Logjam TLS attack - <AUTHOR> https://weakdh.org/ <comment><USER2> My side project tries to give secure default settings for all major webservers and other software (like haproxy, mysql, mailservers etc): [https://cipherli.st/](https://cipherli.st/)

From the start it has listed the suggestion to set up >2048 DH keys.

If you want to test your site for export ciphers, you can try my other side project: [https://tls.so/](https://tls.so/) \- you can also use the SSL labs test but mine is faster for just testing ciphersuite. (And it's open source, so you can use it internally as well).

Mozilla also has a good wiki page for SSL settings: [https://wiki.mozilla.org/Security/Server_Side_TLS](https://wiki.mozilla.org/Security/Server_Side_TLS)

<comment><USER3> Any chance of adding STARTTLS support to tls.so? I've found a lack of decent tools to scan FTP servers, SMTP servers, etc.

</comment></comment><comment><USER4> This is not at all surprising; even I had pointed out the looming DH problem in an earlier thread: [https://news.ycombinator.com/item?id=8810316](https://news.ycombinator.com/item?id=8810316)

One small nit with the paper: it is claimed that there had been technical difficulties with the individual logarithm step of the NFS applied to discrete logarithms, making individual logs asymptotically as expensive as the precomputation. Commeine and Semaev [1] deserve the credit for breaking this barrier; Barbulescu did improve their L[1/3, 1.44] to L[1/3, 1.232] by using smarter early-abort strategies, but was not the first to come up with 'cheap' individual logs.

[1] [http://link.springer.com/chapter/10.1007%2F11745853_12](http://link.springer.com/chapter/10.1007%2F11745853_12)

<comment><USER5> It's not _particularly_ surprising to the IETF TLS Working Group either, which is at least partially why [https://tools.ietf.org/html/draft-ietf-tls- negotiated-ff-dhe...](https://tools.ietf.org/html/draft-ietf-tls-negotiated- ff-dhe-09) exists.

Minimum _2048_ bits, please note. 1024 is not safe - and has not been for quite some time. GCHQ and NSA can definitely eat 1024-bit RSA/DH for breakfast at this point (although it does still take them until lunch).

(Those of you still using DSA-1024 signing keys on your PGP keyrings should reroll RSA/RSA ones. I suggest 3072 bits to match a 128-bit workfactor given what we know, but 4096 bits is more common and harmless. 2048 bits is a bare minimum.)

<comment><USER6> > It's not particularly surprising to the IETF TLS Working Group either, which > is at least partially why [https://tools.ietf.org/html/draft-ietf-tls- > negotiated-ff-dhe...](https://tools.ietf.org/html/draft-ietf-tls-negotiated- > ff-dhe..). exists.

This draft /does/ encourages use of larger keys, but also encourages the use of common parameter groups. The weakdh.org site mentions the use of common groups is a reason for this attack to be feasible. It also advises sysadmins to generate their own parameters. To me, that makes using common groups sound like a bad move.

The problem is, I lack proper knowledge to assess whether using common groups really is a bad move, even when using larger group sizes... Anyone here who can?

<comment><USER7> Obviously weakdh has more up-to-date recommendations (public only a few hours!) so you should certainly _not_ cling to the _older_ ones published by IETF who-knows-when and which could have been influenced by the players who prefer the weaker encryption for their own benefit.

I don't understand why you would not believe weakdh recommendations? The researchers describe in their paper (1) exactly how they can precompute some values only once in order to then do fast attacks on any vulnerable communication. They proved that the common and too small values are _both_ dangerous. It's real. And it's definitely not "choose the one you like." Change both.

1) [https://weakdh.org/imperfect-forward- secrecy.pdf](https://weakdh.org/imperfect-forward-secrecy.pdf)

"Precomputation took 7 days (...) after which computing individual logs took a median time of 90 seconds."

<comment><USER6> I strongly believe in 'Audi alteram partem', and like to understand rather than believe. Hence my question.

For all I know, a few extra bits parameter length can make the NFS just as infeasible as generating own parameters.

Edit: re-reading my earlier comment I understand your reply better. I've expanded my question to 'even with larger group sizes', as it indeed is clear that it _is_ a problem with smaller groups.

<comment><USER7> The newly disclosed research clearly demonstrates that the common parameters enable "precompute just once, attack fast everywhere" whereas when everybody simply generates their own values that approach becomes impossible. The difference is between the days of computation versus the seconds in their example.

The difference is many orders of magnitude, it is if everybody everywhere can be attacked anytime or just somebody sometimes somewhere.

Moreover, the main reason why it should be done is that the expected browser updates won't block the sites with 1024 bits. So all the sites which for whatever reason still use 1024 bits won't be so vulnerable if they had their own parameters.

The practice of using the common parameters _already now worsens the current state._ The bad effects of the really bad move _already exist._ The common parameters are now _provably bad_ and _it won 't change_ in the future. Just don't use the common parameters. Generate the new ones everywhere.

And, of course, "minimum 2048 bits, please."

Edit: audi alteram... means "listen to the other side." Which side is the other side here? The stale information is not "the other side" it's just stale.

<comment><USER6> Thanks for elaborating.

The 'other side' are the people currently working on the negotiated-ffdhe draft (which I assume are bright people too). The draft was last updated a week ago (12 May 2015), so their considerations must be quite recent.

I'm just trying to get a sense of pros and cons. Iirc, generating own groups has its problems too. For example, the Triple Handshake attack ([https://www.secure-resumption.com/](https://www.secure-resumption.com/)) could break TLS because implementations did not properly validate DH params. Allowing only some (set of) pre-defined (known good) params would have stopped _that_ attack.

To be clear, I'm certainly not arguing for or against using common groups. Just trying to get a complete picture. (And yes, based on current information I think too that using unique groups is the right approach.)

<comment><USER8> The folks working on that draft have definitely become aware of this research. Soon we'll see what they have to say about it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Chrome will be increasing it's minimum DH group size to 1024 bits: [https://groups.google.com/a/chromium.org/forum/#!topic/secur...](https://groups.google.com/a/chromium.org/forum/#!topic/security- dev/WyGIpevBV1s)

But, if you need to spend the time updating a server configuration, just switch to ECDHE instead.

<comment><USER10> I suggest a 768 bit minimum for now, because of Java. As a side note, the latest IcedTea 6/7 release allow 1024-bit DHE but it is not enabled by default.

<comment><USER11> I say this as a Java developer who thinks Java is on the whole pretty decent: Java is way behind browser vendors when it comes to adding new ciphers and dropping broken ciphers.

Between the infrequent releases, the slavish devotion to maintaining backwards-compatibility, the sluggish release distribution, and the general conservative nature of some Java shops when it comes to upgrading, it's just not reasonable to expect the average non-java-using organisation to wait for Java before dropping broken crypto.

If you're running the latest LTS release of Ubuntu you'll get Firefox 37.0.2, released May 2015. But you'll still get Java 7, despite the fact Java 8 was released in March 2014. Giving you cutting-edge TLS1.0 and CBC ciphers [1]. And least Java 7 looks good compared to Java 6 [2] which has no SNI support, a stack of weak ciphers, and only supports the most obscure ciphers. And I know some people who are still running Java 6 in production systems.

If you wait for every last Java 6 holdout before deploying a secure configuration, you'll be waiting forever. Leave us behind, we'll only slow you down [3].

[1] [https://www.ssllabs.com/ssltest/viewClient.html?name=Java&ve...](https://www.ssllabs.com/ssltest/viewClient.html?name=Java&version=7u25) [2] [https://www.ssllabs.com/ssltest/viewClient.html?name=Java&ve...](https://www.ssllabs.com/ssltest/viewClient.html?name=Java&version=6u45) [3] [http://tvtropes.org/pmwiki/pmwiki.php/Main/IWillOnlySlowYouD...](http://tvtropes.org/pmwiki/pmwiki.php/Main/IWillOnlySlowYouDown)

<comment><USER12> I'd say best practices for Java shops should be to move the SSL termination to a proxy in front of the app server. This doesn't work if you're doing mutual TLS to authenticate users in your Java stack of course, and I'm sure there's a bunch of other use cases where you can't, and it would of course be ideal if Java could keep up with security. But given the state of the Java world, just drop in an TLS termination proxy wherever possible (nginx works great) and forget about doing it in Java.

</comment></comment></comment></comment><comment><USER13> Given all the vitriol on another front-page thread, I wanted to note from the site that "A close reading of published NSA leaks shows that the agency's attacks on VPNs are consistent with having achieved such a break."

I'm grateful to people who disclose and fix vulnerabilities instead of leaving everyone vulnerable, and kudos especially to Nadia Heninger from this team, whose work has only grown in interesting-ness and practical implications over the past few years.

</comment><comment><USER14> Why are export grade ciphers even still a thing. I can't believe that libraries are still shipped with implementations for those.

Also, scary that SSH appears to be partially affected(?)

<comment><USER15> _Why are export grade ciphers even still a thing._

Because all the countries still can't get along with each other, and thus export restrictions still exist.

[http://en.wikipedia.org/wiki/Export_of_cryptography_from_the...](http://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#Current_status)

<comment><USER14> Shipping breakable encryption sounds worse than shipping none at all. Especially when over and over again it becomes a source of vulnerabilities :(

<comment><USER16> > Shipping breakable encryption sounds worse than shipping none at all.

Well, yeah, that's the idea—"export-grade cryptography" essentially means means "cryptography we, as a state actor, can win against in a cyberwar."

<comment><USER17> But the GP's point seems to be that this seems to turn into

"cryptography we, as a state actor, can win against in a cyberwar, but which ultimately will end up being exploited at home as well, since we're all using the same partially broken code base"

<comment><USER16> Indeed; maybe it would be better named "export-only cryptography"—not for domestic use by order of COMSEC.

</comment></comment></comment></comment></comment></comment><comment><USER18> From the TLS sysadmin deployment guide([https://weakdh.org/sysadmin.html](https://weakdh.org/sysadmin.html)):

> Generate a Strong, Unique Diffie Hellman Group. A few fixed groups are used > by millions of servers, which makes them an optimal target for > precomputation, and potential eavesdropping. Administrators should generate > unique, 2048-bit or stronger Diffie-Hellman groups using "safe" primes for > each website or server.

Is this why with the easy-rsa package ([https://github.com/OpenVPN/easy- rsa](https://github.com/OpenVPN/easy-rsa)) one should always build a dh pair first? People are using pre-seeded ones when they do not use this tool first!? That is scary.

<comment> trimble-alum For OpenSSH, take a close, hard look at /etc/ssh/moduli (or wherever it's at) too, in addition to EC curves. I would consider deleting the default moduli and regenerating it.

[https://stribika.github.io/2015/01/04/secure-secure- shell.ht...](https://stribika.github.io/2015/01/04/secure-secure-shell.html)

In my mind, more generally: EC attempts to make crypto algos stretch using fewer bits but implementations are harder to prove both theoretically (by being more esoteric, therefore fewer eyeballs are able to catch errors) and functionally correct (by having more moving parts). Why haven't more conservative stretching / extension of proven algos happened?

Also, even more broadly, this and at lot of other crypto decisions in TLS come off as seat-of-the-pants, guesswork, cooking by committee rather than simple, feature-minimal and bullet-resistant standards (how many way over-engineered and over-featured encodings do certs need?). The result smells like a pile of poo that will get recall after recall, patch after patch until something about the inputs and decision-making process changes. We can't keep having OpenSSL and the TLS committee saying "yes" instead of "no" to (feature creep) throwing every little edge use-case live into production 1.x branch, the codebase is huge enough, and it's nearly impossible to compile out all the little used crap, even in forks. Doing the same thing and expecting a different result is either stupid or insane, or both. OpenSSL and TLS leadership, process changes perhaps?

</comment></comment><comment><USER19> This isnt exactly news but I guess a good site with a codename is needed to fix things nowadays.

Also, its nice and dandy to have postfix use SSL but SMTP TLS is always set to opportunistic and can be degraded to no encryption by a MITM - because, you know, compatibility.

<comment><USER20> DANE can at least partly mitigate this, though that assumes that you've DNSSEC set up, along with TLSA records for your mailservers.

Setting up DNSSEC is another kettle of fish, mind.

<comment><USER10> Yea, DNSSEC has its own problems. Personally I think a version of HSTS for mail is the best idea for now.

</comment></comment></comment><comment><USER21> I'm using Version 42.0.2311.152 (64-bit) Chrome, so far it's still vulnerable to this. I believe it's the latest production version.

<comment><USER22> I'm running Version 43.0.2357.65 (64-bit) Chrome, which is also vulnerable to this. I believe it's the latest production version.

<comment><USER23> 43.0.2357.65 (64-bit) as well (latest), says is vulnerable.

<comment><USER24> I'm on the unstable channel here (44.0.2403.4 (Official Build) dev (64-bit)) and even that seems vulnerable.

</comment></comment></comment></comment><comment><USER25> Seen many nginx tutorials omit a pretty critical (IMO) command before applying/reloading config changes: nginx -t.

nginx -t will quickly tell you if you've screwed something up before actually trying to apply changes.

<comment><USER26> `service nginx configtest` does the same thing.

<comment><USER27> That's good to know too, yes, but using the nginx binary itself to test is always available, whilst a service command normally involves an init script, systemd config file or similar to be available, and they can vary between packages and distributions.

</comment></comment></comment><comment><USER28> Is TLS_DHE_RSA_WITH_AES_256_CBC_SHA with a 768-bit group less secure than TLS_RSA_WITH_AES_256_CBC_SHA? Doesn't DHE just add an extra perfect forward secrecy layer to the non-DHE cipher suite without changing anything else?

<comment><USER8> If you can break the DH exchange in the DHE ciphersuite, you can recover the session key and decrypt the traffic. That can be a complete break of that particular session without any need to break the server's long-term RSA key. It's quite possible to have a situation where the TLS_RSA... used a 2048-bit RSA key while the TLS_DHE... used a 1024-bit (or worse) DH parameter. In that case an attacker could have an easier time breaking the 1024-bit discrete logarithm problem compared to breaking the 2048-bit RSA problem.

To answer your question more directly, the DHE does use a different form of key establishment which uses different algorithms, different parameters, and potentially different parameter sizes. The forward secrecy is a desirable property in itself, but under some circumstances implementations might use weaker cryptographic parameters in conjunction with it.

(Daniel Kahn Gillmor first told me about this problem; in TLS_DHE_RSA the RSA key is used for authentication of the DH key establishment -- to stop someone from doing an active MITM attack -- but not for the key establishment itself. In TLS_RSA the RSA key is used directly for key establishment. Thus when you use TLS_DHE_RSA, your security levels may be limited by the weakest link mechanism that you rely on for security, which could conceivably be the DH exchange, depending on other features of your configuration and environment. A number of folks have been aware of that particular problem to some extent for a while and even discussed it at, for instance, the IETF TLS working group, but this paper takes things considerably further and makes the problems really concrete.)

Edit: upthread you can find a link to pbsd and AlyssaRowan discussing forms of the problem half a year ago, including the fact that you can get less security from weak DH parameters than you would have gotten from strong RSA parameters, despite the presence of forward secrecy. In some settings there cost trade- offs are possible for attackers between breaking particular sessions vs. breaking all traffic to a particular service.

</comment></comment><comment><USER29> Looks like Amazon's EC2 ELBs have a common 1024 DH. I don't see a way to fix it without moving away from ELBs, or getting Amazon to fix it.

<comment><USER30> [https://forums.aws.amazon.com/ann.jspa?annID=3061](https://forums.aws.amazon.com/ann.jspa?annID=3061) > Today, Elastic Load Balancing released a new default SSL Security Policy that no longer includes Ephemeral Diffie-Hellman (DHE) ciphersuites. ELB offers predefined SSL Security Policies to simplify the configuration of your load balancer by providing a recommended cipher suite that adheres to AWS security best practices.

1\. Select your load balancer (EC2 - > Load Balancers). 2\. In the Listeners tab, click "Change" in the Cipher column. 3\. Ensure that the radio button for "Predefined Security Policy" is selected 4\. In the dropdown, select the "ELBSecurityPolicy-2015-05" policy. 5\. Click "Save" to apply the settings to the listener. 6\. Repeat these steps for each listener that is using HTTPS or SSL for each load balancer.

</comment></comment><comment><USER31> For those running IIS, I'd suggest looking at IIS Crypto [1]. NOTE: you will need a reboot after the change, and you may see issues with ancient browers (IE8, Android 2, etc).

[1] [https://www.nartac.com/Products/IISCrypto/](https://www.nartac.com/Products/IISCrypto/)

</comment><comment><USER32> So for a full test, I would recommend [https://tls.so/](https://tls.so/) or [https://www.ssllabs.com/ssltest/](https://www.ssllabs.com/ssltest/). But if you just want to check if your server has the logjam vulnerability, I would suggest [http://security.uwsoftware.be/logjam](http://security.uwsoftware.be/logjam). It just says No, Yes or Yes by the NSA (for 1024 DH keys). A little bit humour inside a scanner.

</comment><comment><USER33> For Nginx I think you can simply do !EXPORT to not support *EXPORT. There was a similar security bug which advised users to disable some EXPORT ciphers... correct me if I am wrong.

<comment> ryan-c nginx takes OpenSSL cipher specs, as does apache and a lot of other programs.

The `openssl ciphers -v CIPHERSPEC` command will list out what's enabled with a given setting.

</comment></comment><comment><USER34> Export grade ciphers have always been a blight on TLS.

I hope this is the last nail in the coffin to see the last of it disabled in the wild, you would have thought FREAK would have done the job.

</comment><comment><USER35> So a secure TLS client must refuse to negotiate DHE if the server uses one of the common DHE param values, like in case a Debian no-entropy private key used in the cert?

</comment><comment><USER36> So the NSA can break 1024-bit DHE? Is ECDHE good enough to hold us for now, or do we need to find an alternative to DHE ASAP?

<comment><USER37> Two parts to your question: 1\. Yes, the NSA can likely break 1024-bit DHE at scale - as well as 1024-bit RSA or anything smaller. (Probably also the RC4 stream cipher, if you didn't listen and are still using that.)

2\. ECDHE is totally different to traditional finite-field DHE. ECDHE over P-256 (or better curves) is not vulnerable to this attack.

<comment><USER38> Depends on what we mean by "at scale", right? That's why the shared parameter aspect of this attack is so meaningful: they probably can't solve 1024 bit DH problems "on demand".

<comment><USER39> If they can solve the 1024-bit DH problem "on demand" we should probably be eying 2048-bit DH with some suspicion.

(I'm agreeing with your point.)

<comment><USER38> Attacks don't really scale like that. If 2048 bit prime field discrete logs fail, all of prime field discrete logs (and with it probably RSA) will probably be done for.

There is, as I understand it, a huge performance penalty for using keys larger than 2048 bits. People should just use 2048 bit keys, or stop using conventional prime field public key algorithms altogether, is what I think.

<comment><USER39> Well, if they could crack 1024-bit primes in under a day, how long would you anticipate 2048-bit would last? That's why I said eye it suspiciously.

I don't think the NSA can do this on demand.

> People should just use 2048 bit keys, or stop using conventional prime field > public key algorithms altogether, is what I think.

I believe moving towards ECC (especially djb's work) is probably the right move.

<comment><USER38> Much much longer. We can reason about how an attacker with very large compute resources can break 1024 bit DH/RSA. Given the feasibility of a 1024 break, we can also reason about optimizations that would serve to make that attack deployable in the real world.

We can't do the former thing _at all_ for 2048 bit DH/RSA, let alone the latter.

Entities attacking 1024 bit keys are doing something we've believed would be inevitable for something like a decade.

When 2048 bit DH/RSA falls, DH and RSA will probably fall with them; they won't fall because compute resources eventually catch up to them, but rather because we discover something about integer factorization or discrete logs that makes prime field cryptography altogether unsafe.

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> At least JSSE Java uses random primes (generated at startup). However the Java 8 default of 1024 is rather weak (not to mention the 768 bit of java 6+7). Whats worse is, that clients accept down to 512 bit. (And the client side is harder to protect with ssl accelerators). But there is SunPKCS11-NSS as an provider.

<comment><USER40> I am wrong, no random primes.

</comment></comment><comment><USER41> Everyone should note that these TLS attacks may also work on EAP. i.e. WiFi authentication, or 802.1X. Since HTTP is so much sexier than EAP, no one pays attention to EAP. :(

<comment><USER42> I don't think the export ciphersuites are present in EAP ( [http://tools.ietf.org/html/rfc5216](http://tools.ietf.org/html/rfc5216) )

</comment></comment><comment><USER43> For clients, OpenSSL 1.0.2 introduced a function SSL_get_server_tmp_key() which retrives the ephemeral key parameters used by the server.

</comment><comment><USER44> Hackers have really lost their sense of humor. This would have been at the top of the page had I come up with this name: [https://www.youtube.com/watch?v=zZ- oafGPkqg](https://www.youtube.com/watch?v=zZ-oafGPkqg) (with an author name of Karl Hungus)

<comment><USER45> NSFW

</comment></comment><comment><USER46> " We further estimate that an academic team can break a 768-bit prime and that a nation-state can break a 1024-bit prime. Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18% of the Top 1 Million HTTPS domains."

We need a new web.

</comment><comment><USER47> Is there a support list somewhere for DHE >1024?

</comment><comment><USER48> Use a proper ciphersuite and stop worrying about downgrade attacks. [https://wiki.mozilla.org/Security/Server_Side_TLS](https://wiki.mozilla.org/Security/Server_Side_TLS)

<comment><USER14> Looks like it's not enough just to set a proper ciphersuite, it's also important to reconfigure the dhparams (which apparently isn't even possible in most common apache versions). Interestingly, Dovecot seems to have had the foresight to automatically regenerate dhparams weekly by default.

<comment><USER19> You mean like [https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handsh...](https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam) ?

<comment><USER49> From your link: _" Before Apache 2.4.7, the DH parameter is always set to 1024 bits and is not user configurable. This has been fixed in mod_ssl 2.4.7 that Red Hat has backported into their RHEL 6 Apache 2.2 distribution with httpd-2.2.15-32.el6. Future versions of Apache will automatically select a better value for the DH parameter."_

So I suppose he does mean like that.

</comment></comment></comment></comment><comment><USER50> just so you know

when TLS was committed to openSSL, the code used the vars 'payload' for []byte... not 'msg' or 'data'....

i wrote about it and some other facts and was downvoted to oblivion

another guy from the w3c team wrote an article "TLS is not HTTPS" but they are selling it as HTTPS, same name logo icon etc, and shipping it to the whole world, his post was removed also..

were heading towards a global root.

found the article: [http://www.w3.org/DesignIssues/Security- NotTheS.html](http://www.w3.org/DesignIssues/Security-NotTheS.html)

my take on the situation: [http://8ch.net/g/res/2200.html#2363](http://8ch.net/g/res/2200.html#2363)

<comment><USER50> TLS implementation has already had 2 serious show-stopping bugs if i remember. and heartbleed on top of that.

they were beginner crypto mistakes like reusing nonce/null nonce...

and the new logjam bug

keep downvoting guys the government needs you!

<comment><USER39> I suspect you're being downvoted for linking to 8chan.

<comment><USER51> And/or people aren't much interested in reading about variable names.</comment></comment></comment></comment>


For fun and profit: Data entrepreneurs size up Recreation.gov - <AUTHOR> http://fcw.com/articles/2014/12/16/for-fun-and-profit.aspx

<comment><USER2> > Big-name collaborators -- including Code for America, the Sierra Club and > REI -- joined Hipcamp to form Access Land ...

So it's an ideologue (CfA, a.k.a. Tim O'Reilly) and someone looking to gather more consumer data (REI), asking for mandatory commissions. (I'm not sure why the Sierra Club is involved.)

I don't see any real upside to "unleashing the power of markets" on a site to reserve fixed-price campsites on public land. It's not that complicated.</comment>


Would there be interest in an attachment manager extension for gmail - <AUTHOR>

Do fellow HN'ers feel there would be a need for attachment management in gmail/Google Apps For Domains (GAD) ?
Gmail/GAD has no method in which you can delete attachments. The only method I have found is to load the account into an IMAP client and manage attachments.
Many people abuse email for attachments.  This creates work for me to decide if I want to load the account into an IMAP client and manage the attached file by deletion, archiving, or otherwise.  Do I really need to save all the images that are forwarded to me by friends? However, there may be important textual information in the email that would prevent outright deletion.
Would there be interest in a plug-in/system that scanned incoming and outgoing emails, looked for attached files, removed them, sent them to a remote secure storage, and injected a link into the email.
Outbound messages would have a semi private link so the sender could access the file at all times.
Inbound attachments would be a password protected area only the account holder has access to.
With the current free amount of gmail storage, there should be enough storage, sans attachments, to last a lifetime.
I have not looked at the gmail/GAD API to know if this is even possible.  A service could do it, but would require the account holders credentials and timing of access could cause race conditions.
Am I filling a void that is not a problem, or is this indeed really a problem? <comment><USER2> I would not use it, and I am a heavy Gmail and GAfyD user.</comment>


Dungeons and Back Alleys: The Fate of the Mentally Ill in America - <AUTHOR> https://www.psychiatrictimes.com/couch-crisis/dungeons-and-back-alleys-fate-mentally-ill-america <comment><USER2> What a powerful piece, poignant in its prose.

 _The human brain is the most complicated thing in the known universe and keeps its secrets well hidden. Genetics and neuroimaging have shown how remarkably complex and interacting are the biopsychosocial causes of mental illness and that there will likely never be magic bullets. Drug companies have stopped looking for them._

This paragraph summarizes the issue of mistreatment of the mentally ill in the US perfectly:

 _Why is it that the rest of the developed world gets this and what makes us the laggard outlier? How can it be that the richest country in the world is most neglectful of its most vulnerable citizens? The simplest answer to this complicated question is the misplaced US faith that market forces are always the most efficient vehicle for solving problems. Adam Smith—the father of modern economics—knew better and strongly supported the role of government in providing vital public services undervalued by the market. Privatization of mental health has resulted in too much treatment for the well; cruel neglect for severely sick._

The path to improvement is a political one, lobbying the ones in power on behalf of our powerless mentally ill. We need to end their silent suffering.

<comment><USER3> >> The human brain is the most complicated thing in the known universe

Really? It is more complicated than the Orca brain? We aren't magic. The differences between our's and the brains of similarly-sized animals are slight. I'd say our brain isn't fundamentally any more complex than an ape's or a dogs. But if you want to compare numbers, Sperm Whales have 18-20lb brains, far larger and more complex than ours by every measurement.

[https://en.wikipedia.org/wiki/File:Figure_35_03_05_Brain_siz...](https://en.wikipedia.org/wiki/File:Figure_35_03_05_Brain_size_Vertical.png)

<comment><USER4> Correlating brain size to intelligence or complexity is a common amateur mistake. Let's for a second pretend all animal's brains are black boxes, and we can neither see nor measure them. Instead, let us say we can only judge brains by their impact on the world. Would you then not put humans so far above the other animals as to make it almost silly to compare?

<comment><USER3> >> can only judge brains by their impact on the world.

So bacteria? Plankton has a massive impact on the world too. Insects ... the planet is arguably dominated by insects.

Mammalian brains are, plus or minus a few percent, equally as dense/complex. There are aspects of dolphin brains that are far more complex than ours. A dog's brain has far more connections dedicated to smell than ours. There is some evidence that Orca brains have similarly more connections dedicated to emotions. Each brain is tuned slightly differently, ours perhaps more to vision and problem solving, but our biology isn't any more evolved or complicated.

</comment></comment></comment></comment><comment><USER5> The problem with deinstitutionalization and modern therapy is the assumption everyone can be treated. While that's more true than ever, a significant proportion of the mentally ill do not respond to medicine or therapy.

We need to bring institutions back for those we cannot cure. Jail has become the treatment center of last resort for those too dangerous to themselves or others, because we closed all the secure psychiatric centers. There's not enough room in jail either, and judges aren't keen on incarcerating people long term to protect them from themselves. So these people end up on the street.

Besides the drug addicts, of which treatment is also a problem in the US, this is why you see so many crazy homeless people.

Institutions might not be a "nice" place to live your life, but it's a hell of a lot better than living on the streets

<comment><USER6> _> Institutions might not be a "nice" place to live your life, but it's a hell of a lot better than living on the streets_

Given the choice between being locked up indefinitely in a quasi-jail with a bunch of crazy people or taking your chances on the streets, what would you choose for yourself? Are you certain?

We don't need institutions, we don't want institutions, we need properly funded community care. People with severe and enduring mental health problems do far better when they have a stable home, meaningful activity and a sense of autonomy. We can provide those things far better in the community. Long-term institutions only offer "out of sight, out of mind" for the rest of us.

<comment><USER7> By labeling the solution as "community care" you are really not proposing a solution: what are the implementation steps for your solution?

We don't need more money, we don't need more programs. We need an implementation checklist.

You see, we as a society need to take it step by step and adopt a scientifical method in dealing with this problem. The first step is to prevent the mentally ill and drug-addicted from being a danger to the community and to themselves. So bring back the institutions as that first step.

Then a second step, we need to identify groups of people that we decide to re- introduce with "community care", monitor their results and keep them accountable. Each one of them will most likely respond differently to different implementations of what you call "community care". Give it a time duration too, and observe the behavior. And so on.

Finally, there will be individuals fully re-introduced into society. There will also be individuals that need a little bit of extra effort to make that happen. But like with any group, statistically there will be individuals too dangerous that must stay in the institutions for their own health.

<comment><USER6> _> By labeling the solution as "community care" you are really not proposing a solution: what are the implementation steps for your solution?_

I'm not proposing anything new, I'm proposing the model that is used by most other developed countries and is being successfully used in some parts of the United States. If you think that "community care" is some vague pie-in-the-sky notion rather than an established approach to care with a proven track record, then there's very little point in continuing this discussion.

[https://en.wikipedia.org/wiki/Community_mental_health_servic...](https://en.wikipedia.org/wiki/Community_mental_health_service)

<comment><USER8> As a resident of the UK, I can state that community care is exactly the same ideologically-driven agenda with exactly the same real-world failings that are being ascribed to the US model. The only difference is that there are still remnants of a benefit system that provide some protection for the least fortunate, although the government is in the process of dismantling those as well.

<comment><USER9> It's a failure in most of Canada too, every successive provincial government decides to slash it's budget or 'reorganize' community care to the point it's just a weak pill dispensing model with no oversight and thus you get mentally ill in the street at all hours running wild with drug and alcohol addictions.

I think Andrew Yang style UBI is really the only solution, a guaranteed monthly living income that's illegal to take loans against or illegal to withhold because of debts. That or some kind of accountability where we are able to personally sue politicians who have turned our cities into poorly run asylums.

</comment></comment></comment></comment></comment></comment><comment><USER10> Large part alcohol and drug abuse can be attributed to self-medication. Alcohol is the most available tranquilizer and sedative. If you are homeless with mental problem, what else there is?

After the WWII many veterans simply drank themselves into grave because PTSD was not a thing and they could not get other help. [https://academic.oup.com/aje/article- abstract/109/6/687/1121...](https://academic.oup.com/aje/article- abstract/109/6/687/112124?redirectedFrom=fulltext)

</comment><comment><USER11> So... not to undercut the message of anyone who is trying to reform the catastrophically broken mental health system, but - there is a massive elephant in the room in this discussion, and that is trauma.

It is nearly inconceivable to me that a leader in the field, a guy who wrote an earlier version of the DSM aka bible of modern psychiatry, manages to talk about the pros and cons of meds but never mentions the experiences that are known to drastically harm mental health.

We don't need a "moon shot" as Dr. Frances suggests. At least in terms of expensive research into completely novel technologies or drugs to determine the root cause or treat much of this suffering. We may need a moonshot in terms of getting over our stigma around talking about trauma and abuse, so that trauma-informed care becomes the rule and not the exception.

The closest thing the DSM has to a trauma diagnosis is PTSD and complex PTSD. Dr. Bessel van der Kolk (author of The Body Keeps The Score, incredible resource on trauma) has proposed the diagnosis "Developmental Trauma Disorder" but this has not yet been widely adopted by mainstream psychiatry.

As far as I'm concerned, adding this single diagnosis and training mental health professionals to screen for trauma will do a lot more to help people than writing doomsaying articles like this one.

Source: grew up with developmental trauma from abusive family environment. Lost my little sister to suicide after her severe trauma was not screened for and was misdiagnosed as "bipolar".

</comment><comment><USER12> > It is hard to be complacent when 600,000 people who should be our patients > are instead languishing as prisoners or sleeping on streets.

Any success stories of decriminalizing — or normalizing given it's pervasiveness — mental illness?

One of the most poignant "policing" incidents I saw was at a Charlotte bus stop where the officer with compassion and humbleness was helping out a gentleman who was going through an episode — my lay person's interpretation. I don't know whether the officer had any training, but he was doing the best he could with whatever training he did have, in a way where the person, his meager belongings and his integrity were respected. So why do we depend on the kindness of police rather than mental health givers?

<comment><USER13> Americans don't treat it as a health problem, so the only public force with authority is the police force. There's no fire. There's no car accident. Is not in a national park.

We are cold isolated people.

</comment></comment><comment><USER14> I have been a regular visitor to the USA, and lived there for some time in between, and seen it over most of my life as a visitor. A time period of 45 years, almost.

Whenever I'm 'back in Cali', one of my favourite places to visit is Skid Row.

From here, you truly see what is rotten in the state of Kansas.

Of course, we can go to all of the major American cities, but there is nothing more sobering from the glitzy side of downtown than to go work in a soup kitchen, if they still have them, just a few short blocks away from the wealth.

It is a sad memory of America. But always an honest one.

</comment><comment><USER15> > Why is it that the rest of the developed world gets this and what makes us > the laggard outlier?

Has a lot to do with playing world police. A lot of this is tied to veterans with PSD.</comment>


At Gathering of Spy Chiefs, U.S., Allies Agreed to Contain Huawei - <AUTHOR> https://www.wsj.com/articles/at-gathering-of-spy-chiefs-u-s-allies-agreed-to-contain-huawei-11544825652 <comment><USER2> It's absolutely the case that they have been doing this for at _least_ 3-4 years already. I am personally aware of at least one case in Australia where the relevant authorities approached a major telco who were in discussion with Huawei for purchasing of next-generation wireless gear and told them in no uncertain terms - that if they did buy Huawei they may face issues having their license renewed.

Of course, for real security they should treat every device as compromised on arrival (ie. treat Cisco as just as bad as Huawei) and mandate heterogeneous multi-vendor infrastructure with aggressive anomaly detection, zero architectural SPOFs, and other defense in depth mitigations / failsafes.

<comment> barrow-rider The Australian NBN was taking tenders and explicitly booted Huawei due to questions about their manufacturing.

</comment></comment><comment><USER3> Amusing because US and Israeli manufactured technology has been proven to be backdoor'ed. And Silicon Valley has close ties to the American military, just as close as Huawei. Make no mistake about it. Allies today perhaps but as recent history has proven anything can happen.

The European Union has been sleeping on this. In economic warfare there are no friendlies.

<comment><USER4> As an European, I would still much prefer U.S. supremacy to Chinese one.

<comment><USER5> Yeah it seems obvious you accept from friends and minimize leverage in rivals. There's no good, only better.

</comment></comment></comment><comment><USER6> [https://outline.com/8psBrJ](https://outline.com/8psBrJ)

</comment><comment><USER7> I don't know what is going on, no factual basic for this, but I have a gut feeling that this is more likely economic warfare to try to contain China. No matter where telecom equipment is manufactured it should be tested for security flaws.</comment>


A Social History of Jello Salad - <AUTHOR> https://www.seriouseats.com/2015/08/history-of-jell-o-salad.html <comment><USER2> It's fascinating how it seems that the plethora of processed-instant food with little nutritional content in the US seems to have been caused by the fact that they didn't want to ramp down production. While I haven't researched it super heavily, I've always felt like the US has been in a long-term Military- Industrial complex, but never thought about how that would impact food/diet.

It's crazy to see just how much it's all connected.

>After the war, corporations that had begun producing instant and processed food products to feed the troops were in no rush to slow production. They'd profited on war contracts and were eager to continue their prosperity by bringing new innovations onto the market.

<comment><USER3> _> After the war, corporations that had begun producing instant and processed food products to feed the troops were in no rush to slow production. They'd profited on war contracts and were eager to continue their prosperity by bringing new innovations onto the market._

Am I the only one who is thoroughly incensed by this kind of thing?

<comment><USER4> Possibly? The US military needed to feed it's soldiers during WW2 on the other side of the globe. There were a lot of advances in food prepartaion, sotrage, and manufacturing that came about in order to do this.

What are the alternatives here? Either the government builds the factories and just shuts them down post war, or private companies can do it, in which case they've got a factory at the end of the war - might as well use it...

It's not as if these are factories for chemical weapons or warplanes - it's food..

</comment></comment></comment><comment><USER5> The whole bit about jellied foods being an aristocratic affair that requires a significant kitchen staff doesn't ring true. My family are/we're Eastern European serfs, and have always made these dishes. It requires little more than throwing bones in a pot and leaving to simmer a while. It's the same process as making stock or broth, just with more bones.

<comment><USER6> Sure, but as someone whose mother makes holodets for special occasions, it looks much different than the fancy colorful examples in the article - and our version (and probably yours) aren't "clarified" as the article seems to imply the fancy versions were.

</comment></comment><comment><USER7> Some vintage Jell-O ads:

[http://gogd.tjs-labs.com/table-view.php?product=JELL*O](http://gogd.tjs- labs.com/table-view.php?product=JELL*O)

<comment><USER8> Excellent resource! Found this one from 1942 in a search for sugar: "LIFE BEGINS ON DEXTROSE SUGAR". Scary stuff.

[http://gogd.tjs-labs.com/show- picture?id=1154476215&size=FUL...](http://gogd.tjs-labs.com/show- picture?id=1154476215&size=FULL)

<comment><USER9> Gesh, the tagline above it "The sun is the source of all energy... The energy of sunshine is crystalized in Dextrose Sugar"

</comment></comment></comment><comment><USER10> The Gallery of Regrettable Food: [https://news.ycombinator.com/item?id=17443593](https://news.ycombinator.com/item?id=17443593)

</comment><comment><USER11> Shortly after moving to the US in the late eighties, my mom signed up for a cooking class.

The first dish they taught was... savoury Jell-O salad.

She never went back.

</comment><comment><USER12> Seems like they're due for a revival.</comment>


Show HN: Codekeeper – Source Code Escrow for Developers - <AUTHOR> http://www.codekeeper.co <comment><USER2> Source code escrow is a great service, and one that ALL developers who do client contract work should look into. I've been creating bespoke software for business clients for nearly 30 years now as a one man business, and I have a clause in all my development contracts that stipulates should I pass on or my business ceases to exist, that full source code is released to my clients so they can engage another programmer to maintain those projects.

However, I do think the current pricing is quite high when given the expected timeframes that this sort of service can have. For example, I have one client where I have had their software in escrow with a local lawyer now for over 20 years! I believe my lawyer only charged me < $500 for the drafting of the contract way back then, and I've never seen a bill from him in 2 decades now for the CD of code that he has in his safe somewhere.

Mind you, that CD would be totally out of date now, with the incremental changes that I have made to the system over the years, and I have no real guarantee that the CD _is_ in fact still in a safe somewhere as I have not spoken to my lawyer about this in some years.

That's why I think that this Codekeeper service is a good thing, as it always ensures your latest code is available. But the drawback are:

1\. Is this service still going to be around in 10+ years? 2\. The cost per month is still quite high. Given my project I mentioned above, it would have cost me $11760 to date to have my source code in escrow. If I am going to be around for another 10 years, then that is going to cost me another ~$6000.

I could conceivably pass those costs on to my customers, but then that is another thing I have to track and ensure they are billed etc.

<comment><USER3> One of the issues is that responsibility for maintaining the integrity of the code is 100% on the seller's side. Like you said, if you used this service, it would become extremely expensive over the long term. Since the purpose is to give clients value in the case that you're unable to continue providing service, why not give them an encrypted version of the code and make the key the failsafe? There still has to be trust, but then the client gets to choose the cost of maintaining that code snapshot.

<comment><AUTHOR> You are right it's exactly the combination of ongoing snapshots and the need to only provide access when there's a verified release event. We try to provide that balance.

We also do verification, but that's mainly when there is 'less than optimal' trust between the developer and the licensee.

</comment></comment></comment><comment><USER4> Maybe I'm just a dummy but you should probably explain source code escrow as the first topic in your faq. I _think_ I know what it entails but Im making a lot of assumptions...

<comment><AUTHOR> Good point! We'll add that to the site. Thank you!

</comment></comment><comment><AUTHOR> We created Codekeeper so you can now easily comply with escrow requirements from your enterprise and government clients, and more importantly, to help you close deals with those clients quicker.

Being developers ourselves it's designed to keep your life easy and works in pair with Github, Bitbucket and the other SCM platforms.

We'd love to hear your thoughts and suggestions to make it fit even better inside your development or software business.

Cheers!

<comment><USER5> How are you guys planning on marketing this, if you don't mind me asking?

Are you using smart contracts to power this?

Congratulations on shipping this! It looks like a very compelling offering!

<comment><AUTHOR> Thanks!

Yes smart contracts are on our roadmap.

Marketing wise, we have several distribution channels that help us out at the moment. If you have ideas we'd be happy to hear them.

</comment></comment></comment><comment><USER6> Too expensive.

Make a source code release and encrypt it. Put it somewhere accessible to the customer, e.g. an S3 bucket owned by them. Arrange for the key to be given to the customer under the terms of the escrow agreement, e.g. send a letter to your lawyer with the terms of release and the key.

I can see value in having someone handle this for me, with a nice UI. It's fundamentally a clerical job, though, with some legal process / responsibility. So $50/month is already a fair amount, to say nothing of $1000.

<comment><AUTHOR> The ongoing deposits are the main issue which we automate for the client. Imagine doing what you describe for 50 repo's.

That would make you unhappy quickly. Also the lawyer would not do this for free.

I guess it's a matter of finding the right balance between cost and convenience.

</comment></comment><comment><USER7> The killer feature you should add is support for hosting an API, for trial usage. The escrow service would affirm that the trial API endpoint was produced by hosting a container on a given instance size.

The client then knows that the solution works and is runnable. The integration onus is then on the client, because the software has passed inspection before delivery.</comment>


Watching the "alpha geeks" - <AUTHOR> http://www.oreillynet.com/pub/a/mac/2002/05/14/oreilly_wwdc_keynote.html <comment><AUTHOR> you can also listen ~ <http://www.itconversations.com/shows/detail197.html></comment>


Ask HN: Which Firefox add-ons do you use? - <AUTHOR>

Just looking for some interesting firefox add-ons and was wondering what other people use. At the moment I only have add block. <comment><USER2> Abduction - Screenshot Utility <https://addons.mozilla.org/en- US/firefox/addon/3408>

Adblock Plus <https://addons.mozilla.org/en-US/firefox/addon/1865>

ColorZilla - Color picker <https://addons.mozilla.org/en-US/firefox/addon/271>

Coral IE Tab - View IEs rendering engine in FF <https://addons.mozilla.org/en- US/firefox/addon/10909>

Delicious Bookmarks <https://addons.mozilla.org/en-US/firefox/addon/10909>

Firebug <https://addons.mozilla.org/en-US/firefox/addon/1843>

Firefox Throttle - Bandwidth Throttling <https://addons.mozilla.org/en- US/firefox/addon/5917>

Firequery - Jquery addon for Firebug <https://addons.mozilla.org/en- US/firefox/addon/12632>

HTML Validator - Validate without having to go to the w3c website <https://addons.mozilla.org/en-US/firefox/addon/249>

Live HTTP Headers <https://addons.mozilla.org/en-US/firefox/addon/3829>

Long URL Please - Replaces Short URLs with the original <https://addons.mozilla.org/en-US/firefox/addon/9549>

MeasureIt - Screen rulers <https://addons.mozilla.org/en-US/firefox/addon/539>

Web Developer Toolbar <https://addons.mozilla.org/en-US/firefox/addon/60>

YSlow - Yahoo page performance analyser <https://addons.mozilla.org/en- US/firefox/addon/5369>

</comment><comment><USER3> The huge set of fabulous add-ons is the main reason why I don't even bother looking at Chrome. The addons make the browser, for me.

AIOS All In One Sidebar <https://addons.mozilla.org/en-US/firefox/addon/1027> Vast improvement over default sidebar.

Brief Rss Reader <https://addons.mozilla.org/en-US/firefox/addon/4578> Uses Firefox Live Bookmarks feature.

Delicious <https://addons.mozilla.org/en-US/firefox/addon/3615> Official addon from Delicious.

Download Helper <https://addons.mozilla.org/en-US/firefox/addon/3006> Easily download youtube videos, other media.

FoxClocks <https://addons.mozilla.org/en-US/firefox/addon/1117> What time is it, everywhere.

It's All Text <https://addons.mozilla.org/en-US/firefox/addon/4125> Edit any text field with your favorite text editor.

Tab Kit <https://addons.mozilla.org/en-US/firefox/addon/5447> Arrange and manipulate your tabs however you like, including vertically (nice for wide screen).

Text2Link <https://addons.mozilla.org/en-US/firefox/addon/6003> Right-click and copy the text of a link (rather than the URL).

Toolbar Buttons <https://addons.mozilla.org/en-US/firefox/addon/2377> Adds a shipload of extra buttons you can place on your toolbars.

Uppity <https://addons.mozilla.org/en-US/firefox/addon/869> Easily navigate up the hierarchy of the currently loaded URL.

URL Link <https://addons.mozilla.org/en-US/firefox/addon/403> Select non- linked plain-text URL and open it as if it were linked.

User Agent Switcher <https://addons.mozilla.org/en-US/firefox/addon/59> Control which user agent (browser) your browser reports itself as.

WebMynd <https://addons.mozilla.org/en-US/firefox/addon/6416> When Murdoch and Microsoft succeed in Balkanizing the web, you'll use something like this to aggregate search results from different places. Works great for searching HN.

</comment><comment><USER4> Firebug: <http://getfirebug.com/> \- The single best add-on for Firefox I have installed.

</comment><comment><USER5> Firebug

Web developer toolbar

Selenium

Colourzilla

Measureit

Delicious bookmarks

Diigo bookmarks

Accessibility Extension

HTML validator

Pencil

Fangs

Adblocker

Inline Code Finder

Chatzilla

Screengrab

</comment><comment><USER6> AutoAuth, DOM Inspector, Feed Sidebar, Firebug, FireFound, Links Like This, OPML Support, ScribeFire, Tab History, TubeStop, TwitterBar, URL Fixer, and YouTube Comment Snob.

Of course, I'm biased towards most of these, because I'm the author of all but DOM Inspector, Firebug, and Tab History.

</comment><comment><USER7> I have several add-ons installed but the only one I actually care about is TagSifter. It isn't available for 3.5 yet, but it's the only way of managing bookmarks I've found that makes any sense to me. It combines the ideas of folders and tags in a very nice way.

</comment><comment><USER8> Apart from the obvious (webdev bar, firebug, adblock, etc), I find HTTPFox (<https://addons.mozilla.org/en-US/firefox/addon/6647>) to be invaluable.

</comment><comment><USER9> Pearl Crescent Page Saver

HTML Validator

Adblock

Web Developer Toolbar

Firebug

Flashblock

Noscript

Greasemonkey

Firecookie

PDF Download

</comment><comment><USER10> View Cookies Tab</comment>


My Fully Optimized Life Allows Me Ample Time to Optimize Yours - <AUTHOR> https://www.mcsweeneys.net/articles/my-fully-optimized-life-allows-me-ample-time-to-optimize-yours <comment><USER2> So, I just looked up 'Tibetan singing bowl alarm clocks', 'alternate nostril breathing', 'gratitude journaling', 'bulletproof coffee' and 'intermittent fasting'; and they are all apparently real things...

</comment><comment><USER3> I don't get it seriously, this lady has too much money, only helps herself and others who fund her addiction to premium and unnecessary products. She has a highly inneficient life basically focused on fads and things sold to people as scams. She and her husband don't communicate enough. She has a psychological condition that allows her to feel empowered and with this inneficiency. She convinces others with unusual amounts of money in a cult like fashion to buy her product. She continues to profit, and she brags about this pyramid scheme that she isn't even at the top of.

<comment><USER4> (Psst...it's satire!)

<comment><USER3> Gosh thanks I was blown away

<comment><USER5> I believed it at first, started to have serious doubts around the seven mixers.

</comment></comment></comment></comment><comment><USER6> My favourite line:

> After years of research, I have engineered the most efficient possible > workout, which is a single, 100-pound kettlebell swing, followed by four and > a half minutes of foam rolling.

<comment><USER7> So many great quotes in there

> To make cleanup more efficient, I have seven Vitamix blender pitchers, which > I clean all at once on Sunday evenings. Best $1200 I've ever spent. So much > time saved.

> We have also adapted our own version of the Nonviolent Communication > protocol, which allows us to express all of our needs, feelings, fears, and > experiences from the day in a loving exchange of five sentences each. (To > learn more, check out my husband's wonderful book, The Four Hour > Relationship.)

Edit: hard to single out the best among many!

</comment></comment><comment><USER8> I'm surprised so many people are missing the satire here.

Very funny article. In a modern world focused on the self, this is what you eventually get. Our lives are too comfortable.

<comment><USER9> It should have been obvious when there was no link for the ebook.

> which keeps me in ketosis until I break my intermittent fast

Also ruined the suspension of disbelief. I don't think you can enter and exit ketosis daily, in under 24hrs.

<comment><USER10> This is the 12-parsec problem. Jokes that work within the reality of their subject matter work. Jokes that have to go however slightly out of the reality of their subject matter to work, never work for the people you would think would most like them. Star Wars was cooking along making all its little references to Flash Gordon and so forth and then along comes this line of dialog that was not even meant as humor, whose only obvious reading is a complete misuse of the word "parsec" [1]. Which practically the whole audience had a problem with. (I want to say "literally the whole audience" and this here is how I'm trying to get away with it)

I have only once successfully told a joke to a medical professional that had to do with medicine. I make a lot of jokes that are meant as satires of ignorance, and that audience always just wants to correct the ignorance (which is a good thing).

[1] The line is technically using the word correctly but you have to know 40 years of Star Wars lore to know why.

<comment><USER9> Well put. I usually think of "The Big Bang Theory" as an example of this taken to the extreme.

> The line is technically using the word correctly but you have to know 40 > years of Star Wars lore to know why.

That Han skirted closer to a black hole than anyone else, and that's why a unit of distance is appropriate? But I'm not sure if I've ever seen a canonical source for that, it's just fan rationalization :)

I suppose it's better than the "Han is trying to brag, but he's an idiot" rationalization, which is a bit hard to swallow considering he's otherwise a fairly capable pilot.

<comment><USER10> > it's just fan rationalization

FWIW I had found a source[1] that said George Lucas gave this rationalization on the Blu Ray commentary track. I found it by a search on "12 parsec Kessel run". Is this a retcon-level waving away of a groaner after the fact or what GL was actually thinking when he typed the line?

[1] [http://starwars.wikia.com/wiki/Kessel_Run](http://starwars.wikia.com/wiki/Kessel_Run)

<comment><USER9> > Is this a retcon-level waving away of a groaner

That would be my guess, considering that it's a bit too hard-sci-fi of an explanation to fit in with the space opera writing of Star Wars.

It doesn't really matter, I guess, because the commentary would make it canon. Today I leaned; thanks :)

</comment></comment></comment></comment></comment></comment><comment><USER3> Sounds aweful, the absolute worst. Wow

</comment><comment><USER11> This is great. I've got some relatives that love this garbage and there's things in here I hadn't heard about. I can picture the author being totally surrounded by this shit :)</comment>


What I Learned from Working 32 Hours a Week - <AUTHOR> https://spin.atomicobject.com/2019/01/04/32-hours-lessons/ <comment><USER2> I've often felt that a 5 day work week is about _availability_ , not raw productivity. I could easily compress all of my weeks work into 30 hours or less, but that's not what my managers and clients value. What they value is the fact that I'm making progress on my tasks, and that my reachability is not preventing anyone else (people above me or below me) from making progress on their tasks

<comment><USER3> That's what i notced with my friend in the managerial position. He can spend most of the time in Work From Home mode, has really good pay grade, and can't rest. He's looks like he's on a wrist band leash getting mails every 2-3 minutes and needs to somehow react on 10%.

He doesnt do much other than be available 12-16h 6-7days a week. It's taking more toll than one would expect.

<comment><USER4> I could never understand why would someone accept these jobs. What's so great about becoming a manager and work 60h/week? How's that better than 40 a week as a subordinate and letting someone else worry about all the office drama?

<comment><USER5> It's just a different set of skills and you create value/feel rewarded in a different manner. It's not better or worse, it's just different and appeals to different kind of people. Take some other example from video games:

\- Why would anyone pick a healer in an MMO group ? What's so great about becoming a healer ? How's that better than playing a DPS, actually contributing to killing the boss and letting someone else worry about your health bar ?

\- What is fun about plying support in DOTA ? I mean the fun is being the carry and killing everyone on the other team to win games ? How can anyone willingly waste his gold to buy visibility wards, that is really not fun at all.

The healer/support/manager (="helper") position appeals to people who like to focus less on the pure "productive" task at hand. They like to focus on getting a full picture of everything that is happening, anticipating potential issues, fixing them, and allowing the DPS/carry/engineer (="producers") to be in the best possible position so they can perform their job. This can be fun for some people even if you don't see it that way. This often is really not an easy task. This often is critical for the success of the team.

And just like there are good and bad "producers" there are good and bad "helpers". The skillset is different, the measure of value creation is different, and the fun is different.

<comment><USER6> Also healers get placed in the dungeon ASAP - high priority because there are so few. I play a tank, and feel similar status effects.

I want to know the analogy of healers that rage quit (they do so more than DPSs or Tanks) with the entire manager/subordinate thing ;)

<comment><USER7> Easy. 50% of devs promoted to management go back to dev within 12 months (or so I keep hearing).

</comment></comment></comment></comment></comment></comment><comment><USER8> We've been doing 4-day/32-hour weeks at Wildbit for over a year now, and it's been great. We're a remote-first team of just under 30 people spread across quite a few time zones. It's a mental hurdle at first, but the company has continued to grow and be as productive as we were before.

We're all just much more mindful of how we each spend our time these days. We also strive to reduce meetings and lean more on asynchronous communication in order to reduce interrupting each other. That lets everybody focus more and get more high-quality work done in fewer hours.

Our initial write up: [https://wildbit.com/blog/2017/05/31/experimenting- with-a-4-d...](https://wildbit.com/blog/2017/05/31/experimenting-with-a-4-day- work-week)

The follow up with what we learned and what we adjusted: [https://wildbit.com/blog/2017/10/19/4-day-work-week- update](https://wildbit.com/blog/2017/10/19/4-day-work-week-update)

</comment><comment><USER9> Programmer here. I worked on a 4-day week for about a year between 2017 and 2018 for a small consultancy company.

The company needed the help of a senior developer but could not afford a competitive salary, so I offered to take a pay cut along with an extra day off each week. Of course, I was flexible in case my day off needed to be moved around for something important, but that almost never happened.

Thursdays were my off days, and I think this actually boosted my productivity. Aside from what other comments already mentioned about making better use of your time, this setup allowed me to return every Friday recharged and with some fresh perspective and ideas about my current tasks.

The quality of life improvement was great, and my work did not suffer at all. This makes me wonder: if working 32 hours/week can make you more productive than working 40, why the hell do people often put in way more than that?

Sounds like working 80 hours/week would create almost as many problems as it would solve, leaving you with some very questionable "progress". The only way I can imagine doing this is if you do two or three separate jobs, e.g. coding, design and marketing, so you don't get tunnel vision.

<comment><USER10> > This makes me wonder: if working 32 hours/week can make you more productive > than working 40, why the hell do people often put in way more than that?

I work in a very competitive field, and there are times where I must put in 12- to 16-hour days to ship a project out on time. We get compensation days in lieu of ovetime pay, which has its pros and cons.

<comment><USER9> I've been in a similar situation in another company, where the whole team was working 12 hour days for a week or two to meet a deadline, but those didn't really feel productive... and the project ultimately failed. I believe it was mismanaged, which caused the overtime in the first place and made all those extra hours not worth it.

On the other hand, I've heard lots of stories like yours, where the project was only possible due to the pure grit of everyone working on it. Most of those stories were in game development, which seems at least twice as chaotic as regular software development.

</comment></comment></comment><comment><USER11> I've recently started taking vacation in half-days. I have some flexibility to work remotely, and I've taken a couple of weeks away -- staying in an airbnb with friends, we work short days and go hiking or whatever in the afternoons. It's marvelous, and beneficial to my mental health.

This winter, I had an excess of vacation, so I took 3 weeks half-off. With only 4 hours, I find myself very focused -- I'll set a reasonable goal, and stay on track for the full time. At the end of my work day, I've accomplished one or two tasks; I feel good about what I've done and still have energy and time to take care of personal business. At the end of a half-time period, I don't feel behind the ball like I do coming back from a full vacation -- I have time to put out fires, respond to requests, etc.

I'd estimate that I get as much done in a 4-hour day as I would in 6 hours of a normal 8-hour day. Honestly, I'd be happy to work half as many hours and take a 25% paycut... if only my employer agreed

</comment><comment><USER12> Related: "How to become a part-time programmer" [https://news.ycombinator.com/item?id=17131691](https://news.ycombinator.com/item?id=17131691)

<comment><USER13> I would love to be in a position where 20% off my salary is not something to worry

<comment><USER14> If you can't cut your expenses, getting better at negotiation will help you with both parts. Given how much Google and the like pay at the top tier, and the availability of remote work across geographic zones, it's highly unlikely you're at peak pay for your experience level.

So you can:

1\. First, get a higher salary. 2\. Then, go down to 4 days and take the 20% cut.

Example: when you get a job offer, merely by saying "can you do better?" you can quite often get a 10% higher offer, because usually initial offer is at the bottom of the pay range.

<comment><USER13> The main problem here is that I went for hardware engineering, which almost no one is willing to hire as remote work.

I also happen to live in spain, comparing with other friends working in the same sector, I'm likely above top 10% in salary/age ratio.

Sadly in this country, at age 30 this is 40k€/y that after taxes becomes 29,700€.

Rent alone takes more than a third of that, I take ~3500€ directly for savings, and I need to stretch the rest to cover the rest of my costs, including stuff like medical insurance, gas, etc...

I know this is partly my chosing and the first comment that will come to a lot of people is "move", but I can't do it without heavily disrupting my girlfriend's career (she's still finishing her studies and working part time). Our hope right now is that her current job might give her the option to (legally) move to the US.

<comment><USER14> It's definitely harder in some fields, yes—mostly I'm talking about programmers, who have an easier time.

That being said, I'm told negotiation can still help even for hardware people (but I don't have personal experience with how that works).

</comment></comment></comment></comment></comment><comment><USER15> I'm very grateful that I came across this article.

For a long time now I've been struggling with balancing work and life. I've recently started playing with the idea of exchanging a pay cut for a 4-day work week (I haven't brought it up to my employer yet though). It seems obvious now, but I haven't previously considered using my vacation days to do a test run.

Most of the points in the article are solid, but the one about improved focus struck me as odd. It seems that the author is conflating the change in work hours with a change in his process. Even without any schedule changes, you'd still benefit from thoughtfully planning your day out. Then again, maybe less time _forces_ you to be more proactive.

<comment><USER14> From personal experience working 4 days a week, and talking to others who have done so, the change to shorter hours is definitely a forcing function: you end up prioritizing better and planning better because you have to.

I talk about the contrast between the "work longer!" attitude and the "work less hours but still produce the same" here [https://codewithoutrules.com/2018/02/11/working-long- hours/](https://codewithoutrules.com/2018/02/11/working-long-hours/) and here [https://codewithoutrules.com/2016/08/25/the-01x-programmer/](https://codewithoutrules.com/2016/08/25/the-01x-programmer/)

</comment></comment><comment><USER16> I have been working 24, 32 and 40 hours for longer periods of time.

While 24 hours is great for personal time I felt like I got out of touch with my company, collegues and work in general.

40 hours a week is just 'getting those 8 hours a day full'.

I felt when working 32 hours I was most productive and did the same work as in a 40 hour week. Every week I started fresh and felt more relaxed over all.

</comment><comment><USER17> My $0.02.

I've been working a 4 day/week schedule for 1.5 years now. Initially, I took the time off to lead a nonprofit volunteering project but quickly got burned out (4 days work, 1.5~2 days nonprofit work = 5.5~6 days/week). I've since reallocated the extra day to hobbies and am quite happy with the setup. As I've explicitly taken an independent contributor role at work, I feel no need to be 100% available, and my colleagues respect that.

Overall, I'm very happy with my current schedule and will fight tooth and nail to keep it. If you can afford it and have the drive to do something with your extra free time, I highly recommend it.

<comment><USER18> How did that conversation go with your manager when you first wanted to reduce your hours?

I had a similar conversation about 8 years ago, moving from 5 days to 4 days.

My boss at the time wasn't too happy with the proposal, and suggested it might just be easier for them to replace me with someone who wanted to put the full effort expected in.

<comment><USER14> Typical response is never "awesome, let's do that" because... why should they? They'd prefer you to work 5 days a week. So they'll push back.

But, as an existing employee you're valuable: you know a lot of things that take a lot of effort for new employee to learn. And so quite often the answer is just "yes", or stalling but "fine, ok, yes" if you push at it.

Of course, some places the managers have no respect at all for employees or understanding of your value. You probably don't want to work those places at all, and if you do this won't work.

If you want a detailed howto, I wrote a book about it: [https://codewithoutrules.com/3dayweekend/](https://codewithoutrules.com/3dayweekend/)

</comment></comment></comment><comment><USER19> If you are doing 7-5 days, is that really... 32 hours?

<comment><USER20> Maybe that includes 1h lunch break plus some short coffee breaks?

I think that, in Germany, lunch break does not count towards the paid hours in salaried jobs.

<comment><USER21> Yeh, he was including a lunch break which is not in the paid hours

<comment><USER22> It's still not 32. 7 to 5 is 10 hours. Subtracting 1 is 9. Times 4 is 36.

<comment><USER23> Maybe subtracting two per day, or the "leave by five" had an implied "at the very latest." Surely he did the math before putting the number in the title of his blog post.

<comment><USER24> He worked four 10 hour days and called it 32 hours a week. We don't have any reason to trust his math.

</comment></comment></comment></comment></comment></comment><comment><USER25> The author had a lot of vacation days left, and instead of taking them all at once, decided to give himself a bunch of 4-day work weeks. I wondered recently about the feasibility of doing this, does anyone know how open the average employer is to this sort of thing?

<comment><USER26> I've never minded when my employees do this (and can't imagine why I would). I've also done it myself fairly often because of the PTO rollover limits.

You've earned the vacation days. If your vacations happen to be every Friday for 8 Fridays in a row because that's what you prefer, that's none of my business.

<comment><USER27> Some employers ask you to take holiday in longer blocks because they want people to be able to properly relax and recharge and they think you can't do that in just blocks of one day.

(Not saying I agree, but that's what they say.)

<comment><USER28> I suggest not working for employers who attempt to dictate how you use your PTO without a legal leg to stand on.

<comment><USER29> In some countries it is mandatory by law to have 14 days in one block per year.

<comment><USER30> One finance job I worked in had that regulation. (But it wasn't a general thing in that country.)

<comment><USER26> Policies like that are often designed to (or at least conceived/fantasized to) ferret out/prevent single-actor fraud.

Forcing someone to take two contiguous weeks out of the office means that someone else will need to be briefed for continuity and there's an enhanced chance of detecting "weirdness" that might be associated with a fraudulent scheme.

<comment><USER30> Yes, 'conspiracies' of more than one person are much harder to keep under wraps. That regulation was directly in response to the high-profile cases of rogue traders.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> Different people can function under different workloads, and there is no magic formula that will make everyone happy.

I've been clocking in ~50h/week for a couple of years now as a contractor and it's worked well for me. Working remotely helps a lot as there's no commuting and I can start being productive 15 minutes after waking up. I'm also able to distribute the weekly workload as I please (except daily standups). Some days I'll clock in 12 hours, and other days work barely at all.

All clients were happy with this kind of arrangement so far.

</comment><comment><USER32> I keep lowkey looking for studies on how much actual free time a person has in a day— _really_ free, subtracting all chores and commuting. I've heard that some people have timed that and the results were rather surprising compared to the 'common knowledge,' but I'd like to have a source to cite.

<comment><USER15> To build on top of that, I'd want to see how much of that truly free time is in a "high energy state". What I mean by that is a free time where you're awake/energetic enough to do something meaningful – read a challenging book and take notes, write a thoughtful email to a friend, host a party, try to build a new friendship, etc.

On most workdays I find myself so spent that a) I don't want to see people, b) I don't have any mental energy left. I can only do such things on the weekends, but then I'm also fighting with all the chores that have accumulated over the week.

A 4-day work week sounds very appealing because of the challenges mentioned above. An extra day with free _and high-energy_ time would be amazing.

<comment><USER33> I can say that for me, working 4 days wasn't like getting one extra day per week - it was more like getting any actual weekend at all. Saturday used to be "I'm too exhausted to do ANYTHING, let's stay in", and Sunday was, like you say, a chore day. On Monday I'd still be tired, and demotivated because my weekend was such a waste.

On 4 days I finally feel like I don't have to spend my weekends preserving my energy. I can actually plan things to do without thinking "oh no, I shouldn't, that'll make me too tired for chores/work." I can have a life!

edit: also, a benefit that people don't tend to consider is that getting certain chores done is much faster on weekdays. You won't find queues at the shops, bank, opticians, doctors etc on a Friday morning!

</comment></comment></comment><comment><USER34> One other minor perk of working fewer hours is lower taxes. The first hour you work in a week is taxed much lower than the last hour you work. (In countries with progressive tax systems.)

<comment><USER35> Isn't that simply a consequence of having less money in your pocket in the end?

<comment><USER36> It is. But working 80% looks more attractive, when you work 80% for 84% of net income, rather than looking at the 80% of your salary.

This assumes your employer will pay you less linearly, my previous employer had paid the half-time staff about a quarter of the full time salary for 25 hour weeks.

</comment></comment></comment><comment><USER37> The past decade I have worked about 24 hours or 3 days a week, only making more hours (or full days) when it could not be avoided. I would advice this to everyone.</comment>


Show HN: Formspark – A back end for static HTML forms, dashboard included - <AUTHOR> https://formspark.io/about <comment><USER2> Looks cool. I use netlify's form capture a lot but I've always thought there should be a host-agnostic solution for 'fire and forget forms'</comment>


Ask HN: Are there any HN like communities for marketers and entrepreneurs? - <AUTHOR> <comment><USER2> The closest thing to that that I'm aware of is barnacl.es

That site is aimed at entrepreneurs, with a particular focus on people who are bootstrapping instead of pursuing VC money. A lot of the discussion there tends to involve marketing, although the site isn't necessarily aimed at marketers per-se.

<comment><USER3> Another one that this reminded me of is "The Backstory" ([http://talk.andrewchen.co/](http://talk.andrewchen.co/)) by Andrew Chen (from Uber). It deals a lot more with marketing and growth but is still a great resource for entrepreneurs.

</comment></comment><comment><USER3> There is a really great Slack team for SEO & Marketing called Online Geniuses ([https://onlinegeniuses.com/](https://onlinegeniuses.com/)). It's not really "HN like" but it's a really great community.

<comment><USER3> Just a quick note to my comment.

There are a lot of good entrepreneurial teams as well, but a lot of them have one time fees to join (part of a vetting process).

The one I mentioned above is free which is somewhat unusual for such an active community.

</comment></comment><comment><USER4> Sales and Marketing:

[http://www.closingcall.co/](http://www.closingcall.co/)

</comment><comment><USER4> profitable indie websites [https://www.indiehackers.com/businesses](https://www.indiehackers.com/businesses)</comment>


Comparing the Performance Between Native iOS (Swift) and React-Native - <AUTHOR> https://medium.com/the-react-native-log/comparing-the-performance-between-native-ios-swift-and-react-native-7b5490d363e2 <comment><USER2> Alternatively, SCADE which write in Swift and run native app in iOS and Android. They are partner with Perfect web framework team that are developing Server-side Swift.

We think it will be more performant with Swift 4 release soon this year. The benefits for using Swift over RN is first-class support and optimized with LLVM and Clang.

Useful for intensive processing, gaming and AI that RN is not a suitable choice. Likewise, LinkedIn iOS app is written in Swift.

[http://scade.io](http://scade.io) or chat with the team at [http://perfect.ly](http://perfect.ly)</comment>


Ask HN: How do you learn to speak the other person's language? - <AUTHOR>

A year ago when I was a developer at a big bank, I found that I had to speak to the desk I worked for in their language. I.e. I had to know enough finance to have the conversation in terms of stocks, bonds, options, etc...
Now, I'm on the other side of the table and I find that I need to talk to development guys and I find that I end up talking to them in terms of servers, databases, queries, algorithms, etc...
I also end up talking to our lawyers a lot and I find I need to understand legal talk which they are rarely willing to convert into "plain" English (for fear of losing precision I think).
During all this time, I've found that I struggle for some time to "speak the other person's language."
Any advice? I'm sure it comes up a lot for people here who have to talk to customers. <comment><USER2> Learn one or two foreign languages preferably before you're twelve.

The mental flexibility gained by struggling to make yourself understood using a completely different vocabulary and grammar will directly translate into an improved ability to adapt to other people's way of thinking, even when your language is the same.

<comment><AUTHOR> Now I just need a time machine...</comment></comment>