Why Quantum Computers Might Not Break Cryptography - <AUTHOR> https://www.quantamagazine.org/why-quantum-computers-might-not-break-cryptography/ <comment><USER2> I am worried about the following part from the paper <[https://cr.yp.to/papers/pqrsa-20170419.pdf>](https://cr.yp.to/papers/pqrsa-20170419.pdf>)

"Our batch prime-generation algorithm suggests that, to help reduce energy consumption and protect the environment, all users of RSA — including users of traditional pre-quantum RSA — should delegate their key-generation computations to NIST or anohter trusted third party. This speed improvement would also allow users to generate new RSA keys and erase old RSA keys more frequently, limiting the damage of key theft."

If you told me this was a parody of NSA disinfo, I'd believe it. But apparently, it's a serious paper by djb and Heninger. What happened? Did they finally crack djb, maybe after tying him to the Appelbaum mess? I had hopes for him because ``Keeping crypto insecure'' was talking about stuff TLAs certainly didn't want to see in the spotlight, but this is incredibly disappointing. When I read this passage for the first time I actually laughed for five minutes straight because it was so ridiculous.

<comment><USER3> I read the paper, and it's not clearly so incriminating in context. You've left out the critical immediate following sentence:

"However, all trusted-third-party protocols raise security questions (see, e.g., [19] and [24]), and there are significant costs to all known techniques to securely distribute or delegate RSA computations. The challenge here is to show that secure multi-user RSA key generation can be carried out more efficiently than one-user-at-a-time RSA key generation."

The point is that post-quantum RSA relies on massive keysizes that make generating single keys extremely expensive in comparison to today's state-of- the-art, and that it's possible to speed it up by making many keys at the same time. The comment about delegating to NIST was probably meant as a joke, not as any serious consideration.

</comment></comment><comment><USER4> There are post-quantum public key algorithms which are much more efficient than terabit-size RSA.

[https://en.wikipedia.org/wiki/Post- quantum_cryptography](https://en.wikipedia.org/wiki/Post-quantum_cryptography)

</comment><comment><USER5> This seems pretty academic: even if RSA can be kept alive at some enormous key size, the reason we use RSA and not lattices or isogenies is that RSA is more practical.

That equation flips if quantum computing becomes a real threat, and the numbers in the paper don't appear to change that at all: the key sizes theorized here are, for instance, far bigger than the keys we use in RLWE schemes.

As others here have noted: the paper we're talking about is not entirely serious.

</comment><comment><USER6> TLDR; RSA keys can be generated large enough (1TB was the example in the article) that it would still take an inordinate amount of time to brute force, in spite of the potential speed advantages available to the quantum computer.

<comment><USER7> Are 1TB keys still secure?

I seem to recall that some schemes have issues with keys being _too_ large because of things like prime scarcity.

</comment></comment><comment><USER8> That is an interesting argument... Today we assume RSA is "Safe" because we can guess the maximum computational power of an attacker, and using a key size that makes cracking the key an unfavorable avenue for attack.

He's merely suggesting the same thing: use a really large key (terabit size), and since quantum computers are quite exotic, it will be an unfavorable avenue of attack.

<comment><USER9> We can't even get people off SHA1 to SHA2 "because of lower performance." Somehow I doubt the "1 terrabit RSA key" would go over well with them.

I think there's a much better chance we move off to still slower, but not as slow, quantum-resistant crypto algorithms, than just much larger RSA keys.

<comment><USER10>
      >> We can't even get people off SHA1 to SHA2 "because of lower performance." Somehow I doubt the "1 terrabit RSA key" would go over well with them.

So apparently we are going to need quantum processors to generate encryption that is resistant to quantum processors.

</comment></comment></comment><comment><USER11> > As part of the attack analysis, this paper introduces a new quantum > factorization algorithm that is often much faster than Shor's algorithm and > much faster than pre-quantum factorization algorithms.

This seems like the real point of this paper, no? The rest seems like a joke.

</comment><comment><USER12> So... what is the argument exactly? That quantum computers won't be fast enough to break a key that's larger than most people's hard drives and would be utterly useless in practice?

<comment><USER2> The argument is that it is possible to use RSA that is post-quantum safe in the real world.

Not every research needs to produce a result that is ready-to-use in everyone's home.

</comment></comment><comment><USER13> If I had a quantum computer that was capable of breaking RSA, I wouldn't tell anyone. The whole point is to be able to spy on people, and you wouldn't be able to do that if everyone knew that RSA was broken.

I don't know if quantum computers exist, but I'm sure once they do, the people who build them will keep them secret.

<comment><USER3> A high-end desktop is better at simulating quantum computers than any that we've ever built [1]. The best quantum computers achieve about 10 qubits. Furthermore, quantum operations are slower than classical operations. A classical computer can do a 64-bit operation (depending on clock speed) in ~0.25ns, a quantum computer takes about 5ns. Also, quantum computers don't scale like classical computers. 2 classical computers can solve twice as many problems or problems twice as hard, while 2 quantum computers can only solve twice as many problems.

The hard part is hardware, and you need the minimum number of qubits to be of any use to breaking RSA. That number is on the order of O(N^2), where N is the number of bits--so you need qubits on the order of hundreds of thousands if not millions. Where the state of the art is around 10.

[1] D-Wave is approaching this equivalency, for certain definitions of quantum computers.

</comment></comment><comment> Ar-Curunir I feel like the paper by DJB, which this article is based off of, was some sort of satire.

<comment><USER14> It absolutely is - one of the keywords is "Make RSA Great Again", ffs.

</comment></comment><comment><USER15> My question is: how practical would it be to use a 1TB RSA key for average users? I assume that the size of cipher text would be somewhat depended on secret size.

The storage space and network bandwidth is not free.

</comment><comment><USER16> Who gives a damn about a terabyte size key? what a pointless article.</comment>


Hacking For Good - <AUTHOR> http://rix.si/2013/07/07/hacking-for-good-1/

<comment><USER3> Cats sleep 16 hours a day so if you get them addicted to social networks you'll be creating a rat population problem.

In all seriousness though the author here just took the time to write what most of us have thought... that technology has been getting us to look down at stupid things on our smartphones too much and not enough up at the sky or around us at each other and our cities.

We don't think enough about the bigger problems, we only come up with new filters/effects for our food pics.

</comment><comment><USER4> You should think twice before applying to YC with a social network for cats or cars if only because if you do that you're unlikely to get accepted.

<comment><USER5> What about a social network for cat-driven cars? Or a car network for social cats? Heck, a social cat alone must be worth a patent or two.

</comment></comment><comment><USER6> I think the problem with the Big Problems (tm) is that solving them is not a One Solution Big Reward job. It is millions of different tedious little problems. Solving a few of them will not give you anything.

Example: Decreasing energy consumption of mobile devices. Is that a Big Problem? I think so. How do you do that? Lots of little tweaks and fixes on various layers (software, hardware, interdependencies, etc). Lots of 0.1% improvements. After a few years you get the new iPhone and it is 10% better with energy. Of course, you only see 5% improvement, because additional features ate up the rest. Note that those little efficiency improvements enabled those additional features. However, nobody really appreciates the junior engineer who was responsible for 11 of those 0.1% improvements. Not even she herself finds that amazing.

Am I too dark?

(disclaimer: I know nothing about actual iPhones)

</comment><comment><USER7> > Paul Graham recently wrote that the next big place for startups to disrupt > is in startup investing.

Startups are experiments in efficiency: Who can solve a problem for a large (or valuable) market the fastest, with the least friction, and the highest margin? As pg's pointed out, it's all about growth, and that comes from applying efficiency to a place nobody's thought to do so yet.

The long-term impact on the world doesn't factor in to it at all, initially.

My reading of that essay was that there's a lot of money to be made, quickly, by solving that particular problem.

Of course, the argument could be made that by addressing inefficiencies in the communications between early-stage founders and investors, you are giving more opportunities to more people to make the sorts of changes you desire - <USER2> who would not have otherwise had those opportunities to build things like that.

These ideas aren't necessarily at odds.

</comment><comment><USER8> I have one issue with this article.

You don't "think about getting prescribed antidepressants". You go to the doctor with a health issue which he treats you for.

Antidepressants aren't pills for when you're a bit cheesed off to pick you up.

</comment><comment><USER9> As evidenced by your 'hug request' anecdote, it seems your time could be better spent AFK in general and learning how and why people interact with one another. For example, hugging is a spontaneous gesture (aside from greeting/farewell hugs) meant to convey a feeling of connectedness between two people. It sounds like you are actually suffering from feelings of alienation and in your confusion, projecting these feelings onto society and the YC/HN community at large. Furthermore, increase in the use of prescription antidepressants is only a correlation between time and prescription antidepressant use. That is to say, it doesn't prove that people are more depressed nowadays.

<comment><USER10> This.

I get the feeling that 'the West' is looking for 'pop-a-pill' solutions for everything. I've seen it said many times in HN comments surrounding depression that these drugs are not the answer to depression. I tend to agree.

The solution must be born subjectively. Unfortunately, this true 'solution' to an individual's depression is inadvertently missed when one's mind has been deadened to believe that 'everything is Ok' by the presence of a drug.

<comment><USER11> _I 've seen it said many times in HN comments surrounding depression that these drugs are not the answer to depression. I tend to agree._

It'd be good if you'd explain an alternative.

</comment></comment></comment><comment><USER12> Very good article.

But in the end it's just a job. We all have to make money because we don't grow our own food.

I thought about this a long time and I'm just going to use hacking to make money and spend it on a social project that has nothing to do with hacking and can't be fixed with (computer) hacking.

</comment><comment><USER13> Ahh yes the Real-Problems(TM) paradox and moral high ground.

I take issue with that last paragraph.

You know what? I want a social network for cats. You know why? Because that sounds awesome. Come on guys and gals, whatever happened to being _human_ and having a sense of humor?

Let's solve the hard problems too! We don't ONLY have to do one or the other. Let people work on what they want to.

I think people's motivations are the more concerning thing about these kinds of things. Is the person building a social network for cats because he or she is a huge pet lover and wants to see something like that exist or just because he or she is trying to make a quick buck? If it's the former, then I'm completely fine with it. Let them try, and if it fails it fails.

<comment><USER14> Well how many social networks do you need? How many cat photos and videos? How many i-fart applications? Humor is nice. Laughing is nice. How much do you need to laugh? 100% of your waking time?

How many real problems have we solved for every ifart application? Somehow I don't think that the numbers add up.

<comment><USER15> I think it was found that looking at cat picture increased motivation? Maybe we could start a gtd site based on sharing cat pictures?

<comment><USER14> > I think it was found that looking at cat picture increased motivation?

The motivation to kill more cats? :P

<comment><USER15> :-O

</comment></comment></comment></comment></comment><comment><USER16> Okay.. your article is of course a good reflection of our distorted social interaction.. But what are your _concrete_ proposals for solving it apart of negating social networks for cats?

</comment><comment><USER17> Wonder how this relates to Random Hacks of Kindness? [http://www.rhok.org/](http://www.rhok.org/)</comment>


Ask HN: Is there anything that can be done about politics on HN? - <AUTHOR> Can HN make a new section or not?
Why isn't ycombinator interested in investing in their own board? The benefits outweigh the negatives by a million times.
Plus it probably costs them close to nothing to do it if money really is the issue here.
No the real issue here is that we are all content with PR campaigns disguised as protests. Net Neutrality is much bigger than a blackout/ slowdown protest. While it's still nice and very welcome it isn't what we all so desperately need right now which is a backbone. A techno political revolution so big it will change history forever and cement us as the winners in an unwinnable war.
It can all simply start just by making a new section where us politically motivated HN users can talk freely without being flagged within the first 30 seconds of posting anything slightly sometimes extremely relevant material.
-2k char limit- I commented the rest <comment><AUTHOR> Example 1. ISPs voluntarily assigning themselves as a public utility without any help from the federal government, essentially nullifying and voiding any further net neutrality argument forever.

It sounds absolutely insane right? Well good, that is the point. As insane as they are for fighting literally everything about making the internet an enjoyable experience or a beneficial one. As insane as they are for welcoming and warming to the idea of throttling and controlling our internet we need to hit them harder than ever before and constantly non stop until we get what we want.

Which means doing things kinda the old fashioned way. Talking about it. With other people. Not flagged or downvoted into oblivion.

With all the people on Hacker news and how much reach this relatively small site gets I can guarantee it's only a matter of time until we all become a target. (I don't remember a single flagged political discussion on HN before the last election happened)

And besides if the techno political revolution doesn't start on HN where will it start? How much longer are we going to wait until the billionaires decide they don't want a free internet? How much longer are we going to wait until corporations decide five eyes actually isn't enough for them?

<comment><USER2> You still have time to return your HN to place of purchase for a full refund.

</comment></comment><comment><USER3> I think the problem is brand dilution. HN is a niche site mainly for technical discussion, and "anything that gratifies one's intellectual curiosity", with a very narrow definition of that. It's not a general discussion forum.

You can understand this better if you imagine that HN is just a subreddit with a very strange customization.</comment>


AWS urges developers to scrub GitHub of secret keys - <AUTHOR> http://www.itnews.com.au/News/375785,aws-urges-developers-to-scrub-github-of-secret-keys.aspx

<comment><AUTHOR> Apparently "Thousands of 'secret keys', which unlock access to private Amazon Web Services accounts are currently available unencrypted to members of the public with just two clicks of a mouse."</comment>


Announcing Patron: a Ruby HTTP client library - <AUTHOR> http://fiatdev.com/2009/07/03/announcing-patron-a-ruby-http-client-library <comment><USER2> I don't see any difference with this and HTTParty (besides having to install libcurl).</comment>


Totaled Recall: How technology is ruining our brains - <AUTHOR> http://www.graphpaper.com/2009/08-21_totaled-recall-how-technology-is-ruining-our-brains <comment><USER2> Information overload is a mater of discipline. If you let yourself be enveloped in random facts you'll eventually become a little scattered.

This isn't really a new concept. In the first Sherlock Holmes story (A Study in Scarlet published in 1887) Watson mentions to Holmes that the Earth revolves around the Sun and is shocked to find Holmes doesn't know that. Holmes' response is that not only did he not know it but that he'll try his best to forget it now that he's been told because it does not serve any practical purpose for him.

Clearly that's a little too extreme but the lesson is there. The argument of how humanity's increasing knowledge is become detrimental has been on people's minds for a long time. Easy access to that knowledge just exacerbates the problem. Yet society hasn't collapsed and I don't think our brains are going to rot anytime soon.

The trick is just realizing your brain has finite resources and it probably isn't best to get to bogged down in minutia.

<comment><USER3> Tyler Cowen's new book [http://www.amazon.com/Create-Your-Own-Economy- Prosperity/dp/...](http://www.amazon.com/Create-Your-Own-Economy- Prosperity/dp/0525951237/ref=sr_1_1?ie=UTF8&s=books&qid=1250886041&sr=1-1) is about managing information; he suggests looking at how autistics manage the mass of details they tend to collect for pointers at how neurotypicals can do better. The book's thesis is more complex than this, but I think he was a bit sloppy at developing it.

EDIT: He also wrote a similar webbed article [http://chronicle.com/article/Autism-as-Academic- Paradigm/470...](http://chronicle.com/article/Autism-as-Academic- Paradigm/47033/) This was discussed on HN some time ago; I was going to include a link to the discussion but the WebMynd search was taking way too long.

</comment></comment><comment><USER4> I really don't like these titles, because they come off as authoritative -- as in a scientific study was done -- only for people to follow the link to end up reading some guy's thoughts on technology and memory because he forgot something.

</comment><comment><USER5> Gah, this piece is fluff. I don't have a pile of poems memorized, I'll admit that. I don't have phone numbers memorized either. What I do have tho, is a very broad knowledge. I know enough about a lot of things to effectively search, and i can retain lots of stuff, I just don't do the details. Does this mean I am not as capable of coming up with something new, or that Im not as capable of coming up with something new in the same old ways? Because I have access to top-shelf knowledge of many fields, I can put ideas together that would have remained separate for lifetimes in previous generations, or is this synthesis different from some "one true creativity"?

</comment><comment><USER6> Perhaps it is ruining yours, but then a little discipline helps. I have multiple pda and cellphones and a hp200lx. Believe it or not, the hp200lx can enter a todo item quicker than any other method, including pencil and paper, berry, pda, whatever.

It is a little bulky, so i always carry a small notepad (like a daytimer) (yes, I know, retro) and a pen, and it is very useful that way.

I also particularly agree with TomOfTTB's comment above.

<comment><USER7> I find it amusing that you carry a hp200lx yet describe the _paper notepad_ as 'retro' :)

Do you just use it (the hp) as a todolist? Do you sync it with anything? What characteristics make it faster than a more modern PDA with a physical keyboard?

<comment><USER6> Well, there is retro and there is double retro.

I log time on projects mainly, and set up appointments. And use the todo list. I sync it these days with linux.

The speed of entry is a happy combination of several factors. First, of course, it is instant on. Next, there is a very simple database that you can customize which is behind the todo list. Third, there are keyboard macros that I have set up to instantly call up this todo list and pre-fill a blank entry, so after hitting that key, I can instantly begin typing. So the sequence is power on, hit two keys to bring up the database (0.5 sec so far, maybe less) and begin typing instantly. Stylus is slower, berry wheel is significantly slower, I am guessing that the iphone is slower, hp pda with stylus is slower as well.

It can also have phone numbers, but those usually end up in the berry.

</comment></comment></comment><comment><USER8> At work in the past few weeks, I've been expected to document some parts of a large system I've been designing, so that other people can use it. I've now produced tens upon tens of pages of documentation, which still only _scratch the surface_ and have massive gaping holes, some by design, some by sheer necessity. Meanwhile, this stuff is just basic state I need in my head to do what I'm doing, it's not even a full explanation of what's going on; even the code is only covering the what and for a third party to extract the "why" could take a long time.

When it's all in my head, it doesn't seem too large, until I try to get it out on paper and I find that it's a simply _huge_ amount of state.

I'm not feeling too guilty about not having Shakespeare memorized. I've got a lot of things going on in my head that very few people of past eras had to contend with. Sure, if I didn't have a job and didn't care about world news and didn't sometimes do my own writing and have programming projects on the side, I'd be left with _tons_ more time to memorize poetry. But... so what?

</comment><comment><USER9> Technology is not actually ruining our brains but perhaps there is too much information entering our brains now, compared to 20-30 years ago. Perhaps our brains are re-prioritizing what needs to be remembered and what not.

I personally code without using any reference/cheat sheets (not in Erhlang ;) ) , but for the life of me I can never remember my mobile number!

<comment><USER10> >Too much information

Yes. I believe it is thinking too much that spoils our recall (not speed-dial and suchlike as the author claims). There's been an explosion of content and communication in recent times. Too much noise makes it harder for minds to rest.

I've noticed that calm, alert people tend to have full heads of hair and excellent memories!

</comment></comment><comment><USER11> Personally, I do not consider writing to be: " _the closest we have come (so far!) to perfecting the human interface._ " In fact, I tend to do it only when there are no other practical options.

I can type far faster than I can write, find it far more natural, and it has numerous advantages. For instance, I can share it more broadly, reproduce it more easily, archive more effectively, search through it more easily, and worry about losing it less (largely because of that archiving and searching).

Even in his particular example, it seems that if he had spent less time trying to decide which of his bells and whistles to use and just picked and used any of them he would have had no problem. (In his situation, I would have left myself a voice note on the phone. If you are used to it, you can do it while walking with very little slowdown.)

</comment><comment><USER12> It all comes down to correct utilization of technology. If you want to recall something, then memorize it - it`s not a difficult task. If you simply record it via chosen medium AND you wish to recall it at a later date, then you're doing it wrong. I think it just comes down to common sense..if I need to call a number once, I won't memorize it..it`s a waste of time. However, I am more than likely to memorize a friends number who I call often.

Personally, I can recall old passwords, tons of current passwords, tons of phone numbers, student ids, credit card numbers, bank account numbers and tons of relevent IP addresses I use frequently..come to think of it, I have a lot of things stored in my head. How can the author assert that our ancestors remembered more than us? Heck, do we not recall THOUSANDS of domain names?

</comment><comment><USER3> "People who want to appear clever rely on memory, people who want to get things done write things down."

I haven't been able to find it again, so I'm not certain, but I think it was from the Lairds' 1947 book [http://www.amazon.com/Technique-Getting-Things- Directing-Lea...](http://www.amazon.com/Technique-Getting-Things-Directing- Leaders/dp/B000Z2MT3O/ref=sr_1_1?ie=UTF8&s=books&qid=1250885788&sr=8-1) which I reviewed on Amazon:

This is a very useful book on getting things done. If you need hand-holding and specific techniques you can apply without thinking too much it's not for you. It gives few specific techniques, instead it focuses on general methods applicable to almost anything and on many inspirational anecdotes. Very readable.

</comment><comment><USER3> The big difference is in HOW MUCH we need to remember. There simply wasn't that much new information to remember Before Writing. An expert story teller in ancient times probably didn't remember more than a few novels worth of information - far less than I take in in a month - over his lifetime. Others had even less, and most of what they took in was gradual changes in the surrounding environment, not a lot of explicit information (like, to use the original essay's example, telephone numbers; and we don't remember as many phone numbers today as 30 years ago because we're not dialing as many).

</comment><comment><USER13> Technology isn't hurting our brains. It's evolving them to deal with a different set of problems.</comment>


School Expels Student For Playing With Toy Gun in His Own Yard - <AUTHOR> http://www.policymic.com/articles/64985/school-expels-student-for-playing-with-toy-gun-in-his-own-yard <comment><USER2> This the school principals statement on the matter: [https://linmedia- cms.endplay.com/documents/234677/0/Principa...](https://linmedia- cms.endplay.com/documents/234677/0/Principal%27s+response/f65e30ee-1e06-49a3-b212-30e18a55b6cb)

<comment><USER3> Key part:

Several students verified that they had been hit by pellets and had the marks to support their claims. In one instance, a child was only 10 feet from the bus stop and ran from the shots being fired but was still hit. Another student claimed to be shot in the back while running away during a previous incident Wednesday, Sept. 11. This child was also shot in the arm and head during Thursday's incident. I contacted the school division's Office of Student Leadership and School Board Legal Counsel for guidance. Because students were on their way to or at a school bus stop when they were struck by pellets, the school division has jurisdiction to take disciplinary actions against those students responsible for the disruption. There is an expectation that all students should be able to travel to and from school in the safest environment possible.

</comment></comment><comment><USER4> 'Toy gun' is a little weak. 'Pellet gun' is more accurate.

<comment><USER5> It's a toy, that looks like a gun, and shoots plastic balls filled with air that afaik wont break skin. Toy gun is not only not weak, it's accurate.

</comment></comment><comment><USER6> Anyone still question what the social outcome of all this will be?: society will frown upon gun ownership, to the extent that people will be ostracized for exercising their second amendment rights. It doesn't matter if this is planned or not, it's the end result that matters.</comment>


Ask HN: How did you pick your HN handle? - <AUTHOR> <comment><USER2> I bend, shape and contort Linux to do many different things in very simple ways and to meet my needs and the needs of others. So, LinuxBender.

I only use this in one other place. I have hundreds of nicks / handles / aliases to reflect my moods at the time.

</comment><comment><USER3> My name is Dave, and Fiat Lux Research was my first startup. It is Latin for "Let there be light". Among the other things I learned was: don't name your startup in Latin! We got really tired of spelling the name to every single person we talked to. Vendors would think we were a subsidiary of Fiat Motors or similar.

</comment><comment><USER4> Same as my GitHub handle, named after the Super Nintendo Entertainment System. It was the first video game console I ever owned.

<comment><AUTHOR> On a relatively small platform like HN, it seems like lots of handles that are taken @gmail, @yahoo, etc. would still be available here. I imagine supernintendo isn't available on most public platforms?

<comment><USER4> Yeah. I just use first name, last name for most sites since it's fairly unique.

</comment></comment></comment><comment><USER5> Well, I have a giraffe, and I ride it. I've also ridden other giraffes.

So, well, RiderOfGiraffes.

<comment><AUTHOR> Is this a handle you use all over? A lot of times people will say "contact me at handle at gmail" or some such thing. I'm curious to know whether HN handles are used all over, or are special use for HN.

</comment></comment><comment><USER6> It picked _me_.</comment>


Clump – A library for expressive and efficient service composition - <AUTHOR> http://getclump.io/

<comment><USER2> I know just enough Scala to recognize the fact that this is a Scala library even though almost nowhere on the page does it mention Scala (except in a section near the bottom called "Scala Futures")

<comment><AUTHOR> Thanks for the feedback, I'll update the readme.</comment></comment>


Ask HN: What does performance management look like at your company? - <AUTHOR> I'm curious to learn about staff performance management at other companies to understand what works and what doesn't. How does your company set goals, evaluate performance, etc? Do you use OKRs or a similar tool? Thanks!<p>Edit: Clarified that I am asking about staff and employee performance management. Thanks! <comment><USER3> It's all honestly completely useless. I've never had a useful performance review at any company ever. It's either I'm doing bad, and know it, and that is either my fault or due to reasons outside of my control. Or I'm doing well, and know it. Honestly, sometimes at places things were so bad that I felt I was doing terrible, but I was actually keeping the team going by pushing past a lot of tricky issues.

Really I think any company that waits until performance review time is really broken. That could be a year, or sometimes many years.

Also, the usefulness or performance management is usually undermined by the fact that the people doing the worst usually are in hardcore denial as to their performance. Those people are the hardest to change and manage. I've rarely seen performance management actually fix a problem, other than making the environment so unpalatable that the person just leaves.

I really wish I could have all that time wasted on writing useless "self- reviews" back. Even if I was staring at a blank wall it'd be time better spent.

<comment><USER4> I wish I had that kind of insight into my 'performance' pre-review! I'm at a FAANG right now and given my interactions with my manager alone, I figured I was bombing performance-wise (constant complaints about my work, refuses to acknowledge any accomplishments, super angry at me during one on ones, assigns piles of work that 'need' to be done by Monday on Friday at 6pm and then doesn't even acknowledge the completion of the work next week, ...). Come performance review time on the other hand I've had awesome peer reviews, performance ratings, stock refreshes, etc for the past four biannual performance cycles. Given the complete mismatch here between how I feel I'm doing and how my manager treats me, I'm actually pretty happy we have this performance review system in place. Probably just need a new manager...

<comment><USER5> Stop your manager in their tracks next 1:1 and state you have some feedback about how you're feeling here. Start by noting that it's a very stressful time right now and that these concerns are even more important for you. Your manager would likely be hurt if you left and good managers appreciate upwards feedback so that they can correct on their side.

The fact that the performance rating is good means your manager probably is acknowledging the work you do, just not to you. The manager input for ratings is hugely important at the FAANGs, so your manager is clearly telling others you're doing a great job. There's just clearly a gap here between you and her/him in that feedback.

Source: Am a manager at one of the FAANGs. I'm finding that everyone is overthinking every bit of feedback right now. Clearly minor feedback is hard to differentiate compared to major feedback. Likely due to the video communications barrier and that everyone is a little bit more alone with their thoughts. I'm being cautious on delivery because of it. There's also less ad- hoc thank you's and acknowledgements going around due to the remote barriers.

<comment><USER6> > Stop your manager in their tracks next 1:1

BAD idea with most managers. Your manager is likely to be vindictive and insecure if confronted like that. Even with peer reviews in place managers have disproportionate influence on your reviews, and promo/comp decisions (something you readily acknowledge). If the manager treats you with disdain, it's almost impossible to fully reverse that - it's just human nature, let alone do so through confrontation.

The best thing is to move on to greener pastures, of which there's vast abundance at any FANG. People can move around easily there by design: that way shitty managers get naturally de-staffed. Anything else is a sunk cost fallacy. Do yourself a favor, and go to a team where you're appreciated, respected, and can work alongside decent people. Do not tolerate this abuse. Otherwise your career will stall, you won't be able to do anything about it, and you'll feel miserable throughout.

Source: been there, done that.

<comment><USER7> Yes. Suck up to the boss, then say you're interested in a new opportunity at Team X, or, sadly, you've accepted an offer to work somewhere else, or, you are quitting for personal reasons.

<comment><USER6> That's why I liked Google so much: you don't have to "suck up" to anybody. If things aren't working out, figure out what you'd like to do instead and 2 weeks later you're working on that, if they have spots on the team and would like your help. You may be asked to stay a bit longer, say 6 weeks, but the process is very non-confrontational. It's not like that for junior people, though - if you're junior you have to stay in your position for at least a year, which IMO is dumb - people who work there have no problems finding employment elsewhere. It should never be harder to move within the company than _outside_ the company.

<comment><USER8> Yeah for a big company there is no excuse. Smaller companies might be more impacted by giving people this freedom but maybe the advantages outweigh the disadvantages anyway.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Slightly off center from your question, but:

1\. Every Wednesday I Google Meet with my salespeople. We review the prior week's priority prospects, this week's, and then I ask them about clients not on the list that our BI system has identified as promising. An integration of internal systems, Slack & Zapier alerts me each day to anomalies (good and bad) with clients, inventory and systems. MixMax (shout out to Brad!) is a big help in tracking email activity. RingCentral reporting is a big help in validating Salesperson activity.

2\. Every Friday I review Github repository activity for my development teams. A very soft-touch and collaborative conversation follows for developers and engineers whose pace of work or direction seems off. This is almost always a result of improper scoping, unrealistic milestones, or miscommunication.

3\. Every Monday and Tuesday I'm hands-on with my marketing team preparing for the Wednesday release of our marketing communications, and reviewing ongoing advertising campaign results.

4\. Every weekday I'm in our Xero accounting software looking at cash flow projections, inventory, A/P and A/R. Xero is hot garbage IMHO, but I've built some integrations that make is easier to use for real-time reporting.

5\. I visit our satellite facility every other week for in-person chats with that team.

6\. I've invested a lot in automation to track our market, predict conditions and generate alerts.

Notwithstanding 1-6 above, there's no substitute for good market conditions and good employees. I have the latter, but not the former. I mention this just in-case you're thinking you can systematize your way out of a demand vacuum.

<comment><USER10> > Xero is hot garbage IMHO, but I've built some integrations

Curious to understand more about these? I've been doing a bit of exploring in the analytics space here, and would love to know where you found the available apps falling short.

<comment><USER11> The financial cloud apps control your financial database and therefore your ability to perform analytics on them. Open source allows you to actually plug in and make dashboards.

It took me 20 mins to build a monthly revenue dashboard in metabase that updates live and you cant do that natively with Xero.

[https://youtu.be/PeQR7GseFQI](https://youtu.be/PeQR7GseFQI)

</comment></comment></comment><comment><USER12> It looks like a total waste of time.

As a developer of internal web apps, it is apparent what I must do next to serve my users, in the next week, month, quarter, year --- I have a long to-do list! It is also apparent what I must do to serve my team, in the next week, month, quarter, year. (I get rave reviews from both, unsolicited.)

The goals that cascade from the executives are laughably vague and obvious: cut costs, increase revenue, reduce maintenance, get to the root of recurring problems, please the customer (of course they phrase those things with your typical multisyllabic jargon). So what the process ends up being is taking my goals that I have already got and writing them down in another place (a shockingly flimsy and probably expensive web application they bought from a vendor) using certain words that they like. It is a total waste of money and time (which, ironically, is counter to at least two of their supreme goals).

Let me be clear. While it is theoretically possible that the executives know of a problem or need at the company that I don't, and when they share their company-wide goals it would be news to me, this has never happened. There has never been a time when the yearly goals come out and I say, "Oh, well, now that you put it that way . . . "

On the other hand, I must be above average, because there exist many at my company who, left to themselves, would sit around and do nothing, or worse. Presumably this whole ceremony is in reaction to their behavior. In my opinion, such people should be fired, not babysat.

<comment><USER13> > In my opinion, such people should be fired, not babysat.

I feel this same way at most places I've worked. But as I've gotten older, I've started to think "how can I level these people up?" and that has gotten me much farther towards my personal goals than the prior thoughts.

Not staying you should or that you aren't already. Just a thought to past me.

</comment></comment><comment><USER14> In most companies I've worked in: thinly veiled nepotism and cronyism. I've never seen the inputs of a performance management tool being the only inputs for calculating merit or bonus amounts, so the outcomes of both these situations depends heavily on your relationship with your boss and their boss.

Don't get me started on stack ranking or making sure everyone "fits the curve" by knocking down everyone to average because HR said so.

<comment><USER15> > thinly veiled nepotism and cronyism

Exactly my experience as well, but it's often not even thinly veiled.

These processes should not even be referred to as "performance" reviews since they often have little or nothing to do with performance. It's loaded and deceptive language.

</comment></comment><comment><USER16> We are a company of about 4000, our performance management is pretty shite. We essentially function as a company of middle managers with a software engineering department tacked on.

Getting promoted has very little to do with the role profiles of the above grade but instead involves doing some menial task, for example I knew a guy who was a total manchild and would smash the keyboard, groan and hide in the toilet if he encountered some difficult code, he would also never ask for help but because he did support he got promoted.

Also there's a limited number of slots, so you could meet the criteria of the above grade go through the process and still not get promoted. We basically lose all our developers after 2-3 years and most projects are composed of contractors. people who can't leave before 2 years and mediocre developers who are promoted way beyond their means and aren't good enough to work at other companies.

The worst thing is our clients usually have a high opinion of us so our competitors must be even worst.

</comment><comment><USER17> I've never worked anywhere that OKRs are actually taken seriously or followed through.

They'll get rolled out with a big hype, people will fill them out with varying degrees of diligence and understanding of how OKRs are supposed to work.

3 months later they're already forgotten and out of date. Some managers will try to keep it going for their teams, because that's what they were told to do, but that'll peter out once they realise no-one else in the org is taking it seriously.

6 - 12 months later there'll be a half-hearted attempt to reset and resurrect the OKR process, but after the first time people take it even less seriously the second time around, and after a few more months OKRs are never mentioned again.

<comment><AUTHOR> I've had a similar experience with OKRs. The issue becomes how often to review and update? On the surface, OKRs seems like it would be a helpful tool but in practice it seems pretty cumbersome and only moderately useful to guide goal directed action.

<comment><USER7> OKRs are useful at the level of the company that has medium and long term goals, not merely keeping the lights on and reacting to short term emergencies.

An OKR is about a paragraph of text per quarter, hardly seems cumbersome.

</comment></comment></comment><comment><USER18> I'm eight years into management across two different sized companies. Both have ultimately had entirely subjective systems.

I'm currently a director of a twenty person office. My current teams are supposed to have stack ranked individuals, so I simply give everyone the exact average. I also give everyone the same objectives: improve performance with technical debt repayment, use retros to determine working agreements and adhere to them, adhere to a WIP limit and then help any other team areas when there are bottlenecks, do weekly research to keep your skills sharp, self organize your team to best meet the business goals, help anyone with their job when asked or offer a time when you next are free, and if you have no work ask your team for something to do. These are pretty easy to meet, so people usually do well on them.

Ultimately compensation is tied to the whole product, not the employee, since we all split any money evenly.

I find this works exceptionally well at ensuring the ultimate goal is team performance, not individual performance.

Team members not pulling their weight are identified and asked to find a new job or improve. The ones that don't are given low ratings and let go.

In all it allows us to have a very stable team of high performers. Our average tenure is over seven years. No one has any incentive at all to "beat" everyone else. I've found the teams that employ such tactics never have long lasting talent anyway, just a string of "heroes" who burn out after a few years.

Also I flush this out with a regular "salary review" where I try to ensure everyone is paid fair market rate for their job. This happens maybe every 18 months or so for new grads, and less frequently as people get closer to salary ceilings for our location.

<comment><USER19> My company doesn't fire anybody so low performers are often moved into management or get to do new green field projects. :(. Good performers are stuck doing maintenance work on the money making products.

</comment></comment><comment><USER20> HR people in the UK use 'performance management' as a euphemism for a kind of legal constructive dismissal.

1) Their attitude stinks but nothing specific that can be picked up in a disciplinary on its own

2) They have been in the job for a few years, and their old manager never recorded the behaviour problems

3) Their role is not redundant

So to get them out you meet regularly, set short term goals, and be really picky about not meeting them. The whole thing is designed to make the staff miserable so they leave or get sacked for missing the goals, whilst building up a substantial volume of paperwork supporting a legal defence at tribunal.

Or less cynically it allows the staff to understand what is expected of them, so they perform better. This never works IMHO

<comment><USER21> As someone that has been in this position (manager in the UK) I have to agree and think you have summed it up perfectly.

However, it is occasionally successful and those (admittedly rare) occasions have been some of the most rewarding experiences of my career.

I also don't think that what you have described is necessarily a bad thing. As long as the manager goes into it in good faith and genuinely tries to understand what the problems are and to help solve those problems then the process works well for everyone - either they improve and become a happy and productive employee or they leave (voluntarily or not) and can seek a position more suited to their skills or personality.

Most of the times I have been through this the person involved was perfectly capable of doing the job but they just didn't want to for various reasons and putting them on an improvement plan helped them see this and they move on themselves before they were forced to

</comment></comment><comment><USER22> First company: My manager met with me once over two years. It was 18 months into my just over two years stay, and all she told me was "We don't know eachother at all so I can't really judge your performance." She gave me the standard 7% and we never spoke again.

Second company: It was a huge joke. The CTO invented KPIs that were unattainable and didn't matter, and we were given raises purely because our contract was profitable.

Third company: We had such a ridiculous process of "Write three goals and go over them with your manager", which turned into "Just write anything so HR doesn't complain." The goals were totally useless. Engineers did not have the ability to decide what they worked on or how it went, but the goals implied they did. It was awful and, luckily, did not effect bonus targets.

I honestly think that "performance management" at most companies is a huge joke. I haven't seen it, and none of my peers have seen it, run successfully or be taken seriously. Companies want to pretend they care about your career trajectory and goals only until an employees goals require any legitimate effort from the company's side. The goals/KPIs are pretty much only successful if an employee sets those goals to be "Do whatever their manager thinks they should do", which I would argue isn't a goal at all.

</comment><comment><USER23> It has been known for nearly 100 years that you can never criticize your staff.

"I will speak ill of no man and speak all the good I know of everybody."

― Benjamin Franklin

Last job, my last performance review. There was literally only 1 complaint against me. I was late >40 times. My boss told me he was disappointed in me. I was upset because I was never ever late to work; I was always early.

I asked him to tell me when I was late. He pulled it up. Everytime I worked the weekend because I was oncall 24x7; I would swipe in and because I swipped in after 8am or whatever it was considered a late.

So not only was I going above and beyond helping people afterhours, I was taking a hit in my performance review because of it. Dont care how stoic you are, that hurts.

<comment><USER24> I hope you then worked out how much TOIL you where owned and pointed out to them the definition of salaried employment.

<comment><USER7> Salaried employment doesn't mean unscheduled.

<comment><USER24> Possibly in some cases (eg doctors on particular shift in a hospital) - <USER2> normally as a salaried professional you manage your own time.

</comment></comment></comment></comment><comment><USER25> I work for a company that makes performance management and recognition and rewards software. As such, it is deeply embedded in our culture. We have a mix of tools that enable goals/OKRs, 1:1s, feedback, structured performance reviews, and 9-box evaluations. I lead product design for the company, and part of the reason I took the job was being able to deep dive into the user experience of how this works, and ultimately improve my own management skills. The process of rebuilding, testing, and developing the tools has exposed me to some top brass HR folks at large companies. It has been awesome being able to get the perspective on what works for individuals, and what outcomes people are expecting at the company level. I really feel like I have grown significantly as a manager in my time here.

At our company Goals/OKRs are set at the individual, department, and company level. You can align your goals up, or set individual (personal growth) goals. These can/should be reviewed in your weekly 1:1s with your manager. We allow anyone to send recognition, or send or request feedback at any point. We have several templates that facilitate different feedback types. We do quarterly Check-Ins which is more of a top down performance review where you can reflect on goal progress, feedback, and next steps with your manager. The 9-box talent assessment is calibrated for each employee twice a year. We also facilitate surveys at the company level to help do things like eNPS scores. If you want to learn more, ask away or check us out at [https://www.kazoohr.com/](https://www.kazoohr.com/)

</comment><comment><USER26> (Disclaimer: I work at Amazon, but don't speak on behalf of the company. Just sharing some bits about my experience, this is just my experience and doesn't reflect official Policy.)

Prior to working at Amazon, I had mostly worked for start-ups. The thing I found at startup is that people are trying to figure out processes, and it's kind of hard. Most people putting in a process (whether that's HR or the founding team) are trying to do their best, but start-ups aren't at a large enough scale where they really need to have scalable processes, and for individual contributors all the distinctions are pretty informal anyway, so there's usually no individual contributor promotion path.

At Amazon, I was fortunate to work under someone who had been my boss previously, and we had a good working relationship. He was not afraid to give me blunt, useful feedback about either my work or how my work was perceived.

At some of the start-ups I worked with, part of the year-end evaluation involved filling out a form with a lot of evaluation criteria - the employee would fill out a self-eval form, and the manager would fill out a form, and then they would compare during the evaluation meeting. There's no such equivalent at Amazon.

One thing that overall I like about Amazon's performance management in terms of promotions is how it's centered around a document that you and your manager write together. There are some tedious aspects to the process, but if nothing else when you go up for promotion you know what your manager is officially telling other people are your strengths and weaknesses. The flip side of the process is that decisions about your promotion are being made based sometimes on the quality of your promo doc. I'm not sure about all the company, but at least in the team I was on some of the senior folks set aside time for reviewing promo docs that they were working on with other members of the team to iron out any "doc writing" issues.

We don't really have an official OKR system, but as a more senior engineer my personal goal has generally been to enable whatever my team's goal is for the quarter or year (launch this product; get this architecture document done; research how to solve this problem).

Besides the official process, I've also found it useful to ask trusted peers how I'm doing, whether I'm giving them everything they need and expect of me. It's also pretty common to have one or more mentors outside of your team to give you more informal feedback.

</comment><comment><USER27> I'm a big fan of Dr. Deming's suggestions in this realm (for those not familiar he was involved with helping the auto industry in Japan post WWII among other things). Basically we focus too much on the who and not the what. The manager creates the system to which the worker is involved in, then you judge the employee on your system. So performance reviews are just ways to blame. Instead power needs to be placed in the hands of the employee. They are closest to the problem and the manager is supposed to empower them and basically remove impediments. I'd have to go back to the books but I recall him saying a three tier system but really aimed at seeing what employees need help and those excelling that need to help distribute their expertise to help the processes and continual improvement.

</comment><comment><USER28> What size is your company/team?

Different strategies perform well depending on size. For example, most of the time I find OKRs a little excessive for a small team.

Have you identified KPIs? What are they?

"What's measured is managed," said Drucker. Personally, finding what exactly to measure is difficult. So don't be afraid to spend a lot of time figuring this out. When you do, all the other performance management strategies will somehow find a way to work towards your goals.

<comment><USER29> Drucker never actually said that, though it's been attributed to him frequently. I found this blog interesting, and they link to the Drucker Institute if you'd like something more authoritative.

[https://medium.com/centre-for-public-impact/what-gets- measur...](https://medium.com/centre-for-public-impact/what-gets-measured- gets-managed-its-wrong-and-drucker-never-said-it-fe95886d3df6)

Similar quotes are often attributed to Deming. He never make this claim either.

<comment><USER28> I suppose I confused this with "Know Thy Time" in Effective Executive. Thanks for clarifying, I'm sure I've incorrectly made this attribution before.

Edit: typo

</comment></comment></comment><comment><USER30> Performance management is subjectivity masquerading as objectivity.

I'm a broken record about this.

<comment><USER30> In theory performance management should be about helping people improve. In practice performance management is about four things:

1) Pay

2) Promotions

3) Accountability (e.g. firing)

4) To satisfy legal requirements (perceived and real)

Performance management falls under the umbrella of HR. HR's historical roots are in compliance. In the 90's when cost vs. profit center was the rage, the HRBP model emerged to prove HR could provide business value beyond compliance. HRBP is the dominant model now but it hasn't had the impact its creator intended. Inertia is a powerful thing.

Combine HR's roots in compliance, with the above four reasons performance management exists in practice and that will give you a good way to understand why performance management works the way it does.

If you're learning about these things in an effort to improve your own organization's practices then you can also use the above to evaluate any proposed changes and think about what they would have to contend with. History is replete with failures. Unless you are in a small organization, with total control over incentives and the culture then I will leave you with a quote from Blade:

 _" Some motherfuckers are always trying to ice skate uphill."_

</comment></comment><comment><USER31> At my previous company we had to pick goals that aligned with the goals of our role/level and the goals of the company. It was a shit show. Our partner in charge would reject goals until everyone was struck with goals that were very far putside everyones comfort zone. Everyone hated it.

As senior dev / senior consultant I had to pick goals like "prepare a pitch for a potential customer", stretch goal "win a pitch". I didn't want to do this. I don't care about sales. I want to design and develop systems for someone who wants me to do that, not convince someone to let me do it.

By now almost everyone quit.

Current company: I can work in peace. Bi-weekly 1:1 with my manager that is usually over rather quickly.

</comment><comment><USER32> I've never worked anywhere where the annual review wasn't an almost entirely fictional process. It's totally subjective finger-in-the-air stuff. Often to my benefit, but I recognise that it's subjective.

</comment><comment><USER33> From a task-oriented perspective, developer A can seem more productive than developer B because developer A marked more tasks as finished than developer B.

The problem is that marking a task as finished does not mean that its deliverable is solid. A developer can game the system by leaving technical debt behind for others to fix. In this way, the developer is stealing productivity from others, by forcing them to spend more time reading, debugging, refactoring their half-baked code.

A neophyte manager may buy into this approach to performance, and even encourage it. But after a few iterations of this unsustainable practice of leaving tech-debt behind for no reason, reality sets in: now you need an army of engineers to get things done because the system becomes fragile and complicated. And you also need an endless amount of documentation that is constantly getting out of sync.

In a way, under poor performance management rules, development becomes like a game of pool: it's not only about having a higher score, but also about making it more difficult for others to have a high score. If you want high productivity, recognize this and penalize it.

</comment><comment><USER34> Generally, it's a dumpster fire.

In any rational world, execs would be basing their OKRs on something similar to [https://stripe.com/atlas/guides/business-of-saas#the- fundame...](https://stripe.com/atlas/guides/business-of-saas#the-fundamental- equation-of-saas). Instead it's a trickle up process whereby people tell execs what they want to work on, then the execs group those into OKRs. Also the OKRs appear to only have one level, despite being an org with a thousand people. And finally, the system uses the internal wiki to track, rather than integrating with the project/issue backlog tool.

Annual reviews are even worse. People fish for peer reviews that paint the rosiest picture. They only happen once a year and if something bad is going to happen to you, I recommend it happen directly after reviews, and absolutely never right before them, the recency bias is huge.

<comment><USER35> > People fish for peer reviews that paint the rosiest picture.

I found this happening when our firm used KPI metrics (key performance indicators). Whichever metric management emphasized, those would shoot way up via ... weird methods (all sorts of finagling, but not necessarily helping overall firm performance). Every time they optimized for some other lever it would have all sorts of unintended outcomes on other metrics and overall people spent more time trying to get around the system and increase their metrics than just doing a good job. System was scrapped < 12 mo later.

<comment><USER36> Don't reward raw metrics. Goodhart's law is too real in this context.

</comment></comment></comment><comment><USER37> We are a team of ~50 software engineers and about the same amount of non- engineering staff. We have a quarterly performance review. It starts from setting goals at the beginning of the quarter. Then we have a home-brewed CRM- like system to enter accomplishments, nominate peers, giving reviews and feedback and finally grading.

Then managers talking to their reports, discussing results, giving and receiving feedback.

Grades are from 2 to 5, greater is better. Normal grade is 4, it gives a bonus of 1/2 of monthly salary. 5 is 1 monthly salary and 3 is 1/4 of monthly salary. Our compensations are on market, so we ended up better compensated even after grade "3".

Two 5's in a row is an occasion to talk about promotion. Two 3's is a reason to talk about leaving the company.

That's about it, the whole process takes about two weeks, most of the time in a grade calibration process.

</comment><comment><USER38> I worked for a big enterprise type company. Our performance management process was predictably broken like most BigCorp companies processes are. We had cascading goals from the CEO down to the team manger level, with numerous layers in between. These goals were not data driven in any way. Our performance process was heavily biased towards the quarter prior to the annual review -- so don't put any points on the board until the 4th quarter, that's when they'll count for the most. Common saying -- wins cover up sins.

As a manager of a team, I tried to institute OKR's into the process for my team at minimum. I found that technique partially successful -- meaning successful for me and my team but limited in that other teams in my department wouldn't adopt them. Too much work they said.

<comment><USER39> I worked in a large company for a number of years that had a system where you were scored 1 to 5 (1 being bad and 5 excellent).

However, it really meant you were scored as either 3 or 4 as "nobody is a five and if you were a one or two you wouldn't be here anymore". My manager and I did agree it was a silly system so we settled on me being a 4 and I set everyone who reported to me as all 4s - even though they all deserved 5s.

</comment></comment><comment><USER40> I work for a large company. There are four ratings you can be assigned - 'not doing your job', 'need more improvement', 'you're doing your job average to well', and 'exceptional' for about 8% of people.

I can't really tell you how it's measured or anything like that. The company has policies about it, but more often than not those policies are blatantly violated. It basically comes down to the subjective opinions of your manager, the department head, and the business people you interact with.

</comment><comment><USER41> Thankfully, there is none. What a blessing.

<comment><USER42> It's not a blessing. As bad as performance management, goal setting, and OKRs can be when it's done badly, working for a company that isn't engaged with helping you to improve is far worse. Even if you're motivated to improve on your own you'll be working with people who aren't and that's more stressful and annoying than any number of performance measurement systems.

<comment><USER43> Why concern yourself with everyone having to be like you?

<comment><USER42> Because I'm awesome.

</comment></comment></comment></comment><comment><USER44> Frankly, our personal performance goals are just copied straight from the department goals. Any attempt to make them a little sensible is met with a 'just do what everyone else does'.

That said, when performance review time comes around, that also means that it doesn't really mean anything. The important thing is how your manager feels about you, and the rest is a formality.

</comment><comment><USER45> Last company I worked with used OKRs, but in their own "unique" way. Senior management was always 3-4 weeks late with the company wide OKRs, so the OKRs for individual teams would either be wildly divergent from the approved company direction or they were switched mid-quarter to align with the company OKRs.

Nobody ever checked the progress of the OKRs either, not even at the end of the measuring period and not even to calibrate the realism of the goals for the next measuring period. Once, when asked at an all hands meeting by the person who had been designated "OKR champion" a year earlier, the CEO answered he had forgotten about it but that OKRs were certainly still on.

I think the most success was had by a single guy who had managed to get "increase twitter followers" on his personal OKR list. Not for some company account btw, for his personal twitter account. It was continuous hilarity, but I don't regret not working there anymore. Whatever system you use, take it seriously.

</comment><comment><USER46> It was pretty standard (at least on paper) in my last company (a top 10 bank in terms of total assets).

1\. Agree OKRs with managers in the beginning of the year (to be completed by March). Everyone at same level/hierarchy will have same baseline.

2\. Performance evaluation in October. Employees discuss their achievements with managers.

3\. Results disclosed in February.

This waterfall-ish process never really worked:

1\. Over the year priorities change, teams evolve, and products take new directions. So, everyone used to put vague OKRs.

2\. Evaluation process is a black box. Performance metrics (if there really were any) were never disclosed, and were calibrated at multiple levels.

3\. You get to know only your evaluation. No data to compare to whatsoever.

I've seen this doing damage only. People with good visibility, and network used to get better ratings despite average work. Silent hard-workers will get average ratings, and will leave.

</comment><comment><USER47> I manage 30 people, but I review only 10 of them and the rest are reviewed by my team-leads.

We use KPIs and 360 feedback. These are not perfect measures, and I acknowledge that often, but are good enough for some purposes.

Performance reviews are easy for all sides if there is nothing new in them. If you either side is surprised during a performance review they are not talk to each other nearly enough during the reviewed period.

If I had the opportunity to evaluate I would experiment with more frequent feedback - like monthly sessions, small forms focusing on a very few key items.

<comment><AUTHOR> What are your thoughts on 360 reviews? I've heard the process can be very devisive?

<comment><USER19> I want to do 360s on the managers two level up and higher. Because they are the real problem in my view. I hate snitching on my direct team members not knowing how the the feedback is used so I usually just praise them without much detail.

<comment><USER47> We are not a big shop so there are not many levels up but the managers, including myself also got 360 reviews.

<comment><USER19> We do 360s one level up but the real problems are two levels up. I think it would be great if people could rate the management chain all the way up.

</comment></comment></comment></comment></comment><comment><USER48> I am in the quest of a system myself. I have tried various systems and asked other companies (big and small) on theirs. My tech startup was around 25-30 employees over 5 years. We have tried Balanced Scorecards/OKRs linked systems, 360 Evaluations, etc and ended up making a mix.

We used Google Sheets and asked for qualitative feedback on defined headers (skill with KPIs & culture/values), and a rating (1-5). Each of the headers had weightage that changed with roles & levels.

We tried to make promotions and compensation changes as data driven as possible, but they were inline with intuition / general opinion. To the employee it always felt like "Why did we do all this for such little change?!" It sucks but you need to improve the system across many years. With every round try and understand signal vs noise. That's how you build trust.

Consistency is key. A few learnings regardless of the system that I learnt the hard way:

* Communication. You need to communicate before, during and after the process. You need to make it relatable for all levels of employees. Give them specific templates with specific examples. You need to remove the narrative of you-vs-them, doing-this-to-justify-an-increase, and bring focus on reflection.

* Frequency/Cycle. "if it hurts, do it more often" is the quote that applies to this. Never let it slide. Minimum every six months, ideally every quarter.

* Review of KPIs. You need to review the KPIs every week without fail. It forces you to focus on metrics that you can move on a week-on-week basis. Anything that changes in step function over a month/quarter/year can be broken into a smaller metric.

* Rewards and Recognitions. We were always late on this. Always rolling out the red carpet when someone threatened to quit. It always felt like extortion as the manager. Don't wait for the cycle to call out extreme performance (great and terrible). Give negative feedback in private as quickly as possible. Do a non-monetary (Amazon Gift Coupons etc) for great performance. Wait for promotions and compensation.

* Pay performance linked pay well. I think this was what I got wrong the most. I did not plan the company finances well enough to pay out immediately. I would say "Hey great performance! We will pay you $$ but in 2-3 months when our situation improves". That erodes trust in a moment.

* Getting and acting on feedback. I struggled on this one too and made many excuses -- we are going through a curve

Hope this helps. I would love to hear from others.

</comment><comment> obi-wan I'm currently working on solving this (still in the early stages). More specifically I'm working to objectively measure performance over time, with a strong focus on actionable insights to help you improve. If you would like to test this email email@example.com. Or you can just email me your problems and i'll see if I can solve them.

</comment><comment><USER49> I've used pseudo-OKRs at the last few places, where there's basically a bailout option where you just change the OKRs at the end of the year to match what happened (if you were doing well). Depends on what you mean by works/doesn't work. In my experience performance management is mostly about recording business justification for continued employment, bonuses, advancement, or the negative versions of these. So by that metric these systems definitely work.

<comment><USER15> The OKR's can be ignored as long as there is "progress", but progress measurement is still very subjective and statistics can be deceptive, so the process often just ends up being the usual game of nepotism. Not hitting OKR's can also allow managers to request more headcount, meaning they are incentivized to make excuses instead of delivering value.

</comment></comment><comment><USER50> You fill in a bunch of forms during the year, at the end they tell you you've placed in the highest tier, and as a reward you get a 3.5% pay increase instead of 3.0%.

</comment><comment><USER51> I'm actually defining this process for the first time in my current company. I'll explain my philosophy behind performance levels and goals. I'd love any feedback. I'm specifically trying to make this an actionable process.

First, the levels, because I perhaps have a different interpretation of these than I'm used to seeing. There are essentially three levels that correspond to performance compared to expectations. So underperforming, performing, and overperforming. Only underperforming carries a negative connotation [0], because it means that you are not meeting the expectations for your level. In contrast, overperforming means that you are reaching beyond your current level.

So, hopefully we have zero people underperforming. Also, hopefully we have the vast majority of people performing. Because overperforming basically means we need to be finding an expanded role for that person, which we may or may not have. If too many people are overperforming, then we can maybe expect turf wars as people start trying to expand their role without guidance, which is terrible for morale. Hopefully we can balance overperformers with growth, so we are moving people to expanded roles and then filling in below with new hires.

So, given this leveling, there are two types of goals: baseline and growth. Baseline goals apply to the entire team and define those baseline expectations for that team. Meeting these goals will keep the team out of underperforming territory [1]. Growth goals are tailored to a specific individual, and detail specific targets to work on. The idea is to provide meaningful growth to the person and their capabilities, with an eye towards expanding their role. Over time, having and meeting these growth goals will result in overperforming as the individual fills that expanded role more and more.

[0] Caveat: I would expect a junior-level to be growing. So juniors who are not overperforming are worrisome.

[1] There's a bit of issue here in team vs individuals. Generally, as long as the team is successful, I tend to err on the side of overrating individuals. After all, part of the reason we make teams is to allow them to shore up weaknesses and play to strengths. However, I leave in an out by having a baseline goal centered on teamwork and team success. So if someone is not contributing as expected to the team, there's something to call them out on.

</comment><comment><USER52> I'm surprised at the references to OKRs as a part of performance reviews. Yes, OKRs have elements of focusing and measuring progress, but they are also about encouraging people to be ambitious and communicating intent.

It's generally accepted that using them for performance reviews is a bad thing because it encourages people to be conservative and create hackable key results.

</comment><comment><USER53> My experience: Most of the time, all it takes , is to beat the system..

In one of the companies I worked for : one hand we were doing marvels in automating stuff and repetitive work which saves ton of manual efforts and reduces human errors , and guess what ! its not even accounted for in the standard goals..

Sometimes you need to stare at the bullshit and say here we go and beat the crap out of it..

</comment><comment><USER54> Tangent: Are there any good books or articles on how to find the answer to this question within your own company as applied to yourself?

</comment><comment><USER55> To my knowledge there is no performance management as such (at least in my subsidiary). We have a mandatory quarterly review, but it's intent seems to be to maintain the manager-employee relationship to at least a bare minimum, and to offer a platform to collect data if someone is really, really not pulling their weight.

</comment><comment><USER56> At my previous company, performance management was a show they put on to get a story to tell when it was time to discuss compensation. Lack of performance resulted in firing without warning. Performance assessment gave information about their reading of the job market and the risk you'd jump ship.

</comment><comment><USER57> Just to clarify: what kind of goals do you mean? Is the context people management or anything in general?

<comment><AUTHOR> People management. Goals for staff. Thanks!

</comment></comment><comment><USER58> Most of the answers I would give to your questions are in this post: [https://ivypanda.com/essays/performance-management- essay/](https://ivypanda.com/essays/performance-management-essay/)

</comment><comment><USER57> Shameless plug about goal setting: [https://ochronus.online/goal- setting/](https://ochronus.online/goal-setting/)

</comment><comment><USER59> Everyone got a 3 rating every quarter. Pointless.

</comment><comment><USER60> Survival of the fittest: after being at the lowest 10% for three of five years, you get washed out

</comment><comment><USER61> We used Google Sheets. Honestly, it appeared that culture was more important than tooling here.</comment>


Let's Encrypt client will transition to a new name and a new home at EFF - <AUTHOR> https://letsencrypt.org/2016/03/09/le-client-new-home.html <comment><USER2> > Another reason is that we want it to be clear that the client can work with > any ACME-enabled CA in the future, not just Let's Encrypt.

Great to see that they are actively aware of CA monopolization, and taking steps to avoid becoming one themselves.

</comment><comment><USER3> Anyone looking to use Let's Encrypt and free to make choices regarding their server may want to check out [https://caddyserver.com/](https://caddyserver.com/) \-- it has Let's Encrypt support baked right in.

<comment><USER4> I've said it before when caddy was last mentioned, but _this_ is how I want Let's Encrypt to work with all web servers. Yes. That includes the big ones like nginx, apache and even IIS.

By default, all that's needed is to turn on ssl and you'll be up and running - including a let's encrypt certificate.

Following this vision is why I believe that let's encrypt limited the validity period of their certs (in addition to some security benefits and much lower OCSP load): Once the integration into clients has proceeded to this level where caddy is showing us it's going to, then even quicker expirations would become feasible - heck even as low as a week or so.

So, while I'm not planning on using caddy any time soon (I don't see a benefit to switching away from nginx right now), I applaud caddy for showing everyone how this should be done.

A huge thank you to the author. This goes to show how very important UX is even for backend-y stuff.

<comment><USER5> Thank you for your kind remarks. :) It goes a long way to keeping the burnout away.

</comment></comment></comment><comment><USER6> If you were like me and holding out on Let's Encrypt until Windows XP is supported (even Chrome is still broken on XP) it looks like a date of March 22nd has been set for "getting new cross-signatures from IdenTrust which work on Windows XP."

[https://letsencrypt.org/upcoming-features/](https://letsencrypt.org/upcoming- features/)

[https://github.com/letsencrypt/letsencrypt/issues/1660](https://github.com/letsencrypt/letsencrypt/issues/1660)

<comment><USER7> Why on earth are you still running Windows XP?

<comment><USER6> I haven't met many of these people to ask them, but I know they still exist because of their user agent containing "Windows NT 5.1" and I know for sure they aren't all bots, and many of them even live in Southern California. I suspect these are the people who would be most confused by websites failing to load.

The cost of providing support then is much greater than the cost of a Comodo certificate.

<comment><USER7> I see. It's a shame you can't intercept the error and display your own along the lines of "upgrade your damn OS already!"

<comment><USER8> It's not the OS, just Internet Explorer. And an upgrade to the OS isn't free.

<comment><USER9> Are you sure about that? I assumed it would be affecting SSL verification in WinInet/WinHTTP (and so affect any applications using that stack)...

</comment></comment></comment></comment></comment></comment><comment><USER10> Previous post: [https://news.ycombinator.com/item?id=11253570](https://news.ycombinator.com/item?id=11253570)

<comment><USER11> Previous post with zero comments. Who cares?

<comment><USER12> _jomo, who submitted it. It's "I submitted this already but wasn't the one who got the fake internet points."

_jomo, it happens. Don't worry about it.

</comment></comment></comment><comment><USER13> Let's encrypt really helps get ssl everywhere. It is not super easy to set it up, but I am sure this will get better as time goes, this is huge.

<comment><USER14> Let's Encrypt makes an effort not to use "ssl" anywhere on their site when they really mean tls or https. I'd also hope that no one helps get ssl anywhere given the vulnerabilities that come with it.

<comment><USER13> Can you explain me a little, I am not sure I understand all the points. I can't say I follow everything that is happening in crypto world, I just know I could use free ssl cert for small sites and I have one personal one that I was able to 'secure' with Let's Encrypt cert.

As someone said, if it could work, just by saying SSL yes, it would help a lot.

<comment><USER5> Technically, SSL is the name of the older protocol that TLS replaced. TLS builds upon SSL so that it's more secure. Unfortunately, SSL is still the ubiquitous term, it seems, but we really should start saying TLS now so as not to confuse unsuspecting site owners / sysadmins.

</comment></comment></comment></comment><comment><USER15> Does that mean that they also intend to develop a client for IIS?

It would be great if Microsoft was doing that themselves instead. That the Let's Encrypt client would come by default out of the box.

</comment><comment><USER16> Missed opportunity to move beyond the reach of NSLs.

<comment><USER17> What are NSLs?

<comment><USER18> [https://en.wikipedia.org/wiki/National_security_letter](https://en.wikipedia.org/wiki/National_security_letter)

Incidentally, moving out of reach of NSLs just means you're now in the reach of the CIA/NSA with no need for a warrant.

<comment><USER19> And within the reach of other governments likely to be equally (if not more) meddlesome.

</comment></comment></comment></comment><comment><USER20> Need to refresh the cert every 3 months, need to pick a new name every 3 months too?</comment>


Building a Botnet on ServiceWorkers - <AUTHOR> http://sakurity.com/blog/2016/12/10/serviceworker_botnet.html <comment><USER2> I opened the js fiddle and I can't see any Service Workers running in chrome inspector. Also, since that seems to be an actual image, how does the JS get executed? I see a Link header, but why would something get executed because of it?

Edit: Oh, it's running indeed ( chrome://inspect/#service-workers )

<comment><USER3> IIRC, service workers allow you to intercept all requests made by the page, for the purposes of implementing offline caching.

<comment><USER2> Right, but you need to execute some JS to set them up, and the example only shows img tag.

<comment><USER4> No, the Link-tag with rel=serviceworker on the image response installs the service worker. Not clear (to me) if that's part of the origin trial or not.

<comment><USER5> The link tag with rel=serviceworker behaviour here is part of 'Foreign-Fetch' \- an experiment too allow third-parties to install a serviceworker e.g. analytics provider could install a SW that handles analytics offline so a developer doesn't need to.

I think the origin-trial for this expires early next year.

[https://developers.google.com/web/updates/2016/09/foreign- fe...](https://developers.google.com/web/updates/2016/09/foreign-fetch) [https://groups.google.com/a/chromium.org/forum/#!topic/Blink...](https://groups.google.com/a/chromium.org/forum/#!topic/Blink- dev/sIzHpZVhmBE)

</comment></comment></comment></comment></comment><comment><USER6> Just launched Wolfpack, a little botnet (distributed task-based agents). You can check it out here: [https://github.com/dpgailey/wolfpack](https://github.com/dpgailey/wolfpack)</comment>