Show HN: I made a resume generator for developers - <AUTHOR> https://bytevitae.com/ <comment><USER4> Just a suggestion: I think it would be a good idea to showcase the variety of your available designs up-front, without requiring a signup. I imagine that a big reservation people will have is that they won't want their resume to be recognizable as "one of the three templates offered by that resume generator." You don't have to show a full PDF sample, but just a gallery showing that there _is_ a large crowd of designs one can blend into would go a long way.

<comment><USER5> I agree. I'm not going to sign up without seeing a sample.

<comment><AUTHOR> there is a sample on the landing page!

<comment><USER6> This is a good example of where UX means a different thing to the user than to the developer. Just because it's available on another page doesn't mean the customer is going to take the time to go figure that out. Take these criticisms graciously and learn how your user's use your software it's going to improve your products immensely.

<comment><USER4> He's pointing out that there's a link to a full-size PDF sample of one of the templates on the landing page if you scroll down a little bit.

</comment></comment></comment></comment></comment><comment><USER7> Just an FYI if you didn't know this- stackoverflow.com has something _similar_. They have the concept of a developer story with the option to link to two different web versions as well as generating a PDF for you (no frills). e.g. [https://stackoverflow.com/cv/leetrout](https://stackoverflow.com/cv/leetrout)

Looks like you've definitely put more effort in to the styles and the thumbnails look nice! I would love to see a small gallery of designs!

I'm -1 on photos on resume since it opens the door to a lot of bias (unconscious or not) so I hope you offer a lot options without photos / icons.

<comment><USER8> I think in that way a picture helps - if someone is biased by only looking at a picture, that's a job you don't want.

<comment><USER9> This is not usually the case. Initial resume reviews are often done by HR, some algorithm, or at least somebody who is not who you will actually be working with on the day-to-day. It is incredibly difficult to root out all of the biases in the job application process and even automated attempts have failed[1]. It is best to avoid any opportunity for bias to even enter the system. To say that you're okay being rejected from a job due to your appearance because you wouldn't want that job anyway is defeatist and hurts the cause of those who are truly disadvantaged and would very much like to be employed.

[https://www.reuters.com/article/us-amazon-com-jobs- automatio...](https://www.reuters.com/article/us-amazon-com-jobs-automation- insight/amazon-scraps-secret-ai-recruiting-tool-that-showed-bias-against- women-idUSKCN1MK08G)

</comment></comment></comment><comment><USER10> For me, integration with Linkedin would be much more powerful than integration with Github. My Github is full of my experiments and side projects with ReasonML, OCaml and Clojure. My day job is all about building React applications. Also, a better preview of the non-free themes would be nice but I could imagine you are concerned with people extracting the CV without paying.

<comment><AUTHOR> Yeah, Linkedin was planned, until I discovered they don't provide the profile via API unless you are an aproved developer :(

No, I'm not concerned at all with that! There is a full sample preview of each template once you login. I guess I need to put it in the landing to?

</comment></comment><comment><USER11> Thanks for sharing. Could you help me see clearly the value offered by your product?

In my case, I have a word document that I only occasionally export to pdf when I'm searching for new opportunities, let's say once every two years. Updating is not too much of a hassle for me because I end up just having to add a few lines summing up my new experience since last time.

Am I missing something, or is everyone doing it differently?

<comment><AUTHOR> Yeah, while researchign for this I found it's what a lot of people tend to do, so don't worry :P

Other users (like me) tend to look for a more polished design than that of what MS word/Google Docs etc... offer, but it is perfectly normal, this use case might not be relevant for you.

</comment></comment><comment><USER12> the problems with resume generators are

* privacy: if it's not client-side only, how do I know you're not saving all my data and selling it to advertisers recruiters spammers etc?

* popularity: a random recruiter pulls up two applications and they both have the exactly same template. this is probably a bad thing. best case scenario you become less unique and more forgettable, worst case scenario they think you're a liar that has plagiarized the resume from somewhere and the contents aren't correct

<comment><AUTHOR> Completely see your point in the privacy aspect, but it is really difficult to offer a good user experience with a project like this without storing data. I don't even consider selling data as part of a business model for my projects but I understand that is opaque to the user and not everyone is like this.

On the second argument, I assume recruiters are seeing tons of resumes presented in the same package daily. I don't think this will affect negatively to the applicants. Hopefully this starts becoming a problem and I get to work and design 100 more templates for variety :)

<comment><USER13> Moreover, as a person who participated in hiring a lot, a unique design for every CV isn't something I'd be happy with. The more it unified, the easier to scan the paper for the things I'm looking for.

<comment><USER14> (because you being a recruiter/recruited a lot) Out-of-context, shamelessly plugging [https://nextRound.ml](https://nextRound.ml) to consider your feedback. To keep the thread precise to the OP, drop an email at firstname.lastname@example.com (just in case you want to feedback) .

</comment></comment></comment></comment><comment><USER15> I use LaTeX for my resume and it has been the best experience so far. My content is super simple, and technically I could change the format whenever (although I'd have to learn LaTeX to modify the template, but I'm sure it's not too difficult).

Nowadays I use Overleaf's online tex editor, so I don't even need tex installed to update it.

<comment><USER9> Would you be interested in sharing your template? I used to use TeX, but the available templates never interested me, and I didn't have the time to DiY a good one.

<comment><USER16> I use one of these templates: [https://www.rpi.edu/dept/arc/training/latex/resumes/](https://www.rpi.edu/dept/arc/training/latex/resumes/)

<comment><USER9> Thanks. These look good.

</comment></comment></comment></comment><comment><USER17> Photos should not be included on resumes sent to most American companies. They are a huge source of bias in the the hiring process and will either be rejected or have the photo removed immediately.

<comment><USER18> But there are markets where they are expected. In Germany, your resume has a good chance of being discarded if it doesn't display a photo. That has to be kept in mind when making tools like this. They seem to have templates both with and without photos.

<comment><USER19> Is there a reason why a photo should be included?

<comment><USER20> I mean... other than the obvious ones? (i.e. the same reasons which are _why_ North American companies usually don't or can't request a photo...)

<comment><USER21> I can't think of an obvious reason why anyone -- other than someone being hired specifically _for_ their looks such as a model or an actor -- should include their photo along with their curriculum vitae. What "obvious" reasons are you thinking of? To prove they're not a bot or a house pet?

<comment><USER20> To quote Drawn Together's Foxxy Love: "This whole test is racially biased! Question one: 'What SPF lotion would you use if your were going down to the polo grounds, fellow Klan member?'"

<comment><USER21> ... I don't get it. I mean, I get the joke, but not how it supports your argument.

<comment><USER20> I'm sorry... I mean, really? I thought you were just trolling originally, playing up the "I don't see race" trope. Well, I'll spell it out very plainly for you then: A profile picture facilitates hiring discrimination on the basis of age, sex, race, beauty, and possibly other factors as well.

You'd get into trouble if you wrote "I am a young, white, normal-looking man" on the top of your resume... but maybe if you just sliiide a little headshot in you'll get the message across.

<comment><USER21> > A profile picture facilitates hiring discrimination on the basis of age, > sex, race, beauty, and possibly other factors as well.

I agree with you. That's why I said I don't see why anyone other than an actor should put their photo on a resume, because it makes it easier for the reviewer to discriminate based on illegitimate reasons.

Perhaps there's a misunderstanding? This discussion thread has been about why anyone _should_ include a photo, not why they _shouldn 't_. Unless they want to attempt to benefit from such discrimination by having a favored appearance, which we want to discourage.

<comment><USER20> Positive discrimination. If you're a young, white male you can include a headshot and get a better-than-average crack at the job.

<comment><USER22> How much do you think this increases the candidate's odds?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Hi OP here!

I made this tool because I always feel the pain when having to update my resume as well as my friends ones.

Since I tend to keep my Github pretty updated my idea was having a way to generate a professional looking resume getting the information from my profile (personal data, website, tags, repos, etc...) the fastest possible, without having to tinker much with the design or anything.

I haven't had the opportunity to test it with many people yet, so any feedback is more than appreciated.

</comment><comment><USER23> Is is compatible with [https://jsonresume.org/schema/](https://jsonresume.org/schema/) ? Do you plan to release the source code?

<comment><AUTHOR> I didn't know that existed, but it looks REALLY nice. It would be cool to allow for users to signup with regular email/password and let them import their own json.

I won't release the project per se, but I do plan on striping out all the business logic and release a full stack SaaS scaffolding (Node + React) of the project with the basics (dockerized dev enviroment, a CRUD, authorization, deploy ready etc...) for anyone to build a product like this. this.

edit: typo.

</comment></comment><comment><USER24> Quick comment - I haven't gone thru the entire site, etc - so maybe you are already aware.

I saw the free vs paid options - and the paid being "$30" and I was asking myself "$30 for...how long?" \- so I went back (because I didn't want to make a fool of myself before I commented) and read it carefully...and..."oh - <USER2> one year of access"

Ok - that's fair - but I want to suggest that you make that part a bit more prominent on that card, because if I missed it I am sure others will as well. I don't think the price is unfair (seems reasonable out the gate) - <USER3> knowing the terms of how long you get access for that price shouldn't be something you have to search a bit for.

<comment><AUTHOR> Thank you cr0sh, that's great feedback.

Actually at first it was very evident $30/year, but I removed it in the last minute because it seemed like a suscription (which is not). Definetly going to make that thing stand out more.

</comment></comment><comment><USER25> You made an email "feeder", ready to suck every mail from any developer and sell the data back to some marketing company.

</comment><comment><USER26> I used Resumake.io ([https://resumake.io/](https://resumake.io/)), very good service, has option to export in LaTeX, PDF and JSON as well.

</comment><comment><USER27> For a while I've been building my resume(s) by using a LaTeX template (specifically [0]) and copy-pasting data from my LinkedIn profile which I keep fairly up-to-date. It's worked pretty well for me especially when I had to put together academic resumes for which I could just add my publication through the standard LaTeX bibliography practices.

I've toyed with the idea of making a resume generator SaaS where the user would enter their LinkedIn URL which my app would scrape and use it to populate different LaTeX templates rendered server-side into PDFs (for free) while offering some sort of editor or the raw LaTeX (in a premium version) where the user could apply edits.

While AFAIK scraping LinkedIn was deemed lawful in some previous court case [1] I fear it would be a hard sell. Wonder what kinda trouble I would run into.

[0] [https://www.sharelatex.com/templates/cv-or-resume/fancy- cv](https://www.sharelatex.com/templates/cv-or-resume/fancy-cv) [1] [http://cdn.ca9.uscourts.gov/datastore/opinions/2019/09/09/17...](http://cdn.ca9.uscourts.gov/datastore/opinions/2019/09/09/17-16783.pdf)

</comment><comment><USER28> Maybe a bit off topic, but a targeted cover letter for the specific job you are applying for is also important. I have a template in Latex that I have used on all jobs after university :)

[http://blog.gregjotau.com/job/2018/06/05/cover_letter_templa...](http://blog.gregjotau.com/job/2018/06/05/cover_letter_template.html)

</comment><comment><USER29> Years ago I was using a Word document for my CV but every time I wanted to update the style it was a pain. I found a command line tool that I have been using for years which allows to decouple data (json) and presentation (web technologies based themes, I created my own theme). The name is hackmyresume ([https://github.com/hacksalot/HackMyResume](https://github.com/hacksalot/HackMyResume)) or fluentcv ([https://github.com/fluentdesk/FluentCV](https://github.com/fluentdesk/FluentCV)). I'm afraid it's no longer maintained but I still use it. It supports JsonResume (JRS) and also its own format FRESH. It outputs to multiple formats including word and pdf.

</comment><comment><USER30> You say "For one year" but you don't say what that means. I don't know if it's avilable for download for a year, that it keeps syncing for a year, or if you retain license to the design and I can use it without paying you for one year even if I say make a PDF of it and edit that going forward. So some terms and conditions, as annoying as they are, would be helpful, since I don't actually know what I'm buying here. I think you do know.

</comment><comment><USER31> I haven't tried this yet, but I like your pricing model more than the others I've looked at.

I tried cake resume a while ago and while it was nice-ish, they wanted to sign up for a $7.95-$15.95/mo recurring charge (I feel like it was even closer to $20 a last time I looked?)

<comment><AUTHOR> Yeah, I gave it a lot of thought, because being realistic who needs to build resumes every month?

I think having a 1 year access without recurring subscription is a nice way to be able to use the product (including updates) and not having to charge for something weird like single use/downloads.

</comment></comment><comment><USER14> So, I'm looking into your sample resume at [https://bytevitae.com/cv/bytevitae_sample.pdf](https://bytevitae.com/cv/bytevitae_sample.pdf). Unsure, if I understood "OPEN SOURCE" section means. Also, when I tried to copy your previous company name "Influencity" it is copied as "Inbuencity".

Care to see what I did with this resume using [https://notyce.me](https://notyce.me)? I __validated it to check the resume 's suitability in job market __. Have a look[https://ibb.co/sqqQ1yb](https://ibb.co/sqqQ1yb)

<comment><AUTHOR> Wow, that "Inbuencity" bug is a weird one O_o, just tried it myself and same happens. Don't even know how it is possible, something about the font maybe?

Open source represents open source contributions (aka repos).

Well that looks cool and apparently its spot on!

<comment><USER32> The two characters "f" and "l" are, when typeset, frequently combined into the "fl" _ligature_. Probably, this is what happens here, and some combination of bugs causes the fl ligature not to be correctly translated back into "fl" when copied.

</comment></comment></comment><comment><USER33> This is really cool; I love the slick interface!

Some of your templates look vaguely familiar though.

[https://realporthub.herokuapp.com](https://realporthub.herokuapp.com)

*Edited for positivity. This is legit cool.

<comment><AUTHOR> Thanks for the love!

I designed the templates taking inspiration on what friends showed me, what found online as well as my previous resumes.

To be completely honest its the first time I see that website! But I can see how the black sidebar one looks similar, but they all use pretty common heavily used design patterns.

<comment><USER33> Definitely! There's only so much room to maneuver on resume layouts as it is.

One of the, if no THE, most important things I found was the machine readability of a resume. We could build generators that spit beautiful resumes all day but they wouldn't ever get in front of a human to care.

<comment><AUTHOR> Wow, didn't think about that. I'm not familiar with so automated hiring processes but I guess that is a big concern.

Did you find out why? layout, text style? they need a specific template?

<comment><USER33> Yeah, I wasn't and didn't either!

I love playing around in Adobe Illustrator and so built my resumes in there. I spent DAYS and WEEKS crafting what I thought were a beautiful, icon rich, intuitive, apple-of-my-eye resumes. 250+ applications later the only time I ever got any response was from one or two small operations where it was a human manually reviewing submissions.

Turns out HR/recruiting suites that companies use aren't so hot on parsing, classifying, and tagging image based PDF resumes. Haha, who knew, right?

Finally a friend turned me on to LaTex and I had GREAT success with that. This made a ton of sense: what could be more machine readable than something built out using markup elements, tags, and IDs that explicitly do all that classifying work for the programs already.

So yeah, huge take-away: when your site constructs the resume if you're using HTML and then converting out to PDF (what we did on PortHub) make sure your HTML is verbose and explicit, even if it doesn't get displayed "on page".

<comment><AUTHOR> That is a problem I had on an unrelated project with image based PDFs. With this one I wanted to avoid that, if you check the output, it is text 100% selectable (and even some interactive elements). So hopefully it avoids that problem.

Surely not as easy to parse as something done explicitly for that, but hopefully good enough.

Such good insights in your post! thanks for sharing your past experience.

</comment></comment></comment></comment></comment></comment><comment><USER34> I wasn't expecting much, but I downloaded the sample, and it's definitely something I'd be interested in. Made me think, "Oh yeah, you _should_ do it that way"

</comment><comment><USER35> I respect the hustle, but why do I have to create an account and login with GitHub to see anything?

I recently had to rewrite my resume and found it surprisingly difficult to find any decent templates, so I created my own in Google Docs [https://docs.google.com/document/d/1LoPO2A_mZXJTpn90K27FPKU3...](https://docs.google.com/document/d/1LoPO2A_mZXJTpn90K27FPKU3sdnrS_r7mXbic9HUSDw/edit) . Anyone reading this is welcome to use it.

<comment><USER36> I made mine as an SPA with Vuejs and some CSS libraries, then converted it to PDF with the print option. It felt appropriate. Material.io style resume, bam!

I used it for the first time last week, and I am on to the second round of interviews.

[ When all else fails, use your dev skills ]

<comment><USER37> Thanks for mentioning this. I was doing the exact same thing, also with Vue, but never finished it. Your comment inspired me to pick it up again.

<comment><USER36> The only major problem I had was the pdf conversion cutting off the styled container. I fixed it by adding an excessive top margin. So just be aware and check the formatting before you ship. :D

</comment></comment></comment></comment><comment><USER38> Random bug report, long names overflow into the skills section. Fun tool, though I personally prefer making my own website with print css that is the resume itself (with a PDF copy).

<comment><AUTHOR> Thanks, noting the bug :)

</comment></comment><comment> phoe-krk Do you use {La,}TeX for the resumes? If yes, do you make it possible to download the files in TeX format for your paying users, so they may be hand- tweaked by them?

<comment><AUTHOR> No sorry, I have no experience working with Latex

<comment> phoe-krk OK - if your resumes are not made with TeX, then the rest of my question is moot. Thanks for answering!

</comment></comment></comment><comment><USER39> Without having checked it:

1) Does it use templates? If so, resumes will probably look similar to each other, and not stand out from their competition. Is this assumption incorrect?

2) In my opinion, a developer using a _resume generator_ sounds kind of unprofessional or even lazy ("highest quality developer resume in less than 5 minutes"), in contrast to say, using LaTeX (without templates).

<comment><USER40> Isn't LaTeX just a set of macros? Is that not "lazy" compared to using plain TeX?

I would not think less of an engineer who used standard components.

</comment></comment><comment><USER41> Does anyone remember the Dilbert Mission Statement Generator? It's not up anymore, but here is a rough clone: [https://lotta.se/mission-statement- generator](https://lotta.se/mission-statement-generator) Click the button to automatically generate a new mission statement.

</comment><comment><USER42> Good site and design. My honest reservation about using drastically different resume formats is - resume parsers. Most recruiting agencies, large companies using some form resume parsing to aid in filtering out candidates. Not sure if your formats will get parsed correctly.

</comment><comment><USER43> I love the idea and simplicity, but if you want conversion to paid plans you must make the paid templates previewable before purchase to establish trust in the investment before the user purchases.

</comment><comment><USER44> Is this different from / compatible with JSONResume?

<comment><AUTHOR> See above, didn't know that existed but now I'm considering integrating it.

</comment></comment><comment><USER45> The website after clicking "get started for free" does not work. It is only a black white page. After looking at the source, I can see the problem. It is _JS only_. The JS is uglified as well, so I am not trusting it. You could have at least made some effort to include a noscript tag.

The website also looks like it is hiding functionality behind a registration, instead of letting me try right away, but I cannot confirm this, as the website does not work, as stated above.

</comment><comment><USER6> I like this. Small bug: dates for "experience" are showing up incorrect when rendering to pdf.

</comment><comment><USER46> Is it possible make offline app based on your "resume generator for developers"?

<comment><AUTHOR> what do you mean?

</comment></comment><comment><USER47> Is it possible to input the information yourself? I don't use github all that much.

<comment><AUTHOR> Except the repos, once you log in everything is editable by hand. You lose the speed boost, but you have the option yes :)

</comment></comment><comment><USER48> Where'd you get the illustration on the landing page from?

</comment><comment><USER49> Is there literally no ways to delete my user account and data ???

<comment><AUTHOR> sorry, not currently. I should have added that option. By now please send an email to email@example.com and I will delete it for you. Sorry for that.

</comment></comment><comment><USER50> everyone just use latexresu.me bye

</comment><comment><USER18> A friend of mine had a graphical resume she made in Illustrator and it inspired me to learn Illustrator myself and make this:

[https://penguindreams.org/files/2018-SumitKhanna- Resume.pdf](https://penguindreams.org/files/2018-SumitKhanna-Resume.pdf)

I like it, and it's got me some good roles (probably also kept me from some roles as I'm sure some threw it in the trash thinking it smelled of marketing rubbish; but I still like it so whateves), but it's also a pain to update.

I looked at adapting HackMyResume (listed in the comments) and got somethings into the standard JSON format, but I wanted to keep my timeline and getting it to work programmatically was way more difficult than I thought. Someone provided this answer on StackExchange for Laytex, but I never got things to lineup correctly and sorta gave up:

[https://tex.stackexchange.com/questions/183046/how-do-i- deve...](https://tex.stackexchange.com/questions/183046/how-do-i-develop-a- complex-time-line)

Every time I think about doing it programmatically, I start down a path, get frustrated and realize I need something now, and end up just updating the old one in Illustrator. I hesitate to use a tool like this since mine looks unique and don't want anyone to recognize it comes from a standard template. It's still pretty neat though and I like the idea of allowing a preview with a watermark as a means to attempt to monetize it.

<comment><USER51> As someone who has read _a lot_ of resumes, I really like this! It gets to the core points quickly.

My only suggestion would be to put the names of the companies in italic or differentiate it in some way.

When I read a resume, the very first thing I do is scan the name of the companies you've worked at to see if I recognize any of them as either a place known for great hires or somewhere I've actually worked. I had to go down to your "normal resume" to do that easily.

Edit to clarify: I don't ever cut anyone because of where they worked or went to school. I'm only looking for a signal in the noise or some common experience for us to discuss.

<comment><USER52> > When I read a resume, the very first thing I do is scan the name of the > companies you've worked at to see if I recognize any of them as either a > place known for great hires or somewhere I've actually worked.

Ughh, as someone who went to a state school and spent most of his career toiling away at non-name brand companies, please allow me a moment to shake my fist angrily at you over the Internet!

You've probably already considered this and accept the trade off, but I can't help but think that these kinds of filters result in many false negatives and contribute to some of the monocultures we find inside tech companies (everyone here is ex-Microsoft, everyone here is from Stanford or MIT, etc.) When building the content for a resume, Shouldn't the work content be more important than name dropping celebrity companies? Am I being too naive?

Honestly I wish there was a norm of not mentioning specific companies on resumes, letting your actual skills and experiences speak for themselves, but that ship sailed long before I was born.

<comment><USER51> I don't ever cut anyone because of where they worked or went to school. I'm only looking for a signal in the noise or some common experience for us to discuss.

<comment><USER53> > __I'm only looking for a signal in the noise or some common experience for > us to discuss. __

That is a strange thing to do on first read for someone who reads a lot of resumes.

You can be honest. Nobody here will be surprised. When you are held responsible for who you hire, it's logical to defer to heuristics like that. I have never met anyone truly passionate about hiring black swans. I don't think it is your fault, but this trend is just as common as it is harmful to society as a whole.

> __When I read a resume, the very first thing I do is scan the name of the > companies you 've worked at to see if I recognize any of them... __

</comment></comment></comment></comment></comment><comment><USER54> Pretty sure you show me one of these and its file 13'd immediately.

Take the time to think about your career and highlight what fits the job I am asking you to do.

<comment><AUTHOR> Any feedback on how to make resumes more relevant is very welcome. That is an area I would love to improve.

<comment><USER54> What have you done that is relevant to the job you are asking to do ?

To get past HR load up on recent buzzwords but tailor the resume to suit the job is the #1 thing I look for.

Any hint of not putting in the effort and I assume that is your work style.

No way I want someone who cant put in the effort to get the job. You know they will put in less when they do get it.

<comment><USER55> How much do job applicants get paid to apply for jobs? How much effort do you expect them to put in, unpaid, to kiss your butt, specifically, when there are hundreds of companies that are just like yours? Many of those companies will simply ghost the applicants that put in extra effort to tailor the heck out of their resumes. There is no expected payoff for tailoring until after the company actually makes contact, using a real person, and by then you're already interviewing.

It would seem then that the best solution for the applicant is to create a program that reads in an advertised job posting and automatically tailors the base resume to it, so it looks like they put in effort for each company, but actually just did the work once and used the automated solution for everybody. That sounds like more fun than hand-tailoring resumes, anyway.

Given that none of us get paid to look good for potential employers, what sort of reciprocal effort does your company put in to tailor its recruiting to specific applicants? Are you saying that companies who don't actively recruit specific individuals from leads will likewise be overly passive when it comes to retention? Because that... seems accurate.

All you really know from an untailored resume is that the applicant didn't see tailoring to your company as worth the effort.

<comment><USER54> Little tip....

You should ensure your HN username doesnt show up with a background check on a google search because when I do that and I see comments like this you dont get a job.

<comment><USER56> How often are you hiring for that to matter to the average HR user?

If you have time to research hr usernames how many resumes are you really getting through in a week?

<comment><USER54> Just hired 6 people last week.

I interview for the company on a weekly basis

<comment><USER55> Would you care to mention the name of the company? I, and probably an insignificant handful of other unsuitable candidates, would likely benefit from never applying to work there. And I wouldn't want to waste your time, of course. Cyberstalking and doxxing sounds like a lot of work, especially if it's a rejection-only signal.

Interviewing and hiring is very important work, and your company is depending on you for its future. Six people in one week is huge. The people you hire are lucky to work at a place that has so few problems finding talent.

I wonder, though... Do you think that the nature of your work role has created a bias towards the recruiters and interviewers over the interests of the candidates? Or that it might be an abuse of your hiring authority to threaten a pseudoanonymous person on the internet with a permanent, pre-emptive no-hire status, over comments that are not obviously offensive, whose content is only objectionable due to disagreeing with something you said? As someone who hires, do you feel this is appropriate?</comment></comment></comment></comment></comment></comment></comment></comment>


Watch: MICA, Magic Leap's Eerily Human AI Avatar Who Looks You in the Eye - <AUTHOR> http://nwn.blogs.com/nwn/2018/10/video-mica-ai-avatar-magic-leap.html <comment><USER2> I wouldn't list machines being able to communicate emotions to people as important. The limited value I do sed is having a machine express uncertainty or surprise if given ambiguous or rare/conflicting input. Other people may like it more. I don't enjoy talking to my phone as others seem to find natural.

<comment><USER2> Edit: the very next post I read makes for a much better application [https://arstechnica.com/?p=1392695](https://arstechnica.com/?p=1392695)</comment></comment>


Six Forces Disrupting Higher Education - <AUTHOR> https://www.manhattan-institute.org/html/6-forces-disrupting-higher-education-11273.html <comment><AUTHOR> This seems optimistic to me, especially if Bryan Caplan is correct in _The Case Against Education_ : [https://jakeseliger.com/2018/03/12/the-case- against-educatio...](https://jakeseliger.com/2018/03/12/the-case-against- education-bryan-caplan) , but it would be nice to see real disruption.</comment>


Automattic Spurns $200 Million Acquisition Offer - <AUTHOR> http://www.techcrunch.com/2007/10/29/automattic-spurns-200-million-acquisition-offer/

<comment><USER2> Personally, I believe that they are worth more than $200 million. There is something about their goal to make an amazing blogging tool is what makes me smile.

</comment><comment><USER3> What are they smoking? Take the money and run.

</comment><comment><USER4> an amazing example for building something people want, someone should get them a shirt.</comment>


How In-Memory Databases May Remake Your Database - <AUTHOR> http://blog.smartbear.com/software-quality/bid/207572/how-in-memory-databases-may-remake-your-database <comment><USER2> Good information about how in-memory db's are more than just a 'fast' relational database; thanks!</comment>


Ask HN: Will Peak Employment happen? - <AUTHOR>

I'd like to coin "Peak Employment" for the following:
I think that within the next N (15-30?) years, we'll reach a point in time when more people will be employed than will ever be employed after that time.
Do you think this will happen (globally, or in the US, etc.), and when do you think it will occur? <comment><AUTHOR> Proposing some possible Reasons:

1\. technological advancements and automation (i.e., "Tractored Out" \- see [http://www.livinghistoryfarm.org/farminginthe30s/machines_02...](http://www.livinghistoryfarm.org/farminginthe30s/machines_02.html))

2\. population decrease (e.g., less people needed to support the wealthy, due to reason 1, causing long-term famine and eventual decrease in population)

3\. wealth distribution and socialism, due to reason 1 (resulting in equalized output without increasing labor requirements)

</comment><comment><USER2> If you look at it in terms of percentage of available lifetime hours devoted to wage labor, I would expect it will happen -- if it hasn't already -- but I don't think that that clear enough statistics are available to be certain if or when it has.

<comment><AUTHOR> I agree, it'll be tough to know exactly when, but it'll be clear in hindsight if/when it happens.

</comment></comment><comment><USER3> To clarify, are we talking absolute numbers, percentage of the total population, or percentage of the population interested in working?

<comment><AUTHOR> The question is pertaining the total number of people employed.

</comment></comment><comment><USER4> Ask HN: Will Peak Slavery happen?

I'd like to coin "Peak Slavery" for the following:

I think that within the next N (15-30?) years, we'll reach a point in time when more people will be enslaved and waged-slaved than will ever be employed after that time.

Do you think this will happen (globally, or in the US, etc.), and when do you think it will occur?

[http://theneedleblog.wordpress.com/2012/07/10/peak- employmen...](http://theneedleblog.wordpress.com/2012/07/10/peak-employment/)

<comment><AUTHOR> Wow, nice find (blog link).</comment></comment>


Gazel: IndexedDB meets Redis - <AUTHOR> http://gazeljs.org

<comment><USER2> Closer to memcachedb than redis given the command set, but sill very cool.</comment>


Ask HN: The end of Ramen profitable?  Cash as crack? - <AUTHOR> Scoble has pointed out the end of ramen profitable with the recently announced flow of $150,000 cash guaranteed to all YC startups.
Will the next generation of YC startups be focused more on how to raise and spend money than how to get product out and revenue cash in?  Will every YC business plan including office costs, hiring costs, graphic design costs, administration costs?
Perhaps a better idea might have been to give the $150K to match the startups first $150K revenue.  Or some other idea?
Funding is like crack - once a company gets its first round of funding it's hooked, everything from there is about raising more funding, more rounds, A round B round, term sheets, valuations.  The cash dealers want you to come back for more.  Are all YC companies now dosing up on cash? <comment><USER2> I would guess that a few will buy Aeron chairs, but most will either extend their runway or accelerate their growth depending on where they are in the product development cycle. I suspect that it will be a huge net positive because it will oostpone the distractions of fundraising for YC companies by several months or years. It also allows YC's investors to spend more time focused on other topics besides fundraising at the critical first stages. With 150k in hand, technical founders are likely to be more able to delay bringing on the business guy and more able to attract business guys when they do need them.

</comment><comment><USER3> I don't agree with you that everything is about funding once a company has been founded, but this _is_ going to fundamentally change the way YC companies operate. Even if they don't take the money, they won't be quite as hungry or innovative with survival - just the knowledge that there is going to be a sum of money that can save them means that they will give in sooner.

</comment><comment><USER4> @22-26 yrs of age

150K spread over a team of 3 is like fuck you money. They'll likely buy costlier supplies, capital goods, and indulge.

wouldn't you?

<comment><USER5> Firstly 22-26 is probably not the most representative age group of YC founders. IIRC, pg mentioned that 26 is the median age.

$150K spread over a team of 3 is an annual salary of $50K for each founder. That's not fuck you money in most parts of the world, forget Silicon Valley.

<comment><USER6> Speak for yourself, a $50,000 salary would be 4 times what I make now, and I live in San Jose. $50,000/yr would definitely be "fuck you money" from where I'm standing.

I'm planning on applying for YC once I graduate, and I can't imagine a situation in which I would spend a bunch of money on stupid shit when all you really need for a startup is a VPS somewhere, some tables and chairs and the laptop you already have.</comment></comment></comment>


Show HN: Shogun – SaaS tool to manage all your static web pages - <AUTHOR> https://getshogun.com <comment> nick-cortes I use this for our static pages at TheDrop.club and it's great! Makes me feel like a web developer (I have a business background).

</comment><comment><USER2> Great product we use all the time!

</comment><comment><USER3> Great!</comment>


Meet Margaret Hamilton, the badass '60s programmer who saved the moon landing - <AUTHOR> http://www.vox.com/2015/5/30/8689481/margaret-hamilton-apollo-software#m06g03f20b15

<comment><USER2> Quite interesting that it was seen as women's work then. Would that mean her team was predominantly women as well?

Does anyone print out their source code nowadays? I remember seeing that some 15 years back..</comment>


The Return of Perry Rhodan (1998) - <AUTHOR> https://www.sfsite.com/vault/john38.htm

<comment><USER2> Perry Rhodan is _the_ serie my step father is addicted to. For almost thirty years I enjoyed reading the summary of what's going on in that epic opera pulp serialized piece of .. writings ? Or something. In the men's reading room of course.

I tried getting on the bandwagon when I was a teen, I read the first one and the ?th one (where we learn about Atlan) but there are way too many books to catch up with so I gave up.

I later discovered the germans where _hundreds_ of books ahead of the french traduction so I googled it and found the whole cycle which is like 6 times the 150 books already translated. I am a bit sad my stepfather could die without reading the end.

I read the stories is a little bit shaped by real world social events (fall of the wall, cold war, hippies rise and fall, etc.) but I couldn't see it because reading a '73 book in 1999 makes it hard for a teen to see what is actually transposed in the book.

I can't comment on the S-F part though. From what I read it's really more like a low-key SF soap opera that is character driven (without much character development).

Nothing like `modern´ SF (Baxter, etc.). And not much science.

<comment><USER3> > I am a bit sad my stepfather could die without reading the end.

There is no end yet, the series is still ongoing.

<comment><USER2> I know, what I meant is: "The series is likely to go on after his death." :).

</comment></comment></comment><comment><USER4> German here. I got addicted to it when, as a teenager, I saw them in our local library. The 3D covers of the "silver books" really got my attention! Inside they had, in addition to the story, extremely detailed cross sections of the space ships that occurred in the series. The dimensions and ideas the authors are really (in a positive way) crazy/gigantic. I also liked that the series was more or less one connected story. The authors regularly keep unsolved puzzles, just to explain them years later!

One day I found out that the newsstand on our train station sold current copies of the series and I was amazed by the fact that they already sold more than 2000 issues (Current edition is at ~ 2800)! The silver books I read before were actually just a streamlined version of ten or so issues. So I starting reading the "first edition", and also bought reprints ... in the end I think I read maybe half the the whole series, but two or so years ago I finally hadn't the time keep up.</comment>


Bit-squatting – DNS hijacking by cosmic rays/memory errors - <AUTHOR> http://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit-squatting-dns-hijacking-without-exploitation/ <comment><USER2> I still can't accept that these are memory errors... The chance of that seems just too small. You get 600k errors an hour globally but they still have to hit the exact place where the domain is stored - in ~3GB of memory. Additionally it must happen during or shortly before the request. How can this produce a sustained ~80 unique hits per day?

They should probably create some domains with 2, 3, 4, 5 bits swapped and show that the proportion of traffic drops dramatically to prove their theory about memory issues. Otherwise, I'm tempted to say - what about dangling pointers? What are the chances of that happening instead?

</comment><comment><USER3> Some of these problems could be mitigated by checksumming DNS entries when created.

<comment><USER2> That shouldn't be necessary - responses return the domain name you're requesting. So if you think you send a request for microsoft.com, but get back response for mi2rosoft.com - it should not be treated as a correct one.

It doesn't seem like those errors are caused by bitflips on the network.

</comment></comment><comment><USER4> I'd be more convinced if he'd also registered domains with two, three and four bit-errors in them. Having gathered as much statistics as he did, they should show clearly half as much, resp. 1/4th and 1/8th as much hits.

If that would indeed have been the case, he could say with _very high_ confidence that his hits were indeed caused by bit-flip errors, and not by character errors or who knows what other unknown anomalies.

So far, he's advocating to upgrade memory to prevent this vulnerability, but there's only a rough hypothesis that this might be caused by memory bitflip errors.

And even then, between the client and the DNS-server, there's a lot of machines, the bitflip could occur anywhere, right? How can he say upgrading client memory will solve anything??

<comment><USER5> > half as much, resp 1/4 and 1/8 as much hits

No. These errors are very rare. You only get any of them (according to the hypothesis we're considering here) because there are so many DNS requests made. The probability of getting two bit-flip errors in a single request is _much smaller_ than the probability of getting one, so the expected number of 2-bit hits would be way less than 1.

Something like this might be a useful check in a different way: bit-flipping errors will almost always be single-bit errors, whereas typos and suchlike won't. So if the bit-flipping theory is correct, you'll see systematically more single-bit than multi-bit errors.

<comment><USER6> His math was wrong, but his point stands, it's a simple test to see why these hits show up.

</comment></comment></comment><comment><USER7> There's an example in this article:

[http://domainincite.com/bit-squatting-%E2%80%93-the- latest-r...](http://domainincite.com/bit-squatting-%E2%80%93-the-latest-risk- to-domain-name-owners/)

Also, could ECC memory for clients solve this problem?

<comment><USER8> They changed microsoft.com to mic2soft.com: only 1 bit difference between the two.

I'm astonished that they got so many hits with that. Someone bit-squatting with many different combinations of the same domain can really do some damage...

<comment><USER9> Forgive me, genuinely interested - how does 1-bit difference turn microsoft into mic2soft.. ?

<comment><USER7> In ASCII, microsoft is:

0110110101101001011000110_1_1100100110111101110011011011110110011001110100

micr2soft is:

0110110101101001011000110_0_1100100110111101110011011011110110011001110100

The important bit is the one between the underscores.

<comment><USER10> I think the question is made more relevant when taking into account that the poster above omitted the 'r' ("mic2soft"), thus causing the name to be shortened which is, indeed, very hard to call a 1-bit error.

</comment></comment></comment></comment></comment><comment><USER11> previously on hn: <http://news.ycombinator.com/item?id=2846812>

<comment><USER12> That article didn't have numbers & stats in it though.

</comment></comment><comment><USER13> Earlier comment I wrote on another HN discussion:

Assuming DNS resolvers work as they should, most bitflips on the wire shouldn't result to anything else than a failed DNS query since DNS packets include the original requested FQDN in the result.

Scenario 1) Lets say we have normal Windows computer asking what is update.microsoft.com as an A-record. The computer's resolver sends its request to its ISP's DNS server it was assigned via DHCP. One bit is flipped on transit and the DNS server receives request to resolve update.mic2osoft.com and it does so. Then it returns the result via UDP telling the Windows computer that update.mic2osoft.com is 22.214.171.124, but the computer's resolver was expecting an answer for update.microsoft.com so it rejects(should reject) the result even though the transaction ID is what it expected. Also UDP checksum poses a problem the recursor could reject the packet and not do anything.

Scenario 2) Another scenario is where the bit corrupts on transit while the ISP's DNS recursor is querying the Verisign .com root servers for microsoft.com (assuming it's not cached) and one bit corrupts in transit. Verisign's server answers that mic2osoft.com DNS servers are ns1.mic2rosoft.com and ns2 and it provides the glue records for them (IP addresses) if necessary. DNS recursor receives an answer for mic2rosoft.com while it expects answer for microsoft.com and rejects the result before querying nsX.mic2rosoft.com. UDP checksum also a problem here.

Scenario 3) Bit flip on the Windows computer's RAM before gethostbyname() is called so they call gethostbyname(update.mic2osoft.com). Another timeframe for a successful bitflip is while the OS is running gethostbyname(update.microsoft.com) but before the request is sent. gethostbyname() only returns the IP address so the function caller will not know if its wrong. This is the most plausible scenario, ECC is also rare in consumer hardware so that shouldn't pose a problem.

Scenario 4) Bit flip on the DNS recursors RAM. This depends on whether the address to be queried is stored in several variables in the DNS server so the DNS answer packet to the Windows computer has the correct FQDN but the DNS server queried for the wrong address due to the bit flip. Servers usually have ECC so this is implausible but not impossible. Also if this happened, the DNS server's cache could also get the incorrect entry and give it out to many many many clients if it was a popular ISP's DNS server.

An interesting thought would be what if IP-addresses bit-flipped. If Microsoft had all their update servers in 184.108.40.206/24 and an attacker owned 22.214.171.124/24 with one bit flipped. How much traffic would the network receive? If bit flipped on transit while the server is returning answer for update.microsoft.com UDP checksum should be incorrect but what if a popular ISP's DNS recursor's cache had a flipped IP address for update.microsoft.com. Very implausible but would result in lot of traffic. One more scenario comes to mind about IP bit-flipping. If ns1.microsoft.com was at 126.96.36.199 and an attacker owned 220.127.116.11 he could also configure his DNS server (more specifically the UDP stack on the Linux kernel) to ignore the invalid UDP checksums and serve falsified DNS answers.

<comment><USER14> The bitsquatted domain sends two records, one for the squatted domain and one for the original name, pointing to the squatter's server. The parent article isn't as detailed as the paper/talk was, but this is a point that the DEFCON presentation included (and I reckon the BH one as well)</comment></comment>


Ants can turn colony ant enemies into allies - <AUTHOR> http://phys.org/news/2016-03-mortal-enemies-allies-ants.html <comment><USER2> Part of why Argentine ants have become such a problem in the U.S. is that when different colonies collide, they don't combat _at all_ (usually) and instead _merge_ to form supercolonies.</comment>


Listen to rare recordings of J.R.R. Tolkien reading 'The Lord of the Rings' - <AUTHOR> http://aleteia.org/2017/03/25/listen-to-rare-recordings-of-j-r-r-tolkien-reading-lord-of-the-rings/ <comment><USER2> [https://www.brainpickings.org/2016/01/15/j-r-r-tolkien- reads...](https://www.brainpickings.org/2016/01/15/j-r-r-tolkien-reads-from- lotr/) is the real url

</comment><comment><USER3> Speaking as a modern Brit, it seems that Edwardian English is fast becoming indecipherable. I certainly needed to shift gear to get all the words. I wonder how many generations it will take before people are unable to recognise what he's saying?

<comment><USER4> I think some of the phrasing is mimicking Old English pronunciation. Combined with his natural 'posh' accent and the poor quality of the recording it does make it a little hard to make some of it out.

<comment><USER5> Yeah; I didn't have trouble with it particularly, but two things I noted:

1) He has a very strong trill to his rhotic "r", which I think _must_ be put on for effect.

2) Does he have a slightly South African accent? I think he left South Africa at a young age (three, maybe?) so it seems odd that he still would at 60, but I'm not sure.

<comment><USER3> Yes, I wasn't sure about the rolled r. I could certainly make it out once I had shifted gear, but I have extremely received pronunciation myself; I wonder what someone with a more modern ear would make of it.</comment></comment></comment></comment>


Myers–Briggs Type Indicator: Criticism - <AUTHOR> https://en.wikipedia.org/wiki/Myers–Briggs_Type_Indicator#criticism <comment><AUTHOR> It seems how people think that if administered by managers it validates the MB test as worthwhile</comment>


How To Influence Developers - <AUTHOR> https://speakerdeck.com/myusuf3/how-to-make-friends-and-influence-developers

<comment><USER2> Pretty awesome talk for API Developers, Community organizers, and Open Source Developers.

Actual talk video is here.

[http://www.youtube.com/watch?v=x1igB5fk13k](http://www.youtube.com/watch?v=x1igB5fk13k)</comment>


Show HN: Veros, a high-performance ocean simulator in pure Python - <AUTHOR> https://github.com/dionhaefner/veros <comment><USER2> > Currently, the only officially supported Python version for Veros is Python > 2.7 (64-bit), which should be the standard Python interpreter on most > systems.

Couple questions:

\- Who cares if it's the standard Python on most systems? You shouldn't be installing things in to the system Python anyway.

\- Why start a project like this in Python 2? It's going to be EOL in a couple of years. New projects should absolutely be started in Python 3. I can't see a reason for starting anything new, intended for distribution, in Py2.

<comment><USER3> I agree that new projects should, in general, be targeting Python 3.x by default. In this specific case though, it looks like the Bohrium library being used by Veros for parallelization has some issues with Python 3 so that may be what's keeping this project on Python 2 (at least for now).

<comment><AUTHOR> This. I don't like recommending Python 2 either, but that's the way it is for now. Our tests pass on Python 3, too[1], but Bohrium isn't reliable enough on Python 3 to recommend it to the average user.

I should probably change to wording on that in the docs.

[1] [https://travis-ci.org/dionhaefner/veros](https://travis- ci.org/dionhaefner/veros)

</comment></comment></comment><comment><AUTHOR> Veros is a port of a traditional, MPI-parallelized, Fortran ocean model to Python / NumPy. All parallelism is handled implicitly by Bohrium ([https://github.com/bh107/bohrium](https://github.com/bh107/bohrium)), so all core routines just consist of basic NumPy-like array operations. The best part: Turns out we actually perform half as good as the Fortran reference on 24 CPUs, and as good on a GPU.

</comment><comment><AUTHOR> If you're curious how NumPy and Bohrium stack up against pure Fortran, I'd recommend you have a look at our benchmarks:

[http://veros.readthedocs.io/more/benchmarks.html](http://veros.readthedocs.io/more/benchmarks.html)

</comment><comment><USER4> What does someone use a ocean simulator for? It seems to be for meteorology, but what specific problems would a meteorologist use this for?

<comment><AUTHOR> > It seems to be for meteorology

Not quite - meteorolgists study the atmosphere, while the ocean is studied by oceanographers.

> What does someone use a ocean simulator for?

Ocean models are used to further our understanding of the dynamical system that is, well, the ocean. Ocean dynamics are governed by a set of partial differential equations (usually a simplified form of the more general Navier- Stokes Equations), which are coupled and nonlinear in the general case. Analytical results are only available for highly simplified setups, and many of the large-scale phenomena in the ocean are inherently unmeasurable (even more so since we are not able to observe the ocean in isolation, i.e., without atmospherical fluctuations). So we need numerical models to be able to setup more sophisticated experiments. A classical study is e.g. Kawase, 1987 [1], who showed in a simple model how the global large-scale ocean circulation is setup and maintained by only a couple dynamical effects.

So there are two kinds of ocean models: One is used to study the ocean in isolation, either using idealized or realistic models (which are both supported by Veros). The other kind are hyper-realistic coupled models, which are one crucial component of climate or earth system models like CESM[2]. Those are used to make projections of the world climate (and they're a major data source for the IPCC reports). Those are usually huge setups that run on the world's largest supercomputers, so only extremely optimized Fortran ocean models like POP[3] are used for that purpose.

Overall, earth system modelling is still a Fortran bastion, and Veros is the only higher-level programming language simulator I know of.

[1] [https://journals.ametsoc.org/doi/abs/10.1175/1520-0485(1987)...](https://journals.ametsoc.org/doi/abs/10.1175/1520-0485\(1987\)017%3C2294%3AEODOCD%3E2.0.CO%3B2) [2] [http://www.cesm.ucar.edu/](http://www.cesm.ucar.edu/) [3] [http://www.cesm.ucar.edu/models/cesm1.0/pop2/](http://www.cesm.ucar.edu/models/cesm1.0/pop2/)

<comment><USER4> Very interesting! Thanks for the short introduction!

Might I suggest adding an introduction along those lines to your README or docs? I think right now, when someone stumbles upon the project, unless they already have a very good understanding of the topic it is really hard to get a grip of it. From my experience, adding some more basic introductions to a scientific field (or links to such resources) to the documentation of a domain-specific software can go a long way in getting people interested in the field.

<comment><AUTHOR> Sure. I'll see how I can squeeze that in.</comment></comment></comment></comment>


Ask HN: Am I too old to switch to Bioinformatics through a Masters? - <AUTHOR> By trade I am a web developer and have worked a lot both in the backend and with different databases. My math is very rusty from high school (because as you may know, there is no math in "soft" software development any more which always surprises my friends when they ask). I remember almost zero about how cells work from school.
I was trying to forget this part, but I am 39 now.
There is a very nice Masters program where I live in Europe that is about Bioinformatics, I contacted the co-ordinator and said I could get in if I refresh my Math and Biology with a few books about linear algebra and the book "Essential Cell Biology".
So here is the thing. It would take me this year to prepare myself at my own pace for induction and study these. Next year I would start the 2 year Masters and I will graduate when I am 42.
I would like to either do a Phd or work in a research environment where as someone put it here on Reddit and it stuck with me "I would much prefer analyzing vast datasets of cancer causing molecules than datasets of user behavior to make the company monetize a product".
Questions:
1) Am I too old to be accepted in jobs and research environments after I finish the Masters
2) Is age-related cognitive decline an issue that you think might affect me? I couldn't find many examples of people switched to something very intellectually demanding with no experience later in IT (most of my colleagues are now project managers something that uses crystallized (learned) intelligence and experience rather than sheer processing speed & memory)
3) Will I be able to actually contribute or with my age I will probably end up cleaning excel sheet data? I want to contribute meaningfully
Please be blunt, I am about to spend 3 years of my life in this. <comment> pedantic-fool You're a software developer, so learning is something you're doing constantly without even noticing.

Sure the youngsters have an advantage in sheer symbol ingestion power, but you have experience and probably some intuition as to how to work with information, knowledge and systems thinking which they won't have. Just be open to new tools that go with the territory.

My concern in your case would be the ability to find relevant employment afterwards, as it is somewhat rare to change field mid-career. Certainly that, depends on both the job market you'd be targeting, and your willingness to take an "entry-level" job.

And if all else fails, you still have your developer skills to fall back on.

</comment><comment><USER2> You haven't even lived half your life. Hell you haven't even gone through half your work life, how could you be too old?

Never let fear of the future stop you from doing something that you want to do. Well, maybe within reason, but changing careers is definitely reasonable. People make the weirdest things work for them. The real question is whether you want to do it or not, not whether you can, because you absolutely can.

</comment><comment><USER3> Bioinformatics is a quite tough subject to study as it involves 3 distinct sciences: CS, Biology and Chemistry. I would say be prepared for a lot of study.

Ideally you don't want to go all in to risk everything, try to do it part-time for the first 6 months or 1 year and see how it goes (if you are even interested).

Note though that there are few jobs in bio at the moment, and due to that, ads usually ask PhDs (who at the same time have bigger advantage over a Masters candidate, although your experience is of high importance).

</comment><comment><USER4> If you can afford to do it without (or little) debt, and it doesn't effect your dependents, then why not?

<comment><AUTHOR> Yes actually finance is no problem and in Europe you don't even need debt, the Masters course costs in total $2k/year which would sound strange to an American..</comment></comment>


Ask HN: How did you get first 10 paying subscribers for your service? - <AUTHOR> Question for everyone who has launched products or online services. <comment><USER2> Here is my solution to this problem with review and credibility built in. Github exists for coders, people are massaging it for other projects. Crowdsourcing platforms are many but each have their faults. I am building a platform for anyone to contribute to projects. We are disrupting the future of work. PLease check out www.crowdraising.co/metacampaign and there is an explainer video that does the job [https://www.youtube.com/watch?v=w3QT4lqco8M](https://www.youtube.com/watch?v=w3QT4lqco8M)

</comment><comment><USER2> You are already on the right path. Communities like hackernews and product hunt are good for early adopters Quora,FB groups and meetups are next. Online SEO AdWords will get you some traffic. Best would be have ambassadors/refferars Communities in the real world that cater to your product or service are better for RoI

<comment><AUTHOR> Being new to HN and PH, I feel like influencers' help is needed to promote the story on such communities. Is it really so? Investing lots of time to boost karma does not sound like a good strategy at first glance.

<comment><USER2> I would recommend the rest of my previous post. Online communities will get peoples attention, and at best they are a large opening to a funnel.</comment></comment></comment>


Ask HN: Does the iPhone still need Flash support? - <AUTHOR> Does the iPhone still need Flash support? <comment><USER2> The iPhone never did need Flash support.

Flash is used for delivering ads (no thanks) and video (already covered by special-casing sites like YouTube). Flash is used for silly game sites, and we've got enough games on the iPhone (thank you very much (said by someone who has a non-game app (<http://grafly.com>) that's drowned out by all the game "noise" on the App Store ;-)).

Flash is the proprietary web, undiscoverable, unsearchable.

Flash is owned by entirely by Adobe, who make no bones about trying to build an entirely separate world in Flash to attempt to dominate the web and the desktop (AIR).

No thanks.

Edit: And, as antirez has pointed out, HTML5+JS+CSS are working hard to obviate Flash. With Google and Apple and Mozilla on their side, I think they have a good chance.

<comment><USER3> Apparently iPhone apps are undiscoverable as well... or so your comment implies.

Then special casing is not ideal and i'm fairly sure flash does get indexed these days.

Its apparent you don't want it, but does the iPhone need Flash? I don't know - i don't have one, but i would think its only a matter of time.

<comment><USER4> with HTML5 going forward the "flash is needed for videos" idea is going to vanish...

<comment><USER5> Not only is the "flash is needed for videos" idea going to vanish. The impact of the relentless improvements being made to the JS engines in Firefox, Safari, and Chrome are hard to over state. At some point, the combination of HTML5 and high performance JS starts to make me wonder how many other current applications of flash are doomed as well. It won't happen overnight, but I think the writing is certainly on the wall.

<comment><USER6> The JS improvements in Firefox its called Tamarin tracing and comes from the Flash engine, donated by Adobe, so they also want a fast js in the browser:

<http://www.mozilla.org/projects/tamarin/>

Adobe was also a big proponent of SVG standard (for vectorial graphics) with their very own plugin, until they purchased Macromedia.

Because Macromedia did a incredible, really great job pushing their plugin into the vast majority of browsers (google flash plugin penetration ~ 99%). They accomplished that by making a tool that web developers wanted and people liked, with a smaller plugin and better than any other company: fast animations (remember the pain of making gif89a or a java applet?), mp3 sounds! (remember midi, wav, au, aiff or the BGSOUND tag?), typography, any font! (not just Arial, Helvetica, Verdana, Times or Georgia), vector graphics that downloads and renders fast (is there any website using SVG now?), streaming video embeded into the html page (better than real player, quicktime or windows media, because it works almost for everybody, except the iPhone users, except when watching YouTube), microphone and webcam support, and now (with flash 10) they are putting 3d inside their plugin (before anyone could say OpenGL ES).

In an ideal world we would have solid standards, but in this world we have the W3C, and the abandoned XHTML2 or CSS3, unimplemented by the browsers CSS2, SVG, SMIL, and so on...

That is why we have got the propietary Futuresplash-Macromedia-Adobe Flash leading the web to its full potencial, in place of the W3C, or Sun's Java applets, Microsoft's ActiveX or Silverlight, Adobe PDF+scripts, Google nativeclient... but Macromedia did better.

<comment><USER7> Wikipedia has a lot of charts and such as SVGs. But I've never seen it anywhere else.

</comment></comment></comment></comment></comment></comment><comment><USER8> I don't think rehashing the flash argument in terms of "it's a proprietary technology" is necessary. I'm writing this comment from my iPhone. I can't remember any time in the last 2 years I have needed Flash on this thing for something mission critical. If anything, I am annoyed by the numerous warnings from various sites that make popup alerts saying I need it. The only time it was annoying not to have it was trying to read various links here on HN that were from scribd. Now they have iPhone friendly versions of their documents and that grievance is gone.

So no, the iPhone doesn't need flash and I would disable it even were it available.

</comment><comment><USER4> What I love of the iPhone not supporting it (and in one year of using the iPhone every day I never needed flash) is that it is a good argument against flash, to be used with people not understanding the other, more sensible, arguments against flash. So: _We can't use flash! Otherwise we have a problem with iPhone users_.

<comment><USER9> Personally, I've had a phone for two years, and ran into non-youtube video quite frequently.

<comment><USER4> Yep it happens, but most videos are also viewable searching for the title into Youtube. And as I said I really hope that HTML5 will remove this last problem... The only left problem is P0RN of course... but there is <http://pornhub.com> that is iPhone ready.

</comment></comment></comment><comment><USER10> As someone whose business primarily consists of Flash-based web sites and development, I was initially disappointed by the initial lack of Flash support and subsequent delays.

Now, I couldn't care less. In fact, I'd probably prefer the iPhone didn't have Flash support. For what we do at least, rendering Flash on the iPhone would be a usability nightmare. It's not hard to detect a visitor using an iPhone and render a much friendlier version.

<comment><USER9> I think you mean 'could not care less'.

<comment><USER10> Yes, of course ... edited

</comment></comment></comment><comment><USER11> I think users would love to have the option to access millions more apps/sites/content.

Flash is indeed searchable, and indexed since flashplayer 9.

</comment><comment><USER12> It's not about whether Flash is good or bad; or whether at some point in the future it's going to be outmoded. It's about the _fact_ that there are plenty of websites out there that do use Flash right now, and it would be, I don't know, kind of nice to be able to use them.

</comment><comment><USER13> Apple has many competitive products to Adobe. Of course they're not going to try and help Adobe.

It's also why they aren't supporting an open video tag. They have competitive products to it.

</comment><comment><USER14> Of course it does. There's a ton of apps and services built upon the Flash framework.

But hey. Flash is bad. Rarr. Objective-C good. Woot.

<comment><USER15> it's not that flash is bad per se, but rather adobe's stewardship of it. they're doing their best to create another microsoft-like monopoly around it.

and it can't help that the flash plugin on macs has always been abysmal. it uses way too much cpu time. any flash website i go to makes the fans spin on my older powerbook. hardly surprising, then, that the powers that be at apple are not too crazy about it. in fact, flash pretty much sucks on _all_ platforms except windows.

</comment></comment><comment><USER16> No.</comment>


Show HN: Dishes Nearby – CoreML and Yelp: search for dishes instead of restaurants - <AUTHOR> http://dishesnearby.com/ <comment><USER2> Can it differentiate between hot dogs and not hot dogs?

<comment><AUTHOR> Yes.

</comment></comment><comment><USER3> This is an app i would use. Any chance Android will ever see it?

<comment><AUTHOR> Probably not. I built it to try out CoreML and apply it for a practical solution.</comment></comment>


Tech Companies Petition FCC for Super-Fast Tethering - <AUTHOR> https://www.theverge.com/circuitbreaker/2019/7/23/20707456/6ghz-vlp-wi-fi-tethering-hotspot-apple-google-facebook-microsoft-qualcomm-broadcom-intel-marvell-hp <comment><USER2> part of testing could involve booting up with a far into future system date</comment>


Why Google is Hurrying the Web to Kill SHA-1 - <AUTHOR> https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1 <comment><USER2> Two nits, both pedantic:

An attack on SHA1 that makes certificate forgery viable within the next few years doesn't seem very likely, although over the long term it might be. The attack on SHA1 isn't like the attacks on RSA-1024; my sense is that the literature already knows how to break RSA-1024 given enough compute, but does not know how to do that with SHA1. Further, factoring RSA-1024 provides an attacker with a total break of RSA-1024 TLS, but not every attack on SHA1 will necessarily do the same.

Second, there's a subtext that SHA-3 having been standardized somehow puts the writing on the wall (albeit, a far-away wall) for SHA-2. Not so; SHA-2 could remain secure (in its TLS certificate use case) indefinitely.

<comment><USER3> Why SHA-2 instead of RSA 4096 or SHA-256? Even the RSA is compromised but 4096-bit will take a lot more(maybe few more hours) resources to decrypt.

==edited==

Thank you for the reply.

<comment><USER4> SHA-256 is one of SHA-2's hash functions: [http://en.wikipedia.org/wiki/SHA-2](http://en.wikipedia.org/wiki/SHA-2)

</comment></comment></comment><comment><USER5> A while back I launched a SSL scanner [1] and got tons of feedback from people at Facebook, Google, Microsoft.

The most divisive item was how to represent SHA1 deprecation. The OPs article doesn't really touch on it, but the reason that Google and everyone else haven't moved on is that there still exist a sizeable number of clients that can only accept SHA1 (and will error on anything else).

I actually suspect that large sites like Facebook, etc will maintain multiple certs at the different levels and dynamically serve the best one up that the client can support. They're already doing things like only serving HSTS to browsers that identify as Chrome, etc.

1 - [https://www.expeditedssl.com/simple-ssl- scanner/scan?target_...](https://www.expeditedssl.com/simple-ssl- scanner/scan?target_domain=google.com)

<comment><USER6> > I actually suspect that large sites like Facebook, etc will maintain > multiple certs at the different levels and dynamically serve the best one up > that the client can support.

How would you do that? When the TLS connection is established you know nothing about the client except its IP address. All of the interesting information about the browser is transported via the HTTP stream which is tunneled _inside_ the TLS connection.

HSTS is simple by comparison, as it's only an HTTP header.

<comment><USER7> Not true; consider SNI as an example of the server choosing a certificate as part of the handshake, without a cleartext exchange of the hostname.

[http://en.wikipedia.org/wiki/Server_Name_Indication](http://en.wikipedia.org/wiki/Server_Name_Indication)

<comment><USER6> Actually the SNI extension _is_ sent in the clear. That's one of the things TLS 1.3 is supposed to fix. (See e.g. [http://www.ietf.org/mail- archive/web/tls/current/msg10484.ht...](http://www.ietf.org/mail- archive/web/tls/current/msg10484.html) for a discussion about how to handle SNI there). You have a point, though, in that the TLS extensions sent by the client might give you some indication with what client you are talking with. I would not hope for it though, and even if, such heuristics are hell of an ugly hack inside the TLS stack.

</comment></comment></comment></comment><comment><USER8> I'd like to see them gradually downgrade all non-PFS connections. Non-PFS connections should be considered medium-to-highly vulnerable, and shouldn't receive a green icon in browsers.

Unfortunately, they've just recommended everyone to use "2048-bit keys" when they announced the HTTPS Google ranking policy. A lot of developers won't understand the difference between a 2048-bit RSA key and a 256-bit ECC key, so they'll just pick RSA, since "Google said 2048-bit keys!". Sooo...maybe this policy will come in 10 years.

[http://googlewebmastercentral.blogspot.com/2014/08/https- as-...](http://googlewebmastercentral.blogspot.com/2014/08/https-as-ranking- signal.html)

<comment><USER9> This seems to be a case of a slightly unfortunate wording.

Google calls for the use of 2048-bit key _certificates_ , a very reasonable demand. In the forward secure use case, the certificate key is only used for authentication. Using, say, ECDHE_RSA as your key exchange mechanism allows for small but secure elliptic curve keys (EC), forward security (DHE) and uses the certificate's RSA key for initial authentication (RSA).

Certificates can actually use ECDSA keys, and some companies will support this (Symantec and CloudFlare off the top of my head), but I'm not exactly sure about browser support. The chief advantage, as far as I know and assuming no new breaks in RSA, is a strong reduction in certificate file size (256-bit vs 3k RSA equivalent), not forward security.

</comment></comment><comment><USER10> Everyone is vulnerable: [https://www.google.com](https://www.google.com), [https://www.facebook.com](https://www.facebook.com), [https://www.svyft.com](https://www.svyft.com) as per the link provided in the article ([https://shaaaaaaaaaaaaa.com](https://shaaaaaaaaaaaaa.com))

<comment><USER2> Vulnerable to what? Perhaps better to say, "everyone would be vulnerable".

<comment><USER3> Https is to prevent wiretapping and man-in-the-middle attacks.

The problem now is even you established HTTPS connection, the weak SHA-1 encryption will not protect you.

<comment><USER2> The SHA1 vulnerability being contemplated here affects only the establishment of an HTTPS connection; the attack scenario involves obtaining a forged certificate.

<comment><USER11> That's an especially pedantic correction, as it does not impact the meaning of the statement.

s/the weak SHA-1 encryption/the weakened SHA-1 hash used to verify the certificate that's used to authenticate the encrypted connection/

<comment><USER2> It is, you're right. It's a hobbyhorse of mine, though, because SHA1 (and MD5) appear in TLS ciphersuites as MAC components, and those uses are not known to be vulnerable at all.

</comment></comment></comment></comment></comment></comment><comment><USER12> So where is the fully automated solution for rotating certificates?

I've been looking for a CA who will provide an API to send the cert request, an easy way to prove the domain ownership which doesn't involve SMTP, and the signed cert handed straight back from the API, but haven't found it.

So far the most I've been able to streamline my certificate requests is to automate generating the CSR, skip setting the MX record, just bind SMTP to www.domain.com, get the validation email at 'email@example.com' and auto- forward to my actual email address... so it's _mostly_ automated, but I still have to copy/paste the cert request string into the CA's webform, click the 'Approve' link in the forwarded DV mail, and then copy/paste the final cert from inside email back to the shell where it can finish the import.

<comment><USER13> I'm working on this problem: [https://sslmate.com/](https://sslmate.com/)

Right now it's just a command line client, but a public API is in the works. And this week we'll be announcing a solution to the cert rotation problem (basically, you'll be able to drive your renewals from cron - it's going to be really cool). You might want to follow @sslmate on Twitter - this is just the beginning of some very exciting stuff for automating SSL cert deployment. Also feel free to email me (address is in my profile).

Sadly, we're still SHA-1 only, because that's all that our certificate authority (RapidSSL) supports at the moment. On the other hand, once we make renewals dead simple, you can just buy 1 year certs and it won't be a big deal upgrading to SHA-2 in a year's time. (After all, even Google is still using SHA-1, but they can easily switch thanks to their 3 month certs and well-oiled cert deployment machinery.)

<comment><USER12> Very interesting, thanks! I unpacked the .deb, the nodejs source is pretty easy to follow, so I'd say you pretty much already have the public API done. ;-)

The /link API is interesting, versus generating a token on your site through the UI. You might want to consider allowing an explicit $$ limit on /buy, since you store the api-key in the clear (albeit in a config file set to 0600).

It looks like you still rely on being able to receive an email on the domain and click an approval link, though. I'm sure this is a RapidSSL requirement, but it makes full automation more complex (certainly not impossible).

<comment><USER13> Thanks for checking it out! Yeah, it's really just a matter of documenting the API ;-)

Unfortunately it does rely on being able to receive an email, as this is a requirement of virtually all certificate authorities, though the email address in the whois record is also an option (at least for TLDs which list the email in whois). I have some ideas to make this easier for users who don't otherwise receive mail at their domains, such as by letting them point their MX record at sslmate.

A configurable $ limit on /buy is a very good idea; also I should make it possible for users to use sslmate without permanently storing their API credentials on the filesystem.

</comment></comment></comment></comment><comment><USER14> Understanding that this is a naive outsider perspective, I find it strange that it's any sort of emergency when a single collision has yet to be produced. And then, does the latest hash collision attack allow you to make a collision with a _specific_ target or just make a collision in general? Finally, even if you hit the target with some junk that happens to hash to the same thing, is it going to be in correct file format, and within an acceptable size? It seems like there are a handful of hurdles for the bad guys to go over before we're in danger.

I know crypto is not to be taken lightly, and I'm glad people would rather be safe than sorry, and I'll avoid SHA-1 in my own personal security use (`sha256sum` is sha-2 right?). I'm just curious.

<comment><USER15> When a collision is produced it will be too late. The time to act is before that happens.

<comment><USER14> I guess that's the surprising part. I figured that that's just the first hurdle, there's still the file length and format.

</comment></comment></comment><comment><USER16> An unrelated annoying thing: I want to disable TLSv1 support for my site, for obvious reasons. I don't care about backwards compatibility for my personal site, but I still can't flip the switch... because Googlebot doesn't support anything newer than TLSv1.

</comment><comment><USER17> Thank you google.

I'm a developer, but I'm not responsible for SSL cert acquisition.

The ONLY way I can get the people responsible for that to stop using SHA-1, is to tell them that user's browsers are sending a warning/error message on it.

I will eagerly await Chrome doing that.

</comment><comment><USER18> It's surprising how much energy Certificate Authorities invest into arguing about this. Instead, they should invest that energy into improving their SHA-2 support and helping their customers migrate.

<comment><USER19> They are businesses. Their customers are mostly businesses. SHA1 is, for most businesses that only want a padlock to reassure their customers, just peachy. A CA that hassles their customers and says "you need to do complicated extra work" is put at a disadvantage to other CA's that have a "customer is always right" kind of attitude. Combined with tools that default to SHA1, and customers that may depressingly actually have Windows XP SP2 terminals still in production use, and you get feet dragging.

I don't think this is inherently a problem with the CA model. Rather it's what you'd expect in a competitive market that is basically selling a binary commodity product (a padlock icon), given textbook economics.

<comment><USER20> What's weird though is that they have a consortium. They could have all agreed simultaneously to stop issuing SHA1 certs years ago and at no market loss. But they didn't.

<comment><USER19> No. They've been quite clear about this. CA's are still selling SHA1 certs because customers are asking for them. They're asking for them because they're compatible with more apps/devices and - until now - browsers treated them the same. So why sacrifice compatibility for no improvement.

The Chrome team are right to push this along, but I do have some sympathy for the CA's here too. I read the whole discussion and it's pretty clear that there was some epic miscommunication going on here. Notably Google thinks that removing the padlock icon is not "deprecation" according to the timetable Microsoft established, but all the people buying certs disagree; that's why they're doing it.

<comment><USER21> > So why sacrifice compatibility for no improvement.

No improvement? How about improvement in security?

<comment><USER19> The reality is most people running websites that use SSL are not security experts and cannot evaluate the weakness of SHA1 vs SHA2. So they trust the defaults, which are SHA1 (in e.g. openssl). Their goal is to get the padlock, not to achieve some other notion of security.

</comment></comment></comment></comment></comment></comment><comment><USER22> Would be interesting to know how this affects Git version control, which has SHA-1 at its core.

<comment><USER23> I assume you would need to forge a meaningful (and potentially harmful) commit with the same SHA-1 as an existing one to do arm. That's probably more difficult than forging an SSL certificate (since the actual contents of the blob are more constrained that the certificate file, probably). I'm also not really sure what would happen if commits made after the "compromised" one happened to conflict with it but I'm pretty sure the devs would notice something fishy going on pretty quickly.

That being said git/mercurial and friends will have to transition to an other hashing algorithm sooner or later but it's not as urgent as web certificates security-wise.

<comment><USER24> I'd think the content of the blob is less constrained, because you can put whatever padding fluff you need at the end of the commit message to adjust the sha1 of the commit. To cause harm, you'd include the trojanized code in a different file which your colliding commit blob references. (So, you'd need to include multiple blobs, but only the commit-message one needs to collide with an existing one)

A collision in commit hashes would mean you could no longer trust a signed tag, for example.

Look up the old stripe-ctf "gitcoin" challenge and you'll see it really is quite easy to meddle with commit hashes :)

</comment></comment></comment><comment><USER25> One would think it would have been a good opportunity to change to SHA-2 after Heartbleed, since most websites had to get reissued certificates anyway. Since this process is a pain in the __* then one could have killed two birds with one stone at the time. Alas

<comment><USER26> In fact, Heartbleed helped a lot: [http://news.netcraft.com/archives/2014/05/05/sha-2-very- cryp...](http://news.netcraft.com/archives/2014/05/05/sha-2-very- cryptographic-so-secure-such-growth-wow.html) But there's a long way to go.

</comment></comment><comment><USER27> Also its not exactly fair to compare the Flame attack on MD5 and compare it immediately to SHA-1. Unless you are the US or China you likely don't have the resources necessary to pull off that sort of attack.

The Flame attack's math was invented by an internal government cryptographic think tank. And still had to leverage massive computational power, just not in the order of 100's of millions.

The idea a rogue group who have access to (both of) these resources is slightly idiotic. It would be far easier for them to attack RSA directly if you had 10's of millions of dollars of computers. There are a lot of 1024 bit certs you could pick off for easy profit.

<comment><USER28> Botnet.

<comment><USER27> As I stated.

The computation power needed to break SHA-1 is higher then attacking RSA. So if you are financially motivated attacking RSA has a higher ROI.

<comment> squeaky-clean While true, "There's something more profitable to attack at the moment" seems like a lousy way to handle security.

<comment><USER27> I never said moving away from SHA-1 was irrelevant. I was simply stating that they were overestimating how common the FLAME attack could be pulled off.

Flame like Stuxnet are state of the art. Highly funded state of the art. A lot of security researchers look at these things and simply say, "Are you shitting me?!"

Call me optimistic but I highly doubt we'll be uncovering a new stuxnet every single year.

</comment></comment></comment></comment></comment><comment><USER29> This article is amazing! I work in the SSL industry and this is a huge help in summarizing exactly whats going on.

@konklone, have you followed the CAB Forum's mailing on this topic? Its the most I've seen them argue in well over a year.

<comment><USER26> I have, it's one of the links in there. I truly loved reading that discussion.

</comment></comment><comment><USER30> Just to be clear, since I often end up confused on this point — is the use of SHA-1 with HMAC, outside of the context of SSL, still acceptable?

<comment><USER6> The use of SHA1 with HMAC, _inside_ as well as outside of the context of SSL is still acceptable, yes. Even against a nation state attacker. The reason attacks on HMAC(k,m)~=SHA1(k||SHA1(k||m)) are much more difficult than general collision attacks is that as an attacker you do not know the internal state of the hash function when you are trying to create a collision with m, as the secret key is input in the hash function first.

The attack vector for TLS certificates is the (asymmetric) _signature_ which signs a plain SHA1 hash message. I'm still disappointed that after all the experiences they have had with MD5 they haven't yet started to randomize the hash in the signature (sign SHA1(random||message) instead of SHA1(message) ) which would boost the signature security to that of HMAC.

</comment></comment><comment><USER31> Seems like the SSL certificates that CloudFlare automatically generates for sites are SHA-1 signed.

Anyone know if they're planning to upgrade to SHA-2?

<comment><USER26> They can be seen in the Chrome discussion thread, complaining to Google that the timeline is too aggressive. But they're a good company, and I imagine they'll update as soon as they can.

<comment><USER31> Ah interesting, thanks.

(For anyone else, here's the link: [https://groups.google.com/a/chromium.org/d/msg/blink- dev/2-R...](https://groups.google.com/a/chromium.org/d/msg/blink- dev/2-R4XziFc7A/cLDiqrrnkPkJ))

<comment><USER2> This is a great thread. Thanks for posting it.

</comment></comment></comment></comment><comment><USER32> The issue here is old clients... Does anyone know how old clients would handle SHA-2 certs, would they just get a warning saying the site is insecure but still be able to visit the site over an encrypted connection or do they break completely... I guess - I'll have to run a few tests this afternoon and see how windows XP performs.

<comment><USER33> Please let us know. Here's a table showing when SHA-2 support was added to various browsers.

[http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_br...](http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers)

<comment><USER34> I've seen in a lot of places that Chrome only supported SHA-2 since version 26 (2013). I find this hard to believe (Firefox supported it since 2005) and I can't find a solid reference for it. However I note that this page from 2008, says Chrome supports it [https://www.tbs- certificates.co.uk/FAQ/en/476.html](https://www.tbs- certificates.co.uk/FAQ/en/476.html) (e.g. from version 1)

</comment></comment></comment><comment><USER35> "SHA1 and other hash algorithms generate a digital fingerprint that in theory is unique for each different file or text input they sign."

... and there it goes, any credibility I would give the author. There's dumbing down the content for a non-technical audience, and there's not understanding.

<comment><USER36> what's wrong with that statement exactly?

<comment><USER37> Two things:

1\. Hashes don't "sign" things (not directly anyway)

2\. Hashes aren't unique in theory or practice (using a 256-bit hash on every 257-bit number will generate 2^256 collisions by the pigeonhole principle).

<comment><USER38> High quality hashes are unique in practice.

Suppose every person generates 1 billion files a second * 7 billion people * 1,000 years = ~3x10 ^ 28 call it 10^29. For a collusion among non identical files using a good 256 bit hash you get ~1/(2^256) * (10^29) * (10^29) = ~1/(2^198).

Or 1 chance in ~4 * 10 ^ 59 of finding even one collision.

<comment><USER39> Your math is off a bit[0][1] but you're right, it's a vanishingly small probability of a single collision. This is fairly academic though, when you're talking about an adversary exploiting weaknesses in the algorithm itself, and not a perfect PRF.

[0] [http://preshing.com/20110504/hash-collision- probabilities/](http://preshing.com/20110504/hash-collision-probabilities/)

[1] [http://www.wolframalpha.com/input/?i=%281+billion+*+7+billio...](http://www.wolframalpha.com/input/?i=%281+billion+*+7+billion+per+second+*+1000+years%29^2+%2F+%282+*+2^256%29)

<comment><USER38> Ops, when counting exponents make sure there in the same base.

</comment></comment></comment></comment></comment></comment><comment><USER40> What does stop Google Chrome simply disallow new SHA-1 hashes that collide with known list of SHA-1 hashes for existing certificates?

That would allow non-colliding SHA-1 certificates function as usual and prevent millions of people from major headaches related to speedy certificate migration.

</comment><comment><USER41> Or cut to the chase and just deploy DANE, so that we don't need CAs to sign anything?

[http://en.wikipedia.org/wiki/DNS- based_Authentication_of_Nam...](http://en.wikipedia.org/wiki/DNS- based_Authentication_of_Named_Entities)

</comment><comment><USER42> I'm not saying the conclusion is wrong, but the reasoning likely is: there's a _huge_ difference between a collision attack and a so-called second pre-image attack [1]. To impersonate a website protected with an SHA-1 certificate you'd have to mount the second kind.

> Walker's estimate suggested then that a SHA-1 collision would cost $2M in > 2012, $700K in 2015, $173K in 2018, and $43K in 2021.

If you adjust those cost estimates for the fact that a second pre-image is needed they look more something like this:

An SHA-1 second pre-image attack (needed to e.g. impersonate an SSL protected website) would likely cost about 10^26 USD in 2021... By comparison world GDP is only about 10^14 USD.

Better safe than sorry though. :)

1\. [https://www.ietf.org/mail- archive/web/pkix/current/msg30395....](https://www.ietf.org/mail- archive/web/pkix/current/msg30395.html)

</comment><comment><USER43> Can someone post a summary of the part of the story hinted to by the headline? I couldn't find it.

<comment> squeaky-clean It's one of the links early in the story. (It's pretty link heavy, so it can be hard to miss. 6th link in).

Basically, by 2015, Google will update Chrome to show websites with HTTPS certificates using SHA-1 as "insecure." The level of insecurity shown will get more severe over time, as well as being based on when your certificate expires. Here is the full link for details:

[http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...](http://googleonlinesecurity.blogspot.com/2014/09/gradually- sunsetting-sha-1.html)

<comment><USER43> That's _What_. The headline hints at _Why_ , but never delivers.

<comment> squeaky-clean This entire article is about Why. Read the "An attack on SHA-1 feels plenty viable to me" section for the most info.

<comment><USER43> I see -- it's not announcing any news, or any new theories; it's just a roundup of last week's news.

<comment><USER44> Yes. Much like last week's news was. :-)

</comment></comment></comment></comment></comment></comment><comment><USER45> When I use the sha tool against google.com, it shows them using SHA-1.

<comment><USER46> Google has stated they wont complete their transition until 2015

</comment></comment><comment><USER47> SHA1 is the only supported hash algorithm for PGP key fingerprints.

</comment><comment><USER48> Ironically, www.google.com - Itself is using SHA-1 :)

</comment><comment><USER48> Ironically, www.google.com itself is using SHA-1

Ref: [https://shaaaaaaaaaaaaa.com/check/www.google.com](https://shaaaaaaaaaaaaa.com/check/www.google.com)

</comment><comment><USER49> Another PR stunt Google ? No that wont work.</comment>


The Debate over Ending Social Distancing to Save the Economy, Explained - <AUTHOR> https://www.vox.com/coronavirus-covid19/2020/3/27/21193879/coronavirus-covid-19-social-distancing-economy-recession-depression <comment><USER2> _The debates over whether playing Russian roulette or having clickbait titles are good ideas._

People > profits</comment>