Why I ask "how many golf balls fit on a bus?" in job interviews - <AUTHOR> http://www.chrisstucchio.com/blog/2012/why_i_ask_fermi_problems.html <comment><USER2> The problem is, talented people (some of them, not all of them) are not interested in ridiculous problems like this. It comes off as making the applicant jump through a hoop and watching them squirm for your own amusement, rather than as anything productive. No-one's interested in golf balls on buses, because filling buses with golf balls is a waste of time. Talking about it seems a waste of time.

And the question is stupid. Buses are different sizes and of different designs, you know. We have double-decker buses in the UK.

If you must use this class of problem, at least make it more related to your field or narrow down the kind of bus and what furniture is on it. And explain to the applicant _why_ you would ask a question like this. "We want to see how you think" isn't an adequate explanation.

</comment><comment><USER3> ..and I will no longer be interested in the job if you think answering a question like that is a worthwhile use of my time, or yours.

It's trivially easy to figure out how to calculate a rough number. I'd go so far as to say blatantly obvious. It's also a waste of time to actually do it.

When it comes to the real world, an estimate that rough, based on no actual data (since the actual dimensions of a golf ball or the hypothetical, poorly defined bus are not available), is not something I'm _ever_ comfortable acting on. In reality, you can always come up with better data than that.

<comment><USER4> No-one is interested in the number you come up with. They're interested whether or not you have a process you use to come up with that number.

Ask some people how many golfballs fit in a bus. They'll be stumped. They'll have no idea how to proceed. They'll just stop, and look at you, and flounder.

Ask other people and they'll have a problem solving process. They'll define the problem; they'll gather information; they'll make assumptions (and note the dangers of assumptions) and then they'll start to work out a rough solution. The number that plops out the end is not relevant. Unless your process comes out with a number that is clearly nonsense ("5" or "27 billion") and you ignore that.

<comment><USER5> This.

The most important takeaway from a face-to-face interview for me has always been to gauge a candidates general problem solving ability. When developing, you'll constantly be solving problems that are new to you, in areas you may not be familiar with.

<comment><USER6> Because we presume that an interviewee is desperate enough that they won't give the "honest" answer - well, I'll google that and see if I can't find someone else who has already found the answer.

Seriously, between Google and Wolfram Alpha, do you think that any of these inane questions can't be answered within a reasonable level of proximity?

Don't believe me? I just googled "golf balls in a school bus" and had a page full of answers in seconds including how they solved it as well as the number. [https://www.google.com/search?source=ig&hl=en&rlz=&#...
Better, why not ask me to pseudo-code a problem you've faced recently? Wouldn't that tell you a LOT more about whether my skills and your needs align?

<comment><AUTHOR> Go use Google and Wolfram Alpha to find the answers to "how many fashion items are for sale on the internet?"

If you can do that, I'm truly impressed by your google-fu. Also, as I said, the fashion items question _is_ a problem I faced at my last job.

<comment><USER6> I highlighted your question, right-clicked and chose to Google it, and it was answer number 3 on the returned results. I suspect Alpha would give more useful detail, but then I really think that wasn't what you were looking for.

Slightly more seriously, going to Google first for ANY such problem would highlight both what is already known about the issue, and profitable answers to look for further information.

</comment></comment></comment></comment></comment></comment><comment><USER7> I agree with the need to assess one's ability in Fermi-style problem solving, but I find fault with using non-sensical information for the topic. Seriously, golf balls on a bus? Why not ask about a relevant problem to be solved?

For me, an interview is a two-way street, and a company can most certainly put itself out of consideration with these types of questions. The biggest issue I find with these esoteric-problem-analagous-to-something-relevant types of interview questions is that they usually send a negative signal about the company. I immediately think of gamesmanship, trick questions, watching candidates squirm, or about a dozen other things that I find have nothing to do with the entire reason I might consider joining a company.

While the interviewer's intentions sound very noble, I find the means to the end more risky than useful.

<comment><USER8> _Seriously, golf balls on a bus? Why not ask about a relevant problem to be solved?_

Asking about an irrelevant problem makes it clear that this question is about your logical process and _not_ about your knowledge related to this job. It's a way of isolating variables.

The actual golf ball/bus question is a bit too much of a cliche to actually use, though. I'd rather ask how many raccoons you could put in a battleship.

<comment><USER7> Oh, I get the point the interviewer wants to reach -- using size estimation questions to gain an understanding of one's logic process. But as a method of achieving that goal, I've found it's a poor instrument.

Suppose candidate #1 is unimaginative and cannot offer a reasonable response. Suppose candidate #2 says "well, a golf ball is such and such size, and there is empty space around each ball, and the bus is such and such size....."

What, exactly, have we learned here? In my experience, nothing.

Having gone through this cycle as both a candidate as well as hiring manager (not my choice to use this line of questioning), the real-world results I've found is little to no correlation between candidate responses and accurate assessment of logic process. The false positive/negative outcomes were significantly higher, and the success rate for candidates into the positions we hired them for were mixed. Basically, these questions offered us nothing in finding candidates who would be successful in the position for which we were hiring.

If I were to ask a question such as this, it would be to gauge one's reaction to the question (assuming it's a stressor) and how they react. The response is nearly irrelevant. But I don't like the tone the question sets between myself and a candidate, so I just don't resort to this as a means to achieving that goal. There are better ways to get at that information.

</comment></comment></comment><comment><USER9> Clearly eggplant golf balls fit on a bus.

I always assume the reason that you ask these questions is because you don't have anything interesting to talk about in the interview.

Interviews are as much a chance for a candidate to disqualify the interviewer/company because they asked stupid questions, as they are for the interviewer to ask stupid questions.

You got me all the way out here, spending my valuable time talking to you, and all you can come up with is a lame question about golf balls? Sell your company to me. Show me that you are excited about what you are doing. Talk to me about what problems you've been solving lately and try to see how I would go through the process of solving those problems. Sure there are NDAs and you don't want to violate that, but programming problems are programming problems, and if I am spending my time talking to you you can do me the favor of talking generally about what you are doing and making it interesting for me.

<comment><USER10> _Interviews are as much a chance for a candidate to disqualify the interviewer/company because they asked stupid questions_

Is this really true? Generally candidates know far more about the company than the company knows about the candidates. I think any notion that it's a meeting of equal interests is self-empowered fantasy.

"as they are for the interviewer to ask stupid questions.*

I ask "stupid" questions of candidates. One of the reasons I ask those questions is, quite honestly, because I want to exclude those people who have an attitude about "stupid" questions. Those who can't professionally humor simple questions are seldom the people anyone wants to work with.

And for the record the people who are really in a position to essentially set the terms _we don't even interview_ (beyond meeting with senior management to give them the sales pitch).

<comment><USER11> Are you sure you aren't conflating "having an attitude about 'stupid' questions" with "simply rejecting 'stupid' questions"?

It's possible to reject stupid questions in a way that is diplomatic and non- douchy.

I'd think that being tolerant of accepting 'stupid' questions is as undesirable as having an attitude about them. The former demonstrates unproductive compliance, while the latter demonstrates unproductive social behavior. Surely there must be an optimum point where someone can behave in a way that demonstrates productive non-compliance, no?

<comment><USER10> _It's possible to reject stupid questions in a way that is diplomatic and non- douchy._

Absolutely, and that's how professionals deal with other professionals. The comment that I responded to demonstrated significant _attitude_ about what they called stupid questions (which are the Fermi problems).

An interview is not a skill discovery session -- ideally your resume and online presence (e.g. github projects) has demonstrated that, along with, if necessary, a practical test. An interview is getting to know how you think, how you communicate, how you deal with people, how you approach problems, etc. It is astonishing how many people _don't understand this_ , and thus don't understand questions that aren't an autism-level focus on a person's specific skill gamut.

Can you tell me what you believe your biggest weakness is?

<comment><USER9> I don't have an attitude about answering 'stupid' questions if they are asked in an honest manner. I have answered and asked many 'stupid' questions in my lifetime and will answer/ask many more. Asking stupid questions is a part of learning. You are reading far too much into my use of the word stupid.

My point is that if I agree to an interview, I would much rather have an interesting technical discussion with one of your engineers than be asked brain-teasers by someone from HR.

I would politely answer the question and would not dismiss it. However I find the practice off putting in general.

Fermi problems are a game that give you an estimate of the person's thought process. Another way to gain an estimate of a person's thought process is to engage that person in intelligent conversation on just about any subject. I much prefer intelligent conversation, as it can actually be quite pleasant.

My biggest weakness?

The interviewer clearly is interested in something contrived and job related. But what are they looking for? Do I spin it and say how "my biggest strength can sometimes be a weakness when..." Am I honest and tell them what my actual job-related biggest weakness is?

If I just straight up tell you something like "I'm incredibly disorganized and never show up when you tell me to," I'm clearly not going to get the job. You don't get any points for honesty. Do you want something where the interviewee has spun his biggest strength? It is dishonest but a better answer.

Asking my biggest weakness is really just you asking me 'What do I want to hear.' Another game... I don't know you very well; how could I possibly answer it? So there it is, my biggest weakness is reading your mind. :)

Or maybe my biggest weakness is over-analysis. In what context of the words 'biggest' and 'weakness' would you like this question answered? Size/importance/grandeur/impact? Mental/medical/social/skill competency?

Literally speaking, it would probably be the oxygen supply on earth. It takes up quite a lot of volume, and if it is removed I'm a goner.

edit: biggest weakness... grammar, punctuation.

</comment></comment></comment></comment></comment><comment><USER12> _I often do ask at least one of these questions on an interview. I don't do it because I care about a precise answer or whether you know the exact dimensions of a golf ball. I care simply because if you can't do Fermi calculations, you can't make long term architectural decisions. You'll build a system which handles 2x today's load very nicely and which I need to replace in 2-3 years, or you might overarchitect a system which can handle 1000x more load than I'll ever need._

...why not just ask a question about building a real-time monitoring system itself and judge the responses there?

i would never pass this test. i would solve this problem using variables for dimensions of the bus and a constant "packing factor" (or assume the optimal cannonball packing and approximate the golf balls as spheres) and write an express formula for the solution. then i would substitute in various constants for the dimensions and adjust the packing factor to find a range of solutions.

the problem with the question is they want an intuitive solution. giving them this formula and evaluating for a range of variables would just piss them off, but it's the best way to approximate the answer of something that poorly defined.

<comment><USER13> _i would never pass this test. i would solve this problem using variables for dimensions of the bus and a constant "packing factor" (or assume the optimal cannonball packing and approximate the golf balls as spheres) and write an express formula for the solution. then i would substitute in various constants for the dimensions and adjust the packing factor to find a range of solutions._

Oddly enough, this was exactly how I was taught to solve Fermi-like problems in my physics program. The point was not so much to be able to "intuit" the answer as to learn how to find approximate solutions with little or no real data. You could do this sometimes just with off-the-cuff estimates (as in the piano tuner example in <https://en.wikipedia.org/wiki/Fermi_problem>), but often enough we came up with approximate formulas and guessed at the constants.

I haven't been in enough startup job interviews to know if actually doing algebra would make them think less of me, but that would really seem pretty dumb.

<comment><USER12> that may be an unfair assumption on my part. i just assumed that when people ask these abstract riddles, they're really looking for some way of testing your intuition and not something this mundane and boring.

it really boils down to basic algebra with some constant fudge factors. meanwhile, cs people have a host of sophisticated tools to estimate asymptotic behavior for the worst, best, and average case, or error bounds on solutions to NP complete problems as a function of the number of iterations of approximation algorithms, or trade-offs when certain pre and post conditions on the data influence the run-time of canonical algorithms (think searching).

the basic toolset of computer scientists is so advanced i guess i'm shocked anyone would ask such a relatively simple problem when there are much better ones out there.

<comment><USER13> Warning: I don't actually do web startups myself, so this is based on an outsider's view of the field.

Computer science provides some really awesome ways to deal with algorithmic problems... but for most startup-type applications, those problems only come into play in a few places (if that). A cool time-management webapp might have an interesting algorithm at its core that uses machine learning to auto-decide what tasks are most important (making something ridiculous up), but the rest of the app is basically just a shiny interface to a database.

I really doubt the problems of scaling a CRUD webapp (at less than Facebook scale) lend themselves to good mathematical analysis. Even if they did, these apps involve lots of third-party layers glued together to put together interesting functionality, and those seem to change often enough that it's not worth even trying detailed analysis.

So instead they do Fermi-problem estimates to figure out their basic scaling relationships. Then you can decide how to plug things together, decide what your basic resource constraints are (compute, memory, disk, bandwidth...) and make it easy to add those resources when your customer base expands.

Edit to add: Thinking a little more, that's _exactly_ when you'd want a set of approximate algebraic constraints, so you could decide how many customers-per- EC2-instance you could serve and how that number might change as instance count increased. Math, it's important.

<comment><USER12> that's a good point.

at my large company i do this every day on the embedded system i work on, which luckily is not a CRUD app. i guess i would hope they would ask me about that XD

databases can get tricky. but you're right, if something complicated like a bloom filter is used to solve subset-query it's probably in an third-party API they grabbed somewhere that handles most of the difficulty.

</comment></comment></comment></comment></comment><comment><USER14> I don't have a single clue how many fashion items are on sale at a given time, not because I'm incapable of estimating it (even though I've never heard of Fermi problems before), but simply because I have no _field knowledge_ about online store business.

Give me a day to think/research if you really want to make sure I'm the right guy for the job, because in the real life, I _have_ the luxury of not being forced to come up with an answer in 3 minutes in a job interview (that would very well change the course of my life).

With all respect, I think all your questions are irrelevant and are definitely not a good metrics for hiring/filtering out candidates. For all means ask them about clustered/non-clustered (to use MSSQL's terminology) indices or stuff like that, but don't put them in a position like this one (they don't know the answer, but given a few days they can give you a pretty accurate estimation).

<comment><AUTHOR> I don't expect you to know the answer. I expect you to tell me how you would research it.

An answer I like: "I'd search on amazon and a few other top fashion sites to get per-vendor count, as well as some of the lower end."

At that point I'd tell them that ShopBop and Net-a-porter are two typical bigger sites, and they each have about 20-50k items. I'd also point out there is a longer tail of much smaller sites.

If your answer is 3M or 20M to my 10M, I don't much care. This isn't a question with a definite answer, it's a question about whether you can think on your feet and get started on poorly defined problems.

With me, it's a good sign if I'm asking you the poorly defined questions with unclear answers. If I reach this point, I've already decided you probably know _how_ to code, and I want to determine if you can figure out _what_ to code.

<comment><USER14> > _If I reach this point, I've already decided you probably know how to code, > and I want to determine if you can figure out what to code._

Well, if that's the case, then it could be a good question.

However, you didn't state or emphasize that in your blog post and from what I've heard, many companies ask such unrelated questions _first_ to filter out completely hopeless candidates and then get to the _real_ interview (technical questions), so I assumes this is what you meant, and I don't owe you an apology ;-)

</comment></comment></comment><comment><USER15> This is dumb for one simple reason, It divides candidates based on an arbitrary line that has only limited correlation to the desired split: Those who fit your job requirements vs. those who do not. Instead, ask them to solve a pertinent problem to your company. If they go down the wrong path, give them a hint as to the right track and see how well they can grasp the new method. Simple. OR even better ask the candidate to explain how they solved their own last 'interesting' problem.

</comment><comment><USER16> You're asking the wrong question. If an interviewer asked me "How many golf balls fir on a bus?", the only sensible answer is "I don't know.", and if the interviewer would expect anything else, I'd call him an idiot.

The correct question is "Estimate how many golf balls fit on a bus." I.e. I'm not expecting the correct answer, I'm expecting an order-of-magnitude estimate.

This specific question is however inappropriate even with the _estimate_ wording, since 1) busses differ (double decker, how many seats vs. standing space, ...), and 2) golf balls are round. This means that the simple estimate "how many 2 cubic inch things fit into a x * y * z box" (as attempted by another commenter below) would produce wildly incorrect results.

<comment><USER17> Not to put too fine a point on it, but if you made this comment during an interview, we wouldn't hire you unless looking for someone to sit alone in a cubical to write device drivers.

</comment></comment><comment><USER18> These type of questions belong in the "Weekly Puzzler" part of the Car Talk radio show.

Honestly, what's the deal with them? Do you have an urge to somehow feel smarter than the person you are interviewing?

Why don't you instead do the following:

Sit the programmer down and show him your source code. If he can make any sense out of your spaghetti, then hire him/her. That's all you are looking for, right? Someone who can understand what it is you are doing so he/she canhelp you to do it faster.

No other industry has to deal with this nonsense. Imagine if auto mechanics had to guess how many miles does the average Formula One engine piston travel in a scheduled race. We would be riding around in bycicles because no mechanic would take that.

</comment><comment><USER19> Maybe I can add some context. I was the OP that started this whole discussion about posing math problems / Brainteasers at interviews.

Out of the blue I got a call from a recruiter saying that bank X would like to interview me for a quant role they have. They wanted to fast-track the process so they booked me for 2.5-3 hours of back-to-back interviews. I was not looking for a new job but I thought it might be good to talk to them and explore leaving academia.

The first interview was with some quants who work for the hiring manager. They tell me that they plan to have a technical talk with me and then follow that with some math problems and brainteasers. At that point I respectfully declined saying "I wasn't aware that I was going to be asked those types of questions and I don't really believe they are a good hiring tool". The guy tells me too bad, that's the way they hire now. I say fine and we carry on with the first part of this session and have a technical talk.

We then come to the point that they want to ask me the math problems. I again say that it's silly. They disagree. Then I say "For example, who's to say you're not going to ask me problem A". They laugh. "followed by problem B, C, D". They stop laughing. "Finishing with the problem about the expected number of tosses of a coin to HH". They look at each other. "and who's to say that I don't know the answers by heart. It's luck of the draw, maybe I know your questions and maybe I don't and how would it reflect on me if I don't know". The guy who had problems ready for me turned white. They quickly ended the interview in a cordial way at that point and seemed to scramble to find the next two guys to come and interview me. Probably because the interview finished 30 mins earlier.

What they didn't realize is that I love these types of problems and that it is a small community. I know a lot of people and remembered what questions they had asked one of my friends. When they walked in the room, the guy had the solutions written out on a piece of paper and with only a brief glance I knew that I was going to get asked the same ones.

He had paper with the solutions face down during the whole interview but when he left I have never seen anyone pickup a piece of paper in a more awkward way. He did the whole fold in half as you lift thing.

</comment><comment> alok-g A bigger problem I have with these problems is that I do not feel motivated to solve or even think about such problems. My internal reaction therefore always is, why do I care how many golf balls fit, even if I do not say it out loud.

For whatever problem the interviewer poses me, I would like them to supply me the context around that problem so I can see what is the benefit of solving it. Solving it for the sake of the interview is not a valid answer for me.

There are a plenty of important problems to be solved for me to not waste a minute on a useless one.

<comment><USER8> Y'see, with that attitude I wouldn't hire you.

I don't want people who solve problems because they're important, I want people who solve problems because they're intensely curious and just love solving problems.

<comment> alok-g Without knowing why the problem is important, you do not really understand the problem yourself. Understanding the problem better is often even more challenging than solving the problem (once understood). I have seen people go circles around trying to solve the problem at hand without reaching the solution that actually solves the problem, just because they did not understand the problem correctly to begin with.

There indeed are curious problems. Estimating number of golf balls that can fit into a bus is certainly not one of them. Try to come up with a curious problem, then we'll talk.

</comment></comment></comment><comment><USER20> The author gives a reasonable example of the usefulness of this skill.

My problem with these questions is when they come out of a box delivered by Cargo Cult Airlines. If you or your organization don't actually use these techniques in the normal course of the job, then don't ask these questions.

"I just want to see how you think." OK, fair enough. After I've answered, describe how I think, and compare and contrast that with how other candidates think. My bet is that most people who ask this question have no idea how anyone thinks, including themselves. Most people.

Column 7 of Programming Pearls (which can be read online, <http://netlib.bell- labs.com/cm/cs/pearls/>) is an interesting exploration of the actual use of this kind of exercise.

When you get a question about golf balls, don't just declare "Bogus." Consider who's asking it, and whether they seem to know what they're doing with the question.

The question is valuable to the candidate, and not just to identify lame companies. Face it, most people just don't know how to interview, and if you decide based on this, you're being a lazy interviewee. In rare cases, the question might even expose a company with a clue.

Be open.

</comment><comment><USER21> It's pretty simple really. The answer does not have to be right. Just talk your thought process through... how big is a golf ball... maybe 2 cubic inches. I wonder how many cubic inches are on a bus... how big is the bus? Well, it doesn't matter... assuming the bus is 20 feet long and 7 feet wide, and 8 feet tall there would be X cubic feet in the bus some of which would be taken up by seats and other things so we'll say X minus that to get the total number of cubic feet that we can put the golf balls in. Now the question becomes, "How many 2 cubic inch things can you fit into X cubic feet?"

That's it really. Just think it out and solve it like you would any other problem. If you can't talk it out and sort of layout how you'd go about solving it, then you're likely not a good candidate for some jobs.

</comment><comment> sasha-dv >Why I ask "how many golf balls fit on a bus?" in job interviews

Perhaps, you think that a direct question about realtime monitoring systems isn't tricky enough?

<comment><USER22> I think this is really what it is. There's this trend in the valley of everyone thinking they need ninja zombie pirate rockstar gurus who can solve P=NP and interviewing accordingly, when they're really writing simple CRUD apps and just need someone that knows how to do solid architecture and design.

Asking stupid questions like golfballs on a bus sends a signal of "we need geniuses for some reason" and is intended to make the candidate think "wow, the interview questions were so hard, everyone that works here must be really smart!"

<comment><AUTHOR> _...need someone that knows how to do solid architecture and design._

Solid architecture involves having an order of magnitude estimate of the load you might expect and building accordingly.

How do you get your order of magnitude estimates?

<comment><USER22> "How would you scale a web service to handle 10 hits per second? 100? 1000? 10,000? 1,000,000?"

</comment></comment></comment></comment><comment><USER23> Short bus or long bus? A long bus is about twice as big as a short bus, here in Denver, at least.

Also, with or without seats?

<comment><USER11> I was thinking the same, but it'd be funnier to take it one step further:

"Short bus? Long bus? Double decker bus? Coach bus? VW Bus?" Since I'm not sure of the relevance of the question, I choose a Matchbox Bus. The answer is 0. 0 golfballs fit in a matchbox bus. Enough bikeshedding. Let's move along to questions that will more reliably assess skills I will be using on the job as a software engineer."

"Bob Slydell: I'd like to move us right along to a Peter Gibbons. Now we had a chance to meet this young man, and boy that's just a straight shooter with upper management written all over him."

All questions like this would tell me about a candidate is that they have a high tolerance for bikeshedding.

<comment><USER2> > "Short bus? Long bus? Double decker bus? Coach bus? VW Bus?" Since I'm not > sure of the relevance of the question, I choose a Matchbox Bus. The answer > is 0. 0 golfballs fit in a matchbox bus.

You never know how far they want you to go with their game. This could mark you as a genius, or as an ass.

<comment><USER11> I suspect that I'd be marked as an ass, though I reckon I'd get brownie points for correctively outing the bikeshedding.

In fact, it'd be even funnier to answer the question, then ask the question "I'm building a bikeshed. What color do I paint it?"

</comment></comment></comment></comment><comment><USER24> Instead of asking me about golf balls and bus, would you not have consideration for my intelligence and ask me a question that pertains to the problems your company faces, and see me analyse it in various contexts, leading to a richer interview? This way I will know something more about your company and its work too, and you will know how I think about problems. In your case, respect me enough to tell me your problem with number of clothes and such and test me against it. Golfballs are Golfballs, your company's problems are what I am hoping to solve. In that sense, you and your company will earn my respect if you treat my time and insight as something valuable. I will not solve golf ball problem for some myopic "insight" of questionable value.

</comment><comment><USER11> If a company is solving interesting problems, I think that they won't even be thinking about irrelevant problems for an interview.

Assuming a company has interesting problems that they are solving, why would they willingly leave their interesting problems at the door instead of using those problems as the basis for their interview dialogue.

The best interviews are a dialogue (not an interrogation!) where both the interviewer and interviewee spend about equal time talking. Questions where the interviewer spends a few seconds asking the question and the interviewee spends several minutes answering is not demonstrative of real life collaboration, and at the day the purpose of an interview is to recruit a potential collaborator.

</comment><comment><USER25> I don't see the problem with these questions. If you are really good it will take you 5 minutes to answer that question. That is it. And lamenting about interviewer waisting your time is ridiculous, you waist much more time every day on the stuff that is less useful. The point of the question is to quickly check if you can think logically that is it.

<comment><USER2> It isn't a well-formed question. There's so many different kinds of buses, there might be furniture, it might be toy bus, the doors might be open, it might be an alien bus, it might be full with people or superglue; Who knows? The question is so loosely-formed as to be nonsensical. You might as well ask "How many/much object(s) can fit (insert spatial relationship here) (a/an/the) thing(s)?"

<comment><USER25> Well to me it seems like a lot of questions in the real world are formed like this. I.e. if you are asked to find how many customers will buy a book of your website you make some reasonable assumptions like: The world will not come to an end tomorrow You don't ask a person what should be defined as a book or what should be defined as a buy etc. What I mean is that it is good to have the ability to research the common case. And imagine the question about balls was a real problem that your company faced, I don't think you would ask your colleagues all the questions that you pointed out.

<comment><USER2> But in this case (golf balls on a bus), I don't know what kind of assumptions I can and cannot make. It isn't a real-world problem, so I can't use my 'common sense' to reason about its constraints.

</comment></comment></comment></comment><comment><USER26> I know why people keeps asking these questions: because it makes YOU look smart. And also because it is/was a fad.

</comment><comment><USER27> How many idiotic interviewers does this company have?

At least 1.

</comment><comment><USER28> _Fermi problems come up all the time in computing_

Hm. I've never faced any such problem. But then, I do uninteresting stuff like deciphering horribly documented APIs and writing desktop software.

If I go into an interview for a desktop software role and they start asking me Fermi questions, I'm probably just going to walk out. In fact, if they ask me questions that look like dynamic programming, I might walk out, too. Why? Because I know they aren't _ever_ going to present me with such problems, and they're just cargo-culting their interviews.

<comment><AUTHOR> _If...they start asking me Fermi questions, I'm probably just going to walk out...dynamic programming, I might walk out, too...I do uninteresting stuff like deciphering horribly documented APIs and writing desktop software..._

Maybe if you stop walking out of tough interviews you'll find a more challenging job.

<comment><USER28> My last sentence explained why that's not an issue. If you're going to be condescending, you should read more closely.

<comment><AUTHOR> Yes, you believe they will never present you with such problems, even though I gave two real life examples of where such problems come up.

<comment><USER28> ...real life examples which have absolutely nothing to do with any of the jobs I've ever interviewed for. But hey, I'm sure you know about them better than _I_ do.

Seriously, man, you need to get over yourself.</comment></comment></comment></comment></comment>


ESR: Software licenses as conversation - <AUTHOR> http://esr.ibiblio.org/?p=2000

<comment><USER2> It is an interesting perspective, but surely not the only relevant one. Open source licenses - at least the non-satirical ones - are after all enforced regularly by the courts: <http://gpl-violations.org/faq/sourcecode-faq.html>.</comment>


Image-Match: Open-source scalable reverse image search - <AUTHOR> https://github.com/ascribe/image-match <comment><USER2> This is _sweet_...image-matching is one of those functions that external services do extremely well for the consumer -- e.g. Google Image Search and TinEye -- but not for those who need to have such a service in a private domain, such as an in-house photo library...I've used pHash for comparisons, and have a decent idea of how to build my own classifiers...but pretty much no idea how to do it efficiently and in a structured way to do reverse-image matching.

FWIW, John Resig uses pastec for his work:

[http://ejohn.org/blog/image-similarity-search- wanted/](http://ejohn.org/blog/image-similarity-search-wanted/)

[http://ryanfb.github.io/etc/2015/11/03/finding_near- matches_...](http://ryanfb.github.io/etc/2015/11/03/finding_near- matches_in_the_rijksmuseum_with_pastec.html)

</comment><comment><USER3> The LSH wikipedia page is a fun read and relevant [https://en.wikipedia.org/wiki/Locality- sensitive_hashing](https://en.wikipedia.org/wiki/Locality-sensitive_hashing)

Here's a real-world use case [http://blog.livefyre.com/architecting- sidenotes/](http://blog.livefyre.com/architecting-sidenotes/)

</comment><comment><USER4> You might want to look at Morelikethis queries to boost performance. I worked on a proprietary version of this and at the time Lucene performance dropped off nearly linearly with the number of query terms.

We used MoreLikeThis to reduce our queries count to the 30-40 most statistically interesting terms. The one hiccup being an issue in Lucene [1] where the term cache wasn't operating properly. We just added our own image query term cache and a custom MLT query to leverage it, which gave us a 10x speed bump over any other methods we tried.

The interestingness of the terms is assessed on a per-term basis though, so you might see a relevence drop for some types of image if you set MoreLikeThis to use too few terms.

[1] [https://issues.apache.org/jira/browse/LUCENE-1690](https://issues.apache.org/jira/browse/LUCENE-1690)

<comment><USER5> Thank you for the suggestion. I actually did try restricting the terms by measuring correlation between columns -- the idea being that more discriminating terms should be searched first. This did result in modest speedups.

Fortunately or unfortunately, we were already achieving pretty good speed with Elasticsearch so we didn't implement it. However, it didn't occur to me to try a MoreLikeThis query, which should be even simpler -- I will look into it!

<comment><USER4> Cool. Impressive project by the way; I forgot to say that before.

I tried something similar; but with a different approach. I tried creating compound words, a bit like n-grams. I didn't get it working as that was a side-project and I couldn't commit enough time.

</comment></comment></comment><comment><USER6> Last time I looked into doing some content based image matching in nodejs the best I could find was a node-phash fork that was difficult to get working on osx.

Does anyone know if this has changed since?

</comment><comment><USER7> An implementation of image similarity search based on deep convnets can be found at [https://github.com/beniz/deepdetect/tree/master/demo/imgsear...](https://github.com/beniz/deepdetect/tree/master/demo/imgsearch)

</comment><comment><USER8> Uhh... that's a fork. This is the original repo: [https://github.com/rhsimplex/image-match](https://github.com/rhsimplex/image- match)

<comment><USER9> It appears that since your comment was posted the original repo's README was updated with a notice stating it was no longer maintained and that OP's linked repo is actually the correct one.</comment></comment>


I and We - <AUTHOR> http://www.aaronkharris.com/i-and-we-1 <comment><USER2> Great post. I've always thought a good metric on how much founders really care about culture is to see how many early employees still work at mature companies. Retaining somebody for 1 year is easy, but retaining somebody for 5 years is really really hard.

I found that an unnamed founder (to protect his ego) had a great statement on this topic:

> And the other thing worth mentioning is, on the first ten people on the > culture and team topic, I think everyone doesn't realize until they go > through it themselves, how important it is because in life and media people > focus too much on founders. Here we are and we are reinforcing the > structural narrative that Stripe is about John and Patrick and Pinterest is > about Ben. When the vast majority of what our companies do, 99.9% are done > by people that are not us, right? It's obvious when you say it but it's very > much not the macro narrative. These are abstracts and you associate them > with certain people. For companies like Apple and others, Steve Jobs was a > tiny, tiny part at the end.

> Source: > [https://www.youtube.com/watch?v=H8Dl8rZ6qwE&feature=youtu.be...](https://www.youtube.com/watch?v=H8Dl8rZ6qwE&feature=youtu.be&t=21m30s)

If I were looking to join a company, these are the kind of statements that would make me want to work for that founder.

</comment><comment><USER3> I'll just leave something I posted to my Facebook a few months ago, because it seems relevant.

> A tip for future leaders: leadership means absorbing blame while deflecting > success. All too often, I see leaders that do the opposite.

> When your team succeeds, make sure people know that it was a team effort. > The _team_ succeeded. Likewise, when your team fails, you should take full > responsibility for it. It's not so-and-so's fault that s/he made a mistake, > it's your fault for giving them the space to do it. _I_ messed up.

> Onward and upward!

> (PS: Obviously this assumes a good environment, where leaders have close to > full control over what they and the teams are doing. If that's not the case, > then obviously you have issues that are more important than who gets the > blame.)

<comment><USER4> I think this is right up to a point. While good leaders take first blame publicly, they do need to figure out the causes internally. There are many times where the fault actually belongs to someone specific. That's really important to learn.

<comment><USER3> Right, this was meant in a public sense.

</comment></comment></comment><comment><USER5> I think the use of 'I' and 'we' is most interesting in Formula 1 where the drivers always use 'we' in the winner's driver's conference. Hang on a minute, you were the one driving, nobody else was in the car, yet you use the word 'we'? What is going on?

Well, at times, they also use the word 'I'. This is in the other scenario - losing! 'I clipped the kerb' etc. But you don't get the losers in the driver's conference, hence 'we' is the term used. F1 is very much about individuals wanting to win, team mates are perhaps the most terrifying rivals as they have an identical car - they have to be beaten before the rest of the field can be beaten. Yet it is always 'we' and 'the team', even though there is nobody else in the team doing the driving for them. Sure there are things like good calls for pitstops that comes from the guys in the garage, but it isn't a team sport like cricket/rugby/football is.

Personally I think that 'we' is an important word to use in the workplace as it sends out a quite powerful signal that someone is part of a team, even if 'we' can be used nefariously, e.g. to not acknowledge blame for having broken something.

<comment> david-given OTOH --- but I won't try to argue myself, as this story from _The Codeless Code_ does it so much better. (Cut-and-pasted here, as it's short.)

[http://thecodelesscode.com/case/106](http://thecodelesscode.com/case/106)

A certain monk was known throughout the Temple for his humility. When discussing flaws in his clan's software he always took personal responsibility, yet when receiving praise for marvelous features crafted by him alone, he always gave credit to the entire team. Eventually word of the monk came to old Jinyu, Abbess Over All Clans And Concerns.

"So," she said to her chief abbot, "this monk says 'I failed' after the defeats of others, and 'we triumphed' after his own victories?"

"So it is said throughout the Temple," said the abbot.

"Bring him to me," commanded Jinyu.

When this was done, Jinyu surprised all in attendance by striking the monk with her cane and sentencing him to thirty days' hard labor in the data mines. After the stunned monk had been taken away the abbot nervously approached Jinyu to inquire the reason.

Jinyu struck the abbot. "Fool! Consider the monk's algorithm. When he says 'I failed', what is most probably the truth?"

"That others have failed," said the abbot, flinching.

Jinyu struck him again. "And when the monk says 'we triumphed', what does he most likely mean?"

"That victory was his alone," said the abbot, wincing in pain.

The ancient priestess twirled her cane overhead, so fast that the very air whined in anguish, until with a thunderclap she brought it down hard on the floor in front of the terrified abbot. "The only thing praiseworthy about this boastful monk is that he has mastered the art of one-to-one mapping. Meanwhile, what am I to do with the rest of you idiots? You were deceived by a simple substitution cipher that your brains had already decoded."

<comment><USER5> Many thanks for that, I shall now read the code-less-code...

</comment></comment></comment><comment><USER6> Separate process and identity. It's not "I/we succeeded, or failed." Rather it is "we've found what works and what doesn't work".

</comment><comment><USER7> I like the author's use of the word "modesty", but maybe "humility" is really what we're looking for. Modesty means balanced and moderate, but sometimes leaders need to take feedback without trying to balance it (i.e. defend themselves). Take their lickings, so to speak. Those are the times that true growth happens.

<comment><USER4> That's an interesting point. I hadn't really parsed the difference between the two terms, but there is one. I think it ends up calling for both, depending on the situation.

</comment></comment><comment><USER8> I can say with utmost honesty this post made me happy. You just get it man. And unfortunately people who do not get this, just won't.

You have people who are all inclusive and people who just want everything to be centered around them. Such attitude is simply toxic for the simple reason that these people are far more interested in how the world perceive them, then the advancement of the works.

</comment><comment><USER9> Another interesting thing to look at is how founders talk about their team - do people work _for_ them or _with_ them?

Great passage from this post on leadership and mentoring: [http://www.bothsidesofthetable.com/2010/12/02/whose-life- are...](http://www.bothsidesofthetable.com/2010/12/02/whose-life-are-you- going-to-change/)

You looked after me when I got there and treated me like a friend, not an employee. You refused to say "he works for me" you always said, "he works with me."

</comment><comment><USER10> The word 'Ego' was just completely hijacked.</comment>


Chrome 56 will mark HTTP pages with password fields as non-secure - <AUTHOR> https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html?m=1 <comment><USER2> Firefox has started to do this recently and it's been fantastically informative and helpful.

It's the one new browser feature I never really considered wanting/needing before, that's really stood out to me as being incredibly valuable since I've started to see the warnings pop up.

<comment><USER3> Kinda like how your antivirus tells you about how the formidable threats it saved your ass from today?

Or like "did you know your house COULD have been ransacked today, but it didn't happen!!"

Now all my users are going to hear that my site is insecure, when nothing at all changed.

How long ago did they announce that? I think just a couple months? They should have announced this much sooner.

It's going to hit me hard as my site is pretty niche and driving even more people away is the last thing I hoped for :( My shared hosting doesn't offer Let's Encrypt, and makes me pay to "install" a free certificate anyway. So I have to move everything to a different web host.

<comment><USER4> > Now all my users are going to hear that my site is insecure, when nothing at > all changed.

You're being pretty irresponsible if you aren't using SSL for passwords. You users _should_ be told that your site is insecure, because it is. You should care more about the security of your users.

If your hosting does not allow SSL, you have an obligation to change hosts for the safety of your users. If you aren't willing to do that, you're negligent and you should stop doing business with the public.

This is a huge red flag. If you really don't think SSL is important, it raises disturbing questions about your approach to security in general. Which other standard security practices have you ignored? Are you using strong hashing for passwords? Are you properly handling input to prevent SQL injection?

<comment><USER5> "insecure", "huge red flag." For a banking site, an e-commerce site, a webmail, sure. Must an aquarium enthusiast forum be resistant to Man-in-the- Middle attacks? What about weak ciphers? Should every site be resistant to offline decryption by a state actor?

<comment><USER6> Until users stop using the same password everywhere, your aquarium website is effectively the security for _all_ your users accounts, including their bank.

<comment><USER7> How is that the websites fault?

<comment><USER6> It isn't the website's fault that users do things wrong. It's the users' fault. However, it is the website developer's _job_ to mitigate obvious problems. We know that users do things that are stupid so we have to work a little harder. We have to build products that recognise what the basic minimum standard is, and then try exceed it. If you're transferring passwords across the internet in plaintext then you haven't managed to do that and you need to try harder.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Pm - "why is this page insecure"

Developer - "chrome labels password fields as insecure over http"

Pm - "what if it wasn't a password field"

<comment><USER9> Don't you need to use type = "password" to get the _-for-every-character treatment?

I suppose you could implement your own (e.g. type = "text" with an onKeyDown listener that cached each keystroke and inserted a _ into the field), but that sounds like a terrible solution in so many ways.

I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site. Looks like they have a service called Flexible SSL that terminates HTTPS at the CDN, and sends unencrypted traffic to your backend:

[https://www.cloudflare.com/ssl/](https://www.cloudflare.com/ssl/)

<comment><USER10> A few solutions:

\- Create a font such that every character shows up as a * and use it for a text input.

\- make the input field use white text on a white background using a fixed- width font, monitor length, and display the correct number of *'s above it using a div.

\- implement the text box ground up from scratch using div's and JS, like google docs does.

\- implement a HTTPS password field in an iframe and communicate with it over post messages.

<comment><USER11> Honestly, why would you do any of those things, now that installing a certificate takes 5 minutes and is free, with Let's Encrypt?

I know that you're just exploring solutions because it's interesting, but all those things take longer than Let's Encrypt.

<comment><USER12> Let's Encrypt is great, but completely useless for... Actually every single website I host. No wildcard certs, the rapid rotation that requires software to renew it regularly, etc. The cost of implementing HTTPS for dozens of sites with no sensitive data is simply not worth it.

When companies like Google and Mozilla decided how to handle HTTPS, they decided based on their needs and their perception of everyone else's needs, like banks and major corporations. This led, IMHO, to a complete failure to recognize a lot of other uses for the Internet, and so their solutions fail to adequately account for them.

<comment><USER13> HTTPS is for the user's benefit, not the site owner's (barring legislation, of course). Also, HTTPS prevents hijacking, not just sniffing, of content by a MITM. That includes malware injection.

This has been coming for quite a long time. The time for excuses is over. If you think the safety of your users is "simply not worth it", well, I'd like to know what your websites are so I can block them at my firewall. I'm not saying this to be a dick, I'm saying this because this is an attitude of callous disregard on display, and it's downright odious given the modern security climate.

LE is not that hard to use, and I seriously question whether you can't make an API call once every 90 days per subdomain. The requirements have never been lower.

<comment><USER14> HTTPS is very much for the site owner's benefit as well. If your site is not HTTPS then you can't be sure that your users are seeing what you intend them to see. Ads, malicious script, whatever, can be injected or replace your content.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> I've got to say though, that this is a wee bit frustrating as a developer. SSL libraries are terrible, bug ridden, hard to work with, and there are huge sacrifices using a pass-through proxy to offer SSL.

The brittleness of SSL libraries manifests not just in the form of security exploits, but also in the form of delaying the next generation of HTTP technology. Node doesn't support natively support HTTP/2 due to HTTP2 fitting issues [[https://github.com/nodejs/NG/issues/8](https://github.com/nodejs/NG/issues/8)]. Jetty was delayed for Java SLL changes. Same with Go.

If Google wants to make the whole web secure? That's great. But we also need to work on making it _simple_ to secure. So much research goes into novel ciphers and optimal ways to defeat timing attacks, and etc etc, but the spike in complexity means that we're reaching a point where almost no individual or group can approach a correct implementation.

It worries me that we're approaching a point where we're utterly dependent on a security standard no one can understand.

<comment><USER16> As with most things, progress isn't clean or easy. Shifts in policy or practice cause disruptions, and then people adjust. The world is a dynamic place.

Software is no exception. SSL libraries will get better if they get used more. The developers will make them better. Or if they can't, we'll find a solution that works.

The question is whether the benefit of the disruption outweighs the cost. Browser-makers decided that their users' needs were best served by this change. Mozilla and Google have been telegraphing their actions in this direction for years. They have attempted to make a responsible and gradual transition, and to a large extent have succeeded.

Every once in awhile though, a break needs to be made and some folks will get left behind until they adapt, or don't.

<comment><USER15> > SSL libraries will get better if they get used more. The developers will > make them better. Or if they can't, we'll find a solution that works.

I keep hearing this, but failing to see it. Since OpenSSL's inception.

<comment><USER17> BoringSSL and LibreSSL are two non-trivial projects to improve SSL libraries that started within the last 2 years. They may not be at an ideal state yet, but a lot of work is being done to move the baseline to a better state.

</comment></comment></comment></comment><comment><USER18> I hope they do this for CC numbers too, because I know of a website I had to use that passed your Name, address, CC number, CC exp, amount; the whole shebang over plain ol' http to do a payment _shudder_.

<comment><USER19> Honest question, who is in a position to tap your connection such that this becomes a serious security concern? IT staff at your company? The admins at your ISP? The NSA? I'm assuming that public wifi has session-specific encryption keys. I don't see these as the kinds of concerns that would warrant the kind of panic that some people seem to show over HTTP.

<comment><USER20> > who is in a position to tap your connection such that this becomes a serious > security concern?

When you use HTTP everything is sent in plain text. This means...

\- Anyone on the same network as you can see all of your traffic. This includes company networks, coffee shop wifi, your house, the library; any place that has a WiFi network. Caveat: it's possible to use network isolation to hide your traffic but this is crazy rare to see and typically is done to isolate networks, not individual traffic.

\- Your ISP can see and log everything sent over HTTP.

\- Anyone at the router level that your traffic passes through. Your traffic makes a lot of hopes over various routers on the internet before making it to your final destination.

Overall it's a terrible idea for anything that needs to be sent securely.

<comment><USER21> If I have two devices connected to a switch, how can they see each other's traffic?

<comment><USER22> Just download Wireshark and you'll have an easy to use tool that'll show you the traffic.

<comment><USER23> Not by default, only if you do ARP poisoning, which most consumer switches wont guard against.

All you'll see without it is broadcast crap.

</comment></comment></comment></comment></comment></comment><comment><USER24> I've been paying rent with www.rentpayment.com which unfortunately serves up their home page with multiple logins over http. Naturally, emails and tweets to their support go ignored. Maybe they'll finally respond after more people ask them why they're "non-secure".

<comment><USER25> I wrote a short article on this topic with approaches for less tech savvy folks to set up HTTPS:

[https://medium.com/punk-rock-dev/https-new-year-avoid-the- no...](https://medium.com/punk-rock-dev/https-new-year-avoid-the-not-secure- label-eefb99879980#.io1rzm367)

</comment></comment><comment><USER26> Mods, can we please get the "?m=1" part of the url removed? I think the current link is for mobile.

<comment><USER27> But that would make it worse for people on mobile.

<comment><USER28> Man, someone should really invent a way to make webpages respond to the dimensions and capabilities of the user's device.

<comment> amiga-workbench Plain, un-styled HTML?

</comment></comment></comment></comment><comment><USER29> Alright, for what its worth everyone, if you haven't seen this already, here it is! The Cert bot from EFF!

Get that HTTPS motor running. This really does make it easy.

[https://certbot.eff.org/docs/intro.html](https://certbot.eff.org/docs/intro.html)

</comment><comment><USER30> Firefox has a similar feature enabled in dev edition: [https://blog.mozilla.org/security/2017/01/20/communicating-t...](https://blog.mozilla.org/security/2017/01/20/communicating- the-dangers-of-non-secure-http/)

<comment><USER31> Actually, it's in Beta now, and will be shipping to Firefox release channel users on Monday or Tuesday.

</comment></comment><comment><USER32> Countdown until a JS extension that takes a normal <input> field and uses • characters to make it look like a password field without tripping Chrome's detector...

<comment><USER33> Can we just ban inputs being manipulated on input? It's really annoying for custom implemented types like phone numbers that do the '(___) ___-____'. Half the time it seems they break if you mess up.

<comment><USER34> I'd be in favor of banning input manipulation but adding custom fields like phone which would accept regex formatters.

<comment><USER2> Browsers already support that. Good look convincing managers/clients/designers that they're sufficient on their own though.

The real problem is UI. Most of these plugins are changing the UI of forms to something that looks fancier (and more consistent) than the defaults.

<comment><USER33> There really does need to be a better way to style inputs. It's all over the place now. Hell, just making `type=search` look the same across browsers isn't as straight forward as it should be.

</comment></comment></comment></comment></comment><comment><USER35> Stupid question: Is the warning going to show up for localhost i.e. using chrome to see the local dev version of your website?

<comment><USER36> see chrome://flags to disable security warnings on localhost -- great for development

<comment><USER37> it's weird that the warnings aren't disabled by default on chrome for localhost: it's officially classed as a "secure origin"

[https://www.chromium.org/Home/chromium-security/prefer- secur...](https://www.chromium.org/Home/chromium-security/prefer-secure- origins-for-powerful-new-features)

</comment></comment></comment><comment><USER38> What should be done for routers and printers that are accessed by their IP address?

<comment><USER39> The best solution is for them to be accessed through a publicly registered hostname e.g. [https://router0123.netgear.com](https://router0123.netgear.com) (that would only resolve locally). They could provision certificates for themselves using the Let's Encrypt DNS challenge.

<comment><USER40> So, now we have a single certificate on all routers? What happens if I take apart a router?

Or would every router get its own certificate? But then netgear would have to become its own CA.

And in either case DNS hijacking is a massive issue.

<comment><USER41> _Or would every router get its own certificate? But then netgear would have to become its own CA._

Why? They could just partner with an existing CA, like Cloudflare does with Comodo.

And how would DNS hijacking be an issue? The attacker wouldn't be able to produce a valid cert anyway (the router would come with a custom burned-in key that it would use to authenticate itself to the CA and get the cert).

<comment><USER40> > the router would come with a custom burned-in key that it would use to > authenticate itself to the CA and get the cert

I take apart the router, and get a valid certificate. Now I hijack DNS, and get you to connect to me.

HTTPS within LAN for this purpose is useless.

<comment><USER41> _I take apart the router, and get a valid certificate_

You only get a valid certificate for your router's address. But if you can take apart the router, you don't need to hijack the DNS, you can simply control its traffic.

But if you're a guest in my home and I see you take apart my router, you'll have to answer a few questions. Same in an office or coffeshop. Having LAN access doesn't mean you have complete physical control of the router. So the HTTPS is _not_ useless.

<comment><USER40> You only get a valid certificate for your router's address.

Considering basically every router has the same address, I now have a valid certificate for basically every router.

<comment><USER41> _Considering basically every router has the same address_

They have the same IP address, not necessarily the same DNS hostname, which is what the certificates are tied to. The user would just be told to connect to the hostname (possibly printed in the sticker) rather than to the IP.

<comment><USER40> That's certainly one option, but what happens now if I change the IP of the router in its config, because I use multiple in my LAN, one as router, the others as AP?

There is no option for any of this that isn't completely messy and hacky

<comment><USER41> On first boot and every time you change its IP, the router sends an authenticated message to the server to update its DNS records.

As a bonus, the user doesn't have to change anything to keep accessing the router admin page after the switch.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER42> There should be an HTTP Header (or a CSP directive) to allow servers to set sites as "Not Secure" manually. That would help a lot of people dealing with phishing attacks on web hosts.

It would function in the same way - if Chrome detects CC/password forms, it labels the site as Not Secure.

</comment><comment><AUTHOR> I know the article is older, but it's January 2017, just a reminde. The message will appear in the address bar.

</comment><comment><USER43> Not a Chrome user, but this is a great feature, and is at least moving things in the right direction. Really they should go farther though. The UI treatment is almost un-noticable, even if they went with the "red triangle" version. How about a red-background interstitial page or a modal with a clear "Get Me Out Of Here" and "I Know What I'm Doing" choice for the user?

And for all those "small businesses" that are going to get affected by this? It's hard to muster up much sympathy at this point. It's 2017, and you're still horsing around with vanilla http?

</comment><comment><USER29> I'm going to go ahead and make another shameless plug, since a lot of folks who are hesitant about this new HTTPS stack are worried about deployment, and thats for the fantastic folks over at Caddy. They make an Apache/Nginx alternative that has built in letsencrypt renewal support and automatically encrypts your site by default and serves over https/2.

[https://caddyserver.com/](https://caddyserver.com/)

I am not an affiliated developer, but I am a user, and have recommended this to others as well, its a solid product.

</comment><comment><USER44> How does it handle password inputs that are added to the page with JS?

<comment><USER45> Maybe we can make it blink by adding and removing the password field

</comment></comment><comment><USER46> I'd go a leap further and change the background color of the address bar to red if it's a non-HTTPS page. No excuse for any site to be HTTP in 2017, especially with LetsEncrypt. Your host doesn't allow LetsEncrypt? They need to get with the times, or you need to switch hosts. (Why would you want to use a host that doesn't see the value of HTTPS?)

<comment><USER47> As stated in the article, that is in fact the long term goal for treatment of the Google Chrome address bar.

</comment></comment><comment><USER48> I'm in an A/B test group where all pages are marked either green 'Secure' or red 'Not Secure', password or not.

I like it.

</comment><comment><USER49> I hope me trying to push this on G+ and Twitter for years helped.

This was always my first install on a new Chrome.

[https://chrome.google.com/webstore/detail/unsecure-login- not...](https://chrome.google.com/webstore/detail/unsecure-login- notifier/ledomejmbiemgdfiekmhoheabhonihmi)

</comment><comment><USER50> Will this also apply to data URIs? Thinking of the recent data URI phishing exploits [1]

[1]: [https://www.wordfence.com/blog/2017/01/gmail-phishing- data-u...](https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/)

</comment><comment><USER51> Working on a new community site to help people move to HTTPS: [https://blog.movingtohttps.com/dedicated-to-simplifying- the-...](https://blog.movingtohttps.com/dedicated-to-simplifying-the-move- from-http-to-https-97d80b08e4dd)

</comment><comment><USER52> It's great that Google wants to move more sites to https, and I'm in support of this, but it also creates challenges for security vendors such as myself.

Currently DNSFilter and others Man in the Middle traffic destined for sites our customers have decided to block. This works great for http, but not https, as certificate warnings are presented.

The standard work around is arguably less secure: adding a third-party CA to all end-points. This can still present problems with HSTS and certificate pinning.

I'd like to work with Google to create a standard where vendors can either be on a whitelist or have new recognized SSL cert fields, not to MITM traffic, but just to present users with a friendlier message explaining whats happening, and providing a separate [https://](https://) url to visit for information from the vendor about the block.

Implementing such a standard in browsers would further increase user security, and provide a viable method for filtering on guest networks where there is no end-point access.

<comment><USER53> Removing insecure HTTP altogether is the road Google is taking. That should make this a non-issue.

<comment><USER54> How does removing HTTP solve the issue presented:

When actively interrupting an HTTPS connection as a network element, there is no way to provide information to the user about the reason for the interruption or steps the user could take to prevent the interruption.

This can be done with HTTP, where a filtering proxy could show a page 'our software thinks this page violates company policies, but click here to override or contact IT to fix', or see also captive portals.

Maybe the right answer is simply there's no reasonable way to handle this use case in a secure manner, but taking away an established use is a real issue.

</comment></comment></comment><comment><USER55> What happens if the page is insecure, but the attacker places an iframe in the page with HTTPS url, which then tricks the user into sending their credentials (unsuspecting users will think they are logging into the site).

<comment><USER56> I'm not sure that really fit what is changing here... If the forum is submitted it's going over https even if the iframe is on an http page. If an attacker has the ability to add code (iframe or other) to your site you've already lost.

<comment><USER55> that's exactly my point. I am hoping/assuming chrome would notify the user about this as well.

<comment><USER56> Why? IIRC cross-origin will prevent the http page from reaching into the https iframe and furthermore the password is being sent over https so google doesn't really care.

<comment><USER55> But since top lev is insecure, an attacker could inject a legit looking form whose destination is set to steal passwords.

<comment><USER56> I guess it depends on the attack this is supposed to stop. This change does prevent sniffing of passwords and protects them while in transit but no, it doesn't prevent MitM attacks. That said google plans on marking all HTTP pages as "Non-Secure" in the not-too-distant future which will help warn against the potential for MitM.

</comment></comment></comment></comment></comment></comment><comment><USER57> What about services like Sellfy that let you add a button to your site's pages, that loads a shopping iframe? Will it change the indicator when the iframe appears after a user clicks the Buy button?

</comment><comment><USER58> Ultimately, how is this plan by Google going to affect sites that are hosted on a virtual server hosting plan?

For instance, I have a website hosted at Hurricane Electric on a virtual server plan. I've had hosting there for well over a decade. I like their service, the virtual host works well for most of my needs. There are two areas where it doesn't work, though (AFAIK):

1\. I can't run a pure NodeJS website.

2\. I can't set up HTTPS.

Number one isn't relevant to this discussion; but as far as I know, the second one is a big deal. There isn't any way (AFAIK) to host multiple virtual servers each with their own certificate.

So right now (well, with the release of v56 of Chrome) - if you have a Wordpress site or something on a virtual host that has a login - it's going to show something that says "unsecure" for the login/password form. Honestly, I am fine with that. My own site isn't a Wordpress site, but I do have a login/password box on the site, and having it show that it is insecure is not a big deal to me. While there isn't much or anything I can do about it, I do understand and support the reasoning.

But...

...in the future, they want to mark -all- non-HTTPS sites as "insecure" \- regardless of what the site does, presumably. It could just be a collection of static html pages (no javascript, no forms, nothing special), and it will still be marked as "insecure"? Does this sound reasonable? Suddenly, all of these pages will be deemed pariahs and non-trusted because they choose to use non-encrypted means of presentation?

Is there any solution to this, as it stands? Or are all of us with virtual hosting solutions going to have to migrate to some cloud-based server solution, with it's own IP, then obtain our own certificate (easier today, I know - and cheap to free, too) - just to get around this? Is this the end of virtual private server hosting (or is it going to be relegated to third-tier)?

I don't currently know what if anything Hurricane Electric plans to do regarding these changes. I don't want to move to another hosting provider if I can avoid it (while HE isn't the cheapest for what you get, they are nice in that they assume you know wtf you are doing - your hosting is basically access to the server via ssh and sftp - so you better know how to admin and set things up via a shell, because they aren't going to hold your hand).

I'm thinking I should send an email to them to ask them what they're planning to do - if anything.

<comment><USER59> If you are talking about this service: [http://he.net/web_hosting.html](http://he.net/web_hosting.html), then it's supported SSL since 2013, at least, with a simple admin panel to set it up... If it's an actual VPS, then SSL is fully on you, and trivial to set up with common stacks and LE.

</comment></comment><comment><USER60> It should just label HTTP pages as "not secure", full stop. Because they aren't secure. Or at least, any page with a form. Never mind if it's a password field or not.

<comment><USER61> ^ 100% agree. I think just marking HTTP pages with password fields as Not Secure would make HTTP pages without passwords fields appear to be secure. This is obviously not the case---they are just as insecure because you are sending your session cookie which is equivalent to your password---so all pages should be marked Not Secure.

<comment><USER62> Plenty of websites think they only have to secure app.example.com, while www.example.com can be left uncovered even though it serves www.example.com/login, because /login POSTs to the app. subdomain, and the session cookie is only set _by_ and _for_ the app. subdomain.

From a naive perspective, all requests passing private information are protected in such a scenario. But, of course, since the www. subdomain is uncovered, it can be MITMed and replaced with a phishing site. (A.K.A. a "spear-phishing" attack.)

This change somewhat fixes that scenario: the developer can no longer keep the /login route on the insecure www. subdomain; they'll have to serve that page securely (either by making www. secure, or, more likely—because it's lazier—just moving /login to the app. subdomain.)

Even though www. can still be MITMed to replace it with a phishing subdomain, that subdomain can no longer serve a login form itself. It would have to link to a "real" phishing FQDN (one the attacker controls enough to get a TLS cert for), at which point that domain can just be found and blacklisted by the browser vendors.

In a sense, it forces the attacker into the open, where the attacker themselves can be caught/blocked, rather than simply their _attack_ being caught/blocked. (In other words, it forces MITM attackers into a situation more akin to current botnet malware-writers, where they must put up C&C infrastructure which can be traced back to them.)

Of course, this isn't nearly as good as just securing the www. subdomain; and it will force much more work (likely, doing said securing) on those who want to embed a login form directly on their www. subdomain's landing page. But, in the interim while we work on universalizing TLS, it _will_ drastically decrease the _value_ of spear-phishing attacks, just as spam filters drastically decrease the value of unsolicited bulk email ad campaigns.

</comment></comment></comment><comment><USER63> What if the <form> submits to an https page but the page is served up on an http page? The form submission will be secure, correct? Will Chrome still mark as insecure?

<comment><USER64> The form submission is only half the issue. If the http page gets compromised the malicious party could simply read the contents of the password input.

<comment><USER63> thanks

</comment></comment></comment><comment><USER65> Needs to start blocking form fields that have no corresponding input text box because...these unused fields still get autofilled with cached but personalized info.

</comment><comment><USER66> Do they send a letsencrypt notice to these domains ? notifying users is awesome, helping "late" hosts into HTTPS would be perfection.

</comment><comment><USER67> Insecure websites could get around this by not marking the fields as password fields but using javascript to make them appear so to the user.

</comment><comment><USER68> I think the title must be "Chrome 56 will mark non-HTTPS pages with password fields as non-secure"

</comment><comment><USER69> So if we have an http page with a password field that posts via https, it will be marked non-secure?

<comment><USER70> Yes, because it is insecure.

</comment></comment><comment><USER71> I'd like to see this with Adobe Flash and third party scripts. (Pandora!)

</comment><comment><USER72> About time, this is an excellent feature.

</comment><comment><USER73> Advancing HTTPS is one of a few good things Google made in the recent years. Thanks Google.

<comment><USER61> It's one of the few things they do that I can't find a reason they would be financially motivated to do so, other than increase developers' opinions about the company as a whole, which is a good thing for all.

<comment><USER74> google competes with the likes verizon, comcast and at&t, and the data google gathers on you is very valuable. why would they want to share that data with the line operators for free?

sorry to say, but https is not an altruistic move by google.

<comment><USER75> This is ascribing an absurd level of Machiavellian intent to Google. Why can't people just accept that occasionally, Google engineers do stuff that isn't profitable to the parent company?

<comment><USER76> Just speculating, but I think Google is at such a huge scale whenever the internet wins Google wins. That's why they're trying to improve internet access with Project Loon and WiFi in Indian railway stations.

If privacy improves that will benefit the internet (privacy has real costs that don't involve state actors like hackers, etc). Many people, especially in developing countries, are afraid of transactions over the internet and use cash on delivery.

</comment></comment></comment></comment></comment><comment><USER77> Thank God

</comment><comment><USER3> > A substantial portion of web traffic has transitioned to HTTPS so far, and > HTTPS usage is consistently increasing. We recently hit a milestone with > more than half of Chrome desktop page loads now served over HTTPS

Well OBVIOUSLY when the traffic is increasingly going to the same top ten sites like Faceboo, Twitter and Co.

</comment><comment><USER78> This is such a dumb idea on google's part (and mozilla's) because people are now going to program dumb workarounds for this.

Google seriously has to stop trying to police the god damn web.

<comment><USER79> With free ways to encrypt web coming out, you really have no excuse to not use https for login forms. People should be informed.

<comment><USER78> This is not the right way to educate people. This is a sort of like shaming someone in to doing something. Many small companies are going have an impact thanks to this.

There are many companies I have personally witnessed that use a direct IP to access web based solutions to their inhouse software, how are these people supposed to get a ssl cert.

We need to educate people, not shame them in to doing the things big google wants from them.

<comment><USER37> >Many small companies are going have an impact thanks to this.

if those small companies aren't offering secure logins to their users, they should be impacted. that's the whole point. You shouldn't get to risk your user's security just be being small. Implementing SSL is not difficult or expensive, and the prevelance of password re-use means that a small company with an unsecured login is causing a risk all around the net.

we've been educating people about SSL for years. if they haven't figured it out yet, it's time to start shaming them.

</comment></comment></comment></comment><comment><USER80> "Thanks, Captain Obvious!"

Is there an option to turn this off, for those of us who feel we need it like a hole in the head?</comment>


Who is using VB.NET? What are they using it for? - <AUTHOR> At the time Microsoft announced the .NET platform, I made my living as a VB6 and ASP/IIS developer. I put a small amount of energy into looking at VB.NET, but it was VB in name alone. Ultimately this was the push I needed to switch to the F/OSS team and I became a Ruby developer just in time for Rails to come out. I was - and am - very happy about this change.
Over the past few years, I've spent time working in Unity, which means I've accidentally become quite proficient in C#. And you know, I don't love it but it's not so bad once you're moving.
However, at no point did I ever consider going back to VB.NET. If you'd asked me before a few weeks ago, I honestly believed that it had been consigned to the annals of nerd trivia.
It came as a huge shock to see that VB.NET is apparently more popular than C#, which seems to be used for all manner of things:
https://www.tiobe.com/tiobe-index/ https://insights.stackoverflow.com/survey/2017#technology
One survey and I'd assume that TIOBE was being trolled. But this seems real.
However, I'm experiencing massive cognitive dissonance because I've never met a VB.NET developer, and while I've worked in web, mobile and game development circles for 25 years, I literally have no idea what you'd even use VB.NET for.
I've never seen a single article or mention on Hacker News or any of the other forums I read.
Is there a sort of progressive/conservative-esque perception bubble where there's a parallel universe using VB.NET for building the next Hooli?
It's really bothering me. :) <comment><USER2> When I was consulting we would usually run into VB.NET in businesses that were either small or didn't have career developers. One exception to that is a lot of financial services firms (even banks) seemed to use it a lot.

The types of problems I saw VB.net used to solve were usually data entry apps, call centers etc. A lot of the times these developers are what I called "tools based", because almost without exception the only way they knew how to get a database connect or a form component on the screen was to use Visual Studio to drag and drop it. I did run into a few VB.NET projects that were super professionally done and impressive but that was the exception. I don't fault the language overall, but I would never want to maintain it long term.

Funny part, one of the consultancies I started and ran for years focused on project rescues and our bread and butter was the Microsoft stack for a time. By percentage we were called for VB.NET projects in financial services firms above almost all other situations. To be fair, VB.NET wasn't the failure generally, poor project management, bad requirements and staffing almost always was the failure. Architecture and language choices were usually made by non-developers or at least non-career developers.

<comment><USER3> Agreed, I built a data entry program in VB.NET for an insurance company.

The WYSIWIG aspect of .NET WinForms and events meant I could build a very efficient data entry program (I miss that part a lot when developing for the web).

<comment><USER4> I still maintain an internal WinForms app in c#. Even with the very old (.net 1.0) code everywhere, lot's of spaghetti, inline sql (including the sql injection variety) etc, it's still our most maintainable application and I love getting the chance to work on it.

Most other apps we have, even the ones far simpler than this one, contain just as much spaghetti but distributed over 15 layers to the point where their incomprehensible.

In hindsight I'm not convinced replacing drag'n'drop coding with "architecture" was a good move.

</comment></comment></comment><comment><USER5> No one is using VB.NET to build the next Facebook or something. VB.NET is used heavily in the most boring of all domains - business side apps. Like, for example a small invoicing app for a mom and pop store made usually by students or some extra cash or by small scale consulting companies.

In India a whole lot of such apps, even for big grocery chains and banks are made in VB.NET. I made many of them when I was an undergraduate for some quick spending money.

> I've never seen a single article or mention on Hacker News or any of the > other forums I read.

You wouldn't. This is not a client side or flashy business where you can claim big innovation or some grand mission like changing the world. No one on a forum has the time to talk about the boring stuff.

</comment><comment><USER4> Early on in .net history VB was just as popular as c# if not more. There was a huge difference in skill set of the programmers for each though, the VB camp were mostly the drag'n'drop type of developer, essentially using VB.net like an access developer would. On the c# side were the "real programmers" that often had a background in java and c++, just look at any of the OSS software from the era and nearly all of it was in c#.

As frameworks churned away from tools amenable to drag'n'drop programming with MVC on the web side and XAML on the desktop the VB developers seem to have either moved to c# or dropped out of the industry, I occasionally talk to people that were programmers in the late 90's/early 2000's that left the industry and they are pretty much all VB programmers of one dialect or the other.

As for what it's being used for, it works just as well as c# everywhere that works, web desktop and mobile, there's no technical reason to avoid it (but a few less technical ones).

What I can't explain is it's recent resurgence. I haven't seen this in the boring business programming world, this is where VB thrived but from my experience it's all in c# or java these days. If I had to guess it would be tools like unity responsible for VB's second coming... or errors in tiobe methodology.

<comment><AUTHOR> Just to be clear, before I was the Ruby guy, I was the VB guy. I owned boxed copies of every version from 1.0 onwards - including VB Dos - and was even the Mining Company (later about.com) guide for VB.

I was one of the signatories of a petition by over 120 Microsoft MVPs that asked them to maintain a COM branch long enough to release a proper VB7 release that could serve as a viable transition pathway. They told us in no uncertain terms that we were farting into a hurricane.

There were initially more VB.NET developers - more of _us_ \- than C# developers only because there were millions of casual VB6 developers that had a massive investment in the tools. It's my position that they really fucked up by telling us that our only choice was to get with the program. At least in my case, it was not. I left the VB world and started the first Rails consultancy in the world in fall 2004. This proved to be a rather excellent move.

I'm curious about your comment about how all OSS software from the 2002 era was VB.NET. I could be missing something, but... what? :) Do you have any good examples?

</comment></comment><comment><USER3> The company I used to work for (big, multibillion-dollar insurance company) had a lot of VB.NET projects (and C# projects, and Java projects, and anything you might care to think about).

In particular, the manager at the branch I worked in had settled on VB.NET because he thought it would be an easier transition for the old VB6 developers he had.

And it's not bad, I loved not having to worry about case sensitivity and stupid brackets and semicolons, but that's only syntactic sugar.

I'm now back to C# for the last few years and I noticed no significant difference, other than more resources on the web.

</comment><comment><USER6> My previous gig they were using it for some machine learning algos. I think it was just because that was what the programmers were familiar with and liked using. I found it a bit annoying to maintain being from a C# background, but that's just because it is a productivity hit with the weird syntax around the later C# features like generics.

<comment><USER3> I actually liked the syntax for generics a lot more (and BASIC syntax in general over C syntax).

But C-style syntax has won over the world.

</comment></comment><comment><USER7> I'm currently employed by a company to make custom add-ons for Sage 200 (the accounting software).

Sage 200 is written in C#, but has SDKs for both VB.NET and C#. My boss has only really used VB.NET, so that's what we're using.</comment>