I'm working on that screen.

On the other hand, my 2nd monitor is an el-cheapo Samsung I bought before I cared what "nits" meant, and is rated at 250 nits -- a significant difference.

My typical workspace at night is, left screen (iMac) holds the browser where I view changes, and the right screen (Samsung) has my code editor.

So when f.lux kicks in... my options are one of two things: \- disable it \- buy a new monitor

Guess which one I go for?

<comment><USER52> So are you enjoying your new monitor?

(Have you tried calibrating both screens? flux should not affect brightness/gamma differently.)

</comment></comment><comment><USER53> I've got irregular sleep patterns and this didn't help so I didn't bother setting it up again on next OS reinstall.

I work from home, so can get away with working "whenever". For a while I've basically given up trying to "fix" my sleep cycle. I'm awake until I pass out and I wake up when I'm rested. This is of course suboptimal for workouts--you need to rest properly after workout to get max benefit from it. But lying in the bed and trying to get asleep is such a bother. If I'm not sleepy I'd get up and be active until I get sleepy.

<comment><USER44> Yeah, I have a similar "problem": I'm 'rotating' my sleep cycle. I constantly stay up longer and longer so in a few months I'm awake at night and sleeping in the day - and a few months from that I'm awake in the day and sleep at night.

But to be honest that really doesn't bother me that much. It only get's weird when I have to set a wake up alarm to do grocery shopping before the stores close ;)

<comment><USER54> This sounds fun :)

</comment></comment></comment><comment> guard-of-terra I've installed the ubuntu version into my kubuntu. After launching it does nothing. Which isn't strange because the /usr/bin/xflux is a 32-bit binary and the package didn't request the required libraries. I have to consider it doesn't support 64-bit linux.

Come on. Linux is not Windows. Everybody and their dog already run 64-bit version. It makes no sense not to. All the software is built for 64-bit too. It's just a fact of life. Nobody uses 32-bit anymore except for netbooks and like.

<comment><USER29> I'm not sure what you mean by "Linux is not Windows" in this context. In my experience, most installs of Windows these days (Windows 7 and Windows 8) are 64-bit installs. That's what is sold at Best Buy on their desktops and laptops for example. On the contrary, when a user goes to install Ubuntu, they're recommended to use 32-bit. When I'm on forums, people mention compatibility problems with 64-bit Linux and recommend 32 bit instead. Maybe I'm outdated on that information? Can you elaborate?

<comment> guard-of-terra Do you remember Firefox trying to cancel 64-bit build for Windows? Stating they have a lot of extra bugs in it?

In Windows they still run 32-bit software on 64-bit OS, but a typical Linux install will have not a single 32-bit program.

That's why not having a 64-bit version is pathetic.

<comment><USER55> In fact, the _majority_ of software installed on my 64-bit Windows 7 system is 32-bit. Sad.

</comment></comment></comment></comment><comment><USER56> Took me a few days to get used to the color but now I really like it. Sometimes I'd stare at the screen so much that I'd have watery eyes by the end of the day.. doesn't happen so much anymore. (I'm hoping this is not just a placebo)

Another app that's helped with eye-strain is TimeOut (<http://www.dejal.com/timeout/>). It helps to take a regular break from the screen every few minutes.

</comment><comment><USER57> Probably too late to mention, but someone suggested yesterday that the colours blue and yellow could help those with dislexia. Looking further into this, there's mention of using yellow and blue filters to help read. There's at least one mention here of someone wearing yellow sunglasses. Interestingly redshift, kind of is like a red filter. It might be interesting to see how alternative colours could work.

<comment><USER57> I found compiz and it's filters made it easier to look at the screen.

<https://news.ycombinator.com/item?id=5037538>

</comment></comment><comment><USER58> I tried it for a long time and just found it distracting. I don't work with images these days but perhaps my background in graphics makes me picky. I'm familiar with some of the research but I'd be interested to know if the approach taken by f.lux actually works - real world light wavelengths and colors faked by mixing red, green and blue are subtly different things.

</comment><comment><USER59> I've been using this for a year or so, both on my computer and on my iPad. It really does reduce the stress on your eyes.

</comment><comment><USER60> Is there any evidence that color temperature negatively affects the eyes?

BTW I just scale down the contrast and brightness of my screen

</comment><comment><USER61> I've been rather content just turning my brightness down when I turn my lights off. That said I keep my room flooded with light so as to not strain my eyes trying to look at a screen or read in the dark. I kind of want to give this a shot though as my eyes are very sensitive to light and changes in light levels.

</comment><comment><USER43> F.lux is a godsend when reading black-on-white web pages(so the majority of pages out there) late at night.

</comment><comment><USER62> I tried this a while ago, but just found the colours weird and distracting, probably because I don't really have a problem with the normal colours/intensity at any time, but more a gamma issue.

I was hoping more for a decent gamma adjustment tool as there don't appear to be any decent free ones out there.

</comment><comment><USER63> Installed on Xubuntu 12.04, using dual-monitors. "f.lux indicator applet" shows up in my Accessories menu. First time running it I gave it latitude & longitude. It starts up (its icon shows up in the tray), but it doesn't seem to have any effect.

Trying to open the applet's Preferences has no effect.

</comment><comment><USER64> I have been using flux for years and I definitely notice a difference late at night and early in the morning.

Also, though, I have higher astigmatism and a high prescription and it might be why my eyes feel tired and notice a difference.

Either way this software is not a hallucination and makes a difference for me.

</comment><comment><USER65> I just recently started using flux ~2 weeks ago and I've finally gotten used to the "temperature" change. First couple times it happened I was kinda thrown off, but I find it does actually help lessen strain on my eyes (since I sit in front of a computer screen all day)

</comment><comment><USER66> > Or wake up ready to write down the Next Great Idea, and get blinded by your > computer screen?

This happens to me all the time on my MacBook Air. The problem is that Mac OS X wakes up at the previous backlight level, which is often way too bright for a pitch black environment.

</comment><comment><USER67> What's the business model on this? Are they selling data on users? Is there a premium version?

<comment><USER14> We are not selling data, and we won't. There may be a premium version in the future. Some exciting improvements coming, but you don't have to worry about privacy or spam.

<comment><USER68> Is there a way to sign up to be notified when a new version is available?

</comment></comment></comment><comment><USER69> Not too useful for me... I've invested the time / money to properly color profile my monitor with an X-Rite device so the times I end up creating graphics assets / working with photos, they will look correct.

Although I may play with it ... I spend a lot more time coding.

<comment><USER18> So not useful for you, except for most of the time? If you need to see something in true colors, just turn it off for a second. Also, how do you play with it? You just use it at night and then your eyes feel better.

</comment></comment><comment><USER70> Redshift ( <http://jonls.dk/redshift/> ) is a generally better piece of software with far longer transition times and better configuration options, rather than the abrupt change that f.lux provides.

<comment><USER71> f.lux has a configuration option to transition over an hour instead of 20 seconds.

Also, it doesn't look like Redshift is available for Mac OS.

</comment></comment><comment><USER72> Does flux practice readable colors on their own website?

It seems like they do - I just returned to HN from reading flux's pitch, and my eyes did not take too well to the higher contrast on HN. Can anyone confirm if the colors on their website change over the day?

</comment><comment><USER73> I love it, it has absolutely changed how well I sleep. Twice it's happened that I've had trouble sleeping, then noticing that I had turned off f.lux becausse I had been gaming earlier in the evening (gaming with f.lux is not a good idea).

</comment><comment><USER74> I used to wear yellow glasses for the same purpose. How silly is that. =)

Flux helps a lot but the display side still sucks. I have to adjust the the brightness few times per day. Apple display have a nice brightness control but it's a mirror.

<comment><USER57> <https://news.ycombinator.com/item?id=5042010>

</comment></comment><comment><USER75> Why use f.lux when you can just pop a metatonin pill thirty minutes before sleep? I've been doing that and I sleep like a baby every night regardless of how long I stare at my bright monitor beforehand.

<comment><USER25> How does staring at a bright screen affect sleep? If anything, it makes me tired and I fall asleep even faster.

<comment><USER75> Like any other bright light source (such as the Sun), the light coming from the monitor breaks down some of the melatonin that your body naturally produces. You may still become tired when using a computer and subsequently fall asleep, but the _quality_ of that sleep will be adversely affected unless you account for reduced melatonin levels somehow (either via a program like f.lux, or with supplemental pills).

<comment><USER76> Melatonin is prescription only in the UK. So, go careful if you're travelling from US to UK with off the shelf sleep meds.

I read some article that investigated melatonin supplements in the US. It said that because supplements aren't as heavily regulated you couldn't be certain which pills had melatonin or how much.

<comment><USER75> Actually, most brands will list the amount in milligrams on the bottle itself.

</comment></comment></comment></comment></comment><comment><USER77> It would be really great if F.lux would also adjust for local cloud cover. Sun is out - screen is bright, it's cloudy - screen dims. has anyone else noticed that the pointer in windows dosen't dim?

</comment><comment><USER78> Has anyone done a rigorous experiment, even on just themselves, with f.lux or redshift?

Sleep-monitoring wristband data + "did I see a screen, a red-shifted screen, or no screen" would be really interesting to me.

</comment><comment><USER79> I tried this for like six months. Couldn't stand it. I get far better results adjusting environmental lighting. An LED strip casting a glow behind my monitor made the most difference.

</comment><comment><USER80> Does anyone else notice the slight display lag that f.lux exhibits? On my mac it's just the slightest bit annoying, and I had to get rid of it.

Otherwise I'd love to use it. Maybe I'll try redshift.

<comment><USER81> f.lux caused my mouse to randomly jump on OS X. It didn't seem to matter how fast I'd move it, every 10s or so it would jump 1" in the direction I was moving. Really, really annoying.

<comment><USER80> Yep, that's what I saw as well. I attributed it to display lag or something. It was unacceptable and I had to remove it.

</comment></comment></comment><comment><USER82> Am I the only one that keeps the same value for night and day? I have it set to 5400K regardless of the hour. I like the subtle warm glow to remain constant instead of fluctuate.

<comment><USER83> While a bright monitor can reduce the quality of your sleep at night, I actually read somewhere (sorry, can't find it now) that a bright monitor at daytime can be beneficial for your circadian rhythm if you don't get exposed to much sunlight otherwise.

<comment><USER84> <http://en.wikipedia.org/wiki/Light_therapy>

</comment></comment></comment><comment><USER85>
      xbacklight -set 0 && xcalib -invert -alter

</comment><comment><USER86> Had flux for around a year and I can't imagine not being without. Just to see what life it like without it, sometimes I pause it.

My eyes - they burn with blue light.

</comment><comment><USER87> F.Lux has been a standard program for me for years. The best compliment I can give is that I forgot I had it installed. It's simply perfect.

</comment><comment><USER88> I wish f.lux was smart enough to detect when I change my desktop clock to a new timezone and change it's own location info automatically.

</comment><comment><USER84> My MBP has two light sensors and adjusts it's display brightness automatically based on actual light levels instead of time.

</comment><comment><USER89> Since brightness control has never worked on my installation I expect f.lux to have problems. Or does it not rely on this?

</comment><comment><USER90> Love it. Couldn't live without it now that I'm used to it. Wish iOS allowed direct control of screen settings also.

</comment><comment><USER91> I never even realised flux was still installed. Definitely helps my eyes at night, and I never even notice its on.

</comment><comment><USER92> I like on my desktop but on my laptop it seems to conflict with some Asus energy management program.

</comment><comment><USER57> I quite liked the way my old powerbook would change it's brightness depending on ambient lighting.

</comment><comment><USER93> Every time I find my eyes hurting while looking at a computer, I realize Flux hasn't been running.

</comment><comment><USER94> It's available for iOS but not for Android? I didn't even know you could do that on iOS.

<comment><USER26> It's worth jailbreaking for! Www.jailbreakme.com As of now, you can jailbreak iOS 6, but not an iPhone 5

<comment><USER95> You can jailbreak only a 3GS or iPhone 4. A much better resource is <http://jailbrea.kr/>.

<comment><USER96> And if you want more details or help, see <http://www.jailbreakqa.com/> \- it includes a tutorial for jailbreaking iOS 6.0.1 on iPhone 4/3GS and iPod touch 4th gen, which has a tricky bit where you have to use the 6.0 IPSW (firmware file) as part of the process.

</comment></comment></comment></comment><comment><USER97> I used it for 1 year straight on my pc... It bothered me much more than anything.

</comment><comment><USER98> I love flux, except that it messes up the mouse movement speed on Mountain Lion.

</comment><comment><USER99> great idea !

though my iPhone is higher than OS 5, so I don't have any idea about how to install it to my iPhone,

but I think , maybe if Apple sensed this, would the integrate this into iOS as new feature? just call it the Platform's feature

</comment><comment><USER100> I love f.lux. I've been using them for the last 2 years on all my devices.

</comment><comment><USER101> I find lowering the brightness on my monitor 10x better than f.lux.

</comment><comment><USER102> I miss a Berlin toggle, there is no sun for two thirds of the year.

</comment><comment><USER103> Love Flux. I've used it for months now and it's super helpful.

</comment><comment><USER104> didn't like flux, instead arranged small 15watt lamp to read kindle/book in my bed but leave the light levels in the bedroom low. this was before kindle paperlight :)

</comment><comment><USER105> I love f.lux. It helps save my eyes. It's a savior, indeed.

</comment><comment><USER106> "save your eyes" - huh? (I've used the program and like it).

</comment><comment><USER107> I'm sure this makes front news of HN every few weeks or so?

</comment><comment><USER108> I've been using for a couple of years and it's great :)

</comment><comment><USER99> good idea but , hurt indeed...

getting red and red my screen, feel like I am looking at some fire through the screen

</comment><comment><USER109> Is this not a repost?

</comment><comment><USER110> As long as seeing correct color is not important to you. I'm the kind of person who can immediately tell when an LCD is not at native resolution and what temperature the color is set at, so the strong yellow tint of f.lux was unbearable.

If your eyes hurt at night, just alter your brightness contrast, or write a script to do that instead of messing with color!

<comment><USER111> Why not mess with colour? I have no need to see the 'correct' colour, if it's less comfortable to me.

I actually leave my LCDs at a redder tint most of the time now, as I find it more comfortable. This is particularly useful as most desktop LCDs won't adjust their brightness down far enough for me. Laptops are better, since they actually bother to adjust the power of their backlight.

<comment><USER110> I prefaced my post with "as long as color isn't important to you".

Since it clearly isn't to you, there's no reason not to mess with it!

</comment></comment></comment><comment><USER112> This severely affects the emotionality of information I receive. The aesthetics of one's environment, I believe, is significant to how information will be processed. At first I noticed headaches after reading, using f.lux, but soon after I realized that the sensation was a placebo. What I believe was going on is that my brain was adjusting to the emotional information packed into the content I was reading; a more significant emotional bond was being established between myself and "mere content" not dissimilar to spending too much time with a friend at the café.

Over time, your endurance for it increases, and reading becomes more of an emotional activity, unwittingly.

</comment><comment><USER113> At first I liked the idea, and the app is nice, but when you think of it, what does my monitor and the document I am working on have to do with the color of the skies? You can adjust the room lighting that way, but not the document I working on at my computer, damn, that's even stupid! The monitor can adjust its brightness with the brightness of the surrounding environment, but that is the monitor's own business, and it's brightness adjustment, not the color scheme.</comment>


Need More RAM? Try Compressing What You've Got - <AUTHOR> https://shortestpath.dev/need-more-ram-try-compressing-what-youve-already-got.html <comment><USER2> For those of us on debian based distros:

[https://github.com/Nefelim4ag/systemd- swap](https://github.com/Nefelim4ag/systemd-swap)

<comment><USER3> > _For those of us on [systemd powered] debian based distros:_

What about those of us who use Devuan or any other non-systemd distro?

<comment><AUTHOR> I'm thinking of writing a helper tool that can set up different types of services. Besides systemd what else is still used? Upstart still around? It's Devuan still SYS V?

</comment></comment></comment><comment><USER4> Pro tip: make sure to load RAM Doubler via HIMEM.SYS.

<comment><USER5> Make sure to load RAM doubler before your sound card driver!

</comment></comment><comment><USER6> Or just download more from [https://downloadmoreram.com](https://downloadmoreram.com)

</comment><comment><USER7> Anyone remember Stacker with the STAC Coprocessor Card? Had one of those bad boys in the home PC back in the day.

</comment><comment><USER8> Welcome to Mac OS X 10.9?

<comment><USER9> Welcome to MacOS 7.1?

</comment></comment><comment><USER10> even better, why not gzip all your S3 buckets?

<comment><AUTHOR> Not sure what you mean, sorry. I don't use S3 for anything ATM.</comment></comment>


What's the future of Push Notifications SaaS like https://pushassist.com - <AUTHOR> Frankly speaking, i am interested in Push Notification space, just wondering what's the real future of Push Notification SaaS vendors.<p>Anyone can share an insight on this business? <comment><AUTHOR> Am i pursuing the right product?</comment>


Netflix HTML5 Video in IE 11 on Windows 8.1 - <AUTHOR> http://techblog.netflix.com/2013/06/html5-video-in-ie-11-on-windows-81.html

<comment><USER2> _These extensions are the future of premium video on the web, since they allow playback of premium video directly in the browser without the need to install plugins._

No, thanks. Future of video on the web is DRM free. Calling a dying trend "the future" is an indirect promotion of it, and Netflix can't pretend that they are neutral or even opposed to DRM when they promote it up to pushing it into HTML standard.

<comment><USER3> The only reason Netflix appears to support DRM is because they get content from organizations that demand it.

<comment><USER2> That's how they present it. However they don't sound convincing. This announcement is enthusiastic, rather than saying "yeah, we don't really like what's going on, but our hands are tied, etc. etc.". If they are enthusiastic about DRM - they are promoting it. So it's reasonable to criticize them for it.

 _Today, we 're excited to announce, blah, blah_

People who don't like DRM and only use it out of supposedly necessity (bad excuse if you ask me), won't be excited about it.

Also, Netflix is supposedly streaming some content that they own themselves. Is it offered DRM free?

<comment><USER4> "This announcement is enthusiastic, rather than saying..."

Well, Netflix is in the business of renting video, not in the business of fighting DRM.

<comment><USER2> I don't argue with that. All I'm saying - they are pro DRM. But when confronted about it, they try to deny it, and pretend they aren't. Being pro DRM is bad PR for them. Publishers are at least honest that they support DRM (out of some stupid reasons). It's not publishers however, but Netflix who pushes this garbage into the standard. So they have to bear the responsibility instead of pretending that they have nothing to do with it.

</comment></comment></comment></comment></comment><comment><USER5> Can anyone tell me how are HTML5 "extensions" different to or better than "plugins" (eg Flash, QuickTime, Silverlight)? Has the line between open browser / specification and proprietary plugins just been shifted over a bit?

<comment><USER6> The primary user-facing difference is that these "extensions" don't require additional installation to view content (that is, once all major browsers support them). From a technical perspective, there could other differences, like protections in place to sandbox the browser from the rest of the system, which is much better than requiring the execution of a closed-source proprietary binary.

<comment><USER5> So if Flash player was built into all major browsers (like it is currently with Chrome) then that would remove the primary reason.

I thought EME was execution of a closed-source binary blob too. I also thought some browsers sandbox plugins (I could be wrong).

EME still seems to be just a new plugin specification, with a more limited API.

</comment></comment></comment><comment><USER7> While I am against DRM, what I do like about this becoming implemented is that videos can be encrypted in the file system then distributed over HTML5. This will be good for "private," videos...it's the only positive I can see.

<comment><USER6> What is the distinction between "'private' videos" which are presumably created by individuals, and privately owned media (like movies) which are created by corporations?

<comment><USER7> I'm using my own examples here, one of the projects I'm apart of distributes personal videos over HTML5. Having these _just_ stored on a file system is vulnerable in a way that a sysadmin could view the video or if the file system is compromised [the exploit could reveal the video]. Those are what I could think of off the top of my head.

Having the video encrypted (since Netflix is pushing for it anyways, why not use it to my benefit), allows me to provide the keys directly to the content owner for decryption.

<comment><USER8> Would you do this by creating your own EME in a cross-browser manner?

I guess the built in support for basic encryption would work here (the mandatory profile).

You could even deliver the symmetric key out-of-band with asymmetric encryption.</comment></comment></comment></comment>


Will Apple ever replace Objective-C with another language on their platforms? - <AUTHOR> http://www.quora.com/Will-Apple-ever-replace-Objective-C-with-another-language-on-their-platforms-If-so-what-when-and-why-If-not-why-not?srid=z47 <comment><USER2> John Siracusa has done a couple of articles and a podcast episode on this subject:

<http://5by5.tv/hypercritical/14>

<http://arstechnica.com/staff/fatbits/2005/09/1372.ars>

[http://arstechnica.com/apple/news/2010/06/copland-2010-revis...](http://arstechnica.com/apple/news/2010/06/copland-2010-revisited.ars)

The question should clearly be _when_ , as, like the guy on Quora says, "ever" is a long time.

</comment><comment><USER3> Aside from all other issues (sheer volume of APIs to port, people depending on it, etc.) it's hard to imagine using another language with Cocoa unless it also chose "theSame:kindOf:calling:convention:".

Objective-C just looks weird when you try to call it like you would a C function, because arguments are almost always intended to be preceded by names. So how would old APIs be invoked? They may _work_ , but it'd be a very awkward transition.

<comment><USER4> I'm not sure what you are saying. Sending a message in Objective-C just compiles down to a C function. Syntax has absolutely zero to do with the language choice or transition to another language. It sounds like you think adopting another language means you tack some different syntax on top of Objective-C and call it a day. This is incorrect.

Furthermore, when I hear a programmer make disparaging remarks about a language because of its syntax (or really any reason), I immediately know not to hire this person or trust any of their opinions; an experienced, rockstar programmer would never even hint at this sort of sentiment.

<comment><USER3> What disparaging remarks? I'm only stating exactly how Objective-C looks. It is a syntax I happen to like, too. Not sure how you thought otherwise.

Yes, when calling Objective-C, it compiles to C. But since the article talks about the idea of moving _away_ from Objective-C, the only thing that matters is how source code currently is. The millions of Cocoa-dependent projects aren't using just C functions (even if they're compatible), their API calls follow Objective-C style. So, it is _those_ calls that need to transition. It's not impossible, but it would be inelegant to move those API calls to a language that is significantly different than Objective-C style.

[Just so you know, I've been programming for over 20 years. I have years of experience with Objective-C on both Mac and iOS and dozens of projects under my belt, both for companies and open-source. I have used many different programming languages and know their strengths and styles very well. But you're right, you would not be hiring me...because I would definitely choose not to work for you.]

<comment><USER4> Every Objective-C class/object is a C structure. Every Objective-C message send is actually a C function call (objc_msgSend). Every Objective-C method is actually a C function definition. So, to the contrary, every Cocoa project is just using C functions, types and using the ObjC runtime.

The point you are trying to make is that porting an ObjC application to another language would be difficult because of the syntax of the language, notably, the interspersing of arguments within the method name. My point is that this has zero relevance to adopting a new application-level API.

An application-level API hooks into OS-level calls (which are not ObjC), which gets turned into assembly, which gets turned into machine code. The only way Cocoa applications would no longer run is if the Cocoa library could no longer bridge the the operating system or if they intentionally did not ship the Cocoa library. Thus, creating a new application-level API would deprecate Cocoa, but wouldn't render those applications useless.

Clearly, a company would have to transition to the new language/API. However, once again, the syntax of ObjC would not make it any more difficult or easy to make this transition compared to any other language. And this did not stop Apple 10 years ago, so I don't envision this stopping them again (C Carbon -> ObjC Cocoa; note that you can still make Carbon calls on Mac OS X).

<comment><USER3> All kinds of things compile down to assembly. Binary compatibility between two programs doesn't say anything about how easy it would be to translate their designs into other languages (which is often a new way of thinking), or different standard libraries. Many approaches are _possible_ , few are worth the effort.

If Apple proposed a new language that didn't support message-passing syntax, and the only way to keep Cocoa dependencies working was with a pile of objc_msgSend() calls and other low-level wrappers, developers would just laugh at them. A _single line_ of Objective-C often contains 3 or 4 pairs of square brackets, and objc_msgSend()-ifying that alone would be a nightmare even in the short term and even with a code generator.

That's why I said, the new language has to follow the same calling conventions. Fundamentally, whenever I see "setFoo:x toBar:y withBaz:z", I should be able to either _leave that alone_ or do _very little_ to that line of code.

Carbon-to-Cocoa was feasible because Objective-C is a superset of C (plus the libraries did share some things, like free casting between the CFStringRef and NSString* types). Not only that, but there's a compiler for Objective-C++. It was very easy to adopt.

So to follow the Carbon-to-Cocoa model, Apple needs a new language that's a superset _of Objective-C_. And that's actually something I'd like to see.</comment></comment></comment></comment></comment>


Show hn: realtime redis dashboard - emre-yilmaz https://github.com/emre/swarm-host

<comment><AUTHOR> after a great deal of effort, I have enhanced this and ported it to a popular platform called 'unix'. The source code follows:

watch redis-cli info</comment>


Show HN: Synctuary, secure cloud file sync, released with $1 promo pricing - <AUTHOR> http://www.conceptblossom.com

<comment><AUTHOR> They're presently offering the "host your own" variety, but promising to release a hosted and/or manage-your-keys solution this summer.</comment>


Parody copyright laws set to come into effect in the UK - <AUTHOR> http://www.bbc.co.uk/news/entertainment-arts-29408121 <comment><USER2> Generally, this seems to be a good law. To my understanding, it's on par with the protections we already have in the US.

It's interesting how the law singles out "discriminatory":

> _If a parody conveys a discriminatory message (for example, by replacing the > original characters with people wearing veils and people of colour), the > holders of the rights to the work parodied have, in principle, a legitimate > interest in ensuring that their work is not associated with such a message._

Why is that the only case where right holders have a "legitimate interest" like this? There are lots of other cases where somebody _should_ have a similar case by a similar standard: obscenity, sex, violence, religion or anything else counter to a group's core beliefs. The law should be consistent one way or another, but it isn't.

A few decades ago, sex would have been the one issue singled out. And before that? Probably anti-religious messaging. Or maybe just communism, although that was more of an American concern.

Point being, it really brings to mind the idea of "moral fashion" from "What You Can't Say"[1]. As time goes on, I'm seeing the ideas from that essay illustrated more and more, especially because we seem to be in a transitionary period between two different fashions. It's a bit disconcerting, honestly; it feels like things aren't really changing, just the names and details.

[1]: [http://www.paulgraham.com/say.html](http://www.paulgraham.com/say.html)

<comment><USER3> > There are lots of other cases where somebody should have a similar case by a > similar standard: obscenity, sex, violence, religion or anything else > counter to a group's core beliefs.

Just what I came here to say. If I wrote a children's song and someone parodied it with sexual content, I'd be miffed.

On the other hand, if original authors could define what's offensive, they could object to each parody individually on made-up grounds.

It's probably better to totally separate the questions of "can you make a parody" and "can you publish a work with content X, whether or not it's a parody" (with the answer being "yes, we believe in free speech" in all but a very few cases).

<comment><USER4> The UK is a bit more nuanced with free speech than the US, it can be illegal to make an offensive joke on twitter for example.

<comment><USER5> "Nuanced" is a good word for this. It feels like there has been a gradual shift over the last few years - and the Twitter rulings (of which another just today) exemplify this - towards less freedom, supported by vague ideas like "incitement" to "terrorism" and "racial hatred".

For anyone old enough to remember the wild west of Usenet a decade or two ago, the sort of stuff we see people being imprisoned for posting on Twitter now seems extremely tame. But hey, celebrities didn't really get into Usenet too much...

<comment><USER6> There is nothing new or special about the Twitter rulings in the UK. Whether you agree with it or not, if you wrote similar messages to someone via letter 20 years ago you could get in trouble. Simply changing the medium hasn't changed the legal ramifications.

<comment><USER5> Aside from the fact that there have been actual changes to the law (mentioned in my "vague ideas" clause), what's changed is that people used to post obscene and threatening things on usenet, and whenever the police were involved, nothing ever came of it. With Twitter in the UK, in 2014, people now go to prison for posting such things.

Of course Twitter is more popular than Usenet ever was, but I'm not sure whether that's more the point than a gradual erosion of freedom of speech in the UK which I personally think we've seen.

</comment></comment></comment></comment></comment></comment><comment><USER7> "Owners of the copyrighted works will only be able to sue if the parody conveys a discriminatory message.

"It would then be down to a judge to decide if the parody is funny."

Can't wait to see that lawsuit...

<comment><USER8> When I read the title, I though that the law was a parody, and somehow got into effect...

Now that I've read it, I know that my first interpretation was correct.

<comment><USER9> That first interpretation may have always been correct, at least with much of copyright law. When you google mickey mouse law and get the US copyright extension act, you gotta figure there is some high stakes satire going on somewhere.

</comment></comment></comment><comment><USER10> Phew, for a second there I thought this was going to be _banning_ parody. No idea it was already.

</comment><comment><USER11> The most successful use of this in the US has been [https://twitter.com/dumbstarbucks](https://twitter.com/dumbstarbucks). Pretty great.

</comment><comment><USER12> What if the derived work is funny and discriminatory.

<comment><USER13> We must protect the UK from the likes of Key and Peele!

</comment></comment><comment><USER14> _Cassette Boy, who is known for his online mash-up parodies of shows_

Not so many years ago, that sentence would look very weird. I love the times we live in.

</comment><comment><USER15> I read the title to mean someone proposed the law as parody only to see it come into effect. Such a jaded and cynical world!

</comment><comment><USER9> John Cleese will now fine you a herring for whistling any tracks by the Beatles.

</comment><comment><USER16> @SouthPark

</comment><comment><USER17> If copyright owners start using this law to sue everyone they see fit, the law will last 12 months tops IMHO or it will destroy both parody and satire as we know it in the UK.

<comment><USER18> This law does literally the opposite of what you are talking about.

<comment><USER17> Then, I got this entire thing wrong, which is a good thing.

<comment><USER9> We were living in your nightmare future world already and you didn't even notice. Just think of all the parody we've been missing up until now.</comment></comment></comment></comment>


Show HN: Matching Startups with Experts for Feedback - <AUTHOR> https://vinko.io/ <comment><USER2> Cool idea. I was trying to sign-up with my Gmail for the free plan, but it doesn't seem to work.

<comment><USER2> My bad. I had to click "I agree...". Maybe you can make it a bit more evident that I have to click that with a pop-up or something similar.

<comment><AUTHOR> Thanks for the feedback Maria, we are fixing this now ;)</comment></comment></comment>


Heroku's current network issues and Engine Yards tweets. Hmmmm... - <AUTHOR>

Is it just me or does it seem a little bit of a coincidence that there's a volley of tweets publicising Engine Yards new Heroku migration tool at pretty much exactly the same time that Heroku is experiencing major network trouble....? I'm not suggesting dirty tricks, but it certainly looks like someone at Engine Yard has noticed Heroku's uncharacteristic downtime and seized the opportunity for a bit of ad-hoc marketing via Twitter.<p>Don't worry Heroku I still love ya but I hope you get things sorted out soon it's 4.30am here and I need to deploy before getting some shut eye. <comment><USER2> Savvy marketing on the part of EngineYard, but I'm not leaving heroku either :)</comment>


Tell HN: DigitalOcean NYC1 Appears to Be Down - <AUTHOR>

A cluster of my servers went offline. They have yet to update their status page. <comment><USER2> Their support has been pretty bad lately, pulling servers offline and they take forever to respond to support requests.</comment>


Costco selling $6,000 doomsday-prepper food kits – feed a family of 4 for a year - <AUTHOR> http://www.businessinsider.com/costco-emergency-food-kits-for-doomsday-preppers-last-25-years-2018-3 <comment><USER2> It's not just preppers. Members of the Church of Latter Day Saints (Mormons) are taught to build up reserves of food and other resources.

[https://ldsblogs.com/9618/mormon-faq-why-do-mormons-store- fo...](https://ldsblogs.com/9618/mormon-faq-why-do-mormons-store-food)

<comment><USER3> > It's not just preppers.

Maybe, I mean it's a _very_ cost-effective "i need to eat but not think about it" alternative to something like Soylent (assuming you have the storage space), so there may be a non-prepper market, but...

> Members of the Church of Latter Day Saints (Mormons) are taught to build up > reserves of food and other resources.

Pointing to a group for whom being preppers is a religious practice (and maybe even a doctrinal obligation) is not support for the idea that the market for a product isn't just preppers.

</comment></comment><comment><USER4> Supply chains are something that are always taken for granted until there's an emergency.

Regardless of the motivations, if this gets more people prepared for an emergency, I think it's a good thing.

</comment><comment><USER5> For reference, Superdeluxe remix of Jim Bakker selling buckets of food: [https://www.youtube.com/watch?v=WnaSvvSqY-8](https://www.youtube.com/watch?v=WnaSvvSqY-8)

<comment><USER6> Vic Berger's supercuts of Trump with the airhorn and theme music and fake crowd sounds are so impossibly funny and terrifying at the same time

</comment></comment><comment><USER7> It's worth noting that they've sold these kits for at least ten-ish years. I remember seeing them on the website and thinking how cool it was that you could buy a year of food _as a unit_.

</comment><comment><USER8> I like that they at least have a decent shelf life. I've seen a bunch of these prepper kits that include items with 3-5 year shelf lives, which means you need to be eating your doomsday food regularly and restocking it. That's not ideal since most of this food is designed to keep you alive, not to taste great.

Of course you'll have the same problem with these kits in 24 years, having a year of eating nearly expired lentils and dried cranberries if the world doesn't come to an end.

And of course this kit seems to forget about the 1 year worth of fresh water storage. Hopefully whomever buys it doesn't.

<comment><USER3> > Of course you'll have the same problem with these kits in 24 years

If you use and replace 1/25 of your annual consumption with them each year—about a day's consumption every other month—this is less of a problem (with 3-5 year shelf life, the gradual replacement strategy doesn't work as well.)

<comment><USER9> Doesn't seem like you can (easily) buy a 25th of one of the kits, so replacing it gradually still doesn't seem like a very practical solution.

<comment><USER10> Seems a good opportunity for a startup, if they can solve the problem of how to deliver the stuff without knowing the delivery address (if you are into this, you don't want anybody to know where your food is)

Such a startup could also offer to take in that 25 year old 1/25th part to give it to a food bank, making the purchase deductible as a gift to charity.

Unfortunately, customers only need to start replacing stuff after years (you may want to replace 1/25th a year on average, but do you really want to start doing that a year after buying this?)

</comment></comment></comment></comment><comment><USER11> I recently re-read the story of James Kim, and got interested in the "toy" question: If I am stuck in a blizzard or a disaster, what should I be worried about? The rule of thumb is I can be cold for 3 hours, be thirsty for 3 days, be hungry for 30 days. There have been stories of people who are stuck in a car in a blizzard for months, didn't eat much and were OK. Being hungry sucks, but it takes a long time for hunger to kill you.

If the wasteland has hazards or hostile people, I need to worry about my physical security so guns with lots of ammos will go a long way too.

So I keep in my car a lighter, an old dumb cell phone that has microUSB lead I can charge easily with my car cigarette lighter or anything that has USB out, a knife, a super bright flashlight, and a first aid kit. I don't store cans of food. That sounds pretty stupid.

<comment><USER12> Interesting thought experiment.

What do you think about storing some water in the car? On the one side, it's the most critical resource after wound treatment and shelter - you won't survive more than a few days without it. Also, if you're just semi-hibernating in a closed environment (and possibly _cough_ recycling), you'll need much less water than normal so you can realistically keep enough water for a week or more. On the other side, most "stuck in a car" scenarios (at least in the northern hemisphere) involve rain or snow, and if they aren't and they last a month or more, your water reserve won't save you.

<comment><USER11> I keep a bottle of water too. Yes, I think realistically the only reason that I'm stuck that way is because of a blizzard. Melting snow is going to be the solution. In any case I think given I don't die right away, the best chance to be found and rescued is to have a radio transmitter device. So the cell phone, even when it doesn't work, is the next most valuable thing. There are tons of stuff we can do with the cell phone or ham radio. Kim was searched for, just that they couldn't find him. I think being searched for is the most realistic scenario if something like that happens to me.

</comment></comment></comment><comment><USER13> So by selling this instead of hoarding it Coscto is confirming its bearish on a scenario where food becomes scarce for a year or more

<comment><USER14> Costco knows their customers, not the future.

</comment></comment><comment><USER15> Shouldn't they store things like vegetable seeds or other products you can grow yourself so you're not worried about shelf life, it takes less space and is healthier?

</comment><comment><USER16> *Can opener not included.</comment>


Port knocking - <AUTHOR> https://en.wikipedia.org/wiki/Port_knocking <comment><USER2> I've been in this business for a long, long time and have come across all manner of innovations regarding network security.

Port knocking (which I think I learned about first at defcon ... perhaps 18 years ago ?) _stands out_ as one of the very few things that made my network(s) substantially safer at nearly zero cost. I love, and continue to love, both the idea and the implementation.

Pay no attention to the nay-sayers and their comical straw-man argument against deploying port knocking _by itself_. Of course it's not deployed by itself - it is the last layer of _defense-in-depth_ on top of all the other authentication methods you may be doing.

The _substantive critique_ is that you add some amount of complication to your network and introduce a point of failure with knockd - and that is correct. I am happy to report that 15+ years of knockd in production use, all over the world, has produced exactly zero lock-outs or unintentional self-DoS.

<comment><USER3> any tips or where one would get best practice for configuring/setting up/using knockd?

I wrote up how having a server on the internet is scary now ([http://redgreenrepeat.com/2020/03/20/why-you-should- secure-y...](http://redgreenrepeat.com/2020/03/20/why-you-should-secure-your- server-1/)) and how to protect it ([http://redgreenrepeat.com/2020/04/10/how- to-secure-your-serv...](http://redgreenrepeat.com/2020/04/10/how-to-secure- your-server-2/))

One thing I didn't get into more was port knocking/knockd as there were not many resources for it.

I'd love to learn more about how you have used knockd.

<comment><USER4> Moxie actually published a nice lighweight port knocking daemon that:

* Does not bind to sockets

* Is not written in C

* Prevents replay attacks

* The only code that runs as root is just tailing kern.log and is like 15 lines

It probably needs to roll from SHA1 to SHA256 and Python2 to Python3, but otherwise seems sound.

[1] [https://moxie.org/software/knockknock/](https://moxie.org/software/knockknock/)

<comment><USER5> Looks like there is a pull request to change it from authenticate-then-encrypt to encrypt-then-authenticate that hasn't been merged for over five years. Thinking this project might be abandoned, unfortunately. :-(

Edit: It appears there may be an active fork here: [https://github.com/indyprime/knockknock](https://github.com/indyprime/knockknock)

Still digging through to see if the encrypt-then-authenticate change made it into this version.

Edit 2: It looks like it still uses authenticate-then-encrypt. I sent an email to the maintainer of that fork, we'll see what happens. ^__^

</comment></comment></comment></comment><comment><USER6> I implemented a physical port-knocking daemon, once. I lived in a block of flats — you needed an expensive fob to open the outer gate, and it didn't even work reliably.

I lost my fob. So I took my intercom apart and wired a band pass filter circuit between the buzzer input and actuator output. If you pressed my buzzer with the right steady pattern, it would automatically let you in.

It worked great and I didn't buy a replacement fob.

A few months later I started getting woken up by someone buzzing my buzzer. They would always scurry in before I could open my door to see who it was.

Turns out my upstairs neighbor saw my shenanigans a few times and started freeloading off my invention. Honestly amazed he/she reverse engineered what was going on!

Needless to say, I bought a new fob.

<comment><USER7> I enjoyed your story, but can you please elaborate on what your intercom is / was for?

I understand the key fob/card concept for access purposes, but have never heard of an "intercom" in the context of home/apartment/etc security.

<comment><USER8> An intercom that lets someone at the gate talk to the apartment in question to try to convince them to buzz them in?

<comment><USER9> Yes. They press an apartment number which dials your phone. "Hey your pizza is here", then you press a button on your phone which opens the outer gate or the front door to the building. You then meet them at your front door.

</comment></comment></comment></comment><comment><USER10> Port knocking was somewhat silly when it was introduced ~20 years ago --- at most, on a reasonably designed network, it was saving you from your own misconfigurations, but at least in 2005 it was reasonable to imagine a highly diverse network of machines that people logged into using multiple protocols, where those misconfigurations were likely.

In 2020, it's gone past "silly" and is now a design smell, in the same way that actually relying on fail2ban would be. Whatever port knocking is doing to help you is a a description of something you're doing wrong with your architecture.

We're not even comfortable with long-lived _keys_ anymore; modern networks are built with short-lived certificates issued off 2FA from an IdP. We have good VPNs right now for the other weird cases. Our networks default to all-ports all-hosts closed. Arguably, port knocking is literally setting your security back, by making it harder for automated tooling to scream bloody murder if you've managed to expose a dev instance unexpectedly to the Internet.

Don't bother. If you've got a single system you're managing outside of a cloud provider with its own decent network firewall, just set up WireGuard and filter everything but that. If it helps, think of WireGuard as the evolution of SPA port knocking.

<comment><USER11> I use port knocking and I don't take it seriously. Anyone using it in a serious setup is batshit. However, for fun home projects where users install that giant php based file sharing program, or that IoT camera, why not? They don't have automated intrusion prevention, etc. They can't understand the code to determine it's quality, etc.

When the next 0day hits… will it be enough to protect them, yes. After all, they're not a target and the automated attacks won't affect them.

<comment><USER12> I don't understand how knocking in if itself is bad. It's just a technique to add a layer of protection.

In my case, all internal services in a kubernetes cluster have no path that allow it to be accessed from the outside. Occasionally, developers might want to do so, say to access a database or prometheus server.

The way to properly do this, imo, is to use a hardened service that functions as a networking proxy. Use proper encryption keys for access, and it should be quite hard to bust open.

Where does port knocking come in? That service should need to be exposed at all times. So, use port knocking to configure the infrastructure to temporarily allow access from your IP, to that proxy servers IP, on that particular port.

I'm more inclined to _not_ take it serious, if such a simple mechanism isn't in place to protect infrastructure.

<comment><USER12> *should not need to

</comment></comment></comment></comment><comment><USER13> One can use "port knocking" for more than remotely opening ports. It is a crude form of messaging in its own right, that can be based on some pre- determined code, like Morse code. The "secret knock" need not open any ports. It can be simply a message to the person (or program) reading the logs, to be translated according to the pre-determined code. Actions might be taken in response to the message, or not.

It is possible to do similar things with haproxy. Configured to listen for TLS connections on a large number of ports, look for a secret combination of custom headers and values, then, if found and matching, forward to a localhost ucspi tcpserver on the backend. The tcpserver may then execute some program, for example sshd or pfctl.

[http://cr.yp.to/ucspi-tcp.html](http://cr.yp.to/ucspi-tcp.html)

<comment><USER14> Good idea. You can also do it based on a sequence of ports accessed as well without headers/values which would allow you to forward directly to a tcp based service. You can track which ports are accessed and verify the sequence using stick-tables.

Here's an example of what that would look like:

[https://gist.github.com/dcorbett- haproxy/ec7059cbfccf12c8f41...](https://gist.github.com/dcorbett- haproxy/ec7059cbfccf12c8f41d060ac25403a5)

</comment></comment><comment><USER15> If you're a fan or not of port knocking, single packet authorization is along the same lines, and has a much more robust mechanism that addresses most of the criticisms of port knocking. Your packet is cryptographically signed.

Take a look at fwknop for the implementation. The only issue with it is there's no easy install for pfsense.

</comment><comment><USER16> Port knocking is great. Also look into honey ports which would be somewhat opposite where you automatically block/log hosts that touch the wrong ports.

<comment><USER3> interesting - would this be an effective way to block portscanners?

<comment><USER16> Yes.

</comment></comment></comment><comment><USER17> A fun exercise is to integrate this with TOTP by reloading knockd with a new config every 30 sec based on the secret.

<comment><USER18> Doesn't TOTP usually allow for clock drift in either direction? This might be problematic, especially if there's some IO issue causing it to hang. What happens if the rootfs gets stuck read only?

</comment></comment><comment><USER11> I too am a fan of port knocking. I don't use knockd, just iptables. I found the Arch Wiki most helpful. You'll need to figure out which chain works for your setup but it's pretty straightforward.

[https://wiki.archlinux.org/index.php/Port_knocking#Port_knoc...](https://wiki.archlinux.org/index.php/Port_knocking#Port_knocking_with_iptables_only)

Here's my example for a VPN running on OpenWrt. If you experience any race conditions with iptables you can pepper each rule with something like "-w 5"

This opens Wireguard port 666 for 15 seconds. I have a script that creates my ipset allowing connections from the USA only.

       # The correct port sequence is  1111 -> 2222 -> 3333 -> 4444; any other sequence will drop the traffic
       iptables -N WG-INONE
       iptables -N WG-INTWO
       iptables -N WG-INTHREE
       #
       iptables -A input_wan_rule -m conntrack --ctstate NEW -m udp -p udp --dport 666 -m set --match-set usa src -m recent --mask 255.255.255.0 --rcheck --name WG3 --seconds 15 -j ACCEPT
       iptables -A input_wan_rule -m conntrack --ctstate NEW -m tcp -p tcp -m recent --mask 255.255.255.0 --name WG3 --remove -j DROP
       iptables -A input_wan_rule -m conntrack --ctstate NEW -m tcp -p tcp --dport 4444 -m recent --mask 255.255.255.0 --rcheck --name WG2 -j WG-INTHREE
       iptables -A input_wan_rule -m conntrack --ctstate NEW -m tcp -p tcp -m recent --mask 255.255.255.0 --name WG2 --remove -j DROP
       iptables -A input_wan_rule -m conntrack --ctstate NEW -m tcp -p tcp --dport 3333 -m recent --mask 255.255.255.0 --rcheck --name WG1 -j WG-INTWO
       iptables -A input_wan_rule -m conntrack --ctstate NEW -m tcp -p tcp -m recent --mask 255.255.255.0 --name WG1 --remove -j DROP
       iptables -A input_wan_rule -m conntrack --ctstate NEW -m tcp -p tcp --dport 2222 -m recent --mask 255.255.255.0 --rcheck --name WG0 -j WG-INONE
       iptables -A input_wan_rule -m conntrack --ctstate NEW -m tcp -p tcp -m recent --mask 255.255.255.0 --name WG0 --remove -j DROP
       iptables -A input_wan_rule -m conntrack --ctstate NEW -m tcp -p tcp --dport 1111 -m recent --mask 255.255.255.0 --name WG0 --set -j DROP
       iptables -A WG-INONE -m recent --mask 255.255.255.0 --name WG1 --set -j DROP
       iptables -A WG-INTWO -m recent --mask 255.255.255.0 --name WG2 --set -j DROP
       iptables -A WG-INTHREE -m recent --mask 255.255.255.0 --name WG3 --set -j DROP

EDIT - For those wondering about the Netmask, it's for mobile connections.

<comment><USER19> FWIW I worked with a guy who insisted on doing it this way and it was extremely twitchy.

Problems included various operating systems and network tools knocking in ways that iptables hates but a knock daemon will handle (e.g. sending two requests per port); making iptables rules unnecessarily complex and hard to audit and eventually conflicting with other things that interacted with iptables; and, once, accidentally getting the knock-related rules nuked by some other software and turning a simple login into a fun little puzzle at exactly the wrong time to be solving more puzzles.

We tested both approaches early on. A working knockd implementation cost less than an hour, including getting other users set up to interact with it. The iptables implementation he switched to shortly after ended up costing dozens of hours.

<comment><USER11> Interesting. The only issue I've had was ensuring knocks were received in order. DDNS being the worst culprit. Ensuring an adequate delay between knocks solved my problems. However, I use this for home (friends and family only) nothing serious.

If I were to use a daemon I'd go with an SPA, like fwknop. The lack of an iOS client is the only reason I still use port knocking.

</comment></comment></comment><comment><USER20> I agree with other comments that portknocking is stupid.

It's not stupid to have a tiny tiny service to unlock your bigger attack surfaces. It _IS_ stupid to implement "IP-over-SYNpackets" (actually "password over SYN packets") when we already have a perfectly good way to send packets of information that doesn't expose even the complexities of TCP (e.g. slowlaris, SYN flood, etc…). And it's called UDP. Just send your plaintext password in a UDP packet.

It's not exactly hard to safely receive a UDP packet. In fact it's orders of magnitude easier to make a UDP server secure than a raw packet sniffer.

But also I would argue that TCP MD5 (RFC 2385) is vastly underused. It doesn't work through NAT, so maybe now that IPv6 is becoming more and more common it'll gain more traction. It's been used in production with BGP since forever (at least since the 90s), but there's nothing stopping it being used for SSH too. (in fact I run a patched OpenSSH that uses TCP MD5, see my blog post)

TCP MD5 also prevents your connection from being reset on a TCP level, once it's up and running, even by someone who can inject spoofed packets and sniff your encrypted connection.

More on this: [https://blog.habets.se/2019/11/TCP- MD5.html](https://blog.habets.se/2019/11/TCP-MD5.html)

</comment><comment><USER21> What does port knocking look like on the client side? Does ssh have some option that makes it easy? Does everyone just write a custom bash script that wraps ssh client?

<comment><USER21> If anyone else was curious like I was, it looks like yes, most people do write a custom bash script to wrap (or use before) SSH. The makers of knockd also make a `knock` util that serves as a client, but other people also do something like:

``` for x in 9000 8000 7000; do nmap -Pn --host_timeout 201 --max-retries 0 -p $x server_ip_address; done ```

</comment></comment><comment><USER22> A recent version of single-packet port knocking is the handshake in the Noise protocol: [https://noiseprotocol.org/](https://noiseprotocol.org/)

</comment><comment><USER23> Classic! I remember using Port Knocking during the Louisiana Tech CyberStorm Hacking Competition in 2015 to completely lock down open ports on our VM Host Server since trying to use the glitchy Server KVM directly on the Rack was a test in futility. Between Port Knocking, Xpra, and knowing to disconnect the VMs from the network until after I had patched them, no one stood a chance hacking our VMs. Their VMs on the other hand often didn't withstand my scripts just constantly trying to get in with the VM default passwords, change the flags to give us credit, lockdown and take over root, leaving us a way back in after, and continuously using the root account to reclaim the flag if they noticed.

</comment><comment><USER24> Couldn't someone (in the dataplane path) just sniff the knock and observe comms after and replay it later?

<comment><USER25> Yes but you can defend it against replay attacks if you use a rolling code [https://en.wikipedia.org/wiki/Rolling_code](https://en.wikipedia.org/wiki/Rolling_code)

</comment></comment><comment><USER26> This seems brittle as hell, and is security-through-obscurity. It breaks when packets come out of order. It breaks when packets are dropped. It breaks when it gets carried away and shuts down all inbound traffic, effectively DDOSing yourself.

It seems like you would get the same benefits by moving all major at-risk services (eg SSH) to non-standard ports, and set up exponential IP bans on attempts to communicate on any other port.

</comment><comment><USER27> I use port knocking as an emergency backup measure on my bastion host (OpenBSD w/pf). The regular sshd runs on a non standard port with key authentication only. The backup sshd needs to be knocked and allows password authentication. I only use it in emergencies when I don't have my key handy.

I have used it in the past and has saved me a few times. This is only on the bastion.

</comment><comment><USER28> One-time knocking via changing the ports for every connection / every X seconds with a OTP is something else you can do to further contribute to the _defense-in-depth_ idea. Port knocking is great on it's own, but curious to hear from those who have set it up this way. Love the 'honey port' idea mentioned elsewhere in the thread.

</comment><comment><USER29> Port knocking is pointless. Just use a password over UDP and stop feeling yourself with your cloak and dagger pretend spy nonsense.

</comment><comment><USER30> We like fwknop a lot for its cryptography implementation which can prevent MITM attacks. However, we don't like it for relatively complex client setup. (For example, there is no official iOS client). So we built our own cheap version of port-knocking and called it "doormand". It's just a HTTP server (behind nginx) listening for a POST request from clients. If the request is valid, a new iptables rule is added for the knocking IP for 30 seconds. It supports users with secret key (think API token) so we can knock from our workstation easily. It also supports Timebased-OTP (we can even setup so user is required to enter 2 different TOTP's when knocking) so we can knock from mobile devices. All messages are hash'ed with timestamp making it harder to re-play attack. It works great for us (a small team) because now we can knock over HTTPS on our phone/ipad and then SSH-connect to servers.

</comment><comment><USER31> Port knocking is stupid. The only possible real reason anyone should have for actually using it is if they really don't want their logs to be flooded with the normal internet attacks. Logs which the SSH daemon really shouldn't (by default) be creating in the first place, since what's the use? It's like having a weather station on your roof which always says "it's raining", since you _live on the ocean floor_. It's the internet, SSH will be attacked; there's (by default) no purpose to logging this.

For _actual security_ , though, it's also woefully inadequate:

1\. It adds _very little_ security. How many bits are in a "secret knock"?

2\. The security it _does_ add is _bad_ : It's sent in cleartext, and easily brute-forced.

3\. It complicates access, since it's non-standard.

<comment><USER32> I agree with 1. and 3., but not 2.: It's basically like a password where ports are your alphabet.

Assuming you use most of the 2^16 ports, and a typical text password is based on an alphabet of ~70 characters, each knocking step is roughly equivalent to log_70(2^16) ≃ 2.61 traditional password characters.

For example, 5 steps of knocking already entail (2^16)^5 ≃ 1.2*10^24 steps to check. With 1000 attempts per second, that still means trying > 10^13 years until all combinations have been tried.

<comment><USER31> I'm unconvinced that most people use such complicated knocking schemes to contain that many bits.

It's still trivially sniffed, since it's sent in the clear.

And it's hard to change, since you have to change all the places which needs it.

</comment></comment></comment><comment><USER33> I have created a different approach to accomplish the (somewhat) same goal as port knocking here:

[https://github.com/jftuga/gofwd](https://github.com/jftuga/gofwd)

gofwd is a cross-platform TCP port forwarder with Duo 2FA and Geographic IP integration. Its use case is to help protect services when using a VPN is not possible. Before a connection is forwarded, the remote IP address is geographically checked against city, region (state), and/or country. Distance (in miles) can also be used. If this condition is satisfied, a Duo 2FA request can then be sent to a mobile device. The connection is only forwarded after Duo has verified the user.

Thoughts?

</comment><comment><USER34> Many Many Moons ago I implemented an OS version of this for windows. It was taken over a few years back and is released as KnockKnock. [https://sourceforge.net/projects/knockknock/](https://sourceforge.net/projects/knockknock/)

We are now using the same technique in a network security product at AppGate which is used to protect highly sensitive workloads around the world. [https://www.appgate.com/blog/dont-be-fooled-by-lowercase- sdp...](https://www.appgate.com/blog/dont-be-fooled-by-lowercase-sdp- imitators)

Port Knocking is great, another layer of defense.

</comment><comment><USER35> How convoluted. Why not just send the password in a plaintext UDP packet?

<comment><USER29> Correct.

</comment></comment><comment><USER36> And to save other folks a search, this is pretty awesome:

[https://linux.die.net/man/1/knockd](https://linux.die.net/man/1/knockd)

<comment><USER37> If someone intercepts the traffic to my server, they could see the knock sequence and re-use it. Is there any way to get knockd to use a google authenticator-like sequence of port knocks?

<comment><USER38> I use fwknop[0] on my servers. It does single-packet authorization rather than straight port knocking, which solves the replay issue.

[0] [https://www.cipherdyne.org/fwknop/](https://www.cipherdyne.org/fwknop/)

</comment></comment></comment><comment><USER39> Alternatively, check out "single packet authorization"

</comment><comment><USER40> TIL. Basically you type in a password. But instead of fingers, you use HTTP requests. And instead of a keyboard, you use server ports.

</comment><comment><USER41> What if the correct port knock sequence rotates every 15s based on the time and some PSK material, kinda like TOTP.

</comment><comment><USER42> This was one of the coolest tech that I have implemented!! We used it for authenticating public facing services in a voip application. It worked really well! I was a beginner and I barely understood the benefits. It was the tech leads who guided me to the finish. Such a rewarding experience!

</comment><comment><USER43> it's a great technique, one I used a lot in the late 90's, had a port sequence would ping and that was S/KEY and could run on an nokia or anything that could run java to get the key from the seed. then dydns and could get ssh open and connect. Probably a bit para, but hey, with security it's only paranoid in hindsight if nothing bad happened. Also added extra layer against any zero day upon ssh.

Had it on a openbsd box, firewall script deamon would monitor the firewall logs, pick up the sequence and open ssh for that ip if matched and as sequence was S/KEY, it was always changing. Still cool effective solution.

[https://en.wikipedia.org/wiki/S/KEY](https://en.wikipedia.org/wiki/S/KEY)

</comment><comment><USER44> knockd is pretty easy to setup and use. I used it in a security lab class in college in the late 2000s and nobody could figure out why we didn't have any open ports!

</comment><comment><USER45> Why is this better than an application taking open requests on one of the ports and accepting a password used to open the other port?

</comment><comment><USER46> It's not really very secure, but it's used so little that low-end attackers don't bother to attack it.

</comment><comment><USER47> Port knocking is literally the computer security equivalent of an ADT home security sticker in your front window.

</comment><comment><USER48> Port knocking is great theatre but not much good for anything else. I guess it can keep logs clear feom some drive by script kiddies.

<comment><USER49> If your ssh sever had a 0day, port knocking would protect you.

<comment><USER50> What if your port knocking monitor has a zero day?

<comment><USER51> Then ssh would protect you. The two having zero days at the same time is unlikely.

<comment><USER25> Not necessarily, imagine a port knocking monitor that stores each port attempt it sees in a large buffer. Imagine you make many attempted connections allowing you to overflow the buffer and write arbitrary data onto the heap.

<comment><USER52> Or the monitor being written in c and analyzing text in the knock messages, e.g. looks and interprets a hash</comment></comment></comment></comment></comment></comment>


Ibis on Impala: Python at Scale for Data Science - <AUTHOR> http://blog.cloudera.com/blog/2015/07/ibis-on-impala-python-at-scale-for-data-science/

<comment><USER2> You would think from reading this that PySpark does not exist.</comment>