How the Catalan government uses IPFS to sidestep Spain's legal block - <AUTHOR> http://la3.org/~kilburn/blog/catalan-government-bypass-ipfs/ <comment><USER2> "Basically, the code recurses a sha256 computation 1714 times to get a lookup key, and then once more to get a password for decryption."

This is an Easter Egg. Barcelona fell on September 11, 1714 during the War of Spanish Succession and with that Catalonia's freedom as well. September 11 is the National Day of Catalonia.

Also, at 17:14 of each and every game of FC Barcelona in Camp Nou Stadium, Barcelona fans claim for independence [1].

So it was not by chance that the coder chose 1714 for the encryption algorithm.

[1] [https://www.youtube.com/watch?v=EneqR3oDpmQ](https://www.youtube.com/watch?v=EneqR3oDpmQ)

<comment><USER3> Wasn't this the succession war between Habsburg and Borbon dynasties?

I've seen some depictions in paintings [1] where you can see soldiers from the Habsburg (wearing the Catalan berretinas) porting a Spanish flag... I believe it was more a war for two different models for Spain, not for independence or anything like that. Sounds like revisionism to me.

[1] [http://www.msde.es/wp-content/uploads/2012/10/2-Embarque- de-...](http://www.msde.es/wp-content/uploads/2012/10/2-Embarque-de-la- primera-espedici%C3%B3n-de-voluntarios-catalanes-a-Cuba..jpg)

<comment><USER4> The war was between European powers and had many ramifications in different places. For Catalonia the net result was that it lost its political institutions and became a province in a centralised state.

<comment><USER5> Also, became a much richer region, because after the centralization got access to world-wide trade because of the Spanish Empire.

<comment><USER6> And with that definition/benefit you've stated, how is that different to colonialism?

<comment><USER5> Catalans were doing colonialism within the Spanish Empire. I.e. doing the colonialism, not suffering it.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Author here. I've tried to keep the article as apolitical as possible, while giving some context to provide the setting.

Anyway, I'm very interested in knowing if the used crypto is sound or not, and stirring a discussion around possible alternative approaches.

Ask me anything if you want to know further!

<comment><USER7> The crypto is far from ideal.

The situation is very similar to password storage, where you want to not make it trivial to brute-force moderate-entropy passwords even if your database gets breached. We have functions designed specifically for that: scrypt, argon2 etc. [https://www.npmjs.com/package/scryptsy](https://www.npmjs.com/package/scryptsy) is a pure JS implementation of scrypt for example.

Even with scrypt the situation is not great, but using sha for this kind of thing is no longer state of the art. If people are willing to (a) download and run a program rather than rely on the browser and (b) willing to wait half a minute or so for the result then you could easily tune the scrypt/argon parameters up to 11 but at the cost of quite a bit in the way of usability. If "must work on smartphones without extra app downloads" is a requirement you're pretty limited in what you can do this way.

Another solution might be to use real servers but host them on the "dark web" \- get Tor a bit of publicity in Catalunya!

EDIT: in response to a few posts that briefly appeared and then disappeared again - IPFS is fine. SHA256 for authenticating a page is fine. I'm only objecting to using raw SHA-anything as a key derivation function as in the section "A static database".

<comment><USER8> I'm not sure what you mean by "the crypto is not ideal"? I was under the impression that there are not yet collisions for SHA-256 [https://github.com/ipfs/faq/issues/22](https://github.com/ipfs/faq/issues/22)

Only for SHA-1 (which has 160 bit hashes) [https://en.wikipedia.org/wiki/SHA-1#Attacks](https://en.wikipedia.org/wiki/SHA-1#Attacks)

<comment><USER7> The attack mentioned on the page is brute-forcing someone's details from partial information:

"it can be used to "fill the gaps" of information about any citizen. If you know someone's birth date and the area where they live, you can obtain their government ID by trial-and-error on that website."

The mitigation is slowing down the number of guesses/second that an attacker can try. In a well-designed key derivation function, an attacker with 100x the resources should only be able to try out guesses 100x as fast. That's what scrypt/argon2/bcrypt/PBKDF2/... try and achieve.

SHA and other general-purpose hash functions tend to be easy to parallelize, at least in parts, and you can get huge speedups on GPUs or even better, FPGAs/ASICs. That's why no-one serious still mines bitcoins on CPUs and the big mining syndicates [hire planes]([http://uk.businessinsider.com/cryptocurrency-miners-rent- boe...](http://uk.businessinsider.com/cryptocurrency-miners-rent- boeing-747s-2017-7)) to ship GPUs a little bit faster.

This has nothing to do with collisions. It's to do with hash functions being designed to be fast, and key derivation functions are designed to be slow and memory-hard.

<comment><USER9> Holy shit! People are hiring planes to ship them GPUs!?

Jeasus!! Gibson was far more prescient than acknowledged;

" __ _the future is already here, but not evenly distributed yet_ __"

Wow...

I had such opportunity and ability to buy bitcoins in 2012... and I missed that boat.

<comment><USER10> I downloaded the Bitcoin mining app in 2010, opened it once, got bored of waiting for it to sync with some server, then shut and forgot about it for a few years. It might be a funny story to tell my grandkids if BTC is still around

<comment><USER11> If Bitcoin is around when your grandkids are of age, even this minute might be a great time to buy Bitcoin. Why miss the same boat twice?

<comment><USER12> Hope what you say is true, because I bought bitcoin @ $4700 :'(

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> As an outsider, it's strange that nobody here seems to question whether the referendum really makes sense.

Forgetting about Catalonia for a moment, isn't it fundamentally amoral that a part of the country where prosperity has (by mere chance) concentrated suddenly wants to split off? Isn't this taking wealth-inequality to the next level?

Of course the people in a prosperous part of the country want to split off. Absolute democracy seems to result in an undesirable situation, because do we really want to live in a world that converges towards little selfish islands?

<comment><USER14> The part that makes it even more confusing for me is that their party, Podemos, is a real left party which you'd expect to be against increasing income inequality.

I expect that the situation in Spain is much more complex than we give it credit for.

[https://en.wikipedia.org/wiki/Podemos_(Spanish_political_par...](https://en.wikipedia.org/wiki/Podemos_\(Spanish_political_party\)#Policies)

EDIT: added link, changed "socialist" to "left"

<comment><USER15> Downvoted because "their" is a very misleading word. Podemos is not particularly Catalan.

<comment><USER14> Thank you for the correction.

</comment></comment></comment></comment><comment><USER16> I just left Barcelona a couple hours ago, the capital of Catalonia. Everywhere you look, Catalan flags, signs demanding 'democracia', demanding freedom.

I'm told this is just normal for the region, but if this is normal then independence is eventual.

<comment><USER17> Well, it is normal since independentists have controlled Catalunya since 40 years ago. It used to be that 20% of the population was independentist through, now is over 50%.

For example, they choosed school principals among independentist so now over 85% of them are Catalan language teachers that tend to be independentist. This way kids could be directed to be independentist too.

The same happened with the local media, TV3, newspapers like La Vanguardia. If you were not independent public funds were not given to you. Those private media without the public funding could not live on their own.

Since 20 years ago they control education too, and kids are forced to speak Catalan as the main language, studing a very biased History full of lies like that Catalunuya was a reign in the past. They also put big sanctions on shops labeling things on Spanish until nobody dare.

They brought nearly a million muslim people to Catalunya to work so they do not speak Spanish, like people from Spain or South America does. This makes it the higher terrorist risk area in all Spain, including Ceuta and Melilla.

The problem was not independentist forces doing this, but the central gobertment that let this happen.

Now with half the population(controlling Catalunya) against the other (supported by the Govertment) there is a significant risk of civil war there.

<comment><USER18> A Catalan here. Quite a bad description, I think. We should remember that Catalonia had its own language forbidden to even speak in the street for 40 years during Franco's dictatorship. Language and culture was kept alive thanks of people keeping it in secrecy.

When "democracy" returned, some of the competences they had before the war were returned to the government.

After 6 years of demonstrations of 2-3 million (out of 7million) asking to hold a referendum and receiving NO to any request, it was announced and proposed one year ago in order to agree it with Spanish government, but they would not even discuss it. In the end the unilateral way is the only way to hold this referendum.

Why shouldn't it be allowed to ask people's preferences? Isn't it democracy? People who doesn't want independence can say NO. Laws should serve people's desires, not forbid participation and opinion.

<comment><USER19> Another Catalan here, a Catalan that has lived in Italy and France.

In the dictatorship Catalan was forbidden, but now Catalan in Catalonia is the only language used in schools (the teachers are told to only speak in that language even to the parents, search for "immersió lingüística"), the official buildings, hospital papers, and so on. Is this what you would call repression or not-democracy?

Now, in Spain other languages (I am using the word languages again) are official, and they are the language the teachers use at schools. Do you know what they call other languages in France or Italy? _dialects_! They are not official, of course, nor used as official languages in schools or public buildings.

So Spain is even more democratic than Italy and France in that issue, but people are complaining in Catalonia because of the adoctrination, and millions of euros spent by the Catalan government. Don't fool yourself. A referendum in a moment of maximum propaganda by the Catalan government is really democracy?

The conservative Catalan government, as the conservative Spanish government, have a lot of cases of corruption, and since all this irrationality nobody is talking about that. Last week _Spain_ freed two _Catalan_ politicians from the current governing party from going to jail because of the Pretoria case, but almost nobody mentioned that. Do you really thing this chaos is not premeditated?

<comment><USER20> Catalan is a lenguage... because it is. Don' play demagogy around that

<comment><USER20> *[1] [https://en.m.wikipedia.org/wiki/Catalan_language](https://en.m.wikipedia.org/wiki/Catalan_language)

</comment></comment></comment></comment></comment></comment><comment><USER21> "it is nearly-impossible for any actor to block access to this content because it is replicated around the network automatically, using peer-to-peer encrypted connections that would be very hard to identify and block at the ISP level. "

It's right that the connections are encrypted, but it's NOT correct to say that content is automatically replicated (but it's a common misconception). Instead, content who is wanted by other peers is the only content that gets replicated. You need to explicitly "pin" content to help replicate it.

This is different from Freenet where content is indeed pushed out to other peers in that fashion.

<comment><USER8> You do NOT need to explicitly pin content to help replicate it. Any content which is requested via IPFS is replicated by the daemon, up until it is GCed. The only thing that pinning does, is prevent the content from ever being GCed

<comment><USER22> You make it sound like if merely accessing a resource will make my ipfs node share it to others. Is that the case?

<comment><USER23> Yes, analogous to downloading a torrent. The GC is run pretty regularly by default so you generally want to pin anything you want to keep local.

<comment><USER24> As far as I remember GC isn't run by default - but it could have changed

</comment></comment></comment></comment></comment><comment><USER25> It seems shocking that Spain a member of the EU is resorting to these tactics. Can you discuss some of their justifications for doing so?

<comment><AUTHOR> The spanish constituion explicitly states that Spain is an indivisible country. Hence, the Constituional Court (that is elected by the parliament) has ruled out that any referendum about independence is illegal.

At this point, the government says that both them and the judiciary powers are just defending the democratic rules, and Catalonia's government is the one at fault for all this hassle.

The problem is that it is accepted that there's a wide majority of catalan people who want a referendum, and here we are...

<comment><USER26> Governments usually do not like to give up the money making portions of their countries and neither does the population of the rest of the country. You never see a poor part of a country seceding (well, other than Quebec maybe).

<comment><USER27> The South in the U.S. Civil War?

<comment><USER28> The South expected massive cotton revenues to prop its economy.

[https://en.wikipedia.org/wiki/King_Cotton](https://en.wikipedia.org/wiki/King_Cotton)

<comment><USER29> To be fair however, it was known how the war would proceed _before_ the outset!

In the words of General Sherman:

 _You people of the South don 't know what you are doing. This country will be drenched in blood, and God only knows how it will end. It is all folly, madness, a crime against civilization! You people speak so lightly of war; you don't know what you're talking about. War is a terrible thing! You mistake, too, the people of the North. They are a peaceable people but an earnest people, and they will fight, too. They are not going to let this country be destroyed without a mighty effort to save it… Besides, where are your men and appliances of war to contend against them? The North can make a steam engine, locomotive, or railway car; hardly a yard of cloth or pair of shoes can you make. You are rushing into war with one of the most powerful, ingeniously mechanical, and determined people on Earth — right at your doors. You are bound to fail. Only in your spirit and determination are you prepared for war. In all else you are totally unprepared, with a bad cause to start with. At first you will make headway, but as your limited resources begin to fail, shut out from the markets of Europe as you will be, your cause will begin to wane. If your people will but stop and think, they must see in the end that you will surely fail._

People are not rational however, and the wealthy landowners were facing the extinction of their wealth... so they started a war.

<comment><USER30> > the wealthy landowners were facing the extinction of their wealth... so they > started a war

As someone who doesn't know much about American history: What happened to the wealth of those Southern landowners after the war? Did they get to keep it?

<comment><USER31> Some of it. Many of those who survived lost a good portion of their capital. But they kept title to their land, and used that leverage, voting power, and racist solidarity over time to claw back much of what they had previously enjoyed from exploitation of the emancipated slaves.

The South was still devastated by the war. But being largely agrarian to begin with, loss of capital wasn't quite as hard a blow as losing a factory.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> It doesn't matter that they can circumvent it. The fact that the Spanish government has taken such drastic actions means that the result of the vote will be completely meaningless and illegitimate. Opponents of the referendum who agree with the Spanish government will not participate.

<comment><USER33> The reason referendums don't have a minimum of votes is precisely to avoid boicots like the one that the opposition is trying to do, so if they don't want to vote it's up to them, but that doesn't make the referendum any less valid.

<comment><USER34> If the referendum unlawful, then some people will not go to vote, simply because they usually avoid breaking the law.

The result would be valid (from a probabilistic point of view) if "going to vote" was independent of "voting yes". But if the there is any correlation between "going to vote" and "voting yes" then the result of the referendum will be significantly different than the result of a referendum where any individual was forced to vote.

Here there might be a correlation: people in favor or independence or more likely to go voting than others.

A similar phenomenon may have happened in the us. If there is a correlation between "lying to polls" and "voting for candidate A" then the poll predictions can become very wrong.

</comment></comment></comment><comment><USER35> "it is nearly-impossible for any actor to block access to this content because it is replicated around the network automatically"

This isn't entirely accurate though. It's only replicated if people request it. If everyone only requests the content through `ipfs.io` then the content will only be living on the original seeder, and the IPFS gateway nodes which run GC on a regular basis.

Depending on how the content is moved, it _might_ end up on a few other nodes (a way around nats, by using a third party peer to stream content between two peers), but I believe it's only ever moved through the network, and will not be stored on the nodes. If it is, it's only there till the next GC (disabled by default I believe).

</comment><comment><USER36> Wow, this is super cool that they thought of / implemented this.

(I think your math on bits is wrong: I'm getting that log2(10 __10 * 23 * 365 * 4) = 33.4, not 28.)

A few notes on the crypto off the top of my head:

1\. 1714 iterations of SHA-256 seems really low given that you're going to be looking this up approximately once per person. My 2010-era laptop can compute about a million hashes per second according to `openssl speed sha256`. A second or two to look this up is definitely comparable with what a human would expect the UX to be for a dynamic website run by a government; honestly I wouldn't complain about up to a _minute_ as long as there was a clear progress bar. So you could easily change it from 1,714 hashes to 1,714,000 without impacting UX, and you should probably do that given the relatively small key space, which would give you a factor of 1000x on the brute force attack.

2\. AES-256-CBC with no IV smells funny to me. I guess every message is encrypted with a different key, but the keys _themselves_ are easily derivable (they're just a single SHA-256 hash of the lookup key, and those are all in the public filesystem). I cannot think immediately of an attack against this but maybe someone else can.

3\. Your brute-force estimates are what's needed to enumerate the entire lookup key space. The practical attack here is what you've outlined, that you know someone's date of birth and zip code (which are likely in public records). and want their national ID for some identity theft. You're not trying to find some arbitrary person to steal the identity of. That means that the date of birth and zip code are fixed, and you only need to brute-force the DNI portion, which has only 10^5 * 23 possibilities. That's extremely realistic: I can compute 10^5 * 23 * 1715 hashes _on my 2010 laptop_ in a little over an hour.

I guess they do the right thing by only using a part of the DNI string, so you still have three unknown decimal digits, and zero information about what they might be.

<comment><AUTHOR> > (I think your math on bits is wrong: I'm getting that log2(1010 * 23 * 365 * > 4) = 33.4, not 28.)

1\. Totally right that I'm wrong, but I'm now getting 48 bits, not 33 ;)

2\. That was a terrible mistake of my own. The lookup key is derived from the password, not the other way around. I've corrected the article to clarify that!

3\. Yeah that's why I said you can do it with your laptop and not too much time ;)

Only using the latest part of the DNI is not that good though. The letter is actually a control character, which can be computed from the 8 numbers. Hence, if you have 5 numbers and the letter, there are only some possible 3-digit prefixes that lead to a valid DNI! How many? I would have to investigate further hehe...

<comment><USER37> I can't check, but isn't sha256_times(passkey, 1713) == passkey? (sha256_times(sha256(a), 1713) == sha256_times(a,1714)?) The encryption is then basically worthless if you have a list of all lookups. (I didn't see a dynamic in the sha256_times function.)

</comment></comment></comment><comment><USER38> I hope Mozilla shows leadership in adopting IPFS support in Firefox. I don't necessarily want it to adopt IPFS _right now_ , but it should have a plan for when it thinks the project is "mature enough" to be adopted in a mainstream browser, but also it should be early enough that Firefox is the first to do it.

Maybe Mozilla should even get involved early in IPFS so that it can shape the protocols the way it would prefer them to work in its browser later on (while still ensuring the censorship-resistance vision of the project remains intact).

<comment><USER39> Should they also adopt Tor, Freenet, I2P, etc.?

But I would give a thumbs up for Gopher support.

<comment><USER8> I would hope they adopt Tor at some point. That would be awesome. Why shouldn't they?

<comment><USER40> Why _should_ they? Tor is managed by the Tor Project. It is bundled & shipped as TBB already, using Firefox. You already can use it if you want to, so why would they bother with implementing Tor in the mainstream version of Firefox? They could only offer it as option (because not everyone wants to use Tor all the time) and this option is already satisfied.

<comment><USER8> So that it is more accessible to "normal" people and so that onion links would "just work"

</comment></comment></comment></comment></comment><comment><USER41> "In the where to vote? page, you are prompted to enter some of your details: DNI (national id), Birth date, Zip code"

Wait a second, can someone from the area explain this? Why on earth do they need your ID number just to tell you where to vote?

In my country (UK) 99% of the time all you need is a postcode and you can be told your voting place. (I say 99% because there are a few postcodes that are split across different seats and thus different people in the same post code have different polling places. Also just to note some areas are bad at publicly supplying this data. But my general point still stands.)

<comment><AUTHOR> For most people that would suffice, but there are exceptions: people who moved recently, people who is not accounted for, etc..

This way, if you are not in the database you know that there's a problem and can ask the authorities to get it fixed before it is too late and you cannot vote.

<comment><USER41> That's a different question tho - what your talking about is "Am I registered to vote correctly?" and there is no way to answer that without a DB of personal information in some way.

(This could be handled better in the UK - at the recent election there was a website for last minute registrations which got lots of traffic, and afterwards they said a very large amount of people were already registered. But there is no easy system to check if you are already registered .... so everyone just used this site to sign up again.)

BUT

The article talks about answering the question "Where do I vote?". The assumption is the registration is correct, you just want to know where to vote.

In my country, this can be answered by a information system that contains no personal information at all, so I was surprised to see the DOB & ID bit in the original post.

</comment></comment></comment><comment><USER42> Ah, that explains why I saw various catalán sites being pinned on the IPFS pinning service I run ([https://www.eternum.io](https://www.eternum.io)), which also runs a public writable gateway (so you can access IPFS files, including the banned catalán websites, through it).

Having just gotten back from Barcelona, I have to say that the way the Spanish government is handling this is far from ideal. I don't very much support the Catalonian plea for independence (I haven't heard any good reasons other than "but our freedom"), but blocking sites seems... suboptimal.

As for the crypto itself, why not use bcrypt? Your users don't care if it takes three seconds, but it makes attacks entirely infeasible.

<comment><USER43> Do you mind technically explaining a bit more about pinning, how it works and why would anyone do it?

<comment><USER44> You can't just look at data from the internet without touching it, you need to download it. The same holds true when reading data from the IPFS network.

In the process, you make it available for anyone else who ask for it, but only for a limited time; until the Garbage Collector (GC) runs. If I remember correctly, the GC run once every hour or so, so you probably won't reshare the data for longer than that.

You need to pin the data if you want to keep resharing it. This effectively tells the GC to not touch it.

<comment><USER43> That was very clear, thanks!

<comment><USER42> You can kind of think of it like seeding a torrent, and pinning ensures the seeding won't stop until you unpin.

<comment><USER43> So the service would be the equivalent of a seedbox?

</comment></comment></comment></comment></comment></comment><comment><USER45> I don't understand why would you need to know a person's details to tell where he should vote. In Czech Republic, you can tell just from your address of residency. It's usually the closest one to your registered address. Therefore, it should be enough to publish just the list of locations and the areas they serve.

</comment><comment><USER46> For those who want more background into what's going on, here is an excellent video from The Economist explaining the independence movement in Catalonia: [https://www.youtube.com/watch?v=NaQ4_v0fz6k](https://www.youtube.com/watch?v=NaQ4_v0fz6k)

</comment><comment><USER47> If my government did that, I'd certainly want independence, too.

</comment><comment><USER48> Agree they should have not use a bespoke algorithm but I don't think there is much of a security issue. Knowing where you need to go to vote is not enough to vote.

You still need the physical security of the ID (DNI) that includes a few security features (like your face). You can see and image here: [http://www.aulaclic.es/articulos/graficos/DNIe.gif](http://www.aulaclic.es/articulos/graficos/DNIe.gif)

From my point of view, this rises a far more interesting question.

Do you guys think it could be possible to use blockchain to implement a secure voting system? I do and I got a few ideas about the main issues (authentication, authorisation, validity period and others) and will be happy to discuss with anyone interested on co-developing such a system... or if you know of one already do let me know!

Seems like if every computer can be a "poling station", authoritarian regimes/governments will have a more difficult way of stopping this sort of voting from happening. And maybe, only maybe, we can enjoy a free democracy.

</comment><comment><USER49> I'm genuinely curious which part ipfs solves here? Given that it's still accessed via browser/domain wouldn't they just block the dns or even ip? In which case this is no more resilient than say multiple domains and dns entries and proxying on from there to a central database (which could be run in a jurisdiction over which Spain has little control and which they would have to discover first anyways)

<comment><USER44> Data on IPFS is accessed over P2P, not over IP. ipfs.io is just running a gateway. Anyone could do that. In fact; if you were to run IPFS on your computer, you'd probably have your own gateway on your localhost.

Somebody would just make their own public gateway, and the government would need to block another domain. Of cource, running IPFS for yourself would take away any need to use a gateway.

</comment></comment><comment><USER50> Let's get the political reasoning straight.

Under Spanish Constitution, supreme law in Spain, the right to determine the territory of Spain belongs to _all_ Spaniards (article 2).

What some people claim as "democracy" or "the right to vote" is actually removing this right from the rest of Spaniards.

Aside from other claims and whether there are political or historical reasons, the voting has been declared illegal by the "Tribunal Constitucional", highest court in Spain. End of story, it's illegal, period. And Spain (mostly judges and police forces) are trying to defend the law.

Now a quick note on the alleged economical facts: no, Catalonia does not contribute 16 billion to the rest of the country, it's actually 2,4 billion (this is what Catalonia published last year). This is called "solidarity", and it is what contributes to other regions in Spain to grow and benefit the country as a whole. Madrid is also a significant net contributor. On the other hand, Spain holds 55 billion in debt from Catalonia, which is unable to finance by itself on international debt markets. So numbers don't add that quickly as it has been said here.

<comment><USER51> Let me add one thing: the current Spanish Constitution was subject to a referendum in 1978. In Catalonia, it was approved by 90.46% of the votes.

<comment><USER52> 1978, shortly after the dictatorship ended, a time in which Spain was still dominated by cronies from that very dictatorship, and who proceeded to dictate the Constitution.

So in 1978 Catalonia's vote mattered and you're claiming today it does not.

<comment><USER50> Because it did matter in 1978, there's a law that says that 1-O voting cannot happen, it's illegal.

Only all Spaniards can vote regarding the integrity and sovereignty of Spain.

If you think 1978's Constitution was approved under some form of oppression, fight that, there are clear ways to change the Constitution. But do not support any illegal activities that remove rights from the rest of the people in the country.

The root of the democracy is the respect to the law. Not "voting".

</comment></comment></comment></comment><comment><USER53> The original article doesn't take into account that DNI letter is calculated from the previous DNI digits with a known formula. So when you choose the numbers, you already know the letter. See for example: [https://gist.github.com/afgomez/5691823](https://gist.github.com/afgomez/5691823)

So Instead of: 10^10 * 23 * 365 * 4 = 33580 * 10^10 possible combinations , we have 10^10 * 365 * 4 = 1460 * 10^10. And we can represent it with 44 bits instead of 48.

To explore all possible combinations, we need then 1460 * 10^10 * 1715 = 25039 * 10^12 hashes, instead of 575897 * 10^12 hashes

With AntMiner S9, we can do all hashes in: 25039 * 10^12 / 28 * 10^9 = 10.3 days.

If we want to specifically scam a target neighbourhood (imagine sending an email telling people "your local bank in your neighborhood asks you to reset your password), we can choose a fixed zip code, and all this could be guessed with a less powerfull machine (someone else can do the math).

</comment><comment><USER54> How very crypto-anarchistic

<comment><USER55> Seems more accurate to say crypto-nationalistic

<comment><USER56> crypto-separatist

</comment></comment></comment><comment> m-p-3 How does one provide a full mirror/node of an IPFS website? I wouldn't mind sparing some bandwidth and storage.

<comment><USER57> First install ipfs

then run:

      ipfs pin add QmZxWEBJBVkGDGaKdYPQUXX4KC5TCWbvuR4iYZrTML8XCR

and wait for a large amount of data to be pulled in....

<comment> m-p-3 Thanks, will do that!

</comment></comment></comment><comment><USER58> Wow, the potential massive leak of private information this could lead to seems quite irresponsible...

</comment><comment><USER59> It's interesting how Russia and Assange are backing every movement that weakens the West (Trump, Brexit, and now this):

[http://www.businessinsider.com/julian-assange-catalonia- inde...](http://www.businessinsider.com/julian-assange-catalonia-independence- movement-and-referendum-spain-2017-9)

Russia wants to break apart the bloc with Germany at the center to dominate its neighbors. It's a replay of Russia's tensions with Europe that date at least to the Napoleonic wars, and include WWI and WWII.

</comment><comment><USER60> "Basically, the code recurses a sha256 computation 1714 times to get a lookup key, and then once more to get a password for decryption."

Other way around, no? The index is the hash of the decryption key (as it should be), it's just that the index is called "key" and the key is called "lookup".

If the decryption key was the hash of the index, then it would be trivial to decrypt every entry.

<comment><AUTHOR> You are right, and I made a huge blunder while "prettifying" the code and then commenting it. It should be corrected now!

</comment></comment><comment><USER61> I would have used scrypt (memory bound and therefore hardly scalable in ASICs/FPGAs) with a higher round count, say that it takes ~1s to calculate the hash. That way bruteforce is infeasible these days. Also I would have used other sparse information such as street number that hardly can be connected to a particular person.

</comment><comment><USER62> Summary of instructions to add a ipfs node for this site :

      wget https://dist.ipfs.io/go-ipfs/v0.4.11/go-ipfs_v0.4.11_linux-amd64.tar.gz
      tar zxf go-ipfs_v0.4.11_linux-amd64.tar.gz
      cd go-ipfs
      ./ipfs daemon &
      ./ipfs pin add QmZxWEBJBVkGDGaKdYPQUXX4KC5TCWbvuR4iYZrTML8XCR

The stuff goes into ~/.ipfs

</comment><comment><USER63> "it is nearly-impossible for any actor to block access to this content because it is replicated around the network automatically, using peer-to-peer encrypted connections that would be very hard to identify and block at the ISP level. Maybe China could do it, but Spain definitely cannot."

How would China do it?

<comment><USER64> I imagine because China has spent more time on the required infrastructure to make this happen. Spain is trying to stop something that is set to happen on Oct 1, so they have a finite amount of time to suppress the information.

<comment><USER65> By the same token, they're also not the home of a bunch of friendly companies that will implement the work, unlike China, and they don't have a long history of trying to stop the flow of information, unlike China, and they don't have a effectively infinite budget, unlike China.

I'm betting against Spain on this one. Go Catalonia!

<comment><USER66> There is a huge gap between having a referendum on independence and actually being independent.

</comment></comment></comment></comment><comment><USER67> Good historical perspective: [https://www.jacobinmag.com/2017/09/catalonia- independence-re...](https://www.jacobinmag.com/2017/09/catalonia-independence- referendum-spain-podemos)

</comment><comment><USER68> I see IPFS as the single most promising & important software projects in the world today.

</comment><comment><USER69> A possibly simpler solution would be to not have assigned places to vote that are based on your ID & DOB.

Just vote at the polling place most convenient to you, and announce available polling places on posters around town, or facebook & twitter if you prefer.

<comment><USER70> The reason that isn't done in any election is because, to prevent people from voting twice, each voting station needs a list of the people that are supposed to vote there.

<comment><USER41> That's a fair point but doesn't explain why ID & DOB are needed. I asked about this in another comment - in my country, you just need your postcode to find your polling place 99% of the time.

<comment><USER43> It's needed because it depend on the census.

In Spain you don't have to register to vote every time. Just show up at the place you have to, based on the census.

<comment><USER41> Interesting, but that doesn't answer my question. It's not in any way about voter registration.

I'm asking why can't you be told where to vote - the original thing the article is about - based on your postcode only. But I think I have my answer in another thread.

</comment></comment></comment></comment></comment><comment><USER71> I have done: ipfssudo get QmQZzfs7LjkEnmG3zU92YF7ViCcuCXkNokuYoiNe6pKvDZ

But I don't see any database only html code, how can I clone this website to see what is happening with my f __* data?

</comment><comment><USER72> The letter in the DNI is a checksum of the numbers. Simply DNI mod 23 indexes a lookup table with the 23 allowed letters, so those 238 card days get reduced to only 10 days!

</comment><comment><USER73> Is there oppression of human rights by the central government? Is there discrimination against catalans ? In other words, what's broken that secession would fix?

</comment><comment><USER74> Some interesting insights there. Thanks for this article. I just hope this doesn't lead to more draconian IT laws all over the EU... ;)

</comment><comment><USER75> [https://youtu.be/6Ggi_QPYRrA](https://youtu.be/6Ggi_QPYRrA)

</comment><comment><USER76> Hmm, it appears I have misplaced my mirrorshades. I mean it's really bright in the future.

<comment><USER77> A healthy dose of Gibson and Stephenson helps me to stay sane. It feels like we're approaching a singularity.

</comment></comment><comment><USER78> I really wonder why we have such a hard time to get along with each other...

</comment><comment><USER79> What if ipfs.io goes down? The DNS has always been the bottleneck.

<comment><USER80> Spray paint 220.127.116.11 on buildings.

<comment><USER81> Government could probably just block any DNS requests that want to resolve the ipfs.io domain. Though Spain probably does not have the censorship infrastructure deployed for that the way a country like China has.

<comment><USER82> Spray paint the IP of ipfs.io?

For reference it's 184.108.40.206. Or if you want to go to the Catalan referendum page, it's [http://126.96.36.199/ipns/QmZxWEBJBVkGDGaKdYPQUXX4KC5TCWbv...](http://126.96.36.199/ipns/QmZxWEBJBVkGDGaKdYPQUXX4KC5TCWbvuR4iYZrTML8XCR/en/index.html). Unfortunately SSL doesn't work, as the certificate is only valid on ipfs.io.

</comment></comment></comment></comment><comment><USER83> Why does a single post like this get 479 points (so many) ?

</comment><comment><USER84> kurdistan, quebec, and california up next

</comment><comment><USER85> All seems rather like an arms race.

</comment><comment><USER55> Voting is not necessarily democratic. Hitler won in democracy. Respecting minorities and not playing the victim card is more democratic indeed! There are many republicans dead under catalan descending military charges, all over the peninsula. I don't think being born in Catalonia makes you less fascist.

But you can always play the victim card ans act like history never happened.</comment>


Ask HN: What are your best resume tips? - <AUTHOR> Here are some questions I'm coming across, but I'm curious to hear whatever you have discovered in general makes a good resume.
Should I include a skills section at the end?  (It looks tacky, but I think a lot of places use automated searches?)
For each project I list should I include languages and tools used?
If I only have one publication is it worth having a publications section? <comment><USER2> In the last week I have read way too many resumes. Here are some of the things that I would look to tell all future candidates...

\- Your resume should be no more then 1, if you must 2 pages (1 page per 10 yrs experience). I can't tell you how many 5-7 page resumes I receive that get a quick skim and thrown aside.

\- Use the cover letter to address the company. Who ever is reading it is probably reading others as well. The same generic boring BS gets old. Every letter says "I would be a good fit for your company and my skills match your job description". That is obvious or you wouldnt be applying, or you didnt read the job description. Tell the company what you can do for them and not what they can do for you. Mention why you want to work there and what intrigues you about the company. Pretend you read the job description and researched the company. Be personal-able. You are trying to stand out amongst potentially hundreds of other candidates.

\- A skills section is useful, especially for tech jobs. But you don't need to mention every tool you have ever used. No one cares that you still know win 3.1 (I see that on resumes sometimes). Give the highlights and worthwhile list. More is not always better.

\- Definitely include your publications, speaking events anything that shows your community activity. They dont need to be more then a line or short description.

\- Some people put what tools and languages are used for every project. It starts getting repetitive. I think those can be covered in your skills list. The projects should be short and sweet with a few bullet points. Tell the reader what the project is and what you contributed. You don't need to list everything you ever did at a company. Just need to give the reader a taste of your skill level and ability to perform the job they are filling. If they like you, you will get an interview or follow up questions.

The goal is not to digest your entire life story and work history into a resume. Old jobs and projects can fall off the list. I know its hard to part with some of those things, but it will better your chances that someone will actually read your whole resume. You want to impress them as quickly as possible. The goal is to get an interview.

<comment><USER3> > More is not always better.

Wasn't there even a study about it, that confirmed your finding?

</comment></comment><comment><USER4> Hard, discrete data such as measurable accomplisments followed by numbers or equivalent (gave 14 presentations in 3 continents, architect of Apache2 http server, etc) instead of ambiguous information such as 'gave many presentations',' founder of many projects',etc.

<comment><USER5> Yes, giving some way of quantifying any accomplishment is a good thing for all resumes.

After that, I'd go light on keywords if applying to a startup, but rather get into the tech details of what I'd done at each company. I'd be likely to describe how I'd deliver software that changed things for the better at each company.

For a day job, I'm prone to keyword stuffing. I hate to say that, but to get the resume past HR drones and third-party recruiters, some form of black hat resume SEO is needed. I have a section at the top that has the keyword and years of experience for all relevant experience. I also have a roundup of keywords I'd used at a particular employer. For a startup, I'd be likely to leave that section off. I only use it for regular jobs because it works. My resume gets through the filters and to the people who will interview me.

</comment></comment><comment><USER3> On a slightly unrelated note: I use LaTeX and the currvita package for my resume. It's easy and looks good. Plus the LaTeX source plays nice with git, and thus helps me keep track of how I customized my resume for different employers.

The extra-selling point for me is, that the use of LaTeX itself may people in the know to recognize me as the serious mathematician that I am. (Though that's no substitute for commercial experience.)

<comment><USER6> Agreed wholeheartedly on LaTeX. It also is a great entry point for a warm-up conversation at an interview if you format it professionally. I've been asked a number of times "how'd you do this?" and I'm not doing anything fancier than a two-column layout.

I think we hackers tend to underestimate the influence presentation has on perception. A LaTeX-formatted résumé adds a nice touch of professional style and a little boost of geek cred to academic résumé readers.

Or so I'd like to think…

<comment><USER3> And the currvita documentation (e.g. at [http://www.cam.ctan.org/tex- archive/macros/latex/contrib/cur...](http://www.cam.ctan.org/tex- archive/macros/latex/contrib/currvita/currvita.pdf)) has actually some nice general hints on how to write a resume that are applicable even when you do not use it.

I saw lots of nice and well-presented CV here, where just using LaTeX might have made them even better. Knuth got something right with TeX.

</comment></comment></comment><comment><USER7> Instead of listing your responsibilities, talk about concrete numbers and achievements. If you list things like "interfaced with QA", "participated in planning with product management", or "used JSPs and Servlets to write web- based mail client", you will not stand out much from other applicants. You should focus on (preferably quantifiable) results. Examples: "designed and implemented QA testing plan that raised code coverage of a 100 KLOC email service from 18% for 63%", "wrote web-based mail client that handles 8000 users and up to 50 requests per second", etc. Try to show what you have achieved, not what you have worked on.

Along with making your resume stronger, specific points often help guide your interview predictably. I have 1-2 bullet points that everyone asks about, and it's great to have a few interview questions that you know you will ace.

</comment><comment><USER8> As a technical recruiting manager I'd say:

Yes, add skill section, it will get you through most HR filters. Skills should be plausible and based on experience in job section. Otherwise skills look fishy to me.

The major tools for each project helps me cross check the skill section with the jobs. I'd say yes. But do not add all tools and all languages. The most important ones used are enough. PLEASE: Only add those you've used, not all tools used by others on a project. This is a warning sign for recruiting managers should they discover this during an interview. Clearly state your part of the project. It's too common that candidates describe projects in wonderful colors and then only have written XML files - which they did not state in the resume.

I'd drop the publications if you only have one. I do prefer shorter resumes.

Hope that helped.

<comment><USER9> It depends on that publication.

If you proved P = NP* and that was your only publication, I'd still include it.

*-other than the joke "for P = 0 or N = 1"

</comment></comment><comment><USER10> First I think that anyone who is offering advice on resumes should be willing to present theirs. Here is mine: <http://elem.com/~btilly/BenTilly.pdf>

I believe that a good resume is one that makes people look twice at you. It should lay out the facts in as compelling and concise a way as possible. Whenever possible you should demonstrate to prospective employers that you provide value, and you understand how much value you provide. Details about format, layout, and so on should be chosen to highlight your strengths in the most compelling way possible.

The first trick is that you must hook people fast. Yes, you need a bunch of keywords for the bots. But you don't want that to be the first thing the humans read. You want people to read something that can make them dream about what you could do for them.

The second trick is that a resume is not the time for modesty. When else is it socially acceptable to sit down and say the nice things about yourself? Don't hold back, have fun with it!

The third trick is that no matter how much work you put into your resume, you need your most honest friends to read it and give critical feedback. You don't want the friend who will say nice things. You want the one who will look at it, tear apart, let you know why it doesn't work and make you rewrite it. I don't know how many times I rewrote my resume, but I do know that it is a lot better for having been rewritten.

I'm starting to ramble now, so I'll stop. So in closing, good luck.

<comment><AUTHOR> I really like that. BTW where you look for part time consulting jobs like that? Everything online seems to be full time w2 type work.

<comment><USER10> Networking, networking, networking. I hit up everyone I had worked with in the previous few years, and several came up with projects that they wanted done which I was an ideal candidate for.

It helped a lot that I maintained connections and have an unusual combination of useful skills. Therefore people have things they want done which they know I can do, but don't know who else could.

</comment></comment></comment><comment><USER11> I've written about this before:

<http://news.ycombinator.com/item?id=728863>

I freely admit I'm unusual, but then again, so are you.

Here it is again:

If you apply for a job with me, I want to know why I should employ you. I want to know how you will add value to my company. I want to know that you will bring skills and abilities.

Do you know what I want? You should. You shouldn't just read the ad for the job - you should find out what my company does, then read the ad, and work out how your skills will help me meet my goal of making money. If you can't or won't do those things, I probably don't want you to work for me.

What skills do you have? _How can I tell?_

Can you work on your own? _How can I tell?_

Can you work in a team? _How can I tell?_

Will you get things done? _How can I tell?_

I don't really care about your education, or your recent jobs, unless they show me why you are the right person for me. And I want to read that on the first page, preferably in the first paragraph, and preferably without typos, grammatical errors, or anything else to distract me. I don't at this stage really care what your name is, or how to contact you, or whether you can typeset 16 different fonts on the same page.

Why should I employ you? What do you think I want, and why should I think you have it.

</comment><comment><USER12> I like to receive well researched cover letters to go with resumes.

<comment><AUTHOR> What kind of research? What impresses you in a cover letter?

<comment><USER12> Someone who has researched the company and shows me the relationship between their resume and the position we are hiring for.

<comment><USER13> Doesn't it depend on JOB or CAREER the company is offering?

</comment></comment></comment></comment><comment><USER14> Always remember the goal of a resume is to land an interview not land the job. Your resume should make the employer want to meet you and learn more about you.

</comment><comment><USER15> I'm going through the hiring process now so from my perspective:

Keep your resume short, and tailor it for the specific job. If the job doesn't say anything about a specific skill, take it off your resume (unless its a general skill like UNIX) - include no more than 6-10 skills. I definitely include skills and don't think it's tacky in our applicants, but it is tacky to include a huge list of acronyms and makes people think you actually know less (less about more, instead of more about less). Cover letters are nice, but in my view they are just a paragraph to know how well the person speaks english (many hackers don't speak english well). I like short, casual, cover letters ('hi, saw the post on craigslist, heres 4 bullets why im good for the job, hope to hear from you soon, DONE.) Number one thing for me is to keep in concise, don't make the reader read through a giant paragraph description of your work, just bullet points and tailor the bullet points to the job (you're trying to say "heres my experience at abc123 corp. and heres why its relevant to you").

cover letter is exponentially more important if you aren't replying to a job posting, and less if you are (we use craigslist so get a ton of applicants and we weed people out based on bad english in the cover letter, but we dont really see many cover letters so good that they sway us positively)

</comment><comment><USER16> 1) Languages and tools should be highlighted if they're exceptional -- e.g., I probably don't need to hear that you used SQL to interact with a database, but if you implemented a set of complex views in T-SQL that's useful.

2) ...which means you need to list your skills somewhere. I tend to categorize mine for easier scanning (languages, databases, frameworks, build infrastructure) but YMMV. If something sticks out there I'll ask about it -- "how did you find the experience of implementing a maven plugin?"

3) In the vein of not annoying people who read your resume, name the file you send "FirstName_LastName_resume.pdf" rather than "resume.pdf". Attention to detail matters, and people wind up dumping resumes into a directory with others.

</comment><comment><USER17> As a consultant, I have a sales pipeline that starts out with people searching for me on LinkedIn or getting a reference from somebody I know.

The next step is for them to look at my resume. If that goes well, then the next step is a phone interview.

It's all a pipeline, and my resume's main job is to get the phone interview. That's it. While technically the resume is supposed to be a history of what you've done, that's what a resume is, not what it's used for. It's used for screening, therefore it should be good at surviving various screening processes.

<comment><AUTHOR> Is your resume much different being designed for consulting instead of a regular full time job?

<comment><USER17> I don't think so.

It's all about showing capabilities. For full-timers, there might be more interest in "culture fit", but you can't really tell that from a resume.

</comment></comment></comment><comment><USER18> Side note: I have been told by the person in charge of recruiting at my company that explicitly stating references as "available on request" is really unnecessary, and just takes up space. Obviously your references should be available upon request if they aren't on there.

Other tips: \- Avoid using italics, it apparently can cause problems if someone tries to scan your resume and have a machine read it. \- Keep things left-aligned as much as possible, so someone quickly glancing down doesn't have to jump across the page on every line of the resume (this is actually similar to web design, in that you can assume the reader will spend a very minimal amount of time reading your resume unless they quickly find something they like)

</comment><comment><USER19> General rule of thumb:

Even Steve Jobs' resume is one page, so what makes you think that yours should be 4?

<http://homepage.mac.com/steve/Resume.html>

(this is an incorrect quote, but I cannot seem to find the original)

<comment><USER20> I was always told in college that hiring managers won't read past the first page. So I don't.

Having a concise resume is an exercise in good communication and editing skills. Give me the _most important_ facts, not every single thing you've ever done.

<comment><USER21> The rules ares changing for length of resume. In college, yes, it should just be one page, but that's because you most likely don't have any experience. The one page limit works because it makes you focus on the meat of who you are.

However, as you gain experience, then the one pager can become an artificial limiter. As many people have explained above, tailor it to the job you are applying to. But in the hacker community it will be important to show things you work on for fun as opposed to things you do to pay the bills.

My resume is currently 3 pages. First page is what I love to do (projects I am working on and consider important). Page two is how I get paid. Page three is education, skills, references.

<comment><USER22> I can tell you as a hirer I would most likely not seriously consider your resume. You might think that is unwise, but you clearly don't know what it's like to wade through a pile of crap from people who are obviously just spamming every job opening they can find, trying to find the few people who are _actually_ reasonable candidates, before even trying to figure out which ones might be any good. Even using a recruiter is of limited use -- you can give them criteria, but they often just don't know to tell the difference between a real programmer and someone who has put "programmer" on a piece of paper.

Three pages, with skills on the third page, is roughly as rude as walking into my office and unplugging my computer.

</comment></comment></comment></comment><comment><USER23> I think one of the things that I have found that have worked well on my resume is a summary of qualifications at the top. Helps you leave out a generic skills section(which can look cheezy) and lets you highlight whatever you want to highlight for a particular position.

I make sure that I tailor that summary for every position I apply to make sure I highlight my relevant skills/experience.

<comment><USER24> I usually summarize qualification as they apply to the job in question in the cover letter.

Another thing I do, rather than taking up space in your resume with a separate summary, is to simply make the important words/qualifications bold in your resume. That makes it easy to skim without using up more resume real estate.

</comment></comment><comment><USER25> Put in the least amounts of skills that will still land you an interview.

Writing "basic knowledge of Java" adds a lot of credence to "expert in C++".

<comment><USER3> So you suggest understatement, to make the dynamic range sound broader? (Writing "expert in everything" definitely won't work.)

</comment></comment><comment><AUTHOR> How do you list an achievement where you were part of a team?

It sounds dumb to me to write: "helped build X". Any ideas?

<comment><USER26> "It sounds dumb to me to write: "helped build X". Any ideas?"

Not all that dumb. But try to include concrete numbers about the value added to the company because of the team.

Rather than "helped build X", write "helped reduce operations costs (numbers if possible) by (whatever it was your team did)."

The goal of a resume is to get an interview, so you need to pique the interest of the reader. Showing that you were at least part of a process that made money or reduced costs suggests you can help do the same for someone else.

Also, pointing out how your contributions (if even via a team) affected the bottom line should indicate you have an important awareness of business needs.

</comment></comment><comment><USER27> I've always liked the way this guy's CV is structured(it's on his front page): <http://www.zeroflux.org/static/resume.pdf>

Btw: he's the guy who created ArchLinux, though he's no longer the lead developer.

<comment><USER28> It's nicely laid out. I don't think I'd put education up top (in fact, I don't). Maybe you would if you're closer to just having graduated, and/or from a particularly renown University.

<comment><USER29> You're hinting at a general rule that goes something like "the most salient facts go at the top".

When I was trying to get my first job out of college, the fact that I'd graduated from a well-known school with a decent GPA was really important, and mentioned at the top. Ten years later, the fact that I went to school is just barely interesting enough to sneak in at the very bottom of the page, and my grades aren't worth mentioning at all.

</comment></comment></comment><comment><USER30> I typically turn in my resume using a a flat text file (usually using restructured text). It's really helpful because you really have no idea how the company's HR systems will mangle your resume. Plus, doing a resume in ReST just screams "hacker".

<comment><USER3> Yes, text files are among the best choice, when you are actually applying for a hacker post and know that a hacker will read your resume. If you are not so sure about your reader, I'd use LaTeX and produce a nice pdf.

It will still be recognized, but it also looks kind of pretty to the mere mortals.

</comment></comment><comment><USER31> Instead of having a skills section at the end of your resume, try showing how you utilized those skills in the 'work' section. The keywords will still get hits, and it will give context to how you use those skills, and your proficiency with them.

<comment><USER32> Let's face it, doing interviews can be boring when you do a lot of them, and so interesting resumes jump out of the stack pretty quickly. Your story should tell me why, if I choose to have a discussion with you, our conversation is going to be really engaging and interesting, and how it will convince me that you're the right person to do the job.

Some characteristics of engaging interviews:

\- They're with people with people who are smart. Show your smart on our resume either by listing academic achievements if you're just out of school, or by describing hard problems you've solved.

\- The candidate has done something interesting in their previous experience. Your resume gives you the opportunity to tell me what the most interesting thing you've done is. If I agree, you'll get to tell me all about it.

\- The candidate has enough experience to get through my technical questions in style. I think this is less about knowing specific buzzwords (at least for how I interview), and more about having solid fundamentals and good hands-on experience. This suggests it's probably better to talk about hard things you've worked on, rather than playing buzzword bingo.

</comment></comment><comment><USER33> The resume is important, but what grabs me every single time is a insightful and thoughtful cover letter. Honestly 75% of resumes look the same. If you can get me with the cover letter 9 times out of 10 you'll at least get a phone screen.

</comment><comment><AUTHOR> Side question. I'm also considering doing consulting or contract work so I figure I should have a separate resume for that.

Does anyone have good examples of a resume geared towards consulting?

(Are they even much different from regular resumes, do consultants need resumes?)

<comment><USER34> I haven't done consulting, but I have a basic resume for each job type (public policy, campaigning, engineering (now out of date), and finance) that I've been looking for recently that then gets geared towards the specific company in question.

I'll second the "restate the job posting in the cover letter" thought, though.

</comment></comment><comment><USER35> I like to see a strong, concise introduction/objectives section which (a) isn't full of buzzwords or B.S. and (b) helps me get a feel for the candidate and what makes them tick.</comment>


Ask HN: do you like "new" yahoo mail that has been forced at you? - <AUTHOR>

Early this morning my little girl ran to our bed all crying that Little Forest dissapear from her Yahoo. First I did not know whats going on until I opened my own mail.
It seems that Yahoo mail got GUI alterations without even asking their users if they want to have it applied to their profile. Nowhere I can find how to switch it back. I remember from GMail even Google had option to go back when they switched. This is very sad...
While explaining my daughter what has happened, my hope was that we can just go and reapply Little Forest theme - but little we know, all the themes are gone and you are left off with nothing other than boring colors.
As of alterations (I will call them that because I have not seen one new option/feature so its not like this is "update" per say [rather downgrade since themes are gone], but rather bunch of alterations thrown at you for God knows reason [I have my AdBlock on and I am afraig of turning it off -- perhaps themes dissapeared because now they can be dynamically replaced by ads, don't know), the only thing I noticed is three icons (trash can, favorite and checkbox) running around after your mouse that annoys me and wont let concentrate on reviewing mail.
Can someone tell me whats new about ths GUI and why it has been shoved in users throats without question or option to opt out?
As of my daughter it seems that GMail still allows for cool themes. Glad to know that. Will train her on using Gmail this should be an interesting experience. <comment><USER2>
      "all the themes are gone and you are left off with nothing other than boring colors."

FWIW there are still themes in the new Yahoo Mail I don't know if Little Forest is there because I don't use Yahoo Mail but its under "Options" on the top left hand corner of the page, next to the Sign Out button.</comment>


New Chat Protocol – XMPP Alternative (Based on XMPP Semantics) - <AUTHOR> Hey Guys,
After trying XMPP for months and unable to make it work on slow network, we decided to write a new protocol on mqtt. We loved XMPP for it's extensibility and the protocol completely mimics XMPP - chat, chatstates, client-state indiciation.
Just the namespaces are replaced by MQTT topics and with wildcards clients are really lightweight.
Advantages: 1. Streaming Binary instead XML (XMPP have exi so it can be fixed). 2. Super easy to implement. Just took us a day to implement to port most of the functionality from XMPP. 3. Just like XMPP it's infinitely extendible. Wanted to add a new packet type is just adding a provider and registering it to manager (to all those who worked with Smack - will feel at home). 4. Out of the box support for Webrtc - audio and video calls.
Here is the protocol - https://github.com/bangarharshit/Mqtt-chat and here is a proof of concept - https://github.com/DrawersApp/Node-Sdk/tree/mqtt/src . We are polishing the SDK and will be releasing the android sdk, java client, node client and server support - emqttd in the next few weeks.
One more thing we didn't like about XMPP was the time it takes for an XEP to go from draft to implementation (sometimes in years). We are trying to create an echo-system on git itself, where we can bring it down to days (or at-least weeks/months). Please submit feature requests on Github as an issue, propose a solution (or let it be proposed by community), quickly implement it and test it out.
Feel free to cut an issue for any discussion.
Thanks, Harshit <comment><USER2> Very nice harshit ... Best of luck .</comment>


Current qutebrowser roadmap and next crowdfunding - <AUTHOR> https://lists.schokokeks.org/pipermail/qutebrowser-announce/2019-October/000066.html <comment><AUTHOR> Qutebrowser ([https://qutebrowser.org/](https://qutebrowser.org/)) is a keyboard-driven browser written by Florian Bruhin (aka The Compiler) similar to dwb and Vimperator/Pentadactyl and based on the QtWebEngine.

<comment> The-Compiler > Florian Bruhin (aka The Compiler)

Hi! :)</comment></comment>


Spotify asking family-plan users for gps data to prove they live at same address - <AUTHOR> https://qz.com/quartzy/1405477/spotify-is-demanding-family-plan-users-hand-over-gps-data/ <comment><USER2> I often travel between Italy and Poland (I'm in Italy 1 week/month), and I keep running into problems of this kind.

I assume for copyrights agreements, when I'm in Italy Netflix will fail to show movies I was in the middle of watching in Poland. I keep having AWS, Digital Ocean, and others think I'm a hacker despite the fact that I routinely confirm my account again while travelling between the same two countries, etc.

Of course, in this case Spotify wants to stop people from saving money by sharing their account, but my point is that things like this often lead to bad experiences for legit users.

If I was 18 in this case I would have organized a "Spotify confirmation" dinner at my house. A parent who pays for Spotify and is travelling might see his account limited.

</comment><comment><USER3> IMHO no app that doesn't really need location data to perform the very function people install it for should ever be given access to this data. Same applies to Internet access and other app permissions.

</comment><comment><USER4> Because screw families that don't live together</comment>


Last.fm, CBS: we have not shared any data with anyone - <AUTHOR> http://arstechnica.com/tech-policy/news/2009/06/lastfmriaa-drama-round-2-denials-denials-denials.ars

<comment><USER2> _"[A]bsolutely no individual user or listener information was supplied to the RIAA by Last.fm or any division of CBS Corporation in the past, nor do we plan to do so in the future," CBS told Ars. When we asked if perhaps CBS had transferred the data to a music label or other third party, CBS said, "We never handed over user info to the music labels or anyone else."_

Ok, TechCrunch. Your turn.

</comment><comment><USER3> _slew of accusations_?

One blog accused them of sharing data. Three months later, that same blog added another accusation that they're basically lying.

That's like 1.5 accusations. Hardly a slew.

</comment><comment><USER4> Of course the denial is reported by Ars and not TechCrunch...</comment>


Portable, super-high-resolution 3-D imaging - <AUTHOR> http://web.mit.edu/newsoffice/2011/tactile-imaging-gelsight-0809.html <comment><USER2> See also the discussion from a few days ago:

<http://news.ycombinator.com/item?id=2864565></comment>


Finish the Job - <AUTHOR> http://birchtree.me/main/finishing-the-job-because-nobody-cares-what-youre-going-to-do <comment><AUTHOR> My experience is that you need to be able to ship iterations very quickly. You need to have a big blue button that says 'ship' on it. If you can release often, then the last 10% actually looks like 10 little 1% jobs.

Completing a 1% job 10 times is much easier than completing 1 10% job.

<comment><USER2> Totally agree - ship what you have now, and then add the polish. Seriously if people care what your content is about they will live with lack of polish.

There is however an Internet sixth sense - that says "dodgy". A two page site with a email collection form mailchimp is waaaay more forgiveable than something that reeks of pump and dump

<comment><AUTHOR> Absolutely. I believe these two groups of people are mutually exclusive: 1) Producers of 'Pump and Dump' sites and 2) People who struggle with the last x%.

Group 1 always produce low quality junk that triggers our 'dodgy' alarms. Group 2 always worry about producing something that is polished and finished.

The secret is to be in Group 2 but to have someone next to you shouting "Ship It!" as regularly as possible.

<comment><USER3> Some 37 signals outlet had a nice discussion on this. The key in their view was to limit the number of features rather than the quality of said features. Something about thinking of the features you want on a 2D map, and the thickness being the quality, building up your volume of work. To reduce volume you can break off pieces, but you should strive for even (and sufficient) thickness.

Too thin - pump & dump. To big volume - group 2. Small, but thick - good shit.

</comment></comment></comment></comment><comment><USER4> Relevant quote by Tom Cargill, and one of my favourites:

«The first 90 percent of the code accounts for the first 90 percent of the development time. The remaining 10 percent of the code accounts for the other 90 percent of the development time»

</comment><comment><USER5> My personal experience is that the last 10% are hard when:

      - I didn't stick to the specs
      - Added specs while coding
      - Didn't test while coding
      - Didn't fix shitty while coding

Because I think specs are very important I don't believe in too much of agile. I think the waterfall model is very useful but you have to keep the waterfalls very small. Maybe you can call this the agile waterfall model: waterfall -> release -> waterfall -> release

Related: <http://en.wikipedia.org/wiki/Ninety-ninety_rule>

<comment><USER6> Agile basically is very small waterfalls. Of course you need to think up front about what you need to do before you do it. The fallacy of the waterfall model is the idea that you can accurately predict the full structure of the system before you write the first line of code.

</comment></comment><comment><USER7> I feel much the same way about finishing and releasing. What I find interesting is that once I put something out there, opinions will vary wildly on the question whether it's way overdone and should have been released much earlier, or whether it's nowhere near ready to be released. I'm beginning to think that there is no such thing as the "right time" to release. What matters is that _I_ have a clear vision of what _I_ think is a great achievement that's not overdone. That vision gives me a finish line and provides me with a work rhythm. That "last 10%" that charlieirsh describes is part of that rhythm.

</comment><comment><USER8> The last 10% has little to do with the number of remaining items, and all to do with the type of tasks and mental blocks. Project fatigue sets in.

Within the last 10% are small details pushed aside as the pace was chugging along for the other 90%. Seemingly trivial problems are hidden until the end, during which, developers/engineers are most eager to move on to the next mentally stimulating new project.

I think there is a reason why in schooling, 'A' level work requires a completion of that last 10%.

</comment><comment><USER9> He's 90% dona and _then_ he'll show it to the world? Ehm, what if the world doesn't like it? Aren't we pass this? We do pre-launch, research and try to spread the concept and acquire interest and real-world feedback before we go 'all-in' right?

<comment><USER7> The way I understood the original submission was that "100%" indicates the point where the thing is ready to be released to the world at large. Before that, one may well do iterations involving users and potential customers. That will of course make the actual release, or launch, less of a traumatic event. And yet, perhaps I'm old-fashioned, but to me, release is still an important milestone, sort of a finish line, or a goal I'm working towards. That "first 90% vs. last 10%" really resonates with me.

<comment><USER9> It's because he doesn't show or tell the reader what he's working on. He only talks about "my next website" and "this project". I figured if he had shown it to the world he wouldn't mind linking to it in this post at the very least... But of course I could be completely wrong. I just can't tell by this blog post.

</comment></comment></comment><comment><USER10> as they say: if you finished 90% of the project, you are halfway done.

<comment><USER11> Does it follow that if you are 99% of the way through, ie you've done 90% of the last 10%, you are 75% done?

<comment><USER12> Almost: the first 90% of the project takes about 90% of the total time, while the last 10% usually take the _other_ 90% of the total time.

</comment></comment></comment><comment><USER13> I am at 90% right now and it is painful! Need to finish and release <http://get.infyouse.com>

<comment><USER14> I just hope your domain name does not drag your project down. Del.icio.us is as piece of cake, compared (compared with del.icio.us because I had to chunk it in a similar way). If I were you, I would really look for another name, ASAP.

<comment><USER2> What does it mean - I cannot translate the "mashup" from German - but I get the idea you are a personal wishlist site.

</comment></comment></comment><comment><USER15> When someone brags about something they _intend to do_ , it comes off as lazy and more than a bit self-congratulatory (without actually earning it).

I guess some do it as a way of gaining attention and free advertising.</comment>


The JOS Window System - <AUTHOR> http://ryanrussell.me/portfolio/os/ <comment><USER2> Hey everyone. Didn't expect to see this here. I made this for my operating systems class a few years ago. Unfortunately I can't share the code because the rest of the OS is used as assignments for the class, but it was a fun project.

It's not highlighted much in the writeup, but most of the interaction takes place in the terminal. The original assignments just use text mode. The graphics mode got started when I tried to implement ANSI escape codes in the terminal, but some of the effects weren't possible in text mode. I changed the bootloader to switch the system into a known graphics mode, then implemented a terminal emulator on top of that. From there it was just a small matter of mouse drivers and windowing commands.

JOS is a unix-inspired exokernel. It has virtual memory with thread isolation, a pre-emptive scheduler (round-robin, I think), and IPC. Everything else lives in user-land. As alluded to, the disk drivers even run in a user-land process which has been given access to the disk IO port. My windowing system is also a user-land process, which leases out buffers of memory as windows and has been given access to the memory-mapped screen buffer.

<comment><USER3> RE: transparency

see [https://en.wikipedia.org/wiki/Bit_blit](https://en.wikipedia.org/wiki/Bit_blit)

This was used for sprites on pretty much any 1980s target that didn't support hardware sprites.

</comment></comment><comment><USER4> JsonTransform[1] by the same author made me giggle.

"Transforms JSON to JSON using JSON"

[1]:[https://github.com/RussellSprouts/JsonTransform](https://github.com/RussellSprouts/JsonTransform)

<comment><USER2> Haha, my Github has some projects of questionable usefulness, yeah. In that case, I was building a UI for an internal monitoring app at an internship. It had to make requests to lots of internal API and couldn't really ask for custom endpoints or changes. Having a declarative way to transform the responses into UI models was really useful. That also explains the '!json' operator, because inevitably in legacy systems there will be responses that contain stringified JSON that needs to be parsed.

<comment><USER5> For fun, you should make sure to make the identity transform be super complex, like it is for XSLT:

[https://en.wikipedia.org/wiki/Identity_transform#Using_XSLT](https://en.wikipedia.org/wiki/Identity_transform#Using_XSLT)

<comment><USER2> Um, it's been a while, but I think it fails that test -- the identity template is "$"</comment></comment></comment></comment>


Ask HN: Is there room for privacy-oriented tools (e-mail, productivity, etc..)? - <AUTHOR> <comment><USER2> Privacy is as much a feature as it is a business model (or reaction against ad-based business models). The biggest question to consider is what will you replace that business model with? And will people pay to use software they're used to getting for free?

I'm not super confident the answer to #2 is yes. But that's the kind of market research you should do before jumping in.

The other alternative is to follow in the path of Signal, make a free, open- source alternative. Survive on grants and donations if you're lucky.

</comment><comment><USER3> [https://dymaxion.org/essays/pleasestop.html](https://dymaxion.org/essays/pleasestop.html)

<comment><USER4> I submitted this here:

[https://news.ycombinator.com/item?id=15534480](https://news.ycombinator.com/item?id=15534480)

Thanks for introducing me to her essays.

</comment></comment><comment><USER5> Yes especially well designed ones as far as UX goes. That means easy to use by your friends mom and not sluggish based on network performance or application performance. Definitely needed but it requires a bit of an investment on development and implementation.

</comment><comment><USER6> What's up with the obsession with privacy on HN?

I'd rather see people work on ways to facilitate the transition to the inevitable post-privacy world than see people waste time making crappy "privacy-oriented" clones of existing tools.

<comment><USER7> There appears to be a very big demand for a more private world, it seems. A lot of people here do see what's under the hood and it's a natural reaction to want to go back to the good old days when people respected privacy.</comment></comment>


Elon Musk testifies he's financially illiquid, court filing says - <AUTHOR> https://www.latimes.com/business/story/2019-10-16/elon-musk-testifies-defamation-case-cave-diver <comment><USER2> It would be a red flag if he weren't. Imagine if he were hoarding cash while preaching his vision of the future which seems a few trillion shy of launching. It would be borderline fraudulent. If you have a lot of cash, it means you either really don't know what to do with it or think all companies are on the brink of failure and will underperform the dollar.

</comment><comment><USER3> Elon Musk is many things and his fortune has always been uniquely tied to that mystique. Belief in Elon the man lends belief to Elon's companies which in turn makes him valuable. But none of his companies have reached the point where they can freely exchange that value for commodities.

</comment><comment><USER4> I see no reason Elon Musk cannot sell Tesla stock if he were to be liable for a judgment against him.

<comment><USER5> many times CEOs cannot sell stock because doing so might signal to others that something bad is going to happen at that company. I recall a story of a company that was doing well, had customers, and good stock. then suddenly overnight the stock tanked. after researching for a while they found out what the cause was. one of the c-level employees / founder wanted to pay for his daughters wedding so he sold some stock. due to that some algo traders had programmed to sell stock if the founder sells. other algo traders programmed only to sell if both the founder and some other traders sell. well, this spiraled out of control until the market closed for the night.

<comment><USER6> How could they know when the founder sold stock? Is this public information?

</comment></comment></comment><comment><USER7> How much does he have liquid versus illiquid?</comment>


Bitcoin crosses $1,800 for first time, adding $3B in market cap in just 4 days - <AUTHOR> http://www.cnbc.com/2017/05/11/bitcoin-price-1800-record-high.html <comment><USER2> This is the next bubble. Im a bitcoin supporter but this increase seems to have been fueled by rises in ltc, dsh and eth and now investors are moving out of those into a safer currency (btc) it is also the best conduit to turn alt coin profits into fiat. There has been no beneficial change to the fundamentals of bitcoin to drive this rally so soon it will pop. I wonder at what point it will pop though.

<comment><AUTHOR> Isn't really hard to say what the "real" value of Bitcoin should be? I mean what are the fundamentals?</comment></comment>


Why Programmers don't have a High Social Status? - <AUTHOR> http://www.goodbuzz.org/blog/conversation/programmers-high-social-status/ <comment><USER2>
      > Give the work a programmer to another programmer, and most
      > of the time the comment will be negative about the work
      > and the programmer.
      >
      > Artists don't do that.
      > Sales people don't do that.
      > MBA types don't that.
      > Politicians do that only for joking to have votes.

Ahahahahahahahahahahhh aahahhhahahahahahhha hahah. Oh. Oh that's really good. Man, whew. For a second there I thought he was living in some parallel universe where TMZ didn't exist and he was beaming this blog post from that wonderful Utopia.

Then I realized, oh, (s)he's clueless.

<comment><USER3> interesting

original article >> "This manifests itself by a very singular phenomena: programmers hate each other. They usually bash other programmers"

your reply >> "Then I realized, oh, (s)he's clueless."

<comment><USER4> Yeah, because concluding that a specific someone that is a programmer speaks BS, totally means that you validate his argument that programmers hate and bash each other...

Ever heard of self-fulfilling prophecies?

</comment></comment></comment><comment><USER5> I think the trend is definitely positive for us.In my experience I dont think there is any negative connotation to being a programmer these days.Whether positive or not depends upon what kind of stuff a programmer does.Personally when I tell people I make apps for iPhones and iPads I do think I get some positive social credit.

With the increasing adoption of technology in our daily lives,I think its going to get even more positive in the future.

But yes, it would really help if the ladies wanted my number as soon as I told them I am a programmer :)

</comment><comment><AUTHOR> Just read this morning that Jonathan Ive, Apple's senior vice president of industrial design, has been named a Knight Commander of the British Empire in the U.K.'s 2012 New Year Honours list, an honor he has described as "absolutely thrilling." [http://www.appleinsider.com/articles/11/12/30/apple_design_c...](http://www.appleinsider.com/articles/11/12/30/apple_design_chief_jonathan_ive_awarded_knighthood.html).

Progress is on the way

</comment><comment><USER6> Why don't programmers have high social status? Because: \- their craft is arcane (everyone can grasp what either a doctor or a lawyer do, but grasping what programmers do is more difficult); \- they are socially inept (goofy attitudes, disregard for their appearance, etc.). \- they sell themselves cheap (since they are eager to help, often they don't make other people appreciate their help).

</comment><comment><USER7> > Up to date there is No single street name for a top programmer or computer > scientist in any of the Top 20 most developed countries in the world during > the last 60 years.

What about Woz Way in San Jose, CA? He's hardly a computer scientist, nor even primarily a programmer, but he certainly did a fair amount of programming.

(Yes, I know this doesn't invalidate the point of the article.)

</comment><comment><USER8> I would change your title to either 'Why programmers don't have a high social status.' or 'Why don't programmers have a High Social Status?'. The current title implies you are making a statement, yet the question mark implies a well..question. Thanks for sharing, hope this helps. #pedantry

<comment><AUTHOR> Done :)

</comment></comment><comment><USER9> Possibly because so many are such terrible writers.

</comment><comment><USER10> Most programmers aren't social. It's why we get into programming in the first place (writing code for 8 hours a day instead of talking to people). If we were, we would have gotten into sales or marketing.

<comment><AUTHOR> do you think that managing or dealing with people (these irrational talking machines) is harder and scarier than coding?

<comment><USER10> I did 10 years ago when I was 18 or 19. Now that I've forced myself to be social (by pushing myself outside my comfort zone), it's not scary anymore. I actually enjoy it.

However, one of the reasons I got into programming in the first place (at 13) is because I was shy and found happiness there.

I view marketing as a sort of programming, but instead of having a nice project at the end, you have some cash.</comment></comment></comment>


If you die early, how will your children remember you? - <AUTHOR> https://www.bbc.co.uk/news/stories-47334604 <comment><AUTHOR> A thoughtful idea, the article is about an app:

RecordMeNow [http://recordmenow.org/](http://recordmenow.org/)

that prompts someone with questions that most children would liked to hear answered when they're older.

There's also a very good podcast version of the article:

[https://www.bbc.co.uk/programmes/p072kvnc](https://www.bbc.co.uk/programmes/p072kvnc)</comment>


Space Suit: 1949 - <AUTHOR> http://www.wired.com/wiredscience/2012/09/space-suit-1949/ <comment><USER2> > Ross and Smith ended their paper by estimating their suit's weight. It > would, they calculated, have an Earth weight of 150 pounds. On the moon, > however, where gravity pulls with about 15% as much force as on Earth, their > suit would weigh only about 25 pounds.

This kind of audience-confusing shortcut always makes me jump. It would still weight 150 pounds on the moon, but it would exert 15% of the force as generated on Earth. The distinction is important, even for the uneducated, because it means that although you _appear_ to weight less statically, you have exactly the same inertia.

<comment><USER3> Isn't _pound_ the name of both the mass and force units? In that case it would have the mass 150 pounds, but weigh 25 pounds.

<comment><USER4> When I studied physics in highschool, we were taught to measure mass in kilograms and to measure weight in newtons. While this seemed a little strange at the time, it had the effect of forcing you to be clear which one you were talking about and it avoided this kind of confusion.

<comment><USER5> As I recall, the mass term "slug" is often used rather than pound-mass to remove this ambiguity. A slug = 32.174049 lbm (i.e. multiplied by the earth's gravitational acceleration constant without any units).

But, yes, the terminology among other things can introduce ambiguity and the potential for error when using Imperial units for these types of calculations. (In fact, I seem to remember it sometimes was easier to convert into metric and back again at the end.)

The general point here though is that the local gravitational constant changes the weight (downward force on the object) but not its inertia (a property of mass and other physical properties).

</comment></comment></comment></comment><comment><USER6> <http://www.gutenberg.org/files/19141/19141-h/19141-h.htm> Edison's Conquest of Mars

aka "Space Suit: 1898"

Ctrl+F "the air-tight suit".

</comment><comment><USER7> The British Interplanetary Society is still around and active... <http://www.bis-space.com/></comment>


Ask HN: Has Medium become a pay-wall on top of pay-walls? - <AUTHOR> <comment><USER2> Guess it depends on whether you're paying for it or not

Medium hosts lots of content free (or free-ish)

And they host republished content

There is an option to allow views to members only - but there's also the option to publish _sans_ wall</comment>


Examining IPv6 Performance - <AUTHOR> https://labs.ripe.net/Members/gih/examining-ipv6-performance <comment><USER2> Not a performance issue per-se, but more an ugly unintended consequence of IPv6 issues: _peer-flooding_ in torrent transfers. I use libtorrent to distribute my data sets and i'm seeing all the usual trackers are being flooded (DoS-like) via the vast available, in this case phony, IPv6 address space[1]. The unstated contention by agents of content owners being that bit- torrent can never do anything but wrong. Selfishly focused on their own content they're statistically not utterly wrong, but they are using the design of IPv6 to poison the well for benevolent use.

[1] [https://torrentfreak.com/popular-torrents-being-sabotaged- by...](https://torrentfreak.com/popular-torrents-being-sabotaged-by-ipv6-peer- flood-150619/)

<comment><USER3> >Update: The IPv6 addresses which are used appear to be fictional. They haven't been allocated yet and are non-routable.

What kind of network are they using that lets them send forged source addresses? Also, a temporary solution in that case would be to use a blocklist of non-allocated ranges.

<comment><USER4> BT is UDP and you can write whatever you want into a packet.

<comment><USER5> Are you talking about changing source address in IP header? Most ISPs will drop such packets: [https://tools.ietf.org/html/rfc3013#section-4.3](https://tools.ietf.org/html/rfc3013#section-4.3)

<comment><USER3> That's what I thought - but it turns out that not all ISPs behave well.

[https://defcon.org/images/defcon-22/dc-22-presentations/Grah...](https://defcon.org/images/defcon-22/dc-22-presentations/Graham- McMillan-Tentler/DEFCON-22-Graham-McMillan-Tentler-Masscaning-the- Internet.pdf) but the video is also very entertaining. This is applicable to the IPv4 internet but I'm sure someone will eventually come up with a way to do it for IPv6.

</comment></comment></comment></comment></comment><comment><USER6> This compares ipv6 vs ipv4 dual stacks between the same endpoints. The conclusion is that performance is equivalent but the establishment of the connection has a 9x higher failure rate for ipv6.

(Edits:grammar)

</comment><comment><USER7> GeoIP routing is sometimes worse with native IPv6 than IPv4. Take gstatic.com for example which goes to a neighbouring country with IPv6 (inside same ISP, but still):

      $ ping -c 3 gstatic.com
      PING gstatic.com (220.127.116.11) 56(84) bytes of data.
      64 bytes from cache.google.com (22.214.171.124): icmp_seq=1 ttl=61 time=2.11 ms
      64 bytes from cache.google.com (22.214.171.124): icmp_seq=2 ttl=61 time=1.98 ms
      64 bytes from cache.google.com (18.104.22.168): icmp_seq=3 ttl=61 time=1.78 ms

      --- gstatic.com ping statistics ---
      3 packets transmitted, 3 received, 0% packet loss, time 2002ms
      rtt min/avg/max/mdev = 1.780/1.960/2.118/0.143 m

      $ ping6 -c 3 gstatic.com
      PING gstatic.com(bud02s22-in-x03.1e100.net) 56 data bytes
      64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=1 ttl=55 time=9.85 ms
      64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=2 ttl=55 time=9.67 ms
      64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=3 ttl=55 time=10.5 ms

      --- gstatic.com ping statistics ---
      3 packets transmitted, 3 received, 0% packet loss, time 2003ms
      rtt min/avg/max/mdev = 9.675/10.031/10.568/0.403 ms

So I have this in /etc/gai.conf now:

      precedence ::ffff:0:0/96  100

<comment><USER8> The worst problem with Google's GeoIP implementation is that you really can't report problems to them in a good manner. They have this: [https://support.google.com/websearch/contact/ip](https://support.google.com/websearch/contact/ip) but it only works for Google.com and not YouTube. I really, really wish Google would put more resources on this.

<comment><USER9> I heard that you can report YouTube connection issues at [https://www.reddit.com/r/youtube](https://www.reddit.com/r/youtube), and YouTubers will address them. Have you tried that?

</comment></comment></comment><comment><USER10> I didn't RTFA but would point out that the performance problems I've run into with IPv6 aren't related to the specification itself but buggy implementation code from vendors, which I expect to improve with time.

<comment><USER11> There are also issues with end user rollouts. For example, comcast uses prefix delegation to give you are /60 which your router (pfsense in my case) then uses for the internet network (it carves out a /64). However, this prefix changes! As it is not a statically assigned prefix, my internal devices renumber whenever it changes, it would make it a huge pain to get a consistent mapping for my internal devices (media server, printer, etc) were I to go ipv6 only.

I thought about using an additional ULA subnet (ipv6 supports multiple subnets), but apparently many vendors do not yet support RFC 6724, or support it poorly with regard to ULA addresses. As such, I get mixed results with devices trying to use the ULA address for internet egress.

NAT66 (npt) is another possibility, and some people end up having to use this when they have more than one ISP (multi-wan balancing) anyway, but I haven't found a good way to update the nat target when the prefix changes yet (might try moving to openbsd and try ifstated calling a script to a pf table or something).

<comment><USER12> > For example, comcast uses prefix delegation to give you are /60 which your > router (pfsense in my case) then uses for the internet network (it carves > out a /64). However, this prefix changes! As it is not a statically assigned > prefix, my internal devices renumber whenever it changes, it would make it a > huge pain to get a consistent mapping for my internal devices (media server, > printer, etc) were I to go ipv6 only.

Part of the point of IPv6 is that your addresses reflect the real network topology - when your upstream changes, your addresses change. The right thing is to ensure that your router is also updating DNS for your internal devices, and use names to refer to them. You shouldn't expect anything to have a truly static IPv6 address.

<comment><USER11>
      > The right thing is to ensure that your router is also
      > updating DNS for your internal devices, and use names
      > to refer to them.

How does a router go about doing that with SLAAC? Running dhcp6 is something I would like to avoid. Maybe Bonjour/mDNS are just going to be far more prevalent in the ipv6 world.

For most devices, a constantly changing IP is well and good (eg ipv6 privacy extensions). However, for servers it is less than desirable.

<comment><USER13> This is the missing part for me as well. I run DNS internally and it works just fine for IPv4, but everything is using SLAAC so I can't have AAAA records.

The only solution I've heard so far is to have a client on each machine that would update the DNS server with the new address, which sounds terrible.

I'm just about at the point that I'm just going to install DHCPv6, but last I heard not every OS supported it?

</comment></comment></comment></comment></comment><comment><USER14> slightly OT: why is HN not ipv6 yet? why isn't reddit? why pretty much anyone except google and facebook isn't?

<comment><USER4> Because there is no benefit to running IPV6 if you have access to an IPV4 address.

<comment><USER15> There actually is. An increasing number of ISPs is going IPv6-only with central carrier-grade NAT for IPv4. Those gateways are often overloaded, resulting in vastly better performance over IPv6.

<comment><USER16> IPv6 traffic is much slower. In my case (I use Miredo client), link to Portsmouth, ServerHouse, GB is up to 30Mbit by IPv4 but no more than 1Mbit by IPv6.

<comment><USER15> You have native IPv4 and IPv6 over a tunnel, so of course IPv6 is going to be slower.

The point is that for an increasing number of users, it's the exact opposite.

</comment></comment></comment></comment></comment><comment><USER17> I've gotta say, I was impressed with how easy the IPv6 setup was with the latest version of OpenWRT. I just recently upgraded and, with Comcast's native IPv6 support, everything just worked and all of the machines on my LAN grabbed externally-routable addresses. After poking some holes in the default firewall rules, I can connect directly from my machine at work (also IPv6 addressed) to a machine at home without any port mapping or translation. Feels nice.

</comment><comment><USER18> Particularly on mobile, Facebook is seeing fairly big wins with IPv6. It's not entirely clear why, but it's happening. Here's Paul Saab's deck from earlier this year: [https://www.dropbox.com/s/15xi92296lw32hu/Facebook-World- IPv...](https://www.dropbox.com/s/15xi92296lw32hu/Facebook-World- IPv6-2015.pdf?dl=0)

<comment><USER15> I bet on NAT latency. No NAT must be great for push messaging, since the network is stateless and less keepalives are necessary to keep the connection open.</comment></comment>