The Linux Edge (1999) - <AUTHOR> https://blog.corememory.io/the-linux-edge.html <comment><USER2> I find that remark towards the end of the article interesting; of him being happy if someone came along and did the cool things that Linux can do, but leaner and meaner by getting rid of the accumulated cruft of the decades-dead architectures upon which Linux was born and must still run on. From his remarks earlier on the article, that's more or less what he did with regards to Unix.

I suppose we may see something like that eventually, but this article is now 20 years old. Isn't that about the same amount of time between Unix and Linus beginning to work on Linux? I know there's various new OSes in the works, but nothing has caught on yet. But, it's not like Linux caught on immediately either, ("just a hobby, won't be big and professional like gnu"). Maybe in another 5 or so years all the systems hackers, professionals and amateurs alike will all be flocking around NewOS, which is so much better and fun to hack on than crufty old Linux.

<comment><USER3> I'm not convinced we'll have anything that follows Linux. The GPL means that people can't rip it off and fork a closed special version that's needed for their hardware, the result of this being that most ports end up in mainline eventually so you can just kind of expect it to work.

This also means that people doing new things know they'll have the most impact if they do it on Linux and so that's were they do it (plust it being everywhere means they're likely to be familiar with it.)

Personally I think if something new were to come along it would have to have something that makes it interesting socially and I'm not sure there's a lot of room for improvement on that front. It's not impossible it's just a little difficult to imagine.

<comment><USER4> > if something new were to come along it would have to have something that > makes it interesting socially and I'm not sure there's a lot of room for > improvement

The Innovator's Dilemma model of technology disruption suggests that the "next Linux" will be worse in most ways but better for some narrow use case. Perhaps bare-metal containers or unikernels on servers and something like Google's Fuchsia or some RTOS for mobile phones and IoT devices?

<comment><USER3> > RTOS for mobile phones

The market has clearly demonstrated that it doesn't care about phones being real time. They used to be considered critical systems from what I understand and many did actually run realtime OSes. Now we've got android and iOS (android is about as far from an RTOS as you can get, it's almost impossible to write an app that's not guaranteed to just killed by the OS at some point.)

<comment><USER5> The RTOS stuff happens in the handset's baseband processor. The user-facing GUI environment has no hard real-time constraints.

</comment></comment></comment></comment></comment><comment><USER6> I think history has proven that the microkernel people were right from a conceptual point of view, but maybe had some wrong ideas about how to implement one and what level to put abstractions.

The whole mess of VM hosts, hypervisors, containers, and container images is basically a messy half-baked microkernel architecture. A kernel running under another kernel with thin I/O abstractions (virtio, etc.) is sort of like a partition within a microkernel. VM hypervisor hardware pass-through is like allowing a microkernel service to drive one system component.

The fact that the market created all this shows that one monolithic kernel is insufficient from a security, permission management, and configuration management perspective at least if one assumes the limitations of Unix-like permissions and isolation.

I'm not necessarily saying Linus was wrong. Linus was right in the 1990s and from a "get it working and ship it" point of view.

<comment><USER7> We might see containers running closer to metal as market interest demands can drum up money to do it.

</comment></comment><comment><USER8> Well, the micro kernel delusion is about the same as the micro services delusion. Modularity is a good thing when it applies to code and either irrelevant or detrimental when it is attempted to be applied to executables.

<comment><USER9> Some Amiga diehards await the day when we all realize that virtual memory and process isolation are passing fads, and go back to setting interrupt vectors and walking kernel data structures directly in RAM like real programmers did on the Amiga back in the day. What they don't realize is that Amigas crashed a lot more than they remember.

If you value speed above all else, modularity is detrimental. If you value security or robustness, modularity helps you design components in such a way that one component's failure doesn't bring down the whole system, or compromise data being worked on by other components.

<comment><USER10> > Some Amiga diehards await the day when we all realize that virtual memory > and process isolation are passing fads, and go back to setting interrupt > vectors and walking kernel data structures directly in RAM like real > programmers did on the Amiga back in the day.

You mean, like a unikernel? I don't think anyone has tried to write a modern desktop stack that runs within a unikernel, as the Amiga OS did (parts of the desktop widget interface were even hardwired in ROM) but it can't be _that_ hard if you can get useful language-based guarantees.

<comment><USER9> Well, there is AROS, but language guarantees don't stop a rogue binary from bringing the whole system down. For that you want ISA guarantees, and then you're talking a moddern OS. Unikernels only make sense when the entire application of the system is defined AOT.

<comment><USER11> I know I've seen a design for mostly-single-address-space OS that use a VM just for running untrusted binaries. I think it was from someone working on one of the EROS successors, but not sure.

I've also seen proof-carrying code proposed as an alternative; binaries must carry proof that they do not exceed certain capabilities and the proof is verified before they are run.

</comment></comment></comment></comment></comment><comment><USER12> > In fact, this made me think that the microkernel approach was essentially a > dishonest approach aimed at receiving more dollars for research. I don't > necessarily think these researchers were knowingly dishonest. Perhaps they > were simply stupid. Or deluded. I mean this in a very real sense. The > dishonesty comes from the intense pressure in the research community at that > time to pursue the microkernel topic. In a computer science research lab, > you were studying microkernels or you weren't studying kernels at all. So > everyone was pressured into this dishonesty, even the people designing > Windows NT.

A pretty accurate description of fads and fashions in academia.

<comment><USER13> Intel's management processors run Minix, the Android bootloader is LK, and Fuschia may soon displace Linux on Android. It's not necessarily bad for academia to be very early in a cycle.

</comment></comment><comment><USER14> Torvalds is so kind and generous, just a great human being:

"I don't necessarily think these researchers were knowingly dishonest. Perhaps they were simply stupid. Or deluded."

<comment><USER8> Yes, he merely gave us the greatest operating system of human history for free. Such an incredible lack of generosity.

By the way, I read this quote as a sincere attempt to understand what was going on in the mind of some people. I am afraid the actual explanation may be a bit more prosaic. A monolithic kernel might -o horror of horrors- be quite mundane. And where is the tenure in that?

<comment><USER15> Plus -- git!

I'm a confirmed Linux user [switched from macOS], but to me it's clear that git dwarfs Linux in terms of sheer _significance_.

Sure, Linux is what runs most big systems and that is really cool, but if Linux hadn't come around, there was already BSD [which is also good and a lotta my buddies were advocating in the mid-late 90s]. But git is quite unique and has / had no easy substitute. I don't [personally] know a single technology person who doesn't use or interact with git daily. And the benefits of reliable, free/open, and distributed version control are just monumental for the average working code stiff.

<comment><USER16> > But git is quite unique and has / had no easy substitute.

There was Monotone, which was git's main inspiration. If it weren't slow as molasses, we might be using it today instead of git.

<comment><USER17> I'd say the main inspiration was Bitkeeper, which is what Linus used until the free usage was withdrawn by the author.

</comment></comment></comment></comment></comment><comment><USER18> "The first very basic rule is to avoid interfaces."

...

"But from a design point of view this is also the right thing to do: keep the kernel relatively small, and keep the number of interfaces and other constraints on future development to a minimum."

This is exceptionally poor writing. The second sentence is what he meant to say, which is completely different from the first sentence. An operating system is mostly just a bunch of interfaces for user space programs to use, so they don't have to talk to hardware directly. An OS without interfaces is pretty much an oxymoron.

Limiting the number and types of interfaces, of course, is a very sensible idea. But I was very confused for the several paragraphs between those two sentences about what Linus meant.

<comment><USER19> It seems more like questionable reading and strange selective quoting than poor writing. The writing as written is pretty standard - first sentence is the thesis and the rest of the paragraph supports it:

 _The first very basic rule is to avoid interfaces. If someone wants to add something that involves a new system interface you need to be exceptionally careful. Once you give an interface to users they will start coding to it and once somebody starts coding to it you are stuck with it. Do you want to support the exact same interface for the rest of your system's life?_

<comment><USER18> He meant to say "Avoid unnecessary proliferation of interfaces", but said "avoid interfaces" without any qualifiers, which makes zero sense.

Sure, I figured out what he meant a few paragraphs later, but his writing made it much more difficult than it needed to be.

<comment><USER19> I think you might have just missed it on a quick scan when you first read it. The broader notion is in the paragraph before. The paragraph with the sentence itself is specifically about that - it lays out a very standard 'design by contract' sort of argument. It's not true that there are 'no qualifiers', the immediate surrounding context is plenty of qualification.</comment></comment></comment></comment>


KDE to Say Buh-Bye to Screensavers - <AUTHOR> http://ostatic.com/blog/kde-to-say-buh-bye-to-screensavers <comment><USER2> That's fair enough; KDE and Gnome had problems with security with their screen savers. Gnome's reimplementation of Jamie Zawinski's xscreensaver had a bunch of security bugs.

And screensavers are hardly The Killer App.

I do, however, agree that it's annoying when an upgrade kills functionality.</comment>


Tomu, a tiny ARM microprocessor which fits in your USB port - <AUTHOR> https://tomu.im/ <comment><USER2> I was amazed to discover a few years back that my wifi SD card also had full ARM system on it that you could get access to, and if you powered it with batteries it all worked stand alone.

</comment><comment><USER3> The mcu used has a lot more ports available but size poses some limits, however an IR LED+photodiode/transistor could be a nice viable addon, so that it could be used as a bridge to any circuit implementing IR serial communications, or allow communicating with it when it's plugged in a USB supply only port.

</comment><comment><USER4> Is there a USB-C version?

<comment><USER5> It defeats part of the purpose of being an "always in your computer" device, but you could always get a USBA female to USBC male adapter (similar to this [https://images-eu.ssl-images- amazon.com/images/I/41gXYyobsRL...](https://images-eu.ssl-images- amazon.com/images/I/41gXYyobsRL._SL500_AC_SS350_.jpg))

</comment></comment><comment><USER6> My eyes.

</comment><comment><USER7> They can also run Commodore 64 BASIC. Sadly, the ARM part only has 8K RAM.

[https://www.pagetable.com/?p=956](https://www.pagetable.com/?p=956)

<comment><USER8> true, but the next generation has I believe 64k (or more) of RAM.

</comment></comment><comment><USER9> Having bought a number of maker projects where the PCB is designed to plug into the USB port, like this one, I find that the mechanics generally don't work all that reliably. Not sure about the exact cause, maybe manufacturing tolerances on PCBs are not tight enough.

<comment><USER10> This looks like it's supported by a 3D printed enclosure. Otherwise I agree - you need >2.0mm thick PCB to prevent falling out and these are not offered by the usual cheap low-volume PCB manufacturers.

<comment><USER11> If you buy the Tomus from CrowdSupply ([https://www.crowdsupply.com/sutajio- kosagi/tomu](https://www.crowdsupply.com/sutajio-kosagi/tomu)) it comes injection molded case designed by Sean 'xobs' Cross (who actually ran the campaign).

Doing plastics is well outside my skill set, so it was awesome to see him do that! xobs posted about the case here -> [https://www.crowdsupply.com/sutajio- kosagi/tomu/updates/fina...](https://www.crowdsupply.com/sutajio- kosagi/tomu/updates/final-week-of-the-campaign-plastics-and-bootloaders)

</comment></comment></comment><comment><USER12> I can recommend the DigiSpark as a cheaper, slower, alternative that works with the Arduino IDE [1]. Somebody could easily get it into a smaller form factor.

I've bought some of the official versions in their KickStarter and whenever I buy through some company/research funding - but can also recommend the cheaper Chinese implementations to be just as good for projects.

[1] [http://digistump.com/products/1](http://digistump.com/products/1)

<comment><USER13> That doesn't fit entirely within the USB port like the Tomu, and it's out of stock (with no eta).

<comment><USER12> >That doesn't fit entirely within the USB port like the Tomu,

No, but it would be possible to get something more low profile with some work. For most projects I would imagine it's low profile "enough".

For a practical joke (because I'm cool/evil), I plugged one of these devices into the back of somebodies desktop PC and it would occasionally output a random character (either G, H, J or K). I thought the same would be amusing for mouse control too.

You can get it to ultra-low power states too if you replace the power drop down (which consumes about 10mA from memory) and build a low power monitoring device.

>and it's out of stock (with no eta).

That's a shame. Erik is currently working on a 3D printer, it's likely this takes up most of his time now [1].

The clones are readily available though [2].

[1] [https://www.kickstarter.com/projects/robotic- industries/buil...](https://www.kickstarter.com/projects/robotic- industries/buildone-99-3d-printer-w-wifi-and-auto-bed-levelin/description)

[2] [https://www.banggood.com/search/digispark.html?sbc=1](https://www.banggood.com/search/digispark.html?sbc=1)

</comment></comment></comment><comment><USER14> would it be difficult/possible to use this as a smart card with the proper code?

<comment><USER15> GnuK ([http://www.fsij.org/doc-gnuk/](http://www.fsij.org/doc-gnuk/)) implements an OpenGPG Smart Card. Unfortunately, it targets STM32 chips with 128KB flash and 20KB DRAM, and the EFM32HG309 in the Tomu is only 64KB/8KB. I don't know how much work it would be to squeeze the code into the Tomu.

<comment><USER16> You should be able to use other chips in the EFM32 family as a drop in replacement, obviously requires soldering your own board. Seem to be available with up to 128K flash and 16K RAM.

Of course the GnuK site lists some STM32 boards designed specifically to run GnuK. Or if you don't care about open hardware you can buy a $2 STLink clone on aliexpress and flash GnuK on it.

<comment><USER11> Sadly, I don't think there is a bigger EFM32 which has the same footprint but maybe they have released new parts since I last looked.

IIRC GnuK uses the chopstx library which has already been ported (see [https://github.com/im-tomu/chopstx](https://github.com/im-tomu/chopstx)). Not sure what else would need to be done?

</comment></comment></comment></comment><comment> a-ve Speaking of processors on a USB stick, is there any cheaper alternative to the USB Armory? : [https://inversepath.com/usbarmory](https://inversepath.com/usbarmory)

<comment><USER17> you can get 10 tomu devices for less than the price of a single usb armory.

</comment></comment><comment><USER18> Hold on - doesn't having this live permanently in the USB port reduce the security possible with a 2FA device? If the user has to get the key from their pocket and plug it in, it will at least prevent an attacker from accessing the user's account in a remote-desktop scenario. Certainly the requirement to press the button will mitigate this risk to a degree, but might there be exploits that can trigger this button-press event using a carefully crafted USB signal?

I understand the security vs usability thing, just beware of the risks of something like this (perhaps bluetooth-type keys like this are more usable as you don't need to bother plugging them in, assuming bluetooth decides to play nicely)

<comment><USER19> Don't you think they'd have thought that through?

I admire your diligent concern, but I thought the same thing for a split second and dismissed it.

I can't imagine even a corporate churn machine with the most reckless abandon designing a device like this and missing the most basic obvious attack vector.

Well, anyways....

<comment><USER20> It might be possible if you find a hardware or software bug in the USB interface on the chip, but the Yubikey uses a chip designed specifically for security applications. Those sorts of chips are designed and tested explicitly for security applications are tested for all sorts of attacks and and exploits, both physical and in software. I doubt it's even physically possible to craft a USB packet that is able to interfere with the ADC on the chip enough to look like a touch event, but even if it was it'd be exceedingly difficult due to the nature of how USB signaling works. You don't have much direct control at the electrical level of what actually goes down the wire.

</comment></comment></comment><comment><USER21> also great for espionage

<comment><USER22> well.. I'd probably disable the flashing LEDs. But, that aside, I too thought "oh cool... a complete ARM system in my USB.. what could _possibly_ go wrong here" But, the other side of this is: this is precisely what every closed-box USB device I plug into my USB potentially IS. This is just the overt "hi I'm an awesome tiny computer" state we're actually living in, all the time

TL;DR _how do we know we aren 't exposed to these devices all the time?_

<comment><USER23> Every keyboard has an MCU. They used to be 8051s, but now ARM (or PIC or AVR) is more likely.

<comment><USER22> Each time I do the OSX "need to reboot" thing and it sits at the equivalent of BIOS blowing driver updates for things like this, I think "yea, i hate BIOS, but at least I get told which devices are being re-coded" -with OSX, its a bit more opaque.

"trust us"

<comment><USER24> echo "Now we're going to upgrade your storage capacity, please wait."

rm -rf /

Don't trust the status messages; they could be manipulated to anything, in practice. Counter-practice; I mean.

</comment></comment></comment></comment></comment><comment><USER25> Neat little device, looks like a Yubikey clone. One could get a similar device by hacking a Logitech unifying receiver, which contains a ..16MHz 8051 clone in it, and a radio to spare.

<comment><USER8> thats ultimately the intent, to build a Yubikey-like security key, with everything open down through the firmare to the details of the soc

<comment><USER18> One key (pardon the pun) requirement of a 2FA key is that it can't be cloned - how would this be prevented? Can the microprocessor be locked to prevent reading its flash memory?

<comment><USER26> Genuine question: if you can't clone your 2FA, how do you make spares like a house key ? If there is way to get a spare, what's the way to deal with key loss or shared access ?

<comment><USER27> Essentially you have a to configure the account/device you are authenticating with to accept multiple keys permanently (so you can have spares) or temporarily (replacing a key by registering a new one then revoking the old).

In the case of key loss on a properly secure service registering a new key could be problematical if you don't have any other key that is still appropriately registered - you might be permanently locked out unless there is an admin function who has a key registered so can do it for you.

Look at multi-key options for encrypted filesystem for one way that this can work. Often the filesystem or block device has a symmetric key that is in turn encrypted by each of the keys that you wish to be able to open it. It is the same symetric key every time, though you can't unlock my copy of it with your key nor can I unlock your's. Once unlocked we could both add a third user by encrypting the base key with their public key (PKI is not required, but is not uncommon).

<comment><USER26> Ok, so you if you want 9 keys (3 persons in your family has access, have one local spare, and one off site), and 4 services, you need to do 36 registrations of keys ?

Is there a standard to automate that ?

<comment><USER27> You don't need one key per service, so that is as little as 5 keys (3 for active users plus the on-site and off-site spares).

You may choose to have more than one key per person, to reduce the amount of re-registering needed if one key is lost, though remember that this is the second factor so you also already have passwords that vary by service (and if you give people multiple keys they will most likely carry them together to lose them all at the same time rather than individually anyway).</comment></comment></comment></comment></comment></comment></comment>


Golden Rules for Making Money (1880) - <AUTHOR> http://www.fourmilab.ch/etexts/www/barnum/moneygetting/moneygetting.html <comment><USER2> One modern trick to earn a tiny bit of extra money: Use credit cards for buying/paying anything at all, never use debit cards or cash: Credit cards usually pay a small reward point for spends which can often be redeemed as a cash discount later, and also since the expenses go to the credit card, the cash in the savings account stay untouched till the day you make the credit card bill payment, which will keep earning interest for the additional days it remains in your account(Which may be a significant amount over long term, in a high interest rate country).

In some countries you can route large payments like insurance premium payments through the credit card. Sometimes insurance companies even have investment products which they claim are "insurance policies", that can be bought with credit cards too.

<comment><USER3> What about fees?

Not sure about US, but I think in NZ all credit cards with cashback have fees. And I remember there was a research or something concluding that you had to spend at least ~$3000 (don't remember exactly) per month using cashback credit card to break even.

Also, credit cards are not accepted everywhere. And often there is a minimum transaction amount as well.

<comment><USER4> The Capital One Venture Rewards card gives me 2% back on all purchases (I'm in the US). It comes with a $60 per year fee. So, if I spend more than $3,000 on the card over the course of the year it's a net positive. Now, they have access to all of my purchase data but I get around $700 every year to spend on travel. I've weighed the costs/benefits and it's worth it to me.

<comment><USER5> Why not get the citi double cash, or fidelity 2% back with no annual fee?

</comment></comment></comment></comment><comment><USER6> Interesting snippet of wisdom from the article:

> The real comforts of life cost but a small portion of what most of us can > earn. Dr. Franklin says "it is the eyes of others and not our own eyes which > ruin us. If all the world were blind except myself I should not care for > fine clothes or furniture."

In reading a few of the chapters, it was really interesting to see the dollar amounts written. They seemed rather high for 1880.

> She has a nice one thousand dollar camel's hair shawl, and she will make > Smith get her an imitation one, and she will sit in a pew right next to her > neighbor in church, in order to prove that she is her equal.

Inflation calculators put that camel shawl at nearly $25,000 (2019 dollars).

<comment><USER7> There used to be a lot fewer luxury goods and they were a lot more expensive because most came from "exotic" far away places (and many were valued solely because of it). Camel's hair, especially, likely wasn't an automated textile like cotton and it's a rather expensive material to begin with (a good shawl would likely run into four figures even now).

$1,000 is roughly two to five years average income (depending on the state) in 1880 so if the average family income right now is ~50k and a family of professionals makes 250k, it's not that far fetched. Especially when you consider that church was the important social outing for a majority of the population.

</comment></comment><comment><USER8> Our Fake History podcast has an excellent series on PT Barnum. He was something of a genius promoter (and self-promoter). Today he's best remember for his circus act, but that was just one of a long line of productions he put on.

In Barnum's parlance, a "humbug" was a practical joke played on his audience. A less charitable interpretation is that of some of Barnum's humbugs are downright fraudulent. It's a fun story.

Episode 1 of 3 is here: [https://ourfakehistory.com/index.php/season-2/episode-32-who...](https://ourfakehistory.com/index.php/season-2/episode-32-who- was-the-prince-of-humbugs-part-i/)

</comment><comment><USER9> Shameless plug, free nicely formatted epub of The Art of Money Getting for your ereader of choice at Standard Ebooks: [https://standardebooks.org/ebooks/p-t-barnum/the-art-of- mone...](https://standardebooks.org/ebooks/p-t-barnum/the-art-of-money- getting)

</comment><comment><USER10> 2007: [https://news.ycombinator.com/item?id=88544](https://news.ycombinator.com/item?id=88544)

2008: [https://news.ycombinator.com/item?id=310056](https://news.ycombinator.com/item?id=310056)

2016: [https://news.ycombinator.com/item?id=11320169](https://news.ycombinator.com/item?id=11320169)

<comment><USER11> This is an interesting point you may have raised regarding re-post. At one end, repeated information will lead some to think it is counter-productive, think it is a karma-hungry person or lead to backlash. On the other end, there are many individuals that can benefit from older articles that they have yet to see.

Where to find the balance? We have yet to see.

<comment><USER10> Reposts are ok after a year or so. This in in the FAQ: [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html).

The reason for providing links like that is simply that people find previous discussions interesting.

</comment></comment></comment><comment><USER12> All praise be unto this fourmilab.ch website. This is the old internet. The internet that I first fell in love with. Its purely about the information, just an honest straight provider of information. Its a truly loyal ode to the term "information highway". These types of websites are so rare now.

</comment><comment><USER13> > Young men starting in life should avoid running into debt. There is scarcely > anything that drags a person down like debt. It is a slavish position to get > in...

Well, that put student debt in perspective no ?

<comment><USER14> It is weird to see this mindset on a site that is basically founded on the idea that taking on debt can be valuable. What would the startup scene be like if everyone avoided debt at all costs?

<comment><USER15> Selling equity in a startup is very different from taking on debt, with debt your committing the business to a strategy, if it doesn't work the business will probably fold.

While this makes sense for capex intensive businesses. It's an irrational choice for a tech startup that may need to pivot, partner or be acquired. For those choices you need a source of capital with similar incentives as the founders.

<comment><USER16> > Selling equity in a startup is very different from taking on debt, with debt > your committing the business to a strategy

wha? selling debt you are committing yourself to a financial obligation, selling equity you are committing yourself to a strategy in the hope that that strategy will be successful.. yes, it is not binding fiscally and so the strategy can be renegotiated without penalty, but that doesn't by proxy imply the converse that debt inherently requires a fixed strategy..

this is why you can get cash flow/line of credit loans based simply on historical accounting data, etc..

that said getting loans under false pretenses is also fraud. YMMV

</comment></comment></comment></comment><comment><USER17> > _Money is in some respects like fire; it is a very excellent servant but a > terrible master._

Some great quotes in there.

</comment><comment><USER18> Funny how some of it seems like good common sense and then you get

> Some men have a foolish habit of telling their business secrets. If they > make money they like to tell their neighbors how it was done. Nothing is > gained by this, and ofttimes much is lost. Say nothing about your profits, > your hopes, your expectations, your intentions. And this should apply to > letters as well as to conversation. Goethe makes Mephistophiles say: "Never > write a letter nor destroy one." Business men must write letters, but they > should be careful what they put in them. If you are losing money, be > specially cautious and not tell of it, or you will lose your reputation.

In 2019, it seems openness and transparency (eg Buffer) can form the foundations of a profitable strategy

<comment><USER19> In _The Count of Monte Cristo_ , the Count ruins Danglers' fortune via bond market manipulation per his revenge plans. One of the ways he keeps track of how the ruination progress is via Danglers' own words. At first, Danglers boasts loudly in parties about how much he has lost, but eventually he is cowed and no longer talks about money or his fortune. The Count keep track of his boisterousness as a barometer of his revenge and it's progress.

Its a great book and well worth the read, despite it's size.

<comment><USER2> The Count of Monte Cristo, is such a rollicking story from beginning to end, almost the entire 1300+ pages.

</comment></comment></comment><comment><USER20> I am yet to hear one concrete piece of useful advice on "how to make money."

The ONLY things I can say with certainty in life, as far as productive activities go is something like "workout, eat right, sleep enough, drink enough water." That's literally it.

<comment><USER21> This guy has plenty of concrete advice:

[https://www.mrmoneymustache.com/category/mmm- classics/](https://www.mrmoneymustache.com/category/mmm-classics/)

It is very similar to "workout, eat right, sleep enough, drink enough water", as they are things that "everyone" knows they should do, but few have the will power and self discipline to actually do them.

Budget. Get your expenses under your income. Set aside an emergency fund. Pay off your debts as quickly as possible. Then start investing for retirement, house, kids college, etc. While avoiding new debt.

That's pretty much it. Dave Ramsey and many other advisers say roughly the same thing, including the introduction to Barnum's book:

[http://www.fourmilab.ch/etexts/www/barnum/moneygetting/money...](http://www.fourmilab.ch/etexts/www/barnum/moneygetting/moneygetting_chap1.html)

Ramsey pretty much says this stuff is simple in his course, and spends most of his time on the emotional and motivational aspects of putting the advice into practice. For example, he advocates paying off your smallest debt first, not the one with the highest interest rate. This is solely for the motivational impact, because seeing a debt disappear completely will inspire you to keep going and attack the next one, even if it's sub-optimal from an economic perspective.

<comment><USER22> The advise Dave Ramsey and Mr. Money Mustache give are really only applicable once you already did the hard part and built a steady career. Their advice isn't going to help someone who works at McDonalds with several kids with several deadbeat baby daddies and no family support get out of poverty, nevermind build wealth. The fact that most of Mr. Money Mustache's readers (who answer surveys) are engineers really reinforces that.

I'm not trying to pick on anyone here, I'm actually describing a good friend of mine.

That being said, I don't know what will, so I don't have any suggestions.

<comment><USER23> [https://www.mrmoneymustache.com/2013/07/25/50-jobs- over-5000...](https://www.mrmoneymustache.com/2013/07/25/50-jobs- over-50000-without-a-degree-part-1/)

[https://www.mrmoneymustache.com/2013/08/05/50-jobs- over-5000...](https://www.mrmoneymustache.com/2013/08/05/50-jobs- over-50000-without-a-degree-part-2/)

</comment></comment></comment></comment><comment><USER24> A good way to make money is to sell a book about how to make money.

<comment><USER25> Reminds me of that dude who made a rather impressive amount of money posting classified ads on how to make money where the "secret methodology" being sold turned out to be a set of guidelines which simply instructed the buyer to follow suit.

<comment><USER21> Sounds like an urban legend, but I hope it's true.

<comment><USER26> Most of the MLM industry is based on this exact principle.

</comment></comment></comment></comment><comment><USER27> _" Unless a man enters upon the vocation intended for him by nature, and best suited to his peculiar genius, he cannot succeed. I am glad to believe that the majority of persons do find their right vocation. Yet we see many who have mistaken their calling, from the blacksmith up (or down) to the clergyman. You will see, for instance, that extraordinary linguist the "learned blacksmith," who ought to have been a teacher of languages; and you may have seen lawyers, doctors and clergymen who were better fitted by nature for the anvil or the lapstone."_

#learntocode

</comment><comment><USER28> Don't Blab >>> This chapter/paragraph goes against everything I believe in, the entire opensource community is based on sharing. I am an aspiring farmer with a tech addiction and if it wasn't for people sharing their successes through YouTube and a lesser extent farmers that write books, this "City Boy" wouldn't have survived my first year on the farm. I also agree Internet sucks in the country, but it's still better than encyclopedias!!

<comment><USER29> Hey sigmaprimus I'd love to hear more about your transition from "City Boy" to farmer! I'm thinking of taking the leap in a few years after saving "enough" capital. I can put my contact info in my bio if you have time to private message.

<comment><USER28> I am still in transition to be honest, I have finally got to the point that I am living full time on the farm now but have not managed to make a profit yet. Farming is a great lifestyle but the farming lifestyle is not a great business, not yet at least. I am planning on publishing a blog/vlog this year and will definitely share it with HN. If you are looking for some inspiration though, look into Joel Salatin,John Suscovich and Curtis Stone on YouTube.

</comment></comment></comment><comment><USER30> Thanks for the link, it's a nice discovery. fourmilab.ch is a real website for hackers, lots of interesting things. Also, I didn't know its author, John Walker, creator of AutoDesk AutoCAD was living in Switzerland and still so interested in topics such as astronomy, C64, science fiction, Kerbal Space Program and more nerdy things.

</comment><comment><USER31> I like how it begins with... "In the United States, where we have more land than people..."

<comment><USER17> Only people living in big cities think this isn't still true.

If you so desire, huge portions of land in the country "flyover" USA are yours to be had for very cheap.

Of course it's difficult to get internet there, so how will the millennials make it?

<comment><USER32> Some millennials are in their mid 30's. Isn't it time to pick on a new generation?

<comment><USER33> Millenial here. Did this happen with other generations? Where the term was just used as a derogatory way to refer to young people?

<comment><USER34> It happened for Millennials and Baby Boomers.

But not so much for the Greats, the Silents, and Generation X. My theory is that the Greats, the Silents, and Gen X were all wartime generations. The Silents and Gen X were also relatively small generations, there really aren't that many of them. Add to that the fact that all of those generations had some level of dispossession coupled with an even more impressive level of productive wealth creation, and you can kind of see why no one really picked on them as much as what we see today. The Greats were, well, the Greatest Generation. 'Nuff said there. The Silents were a wartime generation, born in the depths of the depression, who never really whined about their lot and because there really weren't many of them, they were, person for person, likely the most productive generation in our history. Generation X was given the name because they were the black spot. They were the first generation that would grow up to have _less_ than their parents. They kind of just ran with it, and despite having war after war to deal with, ushered in one of the most transformative eras of wealth creation in mankind's history.

All that said, actual _leadership_ of the country seems to skip over those kinds of generations. (With the exception of the Greats.) Not many leaders from the Silents or Gen X, but a large number of well known leaders from the Baby Boomers and even the Millennials. From Mayor Pete to AOC, the Millennials seem to outshine Gen X as far as leaders are concerned, for better or worse. In the same way, the Baby Boomers outshone the Silents to the point where the Silents are almost forgotten to history. Generation X might have been forgotten were it not for their technological innovations and achievements.

Anyway, that's my theory. So Millennials shouldn't take all the ribbing too hard, because if history is any indication, in the end, you'll likely be the ones in charge. Again, for better or worse.

<comment><USER35> Depending on who's definitions of birth date ranges you use, Obama might be considered a Gen X president.

Also, not entirely sure why there's a generation called "the Greatest Generation". We can say they were all war heroes and suffered etc., but there were also jerks in that generation who started those wars. We are all products of our time. It kind of sucks to just lump everyone based on their birth date and stereotype them.

</comment></comment></comment></comment></comment></comment><comment><USER28> Just a small observation but I feel important: This article has two titles, "Golden Rules for Making Money" and "Art Of Money Getting". You can "Get Money" without being productive, to "Make Money" is inherently productive.

</comment><comment><USER36> "Once you have their money, never give it back."

[https://memory- beta.fandom.com/wiki/Ferengi_Rules_of_Acquisi...](https://memory- beta.fandom.com/wiki/Ferengi_Rules_of_Acquisition)

</comment><comment><USER37> > We are all, no doubt, born for a wise purpose.

I've heard and seen this time and time again and yet there's no advice on how to find that purpose. It's always easy to say, "do what you love" but how do you find what you love?

<comment><USER21> I think it's terrible advice.

Do what brings the most value to others, that you have the talents to accomplish, and that you also enjoy doing. I think the intersection of those sets is the most likely place to find one's "purpose".

There are plenty of things you might "love" to do, that will leave you destitute and unfulfilled if you devote your life to doing them.

<comment><USER38> It has to align with your values, there is no point going to work on missile software if you are a pacifist at heart. The work needs to be meaningful.

There should be some element of mastery, you need to be challenged in your work but not completely out of your depth.

You also need a degree of autonomy, this is what makes most corporate life so miserable, they have so many rules you can't decide anything.

Money doesn't matter so much, most people adjust their lifestyle to their income and get used to it.

</comment></comment></comment><comment><USER39> It simple your daily income must be superior to your outcome thats it

</comment><comment><USER40> The first few paragraphs remind me of a book called "Your Money or Your Life", which provides a simple way of expense tracking that can help build up savings. I recommend it for anybody who likes money.

</comment><comment><USER41> My favourite quote on wealth (not in this book) is "The best way to make a small fortune on the internet is start with a large fortune".

<comment><USER38> That is frequently quoted with regards to the restaurant business.

</comment></comment><comment><USER42> Personally I like Benj. Franklin's maxims better. Much the same content, but pithier.

</comment><comment><USER43> I found this to be insightful and helpful. Thank you for sharing.

</comment><comment><USER44> 1- Be born rich 2- ? Whatever 3- Profit

<comment><USER45> Sadly, this is to a large extent, the correct answer. Opportunities depend on income level when born. Citation:

[https://www.brookings.edu/research/economic-mobility-of- fami...](https://www.brookings.edu/research/economic-mobility-of-families- across-generations/)

[https://www.worldbank.org/en/topic/poverty/publication/fair-...](https://www.worldbank.org/en/topic/poverty/publication/fair- progress-economic-mobility-across-generations-around-the-world)

PT Barnum, on the other hand, makes a great case for living within one's means, which is always valuable advice.

</comment></comment><comment><USER46> Life tells you what you should do in two ways: what you like to do and what you are good at. Of course liking something and being good at it often go hand in hand.

When you are good at something, it's fun to keep doing it so you feel better than other people. When you like to do something, you often get good at it.

<comment><USER21> I would add to those two "and brings value to others". There are plenty of things you might love doing and are good at, that will leave you destitute and unfulfilled if you devote your life to them.</comment></comment>


Kickstarter: Pants that look good & survive multiple wears without washing - <AUTHOR> http://www.kickstarter.com/projects/594084262/pants-by-bluff-works

<comment><USER2> > Pants that look good & survive multiple wears without washing

That pretty much describes all of the pants I own.

<comment><AUTHOR> Couldn't fit in the title, but other properties of these pants that I found interesting are that they are supposedly wrinkle-free even after folding, rolling, etc., and that they are quick-drying when wet.

<comment><USER2> I read the kickstarter. They're just polyester pants - that's what polyester pants do.

They're also really itchy if you have hairy legs.</comment></comment></comment>


Sustainable engineers Kenoteq are reinventing the brick - <AUTHOR> https://www.cnn.com/style/article/going-green-kbriq-sustainable-brick-spc-intl/index.html <comment><USER2> It would be interesting to see exactly how much CO2 was created in the process of creating a brick vs the amount of CO2 created during transportation. This tech seems like a good idea until you realize every brick is being produced in one spot in England... the real problem isn't creating these bricks, it's building out the infrastructure to supply a significant demand.

I work in the masonry trade, all of the materials we use are from brick yards and quarries that are local (~75-100mi radius) for the simple fact that transporting large numbers of pallets of brick over long distances is a logistical nightmare. Storing them can also prove to be a problem, so much so that we literally throw away thousands of bricks we have left over from jobs every year. It's rare that two customers would use the same bricks and we end up keeping the extras until we know we're not getting called back in to do additional work.

They're right that reclaiming bricks as being labor intensive work. The real holy grail of this industry would be figuring out how to reclaim the trillions of bricks already in circulation without needing human intervention. There is often huge demand for antique bricks because a lot of the unique clay deposits used to create the bricks end up being totally depleted. Milwaukee, WI is famous for their Cream City bricks that were produced in the mid and late 19th century but once the unique clay beds used to create these bricks were gone, so were new Cream Cities. You can see these in just about every city's downtown in Wisconsin. I've spent many hours reclaiming these bricks from old houses and factories because for one, they look incredible, and two, they're worth about a dollar a piece once they're ready to be laid again (Pretty good money if you're good with a brick hammer). If there was a way you could dump a house worth of old bricks into one end of a black box and spit out reusable brick from the other end, you'd basically be printing money. Mortar is not easily removed from brick without damaging the brick. That's kind of the whole point of the mortar being used as a binder in the first place.

<comment><USER3> _Milwaukee, WI is famous for their Cream City bricks_

For anyone interested, Cream City bricks has a Wikipedia page[0] with pictures of buildings built with them.

[0] [https://en.wikipedia.org/wiki/Cream_City_brick](https://en.wikipedia.org/wiki/Cream_City_brick)

</comment></comment><comment> kube-system We already have several reinventions of the brick which are stronger and more eco-friendly -- we call them concrete blocks.

I thought it was pretty silly to compare this product to bricks on it's cost/strength/waste. People aren't choosing brick for these factors anyway. People choose brick mainly for the aesthetic.

<comment><USER4> Yeah, I lost it when TFA referred to bricks as "The building blocks of modern suburban homes." I'm not sure what suburbs the author is familiar with where new homes are made of structural brick.

<comment><USER5> The article is fairly UK-centric, and in the UK, most suburban homes are made of brick.

<comment> kube-system "Brick" homes are common in the US too, but most made after WWII are simply veneers over a structure of a different material. Are you sure that's not the case there? I did an image search for "uk home construction", and all of the instances on the first page also appear to be veneers.

Example: [https://www.independent.co.uk/news/business/news/615000-new-...](https://www.independent.co.uk/news/business/news/615000-new- homes-thats-what-uk-housebuilders-could-put-up-on-their- landbanks-a6791486.html)

<comment><USER6> I'm another UK resident/former resident who can confirm that at least some new suburban homes are constructed primarily from bricks.

</comment></comment></comment></comment></comment><comment><USER7> This article has inspired me to make a brick. The regular kind. I have tons of clay and a forge that can melt steel, honestly it just never occured to me so now I have to try!

<comment><USER8> Now you've got me googling "refining clay from soil". Our city is built on the most terrible clay gumbo imaginable, and I've got a huge pile of the stuff to get rid of somehow...

</comment></comment><comment><USER9> This is in CNN Style for a reason. It's a neat research project, great for prestige projects like Hyde Park. It just cannot compete with clay from a cost perspective.

<comment><USER10> I'd be curious if you've got some figures or if you are just guessing that it's the case. (Intuitively, I'd agree with you, but I couldn't find any info.)

Assuming also that the externalities of the existing brick manufacturing industry are not costed into the price of a standard brick. Other sources suggest that the k-briq is also more insulative than a regular brick, which should impact the cost calculations as well.

<comment><USER11> Technically true but wouldn't going with a cheaper exterior option and using the saved cost for dedicated insulation be more efficient? Aside from airflow it is usually windows and frames where the insulation property is relevant, otherwise we would see using thicker walls instead of just spraying insulation for cheap development.

I mean it is a neat concept but unfortunately efficiency often selects the "boring" option.

</comment></comment></comment><comment><USER12> I've heard great things about CEB (compressed earth blocks).

</comment><comment><USER13> Sounds like a more rigorously engineered form of the Compressed Earth Brick. [https://wiki.opensourceecology.org/wiki/Compressed_Earth_Blo...](https://wiki.opensourceecology.org/wiki/Compressed_Earth_Blocks)

<comment><USER14> Many older village houses here in Czech Republic are made from compressed earth bricks (using local materials & not fired). As long as you keep them dry, they will last basically forever. If they get wet, they loose all strength and the building collapses, making any floods particularly dangerous for such buildings.

<comment><USER13> Do you think the k-briq they are talking about here will also lose cohesion when things get wet?

</comment></comment></comment><comment><USER15> I think the killer invention would be to solidify C02 efficiently for building materials (much like trees do).

<comment><USER16> If only we could use trees as a building material!

<comment><USER17> Cross-laminated timber is quite promising in that regard.

[https://hn.algolia.com/?q=cross+laminated](https://hn.algolia.com/?q=cross+laminated)

<comment><USER18> Pretty sure they are being sarcastic and referring to wooden construction (majority of US homes).

<comment><USER17> Yea, I know. Mine was just an example of 'reinventing the wooden construction'.

<comment><USER15> Trees are great but require quite a bit of landmass. They're also slow :) As part of an "all of the above solution", a way to do what they do artificially would be handy

</comment></comment></comment></comment></comment></comment><comment><USER19> Tim Harford has an episode about why bricks have been so great for humanity for so long, and a bit on why they are so hard to improve on:

[https://www.bbc.co.uk/programmes/w3csz2w8](https://www.bbc.co.uk/programmes/w3csz2w8)

</comment><comment><USER20> > To make it, construction and demolition waste including bricks, gravel, sand > and plasterboard is crushed and mixed with water and a binder

I notice they don't mention what the binder is, and I see it labeled as a "secret binder" in another article.

</comment><comment><USER21> As far as different mediums for building go, check out sirewall. Or insulated rammed earth wall. It is only 9 pct cement. And can make some pretty charming spaces.

</comment><comment><USER22> What's the binder?

<comment><USER23> I thought it would be cement and they were ashamed to admit that. But their site says "no cement use when compared with concrete blocks". Not sure why "no" has to be a relative term, so something sneaky might be going on there.

<comment><USER24> If I was forced to make a bet, I would guess fly ash.

[https://patents.google.com/patent/US10669205B2/en?oq=US10669...](https://patents.google.com/patent/US10669205B2/en?oq=US10669205B2)

I think this is the patent, but they don't mention a "binder" per se. There are several claims specifically relating to the exclusion of "tar" which seems interesting. I think someone better versed in reading patents than I am might be able to make more sense of that. Tar just doesn't seem like their style. Maybe there are already claims on that or they are well known. But "organic matter", "tar", "cement" or "fly ash" still seem like possibilities.

The patent also mentions "additive" (e.g. pigment / recycled toner) as improving the strength of the resulting bricks and reducing moisture uptake. It can be added in surprising amounts (5-20%). That doesn't seem very scalable though.

Or, of course, they could have come up with something else in the meantime. Distinctly possible.</comment></comment></comment>


News of a Proposed Immigration Proclamation on Non-Immigrant Visa Holders - <AUTHOR> https://www.immigration.net/2020/06/09/immigration-update-rumors-of-proposed-trump-immigration-proclamation-with-serious-negative-news-for-non-immigrants/ <comment><USER2> Don't ask a barber if you need a haircut.--Warren Buffet Don't ask an immigration lawyer to restrict visas.</comment>


The end of Openstreetmap as we know it - <AUTHOR> https://blog.mapillary.com/update/2019/06/26/end-of-maps-as-we-know-it.html <comment><USER2> As an unsophisticated OSM user, I've got two major problems with its modern version.

I live in the US and speak English. The use of local languages to name cities and features makes the map nearly useless for many things. (Cities in China? named in Chinese. Cities in the Middle East? Arabic. Who reads all these languages?) The 'names' layer needs to reflect the user's needs. If there's a way to switch that preference on (and retain it in a cookie, perhaps?), it's not transparent.

Nearly all bodies of water on Earth have names. Not so much on OSM ... unless you zoom in and then poke around trying to find one. And if they're away from cities, good luck. It's hit and miss ... mostly miss. There are still large regions of the Earth's surface that show no lakes (and have no roads, as far as the map knows).

It's certainly not 'the map that anyone can edit'. Yeah that keeps the riff- raff away ... but its also a major limitation.

<comment><AUTHOR> You seem to be describing the map at [https://www.openstreetmap.org](https://www.openstreetmap.org) \- it is indeed as your say. But it is only one render of the Openstreetmap data - there is an infinity of others. Look at the following examples comparing different styles - and you can make your own... Openstreetmap is data that you can process and render in any way you desire !

[http://mapstyle.petschge.de/](http://mapstyle.petschge.de/)

[http://leaflet-extras.github.io/leaflet-providers/preview/](http://leaflet- extras.github.io/leaflet-providers/preview/)

[https://mc.bbbike.org/mc/](https://mc.bbbike.org/mc/)

<comment><USER2> Thanks for the helpful tips, I'll be checking those out soon!</comment></comment></comment>


Red Dead Redemption 2 had the highest grossing opening weekend of any game ever - <AUTHOR> https://www.cnet.com/news/red-dead-redemption-2-had-the-highest-grossing-opening-weekend-of-any-game-ever-725/ <comment><USER2> And no PC port... :(

<comment><USER3> Yea the console execs are trying their hardest to convert PC players over and milk em. Yet they could've had more...</comment></comment>


18 ways to be a good developer - <AUTHOR> http://www.kryogenix.org/days/2006/01/22/18-ways-to-be-a-good-developer

<comment><USER2> Doing these things or not has nothing to do with being a good developer.</comment>


Jumping to Conclusions: When People Decide Based on Insufficient Information - <AUTHOR> https://effectiviology.com/jumping-to-conclusions/ <comment><USER2> This is a severely shortened and retold list of biases from Wikipedia: [https://en.wikipedia.org/wiki/List_of_cognitive_biases](https://en.wikipedia.org/wiki/List_of_cognitive_biases) under a more clickbaity name.

<comment><USER3> I don't think that's a fair judgement.

The Wikipedia page that you linked to lists 192 very specific types of cognitive bias; even _if_ the information of the article were directly derived from the Wikipedia page, the author still managed to distilled 192 entries down to 7 categories.

In addition, the article also has advice on how to avoid jumping to conclusions, and deal with people who tend to jump to conclusions. Those are clearly not derived from the link you provided.

Edit: typo (conclusion --> conclusions).

<comment><USER2> I did not mean he took that list, and transformed it. But the result is the same. The categorization offered is pretty arbitrary.

</comment></comment></comment><comment><USER4> Adams has a fun take on many cognitive biases in "Loserthink", which takes on 'unproductive ways of thinking'.

[https://www.amazon.com/Loserthink-Untrained-Brains- Ruining-A...](https://www.amazon.com/Loserthink-Untrained-Brains-Ruining- America/dp/0593083520)

</comment><comment><AUTHOR> My personal favorite:

> Inference-observation confusion. Inference-observation confusion involves > mistaking something that you inferred using logic, for something that you > observed.

<comment><USER5> Experiential idiots vs theoretical idiots.

Some people really can pattern match an order of magnitude better than other folks, likewise I know folks who can logic better than Spock but they have huge gaps in creative problem solving. Minds are amazing.

</comment></comment><comment><USER5> I think we always operate un insufficient information because we are blind to so much. I don't know which neuroscientist philosopher said this, but that we use our cognitive powers to defend the non-cognitive decisions we have already made. We rationalize decisions vs make rational decisions. Same reason we defend an idea even when we know well we shouldn't.

</comment><comment><USER6> Admittedly, I jumped to conclusions thinking someone finally made the Jump To Conclusions game from Office Space :D

[https://youtu.be/sDEL4Ty950Q](https://youtu.be/sDEL4Ty950Q)

</comment><comment><USER7> If only there was some kind of say, mat, that could guide us.</comment>


Dear RIM: Hire me as your Co-Co-CEO - <AUTHOR> http://blog.jamiemurai.com/2011/06/dear-rim-hire-me-as-your-co-co-ceo/

<comment><USER2> RIM doesn't need a third CEO, they need one CEO with courage and a vision for the future.

If they don't get one soon, they're finished.</comment>


Show HN: Probe API – Utilities for distributed network testing - <AUTHOR> https://github.com/optimal-software/probe-api <comment><AUTHOR> Hey Everyone, The github project has full source code of our command line utilities which allow you to run tests from different networks. This can be useful if you want to find out ping times from different locations , or run reverse traceroute.

Also, I welcome any developer to use our API to run any sort of network tests such as testing latencies (ping/http/dns), speed (http throughput), running traceroutes and figuring out how the internet is wired. Our background is in internet speed testing, we have been measuring internet connection quality since 2007 and helping millions of users each month with accurate speed testing tools. The API is free for non-commercial use, after few requests you will need to sign up for the free API key (this is to prevent abuse).

<comment><USER2> My knee-jerk reaction was, "oh great, distributed ping... that won't ever be misused." I've never been happier to be wrong.

The range of tests available is quite impressive and rivals services like Pingdom and ThousandEyes. Granted, you'd have to write your own dashboard, but we're all coders here right? (I know we're not, but it's still fun to generalize at times)

One thing that is not immediately clear is how to get a free API key. You say "sign up" so I'm led to believe there's a link for me to click on and a form to fill out, but I'm not seeing any, on your site or mashape. Makes me sad.

<comment><AUTHOR> Thanks for the feedback. Definitely the Free sign up could be more obvious. At the moment its below the fold on the homepage.

If anyone is interested here is the direct link to sign up for API key: [https://market.mashape.com/optimalsoftware/freeprobeapi](https://market.mashape.com/optimalsoftware/freeprobeapi)

(also that's where the documentation is and ability to query API without coding)</comment></comment></comment>


Improving the security of your SSH private key files - <AUTHOR> http://martin.kleppmann.com/2013/05/24/improving-security-of-ssh-private-keys.html <comment><USER2> I keep my SSH key pairs on a smart card. It is very cheap to purchase a smart card and card reader (~£25 for a gemalto reader & a gemalto .Net smardcard) and if you're buying in medium to large quantities for a business the cost is even less.

This has some major security and convenience advantages over keeping keys in a file. Firstly, you can generate the keypair actually on the card so that the only device that ever has, and will ever have, the private key is the smartcard. Secondly, the key is secured by a pin and, by default, it will block the card after 3 incorrect pin attempts and after 3 incorrect attempts to unblock the card it will permanently erase the secure storage on the card. Also you can easily make use of your keypair on multiple computers, even untrusted machines, without compromising security. I keep my smartcard in my wallet, so I always have access to it where ever I go.

Alternatively, if you don't want an actual card you can get smartcard-like devices are are physically similar to a USB stick.

<comment><USER3> If someone gets hold if your smart card, they can enter a wrong pass phrase to remove your private key, right? So, you have to have multiple of these smart cards (that all share the same private key), some in your wallet, some in your house and some in a bank or vault somewhere. Otherwise, you can lose access to your private keys forever.

Am I right, or I'm missing something?

<comment><USER4> Depending on the cards and their configuration, you could generate the key outside (say, on a trusted machine at home) and upload it to the card. If the cards gets stolen, and you trust the security of the card to not leak the key, you could just get yourself a new one and upload the old key again.

The other philosophy is to generate the key on the RSA card, and never allow the card to export it. Then you consider the private key dispensable and will have to update all systems to accept a new card's private key.

<comment><USER5> _update all systems to accept a new card's private key._

That sort of a chicken/egg problem though, right? It assumes you've got console or some other means of access that will take another credential.

<comment><USER2> I don't see a situation where you are unable to get console access as an acceptable situation. You don't need to be using a smart card to require local console access if things go bad. What about if the SSH server fails or someone applies a bad firewall rule that prevents SSH access?

</comment></comment></comment></comment></comment><comment><USER6> Of course, this doesn't address what I consider the greatest weakness in using ssh - distribution of host keys.

By design, ssh does not make use of certificates. So there is no way for ssh to know upon connecting to a host for the first time whether the public key presented by that host is authentic. After the first connection, ssh caches the keys in ~/.ssh/known_hosts, and will then give you a big warning if the key changes. I imagine when this happens many folks blindly delete the the cached key and re-connect.

So you should be aware of the potential for MITM attacks to occur unless you have some out-of-band mechanism for distributing or authenticating host keys.

Edit: huh, apparently ssh added support for certificates. "ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication." So now you just need to distribute your CA certificate everywhere and you're golden. [http://justanothergeek.chdir.org//2011/07/howto- authenticate...](http://justanothergeek.chdir.org//2011/07/howto-authenticate- ssh-server-through/)

<comment> mike-cardwell You can put SSHFP records in the DNS. See "VerifyHostKeyDNS" in the SSH man page. You'll also want DNSSEC set up of course.

<comment><USER7> After you get a validating stub resolver, since your OS probably doesn't ship with one by default.

<comment> mike-cardwell Doesn't take long to do an "apt-get install unbound" and then modify your network settings to use 127.0.0.1 as your resolver.

</comment></comment></comment></comment><comment><USER8> While its actually an interesting post, the truth is: Don't copy your private keys around. Keep em on your desktop/laptop.

Making your passphrase twice harder to crack is nice.. but whats 15 days instead of 7? Making your passphrase 10000x harder to crack would also be nice... but why care, if i have access to the file, i can just record your keystrokes when you type the passphrase.

And that's why you can use an ssh-agent, and probably why OpenSSH doesn't care much about changing the key format.

If you do not trust your laptop, the problem is still there. You can still capture the keystrokes easily if you have access to the file, anyways.

I would suggest using something like a cryptostick or any openpgp smartcard when the laptop is not trusted (actually, even if its relatively trusted I would still recommend it!). This ensures the key is never transferred somewhere it can be copied.

<comment><USER9> > This ensures the key is never transferred somewhere it can be copied.

But it does not ensure that the computer will add another entry to the authorized_keys file in the host as soon as you access it. Or install a rootkit there with another kind of backdoor.

If you don't trust your computer, don't give it access to your servers.

<comment><USER8> I'm not sure if I understand what you're saying, or if _you_ understand what you're talking about to be honest.. ;-)

If you need to access a server you'll always need a computer. authorized_keys are public keys only. it does not matter if other computers have your public key. all it does is give you access.

the private key of your ssh key(s) give access to several servers, thats why its the part that you want to protect. if one server has a rootkit, well, that sucks. but if that rootkited server can access all the servers YOU can access, you're screwed.

<comment><USER10> He's saying a latent program could hijack your established ssh connection to add another public key corresponding with an attackers private key to get long term access.

</comment></comment></comment></comment><comment><USER11> > openssl pkcs8 -topk8 -v2 des3 \

> -in test_rsa_key.old -passin 'pass:super secret passphrase' \

> -out test_rsa_key -passout 'pass:super secret passphrase'

Is there a way to do this without including the password on the command line? Because somehow I don't think having your private key's password in your .bash_history will improve the security of your key.

[edit] Oh I see, just don't specify and it'll ask. I get that he's doing this with a sample key, but you just know someone's going to scan through this and do that command on their real key.

<comment><USER12> If you put 'histcontrol=ignorespace' or 'histcontrol=ignoredups' in your ~/.bashrc file it will not record commands that begin with a space [1]. I believe that 'ignoreboth' is the default on many Linux distros.

[1]: [http://www.linuxjournal.com/content/using-bash-history- more-...](http://www.linuxjournal.com/content/using-bash-history-more- efficiently-histcontrol)

<comment><USER13> You still shouldn't enter these kinds of commands on a multi-user machine, because anyone running 'ps' will see the commandline arguments.

</comment></comment></comment><comment><USER14> I couldn't help but notice that the original SSH key was encrypted with AES-128-CBC and the "more secure" one mentions 3DES in the ASN.1 structure. This makes me question if the "improved" SSH key really is more secure.

I'm not an encryption expert. Can someone else weigh in on this?

<comment><USER15> The reason 3DES is avoided is because it is significantly slower than AES and usually leads to generally poorer performance. Security-wise, it's fine to use if you're willing to make these performance tradeoffs (eg, you might want it for backwards compatibility with some ancient DES-friendly system).

<comment><USER16> The fact that 3DES is slower is actually an advantage if you are trying to prevent against brute-force attacks. Given that we are encrypting binary data, it's unlikely that knowledge of the plaintext (for example, knowing that it's probably US-ASCII and so the 8th bit is probably always zero) is not going to be available to the attacker. Other potential attacks, such as related plaintext attacks, will also not be available to the attacker. Given that brute force attacks are the most likely threat scenario, using a 3DES which is slower is a reasonable choice.

<comment><USER17> Double-negative in your second sentence, and I think it's not what you meant. I wouldn't be so pedantic, except that crypto is worth being pedantic about.

</comment></comment></comment></comment><comment><USER18>
      ssh-keygen -t rsa -N 'boobooboo' -f test_rsa_key

      history
      ...
      964  ssh-keygen -t rsa -N 'boobooboo' -f test_rsa_key

Best if you let commands prompt you for a password, rather than putting them on the command line for ps, history and everyone else to see.

<comment><USER19> Tip: you can prepend a space at the beginning of the command and it won't be saved in the history (though I agree that letting the command prompt for a password is better)

<comment><USER18> Excellent. Although that can be set to not do that. I've explicitly set it to "ignoreboth" for so long that I'd forgotten why, so it seems new to me today. :)

From man bash:

           HISTCONTROL
                  A colon-separated list of values controlling  how  commands  are
                  saved  on  the  history  list.   If  the list of values includes
                  ignorespace, lines which begin with a space  character  are  not
                  saved  in  the history list.  A value of ignoredups causes lines
                  matching the previous history entry to not be saved.  A value of
                  ignoreboth is shorthand for ignorespace and ignoredups.  A value
                  of erasedups causes all previous lines matching the current line
                  to  be  removed from the history list before that line is saved.
                  Any value not in the above list is ignored.  If  HISTCONTROL  is
                  unset,  or does not include a valid value, all lines read by the
                  shell parser are saved on the history list, subject to the value
                  of  HISTIGNORE.  The second and subsequent lines of a multi-line
                  compound command are not tested, and are added  to  the  history
                  regardless of the value of HISTCONTROL.

</comment></comment></comment><comment><USER20> Very interesting article. But it makes we wonder ... if someone gets access to your key file, that's nearly always going to be because they have access to your login account, right? And at that point isn't the gig pretty much up?

In other words, how much additional security does password-protecting your private key gain you?

<comment><USER21> If your HDD is stolen they can plug it into another computer and copy any file they want.

<comment><USER22> They would get quite a few pseudorandom numbers of mine, aside from a self- compiled Linux kernel. :-)

<comment><USER23> > aside from a self-compiled Linux kernel.

Likely sitting on an unencrypted /boot, waiting to be replaced by one with a keylogger, am I right? Of course a sane person doesn't trust a system that's been compromised before nuking it and reloading from a clean image.

<comment><USER22> There is unfortunately relatively little you can do to thwart such an attack, apart from keeping your notebook with you at all/most times.

Though using a USB key for /boot might be an idea, it is a little less clunky than a ThinkPad and since I suspend to RAM most of the time, it could even be practical. Hm.

<comment><USER24> Can't TPM be used for this? It could verify your /boot with keys external to the disk itself. I'm not sure if somebody has actually built a solution that uses it yet.

<https://en.wikipedia.org/wiki/Trusted_Platform_Module>

<comment><USER23> Sure it can, as can its evolution in the form of UEFI's Secure Boot, the problem is everyone wants to label these as technologies to enable lock-in instead of technologies to provide a trusted boot chain to ensure your system isn't compromised.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> There's Crypto-Stick [0], a security USB key with many interesting features. It's essentially an OpenPGP card with some added features.

What excites me about their project is a very simple file-system based interface they are planning to implement for their upcoming version. Plug the key in, it looks like a regular USB key, put a file in a specific place, get an encrypted/signed/whatever file from the file system from another place. No driver or software required. I hope their project takes off and people start buying these keys. The price is a little high right now (59,00 €) and it is currently not available.

[0] <https://www.crypto-stick.com/>

</comment><comment><USER26> This is interesting - I've never thought to investigate how ssh stores keys.

For managing passphrases, I strongly recommend the program keychain:

<http://www.funtoo.org/Keychain>

It's a thin wrapper around ssh-agent, but ultimately means I only need to enter my passphrase once.

The nifty feature is that you can add a command to your .login to clear your passphrase, so it's safe to use on remote hosts - if someone else is able to ssh in, they only get access to that host, not others that your ssh key allows access to.

<comment><USER14> I just recently started using keychain as well. It's worth noting that it also supports gpg-agent.

</comment></comment><comment><USER27> It is possible to store SSH private keys in gpg-agent, which uses the openpgp-s2k3-sha1-aes-cbc algo to encrypt the key for storage.

s2k3 is an iterated-and-salted s2k algorithm from RFC2440, the protected private key format is: [https://gitorious.org/gnupg- org/gnupg/blobs/master/agent/key...](https://gitorious.org/gnupg- org/gnupg/blobs/master/agent/keyformat.txt)

The number of iterations is at least 65536, whereas with pkcs8 openssl uses 2048 iterations by default.

More details on how to use SSH keys with GPG agent: [http://budts.be/weblog/2012/08/ssh-authentication-with- your-...](http://budts.be/weblog/2012/08/ssh-authentication-with-your-pgp-key)

</comment><comment><USER28> I believe in having unique keys for each client device, then putting them in a hashed authorized_hosts that you can treat as a unit.

That way, if someone steals my (FDE, managed) laptop or phone, I can revoke just the credentials on that client device, not losing access to all my servers.

Using tamper-resistant storage for the keys is a great idea; I wonder if anyone has done TPM for ssh on windows, or just trousers on linux. Sadly for Macs the only option is some kind of external USB token :( I kind of wish someone made a bluetooth 4.0 le device which could hold keys and be used as a smartcard/key device, maybe with trusted user I/O too. Maybe in a watch form factor.

</comment><comment><USER29> A crypto puzzle: Is it safe to encrypt several keys with the same passphrase? Or is it possible to reveal the keys if the same passphrase was used to encrypt them?

<comment><USER30> The key is encrypted using the IV as a salt and your passphrase. So even if you encrypt the same key many times, the encrypted data will look completely different unless the iv is the same.

</comment></comment><comment><USER31> To be fair the DEK-Info IV should be different for each key generated, so rainbow tables and other common precomputation attacks are pretty much out of the question.

It's not as good as PBKDF2, but it's better than nothing and is probably why stretching isn't used.

As for the argument about being susceptible to a dictionary attack, well if you go to the trouble of using key-based auth then use a dictionary word you're kind of asking for it really.

<comment><USER30> > To be fair the DEK-Info IV should be different for each key generated, so > rainbow tables and other common precomputation attacks are pretty much out > of the question.

That's valid; however, when you can compute 33.1B MD5 hashes a second, who needs rainbow tables? <http://blog.zorinaq.com/?e=43>

Six and seven digit passphrases are easily brute-forced.

</comment></comment><comment><USER32> My private SSH keys have passphrases of 19-20 random characters. I store them in a KeePass database (AES encrypted) so that I can copy/paste. For keys on my Mac, I've also allowed the KeyChain (Triple DES encrypted) to remember it so that I don't have to copy/paste it every time.

I think this approach should be more secure than trying to set memorable passphrases for all my keys. Thoughts?

<comment><USER33> Where do you store the passphrase of your passphrase database ?

<comment><USER34> I don't know about the grand parent, but personally I store that one in my brain. It's about 32 (maybe more?) characters and quite complex, but it's the only passphrase I need to use regularly so it's etched into my mind.

<comment><USER35> You don't even need to have a pass phrase that long with KeePass. It allows you to set the number of rounds of encryption to perform to make brute forcing even short master passwords infeasible.

Of course, that assumes the master password is chosen such that it isn't susceptible to your typical dictionary/hybrid-dictionary attacks.

</comment></comment></comment></comment><comment><USER36> Hey, if you're going to remove the old key, remove it securely: use srm!

</comment><comment><USER37> As far as I can tell, this only works with DSA and RSA, but not ECC keys (~/.ssh/id_ecdsa). Thoughts?

<comment><USER37> Ah. I am an id10t. Helps if I type the command correctly. Carry on.

</comment></comment><comment><USER38> I use a 4096 bit length rsa key with a 200 something bit password. Am I safe?

</comment><comment><USER39> Or just use a proper OpenPGP card.</comment>


Ask HN: Best CRM solution for bootstrapped startup? - <AUTHOR>

i'm long overdue to adopt a program, but now that our b2c startup is entering the b2b market, it's definitely time.
here are the three biggest things i'm looking for:
-notifications when to followup with certain people -notifications if contact never responded to email (does any service offer this??) -a system that organizes my contacts by priority ( i currently http://gist.com to put my contacts in perspective, but it's just a reference -- not actionable for me)
i'm looking for a free service at this point to use between two of us -- any suggestions?
what is your CRM of choice? specifically, what makes it great? thanks!
-adam <comment><USER2> I'm not sure how the functionality has evolved since I last saw it, but I worked on the initial build of <http://www.contactme.com/>

Figured I'd throw that into your pool of options

</comment><comment><USER3> I like CapsuleCRM (<http://capsulecrm.com>), it works great and their pricing is great for young companies.</comment>