HTTPS as a ranking signal - <AUTHOR> http://googleonlinesecurity.blogspot.com/2014/08/https-as-ranking-signal_6.html <comment><USER2> I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere.

Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner:

1\. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How many times have you accessed a site on an open network or from a hotel and got unexpected ads? This is a very visible manifestation of the issue, but it can be much more subtle.

2\. Authentication: How can users trust that the site is really the one it says it is? Imagine you're a content site that gives financial or medical advice. If I operated such a site, I'd really want to tell my readers that the advice they're reading is genuinely mine and not someone else pretending to be me.

On top of these, your users get obvious (and not-so-obvious) benefits. Myself and fellow Googler and HNer Ilya Grigorik did a talk at Google I/O a few weeks ago that talks about these and a lot more in great detail:

[https://www.youtube.com/watch?v=cBhZ6S0PFCY](https://www.youtube.com/watch?v=cBhZ6S0PFCY)

<comment><USER3> In my country, the cost of a SSL certificate is around 60% of my hosting costs, per year. I run a low-traffic blog with comments disabled, so users do not "interact" with the site in any way - except consume the content. I don't see any benefit from this.

<comment><USER4> [https://www.startssl.com/?app=1](https://www.startssl.com/?app=1) and [https://www.namecheap.com/campaigns/2014/reset-the- net.aspx](https://www.namecheap.com/campaigns/2014/reset-the-net.aspx) ???

<comment><USER5> StartSSL is pretty harmful as evidenced by the events after Heartbleed. The certificates are free but they charge you to revoke them, and after we found out about Heartbleed and realized a lot of those free certs were compromised a lot of people refused to pay up for their free keys and continue using the compromised ones. What's more is that StartSSL refused to do the right thing and revoke them, leading a lot of folks to even go as far as petitioning to remove StartSSL from Firefox's Certificate Authorities because any given site using their free certs could be compromised. [0]

[0] [https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=744027](https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=744027)

<comment><USER6> Erm... Heartbleed has absolutely _nothing_ to do with what version of OpenSSL you use to _generate_ the cert.

<comment><USER7> No, but if your SSL certificate has been exposed by Heartbleed, it would be sensible to revoke that certificate to prevent potential spoofing attacks, wouldn't it?

StartSSL charge you for revoking that exposed certificate, so your choices are you pay for the revocation, or wait until the certificate expires.

<comment><USER8> In there defence this their treatment of revocation requests is made quite plain in their policies, and any heartbleed exposure was not their fault (their signing certs were not affected IIRC).

Now if there _had_ been a problem with their signing certificates _then_ I would have expected them to revoke anything affected for free and offer replacements similarly at no cost.

OK, they could have done that anyway (or perhaps offered a discount on the revoke charge) as an good will gesture, but they didn't, so what.

<comment><USER9> Leaving aside the question of whether their response was reasonable (I see the arguments either way), it turned out that using their service to secure your website was not free.

<comment><USER8> _> it turned out that using their service to secure your website was not free_

All they claim is to provide free certificates for non-commercial use, and that they do provide. If people read something else into that it isn't because they were deliberately led to.

Though many people picking up a cert without really knowing the infrastructure won't know about revocation infrastructure and such so might have mislead themselves by having not read the Ts&Csm.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Considering the importance of HTTPS to, in Google's words, "[making the] Internet safer more broadly", this seems like a good time to again suggest that Google enable HTTPS for Google Analytics by default[1].

Google Analytics is on 50.8% of the top million domains on the Internet, and on 26.96% of a randomly selected 48.5 million domains[1]. Of the 42 billion links analyzed in my research, over 48% of them had Google Analytics on either the start or the end. That's a lot of information leakage.

Anyone who is eavesdropping on HTTP connections to the Google Analytics endpoints can observe a web user's traffic history trivially. This enables simple mass surveillance by specifically looking for these connections and recording them. HTTPS would prevent that.

I should note, whilst there is an option to specifically force SSL in the new Google Analytics[2], it must be enabled by default in order to have a positive impact. We can't rely on the owners of millions of domains to upgrade to ensure an end user's privacy.

[1]: [http://smerity.com/articles/2013/google_analytics_and_nsa.ht...](http://smerity.com/articles/2013/google_analytics_and_nsa.html)

[2]: [https://developers.google.com/analytics/devguides/collection...](https://developers.google.com/analytics/devguides/collection/analyticsjs/field- reference#forceSSL)

<comment><USER11> Sorry to jump in with a tangential reply, but BEWARE of the following!

Google treat the http and https versions of a domain as SEPARATE PROPERTIES. This means that even if you 301 every http page to https when you transition, all of your current rankings and pagerank will be irrelevant.

You can verify this behaviour for yourself in webmaster tools.

I suppose this is because it's possible to serve up different content on http/s, but really, who does that?!

In short, don't do this until google rethink their stance on what counts as a property. I'm currently nursing a client with a 30% revenue hole as a result of this.

<comment><USER2> > Google treat the http and https versions of a domain as SEPARATE PROPERTIES.

That's not quite accurate. It's on a per-URL basis, not properties. Webmaster Tools asks you to verify the different _sites_ (HTTP/HTTPS, www/non-www) separately because they can be very different. And yes I've personally seen a few cases - one somewhat strange example bluntly chides their users when they visit the HTTP site and tells them to visit the site again as HTTPS.

> This means that even if you 301 every http page to https when you > transition, all of your current rankings and pagerank will be irrelevant.

That's not true. If you correctly redirect and do other details correctly (no mixed content, no inconsistent rel=canonical links, and everything else mentioned in the I/O video I referenced), then our algos will consolidate the indexing properties onto the HTTPS URLs. This is just another example of correctly setting up canonicalization.

By the way, if you're moving to HTTPS, following our site moves guidelines:

[https://support.google.com/webmasters/topic/6033102?hl=en&re...](https://support.google.com/webmasters/topic/6033102?hl=en&ref_topic=6029673)

specifically, the site moves with URL changes:

[https://support.google.com/webmasters/answer/6033049?hl=en&r...](https://support.google.com/webmasters/answer/6033049?hl=en&ref_topic=6033084)

But you did say you have a client with an issue. I suspect they either implemented the move to HTTPS incorrectly or something else is going on. Please ask for more help at our forums:

[https://productforums.google.com/forum/#!categories/webmaste...](https://productforums.google.com/forum/#!categories/webmasters)

<comment><USER11> Nope, we followed the instructions to the tee. Straight 301 redirects from http to https, appropriate canonicals on all pages referencing https, and their SEO has seemingly started from scratch - used to be in position 1 for a variety of important keywords and searches, now they're beyond page 10.

Oh, and you _can 't_ do a change of address from [http://www.whatever.com](http://www.whatever.com) to [https://www.whatever.com](https://www.whatever.com) \- you don't allow it!

<comment><USER2> This suggests something else is going on. Please post in the forums with the site details.

<comment><USER11> Done. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER12> I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair.

This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and have provably done a horrible job of it in the past (websocket over SPDY, anyone? Yeah, I'm not even sure which version combination of SPDY and websocket I'm talking about either - pick one of the hundred)

There are strong arguments for not enabling privacy by default - not least since it prevents any kind of decentralization or caching of content. At a time when OpenSSL just suffered one of its worst bugs in history, forcing small sites to assume the risk of running code like this, which they inevitably will get wrong, _materially worsens security for all_ , it doesn't improve it.

<comment><USER13> _This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works_

I don't see how is this any different from any other signal that Google uses to prioritize sites. Forcing small businesses to buy certificates doesn't seem any different than forcing them to have faster websites, for example.

There's an argument for more diversity in search engines, but I don't see how is that specific to this signal.

 _There are strong arguments for not enabling privacy by default - not least since it prevents any kind of decentralization or caching of content._

How does it prevent decentralization?

 _At a time when OpenSSL just suffered one of its worst bugs in history, forcing small sites to assume the risk of running code like this, which they inevitably will get wrong, materially worsens security for all, it doesn 't improve it._

How many people could exploit Heartbleed before it was publicly announced compared to how could sniff traffic on open networks, as countless tutorials explain how to do?

Heartbleed was bad, and OpenSSL is a mess, but let's pretend that unencrypted logins are somehow less bad.

<comment><USER14> > I don't see how is this any different from any other signal that Google uses > to prioritize sites. «Oh, they're screwing up before, too? Then I guess it's > alright»

> How does it prevent decentralization? Because only a handful of companies > can issue certificates.

<comment><USER13> _«Oh, they 're screwing up before, too? Then I guess it's alright»_

How is it screwing up? How are they supposed to run a search engine without prioritizing? "Here's 30000 results, we've randomly sorted them for you"?

 _Because only a handful of companies can issue certificates._

Fair enough.

<comment><USER14> Apologies, I haven't made myself clear with that idiotic of a snarky remark :) What I meant is that their actions in the past shouldn't be an excuse to their actions today.

The principles behind PageRank are based on unbiased reputation, and provide for a good ranking system (spammers aside). Whatever's thrown on top needs to be carefully considered not to enforce biases towards any group in particular.

</comment></comment></comment></comment></comment><comment><USER15> Would be more awesome if they offered free certificates and an API to renew them.

Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires.

Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case.

It's worth mentioning that [https://www.startssl.com/](https://www.startssl.com/) does offer free certificates. But without a paid account they last only a year and cannot be issued to wildcard domains, so you quickly end up with a lot of certificates that has to be manually renewed each year.

<comment><USER16> What about a kickstarter to subsidize SSL costs? Or how about one to buy a root CA and make it free?

<comment><USER13> There is already a community-driven CA: [http://www.cacert.org/](http://www.cacert.org/)

The problem is that it's not only about money. You need to follow certain procedures or browsers and OSs won't include your root certificate.

<comment><USER17> I don't think anyone has confidence in CACert anymore. IIRC they bombed their internal audit...

</comment></comment></comment></comment><comment><USER18> My issue with SSL everywhere is that I have to effectively buy my domain twice: once for the domain, and one again for the certificate. My registrar should give me a wildcard certificate good for the time I've paid for my domain.

<comment><USER19> Maybe because there isn't much of demand for that, yet.

Shall the transition come and we'd all perceive HTTPS as a default, it's very likely registrars would also offer certificate signing.

<comment><USER20> The price wars for domain registration pushed the cost way down over the past few years. Certs are starting to move in the same direction. As volume picks up, they can cut margins. And some guys will start to treat it as baseline feature and not a buy-up.

</comment></comment></comment><comment><USER21> I'm interested in statistics (especially from websites with non-technical and international audiences) about what percent of visitors are using browsers/devices that don't support SNI.

I don't know how representative this is, but it looks like StatCounter Global Stats [1] says that slightly over 10% of recorded visitors are still using Windows XP, and many of these users won't have SNI support.

Small websites without strict security requirements often use shared hosting, where SNI is the only practical way to implement HTTPS. Alienating something like 10% of visitors with a security warning is probably not desirable. I imagine this could be a not insignificant roadblock to widespread SSL adoption on small websites, but would like to see more detailed stats.

[1] [http://gs.statcounter.com/#os-ww- monthly-201307-201407](http://gs.statcounter.com/#os-ww-monthly-201307-201407)

<comment><USER22> [http://www.utilitydive.com/](http://www.utilitydive.com/) is a US-based news site for the electric utility industry. About 4.5% of visitors are on Win XP and most of those people are using XP. It's trending down pretty sharply; it was nearly twice that at the start of the year.

</comment></comment><comment><USER23> I don't get it. I have a website that is purely content and available to everyone. It has no user accounts, no sign-ups, no nothing but static pages. Why should I use HTTPS for that? To prevent man-in-the-middle attacks?

<comment><USER24> Using HTTPS will let you know if the website you're visited is being messed with by a company, country, or regionally controlled firewall or content filter. If someone operating one of these filters took issue with your site, they could block certain content and users wouldn't necessarily know that it's happening.

</comment></comment><comment><USER25> Usefulness of SSL aside, is anyone else terrified that Google can essentially dictate what it wants developers to do, with low search rankings as the penalty for not following them? In my opinion, this sets a scary precedent.

<comment><USER26> Yes. Fortunately, they're doing it in the name of improving the web.

So far.

</comment></comment><comment><USER27> Makes sense. The reason seo spam is effective is because it's so cheap to get a new site (or ten thousand new sites) up and running. If you make that cost $50 per domain for the ssl cert, that will help ensure all those sites sift nicely down to the bottom of the rankings.

Bonus points if they allow a single bad site to tarnish the reputation of all sites under a milti domain cert.

We could have had this from the start if domain names weren't essentially free via domain tasting. But hey, better late than never.

<comment><USER28> I do agree, however remember that you can get SSL certs from $9 (e.g. from NameCheap). You might be able to pay lower if you shop around too.

Also even if it was used as a fairly strong ranking signal, if Google still approach their rankings like they do now, spammers might still have sufficient ranking 'weight' to overcome a lack of SSL certificate.

<comment><USER29> Don't forget you have to manage your certs. It's an extra burden.

Let's say I am a freelancer, I make website for small restaurant. Until now I could make a website with frontpage, menu and gallery put it on a server and be done with it and collect a monthly fee.

Now, you have to manage the cert, that is say every year re-issue a new cert and invalidate the old. It adds costs. Without much if any benefits for some class of websites.

<comment><USER30> I'm a freelance web developer for dozens of restaurants. They pay for the site, then a yearly hosting fee every year after launch. They get a basic CMS so they can update their hours/menus/etc.

I host all their sites on a few VPS servers. Some of my contracts require support for IE 7 or IE 8 on Windows XP, and those browsers don't support SNI. So in addition to what you've mentioned - maintaining certificates and losing more of what little money I make on hosting (I basically charge a small % of the VPS cost plus a few hours' worth of work), I now will need to figure out another solution. It seems like a waste to spin up a new VPS for each site that requires XP support.

Clients look at the <10% of visitors coming from Safari and IE7+8 on XP and say "those are potential customers." It's difficult to argue with that.

For now though, I'm going to do nothing new. All indications are that HTTPS is going to be maybe 1% of the ranking, and I know my market well enough that the sites rank highly for local searches - which is the important part. They're responsive and they've all got social media presences, so until SSL is more important for PageRank, I'll wait it out.

<comment><USER29> A few people I've talked with told me the same. For now they won't care. But as told me a friend, if too much client start to ask for it will be troubles for him.

But that is to be kept in mind : "But over time, we may decide to strengthen it, because we'd like to encourage all website owners to switch from HTTP to HTTPS to keep everyone safe on the web."

</comment></comment></comment></comment></comment><comment><USER31> Google has a strong case to have HTTPS implemented:

It prevents ISPs etc. from being able to profile your traffic, but not Google's, since you're probably visiting a site with Adsense or Analytics running on it anyway.

Through HTTPS, Google is the only one with a profile of your traffic, and your ISP is no longer a competitor to them.

<comment><USER32> Hm. I think this is the real answer.

</comment></comment><comment><USER33> It probably bugs me the way it does, because this "signal" has nothing to do with the contents or the usability of the web site (unlike speed, validity of HTML or, well, content itself), but is purely a "we just think you should do X" situation.

<comment><USER34> I would definitely prefer to use a site that supports HTTPS over HTTP. For personal safety reasons in addition to privacy and general welfare of the web.

If you're searching for something and roughly the same content is available at safedomain.com vs. notoriouslysketchy.ru, I'd think you'd prefer to be shown the former above the latter. I don't see how this is much different.

</comment></comment><comment><USER35> We recently changed our existing clients site to 100% SSL when we launched their new site.

If only webmasters had an option to change [http://](http://) to [https://](https://), the entire move would have been slightly easier as "fetch as googlebot" returns "redirect" since we direct [http://](http://) to [https://](https://).

Apart from that, we've had no ranking loss for their keywords.

<comment><USER36> Take a look at HSTS. It effectively tells clients to try HTTPS first when a user types in your domain.

[http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)

<comment><USER37> ... after the first visit...

<comment><USER38> Unless your site is on the HSTS list ([https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...](https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json) for Chrome, Firefox use the same list by verifying by connecting via HTTPS and checking for a long HSTS time.)

<comment><USER37> Right, unless your site is on the HSTS list AND all your users are using Chrome or firefox....

Which was basically my original point, which is that if you want your site to be generally accessible by just typing in the domain name, you still can't just turn off port 80...

Which I guess is why google.com itself is still reachable on port 80.

</comment></comment></comment></comment></comment><comment><USER39> I'm surprised by the amount of negative comments. Independently of what do you think about HTTPS and CAs in general. Given there the alternative currently is plain text, I'm actually surprised that it wasn't a signal before.

<comment><USER29> I see this has negative for several reasons :

* Certificates are expensive (to buy _and_ to manage)

* Crypto is hard and there will be a lot of screw up with inadequate certs in the wild for a long time. Just having a certificate does not mean much if it weak or broken.

* Can't help the feeling it's an indirect push for cloud business hence possibly eating the margin of freelancers / ISV

* Security Theatre : a lot of critical information for business still transit by email. Will Google force encrypted emails for the greater good ? I don't think so.

<comment><USER39> Google is not "enforcing" anything, people react like if you are not going to show up in the results at all, or Chrome won't work via HTTP. HTTPS is signal, just like having a link from a well ranked website like HN is a signal, and probably dozens other.

The points you mention are in fact indicators that someone has put care and resources to make their site work more securely, which says a good thing about the site, which google rewards with some points in their algorithm. Makes perfect sense to me that this will somewhat improve the quality of their results. Would you also complain about google using fast response times as a signal because that "forces" people to pay for better servers?

About your security point, google can not do that without loosing 50% of its customers, I really don't understand what that has to do with the rewarding HTTPS being good or bad. Looks like a red herring.

<comment><USER29> Right, you will not disappear from the results. The reaction (granted maybe overreaction) is about Google pushing HTTPS hard for security (which could be good but not automatically so) and not caring in areas where it is as important if not more.

You are just proving my point. Google rewards the richest, those who have the resources as you say. As for care, I would be clad if people were not going to do it for the wrong incentives. Will Google just check if HTTPS is available and reward or will it also check for broken cipher and penalize ?

I am not against HTTPS. Just saying that rewarding HTTPS is not enough. It's worst actually, some will set it up quickly and badly just for the extra ranking points and not the actual security it should be providing.

To me the red herring here is pretending doing it for security. What is the point of HTTPS if I receive my password by mail ? To me email is more important to secure first. Google could perfectly incentive security practices in Gmail without loosing a single customer. I would even settle for just signing instead of encrypting mails.

As for enforcing, HTTP2 (that is SPDY) IS enforcing HTTPS.

IMO, Good HTTPS where it matters is more important then Crappy HTTPS everywhere just is ridiculous and could even be dangerous thanks to a false sense of security.

<comment><USER39> > Google rewards the richest, those who have the resources as you say.

Google doesn't care who is it rewarding, google cares about the users that search, they've said that multiple times. And yes, people with better resources build on average better things than people without them.

> I am not against HTTPS. Just saying that rewarding HTTPS is not enough. It's > worst actually, some will set it up quickly and badly just for the extra > ranking points and not the actual security it should be providing.

Even then, still 10 times better than plain text HTTP so my whole office can see what I'm browsing with a simple console command.

> What is the point of HTTPS if I receive my password by mail ?

Your email inbox should be accessed via TLS, it's something up to you. And while you don't control the origin (nobody can without breaking compatibility) intercepting a message in transit like that if not exactly something most people I know can do. While getting that password over HTTP is almost trivial for anyone sitting around me.

> As for enforcing, HTTP2 (that is SPDY) IS enforcing HTTPS.

The day you can only see a website via SPDY then I would call that enforcing it. Yes if you want to carrot (performance) you have to pass through the hop (security), nobody forces you to eat the carrot.

> IMO, Good HTTPS where it matters is more important then Crappy HTTPS > everywhere just is ridiculous and could even be dangerous thanks to a false > sense of security.

I really can not get which scenario you are picturing here. Setting it up is not rocket science.

<comment><USER29> > Google doesn't care who is it rewarding, google cares about the users that > search, they've said that multiple times.

Hum, well I've grown wary of what Google say. Like puting comercial mail in a separated inbox is to help the user. It also happens to indirectly help Adsense.

> And yes, people with better resources build on average better things than > people without them.

Does that mean content created by association without a dime for instance is on average inferior ?

I happen to like cooking. I often find websites with great content by word of mouth. They are generally badly ranked because they look like they were done on Frontpage and from Geocities ages. Yet the content is very good and even sometime quite unique. They rank badly because they are not speedy and in beautiful html5. That's elitism. Maybe they should by Adwords.

> Even then, still 10 times better than plain text HTTP so my whole office can > see what I'm browsing with a simple console command.

That is one of the few good arguments for HTTPS everywhere : privacy.

> And while you don't control the origin (nobody can without breaking > compatibility)

You can encrypt or even just sign emails without breaking compatibility. Put commercial email in a separated inbox is OK but put unencrypted and/or unsigned email in a separated inbox is not ?

> While getting that password over HTTP is almost trivial for anyone sitting > around me. > I really can not get which scenario you are picturing here. > Setting it up is not rocket science.

Is it better to have open WiFi or WiFi with WEP ? It's the same because WEP is nowadays easily broken by script kiddies with simple tools.

That the scenario I'm picturing here. A web full of weak/broken certs to comply for ranking, people feeling safe (it's encrypted right ?) and script kiddies with trival tools to break the WEP equivalent of weak/broken HTTPS certs.

Granted, maybe I'm over-pessimistic here but the trend annoy me. i don't take Google at face value anymore. You know they excel at long play.

On the bright side, maybe people will use their certs for more than HTTPS ... say mail server for instance :)

</comment></comment></comment></comment></comment></comment><comment><USER6> Excellent move by Google that should push people to use HTTPS more.

Hopefully this will take into account the supported TLS versions and ciphersuites as well. It's sad to see sites that only supports TLS 1.0 and prefers a CBC ciphersuite.

</comment><comment><USER40> This is great, but it should also be a reminder that SSL is currently not possible for custom domains hosted on GitHub: [https://konklone.com/post/github-pages-now-supports-https- so...](https://konklone.com/post/github-pages-now-supports-https-so-use- it#using-your-custom-domain).

I hope a solution materializes eventually.

<comment><USER41> It's still expensive to offer SSL when you have a CDN in front unless you go with just SNI support (which could cost a significant portion of your visitors).

We have CDN backed HTTPS for custom sites on BitBalloon ([https://www.bitballoon.com](https://www.bitballoon.com)) if you're interested in a Github pages alternative that supports SSL.

<comment><USER42> Yup - Akamai must be rubbing their hands in glee at this announcement. I've already started the conversations here about how much this is going to cost for big CDN hosted projects...

</comment></comment></comment><comment><USER43> Here's the big differentiation that the now still beta and invite-only Google Domains could take on: assign free wildcard SSL certificate for every domain registered/transferred there.

</comment><comment><USER44> Don't have a ton of experience with SSL and only recently started messing with TLS on my Apache server but question: Google makes mention of a 2048 bit certificate but most of the certificates I see are 128/256\. Is this number referring to something else other than the strength of the encryption?

<comment><USER21> Messages like "your connection is encrypted with 256-bit encryption" don't tell you anything about the size of the RSA keys in use.

During the TLS handshake, your browser and the server do public-key crypto to authenticate each other and share private information without a previously- known shared secret. Because public-key crypto is really, really slow, they then share a small secret (say, 128 or 256 bits), and use that secret as the key for a traditional symmetric encryption algorithm like AES. That's the number you're seeing.

Take a look at [https://en.wikipedia.org/wiki/Transport_Layer_Security](https://en.wikipedia.org/wiki/Transport_Layer_Security)

<comment><USER44> thank you both, that really makes sense. I thought it was a little peculiar that Google decided to mention the whole 2048 bit thing, I couldn't have been the only one that was thrown off by that a bit.

</comment></comment></comment><comment><USER45> Perhaps more people would be more inclined to get nudged by Google in this direction if Google got in the CA game and sold certificates themselves, 2048 bit, right on Google Play, Chrome Optimized certs, NFC and QR code-enabled. How about that?

</comment><comment><USER46> there is something odd about this announcement. since it is no harder for a black hat publisher to switch to https than a white hat publisher, this signal will likely get noisy very quickly. i think google knows this, and its why they rarely specify ranking signals.

so, then really, they are just using their dominance in search to effect change. now, you may agree with the change (they did something similar by announcing pageload time as a signal), but it makes me a little uneasy for google to leverage their dominance in this way even if i happen to agree with the goal.

</comment><comment><USER47> The irony is that this will help Symantec, Comodo and Godaddy who are well known for stuffing their users sites with anchor-text (followed) links back to their own SSL pages.

</comment><comment><USER48> Lol, they are not using HTTPS to serve that content. Look who's talking...

</comment><comment><USER49> Do you have to throw out all your social rankings?

I've been wanting to switch to HTTPS but have been avoiding it due to significant accumulation of Facebook likes and some +1's. Last I checked, you had to do some big hacks to maintain your Facebook like count. Has anybody found a good way to handle this or do you just have to start over?

</comment><comment><USER7> I've just signed up for a 5 year certificate using [https://www.gogetssl.com/comodo-ssl-certificates/comodo- posi...](https://www.gogetssl.com/comodo-ssl-certificates/comodo-positive- ssl/) for $18 - I know there's annual free ones, but at that price is it worth the hassle of renewing?

Never used them before, but they're just a Comodo reseller, and they take Paypal, so there seemed little that could go wrong.

Has so far gone smoothly, certificate installed, passes the SSL test google mention, [https://www.ssllabs.com/ssltest/](https://www.ssllabs.com/ssltest/) so it all seems good

</comment><comment><USER50> I'm going to come out and say it. HTTPs is borked, in a functional way. On a social/technical level, it has become a false sense of security. The PRISM revelations let us know that the three letters and any corporate wannabe was doing MITM not just on http but on HTTPS whenever possible. I would say the ISP's and the CA's should all be considered compromised.

We need something new and better, not to push HTTPs on everything as an imagined stop gap...

That being said though, I do understand that if this was pushed to wider adoption, it would create a higher cost to perform such attacks, for ISP's and three letters?

</comment><comment><USER51> A good move. Well done for pushing the world towards a safer internet.

Quick question though. There was no mention of the type of certs used. Will plain certs be worth less than EV certs?

Hopefully Matt or any other Google search representative here can comment.

<comment><USER52> Newb question: Is plain cert locally generated certificates (free), while EV certs are those you pay for from a "trusted authority"?

<comment><USER53> No. A plain cert is one you normally buy, an EV cert stands for Extended Validation which only specific CAs can give out and there's extra guidelines for that, plus they're generally much more expensive. Browsers generally show the identity of the certificate in the URL bar when they are EV, which they otherwise do not.

</comment></comment></comment><comment><USER54> I'm all about this but what about third party static sites like everything on Github Pages? We're using Github to host [http://kili.io](http://kili.io) which has all of our marketing material but there's no way to upload a certificate there. I'd rather not move off of Github Pages for the main site because it's easy to just push changes, it's fast, it makes it easy to tie into the rest of our open code ([https://github.com/kili](https://github.com/kili)), and it's free.

<comment><USER44> Nice organization and cause, looks really interesting. Not being snarky at all but asking - you provide hosting but aren't able / won't host your marketing site on your own servers? Even if you don't have your own infrastructure, even grabbing a VPS from digital ocean or linode and throwing up a cert there could solve your problem.

</comment></comment><comment><USER44> Just doing a little more research. It appears as though many of these EV certs require you to verify your company information, domain registration, phone number and even address. With Google using however many hundred or thousand ranking signals, this makes sense. It is essentially another layer of trust and really great for UX as well. Online shoppers trust a site with the "green location bar" much more than ones without it, and I could definitely see how Google might reward this type of website.

</comment><comment><USER55> I don't buy the 'this is for your own safety' nonsense. Having said that, when are Google going to improve their search algorithm? These days there are so many shitty content farm results that clog up the first page itself. How about improving that first?

Unfortunately, Google is pretty much a monopoly when it comes to online advertising and search that few companies will have a choice in this matter. Google unilaterally forcing them to buy stuff doesn't sit well with me.

</comment><comment><USER56> After you buy an SSL certificate, Heroku charges $20/month to use it. You can circumvent this with Cloudflare, but they also charge $20/month for SSL. Is there any easy way to use SSL on Heroku for $0-5 / month?

(See [http://www.quora.com/Is-there-any-way-to-use-HTTPS-on- Heroku...](http://www.quora.com/Is-there-any-way-to-use-HTTPS-on-Heroku-for- less-than-20-month/answer/Tim-Dierks) for one possibility.)

</comment><comment><USER57> This wouldn't be so bad if there were more support for CAcert. It's great news for the commercial certificate authorities, though.

<comment><USER33> After some interaction (including assuring people), my impression of CAcert is much more negative than my impression with any of those big bad CAs everyone likes to complain about.

They are so far off this side of "sane" it's really not funny.

<comment><USER57> Are you able to elaborate? If not that's fine, but I just don't think paying for a cert makes it somehow better, so I liked the idea of CAcert. If I should be concerned about using them to secure personal sites (in this sense really only used by myself and a few friends who have the CA root cert) I'd be interested in knowing.

</comment></comment></comment><comment><USER29> Let's kill small ISV and raise the bar of entrance to the internet. Oh certificate management is too complex and expensive for too little ROI ? Well see, here we have a nice "cheap to the eye" cloud solution just for you.

Security isn't the priority here. Selling cloud is.

Edit: IMHO, same goes for SPDY/HTTP2 by the way

</comment><comment><USER58> I guess this article from a month ago was right when they observed a boost of their ranking: [https://blog.httpwatch.com/2014/07/07/google-has-given- https...](https://blog.httpwatch.com/2014/07/07/google-has-given-https-a-huge- boost/)

</comment><comment><USER59> But this site is still on HTTP. When I tried HTTPS it redirected to HTTP. Even they are not ready it seems.

</comment><comment><USER60> This is great, it's just a fact that ssl will not have major adoption unless there's a clear UI or business reason for it.

I hope google takes it one step further and updates chrome to show an insecure warning when it detects a password field on the page and it is sent plain over http.

</comment><comment><USER61> I'm not sure I agree with this. I don't see a point in HTTPS for 100% static sites.

<comment><USER36> The NSA and other state actors can use non-secure pages to inject code to exploit the browser and compromise your visitors.

[http://en.wikipedia.org/wiki/FOXACID#QUANTUM_attacks](http://en.wikipedia.org/wiki/FOXACID#QUANTUM_attacks)

<comment><USER13> State actors are probably irrelevant in this discussion; few of them won't be able to get a certificate to any website they want, in my opinion.

<comment><USER36> This is a known issue and being addressed as well.

[http://tools.ietf.org/html/draft-ietf-websec-key- pinning-11](http://tools.ietf.org/html/draft-ietf-websec-key-pinning-11)

[http://dev.chromium.org/sts](http://dev.chromium.org/sts)

</comment></comment></comment></comment><comment><USER62> If this change is here to stay they should update their Adsense SSL advice... [https://support.google.com/adsense/answer/10528?hl=en- GB](https://support.google.com/adsense/answer/10528?hl=en-GB)

<comment><USER40> I do not envy the googlers who have to keep stuff like that up to date.

<comment><USER62> I'm sure their salary more than makes up for it ;)

</comment></comment></comment><comment><USER63> upside: security, further migration to HTTP/2 easier (when it's ready)

downside: HTTPS negotiation time overhead (slower website) (as long as we use HTTP 1.1), costs (certificate, technical migration)

all in all i think it's a great move by google, thx

<comment><USER64> Only the first connection should be delayed a bit [http://vincent.bernat.im/en/blog/2011-ssl-session-reuse- rfc5...](http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html)

</comment></comment><comment><USER65> So what reasonable options does a small to medium site operator now have to buy SSL certs?

For example there is Comodo "FREE" certificate and the one that costs 64.95 Euros.

What is the catch with the free one?

<comment><USER66> Likely nothing relevant - you just can't revocate it, but it should still give you the speed boost.

</comment></comment><comment><USER67> Wow. For those needing to support non-SNI browsers, this is going to become a real IPv4 address land-grab.

IPv6 is disturbingly uncommon still...

<comment><USER68> supporting non-SNI browsers is less common. Over the last two years i've seen a huge drop off in ie8/XP traffic on my sites.

<comment><USER67> Android 2.x doesn't support SNI either, it's not just IE. (20% of Android users: [https://developer.android.com/about/dashboards/index.html](https://developer.android.com/about/dashboards/index.html))

But I agree, it has dwindled rapidly. :-)

<comment><USER68> 20% of android devices, but definitely not 20% of any website's android traffic. the amount of web traffic that comes from those android phones is approximately 0 unless maybe you're in africa or china - the people who still have android 2.x phones aren't browsing the internet with them.

<comment><USER67> > the people who still have android 2.x phones aren't browsing the internet > with them.

Not true. Only devices with regular Google Play store access get shown in those statistics.

The 20% are users with _at least_ regular Wi-Fi access.

</comment></comment></comment></comment></comment><comment><USER69> I hope that at least one site runs without https so that when I am using airport/airline/FlyingJ/Starbucks/etc wifi, I can access it and be presented with the button I need to press to access the network.

I currently use [http://xkcd.com](http://xkcd.com) for this purpose.

<comment><USER70> Funny; google.com works fine for me for this, even though it's definitely https.

</comment></comment><comment><USER71> "Security is a top priority for Google. We invest a lot in making sure that our services use industry-leading security, like strong HTTPS encryption by default."

\-- Says Google site that forces HTTP.

<comment><USER72> People that write content for websites are not always the same people that build those websites. In this case, the search engine team is entirely separate from the Blogspot team.

<comment><USER71> > People that write content for websites are not always the same people that > build those websites.

Wow Seriously? You don't say.

Seems the irony escaped you: announcement was made on a Google site that forces (i.e redirects from HTTPS) you to read it over HTTP.

If you read closely enough it refers to all of Google, not just "the search engine team" or (Google - Blogspot).

<comment><USER73> Internet law: Your good post will be ruthlessly torn apart. Agreement is drivel. The best you can hope for is a slightly different point which happens to agree.

Btw, I agree with you, and I think this phenomenon is dumb.

<comment><USER74> Another internet law: Do as Google says, not as Google does.</comment></comment></comment></comment></comment>


Why Clever And Lazy People Make The Best Leaders - <AUTHOR> http://www.businessinsider.com/why-clever-and-lazy-people-become-leaders-2014-3

<comment><USER2> Erich von Manstein may or may not have been an actual Nazi. The German ( Prussian, really ) Junkers ( pr. Yoonkurss ) class - and I do mean class in a hereditary sense - would have been more dependent on an honor code than on who happened to be Chancellor at the time.

Manstein was dismissed by Hitler at one point. He helped with the plausible deniability ... thing, the "myth of a clean Wermacht"[ Wikipedia ]. That was a Useful idea in resolving the legalities of the War. Whether it was true or not is almost moot.

No, there almost certainly can't be any stats to back this up. It's barely a just-so story.

The money shot is: "Anyone who is both clever and lazy is qualified for the highest leadership duties, because he possesses the intellectual clarity and the composure necessary for difficult decisions." This statement is roughly descriptive and barely that. But it doubtless contains some measure of wisdom. Clarity is critical. Non delusional clarity is even better.

Another corollary aphorism is "a smart man wouldn't do that; a lazy man wouldn't do that." That's a "koan" about allowing that still small voice that nags you not to do something some credence. Especially in dynamic situations, allowing a situation to run to a critical state may be better than trying to anticipate something that's too complex to map in detail.

I suppose the deeper irony of the piece is assuming away ethics as a given when the subject was imprisoned for "war crimes". This being said, that's one whale of an ethical conundrum, to have been an ostensibly Prussian military officer in those times.

</comment><comment><USER3> The term 'lazy' here is a bit misleading. In my view it's not meant in the sense of someone who slothful, but rather someone who aims to do things as efficiently as possible.

Sticking with the military context, one of the British Army's principles of war is 'economy of effort', which I think is a better description. Effective leaders focus on the high value activities, use resources well and delegate.

</comment><comment><USER4> Are there any stats to back this up?

A quote from a Nazi strategist does not answer the question of "why" or even prove the statement is true.

Lazy people certainly do not make the best CEOs. I don't know a single person that I look up to that I would consider lazy.</comment>


Zuckerberg Wants A Facebook For Kids Under 13 - <AUTHOR> http://networkeffect.allthingsd.com/20110520/minor-controversy-zuckerberg-wants-young-kids-on-facebook/

<comment><USER2> I hope this doesn't happen. The negative impact of social networking doesn't need to happen to people any sooner than it already does in their lives. Especially in the developmental years where kids are just learning to socialize.</comment>


Ask HN: I'd like to get a telescope for my kids. What do I need to know? - <AUTHOR>

One of my daughters is developing a keen interest in Astronomy, and I'd like to get her a telescope but I don't know much about them.
What I'm trying to find out is how to tell if I'm buying a toy or something good. There seems to be lots of telescopes in places like Dick Smith (Australian electronics retail chain) that are not much more than toys. What should I look for, and how do I tell if it will be any good?
My budget is about AU$200, but if needed I'll spend a bit more to get something that's actually going to be useful. This is an area I know nothing about, so any advice would be great. <comment><USER2> Fortunately for you 2009 happens to be the international year of astronomy. Buy your daughter this:

<https://www.galileoscope.org/gs/>

She'll be able to do a variety of experiments on it, and if it turns out she actually enjoys looking through it, you can then buy her something more pricey.

</comment><comment><USER3> <http://findascope.com/>

<comment><AUTHOR> Thanks. Haven't read it all yet, but looks good so far.

</comment></comment><comment><USER4> one thing I read in an annual astronomy magazine is that you're better off to start with a good pair of binoculars. I think the reason being they are cheaper and easier to control. I can look up the details if you are interested, and if I still have the mag kicking around home.</comment>


Ask HN: Voxel rendering engine for iOS. What next? - <AUTHOR>

Hi,
I implemented a performant voxel rendering engine for iOS:
---
http://www.youtube.com/watch?v=XPciH3Ynci0&t=3m28s
http://www.youtube.com/watch?v=vkzlpXr7au4
---
Code/Docs:
https://github.com/larsxschneider/iVoxel
https://github.com/larsxschneider/MasterThesis
---
Any idea what this could be used for/who would be interested in this kind of stuff?
Thanks, Lars <comment><USER2> dude thats awesome man....I have been thinking of making a cool virtual reality app where you changed the projection of the view with the accelerometer and gyroscope...could potentially use your library aking it...thanks a lot!

<comment><USER3> At the moment, the only license I can find on the code is "Copyright 2010 Lars Schneider. All rights reserved" You'll need to get a license cleared by Lars before you use his lib.

</comment></comment><comment><USER2> Question : How do I go about drawing my own point clouds.?</comment>


An improved Chrome extension for browsing code on GitHub - <AUTHOR> https://sourcegraph.com/blog/new-and-improved-chrome-extension

<comment><USER2> This link is specifically for the chrome extension (which is great), but also worth checking out sourcegraph's main site as well: [https://sourcegraph.com/](https://sourcegraph.com/)

Their in-browser code analysis is kinda amazing. They index most of the go/python/node libraries in github and make the code browsable as if it were in a local IDE. For example, here's their representation of Flask's app module:

[https://sourcegraph.com/github.com/mitsuhiko/flask@cc98ba909...](https://sourcegraph.com/github.com/mitsuhiko/flask@cc98ba9092f66468aa9a82c4d9af05c13a397e52/.tree/flask/app.py)

I've found it super helpful as a way to explore new libraries and see how they are used by other developers. Props to the sourcegraph team. Excited to see what else is coming down the road.

</comment><comment><USER3> Co-creator of the Chrome extension (and the site backing it) here. Would love to hear any feedback people have from trying it out! [https://chrome.google.com/webstore/detail/sourcegraph/dgjhfo...](https://chrome.google.com/webstore/detail/sourcegraph/dgjhfomjieaadpoljlnidmbgkdffpack)

</comment><comment><USER4> Reminds me I made thing with far fewer features (just definition lookups within the same repository), but with support for lots more languages :3 --> [http://ghctags.shishnet.org/](http://ghctags.shishnet.org/)</comment>


What is your communication plan if your internet service goes dark? - <AUTHOR> Simple question: assume extended and widespread disruption to your internet service at the mobile carrier/ISP level. What would you do? <comment><USER2> 2 meter ham radio (maybe $150), antenna and cables (another $150) plus a 12V battery and trickle charger.

<comment><USER3> This was my answer. It's one of the reasons I became a licensed HAM.

</comment></comment><comment><USER4> This is why some people still keep dial up accounts with a larger ISP around. I can imagine that even AOL might come in handy.

<comment><AUTHOR> The question assumes your ISP is unable to provide service, perhaps through coercion.

</comment></comment><comment><USER5> If wired ISP, use mobile data.

If mobile, use wired.

If they're both down for an extended period at once, then there are probably bigger things to worry about.

<comment><AUTHOR> Well that's the question I'm trying to find an answer to. In such a situation, the need to communicate becomes critical to longer-term survival.

<comment><USER6> _Food_ and _shelter_ are criticial to longer-term survival, communication is _not_. You need to define what are you thinking about.

<comment><AUTHOR> I'm not going to have a semantic argument about this. I'm asking for advice about communication, not food and shelter. If you don't have anything to contribute, then we're done here.

<comment><USER6> You got yourself an advice already: two independent connections, the backup one being cheap to maintain. You need to define what are you expecting if you want any more meaningful advice.

<comment><AUTHOR> Apparently you can't imagine any other kind of internet access beyond the consumer variety. Other people had some more practical suggestions. Next time I post a question like this I'll be sure to make it as tightly defined as possible.</comment></comment></comment></comment></comment></comment>


Show HN: Meeting Box – The Easy to Use Meeting Room Management App - <AUTHOR> https://www.meetingbox.co <comment><USER2> Great application, looks interesting

<comment><AUTHOR> Thanks, glad you like it!

<comment><USER3> Sockpuppet voting and comments are not allowed on Hacker News. We ban accounts and sites that do that, so please don't do that.</comment></comment></comment>


TELUS: Scroll through Vets names, will donate $5 to the Royal Can. Legion - 52-6F-62 https://community.telus.com/remember/ <comment> 52-6F-62 Please take a few minutes to scroll through the (staggering) list of names. If you do, Telus (Canadian telecommunications company) will donate $5 to the Royal Canadian Legion. The Legion is a meeting hall and support services institution for Canadian veterans.</comment>


Ask HN: Do you think we'll ever be able to trust Bitcoin? - <AUTHOR>

The events at Mt. Gox the past few weeks (and months!) clearly show Bitcoins have a long way to go before gaining the mainstream's trust. Do you even think they ever will? <comment><USER2> Mt.Gox's failure had nothing to do with the Bitcoin protocol and everything to do with their own incompetence at running a financial exchange of that size. Many people's losses could have been avoided if they followed common advice and avoided treating exchanges like banks, instead taking their own responsibility for the security of their private keys.

</comment><comment><USER3> No one has found a bug in the protocol that breaks bitcoin itself. What is under attack are the layers on top of bitcoin, in this case the exchanges. We will see more exchanges who make an effort to prove they are solvent, likely via technical methods.

Put another way, some businesses running on bitcoin are still operating like ordinary fiat businesses (e.g. fractional reserve of bitcoin). They will be replaced by those that can leverage the blockchain, for it's security, and therefore maintain a higher level of trust.

</comment><comment><USER4> I still trust Bitcoin itself, but I (still) don't trust the Bitcoin ecosystem.</comment>


Cancer's Super-Survivors: How Immunotherapy Is Transforming Oncology - <AUTHOR> http://online.wsj.com/articles/cancers-super-survivors-how-immunotherapy-is-transforming-oncology-1417714379

<comment><USER2> The article reports, "Most experts believe it will take combinations of immunotherapy drugs—or combinations of immunotherapy with other cancer treatments—to optimize their impact. But finding safe and effective combinations is a daunting undertaking." Yes. A lot of researchers, including researchers at companies that could commercialize applications of the latest research findings, are working on the general approach described in this interesting article, because the approach, if refined, promises substantial increase in healthy lifespan for many patients diagnosed with cancer. Making each patient's own immune system more responsive to cancerous cells looks like an important part of further advancing cancer treatment.

A key idea in medical treatment research is to look for an "endpoint" that actually matters for the patient. When the researchers looked for tumor shrinkage, they sometimes didn't find it soon enough to think that the patients were benefitting from treatment, but the patient Tom Telford named in the story reported feeling better during treatment, even when his tumor still appeared to be huge on scans of the tumor. When the researchers looked for the "hard endpoint" of patient survival, they found out these new treatments are better than they had realized at first. Proxy endpoints never beat hard endpoints in evaluating a treatment.

One more comment about how the story is presented. I will be really glad when doctors speaking to reporters, who are trying to talk in conversational, understandable language, and the reporters themselves get out of the habit of personifying or anthropomorphizing cancer cells, immune system cells, tumors, or even autonomous human body functions. Cancer cells and immune system cells are not knowing agents. They adapt (that is, successful cells survive while others die) but they don't "learn."

<comment><USER3> its not a big deal, your just caught up in language. in a sense learning is just adapting, 'successful' neurons propagate, less successful ones wither. also its helpful when thinking about these things to not fall for the fallacy that cancer and the immune system is simply cells - they are complex systems. For instance, the immune system does learn and adapt.

<comment><USER4> learning is a directed process with a target. the immune system is controled by the bervous system to reach that target, while cancer-cells, apparently are uncontrolled. there's a difference, although it matters more in an educational context.

</comment></comment></comment><comment><USER5> Is there any indication that these treatments can help is prevention or return of metastatic rumors? (As someone going through treatment for stage iv colon cancer with liver metastasis. The erbitux has done wonders in shrinking the tumors, but there are serious skin toxicity issues that may require me to change regimes.)

<comment><USER6> OK. I am not a doctor (just a PhD biochemistry)

I think that currently with these treatments complete remission is luck of the draw. Although many of these treatments (trastuzumab, cetuximab) were designed to block a growth factor from signalling on the cancer, what they ALSO seem to do is to recruit the immune system to the cancer and basically paint the cancer with a giant target.

Now, there is basically a competititon here; is your immune system powerful enough to kill the cancers painted by the antibodies faster than the cancer can adapt (usually by short-circuiting the growth signal). This sounds hokey, but for patients on these class of antibodies (ADCCs "antibody-directed, cell- mediated cytotoxicity"), I'd say it's important to keep a positive attitude, eliminate stress from one's life, and other things that strengthen the immune system. Unfortunately there are a lot of chemotherapeutics which are coadministered with these antibodies that throw a wrench into the immune system, as does radiation, etc.

As for the future, I think that there are some sneaky tricks that we can do to make ADCC drugs more powerful. Right now there is actually batch-to-batch variation in the power of these drugs, again going back to the 'luck of the draw'.

I also see some potential for ADC ("antibody-drug conjugate", not to be confused with ADCC) as well, this is attaching a warhead to an antibody and just directly killing the cells, although I think the ADCs that are being designed _are not potent enough_. But that is another story.

Finally, there will be a class of general chemotherapeutics that don't touch the immune system (I work on one through my nonprofit, there is one in Phase III - SJG-136) which I think will make for a nice 'sweeper' system to clean up any cells that have snuck out of whatever the antibody target is.

In short: I see a future where ADCCs are combined with ADCs and next- generation chemotherapeutics.

The other big challenge is that it's kind of very expensive to make antibody drugs. I think there are clever ways of bringing the cost down, and I might be working on that too.

</comment></comment><comment><USER7> This article hits close to home as my father had stage IV melanoma and took 2 rounds of Yervoy before becoming too sick and eventually passed away earlier this year. These drugs are very promising but the costs are absolutely ridiculous. $120,000 for four rounds (which is the initial amount you get before you must wait to complete more) is not viable for most people. Lucky my father has terrific insurance we paid maybe 10% of that cost. I did a lot of research on these drugs and there are some very severe side effects that you must watch out for. For most people these drugs are only slowing down the spread of the disease but by combining yervoy with other chemo drugs it can be very effective at treating melanoma.

<comment><USER8> _but the costs are absolutely ridiculous. $120,000 for four rounds..._

As the article details, it took 15 years to bring this drug to market, and the process has been and continues to be very research intensive. That money also pays for failures, it's not cheap to produce, and it's sold in small quantities for a currently small number of patients.

Yeah, it's not wonderful, but every time I hear that sort of thing, I also hear the sentiments that are (not so?) slowly shutting down new drug development.

You'll see this play out rather starkly as bacteria become continue to become more resistant to the usual antibiotics.

</comment></comment><comment><USER9> Just today, an early release in the finding of the immunotherapy drug nivolumab being use to treat non-Hodgkin's Lymphoma shows over 10% (4/29) of patients in complete remission. So I say that's pretty good. Dr. James Allison even said that for the 20-25% of patient that get an everlasting remission with Yervoy, that's great.

And those numbers will only go up.

</comment><comment><USER10> Immunotherapy absolutely works for melanoma–I'm living proof. As a Stage IV melanoma survivor, immunotherapy via a tumor infiltrating lymphocytes (TIL) trial at NIH has extended (if not saved) my life. I'm over two years out from treatment and am currently NED (no evidence of disease).

Also, Federally-funded research at NIH continues to push the envelope at relegating cancer to a chronic disease (if not cured altogether).

</comment><comment><USER11> "Death is not an option," he told his doctor.

<comment><USER12> There's only one thing you have to do in life. Any you don't have to pay taxes.

<comment><USER13> Your defeatism is unbecoming.</comment></comment></comment>


Musk adamantly standing by improving radar despite it being so close to lidar - <AUTHOR> https://techcrunch.com/2016/07/15/elon-musk-adamantly-standing-by-improving-radar-even-though-its-so-close-to-lidar/ <comment><USER2> Because they create a point-cloud from it radar is suddenly "like lidar"? I guess techcrunch is "like a handwritten letter" then, since symbols from the alphabet are involved in the output?

</comment><comment><USER3> The lower end spinning lidar by velodyne, the VLP-16 - built and calibrated by hand, is $7999. The VLP-64 (64 lasers) used by Google's Lexus self driving cars is significantly more than a tesla model 3... so yeah, there are no commercially viable lidar systems and musk knows this full well.

<comment><USER4> Google has made its own lidars: [https://www.washingtonpost.com/news/innovations/wp/2015/12/0...](https://www.washingtonpost.com/news/innovations/wp/2015/12/04/the-75000-problem- for-self-driving-cars-is-going-away/)</comment></comment>


Ask HN: What % of users are still on IE6? - <AUTHOR>

And if we're running into constant snags with CSS that is killing us in IE6, should we ignore it in the spirit of efficiency so that we can get a version up, or always work to get it right? <comment><USER2> 37Signals will begin phasing out support for IE 6 today as it happens ([http://37signals.blogs.com/products/2008/07/basecamp- phasin....](http://37signals.blogs.com/products/2008/07/basecamp- phasin.html)). I note that even they had originally planned to phase out support for IE 6 in August this year, but extended the deadline.

I think this is a decision that you really need to make after analysing your particular market. If you have a lot of government/corporate clients who may be slow to move to new technology, then possibly the extra effort to get things sorted for IE 6 may be worth it.

But if like 37Signals, your market is more made up of small/medium business and tech savvy users who move relatively quickly to new technology, then possibly the time to say goodbye to IE 6 is now.

Only you know for sure.

</comment><comment><USER3> It's usually better to get something out sooner. You can always go back and "tweak" IE if you have time.

Companies can thrive on less than 100% of the market; look at Apple as one example. You don't have to win _everyone_ over to succeed -- and in this case, IE6 share will continue to decrease with time, so your market segment will increase likewise.

Don't kick IE6 users out, but don't go out of your way to make the experience flawless. If the issues are fairly noticeable, you can put a note saying "You're using an outdated browser; for the best experience please upgrade."

</comment><comment><USER4> As I'm far too lazy to find my last comment re: IE6 let me dazzle you with stats for this month.

For a classifieds site with broad appeal:

UBs: 4,828,839

IE6%: 24.82%

As a point of interest -

FF%: 17.17%

Safari: 3.97%

Chrome: 0.70%

Unless you are catering to a predominantly tech audience, you've got some pretty hard decisions to make in not explicitly supporting IE6.

If you're working towards your first release I'd be inclined to trade IE6 compatibility for velocity.

</comment><comment><USER5> Still a pretty decent chunk, unfortunately. For their sake, I have adopted using a separate stylesheet for IE6 in most of my designs.

Best of luck!

</comment><comment><USER6> At the company I work at, we are gradually inching down towards around 25% IE6 usage out of all IE users. Overall, about 75% of total traffic is Internet Explorer. IE8 is about 1%, IE7 is about 74%. Firefox is around 20% overall. The other 5% contains Safari and other minor browsers, which includes Opera, old IE versions, Chrome, Netscape, etc. Our site gets about 3.5 million hits a month. My coworker and I are the lead front-end engineers for the site and we are actively pushing on all fronts to abandon IE6 support entirely. We are making gradual headway, but its a long slog. Unfortunately for us IE6 users still comprise too large a percent of our audience to abandon completely.

<comment><USER7> That adds up to 125%. Maybe you meant that IE7 is 49%.</comment></comment>


Ask HN: Please help review my site CollectiveSys.com - <AUTHOR>

Dear HN,
I humbly ask for your precious feedback for my site http://collectivesys.com
It's technically a Wiki + social networking site, and semantically a crowd-sourced review + social news site.
I hope to make it the one-stop hub for evaluation of anything in the world.
Last but not the least, sorry for trading your direct link convenience with my two paragraphs.
Many thank in advance.
Jerry <comment><USER2> Dude, it's a bit too premature for adsense, dontcha think? Also, your summary of the project is too much jargon:

"It's technically a Wiki + social networking site, and semantically a crowd- sourced review + social news site."

Put that in active tense:

"Read, edit and publish news and important stuff. Contact others and talk about stuff"

Also, entries have the URL linked to the source. You might not wanna do that. I recommend a URL from the front page should go to a summary page, where people can read and post reviews, and there should be a big button/link where they can go to the original.

Having a separate page will help you with .. err, figure that out, I'm not sure I want to go there now that I remember the adsense ;-)

<comment><AUTHOR> This is a bit surprise to me -- I thought all HN users would have Adblock on all the time :)

In fact, the AdSense is there just to align the user expectation from day one. Anyway, I can't agree more how annoying they can be and am going to turn them off now.

Thanks for your advice on the summary.

</comment></comment><comment><USER3> I looked at it for a few minutes and I get no idea what the site is about or what I can do. May be a welcome page with some blurb will help.

<comment><AUTHOR> Thanks very much for the feedback.

What I fear most finally comes true -- not even HN users can immediately figure out how to use the site (which was purposely left out from the brief)...

How about some hints like you can get all news regarding social networking websites:

      http://bit.ly/dc6ko

or compare DISQUS with Intense Debate:

      http://bit.ly/3Qhr9s

Now I definitely need to rethink the usability issue.

<comment><USER4> I was able to figure out the point of the site by finding the greyed out "about" link at the bottom. It was too much work.

Also, I think the ratings system for different products is difficult to understand. (I clicked on the anti-virus link from the about page, then on the Avast link. "objectiveness"? huh?)</comment></comment></comment>


George Hotz Steps Down as Comma.ai CEO - <AUTHOR> https://medium.com/@comma_ai/a-message-from-the-new-ceo-of-comma-ai-4db20da0f670 <comment><USER2> He is a tremendous hacker. Sure is arrogant, but I would like to see more hacker run companies rather than some business face running it to squeeze profits from gimmicks.

Doesn't apply to commai since they moved an internal automotive engineer to CEO. That's awesome. God speed! Best of luck to them.

</comment><comment><USER3> Is he planning a new jailbreak for iPhone X s Max??

<comment><USER4> You mean steal someone elses exploit?

<comment><USER5> Don't know why you're downvoated, other than people must be ignorant if6 the truth of your statement.

</comment></comment></comment><comment><USER6> This is great! Glad to see more founders do things like this.

</comment><comment><USER7> Glad he did. Honestly nothing against him but had the most arrogant interview for business dev ever with him. reminded me of my 3rd grade teacher. They got a lot of learning to do at least there is some traction on his self- development.

<comment><USER8> Think you have the wrong startup. comma.ai has never interviewed anyone for business development positions.</comment></comment>


What African Nations Are Teaching the West About Fighting the Coronavirus - <AUTHOR> https://www.newyorker.com/news/news-desk/what-african-nations-are-teaching-the-west-about-fighting-the-coronavirus <comment><USER2> The irony: the US thaught them how to handle viruses.

In times where those policies would seem effective. It's harsh to realize what lack of funding does to an entire country.

I guess you shouldn't run a country like a business, where the CEO has encountered more bankruptcies than successful businesses.

Unless you count "selling a last name" as a business, the current CEO has no successful endeavors without daddy's money.</comment>


Ask HN: Fake LP vs. LP with subscribe form - <AUTHOR>

I have seen, and read a lot about having a landing page with subscribe form, driving some traffic to it (i.e. Google Ads), and using that to validate the idea.
The way I see this, a lot of people would drop out, because they realise that this is actually waste of their current time, and maybe going to the next search result is far better then filling in the form and then waiting for something to maybe arrive.
A lot better way, in my opinion, is to make a fake landing page, with a "buy" button - making people think that there is a product and they can buy it. If the idea and price is good, then measure the clicks on the "buy" button, and you got yourself a good estimate of where this can go, and how much can it make. Although, one big minus that I see about this - tricking people, that they found a solution, and then actually asking them to wait, plus usually somewhere there is your name on the page too, so not very good PR.
I am sure somebody here had experience with these things, could you please share it with the rest of us? :)
Big Thanks! <comment><USER2> > Although, one big minus that I see about this - tricking people,

Yes, that's a darned big minus. Intentionally deceiving potential customers is a serious minus indeed.

> and then actually asking them to wait

"Wait"?? You'd be the guy I tried to buy from, and then found out was a liar. I wouldn't "wait"; I'd never do business with you again.

Seriously, drop this idea like a hot potato.

<comment><USER3> I humbly disagree. I actually kind of like this strategy. I do see your point but you could avoid that issue by thrn having a page "were sorry- we haven't finished development we plan to be launching XXXX date." You could even take it as far as to give them a free coupon code to guarantee a user base when you start. Additionally you get to gauge what/ how much people would pay. Maybe having a changing price, you could gain one of the most important pieces of information before launching! Lastly, this wouldn't be a huge issue because it is a landing page. You are not promoting it to your user base- the people happening on it are doing so naturally and therefore arguably the truest clients. If your product is both unique and something people need (vs something people want) and if its getting hits without any work- then you have a monopoly of sorts and people will definately be retuning either way. This is no joke one of the most brilliant suggestions I've heard. Please hit me up at firstname.lastname@example.com id love to talk to you!</comment></comment>


Ask HN: What other subject areas are ripe for something like Hacker Monthly? - <AUTHOR>

Hacker Monthly strikes me as a great idea, and seems to be emerging as a successful product, which got me wondering what other topics/niches would benefit from this sort of online magazine hybrid. Any thoughts? <comment><USER2> I always think, when someone is ASKING for a niche, then their project is doomed to fail. Things run well when people care in, believe in, live and breathe the thing they are selling/supporting/running.

If you don't having something within yourself that fits that bill then don't just try to service someone else's whim - you will never truly be 'in' it.

I've set up countless forums, sites and groups - those that did well were those that I wanted to do well, that i totally understood and that i believed in. Every failure I've had has come from me not understanding what someone else (the audience) would want out of the site, as i am not the target market.

You can do a lot of work to get yourself into the mind of the target market - but it's far far better if YOU are the target.

<comment><AUTHOR> Thanks for the reply. I wasn't really asking for a niche so I could set up the magazine; I just thought it would make for an interesting discussion.

But I can see now that it probably looks like I'm just asking people to provide me with potential business ideas.</comment></comment>


Ask HN: Is setting up a remote team of developers in India worth it? - <AUTHOR>

Market wages are currently dramatically lower. Potential hires seem to speak really good English considering it's their second language. I still want to make sure there isn't some kind of catch! <comment><USER2> Assuming you aren't trolling: No, absolutely not.

My experience, at two companies, is that what you save in development costs, you quickly pay for (and then some) in management overhead, and low code quality. Some of the code we got was simply not salvageable. (And of course, it consumed time on our side to review the code, reach this conclusion, and document the suckage.)

If outsourcing has any chance of working it is for rigorously specified requirements. If there is any wiggle room, or even if you expect common sense to apply to fill in the gaps, you will be disappointed.

Why is the reality so bad?

\- You have little choice about the actual developers you work with. Would you hire your own development team by phoning up a headhunter, asking for a half dozen developers, and then taking whatever the guy sends over? Of course not. Why should this work any better from an outsource agency?

\- Any marginally competent developer at an outsource firm gets moved into management quickly. (At least in the companies we worked with.)

\- Distance sucks. Do you really want to schedule meetings with 10-13 hour time differences? Deal with any required travel to and from India? Really?

Outsourcing is a clueless executive's idea of how to get software written. It was a new business trend in the early 2000s, (so long ago that I wonder whether you're trolling), and it was weird: I kept challenging the decision to outsource, and the rationale kept changing. Basically, it was a trend, so the executive making the decision wanted to do it, reasons be damned.

<comment><AUTHOR> Not trolling, 100% serious. I don't actually want to do outsourcing, per say. My interest lies more in leveraging low market wages in India and actually setting up a foreign office with it's own management etc.

You still think India's bad for business?

<comment><USER2> From other comments here, having someone on-site there improves the odds. But why bother? If you're a startup, you are creating one more unnecessary problem. Also, if you're a startup, you probably are going to be changing things frequently, resulting in constant software updates. In my experience, outsourcing works best (or least awfully) if the task you are outsourcing is completely specified, with no ambiguity. If you are going to be changing specs on them, it won't work so well.

I understand a startup needing to save money, but doing it this way seems crazy to me. I've done five startups by now (four with successful exits). If I were to join another, outsourced software development would be a red flag -- I'd stay away.

</comment></comment></comment><comment><USER3> Having worked with a number of Indian firms since 1998 and having friends there this is my take.

It is no different then the US, some suck, some are good, some are awesome.

The problem isn't India vs US, it is distance, communication and numbers. And the reality is it truly boils down to a numbers game, if you don't know someone, you are more likely to have nothing but headaches. Also the time difference seems minor to manage at first, or even an advantage, but you soon find out it is a pain in the ass.

Overall, even knowing there are great people in India, I won't use it as a primary source of development for anything. Too many times I have had issues, so I just won't do it. If a friend that lives there has some spare cycles, I will do that in a heartbeat because I know they can/will deliver.

Also, as a whole, we pick up more failed projects from eastern areas than anywhere else. My 2 cents is this isn't because they aren't capable, but the communication isn't clear, and people are trying to seek out the lowest cost person/firm. Seeking the lowest cost to me, means no matter where you are at you are not getting quality, but what you paid for.

<comment><AUTHOR> Do you think there's any chance that the latest advancements in video calling might change that? Things like "living on video"... Streaming the remote office and maybe distributing Google glasses etc.

<comment><USER3> I think even just Skype and technologies like that really positively impacted it and has helped (logmein, gotomeeting too).

Depending on what you are trying to do there could be lots of good/bad. If you are thinking of renting space out and hiring 10 people over there and sticking them in an office and they are solely your team then you have a greater chance of success. But you are going to have to learn to do business in India, learn their rules, learn how to get what you need there etc. That means how to hire, fire, discipline, manage and deal with local authorities. If you think it is hard doing that as a startup in the states, try doing it in two countries at once. Oh, and you will need to be there every few months in person to make sure you are getting what you want, price that airplane ticket * 4-6 times a year. :) I have been asked a lot why I feel face time is so important with remote teams like India, Brazil etc. Frankly the #1 reason is our cultures are different, so interpreting the nuances of spoken phrases or the unspoken is much harder unless you spend time with them. This is by no means bashing anyone, but it is a reality, you need to learn their culture and respect the differences so you can work with them successfully.

If you are thinking of trying to let them work remote out of their house, I have not had 1 good experience trying that as many will sell their time to 3-4 companies this way and do a mediocre job at best and generally a horrible job. This is the numbers game I was referencing, you might luck out, but more than likely you will hit the game of numbers constantly cycling through people.

And if you are thinking to use a dev shop over there, that has its own problems. Most specifically is you rarely will speak to the guy writing the code. They insulate the teams so much that the guy sitting in front of a keyboard has had 3-4 layers of filtering done. Not saying this is true for every place, as I know there are some that are not that way. But in general I saw a lot of this going on.

And even if you go to some of the smaller shops that promise the opposite, then you get the issue of the 11+ hour time difference and the fact that your communication and documentation will need to be excellent to get good results out of them.

My whole team today is basically remote, we work in different cities etc and that works because of technologies like IM, Skype, Hangouts etc. But we are all in the US and all have similar education, understandings and backgrounds. And the team is motivated to produce high quality because it is their name/reputation on the product too. Of course they are also not paid a 3rd world wage either which helps. And even with all that, we still have to get together, hash through things and solve problems in the same room sometimes. So far no technology I have ever seen will replace sitting in a room with 4-5 smart people and a white board. Even when I worked with Indian firms for some of the larger projects I was on, I flew there regularly to meet with the team we hired over there. And we did have video conferencing already. It is really hard to get people that are 8k miles away to have the same level of passion about your project as you do unless you show up regularly to get them involved.

I am not bashing remote work out of India or any other Country, it is just that the problem is hard to solve, and for a startup it is a very tough problem unless you already know people in the Country you want to work with. If you look at Oracle, Microsoft, GE etc, all have dev shops in India and other places. And every one of them has US based personnel that directly are in Country or make regular visits there to manage the shops. They also have significant budgets and staff to write super detailed specs etc. And frankly, if you have seen their dev timelines, it shows.

</comment></comment></comment><comment><USER4> I am original from India (now in New York), and I have hired over 40 developers, designers and marketers in New Delhi over the past few years.

You can hire good developers in India for $1,000 to $2,000 per month. It is viable to hire team in India, but hiring and managing them remotely is a nightmare. Remote teams in India are unreliable and not committed.

In India, you need hustle with your team to get shit done. The only way it is going to work is if you have someone one the ground.

Hiring good developers in India is difficult, retaining them is worse. Good developers are constantly bombarded by recruiters with very lucrative offers.

My 2 cents, It can be worth while if you want to go to India and build a development team. Stay away from outsourcing companies, they are only going to sink your time and money.

<comment><AUTHOR> Thanks for the tip! Isn't $1-2k per month pretty high for direct pay? My estimate for starting salaries was substantially lower.

<comment><USER5> Wow - you want to pay less than that for a software engineer who speaks English?

<comment><AUTHOR> Yes, isn't that possible with direct hiring instead of paying more to go through outsourcing firms? My understanding is that roughly $500 monthly puts an Indian in the middle class. Double that and I figure we would be really attractive to young, entry level programmers.

<comment><USER6> You're not in middle class if you need your month's wage to buy a smartphone.

<comment><AUTHOR> Maybe not in America but India's different and remember, smart phones made in third world countries have different markups since manufacturing is cheap and nearby.

<comment><USER4> Smartphones and other electronics are more expensive in India, almost twice of US prices.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> From my experience, and I started all my projects with freelancers. I was very lucky with russian and ukraine developers but also polish & czech developers seem to have kind of the right working attitude.

The main issues I had with indian developers is the "yes yes culture". It seems that their culture does not allow to say "no, it won´t be ready" or "no, it will take longer...". They always say "yes, sir", "for sure, sir". this is something I can not work with.

</comment><comment><USER8> Setting up a remote team of developers anywhere in the world purely to save on costs isn't worth it.

You should hire remote because you simply don't have access to the talent locally, or can't assemble a local team quickly enough. And you should have at least one seasoned technical leader who's worked with a distributed team before to guide you through the process.

Hiring remote devs halfway around the world because you can save 80% on wages is a pennywise and pound foolish decision.

<comment><AUTHOR> Thanks for your feedback. Just curious... Have you tried it or do you have some sort of negative experience with remote devs? I'm going to need to do something sooner or later.

</comment></comment><comment><USER9> My 2 cents, from what I've been able to gather, the best resources in other countries are being paid comparably to US, or they've already migrated or set up a work visa with a US company. Talented developers know they're talented and will seek out other people who can weed them out from the group. It is a rare case that you run into a highly qualified developer in any country who is working for pennies on the dollar.

<comment><AUTHOR> What about taking advantage of the back log of denied or pending, highly skilled U.S. Visa applicants? It seems to me that tech companies can't import them fast enough. I'm thinking it's time to go to the source instead.

<comment><USER9> It will be interesting to see how this goes for you...

</comment></comment></comment><comment><USER10> I've never worked with a team in India, but I do have experience with outsourcing to eastern Europe. I don't doubt the other comments that say it can be done, but in my experience it's tough.

The development cycle goes roughly like this: \- Early morning call to discuss requirements \- E-mails over the course of the morning covering parts of the same requirements \- Next morning call to discuss the same requirements (seems like we've got it this time) \- Code review uncovers missing requirements...

Between the time difference, the multiple hand-offs and the communication problems we would spend an order of magnitude more time on a task than it would take an in-house resource.

I don't think it's completely impossible to get the formula right, but you need to be explicit about everything, which doesn't really work in an agile development cycle made of tight feedback loops. However, if you're operating a more waterfall process and are able to code up a suite of acceptance tests, it could be workable.

<comment><USER11> > but you need to be explicit about everything, which doesn't really work in > an agile development cycle made of tight feedback loops.

We're a scrum team based in Oceania working for a German firm, and we have had similar issues which we've resolved by usage of proxy product owners and regular backlog groomings.

It'd doable, but it takes some investment in relationships and knowledge.

</comment></comment><comment><USER12> It depends on what kind of project you want the developers in India to get done, combined with the location(city) in India that you are planning to have your team work out of.

If its something like a mobile-first product, it will be better if you can have one of your trusted team-mates, who understands both the product and the aesthetics of your product, sit in India and operate the team: the reason being this team-mate will need to be hands-on with the developers on the product features and also add a lot of value on the aesthetics of the app.

In most cases, the developers in India lack these skills. As long as you are able to address that, you will be good.

The other most important question to ask yourself - are you looking at this team simply to save your development costs (or) are you looking to really collaborate with them and look at them to add value to your product? If its the former, then a lot of brickbats are thrown when the deliverables are getting delayed and you _may_ end up in a bad state and write negative reviews about developers from India. But if you look at the India based team to add a lot of value to your product, then the guys will go any end to deliver the product for you. It becomes a happy ending for everyone. In this case, you wont even mind the 10-12 hour timezone difference.

<comment><AUTHOR> Great tips, thanks! I'm really looking to collaborate with them as equals, not merely remote assistance. It just seems like a great people policy.

<comment><USER12> Its really good then. I am so happy to hear that. Hope you identify a great set of developers / testers with whom you can collaborate with. Let me know if you need any assistance. I have done that before for a couple of product companies in the US and one in Singapore... Will be more than happy to help you.

Also, wishing you a great success with your product.

</comment></comment></comment><comment><USER13> My friend, of East European descent (immigrated to the US as a teen), has started a company with a small number of software engineers from his home country. He is US-based and seems to be having success with these engineers building a platform and finding business.

The big win though is that he speaks the language and has direct hired his employees. This could be a catch for you if you are considering working with an outsourcing company. My friend is successful with his hires because he has the intangibles in place - speaking the language, occasional trips back to visit with them, works hard to direct hire (and keep) smart engineers, and he is personally vested in making sure he shares the "spoils" of the business with his employees. He also hacks on the platform, although not as much as in the beginning.

It sounds like you are considering a similar option, so you might be successful. You'll be putting in _a lot_ of time though - frequent conference calls, code reviews, dealing with the occasional bad-fit, etc. In many ways, I think it would be harder than finding someone local to you.

<comment><AUTHOR> Thanks for your feedback! I'm not an Indian native but I am taking language classes in anticipation of doing something in the future. I'm hearing that it really depends on the people.

</comment></comment><comment><USER14> Don't forget (and this applies to any outsourcing contract, anywhere in the world), the first people you encounter will be the A-grade talent.

Once the project kicks off the they will one-by-one be moved off to the next deal, and replaced with less experienced juniors and trainees.

You can try to contractually lock in particular people, but that's impossible to guarantee if the team is remote.

<comment><USER15> I totally agree with this. This has happened at two places where I worked. We had to bring back development in house because once the project got started the main guys we talked to the first time where no where to be found.

<comment><AUTHOR> Thanks for the tip!

</comment></comment></comment><comment><USER16> It really depends on whether you want to outsource development or actually want a remote (but in house) dev team in India.

Most comments here are already inherently considering the remote team to be code monkeys who will churn out software based on specs. There is no magic here, to get good code, you need devs who are invested in the idea, and not second class citizens in the company.

Invest the same amount of resources into hiring people as you would here, pay not just a good but a great salary, make the Indian office a good place to work, where employees actually have a ladder to climb and have input in the product, and all this can work.

And yes, that most likely means having someone on the ground in the early days.

You can't expect in attract great talent with half assed hiring measures and an intent to get code on the cheap. Those people are happy doing their own startups or working somewhere else.

<comment><AUTHOR> You hit it, thanks! Not interested in outsourcing, per say. My goal would be to leverage low market wages in India by setting up a foreign office with it's own management etc.

How far above average pay do you think I would have to go?

</comment></comment><comment><USER17> I've worked with teams in India (and Poland, US, UK, Australia, Spain) for several years and quality depends on how well you manage the hiring and how well you manage the communication - remembering that communication is harder with anyone the farther you are away from being in the same room with someone. You may need to hire someone local to you to do this for you as communication is a full time job (a solution architect is the sort of role you'll need).

Don't expect miracles, 'cause miracles cost money - but it's got a 50/50 chance of working out OK.

</comment><comment><USER18> What I know is that the quality of their code is very outdated and even being cheaper to hire you are going to spend lots of money fixing the code.

Nothing like having quality code!

<comment><AUTHOR> Thanks, are you saying they tend to be lower quality coders or just outdated coders? Maybe you're saying both. We're talking as more or more than 80% worth of discounts in compensation packages when compared to American programmers.

<comment><USER19> Possibly cue South Park Super Cool Ski Instructor meme. If your first-stated reason "to talk" is "more than 80% worth of discounts", then you're going to have a bad time if the work you are outsourcing is at all highly-skilled. For highly-routinized process work by ops staff, sure, knock yourself out; but you're going to find extremely qualified folks for that in the heartland of the US working for wages competitive with the offshore outfits as well.

How logical is it that you will find someone smart enough to hack full-stack or even a Fabrice Bellard-grade hacker, but not savvy enough to sift through sales channels until they command a rate commensurate with their demonstrated delivery capabilities? This is unicorn-hunting. They do exist, you can land them, but in the meantime your competitors are focusing on Getting Shit Done by not wasting time trying to prematurely optimize their expense structure. If these unicorns were so easily abundant, and if it was that easy, then Google would have long since abandoned recruiting at American universities.

You might have better results if you specified in more detail what you are looking for. Generally, my experience is that coding talent is roughly evenly smeared across the global pool; I'm looking generally for devops types that know their OS's, basic data and control structures in an Algol'ish language (scripted and/or compiled), and work well when customer-facing. There isn't enough difference between geographies to alter the basic recruitment search strategy though tactics will differ (the technical culture is relatively consistent across the globe). Not enough difference to yield dramatically better returns at least, so nationality won't determine whether you get "lower quality" or "outdated" coders. In my experience, individuals' personalities and company culture has a far greater impact on code quality than nationality or ethnicity.

In my market space, given how long it really takes to absorb a significant technical base, on the order of 12-18 months, I'm not inclined to "yield chase" by trying to find cheap technical staff with a turnover that is frequently sooner than that spin-up time before truly insightful work from them starts to get traction. YMMV, so please share your details.

</comment></comment></comment><comment><USER20> I am 1 of only 2 people on a 10 person remote team from the US. The rest are from India and Mexico.

Our team is finally okay after a year of people quitting, getting let go, or just not working out.

It doesn't help that my boss just lets new people check anything into our dev repo without having our project manager look it over first...which has halted development more times than I can count.

The most common thing is that people just don't know how to use git.

</comment><comment><USER21> Offshore indian programmers are one of the best to rely on:

[http://toprate.org/FILES/programmers.jpg](http://toprate.org/FILES/programmers.jpg)</comment>