I'm not a human: Breaking the Google reCAPTCHA [pdf] - louis-paul https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf <comment><AUTHOR> [http://arxiv.org/abs/1602.02697](http://arxiv.org/abs/1602.02697)

I don't work on reCAPTCHA but I imagine they could easily + significantly beef up image captcha by adding adversarial image examples that trip up would-be automators.

Note that _adversarial examples generalize across models._ Meaning a good adversarial example will work against SVMs, convnets, etc just the same.

If you're interested in the basics of how it works, Julia Evans has a great post: jvns.ca/blog/2015/12/24/how-to-trick-a-neural-network-into-thinking-a- panda-is-a-vulture

The key is that deep neural nets are actually very (piecewise) linear and that makes them susceptible to adversarial training.

<comment><USER2> Or use those images: [http://imgur.com/a/K4RWn](http://imgur.com/a/K4RWn) :)

</comment></comment><comment><USER3> Using the Google's own reverse image search to break an image-based captcha. Simple, but brutal.

<comment><USER4> Thought the same thing, that's ironic /and/ smart

<comment><USER5> Perhaps in response google could identify their own image they just served from recaptcha being google searched and throw the google image search into a captcha jail? .... if they have a large enough pool of images they are using, to be able to make that correlation, and if google search and recaptcha are capable of sharing that level of intimate detail ... probably a lot of problems with that tho.

</comment></comment></comment><comment><USER6> _" We ran our captcha-breaking system against 2,235 captchas, and obtained a 70.78% accuracy"_

That's more impressive than it sounds. I'm pretty sure 70.78% is more accurate than I am with reCAPTCHA manually. A lot of the captcha's presented are very fuzzy, or have ambiguous questions, etc.

<comment><USER7> Indeed. It's good that these guys are white-hats because they could have made a _killing_ selling to spammers (for as long as they could go undetected, which could've been a while).

<comment><USER8> Going rate for humans breaking captchas is like $1/1000 captchas solved. A fully automated service could make some money, sure, but not exactly a _killing_.

<comment><USER9> From paper, "Assuming a selling price of $2 per 1,000 solved captchas, our token harvesting attack could accrue $104 - $110 daily, per host (i.e., IP address). By leveraging proxy services and running multiple attacks in parallel, this amount could be significantly higher for a single machine."

</comment></comment></comment></comment><comment><USER10> I am the only one who thinks google reCAPTCHA is just a tool that Google uses to train Machine Learning Algorithms? First it was used to help Google learn how to Read, now its learning to detect object, landscapes, ...

<comment><USER11> I'm pretty sure this is the advertised purpose of it. It stops bots AND helps machine learning.

<comment><USER12> *AND helps a company make profit by training their proprietary models.

If they were open, it would be a lot better (considering all the training is done by volunteers, too)

<comment><USER13> uhh. Everything they do is arguably for profit. That's why Google is an LLC. What do you expect them to do, put an "* this is done to earn us money" disclaimer on everything?

<comment><USER14> This is a little pedantic and doesn't change your point, but Google is not an LLC. It's a C Corporation.

</comment></comment></comment></comment></comment><comment><USER15> > Over the period of the following 6 months, text captchas appeared to be > gradually "phased out", with the image captcha now being the default type > returned, as these captchas are harder for humans to solve despite being > solvable by bots [3, 4].

This is so true. When I first go an image captcha, it took me 3 minutes to learn how to solve it. I had JavaScript disabled so I did not realize I had to do 3 pages to complete the challenge (after two, I reloaded and got a new route thanks to tor the page since I though i message up). Also I'm not sure what to click when there is a partial match, is that still a match? And don't even get me started with solving signs (in my first challenge I had to tell apart different kind of signs that were in the image). Is a no trespassing sign still a traffic sign? What about if it is a sign but I don't know which kind of sign (due to domain knowledge – especially when they're foreign signs). Another problem is that they require you to understand the language the challenge is in. You can still solve a text captcha if you don't speak any English.

I wish there was a way to force text captchas

</comment><comment><USER16> Quite interesting how the authors even mention that this strategy is very economically viable.

From the paper: 'Assuming a selling price of $2 per 1,000 solved captchas, our token harvesting attack could accrue $104 - $110 daily, per host (i.e., IP address). By leveraging proxy services and running multiple attacks in parallel, this amount could be significantly higher for a single machine.'

<comment><USER17> Makes me wonder if they got paid for reporting it to Google.

</comment></comment><comment><USER18> You could also just pay a service that uses human workers in third world counties. It's a little over a tenth of a cent per captcha.

<comment><USER19> Or you could set up a pr0n site that shows the material only after the user has completed the captcha. This trick has been done before.

<comment><USER20> I've never seen a documented case of such tricks actually being used, and I've seen calculations that suggest the cost/benefit outcome is no better than just paying the poor to do the menial work.

The last such analysis I paid attention to was some years ago so the situation may have changed, but I suspect the hassles of running a porn site and CAPCHA proxy still aren't worth it:

* obtaining content sufficient to attract interest

* paying for bandwidth & other resources)

* writing the authentication system

* then maintaining it (every time the CAPCHA service(s) change their process you potentially need to make and test changes to your code)

* and you need to work around rate limits (depending on the CAPCH design it may not be possible to make the relevant requests client-side so if the services has rate limits you'll have to route through something that sufficiently randomises your source address).

* providing support

* dealing with bad press

<comment><USER21> The closest thing to a documented case I've seen is a report of people gaming the Time Person of the Year poll so that the top person was moot, and the first letters of the candidates spelt out "Marblecake. Also the game.":

 _By understanding how reCAPTCHA worked – the team was able to double their productivity (since they usually only had to enter one word instead of two). To further optimize their voting they created a poll front-end that allowed you to enter votes quickly while giving you an update of the poll status (and since it is a 4chan kind of crowd, they also provided the option to stream some porn just to keep you company while you are subverting one of the largest media companies in the world._

[https://musicmachinery.com/2009/04/27/moot-wins-time-inc- los...](https://musicmachinery.com/2009/04/27/moot-wins-time-inc-loses/)

However, this is slightly different as people were deliberately solving CAPTCHAs (and watching porn) rather than wanting to watch porn and also incidentally solving CAPTCHAs that they had no direct interest in.

</comment></comment></comment></comment><comment><USER22> I guess we're all waiting for browser extension to fill in captcha for us, which is sometimes hard to get right, great usability improvement.

</comment><comment><USER23> I have a bad feeling CloudFlare is going to break the internet for Tor users with impossible-to-solve CAPTCHAs again after this...

<comment><USER24> Not that it can become much worse than it already is, though. The current reCAPTCHAS are already "fuck this shit"-inducing on Tor.

<comment><USER23> It very much can. Only a few months ago they were simply impossible. I tried to solve 30 of them while accessing a site and was still unable to. The current set are merely extremely annoying and time-consuming, but they can consistently be solved (at least by English speakers).

<comment><USER25> They can be consistently solved, the only problem is the endless repetition and "multiple answers needed" nonsense, which only seems to apply to Tor users.

</comment></comment></comment></comment><comment><USER26> I may be being overly-cautious, but does anyone have a summary of this that isn't a PDF from blackhat.com?

edit: Thanks for both responses!

<comment> liviu- TL;DR from [https://www.reddit.com/r/netsec/comments/4dvifg/im_not_a_hum...](https://www.reddit.com/r/netsec/comments/4dvifg/im_not_a_human_breaking_the_google_recaptcha/d1uppxn) (though you may be overly-cautious as blackhat.com seems to be the webpage of a computer security conference [1]):

"""

Live attack To obtain an exact measurement of our attack's accuracy, we run our automated captcha-breaker against reCaptcha. We employ the Clarifai service as it shows the best result amount other services.

Labelled dataset. We created a labelled dataset to exploit the image repetition. We manually labelled 3,000 images collected from challenges, and assigned each image a tag describing the content. We selected the appropriate tags from our hint list. We used pHash for the comparison, as it is very efficient, and allows our system to compare all the images from a challenge to our dataset in 3.3 seconds. We ran our captcha-breaking system against 2,235 captchas, and obtained a 70.78% accuracy. The higher accuracy compared to the simulated experiments is, at least partially, attributed to the image repetition; the history module located 1,515 sample images and 385 candidate images in our labelled dataset.

Average run time. Our attack is very efficient, with an average duration of 19.2 seconds per challenge. The most time consuming phase is running GRIS, consuming phase, as it searches for all the images in Google and processes the results, including the extraction of links that point to higher resolution versions of the images.

"""

[1] [https://en.wikipedia.org/wiki/Black_Hat_Briefings](https://en.wikipedia.org/wiki/Black_Hat_Briefings)

</comment></comment><comment><USER27> I must admit that I have not been able to pass any of the text reCAPTCHA challenges lately when I have wanted to access the more sensitive content. Either I am getting them wrong or my submits get ignored.

</comment><comment><USER28> One of the more interesting references linked here was [https://github.com/neuroradiology/InsideReCaptcha](https://github.com/neuroradiology/InsideReCaptcha) — apparently the reCAPTCHA JavaScript snippet uses an encrypted bytecode format running on a custom-built VM, which one intrepid person has decompiled.

</comment><comment><USER29> Anyone else annoyed with the grammar errors on the paper?

<comment><USER30> "We automately searches Google for certain terms, followes links from the results, watches video on Youtube, searches on Google Maps, visites popular websites that contains Google plus plugins and widgets."

It's like reading a security paper authored by Gollum.

</comment></comment><comment><USER31> I worked on a little piece on recaptcha a while ago[0].

I'm glad to see research around how this captcha method is actually as breakable as any, but the real problem continues to be that there is no separation between the data Google collects for advertising, and the data Google collects from the captcha service.

Their privacy policy says they can link the captcha to your other online identity and use it to target you. It's especially cringeworthy to see lots of sites of dubious legality implement reCAPTCHA (like thepiratebay).

[0]: [http://www.businessinsider.com/google-no-captcha-adtruth- pri...](http://www.businessinsider.com/google-no-captcha-adtruth-privacy- research-2015-2)?

</comment><comment><USER32> I don't get why, when and how Google uses reCAPTCHA within their own tools. E.g. within the Webmaster Tools, I can submit up to 500 URLs for manual fetch/render and subsequent index submission. So the rate limit is already there and reasonable.

However, after 4 submitted URLs, I get a reCAPTCHA. From then on for every URL, I have to complete it with additionaly visual quizzes.

<comment><USER33> Another way they get triggered is when people use browser/desktop based rank checkers.

There are also plugins some SEOs use to pull lots of requests. These tools are quite old now and not very useful, but people still use them.

<comment> at-fates-hands Google recently killed off its page rank toolbar - which most people in SEO used to measure their success with the sites they worked on.

Google has confirmed it is removing Toolbar PageRank: [http://searchengineland.com/google-has-confirmed-they-are- re...](http://searchengineland.com/google-has-confirmed-they-are-removing- toolbar-pagerank-244230)

</comment></comment></comment><comment><USER34> I have used services like 2captcha.com, to get solving costs down to $0.5-$1 per 1000 solved captchas.

Googles reCAPTCHA is hardly an effective solution... Also if google wanted to they could just automatically verify people without you clicking that checkbox. Because at the end of the day they already know if they are going to auto-verify you, or make you pass a test.

<comment><USER35> Someone should really make a web browser plugin that automatically solves CloudFlare, Google and Facebook captchas for people using ::gasp:: VPNs. I would happily pay $1 for every 1000 captchas served at me to be solved for me, even if it took the page a bit longer to load for me still. As long as the latency wasn't too much higher than it'd take me to solve it myself.

Just like with DRM, captchas only seem to punish legitimate users and perhaps _very_ small-time bad actors.</comment></comment>


Unsuck your vagrant: Developing in one VM with Vagrant and Docker - <AUTHOR> http://tonyhb.com/unsuck-your-vagrant-developing-in-one-vm-with-vagrant-and-docker

<comment><USER2> Great article, I'm not extremely versed in Docker, but it left me with a better understanding of the process. Thanks!

<comment><AUTHOR> Thanks for the feedback, glad it helped!

Took a fair while to write and edit, but it was well worth it. Docker is a great tool, and the more I use it the more I love it. Would definitely recommend a try if you have some spare tome soon.

<comment><USER2> Yeah, I'm looking at using it for my current project. Need to be able to boot up dev environments on the fly. Can you get SSH access directly into them instead of through the original server?

<comment><AUTHOR> Not that I know of. I haven't tried exposing an SSH server from containers to Vagrant (and Vagrant to your machine), but that could be a possibility.

As far as I know, you can only SSH into containers by running `docker attach {$id/$name}` or `sudo lxc-attach {$id}`.

Dockerfiles might be helpful for you though – they can take care of booting instances as and when needed?</comment></comment></comment></comment>


On Turning 30 - <AUTHOR> http://on-turning-30.pen.io/

<comment><USER2> I really love reading the thoughts of those further along in life than myself. It's like a cheating-style glimpse into the future.

When he talks about college, I can see myself in a lot of that. His perspective on being homeless through college - sophomore year I wanted to build a small house in the campus woods and skip on paying rent.

But once you've established that base connection, it's the thoughts from ahead that are the most enticing for me.

Reading stuff like this is like saving the game in Civ3, then "retiring" and watching the world history animation - seeing the bird's eye view of the world; watching the countries grow and battle and contend for land. And when you revert to the save file, you have a clearer picture of what the future holds. It gives you a sort of pre-emption on the challenges you'll face.

</comment><comment><USER3> I have to say, that's pretty impressive. Although, one has to wonder as to whether or not you were over-privileged. Is your "success" a result of having a head-start? It would seem the economy is just perfect for you, but I digress.

Homelessness eh? So you were leaching off your school, yes?</comment>


What's a good alternative to Exhibit/Simile? - <AUTHOR>

See http://simile.mit.edu/wiki/Exhibit
Is there a better alternative for doing Faceted browsing on html/javascript?
What do you use? (besides coding everything from scratch) <comment><USER2> D3</comment>


Time-reversal of an unknown quantum state - <AUTHOR> https://phys.org/news/2020-08-time-reversal-unknown-quantum-state.html <comment><USER2> T-symmetry [https://en.wikipedia.org/wiki/T-symmetry](https://en.wikipedia.org/wiki/T-symmetry) > See also links to "reversible computing" but not the "time reversal" disambiguation page?

<comment><USER3> The "teeter-totter" thought experiment on that page is interesting to me in that it seems to illustrate how the future has more possibilities than the past. But it also occurs to me that the future possibilities are fractal with the past - ie. the toy could fall onto one of many other lower pedestals, teetering as it was before. In this way the "many arbitrary" possibilities could be perceived as anything but.

<comment><USER2> Could there be multiple "collapsed" paths which consistently converge at the current or future measured state?

</comment></comment></comment><comment><USER4> [http://blog.rongarret.info/2014/10/parallel-universes-and- ar...](http://blog.rongarret.info/2014/10/parallel-universes-and-arrow-of- time.html)

<comment><USER5> > The punch line is this: the statement that we can't time-travel into the > past is exactly the same as the statement that we can only remember the > past.

Note that the author's definition of "time travel" is a very specific one which, e.g., has nothing to do with the way time travel is defined in General Relativity.

</comment></comment><comment><USER6> The last line: "This procedure is to be implemented on the emergent quantum computers with the on-demand thermalizable qubits."

As someone with more familiarity with quantum computer science than its implementation via "computers," I ask: is it feasible to instantaneously swap states as described on any near-term quantum computers? Of course, ignoring the issue of needing sufficiently many ancilla to render the reversal accurate.

It certainly appears to be a novel theoretical result, but I question its practicality. The title was kind of click-bait lol

</comment><comment><USER7> Quantum debugger?</comment>


Are You Maximizing Your Product Blog?  - <AUTHOR> http://www.centernetworks.com/startup-blogs <comment><USER2> Link temporarily broken, but you can read it at <http://www.centernetworks.com/></comment>


React State Management – The Museum - <AUTHOR> https://hackernoon.com/the-react-state-museum-a278c726315 <comment><USER2> The Museum is the jewel of any society where one can observe and see the history on a single platform. I have visited thousands of museums worldwide and they have really impressed me. [https://www.assignmentland.com/](https://www.assignmentland.com/)

</comment><comment><USER3> I am not super familiar with React, are these good practices I ask because the term "museum" makes me think of old or outdated. I am interested in learning but don't want to start with legacy.

<comment><USER4> If you're just starting out, I highly recommend checking out Wes Bos's React tutorial series. He's refreshed the contents of many of them to remain current with the evolving changes of React:

[https://wesbos.com/](https://wesbos.com/)

</comment></comment><comment><USER5> Very well written, very good illustrations too. A very good museum indeed.</comment>


Musk: Tesla Full Self-Driving is going to have 'quantum leap' with new rewrite - <AUTHOR> https://electrek.co/2020/08/14/elon-musk-tesla-full-self-driving-quantum-leap-new-rewrite/ <comment><USER2> I find it interesting that people equate/equated Elon Musk with Tony Stark. Years in the future, I think there's a good chance people will look back and instead recognize him as an incredibly talented salesperson.

<comment><USER3> I find it interesting how polarizing he is to many people. Why is it hard to accept he has many flaws and strong suits?

<comment><USER4> Years ago when he acquired a cult of personality and could do no wrong, I knew it was going to swing the other way.

I never subscribed to either view. He's a brilliant engineer and a talented businessman with some apparently significant personality flaws or emotional regulation issues. In other words he's human.

<comment><USER5> The problem with alot of people isn't the emotional regulation; it's the way he runs his businesses. He embraces a fake-it-till-you make it mindset to a huge degree. He's done so many things that are either fraud, near-fraud, or completely dishonest that it makes it impossible to support someone like that in his position.

</comment></comment></comment></comment><comment><USER6> Musk makes me nervous that he and his team are going to push too far and too fast with putting self-driving in the hands of real users and the ensuing disaster/public outcry is going to be cataclysmic to the self-driving field. The whole "automatically have your car come to where you are in the parking lot" was a great example of an obvious disaster in the making that they made public anyway. I hope I'm wrong.

<comment><USER7> While the potential excites me (self-driving cars can't come fast enough IMHO - I despise driving) I agree.

Tesla has been given an incredibly _long rope_ by regulators and it'll just take a really terrible accident or two to bring it all to a screeching halt.

It's hard to imagine Elon _not_ realizing this, but the incessant drive to the endgame may cloud his judgement.

<comment><USER8> ~33k people a year (About 90 per day) die in car accidents in the US because of humans. It's us who have been given the long rope

There have been _four_ deaths while Autopilot was engaged [1], almost all because the drivers weren't paying attention. Autopilot has been used for 3 billion miles, 1 billion with Navigate on Autopilot (automatic passing and interchange routing), and 200,000 automated lane changes [2]. Is this not impressive?

Yes, self driving is hard. Yes, there will be fatalities due to edge cases. It is unreasonable to confine the tech to a test track until it's perfect, considering the human incurred death rate as it stands. We should be racing to take the person out of the driver's seat.

[1] [https://en.wikipedia.org/wiki/List_of_self- driving_car_fatal...](https://en.wikipedia.org/wiki/List_of_self- driving_car_fatalities)

[2] [https://electrek.co/2020/04/22/tesla-autopilot- data-3-billio...](https://electrek.co/2020/04/22/tesla-autopilot- data-3-billion-miles/)

<comment><USER9> The stats you give for human-driven deaths are for all conditions and all roads. Autopilot does not work in all conditions and all roads, so it's not really a fair comparison.

Further to that, human deaths will be skewed towards drunk drivers and other "bad" drivers. Autopilot deaths will be "random", so public perception will be worse even if the figures were exactly the same.

The other problem is complacency - the Apple software engineer had 2 seconds from his Tesla leaving the road to it hitting the gore point - and this was a bug he was aware of. If the car looks like it's 100% infallible then peoples attention will naturally waver. How long does it take to react to a situation? Feel the weight of the steering again? Calculate the appropriate correction?

I think the system that replaces human drivers has to be 100 times better in terms of fatalities in order to be accepted by society.

<comment><USER10> Although I am concerned about safety and deeply skeptical of the Tesla self- driving claims, if the stats GP presented are to be believed at face value then a lot of your points are irrelevant. While society may not accept self driving until it is 100x safer it would be to their own deadly detriment... human beings are extremely bad at rationally managing risk.

</comment></comment></comment></comment></comment><comment><USER11> > Almost at zero interventions

"Almost" doing a lot of work here.

<comment><USER12> Plus, it seems like the fewer interventions are needed without being zero, the more dangerous the system might be. I can see being lulled into a false sense of security if you have to do nothing most of the time - it's the times you need to do something (especially quickly) that you won't be paying attention and you end up under the semi or in the barrier.

Exciting, but literally "bleeding edge" stuff here.

<comment><USER13> This is why I think Waymo got it right that they were never going to market with level 3 self driving. You can't reasonably expect people to pay attention all the time when it works on its own 99.7% of the time.

</comment></comment></comment><comment><USER14> What is the legality of using an alpha quality build of autonomous driving software on a public road? The other drivers on the road obviously haven't given their consent.

If I could prove I was on the road when he was and he passed me while his alpha software was running could I get a lawyer and sue?

<comment><USER13> IANAL, but I don't see how you would have standing to sue if he simply passed you on the road. If he crashed into you, sure.

</comment></comment><comment><USER15> Quantum leap straight into the side of a firetruck.

<comment><USER16> The Sinclair QL was the first thing I thought of.

</comment></comment><comment><USER17> > "The Full Self-Driving improvement will come as a quantum leap, because it's > a fundamental architectural rewrite, not an incremental tweak. I drive the > bleeding edge alpha build in my car personally. Almost at zero interventions > between home & work. Limited public release in 6 to 10 weeks."

<comment><USER18> >Limited public release in 6 to 10 weeks

The degree to which he is willing to let the public test this software is disturbing. Sure, on the highway it may be safer than the average human. But going from any sort of alpha to a public release in 6-10 weeks on something this dangerous is nothing short of insane.

<comment><USER19> Why? It seems that number of miles, not time alone, should dictate when it is released.

</comment></comment></comment><comment><USER20> i dont know the legal barriers or if some one tried it before, but self driving cars should train their model in Indian traffic with a human supervision , the traffic is very unpredictable and mostly experienced humans who have driven there long has nailed how to drive there, it will give some interesting data points

</comment><comment><USER21> So, the smallest measurable change?

</comment><comment><USER22> Note to Tesla board: Your CEO stopped taking his meds again. Time to change the password on his Twitter account.</comment>


You know what's cool? A billion hours - <AUTHOR> https://youtube.googleblog.com/2017/02/you-know-whats-cool-billion-hours.html <comment><USER2> The best part of this post is the links to some awesome videos, like this one: [https://www.youtube.com/watch?v=RTn77uCYU_8](https://www.youtube.com/watch?v=RTn77uCYU_8)</comment>


Ask HN: Reduced salary during the first 3 months of work? - <AUTHOR>

I'm about to graduate from university and I've been offered a job at a small startup.  They're offering me a little less than half of what I expected to earn, with an agreement that 3 months from now we'll negotiate a proper salary based on my performance.<p>Is this common practice? I feel that the reduced pay will cause lower job satisfaction, and the uncertainty of my future salary unnecessary pressure and stress. What do you think? <comment><USER2> Been there, done that. Do not get into this unless you are comfortable that:

1\. There is an objective way to measure your performance

2\. That way does not depend on any team level/company level objectives like finalizing a business model, completing a prototype, making a sale, getting funded - as a fresh grad, you will have little to no impact on any of these, and so you should neither be rewarded nor penalized for these

3\. The current finances and burn rate of the startup makes you feel comfortable that the company will have the money to make the upgrade without hitch.

4a. You have absolute trust in the founders that they will stick to their word

4b. get the criteria in a contract

on second thoughts, if 4a is not true, you shouldn't join the startup anyway - startups have a lot more dependent on the founders being moral rather than a large company where everything is process driven.

Also, if you have to go the 4b route, you will potentially leave them with ill feeling towards you ('this guy doesn't even trust us'). Meaning you wouldn't/shouldn't get hired.

</comment><comment><USER3> Is there _any_ upside to you in this? Seriously.

Three months from now, you'll have a "negotiation" where you've already compromised your perceived value (they've already had the milk for free, how much could the cow possibly be worth), and the BATNA on the negotiation is your pick of grossly underpaid or unemployed.

This is not common practice among organizations which do not exploit their employees. You can do better than this job.

</comment><comment><USER4> Don't do it. Less than half is a more than a reduced salary. That's a major cut. After 3 months do you get any compensation for the first 3 months of reduced pay?

Even in tough economic times like now, I would not take the offer unless I had nothing else. Its hard enough to work at a startup without this added stress.

I believe that employees are absolutely critical to the success of a start up and I can't image that this start up is going to attract the best and brightest to work there with this attitude. I suspect that no matter how you perform, after 3 months, they will try to keep you salary low because they have already undervalued your contribution in the first 3 months.

What we do is to offer a short term contract during which we pay them normal contract rates, but we have the option of not hiring them at the end of the contract. No matter what they get paid for their work and if we like them, we bring them on at above industry average rates.

</comment><comment><USER5> What is half of what you're expected to earn? Have you asked what range would be 'proper salary based on performance'? Are they doing things that you are interested in? Will you acquire new skills that will be useful in your career?

If you are considering this offer, can we assume that there are few offers at this moment? Depending on your situation/skills/experience, maybe it might be worth giving it a try. 3 months isn't a long time.

<comment><USER6> > What is half of what you're expected to earn?

That's my question precisely. Maybe your expectations are out of line with reality? The programmers I used to manage overseas certainly had this problem. Nearly all of them fresh out of college expected the same salaries as those with 5+ years of real work experience. Graduating from college into the real world is a shocking "reality check" for some students.

<comment><AUTHOR> They offered 1200 BRL/month (about 10K USD/year). A junior engineer is supposed to make at least twice as much over here[1].

They work for foreign clients, and I do have experience with the job (through oDesk/Elance/RAC). I've also published a couple of papers and won several programming contests (I got to the ACM ICPC world finals once). I believe I deserve more.

[1] <http://info.abril.com.br/carreira/salarios.shl>

</comment></comment></comment><comment><USER7> I have done this in the past. The reason behind it was to 'help' the company pay less to the recruitment agent and three months later I was to be compensated for the loss of income.

I agreed at the time and yes I was compensated three months later. The issue though was that the company I was working at the time was solid with a lot of capital, so I was not worried that much for not getting paid.

In my view you will have to have a bit of faith in people but you must also do your homework. If the startup is not going to exist in 6 months then don't even bother.

Gather all the evidence you can gather about the job and present that data to your friends/family and ask them their opinion. A fresh perspective can help you a lot.

What is a common practice is for organizations to try and get things for free from the employees. In other words as patio11 pointed out 'exploitation'.

I hope the above helps :)

</comment><comment><USER8> Run away but punish them when doing so. Tell them you are very excited to join them but negotiate a later start date. 2 days before your start day drop and e-mail and say you'll need another week or something. And on the day you are supposed to start tell them you had a better offer and you'll not be taking their job. Waste their time as much as you can and leave them out in the cold. They are out to exploit inexperienced people, give them a taste of their own medicine.

<comment><USER6> I hope you don't do this, it just drags you down to an unethical level because you "think" they shouldn't pay you half what you expect to earn.

Are you actually worth what you expect to earn? Does the company have a valid reason for offering you less than what you expect? I think these are the questions you should be asking.

I ran an offshore outsourcing company for nearly a decade, and I can tell you something from that experience. The vast majority of applicants were not worth half what they expected. They seem to have come from an environment where they expected to graduate from college and immediately jump into the real world of programming at ridiculous salaries -- simply because they had graduated from college.

The reality was that they had learned a smattering of different languages but they were not proficient in one, so they were little more than "on the job trainees" to me, and in this situation they were lucky that I paid them half of what they "expected".

The bottom line here is that they had ridiculously unrealistic expectations, and they were disappointed to learn their true value in the real world.

It was an eye opening experience for most of them when I wouldn't even consider hiring them because of their lack of capabilities and their failure to perform simple programming tests without books and online references in front of them the whole time.

I'm not suggesting that you're worth less than what you expect, all I'm saying is that in my hiring experience many of my former programming applicants have failed to demonstrate that they are worth their perceived values.

<comment><USER8> Unethical? Get yourself a dictionary. While you look up that word, also look up the words probationary and period if you are in Europe and employment, at and will if in US.</comment></comment></comment>


Looking for beta testers of a gaming platform - <AUTHOR> https://clinela.com/ <comment><AUTHOR> Please test our gaming platform where gamers can create tournaments and invite their friends to join for real-world or online tournaments email@example.com

<comment><USER2> > Host games and invite freinds to play with you.

You have a typo on your website</comment></comment>


Heron: Realtime, distributed, fault-tolerant stream processing engine - <AUTHOR> https://apache.github.io/incubator-heron/ <comment><USER2> So, does anyone here use Heron? Or decided not to use it? Why are there so many stream proceeding engines?? (No disrespect to the project, I'm sure there is good reasoning here I'm just not aware of it.)</comment>


Square: All Hype and Little Value for Small Business - <AUTHOR> http://transfs.com/blog/2010/02/24/square-all-hype-and-little-value-for-small-business/ <comment><USER2> Square isn't about value. It's about trying to monetize off of the hype expected around any startup from a twitter founder.</comment>


Samsung all set to beat Apple with Retina-Resolution Tablet in Feb'12[Exclusive] - <AUTHOR> http://zuvvu.com/article.php?id=819f46e52c25763a55cc642422644317

<comment><USER2> Lots of rumor in that article, but it should easily be possible. Samsung can launch with an item that can only be produced in small quantities. Apple can't go iPad retina display until they can produced in huge quantities.

There was a similar effect during the Macintosh clone period. As Motorola would tick out faster processors, the cloners would launch as soon as they could get silicon, meanwhile Apple had to wait until they could get enough processors stockpiled and the Motorola's production rate up enough to support a new Apple model. It created a market where the cloners were perceived as the higher performance machines and Apple was always late to the party.

<comment><AUTHOR> jws : Your point about Samsung's ability (or rather say safe play) to produce & launch in small quantities is absolutely spot on. That's what makes me (personally) very bullish about Samsung's future prospects in Tab market.

</comment></comment><comment><USER3> Why do I doubt Samsung's ability to pull that off?

<comment><USER4> There's doesn't seem to be a reason to doubt it to me. Samsung has emerged as a top-tier player in the mobile and consumer electronic world.

<comment><USER5> Apple has been producing retina displays for their phones for almost 2 years now. And they are able to produce them in large quantities.

Meanwhile, if we consider SUB-pixel density and not just pixel density (because creating that many elements and maintaining quality is going to be hard) then it is not clear that anyone else has the ability to even manufacture a similar screen at any sort of commercial level.

<comment><USER6> LG makes the iPhone 4 screen, not Apple.

</comment></comment></comment></comment><comment><USER7> Be great if this was true. Hope it doesn't have a 2-hour battery life though.

<comment><AUTHOR> Yea..b8ry has always been an issue. But I hope, samsung will definitely be working on this issue. Lets just hope that Samsung make this thing true.</comment></comment>


Xobni - a waste of money - <AUTHOR> http://greatapps.blogspot.com/2008/04/xobni-what-waste-of-money.html Gee, and people wonder why UK startups hate the VCs over there. <comment><USER2> I tend to agree. It was worth having a go at buying the company, but now they've been rebuffed their next best option is simply to clone the interesting bits in house.

It'll take them six months to produce a reasonable facsimile , but then they probably don't have another feature release planned for that amount of time anyway.

Personally, I think the Xobni guys are fools for refusing the offer. If Microsoft are interested in acquiring the technology, then they're almost certainly going to become a competitor now the offer is refused. They could do far worse than selling out for 20 odd million in cash and stock, spending a couple of years working for Microsoft while their stock vests and then going on to the next big thing. Instead they've got themselves an uphill battle in which they are running very barely ahead of a corporate juggernaut.

Well whatever happens, it should be entertaining.

<comment><USER3> Yes they were foolish to turn down the offer, but competing against a culture as meeting-centric and slow as Microsoft's is less challenging than you might think, IMO.

(I can't believe they turned down the offer!)

<comment><USER4> There are a lot of factors to weight when considering a sale. It's not as simple as weighing the (rumored and potentially inaccurate) purchase price.

You can't say it was foolish unless you know everything--payment schedule (cash/stock/milestones), ambition of founders, post-acquisition employment requirements, future direction of the product.

<comment><USER5> not to mention that a sub $20M sale on $4.2M investment would not be seen favorably at all by the investors sitting on the board.

<comment><USER6> Right. I don't know what their premoney was, but it had to be in the 8-10 range I'd guess. VCs don't approve 2x returns.

</comment></comment></comment></comment></comment><comment><USER7> Dear All, as the originator of the blog post that has sparked this thread may I begin by apologising for my sloppy spelling errors on the post, which I've corrected and thanks for highlighting them. However, to correct some of the misunderstandings and prejudices of other contributors to this thread

\- I was testing the add-in using BUSINESS email and sadly have too many attachments on incoming emails from people who don't use online collaboration services.

\- I've never tended to use an email inbox to store documents, preferring windows file folders instead. Hence the attachments get saved off on receipt. Personally I always found Outlook quite flaky as a file storage system and would also hate to rely on remembering who sent which document.

\- I had to test Xobni on a family desktop as I've migrated away from Outlook for all my work activities and Xobni only works in Outlook. Why pay licence fees when you can use identical services online for free and access them from anywhere? Hence, I simply downloaded business emails onto the home machine to test over a couple of weeks.

\- Google desktop search is what I use to find anything on a PC, albeit most of my docs get stored in the "cloud" these days. Hence, Xobni "search", which is restricted to Outlook content, was superfluous.

\- As for the photo comments, sadly it's the face I was born with and the photo was taken by Ian Forrestor of BBC Backstage fame at the London BBC Backstage & Geek party in 2006. That my opinion is diminished coz you don't like my picture...........wow, tough crowd

\- Oddly enough, I was writing as a past Xobni user and of my experience of the product - my comments had nothing to do with being an investor.

\- I'm delighted that some people could derive use from this product. Evidently we have considerably different needs or have settled on alternate solutions.

<comment><USER8> I regret that you've had this experience here. For some of us, the success of startups is quite understandably an emotional issue, though that doesn't excuse bad behavior like insulting your photo.

For the most part though, we primarily value respectful rational discussion and I apologize again for catching some of us on a bad day.

<comment><USER9> Ditto.

One of the things I noticed at Startup School was that people were so busy talking about substance (hacking, business, etc.), that there was little time for fluff.

In any large group there are outliers. You found a few.

OTOH, I noticed you referred to us as "groupies" on your blog, but omitted that sentence in this reply. I'm guessing you knew it would be inflammatory here.

Nerds. Geeks. Weirdos. Bipolar obsessive compulsive basket cases. Fine.

But groupies? (Throws pocket protector at pg on stage.)

<comment><USER8> Yeah, I'm not a groupie. pg has said time and again how he doesn't want us to be groupies and I don't want to disappoint pg!

</comment></comment></comment></comment><comment><USER10> I didn't care about social aspect at all, there were two absolutely crucial features in Xobni that I absolutely loved:

1\. Ability to instantly see all attachments sent by a given person.

2\. Outlook's own search is unusable, I never mastered it, Xobni was a godsend.

Take any product: some people like it and some won't. I liked Xobni and this guy didn't. God knows why, perhaps he didn't have enough attachments or didn't bother to search anything because of his phenomenal memory or something :)))

<comment><USER11> I still use LookOut which solved the search issue 4+ years ago. Ironic that Microsoft should buy LookOut. Bury it. Then look at buying a company that solved the same problem again, even after not integrating the previous acquisition (which mind you was fast and never slowed down Outlook).

Unfortunately, I saw the attachment lookup as the only thing useful.

<comment><USER12> That was my first impression too. Xobni is LookOut, only more social. LookOut used Lucene to index the email's and allow flashing-fast searches. Too bad MS killed them.

<comment><USER11> Yeah, from what I understand it was buried to avoid competing with windows live desktop search.

</comment></comment></comment></comment><comment><USER13> I can just feel the angst and envy in this thread. Despite being a silly product, they still worked very hard on it and built up enough spin and hype to get it to that point. It brings up the argument that a startup can do any kind of shenanigans as their business, but with hard work, resourcefulness, determination, and perseverance, they can still be successful. Go read their blog from years ago when it was just a couple of guys driving out to the valley, all the way up till now with seven digit offers coming in.

Xobni will make off like bandits despite how "worthless" the product is. The next offer will be for way more than the original $20 million. I wish them the best of luck.

<comment><USER14> _The next offer will be for way more than the original $20 million._

You could be right. But when I saw that "20 million" I could hardly believe it. If I was a MSFT exec, I'd simply say, "we'll give you 1.5 million (or whatever), take it or leave it." If they left it, I'd have a couple interns replicate the thing.

</comment></comment><comment><USER15> Here's an example of how the context-freeness of the web can work against you. I've never seen this guy's blog before. The headline was just interesting enough to get above my click threshold. But when I got to the post, all I noticed was how badly written it is:

 _perhaps it was quickly than trying to replicate_

 _some Microsoft underlying thinks that they will make the old boss happy_

If I knew the writer to be a frequent source of good insights, this wouldn't have much effect. But I don't, so it does.

<comment><USER16> Dismissing comments because of spelling errors? Not sure where it would lie in PG's categories (ad hominen?), but anyway. I remember the other saying, that sometimes you can learn more from your enemies than from your friends, because they are more likely to tell you the truth. How many people here on HN will dare to criticize a YC startup?

Personally I don't need or use Xobni, so I can't comment. And anyway, I probably make a lot of spelling mistakes, too, because English is only my second language. So feel free to ignore my comments.

<comment><USER17> >> How many people here on HN will dare to criticize a YC startup?

You said it. Doing so is grounds for ruthless downmodding on here.

PG said there are 30 editors now. People are getting accounts marked dead at the drop of a hat, if they don't drink the kool-aid.

<comment><USER18> _People are getting accounts marked dead at the drop of a hat, if they don't drink the kool-aid._

That's false, as anyone can see by looking at the dead comments and submissions. There have always been people on here criticizing YC and YC- funded startups. And there have always been about 30 editors, for that matter.

<comment><USER19> "There have always been people on here criticizing YC and YC-funded startups"

And so there should be. Disagreeing on merits, and doing so in a good tone makes interesting conversation and broadens everyones minds. There's a lot of great disagreeing on YC news.

</comment></comment></comment></comment></comment><comment><USER20> So, someone that doesn't usually use Outlook doesn't like Xobni's Outlook plug-in? How is this newsworthy?

Many of the things he said he never did in Outlook were things I did when I used Outlook four dozen times a day. He could have saved time by writing "I am not in the target audience" and been done with it.

<comment><USER7> The observations I made about Xobni on my blog post were reflective of a) having formerly used Outlook for many years in large corporate settings b) my assessment of the functional usefulness of the add-in to me. I'm happy to hear about your personal experiences of the add-in in order to better understand the killer features/purposes I've apparently missed and the value it has given you.

<comment><USER21> this implies you consider the native Outlook search, message threading, and attachment handling better than Xobni's. i'd be surprised if you used Outlook for that long and really thought so.

</comment></comment></comment><comment><USER22> The only person I can think of who is a level above anybody else is Patrick Collison. Everyone else is just in the game, and that's the most important thing. It's easy to think, why the hell did a startup get funded? However, VC's have to invest--it's their job--because the money will be lost due to inflation. And they can't invest in one company, they have to diversify. So if a group of young people with a revenge of the nerds attitude and no other commitments are willing to move to California and work harder than anybody else, and in the software field, no less, then what other choice do VC's have than to invest?

Young people (less commitments, more optimism) make up a small portion of the population. Good programmers make up a small portion as well. Those willing to relocate (California), also. Those who are willing to dedicate themselves to doing a startup for multiple years, tiny. So when you find an individual who has all of these qualities, and as part of a bigger group, you're now talking a very tiny, tiny portion of the country. And VC's have no choice but to invest in you.

</comment><comment><USER23> I have not used Xobni myself, but I think if I have implemented a plug in for Outlook, offered $20M by Microsoft for it, I will take the money and run as fast as I can. Outlook is a Microsoft product, they have unlimited resources, they understand Outlook itself better than anyone outside. Hey this guys can replicate the plug in really fast time trust me. I'm a consultant and done stuff for them I know some of the people there; a bunch of really smarts hackers.

<comment><USER16> Plus, Microsoft is dead, and hence Outlook is dead, too.

</comment></comment><comment><USER24> This isn't actually a 'vc' in the UK who has any standing either

<comment><USER7> Sumon, thanks for your kind comment on my "standing". I look forward to seeing you again in London in person, perhaps at Open Coffee, and maybe we can compare our respective CVs. Meantime, perhaps you can elaborate on what relevance my employment has to my comments on my user experience of this Outlook add-in?

<comment><USER25> > I look forward to seeing you again in London in person,

> perhaps at Open Coffee, and maybe we can compare our

> respective CVs.

The CV of the commentator is irrelevant. He's not claiming to be more experienced/well known than you; he is claiming that you are not a well known UK VC.

</comment></comment></comment><comment><USER26> What relationships does Xobni uncover? How does it do it?

I was thinking to make a web app where people could upload their cell phone records and it would find relationships, but I'm not sure what to look for exactly. Any ideas?

<comment><USER11> I would start with very trusting people. The kind that would be gullible enough to upload their private phone records.

Seriously though. This is just like what Facebook tried to do with the purchase history thing last fall. It didn't go over too well. There's good reason that some things should never be made public.

The problem I see with the social networks is that in order for them to capture any truely valuable relationship data they have to tread on First Amendment rights. Google can luckily stay in the annonymous territory and reap the rewards. The social networks aren't going to be as lucky.</comment></comment>


E Online has left a Gist url on the top of their site - <AUTHOR> http://www.eonline.com/news/371827/newtown-school-shooting-jack-reacher-u-s-premiere-postponed-out-of-respect-for-victims

<comment><USER2> Ha, funny little mystery to solve.

It's added from [http://www.nbcudigitaladops.com/hosted/js/eonline_com_header...](http://www.nbcudigitaladops.com/hosted/js/eonline_com_header.js):

        //Site Pixel HEAD Script For:eonline.com
        //Krux Interchange - Krux KVs Written to AdTag UPDATED:2012-06-01 17:28:25
        document.write(unescape('%3Cscript%3E%28function%28%29%7Bvar%20kvs%20%3D%20window.Krux%20%3F%20window.Krux.dartKeyValues%20%3A%20%27%27%3Bif%28top.__nbcudigitaladops_inject%20%26%26%20top.__nbcudigitaladops_inject.dtprm%29%7Btop.__nbcudigitaladops_inject.dtprm%28kvs%29%3B%7D%7D%29%28%29%3B%3C%2Fscript%3E'));
        //FOR COMCAST: Krux Interchange - Krux Writes to Cookie UPDATED:2012-12-14 15:58:46
        document.write(unescape('https%3A%2F%2Fgist.github.com%2F9cf2d06784a93f1975cb'));
        //Default Pixel - Header (Do Not Delete) UPDATED:2012-02-28 16:35:47
        document.write(unescape('%3Cscript%3E%3C%2Fscript%3E'));

which is, in turn, inserted into the document by <http://www.nbcudigitaladops.com/hosted/global_header.js>; excerpt:

        ...
        document.write('<scr'+'ipt src="//www.nbcudigitaladops.com/hosted/js/'+site+'_header.js"></scr'+'ipt>');
        ...

It looks like the idea here was to include the raw gist in a <script> tag, but that didn't quite happen. Both the gist and the JS file that inserts it include references to Krux, possibly <http://www.krux.com/>, a "cloud-based data management platform".

<comment><USER3> No possibly about it. The gist owner (<https://github.com/dbrans>) belongs to the krux organization (<https://github.com/krux>).

</comment></comment><comment><USER4> Screenshot (for after they've removed it):

<http://imgur.com/rxIhL>

<comment><USER5> It has been more than 2 hours and I can still see it live. Strange that such a large website could overlook this for so long.

<comment><USER6> This is why code changes should not be moved to production late on Friday. Staff go home and problems don't get noticed or fixed in a timely fashion.

</comment></comment></comment><comment><USER7> This same gist is on the Fandango website as of now. Some kind of library issue maybe? <https://www.fandango.com/>

<comment><USER8> Keep in mind, Fandango and E! are both properties of Comcast. That they would share code isn't so surprising.

</comment></comment><comment><USER9> The offending JS files:

[http://www.nbcudigitaladops.com/hosted/js/eonline_com_header...](http://www.nbcudigitaladops.com/hosted/js/eonline_com_header.js)

[https://www.nbcudigitaladops.com/hosted/js/fandango_com_head...](https://www.nbcudigitaladops.com/hosted/js/fandango_com_header.js)

Which contain this:

//FOR COMCAST: Krux Interchange - Krux Writes to Cookie UPDATED:2012-12-14 15:58:46

document.write(unescape('https%3A%2F%2Fgist.github.com%2F9cf2d06784a93f1975cb'));

No doubt someone will be working to update it again either tonight or tomorrow.

</comment><comment><USER10> I'm a Krux employee. Just before midnight PST, after friends noticed this post on hacker news, we got to work and resolved the problem.

Thanks a ton for all the eyes out there that helped us find this one. It's great when the community has your back.

Proof one more time of the dangers of making production changes on a Friday afternoon, and that there's no substitute for manual monitoring of a site.

Derek Brans Technology Krux

</comment><comment><USER11> The gist in question: <https://gist.github.com/9cf2d06784a93f1975cb>

</comment><comment><USER12> That's an interesting copy-paste fail. I wonder what their development process is that someone managed to edit the template on production with presumably no testing.

</comment><comment><AUTHOR> As of 12:47 AM PST it looks like they fixed the issue. If their devs are on the East Coast, I feel bad for the poor guy who got that call.</comment>


Now is the time to patch those unpatched DNS servers. Details have leaked. - <AUTHOR> http://security4all.blogspot.com/2008/07/now-is-time-to-patch-those-unpatched.html

<comment><AUTHOR> Test your ISP / DNS server with this command:

        dig +short porttest.dns-oarc.net TXT

If you see "from 1 ports" it's unpatched and you should switch to OpenDNS immediately. If it says "from 26 ports" (approximately) you're fine.

<comment><USER2> I'm seeing

"x.x.x.x is POOR: 26 queries in 2.1 seconds from 24 ports with std dev 135.99"

Is this good or bad?

<comment><AUTHOR> I think that's fine, as long as it's not "1 ports".

The idea is that the patches randomize the source port, which the attacker won't know, so you'll ignore any responses that don't match. (it's still _possible_ to guess the correct port number, but much much harder)

If you get "1 ports" for 26 queries then it's always using the same port (bad!), but if you get somewhere around 26 ports for 26 queries then it's using random ports (since it's random it won't always be 26 distinct ports, which is why it sometimes shows 24 or 25)

I'm no expert but this is what I understand of it. tptacek, feel free to explain it better (just kidding!)

</comment></comment></comment><comment> patrickg-zill Most Linux distributions, and Blastwave.org packages for Solaris, have already been updated, so "yum update", "apt-get update; apt-get upgrade" or the equivalent for your system followed by restarting the DNS server should fix it.

</comment><comment><USER3> _"... So what happened? Matasano had an article ready with some more details on the DNS vulnerability for after Blackhat and posted it in error. They removed it as soon as they noticed it. ..."_

Hey tptacek ~ <http://news.ycombinator.com/user?id=tptacek> hangs around HN whats the beef Thomas?

<comment><USER4> Today is not an awesome day.

<comment><USER5> Don't sweat it too much... we all make mistakes. What matters isn't if you make them or not, but how you respond when you do - and so far, you seem to have done great :)

</comment></comment></comment><comment><USER6> This is why coordinated advisories are generally kept to as small a group as possible. It's one thing to trust that people won't leak things deliberately -- it's quite another to trust that mistakes won't happen.

With all due respect, this isn't Thomas's fault -- it's Dan's fault for telling more people what was going on than was absolutely necessary.

<comment><USER4> Thank you, Colin, but this is entirely my fault. People need to be able to tell us things and trust that they won't hit Slashdot. We made a terrible error in judgement, and we deserve the hits.

<comment><USER6> _People need to be able to tell us things_

Why? I'm sure that telling you all the details was the easiest way for Dan to convince you that this issue was real -- but there are other approaches he could have taken... starting with "look, ISC and $LONGLISTOFVENDORS have issued security advisories, and they're not idiots".

It seems to me that what happened is that Dan's ego was stung by having you publicly mock his work, and he didn't stop to think about how the situation could best be handled. And really, that sort of thin skin is unforgivable in this business.

<comment><USER4> I wrote something here but for once I think I'm just going to shut up about something.

</comment></comment></comment></comment><comment><USER7> Nevermind -- I understand the severity of it now. Seems like a novel angle to an old problem .. collidable QID's used to verify sender.

</comment><comment><USER8> Is there anybody who couldn't guess the vulnerability from the first announcement and the test webpage?

</comment><comment><USER9> Why is it so very bad that this leaked?

<comment><USER10> It's as bad as a dramatic event happening in a cheap soap opera; which, for that matters, perfectly describes what this so-called computer security industry actually is.

Some of those guys are very brilliant engineers indeed, but at some point they should realize that there are a lot of brilliant engineers building bridges, cars and stuff as well, and they usually have much less inflated egos.</comment></comment>


Why are there so many Quora haters? - <AUTHOR>

Maybe im just reading into it but I sense a very negative vibe to Quora on HN. I've certainly seen worse startup ideas. What gives? <comment><USER2> I think the main reason is the general feeling that Quora is being hyped into unexplainable proportions.

<comment><USER3> That's a big part of it for me. Nobody seems to be able to explain what makes Quora new and different, or why I should care about it at all, and yet articles about it keep on coming up as though the site is self-evidently a big deal.

It makes me wonder whether the people who enthuse about Quora have ever heard of a question-answer site before; maybe they don't know how to explain what makes it interesting because they don't realize this is already a well- established format.

There's also the fact that there does not appear to be any way to browse the site to find out what it's about - the front page is a completely off-putting sign-up form.

<comment><USER4> You're right, Q&A sites have been around for a while. Was Quora the first one to get the community aspects right? No they weren't. StackOverflow figured that out first. What Quora accomplished that was a really really hard problem was how to make the social aspect work across all subject areas while at the same time getting area to stay on topic. That's impressive. The only reason I can imagine someone not finding that impressive would be because they've never tried to manage and build a community.

<comment><USER5> If it can still stay on topic when it becomes mainstream then people might be impressed.

I don't like the social aspect to it actually so I don't think I will ever use it. I much prefer how stackexchange works.

</comment></comment></comment></comment><comment><USER6> Here are some common reasons people don't like Quora:

1\. They don't like all the (perceived) hype, especially when they see it on TechCrunch.

2\. They don't like the rules. Quora definitely challenges the rules of how we interact online, and who is an expert, and that scares people.

3\. They think it's just another "Q&A website" and why would we need another one like that?

4\. They don't trust mechanisms around voting and the use of anonymity to troll?

5\. They don't like that its founders were able to raise Series A money at such an attractive valuation.

6\. They don't like the sites plan to boost signal over noise as the user base grows, which includes vigilance among community members and ranking users.

I am a heavy Quora user and biased toward the site. I understand why some of these items above irk people, but I also believe that most of them, upon investigation, turn out to be mostly unfounded. Briefly -> TechCrunch and other tech outlets are in the business of writing about new technologies and trends, even if vocal parts of their audience hates it. The rules around Quora scares many people who already have carved out little pieces of land online, especially "experts." One of the biggest fallacies around Quora is that it's a "Q&A site" -- that is just the tip of the iceberg. I'll admit that there are ways to lurk anonymously on Twitter, but I'm pretty sure that people behind the scenes monitor for unsavory behavior and vandalism, and that those in charge would and will ban users for foul play. The Series A valuation now seems like a bargain, but what many don't realize is that the technology built under the hood at Quora is itself unique and very valuable, as well as the team and SEO juice. Finally, their most complex UX problem -- keeping signal high using humans and algorithms -- is a challenge that not many teams can tackle.

</comment><comment><USER7> Personally, its because of the arrogance they have with they way they did their UX implementation -- to the point that any criticism of it is brushed off as though the comments are made by morons who don't understand the vision.

Further, the tidbits of information on the site are captured and displayed in a way that makes it very unruly to manage if you want to know a lot about any given topic.

You have a TOPIC - which is effectively a big ass bucket to throw everything. They try to oversimplify data classification making it seem as though tagging etc is too complex. I am not saying that it is an easy problem - I am saying that there is not the deep level of experience being brought to the table to solve these issues.

I do feel that there is a hell of a lot of Facebook Alumn echo-chamber cock- sucking that occurs in the valley. Quora falls square into this area.

Sure, Facebook is an amazing success - but to say, categorically, that all of the alumn who came from facebook out of college - and have that as their _only_ experience ever are going to have messianic vision to every other aspect of online experience is just plain stupid.

Everyone has had the co-worker who's only frame of reference to anything is "their last company" -- and even if your last company is big, and successful - its still just one data-point.</comment>


Nuclio: Serverless for Real-Time and Data-Driven Applications - <AUTHOR> https://nuclio.io/ <comment><USER2> Slightly OT, but I find it interesting how the definition of real-time depends on the industry:

* Embedded systems: nanoseconds to milliseconds (depends on the system, but at the very least needs to be predictable within some bounds);

* Application software (including web): tens to hundreds of milliseconds;

* TV broadcasting: seconds to minutes;

I'd love to hear more examples from different industries!

<comment><USER3> Traditionally, "realtime" means you can tell, in terms of actual wall clock time, how long different operations will take. Tends to show up in embedded systems because they tend to control devices in which fixed deadlines matter.

Somehow it morphed into a shorthand for "fast".

<comment><USER4> Yup, realtime was always predictable(ex. 16.666ms for 60fps). Time unit largely doesn't matter.

Generally precludes GC(yes there are edge cases where you can shoehorn GC in, I don't care about them since malloc is usually out of bounds as well).

</comment></comment></comment><comment><USER5> > nuclio is an open source serverless platform which is faster than bare-metal > code

WTF? Can somebody explain to me what they are trying to convey here?

<comment><USER6> nuclio is using a real-time arch (no context switch, zero copy, no Ser/Des, parallelism, .. ) Go function serves 400K events/sec/proc, Py does 70K events/sec/proc, this is faster than running your own function with standard HTTP serving on a bare-metal server.

for comparison most serverless frameworks do 1-5k events/sec and up to 100x higher latency.

disclosure: i work on nuclio

<comment><USER5> My point is that - as described - it is a dumb comparison.

> open source serverless platform which is faster than bare-metal code

does't make sense. It eventually has to run on top of bare metal (via hypervisor or directly), so claiming that something that eventually runs on top of bare metal is "faster than bare metal" doesn't make sense _at all_.

</comment></comment></comment><comment><USER7> Python and "real time"? Tensorflow as an example in the image/example?

Needs more buzzwords, for sure. Developers need to spend more time understanding "real-time" as well.

</comment><comment><USER8> Clearly this needs blockchain in the title, it's not meaningless buzzword dense enough otherwise.

</comment><comment><USER9> I had to look up "Serverless", especially after it says "here is how to start our docker app".

I might be old by now, but serverless feels like renting a sublet place per hour. I guess it was only going to happen, after we went from 1 server to many instances to unmanageable mess: "aaeaeh let it be someone else's mess! Take my money!"

<comment><USER10> "Let it be someone else's mess, take my money," is the basis of most businesses. That's why I don't grow my own food, and I often don't make it.

</comment></comment><comment><USER11> I think I'm following along with this and it looks pretty cool.

Is there management for handling things with a slow startup time?

I've got a few things that have startup times in the region of 30s+ but then each thing to process takes very little time.

I found this, which I think is relevant: [https://github.com/nuclio/nuclio/blob/master/hack/examples/p...](https://github.com/nuclio/nuclio/blob/master/hack/examples/python/tensorflow/tensor.py)

Are there some pitfalls about this to be wary about / known bad edge cases?

</comment><comment><USER12> What is the median latency in milliseconds?

<comment><USER13> this is what I'm curious about, serverless automatically makes me think of cold startup time.

<comment><USER3> Some poking around suggests that currently they scale to a single copy, so for sporadic workloads latency will be good (relative to normal latency for warm code).

Based on the roadmap in the repo[0] (under "In Design").

Disclosure: I also work on a FaaS project, Project Riff.

[0] [https://github.com/nuclio/nuclio/blob/master/ROADMAP.md](https://github.com/nuclio/nuclio/blob/master/ROADMAP.md)

<comment><USER6> nuclio auto-scale today (use k8s HPA), the roadmap item is to scale-down to zero (today holds one instance when idle and will soon be able to shut it down when idle).

nuclio latency is as low as 30 microsec in Py & Go vs 10s of milisec in Lambda

<comment><USER3> Warm vs cold start is not a very meaningful comparison, though. Lambda typically scales from zero. Any warm system is going to greatly outperform a cold one. Java on Lambda can vary from nanoseconds to seconds, depending on whether you hit a warm copy or a cold start.

Disclosure: I work on a different FaaS, Project Riff.

<comment><USER6> I benchmarked all the frameworks in cold & warm, Warm is also very slow, no concurrency etc'. how many events/sec can u do with a warm Riff instance e.g. in Go & Py? whats the latency?

<comment><USER3> Let me put it another way: are you saying you have no cold-start penalty?

Edit: and to answer your question -- no, I have not personally benchmarked it. Can you point me to your suite? I've been thinking it would be useful to work on a benchmark that different implementations can share to catch regressions (and earn bragging rights, of course).

<comment><USER6> Great idea, we suggested to create an open benchmark at CNCF, a bunch of members opposed, we can come with a joint proposal. You can use our test tool [https://github.com/v3io/http_blaster](https://github.com/v3io/http_blaster), it can generate a workload of > 600K http req/sec with one client and is programable.

<comment><USER3> Do you have a link to the benchmarking discussion? I'd be interested to see what the objections were.

I raised the topic today in a team meeting and I'll probably get to tinker over the next few weeks. I'm interested in exploring a few different axes of stress. RPS is one, but also things like "how does it behave with ten thousand functions installed?", "how does it behave with traffic yo-yoing?" etc.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Well I think this is frickin awesome. Very Well Done!</comment>


Ask HN: Have you ever rejected a project based on programming language? - <AUTHOR>

<comment><USER2> Yes, PHP.

Not much to say about it. I simply do not enjoy working with the language. It feels icky to me, and I think PHP makes it exceptionally difficult to write good code. To this day I don't know what good PHP code looks like - often what people consider good PHP code looks just like Java, in which case I'd rather skip the PHP and write Java.

There are so many well designed languages out there. I just don't see the point in using PHP for anything complex.

<comment><USER3> i second this. i started rejecting offers from companies that are using php, two years ago. companies using php (in turkey) have high turnover rates which means they have crippled products. i don't want to deal with a company like that and a product like that.

</comment></comment><comment><USER4> Yes. I reject all projects based on PHP. At least for the past 5 years anyway. Reason: PHP is a pretty bad programming language and a lot of things don't work as advertised (at least the last time I looked)

I shy away from Python too, but that's because I don't like the idea of white space being syntax. The language seems reasonably sane, apart from maybe the constructors which are a bit odd.

<comment><USER5> It's OK to don't like it. But how much you worked with Python? In any (not really, but nearly) language you have some syntax and some formatting. In Java or like you use tabs or spaces to align your lines anyway, right? I have same align for semantically same lines. Why just don't use this _natural_ alignment for syntax and throw brackets away? One more benefit: There are no discussions about how formatting brackets. Same line? With space before? Next line like in C? Next line with alignment?

<comment><USER4> Oh I get it.

I just have a problem with it. It's not rational:-)

</comment></comment></comment><comment><USER6> I'd be more likely to reject based on framework or lack there of. I don't reject PHP work flat-out per se, but it'll be a cold day in hell before I ever accept another Drupal gig. [shudders].

Also, test-coverage and documentation (or lack there of) can sway my opinion pretty heavily.

</comment><comment><USER5> Why not? If I don't like to eat fish I just don't eat fish.

Personally I think, there are tradeoffs. After many years of PHP, I'm happy to not code in PHP for last 4 years (except a cs project). But for example for a lot of money I would code in PHP again. Why not? I'm also reject non-compiled languages for backend in big projects.

</comment><comment><USER7> Yes. I refuse to work with codebases in dynamic typed languages - they're just too hard to read and get familiar with.

</comment><comment><USER8> I try hard to "learn the future and not the past" and to choose projects that will teach me useful new things. So I do tend to reject projects that use languages that seem to be in decline, or that would teach me bad habits (or just be depressing).

</comment><comment><USER9> I once got a .net role and then was told all the work was php. At that point i left, otherwise all projects i have ever met have had language chosen based on specialisms of colleagues which makes the question somewhat redundant. In what context would you ask this?

</comment><comment><USER10> After a terrible first experience I usually reject anything JSP related. Java is a great language but whoever decided to combine it with web servers created a monster. I actually really enjoy PHP and Ruby projects, even Python with a good framework.

<comment><USER11> Java isn't a great language, but on the server side it actually makes sense in a lot of environments. JSP is only tangentially related in that it compiles to Java.

</comment></comment><comment><USER12> Yes. Legacy ASP.Net webforms! the postback concept was alien to me, and the whole point of .NET trying to mimic javascript just felt strange.

</comment><comment><USER11> Sure, even languages I actually know. I don't understand why this question is even a question.</comment>


Krugman is wrong - Bitcoins not hoarded - Massive selloff - <AUTHOR> http://bitcoincharts.com/charts/mtgoxUSD#rg90zvztgSzm1g10zm2g25

<comment><USER2> I'm not sure this proves Krugman is wrong.

Sell-offs (especially large ones) don't indicate that hoarding hasn't taken place. In fact, if hoarding wasn't taking place I'd expect low variability in trading volume (since the currency would be used by a number of parties for small transactions). A large sell-off implies to me that a large amount of value has just transferred from one set of hoarders (investors?) to another. Either that, or someone just made a huge donation to WikiLeaks...

</comment><comment><USER3> A single large spike of stop-loss sales of a commoditiy that happens at the moment the commodity touches its previous three month low during a long downwards trend does not prove anything about the suitability of the commodity as a currency and is irrelevant to Krugman's argument. Without additional evidence that the exchanges are related to larger exchanges of bitcoin for goods and services, large sales on an exchange only show that would-be hoarders may be losing faith.

<comment><AUTHOR> It is not a single large sell. The graph I linked to shows that the massive sell-off has been going on for 4+ months at least. Look at the graph time axis.

</comment></comment><comment><USER4> Yeah, I think Krugman tried to mix-n-match the dynamics of most (inflationary) currencies with BTC which are designed to be deflationary. The supply of BTC will drop off predictably. It's the _predictability_ that makes a usable currency. For example, since everyone knows how the supply of BTC will change over time, people who are buying now can take the future value of BTC into consideration already.

</comment><comment><USER5> Look at the trade data, one person made a large selloff that triggered a cascade of automated responses. That, of course, could only happen if that person was hoarding BTC. Maybe he read that article and decided to cash out as a result.

</comment><comment><USER6> Whenever you think you're smarter then Krugman on economics take a step back, apply Occam's Razor and realize you're probably suffering from a cognitive bias.

Krugman's simply making a bigger and simpler observation: costs of stuff in bitcoin over time haven't just been slightly deflationary over time, they've been massively deflationary such that there is no incentive to ever use it for actually buying things. This is sufficient to reject it as a currency on the first pass without looking at anything else. Maybe it will stabilize at some point and at that point can be evaluated on other merits.

<comment><AUTHOR> I know Krugman is more knowledgeable that me. I am simply suggesting he was not given the right data, or he did not look at recent trends, before judging Bitcoin. The system may be deflationary by nature, but people are sure not treating it as is.

Or else you would not have seen the value drop from $32 to $4 in 4 months.</comment></comment>


Why every entrepreneur should take up boxing - <AUTHOR> http://swizec.com/blog/why-all-entrepreneurs-should-take-up-boxing/swizec/3646

<comment><USER2> Real sparring should complete the box training and your metaphor ;)</comment>


Let's Encrypt: an automated certificate authority to encrypt the entire web - <AUTHOR> https://blog.acolyer.org/2020/02/12/lets-encrypt-an-automated-certificate-authority-to-encrypt-the-entire-web/ <comment><USER2> It's still a pain in the ass to manage wildcard certificates with letsencrypt.

Especially when your DNS registrar does not support DNS changes via API.

And even _if_ the registrar supports it, you have to build and maintain the code that talks to the API. Yuck.

I wonder why they don't allow whover controls the domain name to use the domain/.well-known/acme-challenge to create wildcard certs that are valid for all subdomains of that domain.

<comment><USER3> My personal take on this is that with easy automation wildcard certificates simply shouldn't be used any more.

In the past one reason for wildcards was that it's too annoying to request certs for each subdomains. With automation this reason goes aways.

The other reason is that you can have "secret hostnames". But if your security relies on secret hostnames that's a bad idea to begin with. You still leak the hostnames to the DNS and as long as we don't have ubiquitous DoH+ESNI also to the network.

Wildcard certs on the other hand have certain risks. If you have a vulnerability in the TLS stack on subdomain1.example.org that may compromise the security of subdomain2.example.org if they share the same cert.

<comment><USER4> Wildcards have use cases. An example:

You have a .example-usercontent.com wildcard certificate for domains like user-1234.example-usercontent.com and you have millions of users. A wildcard certificate is appropriate because:

* LetsEncrypt rate limits are a thing

* The domains exist to leverage origin sandboxing in browsers, but are served by the same infrastructure. It's not more secure (but it is more complicated) to have more certificates here.

Generally, the assumption that two subdomains are served by independent infrastructure is often wrong. Think of things like blogger.com/blogspot.com. So the concern about compromising keys doesn't really apply.

</comment></comment></comment><comment><USER5> _Initially, ISRG was funded almost entirely through large donations from technology companies. In late 2014, it secured financial commitments from Akamai, Cisco, EFF, and Mozilla, allowing the organization to purchase equipment, secure hosting contracts, and pay initial staff. Today, ISRG has more diverse funding sources; in 2018 it received 83% of its funding from corporate sponsors, 14% from grants and major gifts, and 3% from individual giving._

<comment><USER6> This is good, because having something that owns ca. 60% of the SSL certificates on the internet supported by corporate largesse is not a good route forward. I'm glad that's shifting.

</comment></comment><comment><USER7> It's fantastic that Let's Encrypt made short(er)-lived certificates possible. With automation in place it doesn't matter if the cert lives a year or a week. Eventually it will get short enough that we won't have to bother with revocation lists, OCSP, etc.

<comment><USER8> In the medium term the intent here is Delegated Credentials. The TLS working group is putting the finishing touches on a mechanism which goes like this:

You still have TLS certificates like today, but the private key corresponding to the public key in that certificate lives on a dedicated machine that's not accessible to the outside world, rather than your web server.

This dedicated machine uses the private key to sign tiny messages which basically say "I, the owner of this TLS certificate you've seen, authorise this web server for a short period (say 24 hours) to prove its identity using a short-lived key which you can verify using public key P".

Then your web servers serve up the TLS cert (for which they don't know the private key) this short message with P in it, and proof they do know their short-lived private key which can be verified using P. Browsers check the certificate, the delegated credential message and so on and you've got all the same security but with much shorter lived credentials.

This way, when somebody finds a zero day in your tremendously complicated web site and uses it to steal the private key, that key is only valid for maximum 24 hours and so you can close their window of opportunity relatively swiftly if you're on top of it. Meanwhile the dedicated server for making the signed messages is not publicly accessible and can be simpler and thus more secure.

This isn't really a way forward for making toy web sites with 1000 visitors per day, but if you're building anything where you already have multiple servers possibly in different locations then it's more interesting.

</comment></comment><comment><USER9> I have deep concerns about the development to criminalize and ban non-https web sites from functioning in mainstream web browsers. Many flee to Letsencrypt certificates which have a short TTL frame.

What if Letsencrypt gets bought by Google / Microsoft and the free lunch is over? The end of the free web as we know it... ?

<comment><USER10> Lets hope that SSL certs will only be a temporary solution. Why can't we switch to a system that doesn't depend on central authority?

In the meantime, it would be nice for letsencrypt to pledge not to take big donations from corporates.

<comment><USER11> > pledge not to take big donations from corporates

You mean the people who actually benefit financially from the service? Look, I get the sentiment but this is a case where the incentives are remarkably aligned. Companies that derive real business value from the service foot the bill while the rest of the world gets free certs.

<comment><USER10> oops i mean big corporates, like, major companies throwing millions at them

</comment></comment></comment></comment><comment><USER12> I'm always annoyed by the fact that no spec exists for a `intermediate CA for a particular domain`. If it exists, multiple level wildcard pain disappears and Subject Alternative Names stuff is not needed.

<comment><USER13> X.509 Name Constraints extension is what you are looking for. They are VERY expensive when ordered from public CA, but we use them at work for internal PKI.

<comment><USER14> Do real world https clients actually verify the end entity certificate against the name constraints of all the certificates in the trust chain?

<comment><USER13> Yes, they are. The extension should be marked as critical, so if the client does not understand it it should error out. At least java, go, curl and all major browser support it.

</comment></comment></comment></comment><comment><USER15> There is an alternative ACME server implementation available from Buypass: [https://www.buypass.no/ssl/products/acme](https://www.buypass.no/ssl/products/acme). Haven't tried it personally, but they launched support for ACME v2 in late 2019.

</comment><comment><USER16> ACME wasn't the first attempt at automating certs. See Simple Certificate Enrollment Protocol (draft) and Enrollment over Secure Transport (RFC 7030):

* [https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_...](https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol)

* [https://en.wikipedia.org/wiki/Enrollment_over_Secure_Transpo...](https://en.wikipedia.org/wiki/Enrollment_over_Secure_Transport)

<comment><USER8> ACME's secret sauce is the name validation challenges, not present in SCEP and other prior standards. The same people, roughly, worked on two things, one of which is made very visible in ACME a published standard, but just as important is the other side of the coin.

The Baseline Requirements [https://cabforum.org/baseline-requirements- documents/](https://cabforum.org/baseline-requirements-documents/) from the CA/Browser Forum set out shared rules for how a publicly trusted CA must do its job. From the outset the BRs have been clear that a CA needs to somehow validate that it's issuing the certificate for some-fqdn.example.com to the people who actually have some-fqdn.example.com or else this PKI is futile. But until relatively recently the BRs were pretty vague on how exactly they ought to do that. As a consequence some CAs did an admirable job, many did a passable job, some were a bad joke either through not grasping the threat model or just ordinary incompetence.

A trusted CA for example once had a system which would check you owned www.example.com by connecting to example.com over HTTP and making a request for a magic document, say [http://example.com/xyzzy.html](http://example.com/xyzzy.html) then it would grep the reply from the server for a magic string, which was the same as the name of the document, in this case xyzzy, and if it was found the check passes. But wait a minute, this means if your server says "404 Not Found: xyzzy.html was not found" the check passes and you get a certificate. Oops. Now, not checking for a 200 OK was a bug, but even if you do check for 200 OK this validation clearly more of a polite "Keep out" notice to bad guys rather than any sort of actual defence.

So in the same period Let's Encrypt was being set up and ACME was being defined, the CA/B Forum also reformed the BR definition of how to validate DNS names using some of the same personnel. The result is the Ten Blessed Methods (although right now there are actually more than ten of them) and ACME is an automation of just three of those specific methods. Since then CA/B Forum has also worked on obsoleting the riskier and less useful methods and creating newer safer ones. Today that would be /.well-known/pki-validation/xyzzy.html safely in a reserved namespace, and it'd need a value inside it that's either entirely random or is determined by some other factor not under an attacker's control (in Let's Encrypt the equivalent string is a hash of the LE user's public account key).

Some of the Ten Blessed Methods are inherently kinda manual. Some just aren't very universal. So ACME and Let's Encrypt focus on the three which are most suitable for automation, surfaced in a way that is hopefully even more secure than required by the BRs and made available to everyone.

</comment></comment><comment><USER17> For me it was a cherry on top of my home built pipeline. I was able to learn the general cert usage through setting up my CI/CD. It was fun and costed me nothing.

<comment><USER11> What does your pipeline look like? I've always wanted to do this but a lot of CD systems are so heavy. Great at work but super overkill for a homelab.

<comment><USER17> Gitlab for CI, Nexus for jars and docker containers and routing traffic with traefik. Its super easy if you setup them using docker. I will move to jenkins CI tough. Its plugin/ecosystem brings you much more value over gitlab.

</comment></comment></comment><comment><USER18> Adrian does a great job in summarizing the Let's Encrypt paper. He highlights all the important sections and gives the reader the complete overview of the system. Thanks for the summary.

</comment><comment><USER10> It s funny how free certificates are now easier to use than overpriced ones. Knock on wood, letsencrypt works well , except when it doesn't , e.g. when you remove a subdomain from your webserver and then it refuses to renew them for the entire domain. But still it s the best thing to happen to the web in a long time.

<comment><USER19> You should post on the community forum if you ever experience an issue like that again. Https://community.letsencrypt.org

<comment><USER10> thanks. it was actually my fault, i shouldn't have deleted the virtualhost. but when you have many domains these things can happen

</comment></comment></comment><comment><USER20> Kudos to the Let's Encrypt team for their service. I've used it in every project. Much praise!

</comment><comment><USER21> Let's encrypt support for S/MIME would be great.

While seeing great progress in securing the web via HTTPS email still lacks fundamental security. While I would love to see a functioning PGP or other decentralized setup, network effects are a strong force and it's still to much hassle for non-technical people. Free S/MIME would help me to distribute secure e-Mail setup for friends & family.

Looking for free or cheap certificates there was no satisfying provider. Either expensive, or not trustworthy server-side generated certificates, or not compatible/ not trusted root authority, or dedicated Windows software for generating certificates:

[0] [https://www.swisssign.com/email/email-id- silver.html](https://www.swisssign.com/email/email-id-silver.html) [1] [https://www.sslplus.de/bestellen/step1.html?cert=79](https://www.sslplus.de/bestellen/step1.html?cert=79) [2] [https://www.dgn.de/e-mail-zertifikat-dgncert/](https://www.dgn.de/e-mail- zertifikat-dgncert/) [3] [https://en.sklep.certum.pl/data-safety/id- certificates/certi...](https://en.sklep.certum.pl/data-safety/id- certificates/certificate-basic-id.html) [4] [https://wiseid.com/pricing/](https://wiseid.com/pricing/) [5] [https://www.actalis.it/products/certificates-for-secure- elec...](https://www.actalis.it/products/certificates-for-secure-electronic- mail.aspx) [6] [https://volksverschluesselung.de/](https://volksverschluesselung.de/) [7] [https://en.sklep.certum.pl/data-safety/id- certificates/certi...](https://en.sklep.certum.pl/data-safety/id- certificates/certificate-basic-id.html) [8] [https://www.bundesdruckerei.de/de/loesungen/Certificate- Serv...](https://www.bundesdruckerei.de/de/loesungen/Certificate-Service- Manager#CSM) [9] [https://www.instantssl.com/](https://www.instantssl.com/)

<comment><USER22> LE for domain-validated code signing would be good as well. Knowing an executable came from a trusted domain even if it was mirrored or rehosted sounds nice.

</comment></comment><comment><USER23> Can I use Let's Encrypt to sign my own personal CA so that I can issue certs for my domain that are in that chain?

<comment><USER24> Nope! For various reasons, including that the IdenTrust cross-signature has a path length constraint that doesn't allow any longer chains for this path. Also, Let's Encrypt doesn't want to be responsible for supervising the correctness of your CA's operations.

In theory this could be practical if you look at name-constrained delegations but it seems to me that there are a lot of practical problems with making this widespread. If you happen to be interested in discussing them in more detail, come over to [https://community.letsencrypt.org/](https://community.letsencrypt.org/) and create a new "Issuance Policy" thread and we can get into it in more depth. But the short answer to your question is simply no—Let's Encrypt doesn't offer this service, isn't currently permitted to offer this service, and isn't interested in offering this service.

</comment></comment><comment><USER25> While let's encrypt is great I keep getting worried let not what happened to the team managing openssl resulting to heartblead bug happen to the let's encrypt team it would be a disaster

<comment><USER19> Can you give some more insight on what happened to the team managing openssl during that time? I remember being on-call at a job when the news dropped.</comment></comment>


The Power Structure of a Mexican Drug Cartel | Co.Design - <AUTHOR> http://www.fastcodesign.com/1662638/infographic-of-the-day-the-power-structure-of-a-mexican-drug-cartel <comment><USER2> One of the best charts we've ever posted---says alot about how network organization contributes to the spread terror. All kids of connections there.

</comment><comment><USER3> JESUS</comment>