French researchers to test nicotine patches on coronavirus patients - <AUTHOR> https://www.theguardian.com/world/2020/apr/22/french-study-suggests-smokers-at-lower-risk-of-getting-coronavirus <comment><USER2> Patches? Mightn't the protective effect come from the fact that smokers are inhaling poison into their lungs?</comment>


Emoji on Linux - <AUTHOR> http://probablement.net/txt/emojilinux <comment><AUTHOR> FWIW, the article is originally from 2015 but there are several recent updates at the bottom.</comment>


How can the Linux kernel compile itself? - <AUTHOR> http://stackoverflow.com/questions/494372/how-can-the-linux-kernel-compile-itself/ <comment><USER2> > How can the linux kernel compile itself?

Short answer: it can't. Each software system relies for its own existence on a predecessor, usually one of smaller scope. Sort of like biology and evolution.

When I wrote Apple Writer in 1978, there were no high-level development tools available, just a primitive assembler built into the Apple II BIOS. By making direct hand entries, I used the BIOS assembler to write a better, faster assembler that supported alphabetic labels. Then I used that assembler to write a better one, and eventually I had a development tool suitable for writing applications.

Linux development has relied on a similar bootstrap process, on a larger scale.

<comment><USER3> Just out of curiosity, have you ever written a book about the process of bootstrapping an Apple II development environment and the little discoveries you made? I would read that in a heartbeat.

<comment><USER2> > Just out of curiosity, have you ever written a book about the process of > bootstrapping an Apple II development environment and the little discoveries > you made? I would read that in a heartbeat.

Thanks for this suggestion! I write a lot of articles, but I haven't written much about that period, possibly because other people were writing it for me. But I think it might be interesting to write about that time, how we created software before we had access to high-level languages.

In the meantime, here's an old piece I wrote in those days, even though not quite what you have in mind:

[http://www.atariarchives.org/deli/cottage_computer_programmi...](http://www.atariarchives.org/deli/cottage_computer_programming.php)

<comment><USER3> The Atari Archives piece was part of what motivated me to ask about this. Another part is the series of books Jordan Mechner has released (in both print and electronically) about the development of Karateka and Prince of Persia. I've found that I enjoy following along the process of discovery almost as much as I enjoy the finished product. There is also a practical benefit: I gain more intellectual tools for tackling obstacles by learning the process others use to tackle obstacles.

</comment></comment></comment></comment><comment><USER4> If he thinks that's weird, then he ought to read Ken Thompson's article about trusting compilers.

[http://cm.bell-labs.com/who/ken/trust.html](http://cm.bell- labs.com/who/ken/trust.html)

<comment><USER5> While I love the story, it's really amusing to watch how it gets re-discovered on HN every few years, blows everyone's minds, and then gets quoted all over the place, even where it is only mildly relevant. This might be our "does glass flow" meme.

<comment><USER4> Seemed relevant to me. The question asked about compilers and the kernel is what compiled the compiler. Ken Thompsons' talk related to hiding code by adding code to a compiler then compile the compiler, remove the code then continue to compile the compiler with the modified version that doesn't have the source code - your modification remains.

Point being: both relate to compiling compilers.

<comment><USER6> > the kernel is what compiled the compiler

That's not what a kernel does...

<comment><USER4> Who are you quoting? Certainly wasn't me!

<comment><USER6> Uh, it was the parent comment - do a search if you can't find it on perusal. It's possibly taken out of context but I don't see a reading of the passage in question that doesn't include that sentiment. Could you clarify?

<comment><USER4> The parent comment? I was the top level commenter on this. Do you mean the article itself? It reads:

"The kernel is written in C, however how did the kernel get compiled without a compiler installed?"

And...

"If the C compiler is installed on my machine before the kernel is compiled, how can the compiler itself get compiled without a compiler installed?"

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is why I think more people should expose themselves to hardware design, CPU design, and compiler writing, if only at an abstract/academic level. I've worked with a lot of entry-level programmers, and even some that were not so entry-level, that wouldn't have a clue how to answer this question, which is quite depressing.

<comment><USER8> I'm not a programmer at all, and I found this answer quite obvious. Where else does new binary software come from, if not from a computer running older software?

<comment><USER2> It shouldn't be such a mystery, because it follows a biological model -- small, simple organisms produce more complex descendants by way of natural selection, all fueled by proteins. The same process creates complex software systems out of simple predecessors, all fueled by coffee.

<comment><USER9> The biological model also explains why people can get confused about it.

The chicken or egg problem shows that at some point you lose the connection to the predecessor and the process goes around in endless circles.

Then you might wonder how it ever came to be when the first thing depends on the second and the second depends on the first.

<comment><USER2> > The chicken or egg problem shows that at some point you lose the connection > to the predecessor and the process goes around in endless circles.

No, this isn't so. It's a myth about biology that's repeated by people who don't understand natural selection. An egg is a chicken's way to make an insurance salesman.

</comment></comment></comment></comment></comment><comment><USER10> Link to Ken Thompson, link to Quines and that one dude who always goes 'When I wrote Apple Writer...' \- all in the first few comments.. thread complete?

<comment><USER11> i'm still waiting for some way to tangentially connect this issue with NSA backdooring.

<comment><USER12> I guess you found one.

</comment></comment></comment><comment><USER13> This does make me wonder about something though: is there a crashplan for a compiler? Can a very minimal gcc be written which would be capable of bootstrapping the entire gcc compiler?

It seems like it would be relevant if a new architecture was developed at least.

<comment><USER3> If a new architecture was developed you could bring up the whole stack by cross-{assembling,compiling} from an already supported target. By doing so you could test the output using a simulator (or actual hardware) and then when the assembler/compiler is stable enough you could then cross-assemble/compile the assembler/compiler and then be self-hosting on the new architecture.

</comment></comment><comment><USER14> Another interesting thing to remember is that an embedded operating system (Android phone OS and software, for example) is likely being built on a PC set up with a cross-compile environment and not directly on the embedded hardware.

</comment><comment><USER15> The bootloader can compile linux before booting : [http://bellard.org/tcc/tccboot.html](http://bellard.org/tcc/tccboot.html)

</comment><comment><USER16> [http://en.wikipedia.org/wiki/Self-hosting](http://en.wikipedia.org/wiki/Self- hosting)</comment>


Linux Assembly How To: "Hello, World" - <AUTHOR> http://www.tldp.org/HOWTO/Assembly-HOWTO/hello.html <comment><USER2> > Linux is 32-bit, runs in protected mode, has flat memory model, and uses the > ELF format for binaries.

Well, that's a touch out-of-date :)

All the same, I do find it fun to see the set of articles recently trying to show modern programmers that assembly isn't as terrifying as people make it out to be. My own opinion is that, though asm tends to be a bit more verbose and tedious than other higher-level languages, it looks like it's also dramatically simpler in a lot of ways.

For examle, the Heavything[1] library from 2ton suggests to me that asm can still be used for high-performance applications today.

Good find and a fun read!

[1] [https://2ton.com.au/HeavyThing/](https://2ton.com.au/HeavyThing/)

<comment><USER3> Thanks for that, and a tip of my hat to the HN community. Love this place.

Having written the aforementioned, I thought maybe y'all would be interested in a very very lightweight version of same done w/ my assembler of choice (only because it reminds me of Turbo Assembler from way back in the day).

      format ELF64 executable
      _start:
      	mov	eax, 1		; syscall # = write
      	mov	edi, 1		; man 2 write arg1 == our fd, stdout
      	mov	esi, .msg	; "" arg2 == const void *buf
      	mov	edx, .msglen	; "" arg3 == size_t count
      	syscall
      	mov	eax, 60		; syscall # = exit
      	xor	edi, edi	; man 2 exit arg1 == status
      	syscall
      .msg:
      	db	'Greetings, HackerNews!',10
      .msglen = $ - .msg

I don't think it gets much clearer or simpler than that, and more so that "man 2 xxx" provides all of the information you need for syscall goods anyway, it really isn't that bad :-)

if you compile this with fasm ([http://www.flatassembler.net/](http://www.flatassembler.net/)) it produces a 174 byte ELF64 (and if we wanted to have some fun, we could lower that number by quite a bit still).

Cheers!

Edit: leading spaces for code

<comment><USER4> > and if we wanted to have some fun, we could lower that number by quite a bit > still

One of my earliest introductions to the ELF format was "A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux" ([http://www.muppetlabs.com/~breadbox/software/tiny/teensy.htm...](http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html)), which I still highly recommend.

<comment><USER3> This is a beauty, thanks for sharing! I second the recommendation.

</comment></comment></comment></comment><comment><USER5> Securitytube.net has some assembly 'megaprimers'

Linux: [http://www.securitytube.net/groups?operation=view&groupId=5](http://www.securitytube.net/groups?operation=view&groupId=5)

Windows: [http://www.securitytube.net/groups?operation=view&groupId=6](http://www.securitytube.net/groups?operation=view&groupId=6)

Some good resources here too [http://www.opensecuritytraining.info/Training.html](http://www.opensecuritytraining.info/Training.html)

<comment><USER6> Awesome resources. Loving the Linux videos so far. Great instructor.

<comment><USER7> Can't agree more, the description of the different registers was very clear for me.

</comment></comment></comment><comment><USER8> I tried out using x86_64 Linux assembly by writing a simple TCP echo server [1] after reading about the modern HTTP server in 64bit assembly [2]. Turned out to be not too much more involved than writing the equivalent in C, though very much at the cost of readability and development time.

There appeared to be relatively few examples of modern (well, 64 bit) Linux assembly out there, though quite a few relatively out of date documents like the one posted; documentation like the 64bit Linux System Call table were exceptionally useful [3].

[1] [https://gist.github.com/bobbo/e1e980262f2ddc8db3b8](https://gist.github.com/bobbo/e1e980262f2ddc8db3b8)

[2] [https://news.ycombinator.com/item?id=9948749](https://news.ycombinator.com/item?id=9948749)

[3] [http://blog.rchapman.org/post/36801038863/linux-system- call-...](http://blog.rchapman.org/post/36801038863/linux-system-call-table- for-x86-64)

</comment><comment><AUTHOR> I've been meaning to learn some assembly for a while, but never quite knew where to start. Then I found this handy guide to writing "Hello, World" in assembly on Linux. Just install nasm and follow the instructions here and you're good to go.

<comment><USER9> Alternatively you can cut/paste the GAS syntax and use gcc.

       gcc -nostdlib hello.S -o hello

This example uses the old 32-bit syscall invocation mechanism, which works fine under 64-bit Linux. It might be a useful exercise to try porting this program to the 64-bit syscall convention.

<comment><AUTHOR> _Alternatively you can cut /paste the GAS syntax and use gcc._

Oh, interesting. I didn't know you could do that with gcc. Thanks for the tip!

 _This example uses the old 32-bit syscall invocation mechanism, which works fine under 64-bit Linux. It might be a useful exercise to try porting this program to the 64-bit syscall convention._

I wasn't familiar with the difference, but some googling turned up this SO discussion which seems relevant. Maybe I will try making the change and see if I can get this to run with pure 64 bit code.

[http://stackoverflow.com/questions/8510333/x86-64-assembly-l...](http://stackoverflow.com/questions/8510333/x86-64-assembly- linux-system-call-confusion)

<comment><USER10> You can extract the differences by looking at my librt0 [0] project. You can also see a minimal amd64 version in C here [1].

[0] [https://github.com/lpsantil/rt0/blob/master/src/lib/syscall....](https://github.com/lpsantil/rt0/blob/master/src/lib/syscall.c)

[1] [https://gist.github.com/lunixbochs/462ee21c3353c56b910f](https://gist.github.com/lunixbochs/462ee21c3353c56b910f)

<comment><AUTHOR> _You can also see a minimal amd64 version in C here [1]._

Ah, that is very handy, and very illustrative. Thanks for sharing!

</comment></comment></comment></comment></comment><comment><USER11> Shameless plug for those looking to ease their asm dev experience in ST3

[https://packagecontrol.io/packages/NASM%20x86%20Assembly](https://packagecontrol.io/packages/NASM%20x86%20Assembly)

</comment><comment><USER12> I find these assembly demos that rely largely upon system calls lacking. I know much stuff cannot be done without system calls, but there's got to be a better "Hello, World" for assembly.

<comment><USER13> What would a "better" "Hello, World" for assembly look like?

<comment><USER8> Not necessarily "better", but lower level and without the use of syscalls: on bare-metal x86 protected mode, writing characters to "video memory" (from 0xB8000, normally).

[http://wiki.osdev.org/Printing_To_Screen](http://wiki.osdev.org/Printing_To_Screen)

<comment><USER3> IMO, bootloader/video memory is quite a distance from the traditional model of what "Hello World" is meant to be about, no? If anyone's interested, there are lots of very simple bootloader Hello World goods around:

[http://board.flatassembler.net/topic.php?t=17130](http://board.flatassembler.net/topic.php?t=17130)

</comment></comment></comment></comment><comment><USER14> If you wish to make an apple pie from scratch, you must first create the universe.

<comment><USER15> Mmm, universe.

</comment></comment><comment><USER16> $ nasm -f elf hello.asm

$ ld -o hello hello.o

ld: i386 architecture of input file `hello.o' is incompatible with i386:x86-64 output

$ nasm -f elf64 hello.asm

$ ld -o hello hello.o

$ ./hello

hello, friend

</comment><comment><USER17> Nice, wrote up one for OSX toolchain: [http://nickdesaulniers.github.io/blog/2014/04/18/lets- write-...](http://nickdesaulniers.github.io/blog/2014/04/18/lets-write- some-x86-64/)

</comment><comment><USER18> This makes me want to dig into assembly after all.</comment>


Colorectal cancer rates rising sharply among Gen X and millennials - <AUTHOR> https://www.washingtonpost.com/news/to-your-health/wp/2017/02/28/colorectal-cancer-rates-rising-sharply-among-gen-x-and-millennials/ <comment><USER2> I wish people would think twice before wishing for millennials to get ass cancer...</comment>


NASA's Juno to Soar Closest to Jupiter This Saturday - <AUTHOR> https://www.nasa.gov/feature/jpl/nasas-juno-to-soar-closest-to-jupiter-this-saturday <comment><USER2> I was glad to hear that Juno has a nice visible-light camera even though the it's not useful to the scientific mission. I'd prefer if 5-10% of equipment cost for spacecraft was always spent on popular-level pictures/video/sound. Studying details of the magnetic field of Jupiter is a good excuse to send a probe, and I'm glad there are a handful of scientists who devote their life to understanding it deeply, but we should acknowledge that those details will not provide benefit to 99% of the folks paying for it. (These missions can't be justified by the rearch; much more valuable science can be done on Earth for less money.)

<comment><USER3> I think it's important to realize that the budget is not 1:1 per person from taxes to spending. If hypothetically 50% of the population wants more drug research, 10% wants pure science, and 40% military R&D then using that breakdown for spending works. The real limitation is total spending and thus tax levels not how cash flows.

<comment><USER4> And as a reality check, Juno's total budget is on the order of $10^9 over six years. So roughly $200 million per year, or about one percent of Nasa's yearly budget, which itself is a bit over one percent of the US federal _discretionary_ budget (about a 1/300th of the total budget).

<comment><USER5> Or to compare with something concrete, that's enough money to buy about six KC-46 tanker aircraft for the Air Force, or about half the cost of the B-2 that was destroyed by faulty maintenance in Guam eight years ago.

</comment></comment></comment></comment><comment><USER6> Now, doesn't "soar" mean to go higher/farther? Maybe they mean that by soaring closer to Jupiter, Juno is going higher and farther from Earth?

I never thought I'd be this guy. Sorry... but the children.

[http://www.merriam-webster.com/dictionary/soar](http://www.merriam- webster.com/dictionary/soar)

<comment><USER5> One of the definitions in your link is merely "to fly aloft or about." Higher/farther is a common implication, but not a necessary one.

For the children!</comment></comment>


CyberChef – A Cyber Swiss Army Knife - <AUTHOR> https://gchq.github.io/CyberChef/ <comment><USER2> For those of you who don't know what GCHQ is, it's the UK's NSA with all the problems that entails -

[https://en.wikipedia.org/wiki/Government_Communications_Head...](https://en.wikipedia.org/wiki/Government_Communications_Headquarters)

"In 2013, GCHQ received considerable media attention when the former National Security Agency contractor Edward Snowden revealed that the agency was in the process of collecting all online and telephone data in the UK via the Tempora programme."

<comment><USER3> Other than the anachronistic name (thought "cyber" wend out in the 90's), I'm extremely impressed to see such an awesome tool come out of the public sector. Kudos to GCHQ!

<comment><USER4> > thought "cyber" wend out in the 90's

A year ago someone in my research group claimed that they were 'getting into cyber'. I looked around the room and almost every other member of the group looked confused and a little concerned.

Apparently 'cyber' has become a byword for 'cyber security'. I hope that this does not last.

<comment><USER5> The security group at work now fancies themselves as "Cyber Command".

We immediately began mocking them with a buzz lightyear graphic.

<comment><USER6> They might be interested in this:

[https://en.m.wikipedia.org/wiki/United_States_Cyber_Command](https://en.m.wikipedia.org/wiki/United_States_Cyber_Command)

<comment><USER7> Back in the late 90's on AOL, "cyber" was short for "cybersex."

</comment></comment></comment></comment></comment></comment><comment><USER8> This looks like a handy tool, certainly for puzzles and exploring encodings. It makes decoding puzzles like this very quick! 11100111 10111011 10011101 11100100 10111000 10001101 11100100 10111100 10011010 11100110 10010100 10111110 11100101 10111100 10000011 11100100 10111101 10100000

<comment><USER9> They need a "google translate" operator, and then a text to emoticon operator with a facepalm icon.

<comment><USER10> on the Mandarin step I went to the 'languages' tab looking for something similar to a google translate operator, so hear hear.

</comment></comment></comment><comment><USER11> Glad to see that CyberChef supports Numberwang. There are many nefarious uses that such a complicated numerical system could be put to. I'm happy that our intelligence agencies are on top of this.

<comment><AUTHOR> [https://github.com/gchq/CyberChef/blob/master/src/js/operati...](https://github.com/gchq/CyberChef/blob/master/src/js/operations/Numberwang.js)

 _/ / That's a bad miss!_

<comment><USER12> Wonder what the meaning of this email in the code is: email@example.com

<comment><USER13> Looks like it's one of GCHQ's developers: [https://github.com/n1474335](https://github.com/n1474335)

</comment></comment></comment></comment><comment><USER14> This is actually quite useful if you're doing day-to-day forensic work and are trying to de-obfuscate code or are creating proof of concepts.

The interface is really slick and it lets you create an infinite number of recipes/permutations.

String processing is much of what we do in security.

Yay for GCHQ. You'll find me at the bottom of this page due to an omission of obligatory IC bashing and Snowden fanboyism.

<comment><USER15> Man, you had a perfectly nice comment and no one would have downvoted you (and probably no one did), but I did just because of this:

> You'll find me at the bottom of this page due to an omission of obligatory > IC bashing and Snowden fanboyism.

There was no need, really.

<comment><USER14> Are you objecting to my opinion or that I expressed one?

<comment><USER16> From the site guidelines:

 _Please don 't bait other users by inviting them to downvote you or announce that you expect to get downvoted._

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment><comment><USER17> Though it doesn't say so, at a glance it looks like it's entirely browser- based and doesn't communicate with a server in any way. Pretty handy project. Code looks clean, too.

<comment><USER18> There's a download button at the top, though it just goes to the htm file, I believe you can just save that and use it fully offline as you mention! Good tool to have saved for sure.

</comment></comment><comment><USER19> It took me a minute to figure out that doubleclicking the actions in the left column is required to add them to the recipe.

<comment><USER20> Or drag-n-drop, which also lets you alter the sequence of operations.

</comment></comment><comment><USER21> Incidentally, at least one of the images comes from here: (and they're in violation of the attribution license).

[https://commons.wikimedia.org/wiki/File:Farm- Fresh_user_cook...](https://commons.wikimedia.org/wiki/File:Farm- Fresh_user_cook_male_white.png)

I wonder if that image has had many visitors ...

<comment><USER22> The graphics alone make me want to punch this tool in the face.

<comment><USER21> A kind of post-modern inversion of this: [https://www.youtube.com/watch?v=hn1VxaMEjRU](https://www.youtube.com/watch?v=hn1VxaMEjRU)

Also worth considering: [http://www.paglen.com/?l=work&s=symbology](http://www.paglen.com/?l=work&s=symbology)

</comment></comment></comment><comment><USER23> Neat project and slick interface! Does the gchq use this tool internally? Did you have a use case already in mind for this? This would be pretty useful as a web developer. A good idea would be to add a JSON validator.

<comment><USER24> I'm glad they're releasing this, but it gives me a slightly funny feeling. "Here, have this tool we also use to hack you!"

<comment><USER25> More like "Here, have this tool to distract you from our more powerful tools"

</comment></comment></comment><comment><USER26> [https://github.com/gchq/CyberChef](https://github.com/gchq/CyberChef)

</comment><comment><USER27> I'm trying something very simple and I can't figure out if the flaw is on me or on them.

1\. Take a base64 encoded payload as Input: "AAAAI9Dw0qHYq9+61/XPtJS20bTAn+yV5o/hh+jK8J7rh+vLtpbr". I use the "From Base64" module. 2\. The result is differential XOR crypt. The seed is 171. I select the XOR module and use 171 as the key. Then i pick "differential" option. Doesn't work.

Recipe: [{"op":"From Base64","args":["A-Za-z0-9+/=",false]}, {"op":"Drop bytes","args":["0","4",false]}, {"op":"XOR","args":[{"option":"Hex","string":"AB"},false,true]}]

Am I missing something? This is a very simple example.

The simple python code that decodes it is this:

def decrypt(string): key = 171 result = "" for i in string: a = key ^ ord(i) key = ord(i) result += chr(a) return result

string = "AAAAKtDygfiL/5r31e+UtsWg1Iv5nPCR6LfEsNGlwOLYo4HyhueT9tTu36Lfog=="

result = decrypt(base64.b64decode(string)[4:])

print "decoded: ", result print "Length: " , struct.unpack("I", string[0:4])

</comment><comment><USER28> Nice wysywyg security tool that will teach people concepts behind the interface. In my day we'd just use perl or python, but this opens up the field to beginners.

<comment><USER29> It took me a few years in my career to realize the interface usability is more important than the cleanliness of the code. As an engineer I loved my code and treated the interface like a second class citizen. After a bit of experience I realized the interface is what the user judges your code by. First impressions matter and the UI is your code's first impression.

</comment></comment><comment><USER30> oh look, the people who spy on the entire Internet are giving us free candy!

</comment><comment><USER28> Great honeypot as well. If a malware analyst dumps one of their intelligence agency canary strings from one of their spyware packages, they can use it to track the discoverer.

If I were a spook, I would totally be releasing reversing tools that alerted on my encoded code words.

<comment><USER31> That's why you fetch the ZIP from Github here: [https://github.com/gchq/CyberChef/tree/gh- pages](https://github.com/gchq/CyberChef/tree/gh-pages)

Then you download it, and open it in a sandbox VM with no Internet access

</comment></comment><comment><USER32> This is a very handy tool - very full in terms of features as well. I really like that you can drag and drop components and configure them in order to create a transform. Very nice!

Here is my attempt to make something similar although less featureful: [https://encoder.secapps.com/](https://encoder.secapps.com/)

I will try to incorporate some of these features.

</comment><comment><USER33> This is an interesting tool, and I'll happily use it for puzzle solving, but I'm concerned that it misrepresents itself in a dangerous way.

From the About link:

> "CyberChef encourages both technical and non-technical people to explore > data formats, encryption and compression."

> "It is expected that CyberChef will be useful for cybersecurity and > antivirus companies."

From the backing Github readme, which as far as I can see is not directly linked on the page:

> "Cryptographic operations in CyberChef should not be relied upon to provide > security in any situation. No guarantee is offered for their correctness."

Now, it's fair to say that professional security types should assume the 'no guarantee' bit. But it's _not_ fair to offer it up as a one-stop-shop for non- programmers to handle encryption tasks, and then offer no caveat at all in the primary reference page. It's even less acceptable when the About page implies the opposite.

<comment><USER20> Do you use nginx, chromium, bash, openssl, linux...? Because they all have disclaimers with more or less the same meaning. It's boilerplate to avoid liability, not warnings motivated by known shortcomings.

<comment><USER33> I'm aware, but I think I was unclear - that's what prompted my comment on professionals knowing this already.

My complaint was more that this is another entry in the pattern of handing people black boxes labeled "this does cryptography!", without offering any plain-English explanation of what they're actually getting.

It felt particularly important to me here because it's a comparatively new initiative, and the caveat went on the Readme (seen by users who already know) but not the About (targeting users who might not).

</comment></comment></comment><comment><USER34> Gaffer looks interesting: scalable Graph DB based on Hadoop.

[https://github.com/gchq/Gaffer](https://github.com/gchq/Gaffer)

The API seems a bit weird though...

<comment><USER35> >The API seems a bit weird though...

Oh my God, you weren't kidding.

</comment></comment><comment><USER36> This would make an intersting server-side service. I was hoping I could POST the json "code" and input, and get an answer in the HTTP body. Sort of a "Lambda 101" project.

</comment><comment><USER37> Thanks this is awesome. For some of this stuff I usually use the Python REPL. But why go through the hassle when it's all here for stuff like date time conversions etc..

</comment><comment><USER38> Trying to figure out the framework its built upon... Looks like vanilla JS. Nice work.

</comment><comment><USER39> Shouldn't it be _British_ Army Knife?

</comment><comment><USER40> Would be nice to "export as JS"

</comment><comment><USER41> As cool as this looks, not sure how this is any easier to use than a simple Python or Ruby script (or even Bash, if that's more your thing).

EDIT: In lieu of downvoting, would someone like to explain their disagreement? I'm curious. Perhaps this would open up certain programming powers up to non- coders, but for anyone who knows how to code, it seems much easier to just write a script to make these kinds of transformations.

<comment><USER42> I got -4 just for stating the same opinion, and found out your comment at the end of this page.

Since everything is really text here, the typical UNIX way of doing things seems to be much more practical in dealing text transformations here. I second your `Bash' opinion. I could imagine a package populate your PATH as

        PATH=DataFormat:EncryptionEncoding:PublicKey:…

and simply put nice little binaries, each of which does one thing and one thing only, and you can use them like,

        cat FILE | toBase64 | entropy

A nice interface of such thing in Haskell or APL would really shine. I bet GCHQ must have a much nicer internal library (which runs at a fraction of their machines' peak FLOPS) in one of their favorite languages that they can script and launch multiple tries by pushing a few buttons on their keyboard. And of course they are not sharing that.

Alas, point-and-click lovers seem to be the majority here on HN.

<comment><USER43> -4, that's a bit harsh. :-o

</comment></comment></comment><comment><USER7> Now run the entire site through the "cheferizer" and we can have the SwedishCyberChef!

</comment><comment><USER44> Why would anyone in the UK need these? They're gloating?

</comment><comment><USER45> Is there an accessible REST api? Would be neat.

</comment><comment><USER44> Can't wait for 13 December!

</comment><comment><USER46> Wish it wasn't food themed.

</comment><comment><USER47> Ah look, it even has snowflakes.

</comment><comment><USER48> What does it do? The about link does not gracefully degrade when JavaScript is disabled, which is bad design.

<comment><USER41> This is a web app, not a web page. It's not supposed to anything with JS disabled. It's an actual program that runs locally, without JS no can do.

As much of a problem as I have with web _pages_ using gratuitous JS, it should be obvious that actual web applications such as this and gmail will not be able to "gracefully degrade".

<comment><USER49> If it degrades into an announcement that "hey this is a JS-based SPA for doing <frob> and for more details see <baz>" that would be a good start.

<comment><USER50> That would be ideal for a web app like this.

</comment></comment></comment></comment><comment><USER51> GCHQ -- NSA without the ethics, answerable only to the King

</comment><comment><USER52> After just having watched Oliver Stone's "Snowden" last night it's hard to avoid wondering if there are any potential Snowdens in the GCHQ...

It's also a sobering thought that the people who wrote this stuff (seems neat) may be able to uncover my deepest secrets in seconds if they were so inclined.

And being geeks, I'm sure they read this. _gulp_

(As far as I can tell, github.com/gchq is from the actual GCHQ.)

This is mostly a job ad. Don't go there. It's not moral.

<comment><USER53> What do you mean by it's a job ad?

<comment><USER54> I think johansch means to say this is something someone should have made only to add to his cv or similar(not even fully sure) rather than something that people should use.

No one is telling the user what he should use this for, there's plenty of situations where you might want to convert/encrypt/elaborate data without being launch codes for nuclear missiles and this seems like a pretty good tool, all browser based too, opposite of many other more famous tools that require communication with a server.

<comment><USER52> I guess I should have been more explicit.

I am not talking about the actual encryption/decryption/data-wrangling stuff in this HTML page. All of this is obviously very neat and very usable.

The reason I do think this is a job ad is the fact that it's the GCHQ that is publishing it. Seriously, a spook agency is publishing neat open source stuff. I can only think of two reasons for this to happen and both align:

a) employee happiness (few people enjoy doing stuff in secrecy, I think)

b) using the by now well-established mechanics of corporate branding to make the GCHQ appealing to a larger amount of developers/hackers.

I think the latter is the dominant factor, and this is why I called this a job ad.

<comment><USER55> c) helping private companies maintain good security might be a good fit with GCHQ's mandate.

d)"Just-your-friendly-security-agency!"

<comment><USER52> ...right.</comment></comment></comment></comment></comment></comment>


Tulsa Race Massacre: This is what happened in Tulsa in 1921 - <AUTHOR> https://www.tulsaworld.com/tulsa-race-massacre-this-is-what-happened-in-tulsa-in-1921/collection_3763032b-1ecb-5203-b256-2ba1c370f6af.html <comment><USER2> You know what is nuts is that I first learned about this on Watchmen (the HBO series).

At first I was enraged, because I thought that liberal Hollywood made it up to stoke racial resentment. Then I looked it up and was even more enraged that it actually happened. Heartbreaking.</comment>


Ask YC: What kind of hours do all of you hackers work? - <AUTHOR>

I'm curious to know because I work in Honolulu for a new startup, and there aren't many of us down here. I actually "technically" work for two startups, so that makes it even harder because both of them need 110% percent of me and at this stage in the game its not possible to leave either of them (despite how, in any other circumstance, it would be better for both parties to give up on one)
Anyways, here's what my sleep schedule looks like.
Usually the weekends get my pretty screwed up, because I will be awake until the sun comes out. It's not the smartest idea because I'm actually not that efficient if my sleep schedule is constantly changing, but like I mentioned earlier, two projects means balls to the wall all the time and im having a hard time getting a grip on everything.
I tend to sleep for a while, generally forcing myself to get out of bed after 6 hours or so, then its back at it. During the work week (my real "job", the startup here in Hawaii) I tend to get in around noon every day or later, and then work as late as I can before heading home to work on the other project. Most of the people in this environment are 9-5'ers (or even worse, in Hawaii the city is alive and full speed ahead by 6am every day, and shuts down at 4).
What do you guys do up in the Silicon Valley? Are you more of the type that just work as long as you can, sleep for any amount of time, and get back at it? Do you try and keep a regimented schedule? I'm anxious to hear about all of this because sleep and time and all that is related is really the story of my life right now. hah. <comment><USER6> I started up two companies while still working a full-time job. Good luck, I know it's not easy, by far.

You gotta do what works for you and gives you enough time. I think a good approach is to figure out which part of the day is your most "high quality time", and be sure to work on your highest priority in that time.

For me, I found that morning was my quality time. After a whole day of working, I just didn't have the energy to _do_ stuff anymore. Since I had a strict 9-6 job in a bank/consulting firm, I had to put my quality time before that.

So, for 6 months or so, I woke up at about 4am every morning, then worked for 3 hours, then had a 1-hour nap, then went to work. I'd go to bed before 10pm (else I couldn't work the next day). Sometimes I had evening meetings for my second startup, just to keep things even busier.

The most important thing, I found, was actually to get the support of your friends/partner/etc. My girlfriend was really understanding and cooked dinner for me every evening (even though she hates cooking) and that probably saved me a precious 45 minutes every day. Makes a lot of difference when you're really overloaded.

Anyway, so, simple method: \- prioritise your startups \- allocate the quality time each day to your number 1 priority \- make sure your friends/family/partner support you 100%

Oh, re: constant/changing schedule, I kept a mostly constant sleep schedule, because otherwise I couldn't cope. So I woke up at 4am every day during the week - gave myself an extra 2 hours of sleep on the weekend by waking up at 6. Went to bed at 10 pretty much every night though, week and weekend.

PS: I should add I also took some Modafinil in the morning, that helped wake me up while still allowing a morning nap.

</comment><comment><USER7> I struggle to see how anyone can be productive at all working all your waking hours. The only result of that is going to be burnout or stress related illness.

I don't have or work for a startup granted, but when I am working on something hard, I reckon I have 5 - 7 hours a day in me and then I am just wasting time - it was the same studying for exams and my degree - I have never pulled an all nighter for an exam, but still managed to get the top grade - proper rest and relaxation are just as important as the working time - properly rested you will get far more done in less time too!

Oh and leave some time for exercise - that helps you productivity, stress and well being no-end!

<comment><USER8> DHH, the creator of Ruby on Rails, recently talked about getting more sleep. Too much emphasis, he said, is put on the superman mystique of the coder who codes 12 hours/day. We should stop bragging about how little sleep we get and instead wake up rested and productive.

"projects are not dependent on what happens in one day"

As a personal note, from experiencing this many times... once you get sick (which can be accelerated by lack of sleep + diet + stress), the wheels fall off everything (startup/coding? try getting out of bed)

<comment><USER9> In the 12 years that I've largely wasted as a professional software engineer, what I've noticed is that the best developers never work a lot of overtime for extended periods of time. Sure, it happens that they end up staying late to get something done now and then, but it's very rare.

The bad ones make up for taking the "shut up and code" methodology and spending hours and hours trying to get their pointlessly complicated solutions to work, rather than trying to do it right in the first place. The results, assuming they work, are almost invariably a morass of undocumented spaghetti code. It makes you wonder; what were they doing with all that time? If they weren't documenting their code, then the options are: a) they were faking it b) hunting for code that solves their problem on the internet to hide the fact that they couldn't write it themselvse c) wasting time debugging their own mess because they couldn't remember what the code they wrote last night at 11pm was supposed to do, but they were too tired and rushed to bother with little things like documentation

The let's work a 12+ hour day approach isn't how you get the job done, it's how you achieve job security when you work for a big company.

<comment><USER7> Yea, in the big companies, you would not believe how often I have seen someone 'recognised' and given great praise for being in the office real late pulling a release out of the fire - almost everytime it was that very person that put it into the fire to begin with - The ones that just got the thing to work and went home didn't even feature on the radar!

Sometimes I think the way to progress in a big company is to make a hash of things and then stay late fixing them - that doesn't compute with me though - they are bound to get found out at some point, right?

<comment><USER9> Sort of. Those are the ones that tend to get promoted to management roles and proceed to use the same reward system for the people who come after them.

In the end, you end up with a culture of long work hours because "that's how it's done" rather than for any rational reason.

</comment></comment></comment></comment></comment><comment><USER10> >I hate to advocate drugs, alcohol, violence, or insanity to anyone, but they've always worked for me. -Hunter S. Thompson

</comment><comment><USER11> Most days I wake up around 6am and go for a couple of dives, as I'm working on my Divemaster certification in the mornings. Great deal, if anyone's interested- you pay $700 for the course and get unlimited dives for as long as you're working on your certification, which can be dragged out to four months of diving every day. Plus, it's on a Thai island (Koh Tao), so cost of living is quite cheap. $200/month for a bungalow, and $1.50 for some incredible phad thai.

Get back around noon from diving, get some lunch, work until 2-3am. Likely too much, but in the early startup phase of doing a startup there's simply a lot of work to do.

As an aside, I don't really understand the whole weekend thing, if it's necessary to take a break from your day to day life then there's probably something wrong with your day to day life.

<comment><USER12> I'm actually interested in spending a few months in Thailand. Quit my job a few weeks ago so I'm going to be relaxing at first, then work on the first project I have planned while continuing to travel.

How's the internet access where you are? Do you ever do anything else than diving for fun? Found Ko Tao on Wikipedia and it sounds great, but I'd like to see other parts of Thailand too. Have you been around?

My e-mail is in my profile if you prefer that.

<comment><USER11> Someone else emailed me asking as well, I'm thinking I'll have to write a blog article on heading out here...

But yeah! Email sent. Short answer for those interested:

Internet access is... acceptable. I brought an Airport Express and upon arriving at the scuba resort here I just asked them if I could plug it in. They'd been hoping to setup wireless for a while but hadn't had a router, so they were fine with it. Voila, wireless. Problem being, it's usually 5-20kb/s, with my co-founder getting up to 200kb/s. I think it's because he has Wireless N to my Wireless B/G. Should have upgraded to a newer laptop before leaving, but live and learn.

Sure, hanging out and talking with friends at one of the beachside bars, going driving around the island and exploring, or reading/writing. I'm pretty easy to please when it comes to having fun, just give me a great conversation in a cool locale, whether that be a SF coffee shop, a BA tango club, or a Koh Tao beach, and I'm good to go.

Haven't been around, as of yet. Upon getting into Bangkok's airport I booked a domestic flight on over to Koh Samui and got there three hours after arriving in Bangkok. Koh Samui was a lot more touristy than Koh Tao, and in general just seemed to be developed too quickly. When I first got there I was amazed (beach! warm weather! jungle!), but in retrospect I prefer Koh Tao by leaps and bounds.

If anyone else has any questions, I'm not great about checking Hacker News comments, so feel free to hit me up by email as well, it's in my profile.

</comment></comment></comment><comment><USER13> I'm in Dallas but I thought this was an interesting question and I want to take part :)

I'm an early-morning riser. I have two kids[0,4] and a loving wife. I like to be finished with work no later than 6:00PM and usually closer to 5:30. I still have to work 12-14 hour days so I wake up at 3:00AM two days, sleep as late as I can on the third day. I do that pretty religiously although some weeks it's a 4:00AM wake up (or not at all). Sometimes I get burned out after a few months and then I'll just sleep until I wake up for a week of so.

<comment><USER14> Whatcha workin' on? I'm near Dallas too, always on the lookout for other geeks.

/me has wife and kids too

</comment></comment><comment><USER15> I am running a marathon, not a sprint, so I frame my long working hours within a "healthy schedule". My typical day:

      7:00 am - immediately start coding last night's plan, then email, headlines, HN
      8 to 9 - <USER2>
      9 - breakfast & internet
      9:30 to 12 - <USER5>
      12 - lunch & internet
      12:30 to 6 - <USER5>
      6 - dinner with family (home or restaurant)
      7 to 9 - <USER5>
      9 to 11 - computer off, pencil/paper, analysis, design, detail plan for tomorrow

Exceptions: one to two days per week consulting (still keep my night schedule), one day per week with family, occasional sports on TV. I could keep this up forever.

<comment><USER16> If you manage 10 hours a day coding and less than 1h day on email PLUS blogs/news, you are a pretty unique animal. We had a RescueTime group of YC Founders running during the Winter08 session, and I don't think anyone in the group EVER hit 10 hours of coding in a single day. Much less sustained it.

I'm also suspicious of the <1hr I see alotted for email _and_ news (all while getting 7000+ karma here?!). If that's the case, you are fabulously unique (I'm saying this with a database of data with millions of man hours of attention data-- lots of them from web developers).

Of course, maybe you mean what most people mean when they say "I'm coding", which is a distracted mishmash of IM, news, and email, with a light sprinkling of actual coding in there.

I hereby challenge you to use RescueTime for 1 week and then take a screenshot of your dashboard. :-)

<comment><USER17> _> We had a RescueTime group of YC Founders running during the Winter08 session, and I don't think anyone in the group EVER hit 10 hours of coding in a single day. Much less sustained it._

Can you please share what the maximum, median etc for this group was? I want to see where I stand.

<comment><USER18> I'll share my data. My max was 6.5 hours of coding. Since January, I've had 7 days where I spent more than 5 hours coding. My average (as given by the trendline) is about 3 hours/day.

Coding is my top (computer) activity on average. I spend about 45 minutes each on Reddit and news.YC; there's also a big long tail of time spent on untagged apps (often only 20 minutes or so each over the past half-year, but the total is nearly as much as Reddit + news.YC).

<comment><USER17> You are my A-List hacker :-p So, extra thanks for the data.

</comment></comment></comment></comment></comment><comment><USER19> I tend to cycle through different patterns, often depending on workload, season changes, etc. I'm currently up pretty much all night and sleeping in until noonish, and since I set my own hours I often just get done communication stuff during the day then work on programming at night, with some socializing in between :)

It can be challenging though, since staying up late can create a tendency to overwork, and often in a fairly unproductive way. I try to keep semi-balanced with a less-is-more approach. You don't need or want to code 12 hours a day. If I can do 6 hours I've had a really good day. If I get at least one good bit of work done, even if it took an hour to do, I'm happy with that. And that seems to be a realistic pace compared to other programmers anyway, in my experience at least. Not to say others are slow, I just mean that throwing more hours at a problem is often a lot like throwing more programmers on a project: there's a decrease in efficiency with each one added.

</comment><comment><USER20> Get sleep and stay healthy because that way you'll be the most productive

Some days I'll code away from 9-7pm, some from 10am-12pm because I'm just too tired.

Have a life, get sleep, and balance it all out. Think of how much you'll get done sooner if you aren't re-typing half your shit for stupid bugs you made on that 3am binge

</comment><comment><USER21> I've been keeping pretty close tabs on my hours for the past few months and find that I generally average about 6 hours of really focused and productive work per day. It's really hard for me to get into the productive zone so I might actually be sitting at the computer for 10 hours procrastinating.

<comment><USER22> I find that I am much more productive when I go do something else when I find myself wasting time on the PC. I'll come back refreshed and ready to go.

"butt-time" is the bane of my existence.

</comment></comment><comment><USER23> My schedule have this priority: day job - startup - sleep - fun.(besides programming)

Day job - 8 hours on weekday

Startup - 3 hours on weekday, 6 hours on weekend (minimum)

Sleep - 6 hours

Fun - unrestricted as long as I get my minimum hours for startup and sleep

Prioritizing works better for me rather than a schedule. I usually work on the startup longer but if anyone invites me to hangout No problem as long as I get my minimum hours.

</comment><comment><USER24> I'm working my full-time job and in my startup (along with a couple of personal projects) - and I was close to burn-out several times during the past couple of months.

I always have a flexible work schedule, but I usually start around 8-10 am and stop at around 8-10 pm :).

LOTS OF EXERCISE (jogging in the nearby woods)

And I'm definitely working on getting closer to 8-10 hrs per day ...

</comment><comment><USER25> this was good: creative/hacking/new territory time in blocks of 3 hours. Other blocks of time to clean up your SVn repos, hard drive, client accounting, whatever.

[http://abstractgeneratorfactory.blogspot.com/2008/06/working...](http://abstractgeneratorfactory.blogspot.com/2008/06/working- from-home-woe.html)

</comment><comment><USER26> I work 11 AM to 11:30 if the projects are uninteresting. I work 7 AM around the clock to 2 PM if the project is good.

</comment><comment><USER27> what's your startup in town? I'm in Kailua doing a not at all related to programming or hacking startup.</comment>


Two Years to Make $10 in Software Revenue - <AUTHOR> https://www.beamjobs.com/startups/2-years-to-make-10-dollars-in-software-revenue <comment><USER2> I think I understand that you've pivoted to selling a resume builder for data science workers.

It seems to me from your story that you could use some slightly more hard- nosed business sense. I won't pretend I know what you should do, but I do have a few reactions to your story and situation.

Building out a data science/ML jobs site that is trusted by ML workers is a good idea, and could be really valuable. One downside; it's such a large and competitive market that you will be competing with well-financed groups. But, it has a lot to recommend it, _not least_ that these workers are extraordinarily valuable to corporations right now.

I get that you want to aim at workers first for cultural reasons.

What I would do, immediately, as in today, would be to reboot your recruiting business and start getting set up with corporations who are hiring ML workers as a recruiter.

The problem you have right now is that you are charging the side of the two- sided ML jobs market that has no money; the workers. You should charge the side that is willing to pay up to seven figures for good ML workers.

Now, how do you keep your culture and values? There are lots of possibilities — you could keep charging the $10, but offer to forward the candidate to companies that match the resumé. You could make a 'transparency pledge' to the workers, as well as do revenue sharing with them.

You could build out the site into a trusted sort of glassdoor for ML workers where people (that you have vetted, I'd suggest) can anonymously tell others (and most importantly, you) which companies are good and which are bad.

At any rate, I'd strongly urge you to think about hitching up your economics to the side of the market that can get tens of millions of dollars of value out of the people you're working so hard to help — keep helping the people you want to; getting them a job is a lot more help than prettying up their resume.

And, congrats on the sale! It feels good when someone wants what you're selling :)

<comment><AUTHOR> Thanks a lot for the thoughtful feedback, it's much appreciated it!

Right now the resume builder is general purpose for people wanting to work in tech. We went down the path of charging companies for access to qualified candidates and the lesson we learned is that you first need a critical mass (which is bigger than we initially thought) to make it scaleable.

To get enough job seekers looking for a specific job in a specific location with a specific skillset with a specific number of years of experience (companies are very specific with what they're looking for) requires a large number of job seekers on your platform.

We want to start with a resume builder to provide value to these people at the first stage of their job searching process so we can then layer in more services and tools as we grow to that necessary critical mass.

Eventually, we intend for one of those services to be the forwarding to companies when the candidate matches what the company is looking for and vice- versa.

<comment><USER3> This feels like a good chance to do things that don't scale.

We write meaningful sized checks to recruiting agencies that look for people on LinkedIn and pitch them on taking our jobs.

<comment><USER4> A bit off topic but - how meaningful & do they just contact people on LinkedIn and that's it? I'm connecting good people with good jobs on the side, so fresh market info would be quite useful.

<comment><USER3> Somewhere between $10K and $30K per hire. They only get paid when we hire people they bring us. Some recruiters manage to negotiate recurring fees but I have nobody working under those terms at this time.

Recruiters try to build systems more robust than cold-outreach on LinkedIn but most of my hires in the past year have come from cold-outreach tactics. They have databases of candidates but most of that database isn't actually interested in a new job at any given time and it's as productive to work the database as it is to work LinkedIn unless the recruiter has a friendly relationship with a specific candidate. Regardless, you can't sell a candidate to multiple employers in any given 1-2 year period so you always need new candidates anyhow.

If I had more free-time I would totally try doing this myself. The hardest part is getting HR to let you recruit for their open roles.

</comment></comment></comment></comment></comment><comment><USER5> You will not like the path you are on.

\- Google Namedropping is annoying like hell and i have seen it plenty of times. You will not feel great if you need to bring that up all the time \- When i google for Resumes, resume.io is the first hit with ad and it cost 3$ \- When i go to your website, i don't even know that it is a paid product \- People really don't care that much about there resumes. I have seen probably 50 or more resumes. They just use the first thing on the internet or a latex template or a word template or they do it with a friend or with family or with a coworker \- Your webui actually is as cumbersome as all the companies who require you to apply through their webforms. It doesn't matter how your resume looks when you are looking for a job in a bigger and more known company because you will have to type that stuff in some webform again \- Recruiters exists and there are already recruiters who specizalize and are more edgy but you have to realise one big thing: You are entering this recruiter/hiring/resume market. That market is shitty for a reason.

At the end of the day, you are competing with customers which will never return. You have to build a product for this specific use case. If you are not in top 3 of Google Search results, they will not find you and they will not come back because they do not care for a resume after they got hired.

After they got hired and they might start using linkedin etc. recruiters will pester them and those recruiters will use their default templates and map whatever they are able to get into those default templates and no one cares.

I never cared about the layout much, i cared about the content.

<comment><USER6> this perspective is exactly right. I would be very interested to hear your thoughts on our resume software - [https://rezi.io](https://rezi.io)

<comment><USER5> When would i use your website?

The reason is simple: I need a resume.

Now what irritates me a lot is simple: Why would you offer a subscription?

I think you offer a subscription because you would like to have a self sustainable business. You were looking for something small to build and want to make money. Subscription means easy money.

But thats just wrong. I'm finding your webpage in the moment i need a resume. I need it now, i need one pdf to send to companies and thats it. I don't need it monthly and you spend resources in building something which doesn't fit my need

So how to make it better?

Think who would like to use you: a) a student -> money is tight, never wrote a resume b) someone who worked before and probably has enough money

This person needs to see in a glance how much it costs to get that resume, how easy it is and how it looks.

Your funnel needs to do this.

You need to tell someone 'you will create a super simple and smart resume and you will be able to download it at the end by paying 5$'. You can extend it after that person has created the cv with 'look if you pay now 20$, you can update your resume for the next 8 month and we also have 3 additonal features you can use'.

Then make it savable so that if that person, really should not have forgotten you when searching for a new job again, they are able to go to your website and continue where they left of.

<comment><USER6> Good points. We see our churn being pretty high as one might predict.

This year we starting selling the software directly to universities ([https://www.rezi.io/resume-management- system)once](https://www.rezi.io/resume-management-system\)once) this picks up a bit more - we plan on making Rezi completely free for job seekers. But reviews are solid, I'm baised, but I think this is the best resume software in the world.

</comment></comment></comment></comment><comment><USER7> The really useful lesson that I'd like to highlight here is:

In 2020, even if you're a smart hardworking person and enterprising and so on, it's surprisingly hard to make a buck, much less a living.

Now, if you've worked at GCP for 10 years as an enterprise architect and your books is like "insights into using GCP" \- that may not be very hard. You could make real money fast. But it took 10 years to get there, to accrue those credentials - essentially, to build your business.

10 years in, you might be able to make over 100k, on your business. But it took 10 years to lay the groundwork.

Now, of course, anytime anyone has an idea, it could be good, or bad. As a business, it could be a good business, or a bad business.

But seeing the forest for the trees here is recognizing that you're going to have to cycle through a surprisingly large number of ideas, and fight off a lot of other people who are trying just as hard as you are, in 2020.

<comment><USER8> Jeff Bezos: "All overnight success takes about 10 years."

Things that seem to have exploded onto the market overnight have almost always spent years building up under the covers

</comment></comment><comment> Brazilian-Sigma It's beyond me how two ex-Google engineers and graduates of top CS programs with 2 years on their hands end up creating a resume generator that a CS freshman could have written in their free time! Not putting you down or anything, sometimes unexpected random things jam your workflow (like unfamiliarity with front end design), etc.

<comment><USER9> Last time I was on the job market, I wrote a little CLI tool that given data in yaml format, spits out a pixel perfect pdf resume. It took me 2 hours and about 200 combined lines of Python, HTML and CSS.

While I wish the author the best of luck, I'm not sure resume builders for developers are a hot market.

<comment><USER10> There are qualitative differences in resumes. If they can sell theirs as giving you higher chances of success, that's worth something.

<comment><USER9> I've been involved in hiring since my very first dev job - not sure I'd trust a random resume builder more than my experience sifting through 100s of them. But I guess there may be some small market here.

</comment></comment></comment></comment><comment><USER11> Your time-line is remarkably similar to what I've experienced, I also quit my finance job to start a business with a co-founder in 2018 at the age 26. It's also an online product but quite different so it's hard to draw additional parralels but I can totally appreciate your up and downs along the way. It kind of sucks sometimes but for me it's also why I did this in the first place, so I don't look back in my mid thirties with kids and a mortgage and wished I'd did something more with my life when I still had that flame in me. Best of luck! However it turns out at least you took your shot when you had the chance, sometimes that's all that matters

<comment><USER12> > I also quit my finance job to start a business with a co-founder in 2018 at > the age 26. It's also an online product but quite different so it's hard to > draw additional parralels but I can totally appreciate your up and downs > along the way. It kind of sucks sometimes but for me it's also why I did > this in the first place, so I don't look back in my mid thirties with kids > and a mortgage and wished I'd did something more with my life when I still > had that flame in me

I'm not sure why people feel like they needs to make something in their early years before marriage/kids.

a lot of company started by people in their middle age because they spend their early years working in an industry, build up the knowledge and solved some of the problem they experienced.

[https://www.nytimes.com/2019/08/29/business/tech-start-up- fo...](https://www.nytimes.com/2019/08/29/business/tech-start-up-founders- nest.html)

<comment><USER13> Appetite for risk and energy both decrease with age.

<comment><USER14> Middle aged founders are the norm and more likely to take risks because they have financial backing and experience. They're also going to have been exposed to genuine opportunity, instead of a resume builder a college grad might think was a clever idea, and anyone else thinks is kind of a waste of time, as evidenced by the comments here.

It's always been the case, it always will be the case.

With the briefest of Googles you can even find out that's true even in the high-growth tech space:

[https://hbr.org/2018/07/research-the-average-age-of-a- succes...](https://hbr.org/2018/07/research-the-average-age-of-a-successful- startup-founder-is-45)

<comment><USER11> I think there's selection bias for success stories of both young and middle aged founders. For middle aged founders, I feel like the ones that you hear about, i.e. having worked in the industry for a number of years before spotting a good opportunity, also need to be fortunate enough to be in a position for all those things to line up as well. For me, I couldn't see that ever happening down my career if I stayed in my finance job, only being shackled to my job by the high pay. The opportunity cost of quitting gets worse as you become more senior. But who knows, I could be wrong. In my case it also made it easier that I didn't really like my job and that my boss was an idiot.

<comment><USER14> If you actually pay attention, you will see opportunity everywhere at your job.

Even if it's just copying your employer.

</comment></comment></comment></comment></comment></comment><comment><USER15> Feel a bit sad about the author but I suppose they did learn some useful things they were not aware before. As for resume builder, the market is extremely saturated, it peaked probably 4-6 years ago when quite a few people made some decent money selling fancy looking templates on Etsy or even rolled out dedicated websites for it. My advice for all aspiring developers- entrepreneurs is to spend less time on developer oriented websites like HN or Indie Hackers which are often just echo chambers. Go out and talk to people who do some completely different things and your eyes will open.

</comment><comment><USER16> I am honestly curious why, when you learned lesson 1 (Lesson: Don't quit your job too early), did you not apply it? Find a company in a completely different space, carve out your business in your contract, and work your job while you hone your product. In 3 to 5 years you may very well have a solid growing product, or not, but at least you won't be broke.

</comment><comment><USER17> At least they made it out of that first stage! Full-time employees get stuck in that stage all the time by just scheduling meetings but never actually getting any real work done that drives revenue. Looks like they were able to realize that meeting with people without a specific agenda and monetized path forward is usually just wheel-spinning.

By making that leap and going out on their own, they were able to accelerate that learning process and condense it to months rather than years (or never). Painful, but useful.

<comment><AUTHOR> It's a good point, I just wish I learned that lesson a bit quicker. I guess some lessons you have to learn the hard way.

</comment></comment><comment><USER13> Correct me if I'm wrong, but this business appears to be... A template? Like a word template, but the fields are separated so they're harder to navigate.

Why would I, as a customer, use this?

<comment><USER18> I could see the benefits if they integrated their current approach with what they used to do previously — fill out your CV and list your preferences, get a curated list of relevant openings. At that point however, they're directly competing with LinkedIn, Stack Overflow Jobs etc.

</comment></comment><comment><USER19> I've always thought that the talk to customers advice was bad as a starting point. If you don't have the domain experience to go to your first customer and say I built X and it solves your problem Y then I think you're barking up the wrong tree. Once you have customers it becomes important to talk to them for improvements. And when you have a product obviously you've gotta talk to people to sell it.

</comment><comment><USER20> I happen to be writing a book about writing a good developer resume - from the viewpoint of Google, Facebook, Netflix Uber and other tech company hiring managers and technical recruiters as coauthors and reviewers [1]. The book is in beta and I've not advertised it beyond one or two posts, and it's made over $2,500 in a month. So there is definitely some demand here, though I cannot tell how much.

The resume templates you have on site is pretty much the same, somewhat generic ones that profitable resume building sites like resume.io, EnhanCV or VisualCV have. They are not the best templates for hiring managers in tech - even though some candidates will be happy to pay for them, as they think it looks professional. Don't get me wrong: they will work okay, but there are far better ones, purely for optimizing for hiring managers.

Congrats on the sale, but if you are serious about the "resume for data scientists" direction, you might want to think about the market size, and if this what you want to do. All the resume services I know of cater for a much larger audience to make a profit - and, admittedly, this is one of their weakens.

On your site, right now, there seems to be little evidence why these resumes would have an advantage over e.g. the default Google Docs Serif or Swiss resume templates (which, the Minimalist looks very similar to). Selling one- off resumes might not be a fantastic business, or at least it would be a very one-sided marketplace. As someone else was suggesting, taking it a step further, and venture into you also connecting vetted data scientists with companies.

[1] [https://thetechresume.com/](https://thetechresume.com/)

<comment><USER21> At Standard Resume, we worked with hiring managers from several top tech companies and professional designers to make our templates that have been used by over 100,000 people. There are many factors that go into designing resumes, but the most important is always readability. If it's isn't easy to scan and read the resume, nothing else matters. The good news is that there is plenty of research behind text readability that can be applied to resumes. Having proper line spacing and adequate vertical white space are two of the most important.

I'm curious what you think of our tea plates, based on your personal research. [https://standardresume.co/](https://standardresume.co/)

</comment></comment><comment><USER22> Just a hint, a lot of engineers I talk to are desperately in need of career advice and they don't find a port of a call.

<comment><USER15> But are they willing to pay for it?...

</comment></comment><comment><USER23> With all these clever people coming up with products to solve problems only to have it not sell well makes me think the best idea is to just open a bodega or dry cleaners or something.

<comment><USER24> > products to solve problems

dry cleaner certainly solve far more problems for me than a resume builder.

</comment></comment><comment><USER25> +10 still pretty good for a tech company. At my last startup it took us 3 years to spend $7 million making $0 revenue.

<comment><USER24> You have to tell us at least what space it's in so someone will potentially avoid spending 7 more million on it.

</comment></comment><comment><USER26> I really appreciate posts like these that chronicle the challenges of pre-PMF life. Thanks for writing it.

<comment><USER27> What's PMF?

<comment><USER16> PMF = Product Market Fit

</comment></comment></comment><comment><USER28> Hmm, why is the $109k in revenue not counted? I'm a bit confused.

<comment><USER29> It was a manual process and not software driven, my understanding. Now, they have a software product.

<comment><USER28> Ah, I see, thank you.

</comment></comment></comment><comment><USER30> Making profit is like digging for water. Can use crystal ball or tarrot card or pair of sticks, as long as you are digging in the right spot where water is found - you'll make money.

Problem occurs when you dig wrong spot over and over.

For example, in Covid time I saw that people were printing face shields and other stuff, I quickly figured out that there will be major filament shortage in time to come and started creating filament: [https://medium.com/endless- filament/make-your-filament-at-ho...](https://medium.com/endless- filament/make-your-filament-at-home-for-cheap-6c908bb09922)

I made €7000 in less than a month.

</comment><comment><USER31> I'd like to see this article come 6 months from now with $1000 or $10,000 in revenue. $10 is great (especially after 2 years of lessons hard learned) but I wouldn't say $10 is a signal of easier or better things to come.

The next couple of milestones will likely be just as hard to hit if not harder. For your sake, I hope it is mostly hard work and not more pivots or learning.

Coming from someone that can appreciate every step of those past couple years for you and your brother. My brother and I similarly left salaried engineering jobs for the startup unknown. All the best!

</comment><comment><USER32> Great post, I enjoyed reading it.

I'm in a similar position with a product for people selling their homes. At this point I'm tempted to spend some money on advertising but don't know where to begin.

Have you tried ads at all?

</comment><comment><USER33> As a guy in a, eh, boutique software consultancy with an employee count of "myself" and no idea where my next project after the one I'm currently working on will come from (although I've had some interesting calls lately), I'm just here to support your efforts and say thanks for blogging about your experiences.

What's your stack? (Since I work with Elixir which runs on the Erlang _BEAM_ VM, I had to ask, lol)

</comment><comment><USER34> Congrats on launching something with your brother! That's my dream, I'm the backend guy, he's the frontend guy. :D

</comment><comment><USER35> So, basically you have figured that you will not be able to extract money from big corporations with deep pockets and you decided to go for the small fish, i.e. the job seeker. What a novel idea... If I had a penny every time I have seen this model repeat itself, I could probably buy the fanciest drink in Starbucks menu. I was hoping for a miracle solution to make companies pay for a novel idea, but nope.. No such luck. If you can not rob the rich, rob the poor. Move on... nothing new here obviously.

<comment><USER36> Business isn't a zero sum game, providing a service isn't robbing the poor.

</comment></comment><comment><USER37> Recruiting is a crowded space and for a tool that generates resumes, it must be hard to show the value prop. As a stupid example, even Google Docs and Word have a template for resumes....I bet a LOT of people use that and...done.

I can't believe how hard it is for you to acquire customers, I truly empathize and I am not surprised you only made $10 since April. I hope you guys make it, it seems like "bulletproof" resumes are a good way forward to help people have a higher chance at job hunting!

P.S. what about cover letters?

</comment><comment><USER38> >> it would take us 8-10 months to get our product to a place where it wouldn't require significant manual work to send quality job recommendations

Really wondering what's going into these recommendations? Seems it shouldn't be that hard. A job board with even a shard of understanding of technical preferences would be an improvement over the current status quo.

</comment><comment><USER39> I almost thought this article was sarcastic. It had all the elements of a "successful" founder. I was reading another article with lessons from the people, and I'll have to say, this is a great mission: help software engineers put their job search on autopilot. It's great that you learned a lot

</comment><comment><USER40> >"Finally, after bumbling around for 7 months I started to get somewhere with my conversations with hiring managers.

I honed in

 _the biggest problem they had time and time again when hiring technical talent: finding qualified people interested in applying for their roles._ "

</comment><comment><USER41> Just a heads up, the Page Title doesn't change when I navigate to a different page!

</comment><comment><USER42> Have you seen [https://jsonresume.org/](https://jsonresume.org/) ?

</comment><comment><USER43> Congrats on the revenue!

I would possibly be worried if revenue wasn't coming in faster that my product wasn't really a hit.

Perhaps you could consider a better angle or target a more specific audience? I like the idea of charging companies that need employees (they are always hiring) rather than job seekers that need a job (they are rarely looking).

Examples of good angles:

Key:Values [0] (1 person, ~$30k/mrr) matches job seekers with company values, levels.fyi [1] (2 people, ~$5k/mrr) matches job seekers with salaries, and there was a job board posted here for "old programmers" (don't know the link). KV and levels don't need a "critical mass" of job seekers, they need a critical mass of companies that are hiring, so it seems to me like a good angle plus a small pool of company profiles could be pretty effective for building a jobs business more rapidly.

[0]: [https://www.keyvalues.com/](https://www.keyvalues.com/)

[1]: [https://www.levels.fyi/](https://www.levels.fyi/)

</comment><comment><USER44> I clicked the link thinking the title said 10 million. haha!

</comment><comment><USER45> Nice! Congrats on the pivot

</comment><comment><USER46> I can't tell who their target market is. Sounds like it switched from B2B to B2C but maybe they don't think B2C can actually scale so long term it's B2B? The author writes with a level of irony and self-awareness but it feels like he just wants to give it his best and see what happens without a particular need to be successful. And maybe that's fine. But I'd rank this particular approach as low probability of success and low potential of profit given success has been achieved and jeez running forward with this with one year of leeway in this economy is a scary idea to me. The again I'd never run a start up so not my idea of a good time to begin with.

</comment><comment><USER47> I like the clean design of Beamjobs.com. Wish that was more common.

<comment><USER48> Blank white page when javascript is disabled.

<comment><USER47> Today's web needs Javascript. I think what you are looking for is Gopher.</comment></comment></comment>