Ask HN: 6 Startup Founders, What To Do About Equity - <AUTHOR>

I am part of a new startup that was built out of Start Up Weekend. Startup Weekend is pretty much a weekend sprint of software development. The group of 6 is continuing with the company. This has brought up the question: How should we divide equity. My question to HN is what are the consequences of equity division (Further investment, Member moral, etc.); from having 6 equal owners to one with 51% and the others with less. <comment><USER2> Err on the side of equality. More important than the split is to have vesting with a cliff, because given the circumstances, some are likely to leave in the first year.

<comment><USER3> Given the circumstances, I wouldn't be surprised if some people leave within a _week_ , never mind a _year_ \-- but this makes me wonder: Why is a vesting cliff necessary? Someone who leaves after 2 weeks hasn't made much of a contribution, but it seems entirely plausible (to me, at least) that they've made 1/26th of the contribution of someone who leaves after 1 year.

<comment><USER4> I think the practical reason is that it's a drag having to keep them on the books/in the loop/contact for years.

As for the contribution, is it only 1/26th as difficult to run one mile compared with 26 miles?

<comment><USER5> Or to put it another way: Every week you become a more valuable part of the team as you learn about your niche and solution and as you build a product and relationships.

</comment></comment></comment></comment><comment><USER6> a) make sure there's a cliff b) define roles and responsibilities. the cto should have final call on tech matters, business on biz dev,etc. c) clearly designate someone to be a final call/leader type person. they should also have the board seat.

Equal equity is fine. It's the voting/power/decision making that comes with it. You'll end up with a startup bureaucracy where every decision needs to go through a 6 person committee. You will lose one of the ultimate attributes of a startup: speed

Personally, I'd also be asking yourself how you ended up with 6 founders and if all of them are "founders". Yourself included.

</comment><comment><USER7> what's wrong with dividing by 6 equally?

any sort of unequal distribution will mess with moral and effort

<comment><USER8> Dividing unequally != Unequal Distribution.

If some members are contributing much more (in terms of effort, time, cash) then dividing by 6 equally will also mess with morale and effort. This touches in to pg's point about cliffs (which I understand means when you leave, your equity leaves too) and jasonlbaptiste's point about clear roles and responsibilities.

If responsibilities are equal, so too should equity. It's possible to not define equity at this stage so that it can be fairly allocated at a future point based on actual contribution, but that can be messy and time-consuming, which again takes away from speed.</comment></comment>


Ask HN: Why hasn't Edward Snowden been captured yet? - <AUTHOR> If the FBI CIA and NSA is so powerful how come they can't just snatch him up and bring to the US for the crime he allegedly committed? <comment><USER2> I'd say diplomacy. Russia is a powerful nation with an at least reasonably proficient secret service (the FSB might not be the match for the CIA the KGB used to be but I suppose they still know how to do their job). So, if they did try capturing him things might get messy and unlike the affairs of less powerful nations the CIA is involved in, in this case this might have serious repercussions.

Besides, what does the US stand to gain from capturing Snowden other than making an example of him? He's no immediate threat to any operations or to national security.

</comment><comment><USER3> He is in Russia? What do you expect the FBI to do, kidnap him and smuggle him out of a country they have no jurisdiction in? Better question is why did the State Department cancel his passport on his way to Moscow knowing very well that he still could hold the key to an encrypted trove of highly sensitive documents

</comment><comment><USER4> They could if they wanted to. Do they want to? If they get him to the U.S., they'd _have to_ deal with him.

I don't think they want to get him because it'd dramatically limit their options and possibly set a precedent with far-reaching consequences (is he a traitor? is he a hero? what does it mean to be either? is the public ready? how well would a pardon be received? if they pardon him, who else would they have to pardon? what does it mean to leak sensitive information? what does that mean for cases of espionage?)

Why address the elephant in the room when you shouldn't have brought an elephant in the room in the first place? Just let the elephant where he is.

</comment><comment><USER5> Personally, I have been wondering is the cozy relationship between Trump and Putin signals danger for Snowden. I could totally see Snowden being handed over as a gesture.</comment>


Tell HN: Ann Arbor-Detroit HN Group - <AUTHOR>

Just an email list for now. Hopefully, it will serve as a useful resource for startup news/questions and potential meetups (May?).<p>Join us: http://groups.google.com/group/hn-ann-arbor-detroit <comment><USER2> Great, also look into a2geeks for more local meetups: <http://a2geeks.org/display/geek/Groups>

One group of particular interest to people here might be <http://www.a2newtech.org/> (monthly meetups with presentations of new startups and startup ideas).

</comment><comment><USER3> Awesome. Be sure to checkout <http://startupdigest.com>, Michigan edition. I am a curator.

BTW, I am in Bham too.

</comment><comment><USER4> Also, stop by the Tech Brewery for Beer:30 (every) Friday at 4:30 pm - <http://techbrewery.org>

And in May, don't miss <http://leanstartupmi.com> with Eric Ries, Dan Martell, Brant Cooper, and a bunch of Valley/Michigan investors and founders (including 2 YC companies) presenting. It's going to rock!

</comment><comment><USER3> You should all come out to Funded By Night as well. <http://fundedbynight.com> \-- tickets are just $10 for students and if you aren't a student just use the code "HN" and I'll get you the student discount.

Micah Baldwin (Graphicly) & Noah Kagan (AppSumo) will be speaking there...

</comment><comment><USER5> If you live outstate there's Hackers and Hustlers in East Lansing which meets this Wednesday. Theres also a Hackers and Hustlers chapter that has formed in Kalamazoo. Best place for information is on their page on Facebook. Some interesting discussions going on there.

</comment><comment><USER6> Figure this is as good a place as any to ask - I'm a graduating U of M senior looking for a developer partner this summer for a few ventures. Let me know if anyone around Ann Arbor is interested!

<comment><USER7> I feel like we've talked...your name seems familiar. If you're still looking for someone next term, hit me up (I'm otherwise occupied this summer).

</comment></comment><comment><USER8> Also be sure to check out Coffee House Coders, there are several locations now, <http://coffeehousecoders.org/></comment>


Linux 2.8.0? - <AUTHOR> http://thread.gmane.org/gmane.linux.kernel.mm/63589

<comment><USER2> My two cents are that switching to a date-based version system would be the wrong move.

Linux has not been extraordinarily successful at penetrating the desktop market. Where a lot of Linux lives is in the datacenter or the server farm. And if I'm a corporate IT drone, I want to know what is a major, disruptive upgrade and what is a minor upgrade. If you give such a person a CD labeled 2.8.0, it will be viewed with much more suspicion than one labeled 2.6.40, and rightly so. If you give one labeled 3.0, it will be filed in the dustbin until those zeros have become twos. Nobody's going to deploy a dot zero in a production environment.

Thus, giving the kernel what appears to be a big version bump for what is effectively a minor upgrade is going to freak out a lot of IT guys for no good reason. I remember IT shops which still ran 2.4 back in 2005ish because 2.6 was still 'too new'.

(Whether this attitude is legitimate or not is another question entirely).

<comment><USER3> There are two categories of people - those who are sophisticated enough to know that linux kernels these days are all fairly mature, and, what the .stable branch is, and those who aren't and use the kernel supplied by their Linux Distributor, and will, of course, be coddled with an appropriately safe version brand. RHEL 6, Ubuntu 11.04, etc...

Neither of those groups will be negatively impacted by setting the kernel version to 2.8 (or 3.0)

<comment><USER4> Exactly. Most decent admins will be watching these lists and know the reasoning behind this decision.

</comment></comment></comment><comment><USER5> > so that I can avoid having to make the -rc1 release from Japan using my slow > laptop

Linus can't just shell into a faster machine somewhere?

<comment><USER6> Exactly my thoughts!

Edit: Given the lack of visible points a comment is needed to signal to others that others do agree with the comment. How would you like me to phrase it?

<comment><USER7> We would like you to phrase it by abandoning the idea that "me-too" comments are somehow suddenly appropriate.

</comment></comment></comment><comment><USER8> > _but when the voices tell me to do things, I listen._

Either deeply terrifying or words to live by. I can't decide.

<comment><USER9> That's Linus' sense of humour showing through. If you like, you could see it as him listening to his wizardly maker's intuition.

</comment></comment><comment><AUTHOR> There's also an article on Phoronix -> [http://www.phoronix.com/scan.php?page=news_item&px=OTQ3N...](http://www.phoronix.com/scan.php?page=news_item&px=OTQ3NQ)

</comment><comment><USER10> Linus should just drop the 2.6 prefix and go with "Linux 40" (like Solaris 10 is SunOS 5.10). Then the stable kernel releases can be "Linux 40.x".

<comment><USER11> Then he couldn't do an major redesign of the kernel interface and signal it in the version id.

</comment></comment><comment><USER12> Unthreaded view: <http://comments.gmane.org/gmane.linux.kernel.mm/63589>

</comment><comment><USER13> It sounds like he is toying with 3.0 in the comments later on.

</comment><comment><USER14> So 2.8.0 is not really going to be a feature release? Seems strange.

<comment><USER15> If you're familiar with kernel releases it seems pretty normal to me. There have been some really major features merged in normal 2.6.x releases. I think they gave up long ago on trying to decide when a feature is cool and/or big enough to constitute a big version bump. It seems likely that they would increment it just to mix things up, not because of features.

Though my personal preference eliminates the dots all together (except for post-facto stable release (e.g. 220.127.116.11)), so the kernel released next would be kernel 3, the kernel released 3 mo later would be 4, and so on.</comment></comment>


Texas Conservatives Win Curriculum Change (losers include Darwin, secularists..) - <AUTHOR> http://www.nytimes.com/2010/03/13/education/13texas.html

<comment><AUTHOR> Thomas Jefferson is also one of the losers. He has been "removed a list of figures whose writings inspired revolutions in the late 18th century and 19th century" and the article says "Jefferson is not well liked among conservatives on the board because he coined the term separation between church and state.) "

That wasn't surprising, but one new thing I learned is that some conservatives believe that "capitalism" has negative connotations

"They also replaced the word capitalism throughout their texts with the free- enterprise system.

"Let's face it, capitalism does have a negative connotation, said one conservative member, Terri Leo. You know, 'capitalist pig!' "

<comment><USER2> Well, capitalism includes crony capitalism and many would say corporatism (e.g. Italian fascism (the economic part)).

If you say "free-enterprise system" you make it pretty clear what you're talking about, e.g. not someone who goes to the state capital or D.C. for an earmark or law that puts his competition at a disadvantage. Adam Smith had more than a little to say about this.</comment></comment>


A brief history of CPAN - <AUTHOR> http://cpan.io/ref/history.html <comment><USER2> A point for non-Perl folks looking at this on HN: While the use of a minor version number might suggest to you that Perl 5.20 is just a bugfix/update from Perl 5.6, that's very much not the case -- in most other language cultures it'd be several major version numbers on and be seen as a vast improvement over the earlier release.

The problem for this is that the name "Perl 6" was reserved a long time ago for what has become essentially a different language -- bearing about as close a relationship to Perl 5.x as C++ bears to C. So Perl is stuck with minor version number increments, from 5.6 (which IMO should have been Perl 6) to 5.20 (which equally well might be called Perl 20).

<comment><USER3> _> which equally well might be called Perl 20_

That was my thought, too -- they should just do what Java did and drop off the "major" version number altogether. In 2014 it confuses more people than it helps.

<comment><USER2> I believe there is just one obstacle to doing that: Larry.

(Perl isn't the product of a corporate culture: it's a labour of love. Unfortunately this can result in some quirky ego-related side effects.)

<comment><USER4> I don't think it's fair to lay all the blame for any current blockage on Larry. I think the same issues that apply with just using Perl 7 as the name of the next version apply to just using the secondary version number.

It also ignores the validity of the underlying assumption of this line of reasoning, that Perl would be more popular and more used if only the version number was 7.3 or something else that suggested change. I think there's enough holes to be addressed in that argument that making changes based on it is really just flailing in the dark, twiddling bits hoping for a better outcome.

<comment><USER2> It's not that Perl would be more popular and used if only the version number changed -- it's that the not-obviously-iterating version number fools people who don't look closely at it into thinking the language is moribund.

(This problem was a major topic of coffee stand discussion at YAPC::NA this July ...)

<comment><USER4> I have have a feeling it's been a major topic of discussion at quite a few YAPC::NA's that past few years. It was in at YAPC::NA in 2013.

My question is, _what_ people is it fooling?

If the person is unfamiliar with Perl, 5.20 isn't going to mean anything to them, since they have no reference. If the person is familiar with Perl and remembers something about the version they used, 5.20 is different than any version number they remember, so denotes some change they may choose to look into. If the person is familiar with Perl and doesn't remember the version they used or hasn't heard from any other possible source there's been same major changes, then a major version number change may attract their attention, but will it do so any more than the numerous announcements about major changes with versions that are announced? I'm not certain, and even if it does, is catering to this small subset of people worth it? I'm even less certain.

If the language is to grow, it needs new blood, not just to draw back expatriates. I think the name argument is just a red-herring drawing people away from action that could actually be of use (IMHO, virtually any other action).

</comment></comment></comment></comment></comment></comment><comment><USER5> Having to fight with the node.js package-space just increased my appreciation for CPAN, its content and users. Perl might never had much luster and got slightly outpaced by other scripting languages within the last few years, but it's got a _very_ solid foundation, unlike e.g. Tcl.

Managing projects with perlbrew and carton is pretty convenient, and you're free to choose between old-style modular development or various object systems, both lite and heavy, with syntactic sugar or not (recent discovery: Moops).

<comment><USER6> What is 'unsolid' about Tcl? I'll take its source code any day over Perl's.

<comment><USER7> I've worked pretty heavily in both. I don't think Tcl is clearly superior, as a language, to Perl. And, certainly the CPAN is vastly more impressive and vital than the ecosystem around Tcl. One of the reasons I gave up on Tcl was because there just weren't enough people working in it to keep the libraries moving forward (and our website, built on OpenACS, was suffering for it).

So, since we're talking about CPAN, I'd say that the library and development ecosystem around Tcl is "unsolid" where for Perl it is pretty impressive. It's only relatively recently that Python and Ruby have reached parity with CPAN, even.

<comment><USER6> > Perl might never had much luster and got slightly outpaced by other > scripting languages within the last few years, but it's got a very solid > foundation, unlike e.g. Tcl.

Was the phrase, though. I don't think anyone really questions whether CPAN is better than what Tcl had, and you can debate what you like about both languages, but to call Tcl unsolid is not very accurate, in my opinion.

<comment><USER7> I assumed what he meant by "the foundation" was the libraries and culture, which Perl demonstrably has gotten pretty right, while Tcl hasn't. If the foundation is everything you build your projects on top of, then Perl has a vastly better foundation. If the foundation is _just_ the language itself, then Tcl is pretty good.

So, I see where you're coming from if speaking only of the language itself. Tcl is a quite nice, well-thought-out, language. It has a few quirks, but so does Perl.

<comment><USER5> Yes, that's what I intended to say. Maybe "foundation _s_ " would've been clearer.

The first two of which would probably be the language design itself and the implementation. I'd rather not argue about the former, and regarding the latter I don't have a lot of experience with Perl, although I've heard that it's gotten better once they awoke out of the post-Perl6 slump. Still, Tcl was always pretty great in that regard.

But as we're talking about the CPAN here, a lot of the alternatives come out short-handed, and Tcl amongst them. I remember the days when you had a different interpreter for every extension...

</comment></comment></comment></comment></comment></comment><comment><USER8> Many thanks to the Perl community for CPAN! Having an easy to access repository of reusable libraries has given us more power to develop cool stuff than any specific language features. That's why nowadays every important programming language has some sort of CPAN clone.

<comment><USER9> Hopefully some day they can expand to support all the functionality added onto CPAN, like PAUSE, cpantesters, BackPAN, CPANTS, Test::*, TAP, CPANPLUS, local::lib, cpancover, cpanratings, cpanminus, Perlbrew, Carton, Pinto, minicpan, Metacpan, CPAN RT, AnnoCPAN, etc. You can go right now and find the test results of building whatever module you want on whatever perl you want on whatever platform you want, find ratings and user comments, and see general quality ratings of a module distribution's construction.

The only problem I have with CPAN is its lack of a past. You can't just re- download some module from CPAN you had installed a year ago, because it got removed from CPAN and now it's on BackPAN, so now you have to cobble together some scripts to download all the correct dependencies from BackPAN, and use Perlbrew to get the right perl version + core, and use Pinto to maintain your archive of old modules for the branch/release of your application that it matches. Maybe this is a problem that every language's library repositories have, but it's annoying that there isn't a CPAN standard for "install only the dependencies of module X at the time Module X was released".

<comment><USER10> `cpanminus` should install from BackPAN automatically if you ask for an explicitly older version. `cpanfile` and Carton do a fairly decent (IME YMMV) job of locking versions.

<comment><USER9> Indeed, and Pinto uses cpanminus. Carton, however, does not work well with mod_perl type systems, since you have to 'carton exec' your apps.

The whole thing is still a mess, though. For example, some dists never got put into CPAN at all; they were either one-off releases or were shipped in a Linux distro or a perl core at some time or another and then re-versioned for CPAN. So when you try to find the source via cpanminus, you can't, because it literally doesn't exist. So you can either upgrade or downgrade and face whatever incompatibility that means, or use perlbrew and maintain your entire perl stack for every app you ship. Unfortunately it turns out Pinto has a slew of bugs that require you skip all errors (ick). Let's face it, versioning and releases in Perl modules is a goddamn wilderness.

</comment></comment></comment></comment><comment><USER11> Something missing from the history is the existence of the "categorical tree" for CPAN modules, the existence of "registered modules", and the recent destruction of both of these features, primarily due to lack of people maintaining CPAN ( Brian D Foy got overloaded ).

The interface doesn't show any difference currently between modules that were just thrown up willy nilly and those that went through community discussion and review.

It could be useful to mention some of the various binary distribution systems in existence pulling from CPAN ( such as Activestate )

One of the sources for some of the information is very interesting though: [http://history.perl.org/PerlTimeline.html](http://history.perl.org/PerlTimeline.html)

</comment><comment><USER12> Python needs something like CPAN. Python has Cheese Shop (now called PyPi). It's just a link farm; it doesn't host the modules. Nor does it have any useful curation. So there's no quality control, and no way to fix anything short of forking a new version.

That's the big advantage of CPAN. CPAN is the de facto owner of the modules in CPAN, and those modules can be maintained.

<comment><USER13> > That's the big advantage of CPAN. CPAN is the de facto owner of the modules > in CPAN, and those modules can be maintained.

This is just false. The CPAN maintainers (really PAUSE maintainers) can transfer ownership of modules away from totally AWOL owners, but it's not like this happens all the time.

There's plenty of bitrot on CPAN because the original owner went AWOL and no one else has been motivated enough to ask to take the module over. There is no "CPAN group" who maintains modules.

<comment><USER12> No, but at PyPi, nothing gets maintained, just replaced. There are about five modules for parsing RFC3339/ISO8601 dates (the format that appears in every email) and they're all broken, but in different ways.

</comment></comment></comment><comment><USER14> The link to 'PAUSE history' requires a login.

<comment><USER15> [http://pause.perl.org/pause/query?ACTION=pause_06history](http://pause.perl.org/pause/query?ACTION=pause_06history)

Pull request on the way.

</comment></comment><comment><USER16> Url changed from [http://blogs.perl.org/users/neilb/2014/08/a-brief-history- of...](http://blogs.perl.org/users/neilb/2014/08/a-brief-history-of- cpan.html), which points to this.</comment>


How to setup and run 360 Feedback - <AUTHOR> https://grosum.com/blog.do?method=openBlogBody&id=How_to_setup_and_run_360_Feedback <comment><AUTHOR> Here is a detailed step by step guide on how to conduct a 360 Feedback, conduct analysis and move ahead.</comment>


$1 Million Question - Will Math Expert Accept Prize? - <AUTHOR> http://www.nytimes.com/2010/03/21/science/21award.html <comment><USER3> All they have to do is denounce those people that tried to steal Perelman's proof and claim it as partially their own.

Obviously he has a very strict standards for honesty, and will not accept anything from the mathematics community, unless he perceives them as honest.

I think mathematicians do not think they need to do anything because they think it is very clear by now who solved the Poincare conjecture and who did not, and there is no need to embarrass a very influential mathematician over the whole deal. But Perelman does not see it this way, and wants to be vindicated explicitly.

<comment><USER4> Go on...?

<comment><USER3> This explains the whole story:

[http://www.newyorker.com/archive/2006/08/28/060828fa_fact2?c...](http://www.newyorker.com/archive/2006/08/28/060828fa_fact2?currentPage=all)

Note that this has been strongly disputed by certain parties mentioned in the article that do not come off that well, but the New Yorker stands by the reporting and has not issued corrections.

<comment><USER5> _Perelman, by casually posting a proof on the Internet of one of the most famous problems in mathematics, was not just flouting academic convention but taking a considerable risk. If the proof was flawed, he would be publicly humiliated, and there would be no way to prevent another mathematician from fixing any errors and claiming victory._

This is both frightening and disappointing. I can hardly imagine how much advancement in the field is being held back by this attitude.

<comment> daniel-cussen They think of this math as the math they saw in high school, which is focused on accuracy. No such thing is true. At this level, mathematics is about insights and creativity. It's like writing a novel, posting it on the internet, and having someone else fix the typos and claim it as their own.

</comment></comment></comment></comment></comment><comment><USER6> There was an interesting BBC radio show that looked at this chap's achievements and 2006 win: [http://www.bbc.co.uk/radio4/science/thematerialworld_2006082...](http://www.bbc.co.uk/radio4/science/thematerialworld_20060824.shtml) (it's still listenable but is RealAudio, though VLC played it fine for me - <USER2> also just tested it through a US-based VPN and seemed to be OK unlike a lot of BBC content.)

I also recall seeing a Marcus du Sautoy documentary where he went to Russia to try and meet Grigori (without much success as I recall). I can't find a watchable version of that, though.

<comment><USER7> That du Sautoy documentary was lame and the bit where he goes to Russia was cringe worthy. du Sautoy must have known that Perelman would never see him. If Perelman turned down the Fields then appearing on TV was hardly going to excite him.

Ultimately that entire series was about du Sautoy going 'look at me, I'm clever'

<comment><USER8> Slightly off-topic but does anyone remember the name of that online maths teaching startup du Sautoy was involved with ?

<comment><USER9> <http://www.mangahigh.com/en_gb/about/>

</comment></comment></comment></comment><comment><USER10> Uh...math "expert"? Let's try a different word, NYT.

<comment><USER11> What is wrong with the word? He clearly is an expert in math. Is your objection that it's redundant?

<comment><USER12> I think he was looking for "mathematician".

<comment><USER13> Is there some reason to assume that all mathematicians are experts?

<comment><USER14> At least in the context of the headline, you can assume any mathematician being offered a $1m prize is likely to be an expert.

In wider usage, I guess you could say "Math expert" to distinguish between students and professionals, but it's still as clear as mud because it doesn't state which field of mathematics the person is an expert in.

</comment></comment></comment></comment></comment><comment><USER15> for those interested...

[http://en.wikipedia.org/wiki/Solution_of_the_Poincaré_conjec...](http://en.wikipedia.org/wiki/Solution_of_the_Poincaré_conjecture)

</comment><comment><USER16> <http://www.ljplus.ru/img/e/l/ellustrator/puankare3w.jpg>

==> take the millions and shove it up your asses.....</comment>


[Ask YC] Is jobs page for YCombinator startups only? - <AUTHOR>

would like to post the fact we're looking at hiring a Software Engineer here in Seattle:  http://www.emptyspaceads.com/about/jobs... but couldn't see a way of posting that on the jobs page.
i really love the HN community and would love to let people know about this opportunity.
thanks! <comment><USER2> I think the 'jobs' thing is kind of irritating in that you can't use the comments to ask questions or comment about the opportunity. Much better would be to let the job poster moderate comments so as to be able to exclude anything untoward... if that's the purpose of not having comments.

<comment><USER3> I can see both sides of the argument on this one.

You can always just email them if you have questions or comments.

</comment></comment><comment><USER4> YC just funded a startup that's posting startup jobs: <http://startuply.com/>

It might be worth a lookee.

</comment><comment><USER5> Yes, that jobs page is for YC startups only.</comment>


Microsoft sponsored conference brings out the Mac users - <AUTHOR> http://www.edibleapple.com/microsoft-sponsored-conference-brings-out-the-mac-users/

<comment><USER2> I think everyone would agree that Apple produces very good quality (if expensive) hardware and that a useable and productive terminal environment is the bread and butter of the dedicated programmer.

<comment><USER3> Except that these people are dedicated "tech journalists" (and thus are neither).

They were invited to this conference because they republish the constant press releases of all the Taiwanese and Korean companies as they churn out poorly- differentiated consumer electronics, many of which feature poorly-customized Microsoft mobile platforms.

</comment></comment><comment><USER4> Of course they could all be running windows on those macs!

WHO CARES!

<comment><USER5> Running Windows on a Mac is just wrong... I really miss the Windows-proof PowerPC Macs of yore ;-)

But... If they want to know where the world is going, they should really reach for those few who don't use their products. You can't predict the future just from looking into the mainstream.

<comment><USER6> I'm typing this on a MacBook Pro running Vista x64. It's a MBP because those are really powerful machines, but still have great battery life and are very compact and portable. It's running Vista x64 because I'm doing scientific computation that involves Windows-only software (mainly SolidWorks). It feels weird and a bit dirty, but I'm pretty sure there isn't another mobile hardware platform that can meet my needs as well as the MBP. I still boot into OS X when I'm doing something like watching a movie or if I'm "off the clock" and doing personal stuff with the machine. It constantly reminds me of just how big a difference there is between Windows and OS X in terms of everyday usability.

<comment><USER5> "involves Windows-only software".

Fine. You have an excuse. And you also use OSX when you ar nor working. That's a plus ;-)

My main computer is a Linux netbook, but I also have to run XP from time to time (inside a VM, obviously). My bank requires an ActiveX control for the business accounts.

I think it's incredibly ironic they found a way to require Windows for security reasons.</comment></comment></comment></comment>


Thirty Years Before SOPA, MPAA Feared the VCR - <AUTHOR> http://www.forbes.com/sites/joshbarro/2012/01/18/thirty-years-before-sopa-mpaa-feared-the-vcr/

<comment><USER2> Wow. "I say to you that the VCR is to the American film producer and the American public as the Boston strangler is to the woman home alone…"

I wonder if they hire script writers to pen these dramatic speeches.</comment>


A considered look at using Data Visualisation and Infographics - <AUTHOR> http://www.contrast.ie/blog/infographics-and-data-visualisations/ <comment><USER2> Excellent and very informative article. I would be interested in knowing what your tools of choice are for wireframing, charting and infographics?

<comment><AUTHOR> Omnigraffle, OmniGraphSketcher, Numbers, Pixelmator, and rarely Keynote.

<comment><USER2> Thanks. This is the first I've heard of OmniGraphSketcher and it looks like quite a flexible tool.

</comment></comment></comment><comment><USER3> All of Tufte's books should be included at the end.

<comment><USER4> If you like Tufte, I totally recommend Ben Fry's Thesis (Fry is the author of the very popular "Processing" language that lets you create some awesome visualizations). It is an incredibly easy read.

<http://benfry.com/phd/>

<comment><USER5> And if you like those, the mother-of-all-infoviz-books is Jacques Bertin's 1967 _Sémiologie Graphique_ , finally back in print in English translation after 25 years out.

about $50 on Amazon: <http://www.amazon.com/gp/product/1589482611/>

</comment></comment></comment><comment><USER6> I completely agree with the author, but I don't think it was taken far enough. The positive examples at the bottom are crawling out of whatever pit of hell the "184 milk jugs" came from, but meaningless colors, exuberant gradients, fading bars, big overlapping data points... these are all examples of chart junk as well.

My favorite information design mantra is that your design should be _exactly_ as exciting as your data. This probably takes it too far, but much like statistics it is so easy to lie with graphs that you're better off assuming you're lying accidentally.

<comment><AUTHOR> Hey tel, I wrote the article, thanks for your agreement, allow me to quickly explain myself.

The gradients served purely as a background to the image in the article. I wasn't suggest that every diagram ever should have a gradient backdrop.

Overlapping data points was a laziness of my behalf, I was just throwing these examples together in Omnigraffle. The colours in the Markov chain aren't meaningless, they are just out of context. (The idea came from a dash I designed where the app distinguished customers by colour type, so I followed that convention in the chain).

Most of all thanks for reading my article, and for your considered feedback.

Regards, Des (@destraynor)

<comment><USER6> Hey Des,

Sorry if my comment sounded overly critical — I'm sure you know well the frustration you can get from infographics, and simultaneously the urge to just have everything be somehow perfect, suddenly. I want to also mention that I appreciated bringing up the Victoria Secret graphics. Sometimes it is important to lie, much like humor being the best way to tell a sad story.

Anyway, thanks for writing the article. Despite my criticisms, I'm always happy to see more arguments to whittle away abject trust in garden variety infographics.

To round out my comment, I want to mention that I really appreciated the note that there is definitely a time for confusing, artistic infographics even if they are misleading. Victoria's Secret graphics can definitely raise awareness from 0 in a hostile crowd, they also can overemphasize detils to compensate for the audience's unwillingness to consider them meaningfully.

<comment><AUTHOR> Hey Tel, Thanks for your reply - no worries re: sounding critical. Your points were valid.

The Victorias Secret thing is something I keep reminding myself. Life is not about "usability" - the experience is more importantly.

Reminds me of a Joel Spolsky quote

"Usability is not everything.

If usability engineers designed a nightclub, it would be clean, quiet, brightly lit, with lots of places to sit down, plenty of bartenders, menus written in 18-point sans-serif, and easy-to-find bathrooms.

But nobody would be there. They would all be down the street at Coyote Ugly pouring beer on each other— - Joel Spolsky"

</comment></comment></comment></comment><comment><USER7> FYI, the link to the Cleveland article is broken. It should read

[https://secure.cs.uvic.ca/twiki/pub/Research/Chisel/Computat...](https://secure.cs.uvic.ca/twiki/pub/Research/Chisel/ComputationalAestheticsProject/cleveland.pdf)</comment>


Ask HN: I'm getting a new job that involves machine learning. How do I kick ass? - <AUTHOR>

Hi guys,
I've been a PHP web dev all my career and I got this new job that involves a whole lot of machine learning. They are using Java too which I'm very familiar but haven't done extensive programming in yet.
I want to kick ass at this job. I want to do great work and be proud of it instead of going home everyday feeling mediocre.
Please help me do good at my work. What advice/suggestions can you give me? Any help would be greatly appreciated. Thank you so much in advance! <comment> e-dard Hi, machine learning PhD here - one way you can start is by brushing up on some fundamentals. A book such as Machine Learning, by Thom M. Mitchell is a reasonable start.

Also, in terms of applying ML, you could scoot through Andrew Ng's Machine Learning Coursera course (not sure if it's running at the moment, though).

Finally... One tip – typically I have always found that when you want to start apply ML to real-world problemss, start simple and only iterate when the results of your approach are not _satisficing_. This is usually because all the bleeding edge ML research/techniques don't consider a shit-load of real- world issues, like scaleability, applicability to wide-range of problem, unstructured or noisy data and so on.

<comment><USER2> +1 for Tom Mitchell's book. Although it may appear a little outdated, it is an excellent introduction to ML. Highly recommend doing the exercises (in whatever language you'll be working, not necessarily in C), especially the Neural Nets face recognition one. The book doesn't cover SVM, so you might want to learn about those elsewhere. Also if you don't have a good background in basic applied stats (linear models, logistic regression, etc), I suggest you brush up on that as well.

</comment></comment><comment><USER3> I wonder how did they hire you when you had no prior experience? You're lucky. I also want such job.

<comment><USER4> Exactly what I would like to know too. I have been trying for a while now with not much luck, although I have picked up a decent amount of ML via self study.

</comment></comment><comment><USER5> How about checking the videos from the machine learning class on coursera by Andrew Ng?

<comment><AUTHOR> Will do. Thanks!

</comment></comment><comment><USER6> Not well known but there are some interesting videos on Videolectures <http://videolectures.net/site/search/?q=machine+learning>

</comment><comment><USER7> Hi. Congrats on your new job!

As far as advice/suggestions, please consider sharing a few more specifics, so the community may better understand where you're coming from.

<comment><AUTHOR> Thank you Toshio!

I'll be data mining about the usage of the millions of downloadable applications online.

<comment><USER8> I would advise you to get started with these books, which are practice- oriented (rather than theory-oriented such as the Mitchell book): <http://www.cs.waikato.ac.nz/ml/weka/book.html> with the Weka toolkit and/or <http://www.liaad.up.pt/~ltorgo/DataMiningWithR/> with the R language and/or or <http://shop.oreilly.com/product/9780596529321.do> with Python

As for the theory, someone made a nice review of 10 popular ML books here <http://zinkov.com/posts/2012-10-04-ml-book-reviews/> and <http://www.stat.cmu.edu/~larry/all-of-statistics/index.html> is a nice book on inferential statistics.</comment></comment></comment>


Show HN: How I created and promoted my first OS X app for $304 - <AUTHOR> http://novicenolonger.com/how-i-built-and-promoted-workburst-my-first-os-x-app/

<comment><USER2> Unless I'm missing something, shouldn't this be titled "How I paid someone $200 to make an OS X app for me"?

<comment><USER3> A very simple one at that, kinda tempted to drop into Xcode and pump out a free clone when I get out of work...</comment></comment>


Ask HN: What can we do about refugee crisis? - <AUTHOR>

Personally, I'd like to do anything to help ongoing refugee crisis in Europe by making use of my tech skills. But I couldn't come up with an idea yet. So I want to ask HN what I/we can do about it? <comment><USER2> I saw [http://refugeesonrails.org/](http://refugeesonrails.org/) which seems based on the local startup culture.</comment>


Ask HN: Alternatives to per hour pricing - <AUTHOR>

My friend(and really, its a friend and not me ;-)) has a web development consultancy. It's a relatively new company with recent college graduates as interns and a couple of friends the only employees. He's burnt his hand enough with the per hour payment model that he has followed till now for each project that he takes up. The estimates are generally wrong and the interns usually give enthusiastic and unrealistic estimates. He's looking for alternate strategies so that he can devote more time on development. What pricing strategies have worked/not worked for you? Can you suggest some other models that have worked for you?<p>Just to clarify this pricing strategy is for per project. Currently he gives an estimate in hours for each project and charges them the per hour rate. <comment><USER3> > _"It's a relatively new company with recent college graduates as interns"_

Making accurate estimates takes experience - and the only way to get it is to pay the dumb tax -- make your estimates, land the job, and complete the work. Of course a person can reduce the dumb tax by analyzing billing against the estimate and the more fine grained by task the estimate and time tracking are, the less dumb tax you will pay.

"Hourly not to exceed" is a model I have used in my work - which is not programming. Again breaking down the contracted fees into tasks helps because I can know if I am falling behind in the early stages and cap the blood loss. Of course, I have also used flat fee and straight hourly as well.

In my experience fee structure should be based in part on the client's needs not yours. A client who drops the spec on your desk can handle a flat fee. The person who is going to throw wrenches in the works, gets hourly.

Lastly, fee structure is a way of selecting the right clients at the right price. Hourly weeds out exploitive clients. Fixed fee allows "buying the job" when you need cash or when the client relationship is desirable.

<comment><USER4> Have to disagree here. Never ever use not to exceed pricing. This is the single most dangerous type of pricing.

If you do it faster you have no benefit and if you go over you really lose badly.

With fixed fee if you are under you make extra which balances the times that you are over.

When you first start out you must use time and materials (hourly). Report expenditures at least weekly or even more often, so the client always knows where he is at and can prioritize accordingly.

Once you figure out what you are doing and have a repeatable process you can do fixed fee

<comment><USER3> There's no reason to disagree. I wasn't advocating hourly not to exceed - <USER2> offering it as an alternative.

Doing it faster with straight hourly does not offer any more benefits than hourly not to exceed - the benefit of doing it faster in both is improved cash flow if a milestone payment model is used.

Hourly not to exceed provides a solid feedback loop on estimates and allows the development of better estimating skills. Like "buying a job" with a low flat fee, it may provide soft business benefits depending on circumstance.

</comment></comment></comment><comment><USER5> Wait wait wait, if it's per hour, estimates don't matter. Do you mean per project?

<comment><AUTHOR> yeah per project. Sorry if my question was misleading.

<comment><USER5> The you should try per hour. Example:

Project X has an estimate of 200 hours, but if at the end of the project 230 hours are used, you bill 230. This is usually the best way to protect yourself from late changes, feature creeps and undecided clients. This approach also puts more responsibility on the decisions made by the client.

If your friend already has some proven track record, clients should trust him as a professional.

The downside to hourly payed is that some clients don't like it and it's understandable. A failed project is not only the responsibility of the coding team.

Here's a neat article about this: [http://www.webdesignerdepot.com/2010/10/charging-per-hour- vs...](http://www.webdesignerdepot.com/2010/10/charging-per-hour-vs-per- project/)

</comment></comment></comment><comment><USER4> If you use an agile model you will develop the most important features first. What this does is every week keeps you focused on the top priority and ensures that when the budget runs out, the most important features will be done.

The reality is that if there are 100 units of work and only 80 units are possible based on the budget, either the client will be unhappy because you told him 100 units were possible or you will be unhappy because you did 100 units of work for 80 units worth of pay.

It is much better to just do the highest priority 80 units first and then see if the last 20 units are really necessary. When they actually have a working product in front of them, often times clients will realize it isnt worth delaying to get the last few bits.

</comment><comment><USER6> Don't let interns establish quotes, they're not sales people.

The CEO should own the revenue stream, make him approve any quote (or at least anything spanning more than 1 days worth of work).

<comment><USER3> I agree about quotes, but I think the interns were being asked to estimate their time, and that's a good thing provided that the manager's initial adjustments to their estimate are discussed with them, they get ongoing feedback about their performance against their estimate and that there is a debrief to figure out why the estimate was inaccurate.</comment></comment>


Show HN: Built my resume as an interactive website, version-controlled on Github - <AUTHOR> https://github.com/philipithomas/cv-philipithomas <comment><USER2> I'm sorry but I don't get it. What's interactive about it?

It looks like a fairly regular resume to me except for the fact that it's rendered as HTML, but that's not really something new. Sure, it's actually built dynamically with a few PHP functions, but the way each element is built could be smarter (e.g. you have HTML markup in the function's arguments sometimes which seems to beat the purpose a bit).

I'm not trying to be a downer but I was expecting something different and I feel I'm missing something.

If I were to do something like that, I would probably do it in Markdown with Jekyll. Right now, your index.php mixes a lot of presentation with content and I feel that one benefit of Markdown+Jekyll is that you have a readable Markdown file that can be made into a nice looking static HTML page.

</comment><comment><USER3> First off, I am fifty years old, so I'm fond of traditional phrases like _Curriculum Vitae_. That being said... I suspect many people may find it a bit stuffy. Also, I don't think that you can have it both ways: If you use old- fashioned words, you should present it on high-quality paper, lovingly typeset. It strikes me as a little out of place on an interactive web site. JM2C, I'm not sure how you could meaningfully A/B test it.

Second, if you are seeking a programming job, a program is obviously a portfolio piece. Am I correct in assuming that were I to hire you for a project, your preferred approach would be to mix HTML with PHP code that in turn embedded HTML in strings?

If that's what you want to suggest, this is the right approach. If you want to present different options, I would put them to work in your résumé even if they might be a little overkill for your needs.

<comment><USER4> In the U.S. "curriculum vitae" has a specific meaning, which is to convey the research interests, history, and publications of an academic researcher. They are typically several pages long.

This is not a curriculum vitae, and should be called a resume. Particularly since the guy is still in academia where they tend to take their bureaucratic nomenclature very seriously.

<comment><USER5> In the rest of the world, curriculum vitae is almost synonymous with résumé and is used more often to convey the same meaning.

</comment></comment></comment><comment><USER6> Shameless plug, but I used a jQuery timeline plugin to create my CV, since I found regular CV's boring. It's not that detailed, but it's less dull in my eyes. Still need o add my LinkedIn profile that will serve as the boring version. Ps. Doesn't look great on mobile yet..

<http://www.samgranger.com/cv/>

I still need to change a lot and I might end up taking a completely other approach. But I want to make it as interactive as possible. Probably will end up writing my own plugin.

My old CV: <http://www.samgranger.com/old_cv/>

<comment><USER7> Another shameless plug. I'm slowly bootstrapping MightyCV - a resume platform with hacker leanings. It has integrations with HN, github and StackOverflow along with some other cool features.

<http://robeastham.mightycv.com>

If you like the look of it you can sign up for an invite at <http://www.mightycv.com>

<comment><USER8> +1 for building something like this to scale (rehashed from another reply below, but circumstances are the same) ;-)

Might test it later and let you know.

</comment></comment></comment><comment><USER9> If we're doing feedback on version-controlled-via-Github "interactive" resumes, my I present mine?

<http://judy.github.com/>

\- It parses via the hResume microformat, although I've never been able to fully test that. Is there a way to do that now?

\- It prints quite nicely; there are hidden sections that allow me to move the contact information up top when you're printing it, more like a traditional resume.

\- It's responsive. It should look good on any phone, tablet, or traditional display.

Please, please fork it if you like it. You have my full permission. (I mean, just don't copy the content, mmmkay?)

<comment><USER9> Actually, I'm going to reply myself as I'm looking at it again. I built this when Bootstrap was hot shit; it's now a bit cliche-looking, so to speak. I may play with the styles.

I've also gone back and forth on having a picture or not. That pic is on every other "resume" site out there, like Dice or StackOverflow Careers or LinkedIn.

I'm also not looking for a job currently, but I AM looking to speak at more events, now that I'm doing open source work for a living. I wonder how the structure should change?

<comment><USER8> >> I've also gone back and forth on having a picture or not.

It gave me a first impression of you, one that was more affable/likable (a better picture of you, that your skills or GPA cannot give). So, in my view, leave it there.

>> but I AM looking to speak at more events, now that I'm doing open source work for a living.

Why don't you search for interesting tech gatherings in and around your areas and offer yourself as a lineup speaker? One example:

[http://www.meetup.com/find/?keywords=hacker+news+&userFr...](http://www.meetup.com/find/?keywords=hacker+news+&userFreeform=&mcId=&mcName=&categories=&view=masonry&sort=default&radius=Infinity&offset=0&psize=30&currentpage=1)

</comment></comment></comment><comment><USER8> Like a few others, I too found it an average CV (It is something very similar to what I myself have, and I consider myself an average (-; ). To be honest, there are a few others in the comments that I gravitated towards more (It's a matter of personal preference of course). Sure, the Progress bar looks new, but others too have it on them -- see v33ra's response below.

You took a chance and placed it on HN for the self-promotion/ exposure/publicity and you were (luckily) rewarded. As you can see from the comments below, there are a lot of such efforts out there and all of them very commendable as well. They just didn't feel promotional enough like you, to place it here in the first place (and all of them had also placed it on GitHub before you, so open sourcing is not an USP either).

But I felt there there was neither anything "stand-out" about the CV, nor was there anything "interactive". It is a web resume like everyone else's and that's it.

For inspiration, here's what I would consider an impressive (as in look-and- feel) web CV and something close to an "interactive" web CV: <http://www.chrisharrison.net/>

My two bits.

<comment><USER10> Sorry to be 'that guy', but are you sure you attached the correct link? Chris Harrison's CV is (sadly) in pdf on his website!

<comment><USER8> Hey! No worries. ;-)

Remember, we are speaking interactive+web+CV in this thread. So, basically, the entire website is his CV (Research, Visualizations, Fun, Travel -- Top right corner).... You interact with the site and you learn about all his skills (in a very fun, very tangible and informed manner). Also, the teaser animated gif that showcases a few of the "cool" things he's working on, are an excellent teaser/appetiser, don't you think?

Anyway, I suggest you keep a few hours free and sit down with your favourite bevvy and then start clicking..... That's how it's for me with his site every time ;-)

EDIT: If you liked the design and presentation of that CV, please upvote the original comment so the site gets some visibility that it deserves as an interactive and constantly evolving "skills" showcase. (He's no relative of mine, and I have nothing to do with him either personally or professionally)

</comment></comment></comment><comment><USER11> I like mostly everything I see, but I have one criticism. The bars in the technical section seem arbitrary. It seems that a person viewing this CV wouldn't know quite what to take away from it. To start, I am assuming this is some sort of proficiency. The proficiency of a skill is relative _only_ to the proficiency of the other skills which doesn't tell a person much. Is there some way that you can give the bar a baseline to work from. Something along the lines of 'no experience' -> 'comfortable' -> 'proficient'.

</comment><comment><USER12> As a programmer, it never occurred to me that you would _not_ keep your resume, be it online or on paper, under version control.

Your resume looks good, but I have some (personal) objections to it.

The bright background, most people seem used to it, but I don't like it; something more subtle (gray) could make the site look more smooth.

The free space, just because you can scroll, it does not mean that you should waste screen estate like that; e.g. on a 23" screen, almost half of the screen is occupied by your name.

The skill bars are a controversial topic. I am considering them for my resume, too, but to me setting the values seems rather arbitrary.

Section priorities, visually the skill bars take up a huge amount of space, yet the projects section (which is more important, because it's providing proof) looks like some background noise due to its size and different background color.

I think it's a good start and can become a great online resume!

It's always easier to judge other people's work, so you are free to punch back, you'll find my resume at <http://me73.com> (WIP).

PS: If I was in the position of deciding whether to hire you or not, I wouldn't; given your experience section, you already seem to be actively holding 7 positions, how could you have any time left for my business?

</comment><comment><USER13> Good one.

Sometime back, I designed my resume on similar lines. I used hResume microformats and some CSS goodies too.

Here's the live resume: <http://veerasundar.com/resume/> and a blog post explaining the design: [http://veerasundar.com/blog/2012/06/redesigning-my- resume-wi...](http://veerasundar.com/blog/2012/06/redesigning-my-resume-with- html5-css3-and-hresume/)

<comment><USER8> Looks nice! I liked it.

One (minor?) feedback:

Opinion on whether "Ninja" is awesome or uncool is divided even within HN. See recent discussions on "Product is a byproduct" thread. Now, I am trying to imagine how it might be perceived in conservative working environments like Indian workplaces.

IMO, keep the wording and ditch the Ninjas. Ultimately, "what matters in life is how you see yourself"[1]

There must be a way to highlight which are your best skills, like this OP's resume progressbars?

[1] [http://blog.robinleehatcher.com/.a/6a00d8341cb0ee53ef0148c75...](http://blog.robinleehatcher.com/.a/6a00d8341cb0ee53ef0148c75de1a8970c-300wi)

<comment><USER13> //There must be a way to highlight which are your best skills, like this OP's resume progressbars?//

In fact, I do have one similar to progress bars. Have a look at the skills section in home page (<http://veerasundar.com>) where I show a strength bar for each skill.

When I ported the skills section, I just decided not to include the progress bar.. may be I should add it there too.

<comment><USER8> >> may be I should add it there too

No. That was a good call on leaving it out. For your layout and font size, the progress bars add no value (in fact it has the opposite effect).

For your layout, I would recommend a colour scheme of four colours, with a certain colour denoting expert and certain colour denoting novice, and others in between. Have legend on the top saying what is what and that will provide the same effect.

</comment></comment></comment></comment><comment><USER14> Great to see a fellow Wash U student on here - nice work. One thing - is there any way to export it as a pdf?

I know this kind of defeats the purpose, but some people/companies may still want to print these things out, or at least have them on file where they have a static copy (as in it won't change automatically), so having control over what that pdf looks like might be useful.

Just a minor point though, love the design.

<comment><USER9> You raise a good point. If I attempt to print it, Chrome has a terrible time rendering it for print; it's completely unreadable. I think that may just be the custom fonts used. OP should figure that out with a print stylesheet.

</comment></comment><comment><USER15> awesome job! Looks great, just forked :) Also I was looking at the upcoming features list, and I think definitely the pdf functionality would be cool (I'm thinking the fpdf lib - know a better one?). Another idea for a feature would be to give this an REST api for xml, json, and you can then just make an appropriate call to it ( /resume.json, /resume.xml, etc). Again nice!!

<comment><USER16> I set up my resume[1] with PDF exports using Docverter. It takes Markdown or HTML and turns it into PDFs and Word docs.

[1]: <http://www.bugsplat.info/resume.html>

(Disclaimer: I also built Docverter)

<comment><USER15> this is a really well done project, did you build the whole app yourself?

EDIT: I guess you just answered this :) awesome job, it looks amazing!

<comment><USER16> Thanks! I'm pretty happy with it. The integration turned out to be really easy.

</comment></comment></comment></comment><comment><USER17> Really cute, props on the originality. The general design is good (I loved the skills bars!), but your Experience sections looks a bit too wall-o-text. I can't imagine reading through all that.

If I were you I'd try reducing the word count as much as possible as well as applying a very very subtle background shade for each position to set them apart (or something similar to that).

Anyway, awesome stuff.

<comment><AUTHOR> Thanks for the feedback. I want to have better info on the individual companies by somehow incorporating their logos - I'm considering a modal or a popover at the moment.

The subtle grey background is a good suggestion. I'll experiment with some things, and if you do anything cool on a fork, please put in a pull request!

</comment></comment><comment><USER18> Cool idea. This is something I've wanted to do for a while. I'll have to fork this later for my own use.

Few things I noticed that could be improved. Your technical section isn't very clear on what the graphs mean. Do the bars mean the amount of time you've used that technology, the number of projects you've built with that technology, or your experience? It's creative, but it's hard for me to understand what they mean (especially relative to one another).

I also noticed that you didn't include a print CSS. Yeah, physical resumes are not great, but they won't go away for a while. It would be good to have a print CSS that replicates generally what print resumes looks like. Right now it doesn't look very good. It wouldn't be hard to fix.

On another design note, I think it would look better if the pill links didn't have a blue underline on hover.

</comment><comment><USER19> 1) If you're in the US like you say you are, this is a resume, not a CV. 2) The "website" link for Food Trucks Near Me does not work.

Also, I'm a bit baffled by these graphs. While they look nice, I'm not sure what they're conveying. Is there an endpoint for learning/competency (100%) like a bar graph would suggest? If anything, I think a pie chart might reflect your abilities better since it doesn't claim that a College Senior is 50% done/proficient/knows everything about Python or whatever (I don't claim that you're not awesome with Python but that's quite the bold claim, even for someone with many, many years of experience).

Otherwise, looks good and definitely beats a paper resume.

</comment><comment><USER20> I like the way you outlined your skill levels using progress bars. I've always found it tough to describe how good you are with a certain programming language. Saying "proficient with Java, PHP, etc... doesn't really attest well to your skills.

</comment><comment><USER21> I've read/heard that it's best to flip your experience with education unless you want to be viewed as someone entry-level. When education is the best thing you've done, sure, list that first. But when you've created things like an actual business, you want to highlight that first and foremost.

Like the inefficiencies of a call to action being hid at the bottom of a page, you want to highlight your best value proposition (most likely to be the most recent thing you've done) closest to the top.

</comment><comment><USER22> Nice work, it looks really good.

One minor (and I mean _really_ minor) design thought: in the section near the bottom "Selected Projects", there are grey buttons and blue buttons; in the close proximity of the blue buttons, the grey buttons sort of look like they are inactive or disabled, at first. I put my mouse over them and figured out they were indeed active links, but maybe someone non-technical might not do that.

<comment><AUTHOR> Good point - thanks!

Edit: Site updated - the buttons are now green.

</comment></comment><comment><USER23> I hope this catches on as a trend. A similar setup has worked great for me for some time now. Don't forget your print media specific styles though...

</comment><comment><USER24> Your website - <http://philipithomas.com> \- has exactly the same design as the - <https://svbtle.com> \- network.

Are you part of that network (if so... how did you do it?) or are you just really copying on a grand scale?

</comment><comment><USER25> This is very long and there is a lot of white space (hard to skim). I honestly would not enjoy having to read this, and the lengthy anti-skim style comes off as somewhat arrogant to me.

Resumes are typically one page, so you should really consider either supplementing this with a one-page version or shortening it.

</comment><comment><USER26> The part I like is version-controlled on GitHub. Now if I can just 'git log' my employment history ...

</comment><comment><USER27> I don't get it why you said it's interactive. But I like the simplicity of the design. I also built mine, but not in Github, well here <http://jpbalb.in/resume.html>

Just a thought though, is self picture important in the resume?

<comment><USER8> >> is self picture important in the resume?

Especially if you're the greatest and the one and only.... Mojo.....Jolo ;-)

OK, seriously though, there is no hard and fast rule on this one.

But in all, it is not a bad idea to keep a portrait with one's CV. There are very good reasons why it will be taken well, rather than why it won't be taken well. If you already have it there, just leave it there. Remember to update it periodically though. That is very important.

</comment></comment><comment><USER28> I'm confused about the date format. I'm British, and was expecting an American format (even though you confusingly call this a CV instead of a resume) but it looks like it's in British format. Perhaps you could remove the ambiguity by using "January 2012"?

</comment><comment><USER29> Congrats on making Eagle. There are so few of us out there. </left_handed_shake>

<comment><AUTHOR> Thank you! Justifiable contentiousness of the parent organization aside, I am proud of the achievement. In terms of a resume, the Eagle award is unique as the one part of pre-college life that will stay on the resume forever.

</comment></comment><comment><USER30> By interactive do you mean you made a webpage for your resume? That's been a good idea (for tech/programming jobs) for years now.

Shameless example, mine: <http://stephenballnc.com/resume/>

<comment><USER8> You had my admiration, with the Ubuntu theme ;-)

</comment></comment><comment><USER31> If you are really that far along with your PHP skills, I don't think presenting an index.php as embedded HTML with a few string assisting PHP functions grants a lot of confidence to a knowledgeable employer about your skillset.

<comment><AUTHOR> I honestly started with an index.php because that's the easiest way to serve a static site on heroku. I just intended to put up a static site, then built a couple functions for efficiency in formatting. It wasn't intended to be a demonstration of my programming ability; it was designed to be something quick thrown up in a day.

<comment><USER32> >It wasn't intended to be a demonstration of my programming ability; it was designed to be something quick thrown up in a day.

Well yeah then that's EXACTLY the impression you're gonna give off. This is the first thing a potential employer will see if you're already giving off a "I don't really care about the code" vibe I don't see how that inspires a lot of confidence in your abilities and especially mindset down the line.

</comment></comment></comment><comment><USER33> Isn't this kind of an over kill, i mean how often does one update their resume.

</comment><comment><USER34> Great idea! I'm also working on an interactive resume, but havent finished or pushed the code to github yet. <http://www.stevewight.com/resume>

</comment><comment><USER35> You inspired me to build out a personal website for my YC app.

Check it out here if you're interested: <http://news.ycombinator.com/item?id=4676920>

</comment><comment><USER36> Fantastic looking. Forked, and going to deal it with myself tomorrow!

</comment><comment><USER37> I have my resume like this but I also made sure it is easy for others to make their own at my site's expense: <http://www.cvstash.com>

<comment><USER8> +1 for taking the effort to build something to scale. :-)

Hmmm... I checked it.. Good landing page, but your "Sample Resume Preview" which is supposed to load this: <http://www.cvstash.com/profile/john_doe_EUQ8q3gDV>

instead redirects to this: <http://www.cvstash.com/resume/default/index//>

I would like to see the preview of a Resume, before wanting to actually go ahead and try it, no?

EDITED to add: Even clicking on your name: <http://www.cvstash.com/profile/arbie_samong_mfvvK163U> leads me to the front page. Looks like I have to sign up before the site decides to show me anything.

EDIT 2:::

I bit the bullet and clicked JOIN NOW, and got this message:

Internal error

Ticket issued: unrecoverable

Man, I am so sorry to be the bearer of one bad news after another......

I'll give it a few hours before checking back. :-)

</comment></comment><comment><USER38> Cool to see somebody else who was @ startup weekend CoMo. I thought your idea was one of the better ones in terms of actually having a revenue plan. Are you still pursing it?

<comment><AUTHOR> Thanks! Which team did you compete with? The project is on the backburner at the moment as I'm wrapping up midterms and interviewing for a job. One of the GPs in my VC firm put me in contact with some great tools for getting better margins, so we have the resources to continue pursuing it. It is just not a priority at the moment.

Also, did you see the article I wrote for the business journal about the event? [http://www.bizjournals.com/stlouis/blog/BizNext/2012/10/comm...](http://www.bizjournals.com/stlouis/blog/BizNext/2012/10/community- voices-philip-thomas-at.html?page=all)

<comment><USER38> Cool article! I wrote some Javascript/iOS code for the FundRunners project. We only had six people, ;-)

</comment></comment></comment><comment><USER39> This is a nice start but you're missing a huge opportunity to show off your sites in a visual way. Why do you think outbound links are the best way to represent your work?

<comment><AUTHOR> I'm planning on tweaking with modals that show logos and descriptions of specific projects and companies. The other option is having logos appear on over of the names.

I really wanted content to be king, so I didn't include the immediate clutter of a bunch of logos and galleries. The modals make it more interactive.

</comment></comment><comment><USER40> You founded two startups, you are an analyst for a VC fund, yet you are still "looking for employment after graduation"? Only on HN...

<comment><USER41> And FFS everybody please, please. quit calling your website a "startup".

</comment></comment><comment><USER36> Also, to anyone who forks this and decides to use, you might want to remove the authors original google analytics!

<comment><AUTHOR> Good point - I just added that to the "Building Your Own" section of the Readme.

<comment><USER36> I'm not criticising, I'm only trying to complement what you've already done. The buttons show an underline on Safari on OSX when they're hovered over. I'm working on it now, and will post a link with my fixes later on. Fantastic work, thanks so much!

<comment><AUTHOR> Thanks for the positive feedback! I can look at the CSS soon, but if you want to put in a pull request on Github that would also be appreciated!

<comment><USER42> Best way to fix those (Website-->) buttons is to remove them. They are very distracting! Just make the titles links with some suitable style.

</comment></comment></comment></comment></comment><comment><USER43> Props for using CloudFlare.

Negative for the JavaScript error on the page. You need to load jquery before you load bootstrap.

<comment><AUTHOR> Whoops, corrected. Thanks.

Also, I'm a huge Cloudflare proponent.

</comment></comment><comment><USER44> It looks fairly average to me.. but it is great your getting exposure. I hope something good comes of it.

</comment><comment><AUTHOR> Live website: <http://cv.philipithomas.com>

</comment><comment><USER45> This is awesome!

</comment><comment><USER46> in your about section, why do you talk about yourself in third person?

</comment><comment><USER47> bootstrap

</comment><comment><USER48> I love those skill bars.

Because they say something meaningful, potentially, namely what you're relatively better or worse at, more or less experienced at. Without committing the sin of telling the world what your objectively absolute rating is in some supposedly global but in actuality undefined frame of reference.

Example: "I'm a 6/10 on Apples and an 8 on Oranges, and Bob over there says he's 9 on Apples and 1 on bananas. Turns out in actuality I'm way better at Apples than Bob, but Bob kicks most people's asses at bananas!"

<comment><USER49> I disagree, because they're completely arbitrary and a full bar can suggest that you either know everything, or you can't improve any more.

Trying to represent knowledge or skill on a finite scale is a bad idea, I think. If I got this CV in a pile I'd want to see examples to demonstrate that skill in place of this section, not a set of percentages pulled from thin air.

<comment><USER50> Agree. The OP should mention what he has done or what he knows with the technologies and languages he is assessing himself.

For example:

Matlab: built a model to do X in matlab, used very frequenty to do my reports for two years.</comment></comment></comment>


CoffeeScript 0.2.1: Significant Whitespace, Splats, Existence, Object Compre... - <AUTHOR>

CoffeeScript 0.2.1 is out this morning, with a slew of language improvements over the previous gem.
http://jashkenas.github.com/coffee-script/
* Python-style significant whitespace to delimit blocks (no more periods).
* Better conversion of JS statements into expressions -- you can pass a try/catch right into a function, for example (not that it's a good idea).
* Splats, for variable numbers of arguments in function definitions and function calls.
* Object and Range comprehensions, to augment the existing Array comprehensions.
* A Ruby-style block syntax for passing functions as the final argument.
* The existence operator, which returns true if a variable is not null or undefined.
* All functions are named functions, to help ease debugging.
* Array splice literals, to complement the array slice literals.
All of your feedback from the previous post has really helped shape the language. I'd love to hear more. <comment><AUTHOR> Clickable Links.

CoffeeScript: <http://jashkenas.github.com/coffee-script/>

Previous HN Discussion: <http://news.ycombinator.com/item?id=1014080></comment>


Elusive mitochondrial connection to inflammation uncovered - <AUTHOR> https://www.nature.com/articles/d41586-018-05988-z <comment><USER2> Interesting post and comments, as usual. I wanted to give some pragmatic information related to this.

I have a genetic condition that makes my mitochondria to malfunction. I was diagnosed about 10 years ago. At first, I started taking supplements to increase the production of ATP, but my "vitality" did not improve much. I could workout normally, but my recovery ability was poor, and from time to time I would just crash and burn for 2-3 days.

After much reading, I came to the conclusion that the problem was not a shortage of ATP. Rather, it was the mess created by all the workarounds my body was doing to maintain a level of ATP that could keep me alive. So, I started taking the following pre-bed stack. It is meant to be a clean-up the mess, anti-inflammatory:

\- 2g Vitamin C

\- 500 mg reduced glutathione

\- 500 mg curcumin (I prefer BCM-95)

\- 1-5 mg melatonin (depending on activity level)

\- 100 mg CoQ10

(I am also considering adding Ashwagandha to the stack)

As of today, I workout 4-5 times per week, with 2 sessions of boxing (like punching in the face, not the aerobic variation), 1 heavy lifting session (usually squats) and 1-2 metabolic circuit sessions.

Sure I feel tired at times, but it is not liked the deep, extreme fatigue I felt before starting this stack.

Hope this helps.

<comment><USER3> I'd recommend turmeric instead of curicumin and to not take melatonin but I'm happy you are feeling better, so whatever works for you.

<comment><USER2> Thanks for the recommendation.

Could you elaborate a bit, specially about melatonin ?

<comment><USER4> On the melatonin I would add that studies have shown negligible increase in effectiveness over 0.3mg. Yes, most pharma stores offer only 3mg and above, but that seems to be wrong.

Personally I've only taken melatonin when I most needed it, and then gave up on it. You should try giving it up, too, unless you really can't do without it.

You should check the vitamin D level, too, whenever you do your next blood test.

As for curcumin, the Longvida formula seems to be most effective. I can't say I've noticed any effects from it myself, but I haven't taken it daily, and I've also read that you need to take curcumin for 2+ weeks to see the effects.

[https://www.turmericforhealth.com/curcumin-benefits-and- dosa...](https://www.turmericforhealth.com/curcumin-benefits-and- dosage/8-popular-curcumin-supplement-types-in-market-today-a-quick-review)

<comment><USER2> On the melatonin, note that I do not take it to fall asleep, but for its protective effects in the mitochondria. This [1] is a good review.

[1] [https://onlinelibrary.wiley.com/doi/full/10.1111/j.1600-079X...](https://onlinelibrary.wiley.com/doi/full/10.1111/j.1600-079X.2004.00181.x)

<comment><USER3> Here is an interesting video re melatonin:

[https://www.youtube.com/watch?v=2q1ln6vaSE0](https://www.youtube.com/watch?v=2q1ln6vaSE0)

</comment></comment></comment></comment></comment></comment><comment><USER5> If you are interested in more information about Autophagic processes, this video interview is great: [https://www.reddit.com/r/fasting/comments/6qobj7/rhonda_patr...](https://www.reddit.com/r/fasting/comments/6qobj7/rhonda_patrick_brings_nerd_level_video_on/)

Rhonda Patrick interviews Dr Guido Kroemer, an expert in Autophagy. Its one of the most accessible, well-referenced and thorough discussions on Autophagy (including Mitophagy), that I've come across.

<comment><USER6> Transcript and other resources available here. [https://www.foundmyfitness.com/episodes/guido- kroemer](https://www.foundmyfitness.com/episodes/guido-kroemer)

Thanks for sharing!

<comment><USER7> Dr Rhonda Patrick's podcast, Found My Fitness, is excellent.

</comment></comment></comment><comment><USER8> Oxidative stress and inflammation go hand in hand. Aging has rising levels of both.

Mitochondrially targeted antioxidants such as SkQ1 were first approved for use against inflammatory eye conditions. They act to dampen the consequences / amount of inflammation, and do this by cutting down on oxidizing molecules produced within mitochondria. They were first developed out of an interest to slow aging through this sort of modulation of mitochondrial oxidative stress and damage. They do slow aging to some degree, but don't do anywhere near as well as calorie restriction - say 10% in flies, something less than that in mice, which isn't impressive.

The first earnest human trials for mitochondrially targeted antioxidants such as MitoQ (which from the studies is actually less effective than SkQ1) suggest it can reduce the impact of oxidative stress or inflammation on the smooth muscle cells in blood vessel walls. Their dysfunction produces some fraction of the stiffening of blood vessels with age. That stiffening causes raised blood pressure, which in turn causes too many bad things to list here.

So these are not massive effects. You can probably do as well as MitoQ by bumping up your exercise level to the next tier. But then you can always both exercise and take a mitochondrially targeted antioxidant. The costs are not high, so it may be worth it based on the preliminary data.

Not a cure for aging, and thus not worth spilling immense amounts of ink and effort over it. Just something to think about doing and then get on with better development projects with better expected outcomes.

<comment><USER9> Then melatonin supplementation might be the way to go.... [https://scholar.google.com/scholar?as_ylo=2018&q=melatonin+m...](https://scholar.google.com/scholar?as_ylo=2018&q=melatonin+mitochondrial+stress&hl=en&as_sdt=0,5&as_vis=1)

</comment></comment><comment><USER10> One mental model which may help in visualizing "oxidative stress" in mitochondrial networks is to liken it to a "first-order phase transition" in solid-state physics. Gene expression regulates structure. And structure determines function.

But whereas a typical sample of inorganic material may possess a handful of stable states under room temperature conditions. Nuclear genomics in mammals express 1000s of proteins.

MIT's Broad Institute has begun compiling a reference atlas:

MitoCarta 2.0: An Inventory Of Mammalian Mitochodrial Genes

[https://www.broadinstitute.org/scientific- community/science/...](https://www.broadinstitute.org/scientific- community/science/programs/metabolic-disease- program/publications/mitocarta/mitocarta-in-0)

<comment><USER11> If you could acurately simulate biological systems with a computer model, you could do drug development in the cloud without the need for clinical trials. Unfortunately, protein folding and even predicting whether a molecule will be an agonist at a particular receptor site are very slow algorithms.

<comment><USER12> Accurately simulating biological systems in the cloud to run a virtual clinical trial is like trying to predict the exact weather for Washington DC at a specific date and time hundreds of years from now using weather forecast models. It's pretty much impossible with current biomedical knowledge.

To simulate humans well enough to eliminate a clinical trial, you would have to simulate every single cell, organ, and organ system as well as the substantial population of bacterial and fungal microorganisms that live on and inside humans (as well as all their unique biology too). Building such a simulation would require a level of knowledge of biology that the human race currently does not possess.

<comment><USER13> That is and will stay impossible no matter how many resources for simulation you have, actually.

> This technique, when applied to the real world, is sometimes useful, but can > sometimes also lead to self-deception. This technique is called modelling. > When constructing a model, the following idealization is made: certain facts > which are only known with a certain degree of probability or with a certain > degree of accuracy, are considered to be "absolutely" correct and are > accepted as "axioms". The sense of this "absoluteness" lies precisely in the > fact that we allow ourselves to operate with these "facts" according to the > rules of formal logic, in the process declaring as "theorems" all that we > can derive from them.

> It is obvious that in any real-life activity it is impossible to place total > reliance on such deductions, if only because the parameters of the phenomena > studied are never known absolutely exactly and a small change in parameters > (for example, in the initial conditions of a process) can totally change the > result. It is for this reason that a reliable long-term weather forecast is > impossible and will remain impossible, no matter how much we develop > computers and devices which record initial conditions.

[https://dsweb.siam.org/The-Magazine/All-Issues/vi-arnold- on-...](https://dsweb.siam.org/The-Magazine/All-Issues/vi-arnold-on-teaching- mathematics)

</comment></comment></comment></comment><comment><USER14> This is actually very interesting.

Low-grade inflammation is often linked to aging and cancer developments, it is however often unclear whether its cause/effect or correlation - [https://academic.oup.com/biomedgerontology/article/69/Suppl_...](https://academic.oup.com/biomedgerontology/article/69/Suppl_1/S4/587037)

But mechanisms of inflammation are many and still pretty illusive, this is a great step towards understanding aging mechanisms in general.

</comment><comment><USER15> This is highly interesting. After taking ciprofloxan 10 months ago I'm still trying to get my damaged mitochondria back in order.

<comment><USER16> Wow thanks for your post. I had to look up and I was surprised that antibiotics can damage your mitochondria. But it makes sense because I was told, back in biology, the mitochondria were actually a bacteria and "swallowed up" by mammal cells. (forgive me, that's a extremely trivial recall of my memories and I am not an expert in this field)

If you are interested (and very brave, there are risks here), apparently there is a SARM that can help your mitochondria grow back. It's called Stenabolic SR9009. I have never tried it (because I have no need), but I'd be interested in what you think about it. You can find information on it online, I don't want to post anything because I am not qualified to vet the information -- information is all over the web however.

<comment><USER15> For me the experience has made me less risky in general (this was a standard 10 day treatment for sinus infection). Fasting / exercise for now. My biggest issue is the gut and repopulating bacteria. Once that's in order I may try something like the Stenabolic.

</comment></comment></comment><comment><USER17> 2012: [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3536340/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3536340/)

</comment><comment><USER18> Vitamin D3 (+ K; 10 IU D3 : 2 mcg+ MK-4) + chelated/TRAACS magnesium. Magnesium is released by the body to clear inflammation. Vitamin D induces autophagy, and counters inflammation and oxidation.

Riboflavin (selenium, vitamin E, etc) is involved in the recycling of glutathione. MSM + silicon (monomethylsilanetriol) + vitamin C. 4g:1g MSM:C.

</comment><comment><USER19> So this could be what is causing all these nearly undiagnosable cases of autoimmune disease?

</comment><comment><USER20> There are about half a dozen solid rock band names in this headline:

Hello [City], we are [Choose one below]! Duh nuh nuh nuh nuh, Duh nuh, Duh nuh nayayayayay

\- Inflammation Uncovered \- Mitochondrial Connection \- Elusive Mitchondria \- Elusive Inflammation \- Mitochondria Uncovered ...

</comment><comment><USER21> I wonder why we developed the STING protein in the first place. Was it perhaps an early form of immunity, or a precursor to an immune response?

<comment><USER22> The name stands for STimulator of INterferon Genes, where interferons are essentially message-carrying molecules involved with the immune system. STING protein, I believe, is essentially a detector which gets triggered when a cell is invaded by a virus or encounters a parasite. For that, it still serves an important purpose.

</comment></comment><comment><USER23> Ray Peat anyone? :)

<comment><USER24> Absolutely, nobody knows better how to take care of our mitochondria than Ray Peat.</comment></comment>


Unusual Suspects: Finding the Humanity in Vintage Mugshots - <AUTHOR> https://www.collectorsweekly.com/articles/finding-the-humanity-in-vintage-mugshots/ <comment><USER2> No mugshot should be released unless convicted.

<comment><USER3> Agree. It's not like they need the public's help locating, like "wanted" posters. They've already got the suspect in custody.

<comment><USER4> The funny/sad thing was that it was intended as a safeguard against people just getting disappeared into police custody but people were such judgemental bastards that they hold guilty even after acquitted attitudes.</comment></comment></comment>


Attribution of the Australian bushfire risk to anthropogenic climate change - <AUTHOR> https://www.worldweatherattribution.org/bushfires-in-australia-2019-2020/ <comment><USER2> Same study discussed here a few weeks ago:

[https://news.ycombinator.com/item?id=22492538](https://news.ycombinator.com/item?id=22492538)

</comment><comment><USER3> I thought the headline was hard to understand so I found where the 30% number came from in the article:

> Four climate models for which FWI could be calculated show that the > probability of a Fire Weather Index this high has increased by at least 30% > since 1900 as a result of anthropogenic climate change.

</comment><comment><USER4> I'm surprised it's not 100% more likely given what we know based on evidence ?

</comment><comment><USER5> When will we get past even bothering to ask the question of whether or not it's because of humans? It's starting to seem very dated.</comment>


Bob's wife Carla lends a speedy mind - <AUTHOR> http://blog.jgc.org/2013/04/bobs-wife-carla-lends-speedy-mind.html <comment><USER2> "And even when they are salted and hashed it's worth asking (or wondering) whether they used a scheme that could beat Carla's computer equivalent by hashing multiple times."

Using such a scheme is generally called using a "key derivation function". Commonly known ones are PBKDF2, bcrypt and scrypt.

What worries me is that most competent people in the industry still ask whether passwords were salted and hashed, rather than whether they used a key derivation function.

This suggests to me that even generally competent developers are not aware that salting and hashing on its own is considered weak. PBKDF2 is over a decade old now!

If you want to educate people, please finish by suggesting that developers should not be rolling their own, but instead using a key derivation function that wraps the knowledge of the state of the art so that developers don't have to worry about the details any more.

"Be on the look out when a password database is reported to stolen to see if the press reports that the passwords were 'salted' and 'hashed'..."

Instead, I would be on the look out to make a note of which key derivation function they were using. If they weren't using one, they were doing it wrong.

<comment><USER3> _What worries me is that most competent people in the industry still ask whether passwords were salted and hashed, rather than whether they used a key derivation function._

Maybe because even that weak protection is still rare. It is the equivalent of "Did you plug it" in tech support.

<comment><USER2> Sure. I'm certain that there are competent developers who are aware of KDFs but still ask for salting for the reason you described.

The problem I perceive is that other developers learn from this question. They falsely learn that salting is the best practice answer, when it is not.

</comment></comment></comment><comment><AUTHOR> This is the final part of my series about one-way functions and password storage. Thanks for all the comments.

Are there other topics that could use a similar treatment?

<comment><USER4> I think this kind of explanation is brilliant. One on public-key cryptography would be really good but i'm not sure where to start.

<comment><USER5> This.

Also, thanks for a good read John.

</comment></comment></comment><comment><USER6> An excellent series of articles that were clear, concise, and entertaining.

The only cryptologic issue I take is that to some degree the analogy illustrates [rather than breaking down] the security for security's sake commonly argued in regard to passwords.

Imagine Alice decides to found a crossword puzzle startup. Password recovery is far more important than protecting passwords. The answer for 2A is not important enough to justify a computationally intensive salt and hash. She is responsible for entertaining customers, not running a bank.

<comment><USER7> This assumes good password hygiene on the part of all of Alice's users, which is a bad assumption. In reality, a large proportion of Alice's users will use the exact same password for her site as they use for their bank. She owes it to her users to protect that data.

Best password practices do not have to be user hostile. You can still allow a password reset while doing things properly. Yes, you can't e-mail them their old password, but you can set a new one for them, which is nearly as usable.

<comment><USER6> I'm assuming no such thing. I am also not assuming that Alice is responsible for protecting the entire internet.

Your response is exactly in line with my comment - security for the sake of security and unfortunately the analogy of crossword puzzles does not break down there.

Assuming that Alice is responsible to protect her user's data - and there is a comparison with Facebook, Google, and other companies which sell user data, here - Alice's responsibility is to take reasonable steps based upon the nature of the data she is protecting.

Until I started pointing this out on HN, my HN password was "hackernews" because there is nothing here that I really care about protecting, and in my opinion, nothing worth PG implementing complex password protection over.

<comment><USER7> My point is that the data she is protecting is not just the crossword data, but that it also includes _the users' passwords_. Protecting that data is always worthwhile, because those passwords are so frequently reused. This is not "security for the sake of security". It doesn't matter if the passwords are protecting the most unimportant thing on the planet, the _passwords themselves_ still need to be protected.

</comment></comment></comment></comment><comment><USER8> This is a great series of posts! a must read for every developer.

If anyone is wondering about the practical aspect of it, here is my interpretation: never use MD5, SHA-1 etc to hash passwords, they are too fast, anyone with a good GPU / dedicated hashing hardware can brute force short common passwords quickly (Carla), use bcrypt/scrypt or _at least_ SHA-256 with many iterations, and increase it every couple of years as hardware get's faster...

I would also add: salt your passwords with a secure random, and force strong long passwords, don't have "security questions" (they can be Googled / facebook graph searched easily), respond the same time for correct or incorrect credentials to avoid timing attacks, and note that whatever you do, if someone got their email account compromised, none of this will matter.

Thanks again for a very well explained set of posts, hope it will make our web a bit more secure...

<comment><AUTHOR> Your TL;DR talks about things I never said. I never discussed security questions or mentioned any hash algorithms by name.

<comment><USER8> I'm sorry, you are right, rephrased my comment, thanks for a great set of posts!

</comment></comment></comment><comment><USER9> I recall in a previous thread jgrahamc promised a single, illustrated document with this series, very much looking forward to that so I can hand it to someone like my wife and have her truly understand how this works. Thanks for putting it together, great series.

I could see a similar set devoted to explaining things like PGP or PKI

<comment><AUTHOR> Yes, I'm working on the PDF. I intend to leave the series up on my blog but charge a small fee (probably $0.99) for the illustrated PDF.

<comment><AUTHOR> And here it is: [http://www.lulu.com/shop/john-graham-cumming/a-non- mathemati...](http://www.lulu.com/shop/john-graham-cumming/a-non-mathematical- introduction-to-one-way-functions-and-their-use-in-securing- passwords/ebook/product-20976643.html)

</comment></comment></comment><comment><USER10> »And that is the current state of the art in password protection.« It is not really state of the art; storing passwords in plain text or hashing them are just by far the most common solutions. I think something like the Secure Remote Password protocol [1] deserves the label state of the art much more although it is not widely deployed.

[1] <http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol>

<comment><USER11> It's unfortunate that SRP is one of those _things_ that's technically sound and has been around for a fairly long time but has never seen widespread implementation for whatever reason. (See also: IPv6, SCTP, C99.)

</comment></comment><comment><USER12> But it still can be easily cracked by making less than 10 single step reverse lookup dictionaries and the time would be less than a few minutes.

<comment><AUTHOR> Yes, this is the point made here: <https://news.ycombinator.com/item?id=5551027></comment></comment>