A Bug in the Bug Bounty - <AUTHOR> http://engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/ <comment><USER2> Anecdotally I was snubbed at a younger age when the school district was looking for a security system to prevent manipulating school grades. My suggestion was to remove the disk pack (ok so it was a while ago) that contained student records while the students had access to the system via dialup, and replace it at night when the various accounting programs ran (attendance, grades, etc). Imagine my surprise when the contest ended with no winning solution, but oh by the way we've changed our policy and will not make the student grades data available during the day.

We did get them finally fess up that it was my suggestion which they had adopted and they gave me the prize (which was a $250 scholarship as I recall). But it has never ceased to amaze me that people don't think of security as holistically as they should.

<comment><USER3> In today's world, you'd be expelled...

[https://www.google.com/#q=expelled+for+reporting+security+bu...](https://www.google.com/#q=expelled+for+reporting+security+bug)

<comment><USER4> Doubtful. He didn't say he had hacked the grades or accessed the information in any way, just left a suggestion at the school's request.

</comment></comment></comment><comment><USER5> Prezi's apparently trying to cover their posteriors in the wake of Shubham's disclosure and subsequent snub ( [http://blog.shubh.am/prezi-bug- bounty/](http://blog.shubh.am/prezi-bug-bounty/) ).

 _" We greatly value this feedback."_

Weak sauce. Shubham's disclosure saved Prezi from a future nightmare. If they're not going to pay him from the bug bounty coffers, they should at least try and sound more like grateful humans rather than a pissy HR department trying to do damage control.

<comment><USER6> I think that's a bit harsh. I read the full email exchange he posted at the end of his article[1], and they went to some length to explain their position at the end of that exchange, and while I and many other wish it was different, I find their position _understandable_. With any number of past security submissions already deemed inadmissible for a bounty based on being out of bounds, how do they justify doing it in this one case? I think they were heading this direction anyway, and if anything this just sped up the time frame.

1: [http://blog.shubh.am/wp- content/uploads/2013/12/LetterLog_Pr...](http://blog.shubh.am/wp- content/uploads/2013/12/LetterLog_Prezi.pdf)

<comment><USER7> So they screwed up in the past and those screw ups should be used to justify this one, their position is understandable but in any case they can use their discretion to make up for it and it should not take one person to blow something out of proportion and force them to make this change.

</comment></comment></comment><comment><USER8> This is a trite response to an actual concern: Placing scope limits on bug bounties is meaningless and dangerous. Hackers will not respect your scope. The scope of a bug bounty program should always be "Anything that affects our, or our users, data or security".

There's plenty of non-entities that get reported: Failures of XSS protections on data that is actually public, vulnerabilities on vendors sites that don't impact your data, etc. Those should be dealt with with a polite thank you. Everything else should be valid, and everything else should be paid. Possibly not high-tier paid. Have your security team (You don't have a security team? Make one, even if it's just the coder from your team who has the most experience) triage and report. Fix things, or don't, but don't be an asshole and try to downplay real issues.

<comment><USER6> I think that oversimplifies the problem. I think a scope helps keep overeager researchers from doing things that result in legal problems for the company. For example, are laws that require notification of data breaches and personal identification triggered in certain cases? This isn't an academic setting, these are real businesses.

I think the best of both worlds would be very wide scopes with targeted limitations. Don't log into user accounts or company accounts at other services, but here's a few sample user accounts that are fair game and if it's an external service, here's a rep to vet whether credentials you gathered are correct or not.

</comment></comment><comment><USER9> Let's all agree that had Shubham not posted what had happened prezi wouldn't have done anything. This is just a PR stunt to save face.

<comment><USER10> No, I'm not going to agree. From Shubham's post it looks like they were already planning to expand the scope of their program in response to his findings. This is from their email to him on Nov. 4, a full month before his blog post:

 _First of all, we 're still very thankful for pointing this issue out. The credentials you found were real threat. I agree when you write it was easy to exploit._

[...]

 _When we created the terms and conditions, we tried hard to add every web app which we have impact on, and where a reported issue is a value for us. At that time we weren 't thinking of leaked password or such. In the past we turned down the bounty request of people finding issues in out-of-scope services. We had a lot internal discussions about your request: if we were about to pay, we couldn't justify our out-of-scope decisions for anyone else._

It seems reasonable from that email to assume they were discussing this incident seriously and thinking about how this would affect future bug bounties. I am willing to give them the benefit of the doubt unless you have a strong reason otherwise. When the matter was private between them and Shubham they issued a private apology and explanation. Now that Shubham has made the issue public they have issued a public apology and explanation. This is an appropriate response, not just a PR move.

</comment></comment><comment><USER11> I haven't been following this story that closely but I just don't understand why they don't pay him outside the bug bounty.

"Sorry this security hole wasn't in our bug bounty but we'd like to give you the reward anyway. Please sign these legal documents and let us know if you find anything else."

There is so much you can do by just being reasonable. Like if Prezi said they can't officially acknowledge it under the bug program but can just pay out some sort of reward it makes way more sense.

Besides. If the bug was in the code under a subdomain that someone exposed source code it would be the same thing.

<comment><USER12> You've been following the story _so_ un-closely that you didn't even notice that _this article_ says that's exactly what they _are_ doing

</comment></comment><comment><USER13> Never even heard of Prezi before this. If anything, they should be thanking this guy for all the free publicity.

<comment><USER14> That is if they're not paying him for it.

</comment></comment><comment><USER15> Kudos to Prezi. They were not obligated to respond this way but they chose to, and I think it is the best response they could have made. I particularly like their statement that they would look to see whether anyone else had found volunteer abilities that also should be rewarded under the new program.

<comment><USER16> really? I think they were obligated - in the interest of not losing face among the hacker community after Shubham's post. If anything this was just a PR move more than anything else.

</comment></comment><comment><USER17> Why don't you just pay him for the service he provided you? Is your bounty that high that you can't afford to?

It seems the negative publicity you are getting is going to cost you more..

<comment><USER10> It seems reasonable to assume that they will pay him:

 _To improve the program from now on we will reward bug hunters who find bugs outside of the scope provided [...] We will also retroactively check to see if other reports found issues that fall into this category._

</comment></comment><comment><USER18> They are paying to Shubham. The original post is updated with the emails regarding that. [http://blog.shubh.am/prezi-bug- bounty/](http://blog.shubh.am/prezi-bug-bounty/)

</comment><comment><USER19> I find it more respectable now that I see that Prezi actually posted a public blog post acknowledging their fault in their bounty program.

Still, I have to side with Shubham. They should at least reward him now.

</comment><comment><USER20> The guy finds the company source code wide open and notify them and they treat him like that?

Whats up with those people ? They have lost their brain ? or is that inflated egos ?

</comment><comment><USER21> a blog? I actually expected this to be in a prezi.

A few months ago we launched a [Zoom/Pan] Bug Bounty Program

</comment><comment><USER22> The last time I checked Prezi was extremely buggy to the point of being unusable. So they should be very thankful for any bugs reported. Probably their app usability is the consequence of not responding to the user reports.

Are they still relying on adobe flash when everyone else moved on?</comment>


Ask HN: Who owns my senior design project? - <AUTHOR>

I'm working with three others on a senior design project for our "customer" who is from outside our university. Once all is finished, I wanted to post the source to Github for potential employers to see, but I'm not sure if I will be able to (my group members are okay with it). I haven't asked our professor about IP rights, but other students have in the past and basically received a non-answer. Any thoughts? What is typical in this situation? <comment><USER2> The startup I'm working on now sprung from my senior design project. In our case, our "customer" was a local startup incubator. Their goal was not only to mentor the project, but help us turn it into a business (so retaining ownership of it was critical). We investigated the IP stuff from the outset. After some informal conversations at our school and others, we determined that they mostly don't care about undergrad projects, and we can do whatever we wanted with it.

Most research universities have IP and commercialization people (our school included), but the purpose of that activity is limited mostly to faculty and grad student projects since those projects often require some non-trivial resources from the university (so they want some ROI). Nearly every undergrad project that a student might claim ownership of doesn't require any school resources beyond the standard stuff (maybe you used lab computers to host your site or code repository for a little while during the semester -- not a big deal).

I think in your situation, since you just want to use it as a portfolio piece, I agree with noahc: just post it, but take it down if asked. If you wanted to use the IP for something that might create significant value (read: you'd make enough to make it worth it for the school or the "customer" to sue), I'd ask first and get something in writing (with the help of lawyer, if possible).

</comment><comment><USER3> My school's policy (at least to my understanding) was something along the lines of this:

* You're not paid, so it's not their property

* The customer receives all rights to use the software and the source code in order to modify, but they can't sell it (requirement for making it a senior design project), otherwise they'll make $$$ off free labor.

* You are free to use your code/design in portfolios since you created it.

* No NDA's from any party (school, students, or companies)

</comment><comment><USER4> This is more of a cowboy opinion (as in what I would do) than anything else.

I would post it. They aren't going to sue you unless you refuse to take it down. If they ask, take it down.

Of course this is contingent on there really being nothing in the contract.

</comment><comment><USER5> Is the customer paying for the solution or the code? What are there expectations? Why type of license is attached to the project you created? if any.</comment>


Fast Food Robots Steal McJobs - <AUTHOR> http://www.thefiscaltimes.com/Articles/2011/06/06/Could-Fast-Food-Robots-Steal-McJobs.aspx

<comment><USER2> As automation picks off the low skilled jobs we need to seriously start to raise the level of skill in the workforce. Trouble is that will take money, motivation and won't see results in an election cycle so I doubt anything will happen.

I wrote a little bit about it some time ago: [http://www.marcus- povey.co.uk/2012/04/03/education-skills-sl...](http://www.marcus- povey.co.uk/2012/04/03/education-skills-slavery-and-why-were-probably- screwed/)

<comment><USER3> Good article. I agree 100%, except for:

 _Bluntly, if you don't have training in sophisticated and marketable high tech skills, you likely will be out of work soon and will also likely never have a job again._

There are sophisticated, marketable non-high-tech skills that will continue to do fine. Doctors, lawyers, and so forth. But in general yes, you'd better skill yourself up or you are screwed.

Also the conclusion isn't so easy: 'get out while you still can'... and go where? This problem is global, as all the big ones are these days :-)</comment></comment>


The best of sci.space.* - <AUTHOR> http://yarchive.net/space/

<comment><USER2> This makes me very sad that I am too young to have experienced the glory days of usenet.

</comment><comment><USER3> This is not quite a perfect "best of", it's extremely biased toward a few authors. But those authors (Henry Spencer, George Herbert, Paul F. Dietz, a few others) have an exceptional track record so the result is still an amazingly high quality collection of posts.

I really miss usenet, there was a time when it existed in a sweet-spot that fostered some quite excellent discussion. I believe HN is the closest analogue in the modern day but it's a pale shadow of usenet at its best, in my opinion.

<comment><USER4> I have very vivid memories of two particular usenet posts:

\- Reading about a thing called "Mosaic" on alt.hypertext in early '93 when I was actually tasked with finding a hypertext browser for the project I was on. I remember thinking "Sounds cool, but why would I want to load documents over a network?"

\- In '95 reading a post about a project called "Oak" at Sun that involved a guy that I vaguely knew, sending a begging email to Sun got me a very early copy of Java</comment></comment>


Arviz: Python package to plot and analyse samples from probabilistic models - <AUTHOR> https://github.com/arviz-devs/arviz <comment><USER2> A bunch of others and myself contribute to this project! Let us know if there's any questions</comment>


For Sale: A Massive, Obsessive and Probably Obsolete VHS Boxing Archive - <AUTHOR> https://www.nytimes.com/2019/03/22/nyregion/boxing-vhs-archive.html <comment><USER2> As someone who frequently researches obscure and obsolete topics (but in a different subject area), I very much appreciate the efforts of people like her. Especially for older topics, Google is often silent, archive.org has little, but going to a physical library will yield much better results.

I wonder if the Internet Archive would be interested... but then again, it usually takes donations and doesn't purchase material.

 _Just about every fight was available online_

...but is it really? That's the good thing with specialist collections like this: they're very thorough.

<comment><USER3> >... but is it really?

It might be, and it probably won't be in 5 years whenever some copyright troll purchases the license and locks it away. Then 25 years from now someone will come across this article and wish, in vain, that someone had saved this collection.

I don't have any interest in boxing, but there's a special place in my heart for amateur archivists. It makes me sad to think this work will eventually be lost to history because of shortsightedness.

Would love for the Internet Archive to digitize and hold on to them.

<comment><USER4> To me the article evokes the existential futility of trying to achieve anything everlasting. Living humans cannot carry the past history of all those gone before -- at best, there is a continuing process of loss and compression.

From the article:

> _" Before he died, he told me: 'The collection is going on forever. It has > to go on,'"_

How cruel.

<comment><USER5> Then ought not we ask, are we contented with a selective reading and understanding of all those that have preceded us, especially those of small repute and those that had insignificant impact on that history?

And following from that, the factors that contributed to that insignificance in the first place - things like scant media exposure, lack of coverage by mainstream outlets being just two of a whole slew of other factors we may never fully capture or fully grasp.

I guess in the end we are posed with the question, are we okay with that "process of loss and compression."

</comment></comment></comment></comment><comment><USER6> Seems like exactly the type of trove that the Smithsonian Institution would be interested in: "Termed 'the nation's attic' for its eclectic holdings of 154 million items, the Institution's nineteen museums, nine research centers, and zoo include historical and architectural landmarks,"

[https://en.wikipedia.org/wiki/Smithsonian_Institution](https://en.wikipedia.org/wiki/Smithsonian_Institution)

</comment><comment><USER7> I've had this vision of being able to watch 90s cable as it aired (channel flipping). This would entail a project wherein people en masse would send in all their VHS and in return for free digitization we would be able to keep the archived video to recreate cable airtime. I know it's impossible, for copyright/privacy issues, but stories like this make me think it's technically feasible. The material is out there.

<comment><USER8> There's a website like this. You can only flip through a few channels, and there's no guide, but it was long format recordings including commurcials. Ah! Why can't I think of the name. Maybe keep looking? Sorry this isn't more helpful, but maybe just knowing it's there will help.

<comment><USER9> I reckon you're looking for [https://my90stv.com/](https://my90stv.com/) :)

<comment><USER10> Wow that was an interesting 5 minutes of my life. Does U.S. TV still have so many pharmaceutical ads?

<comment><USER11> Yes, probably more. Glossy and strangely happy visuals as a list of side effects is being read. I don't watch a lot but still have over the air tv, and it seems to be bankrolled by drug ads.

</comment></comment></comment></comment></comment><comment><USER12> This brings back memories from my childhood when my father would spend his weekends drinking Michelob, gnawing on a massive stick of pepperoni, and watching sports on television.

Boxing, bowling, and several other sports that were mainstream then and available all the time on free, normal, mainstream TV that are only niche online or pay cable things now.

<comment><USER13> I loved watching golf, curling and bowling on the weekends as a kid. I'd read math and physics books with those programs running in the background. The announcing for curling was like holding the event in the reference section of the library.

</comment></comment><comment><USER14> As someone suggested, the Smithsonian or the Library of Congress can accept a donation for a tax deduction, so a person of wealth can buy it from her for $$ she can live on and they get the 40% or so deduction on the donation. Needs some appraisals by third parties to make it work, but it is doable and can be staged over a few years.

</comment><comment><USER15> I can relate. I have every cable broadcast of WWE (WWF back then) from around 1996 to 2001 on VHS.

</comment><comment><USER16> "any individual or organization would need to embark on a lengthy and expensive digitization project for them to be usable in the longer term."

Lengthy, yes, expensive, no. All you need is one of those video capture USB devices from Amazon, a computer, and a VCR.

8000 2 hr tapes will fit on a couple of 10T drives, and storage will no longer be a problem.

<comment><USER17> I did this kind of thing in college. It's more involved than you think. If you want good results, you're going to need at minimum a professional VCR (We used the Panasonic AG-7350), a timebase corrector, and a professional grade digitizer. Luckily, the equipment is much cheaper than it used to be. You'll probably need a food dehydrator to bake sticky tapes for one last playback. And since tape that old is probably falling apart, you'll need to get good at cleaning heads with cotton tech wipes and ethanol.

<comment><USER16> I've done it for a hundred or so old tapes. It is not so involved. I used thrift store VCRs and an Amazon USB video capture device. Almost all the old tapes play just fine. If the tape has gone bad, it's gone bad. Just toss it and move to the next one.

Yes, you have to clean the heads now and then with a qtip and ethanol. No skill required. Usually just running one of those head cleaner special tapes does the trick just fine. I never had a sticky tape. I have had broken cassettes, but the fix was just taking it apart and moving the reels to an unbroken cassette. Once I had the tape itself break, and a bit of scotch tape got that working again :-)

The results are plenty good enough. My relatives were quite happy to be able to see their old home movies again by clicking a button on their Roku rather than wrestling with their long lost VCR or 8mm camera.

Seriously, this isn't rocket science. It's much easier than recording LPs onto cassettes.

The result will be converting 8000 tapes and their storage problems to two 10T drives, which aren't a burden to store. Though you should copy them to new drives every year or so.

Saying one doesn't have $100,000 to do a 2% better studio job, so throw all the tapes in the trash, is a choice I don't understand.

<comment><USER18> Most of the cheap ways of capturing analog video will end up dropping half the image data before the process even starts.

At a _minimum_ , full SD-resolution capture is necessary. 480 lines and whatever seems reasonable (for VHS, doubt there's much of a difference between 640 and 704/720).

Capture such material at 240 lines and you might as well not be capturing it at all.

It's somewhat involved to make archival-quality digitizations.

<comment><USER16> Elgato video capture captures 640*480 and is $90. I have it, use it, and it produces very satisfactory results.

</comment></comment></comment></comment></comment><comment><USER19> In Portland, the Hollywood Theatre recently bought out Movie Madness, a classic SE video store boasting a wide collection of film media.

The purchase was made using a very successful kickstarter campaign. There was some talk at the time of the actual value of the physical collection, though.

</comment><comment><USER20> I've always wondered if in future an archive like this can be used to train a machine learning powered cyborg boxer or even a robot boxer. This could be one of the incentives for preserving this archive. Surely with AI set to replace a lot of workers, boxers will also be affected

<comment><USER21> Youtube has lots of unboxing videos. Maybe one could just play these backwards, and then the robot/cyborg will learn how to properly box stuff instead of unboxing it. Google's ML division could do it very easily since they basically own the video archive already.

<comment><USER22> If only Google could solve the issues with natural language parsing in humans.

But interesting point nonetheless.

</comment></comment></comment><comment><USER23> Try the Museum of Broadcast Communications in Chicago.[1]

[1] [https://museum.tv/donate%20an%20artifact.htm](https://museum.tv/donate%20an%20artifact.htm)

</comment><comment><USER24> Sometimes I try to think back on what my last watched VHS or heard CD was. I'm sure it was something exceedingly dumb from blockbuster.

</comment><comment><USER25> She is doing conservation as an archivist.

The content should probably be put on the Internet archive

</comment><comment><USER26> What are they asking for it? (I was paywalled) (and didn't have time to incognito)

</comment><comment><USER27> Makes me wonder if there is some value in converting these to digital, then running each scenario through some kind of Machine Learning setup. Learn what makes for successful v. unsuccessful from a tactics perspective.

</comment><comment><USER28> If you want to move your product, try "For Sale: Training Dataset For Killer Robots."

Or... maybe that's just my paranoia acting up again.</comment>


Google News Timeline Offers A New Way To Search The Past - <AUTHOR> http://www.techcrunch.com/2009/04/20/google-news-timeline-offers-a-new-way-to-search-the-past/ <comment><USER2> A little bit of an upgrade from Microfiche. Well done.</comment>


Product Creation: Have you got what it takes? - <AUTHOR> http://nordicnerd.blogspot.no/2012/08/thoughts-on-product-creation.html

<comment><AUTHOR> I hadn't planned on posting any articles to Hacker News at first, but after I wrote this blog post (mostly just to distill my own thoughts) I realized that it might be of interest to other people, so here it is!</comment>


Python Hash Tables: understanding dictionaries - <AUTHOR> http://thepythoncorner.com/dev/hash-tables-understanding-dictionaries/ <comment><USER2> I suppose this isn't a bad introduction to hash tables, but I would assume that most HN readers know how to implement a hash table. It seems like talking about fundamental CS concepts in.. _Python_ is a perennial source of quick and easy blog posts for a lot of people.

<comment><USER3> Anecdata: I don't know how to implement a hash table, but I know how to use them. Not everyone here has a CS education background.

<comment><USER4> If you're interested in implementing a hash table I would assume you're also generally interested in data structures and algorithms. I'd highly suggest the Algorithms, Part 1 class on Coursera. It's totally free and offered through Princeton. It covers hash tables in the last segment, albeit implemented in Java, but still very thorough and is a great introduction to common data structures/algorithms and analysis, like linked lists, union find, trees, quick sort and time/space complexity. [https://www.coursera.org/learn/algorithms- part1](https://www.coursera.org/learn/algorithms-part1)

<comment><USER5> What level of math does one need to understand to take this course?

<comment><USER2> I've ignored math prereqs my entire life and turned out fine. If you're genuinely interested, it's not too hard to learn the math as needed. It might actually be a better way to learn, because you're learning is always in service of other learning.

I haven't taken that Coursera course, but in college, I believe only calc I and II are the prereqs for intro to data structures and algorithms. Though I know solid engineers who understand applied CS who don't have a good grasp of math at all.

<comment><USER3> > It might actually be a better way to learn, because you're learning is > always in service of other learning.

Me in freshman calculus: Why are we learning these Taylor series? It's so boring, and I'll never need to use it

Me three years later in upper-division meteorology: It turns out 90% of what we do is numerical methods because fluid dynamics is hard with limited data.

It's definitely easier for me to learn things when I have an application for it.

</comment></comment></comment></comment></comment></comment><comment><USER6> Raymond Hettinger, Modern Python Dictionaries A confluence of a dozen great ideas: [https://www.youtube.com/watch?v=npw4s1QTmPg](https://www.youtube.com/watch?v=npw4s1QTmPg)

</comment><comment><USER7> FYI, the formatting of several of the Python code blocks is messed up, starting with lines like this:

```python linenums="21" def get_value(self, input_key):

Also, might be worth noting that the "The Pythonic Implementation of Python Hash Tables" section seems to cover either Python 3.6 or 3.7, and that the implementation seems to have changed a bit in 3.8: now `sys.getsizeof({}) == 64` and `sys.getsizeof({"a": 100}) == 232`. Does anyone have the low-down on how it's changed and possibly how it's likely to change again in future versions?

<comment><AUTHOR> I tried to fix it, let me know if it's broken again... It's not super easy to check by myself because I'm not at home and I'm working with my phone... :D

</comment></comment><comment><USER8> Formatting of several of the code segments is borked.

It should be mentioned that a Python set type is basically a naked hash table, or a dictionary with all keys and no data.

As noted, in 3.6 dicts are ordered, but in 3.8 they can be reversed(); and in 3.9 the new merge and update operators are added:

[https://docs.python.org/3.9/whatsnew/3.9.html#dictionary- mer...](https://docs.python.org/3.9/whatsnew/3.9.html#dictionary-merge-update- operators)

<comment><USER9> > It should be mentioned that a Python set type is basically a naked hash > table, or a dictionary with all keys and no data.

Python's set and dict are actually completely different codebases. Notably, the naturally ordered hash table of 3.6 dicts is _not_ used by or for sets.

<comment><USER10> In case anyone is curious, sets were dicts in the original implementation: [https://github.com/python/cpython/blob/a690a9967e715663b7a42...](https://github.com/python/cpython/blob/a690a9967e715663b7a421c9ebdad91381cdf1e4/Objects/setobject.c)

It was changed in 2005 for python 2.5 [https://github.com/python/cpython/commit/9f1a6796eb83a2884df...](https://github.com/python/cpython/commit/9f1a6796eb83a2884df5fd93487634e46d8830a7)

</comment></comment></comment><comment><USER11> So not the best article and advocates for md5? Also full of ads. Why is this getting traction?

<comment><USER12> This is not advocating for md5. :/

<comment><USER13> This does introduce hash functions, list MD5 and other cryptographic hash functions as examples, and then go on to explain how hash functions are used in hash tables.

Not advocating for MD5, but it does strongly imply the use of cryptographic hash functions for hash tables, which is almost never the case, and a useful distinction to explain.

Cryptographic hash functions are trying to make the original data unrecoverable in any way, and essentially distributing as evenly throughout their output space as possible. They are also often trying to be slow to compute to prevent brute forcing.

On the other hand, hashing for a hash table doesn't need to be secure in the same way (hence Python's smaller bits just returning themselves as their hashed values). They also don't need to distribute themselves evenly. They need to be fast, unlike a cryptographic hash, and they need to restrict the data to a fixed size.

<comment><AUTHOR> Yes, maybe I haven't been clear, I tried just to explain what an hash is before introducing hash tables, if someone understood that cryptographic hash functions have to be used for hash table it's probably because my explanation wasn't clear enough... :(

Consider that I'm not a native speaker, so sometimes it's hard for me to send the exact message I would like to send... I will try to explain it better as soon as I will get anywhere I can use a computer :)

Thanks!

</comment></comment></comment></comment><comment><AUTHOR> I'm really sorry for the ads guys, but this is a small site that lives thanks to them... I wish I could avoid them and live just with donations but it isn't possible yet.

Moreover, I don't know anything about SEO or stuff like that so the ads are configured automatically (I went to the AdSense dashboard and clicked on the "do whatever you want" button!!! :D )

However, I will try to limit the ads in the next few days understanding with the AdSense reports which one are not bringing earnings and can be removed.

Thanks for the feedbacks!

<comment><USER14> On mobile the ads are a bit too close to be completely comfortable, but they're definitely not overly annoying either.

The article is a nice introduction, the rest of the website looks great and you don't seem to have included any of the modern stupid annoyances that will make me hate you (in-page popups, notification request, app install banners, chat bubbles).

Thanks for the article!

</comment></comment><comment><USER15> Ugh. Full of ads and full of inaccuracies.

To learn about Python's dictionaries, I'd recommend watching the talks by Brandon Rhodes and Raymond Hettinger.

<comment><USER16> Any talks you recommend in particular?

<comment><USER15> The talks by Brandon Rhodes are these two:

* The Mighty Dictionary (PyCon 2010): [https://www.youtube.com/watch?v=oMyy4Sm0uBs](https://www.youtube.com/watch?v=oMyy4Sm0uBs)

* The Dictionary Even Mightier (PyCon 2017): [https://www.youtube.com/watch?v=66P5FMkWoVU](https://www.youtube.com/watch?v=66P5FMkWoVU)

There's also one by Raymond Hettinger, which seems to have been given first at a meetup and then, in shorter form, at PyCon 2017:

* Modern Dictionaries: [https://www.youtube.com/watch?v=p33CVV29OG8](https://www.youtube.com/watch?v=p33CVV29OG8)

* Modern Python Dictionaries - A confluence of a dozen great ideas (PyCon 2017): [https://www.youtube.com/watch?v=npw4s1QTmPg](https://www.youtube.com/watch?v=npw4s1QTmPg)</comment></comment></comment>


Zferral.com: lean marketing for your business - <AUTHOR> http://blog.zferral.com/post/4003870381/zferral-com-lean-marketing-for-your-business

<comment><USER2> Zferral is pretty great. I found them when I was looking for Rails-friendly affiliate software. Most of the popular affiliate tracking software out there is either really expensive or requires PHP/Smarty. There are a few UI snags, but it's still light-years ahead of NATS's UI.

<comment><AUTHOR> Thanks Jarin. We are actually launching a new UI based on feedback from our customers - it's been great chatting with so many of you!

<comment><USER2> Great to hear! I'm just glad I didn't have to build a whole affiliate thing myself (was getting frustrated with what was out there).

</comment></comment></comment><comment><USER3> I am a fan too! Considering the first blog post was back in Feb 2010, it has come a long way in this one year period. Good market, not too crowded! Nice app! Way to go!

</comment><comment><USER4> Another endorsement for Zferral here. Awesome software and company.

<comment><AUTHOR> Thanks Antonio!

</comment></comment><comment><USER5> Excellent execution on a much needed product. We love it.

<comment><AUTHOR> Thanks TJ - we <3 BatchBook too :)

</comment></comment><comment><USER6> The team at zferral is amazing. Best customer service ever.

</comment><comment><USER7> I have nothing but positive things to say about the team that created this app. Good luck!

</comment><comment><USER8> Service looks great, but the text styling on that blog article is pretty tough to read.

<comment><AUTHOR> Its a template - any advice? I am happy to change it around.

<comment><USER9> The text does not contrast enough. And, although fairly popular, I don't like the white drop shadow thing at all.

<comment><AUTHOR> Excellent, thanks for the feedback - appreciate it.</comment></comment></comment></comment>


Ruby on Rails and the importance of being stupid (2009) - <AUTHOR> https://blogs.harvard.edu/philg/2009/05/18/ruby-on-rails-and-the-importance-of-being-stupid/ <comment><USER2> The follow up on Software Design Review: [http://philip.greenspun.com/software/design- review](http://philip.greenspun.com/software/design-review)

<comment><AUTHOR> Thanks! I've posted that as well — honestly, I believe that both of these are tremendously important accounts. We who have ears to hear, let us hear!</comment></comment>


Building a C64 Power Supply - <AUTHOR> https://gekk.info/blog/main/building-a-c64-power-supply.html <comment><USER2> Be sure to check the AC ripple on the output DC into a dummy load... if there's too much your 64 may be toasted.</comment>


Clump -- say goodbye to Makefiles - <AUTHOR> https://github.com/chkoreff/Clump/blob/master/src/README

<comment><USER2> gcc has an -MD switch.

Say goodbye to makefiles (if you're writing in C), and hello to writing clump.ini.</comment>


Twitter Growth Hacking Using Twitter Search API - <AUTHOR>

I submitted this tool earlier and you guys liked it. Today, I have some updates and a way to do the same without using this tool
Tweet Full (http://tweetfull.com) a tool that helps you get leads from Twitter. Instead of making this post a plug for it, I am going to give away the secret sauce so that you can use it without paying for the tool.
One thing that has worked wonders for me when it comes to marketing on Twitter is to feed my customers' ego.
I used Twitter advanced search to find people who were Tweeting with my keywords of interest. Then I would engage with those Tweets by simply Favoriting or RTing those Tweets. This was not as obtrusive as starting a conversation with them, yet it made them curious enough to check out my profile.
Then I would use a pinned Tweet with a great call to action (20% off right away) that would encourage them to click on my link. I also had a link to the startup/product I was promoting.
My Twitter analytics showed me crazy growth doing this. I was getting 2-3X impressions spending only an hour or so doing this. You can use this method for your own use without paying anybody.
Then I thought of automating it and someone posted on Reddit about Tweet Full (http://tweetfull.com). It had additional bells and whistles like I could search for people with certain words in their Twitter Bios (Twitter search doesn't do that), filter by their Klout score and most importantly ability to pick Tweets with certain sentiment. It is a decent growth hacking tool for Twitter that produces results.
With Tweet Full I am getting over 70K impressions on my profile a month and 1-2% of these people engage with me via Tweets. I use Tweet Deck to keep up with all of the accounts I manage and to engage in a conversation with those who Tweet Back at me. Many times it is automated "Thank you for Fav" Tweets but many a times I have gotten legit customers.
Hope you like it. <comment><USER2> Definitely would suggest going beyond the Klout Score and implementing a mix of topics, topical scores, interest and influence into the Klout calculation. The raw Klout Score is a bit broader than necessary for lead qualification and relevance.</comment>


NASA video game lets you build, run complex space network - <AUTHOR> http://www.networkworld.com/community/blog/nasa-video-game-lets-you-build-run-complex-sp

<comment><USER2> I'd like to see a version of this based on Vinge's "A Deepness in the Sky" novel, where light-speed delay is a serious issue.</comment>


Updated Educational Raspberry Pi OS from Adafruit - <AUTHOR> http://learn.adafruit.com/adafruit-raspberry-pi-educational-linux-distro/occidentalis-v0-dot-2

<comment><AUTHOR> This is our second distro, Occidentalis v0.2. Rubus occidentalis is the black raspberry. It is derived from Raspbian Wheezy August 16. We have made a few key changes to make it more hardware-hacker friendly!

Version 0.2 updates (new!) • Truncated image - only 2.6G now to fit on any 4G card • raspi-config notice retained on boot • Removed persistant wlan0 entry • Password-change reminder on login • Added RTC and lm-sensors kernel module • Included kernel modules for: DS1307, AD626 I2C digipots, HMC6352, BMP085, ADS1015 • New! Adafruit's PWM/Servo kernel module for easy PWM/Servo control on GPIO#18

Version 0.1 updates (still included) • Updated to Hexxeh firmware • I2C and hardware SPI support • I2C/SPI modules initialized on boot • sshd on boot • ssh keygen on first boot • runs avahi daemon (Bonjour client) and is called raspberrypi.local • Realtek RTL8188CUS wifi support • One wire support on GPIO #4 when loaded</comment>


Cars are more complicated to engineer than airplanes or Space Shuttles (2010) - <AUTHOR> https://www.autoblog.com/2010/07/27/why-does-it-cost-so-much-for-automakers-to-develop-new-models/ <comment><AUTHOR> This article makes the bold claim that: ""Cars are far more complicated to engineer than airplanes and Space Shuttles. [Airplanes] don't have to be subjected to the same conditions customers subject cars to."

I work in the automotive industry and I would say this is false, Aero and Space are an order of magnitude more difficult conceptually and in terms of the organisation required to produce one.

Does anyone have any data points / anecdotes around this topic?</comment>


Fuel - A simple and flexible PHP Web Framework  - <AUTHOR> http://fuelphp.com/ <comment><USER4> Preface: I am the Founder and Lead Developer for Fuel

A lot of people are complaining, and saying things like we don't use namespaces properly. My response: Then don't use the framework. I started the framework because no current framework met my needs. Here are some of the reasons I did not simply use an existing framework:

CodeIgniter - Slow to evolve, requires a lot of code for simple things, nothing autoloaded (don't even try to mention the autoload config file.

Symfony2 - Over-complication of menial tasks, kind of slow.

CakePHP - Slowest (php) framework known too man, bloated, need I say more?

Zend - Slow, bloated.

Yii - Just don't generally like the syntax.

Kohana - There isn't much I don't like about Kohana actually...other than its not PHP 5.3 yet (not going into specifics on why this is bad).

DooPHP - Not full-featured-enough.

I also wanted things like HMVC (i know some of the above support it), Modular Routing and a few other things.

To the guy that said he was turned off by the Html class: if you don't want it, don't use it, stop whining.

<comment><USER5> I agree with your assertion to not use your framework. Believe it or not, having an open and active user base of your framework will help you and all members. Doesn't seem like you are attempting to start things off on a very good note.

<comment><USER6> I think you got him wrong. We've been at this for some time now and did some heavy development on this. Sometimes a person comes in and comments with a single line like "I WANT MORE NAMESPACES" and seems to assume that we picked our current setup without giving it a second thought. When someone comes around and all they can say is something as unmotivated and useless as that we won't have a lot of time for the assumption we didn't think of it.

If you completely disagree that's fine, move on to something else then - <USER2> hard feelings either way I hope. Just don't assume we just created this at random. Dan's remark was spot on, we chose the way we handle namespaces and autoloading very deliberately and we'll take the time to explain our motivations if you ask. But if you come in telling us that our setup sucks because we should be all-something because product X has that as well: don't expect we'll spend any time on you. There are lots of others with a more open- minded approach whom our time is far better spent on, and of course especially those actively helping out being the community you refer to.

</comment></comment></comment><comment><USER7> I've been following Fuel's commits ever since they were on GitHub, and it's been impressive watching it all come together. The only concern I have is with the overall tone of the project, influenced mainly by Dan.

There was one comment here about namespaces... Phil gave a detailed answer; Dan says 'if you don't like it, don't use the framework'. Someone brought up the HTML class... Phil explains why it's there and that it isn't loaded unless you want to use it; Dan says the same thing, but adds 'stop whining'. I think Dan is incredibly talented, but I've seen he is very quick to use the words dumb, idiot and retard in his Twitter stream.

As a mid-level developer that uses mainly CodeIgniter, there is a lot about Fuel that is new to me and I don't fully understand. If I were to start using Fuel and had maybe a dumb question about how something worked, part of me wonders if I'd be berated publicly or called an idiot. That doesn't make me want to rush out and start learning something new.

I'm really grateful to all the Fuel devs for busting their asses to release this framework, the one criticism I have is one of PR, and the supposed 'community-driven' aspect of it.

<comment><USER8> I understand this, really. Dan is under a great deal of pressure, as are we all. Most of the developers run several OS projects that have a large following, but when threads like this pop up it's hard not to get frustrate. Fuel already has an amazing community with an IRC already far more active and tolerant than any framework support I know.

Try asking a question in #rails. Chances are you won't even see anybody post for 3 days, and if they reply they'll call you a f __king noob.

<comment><USER9> I have to whole heartedly agree with oskee80 on this one and I feel the need to chime in on it. Jelmer, Phil, you guys are fantastic when it comes to public relations. Dan, not so much. I feel the same way as oskee80; as a mid level developer I do feel a little discouraged about asking questions.

As a framework that is designed for simplicity I'm sure it's going to be an attractive choice for junior to intermediate developers, especially because there is a lot that you can learn from it which I can attest to as I already have. Thank you BTW. But that being said, and as you guys already know, there will be a lot of no0bish questions and seemingly stupid things said simply out of ignorance (Within the true meaning of the word ignorance as in "uninformed or lack of knowledge". Sorry, had to put that in there as I've seen and heard that word get misused a lot). Those questions need to be dealt with professionally. Lest we forget that we were all no0bs once. Never forget where you came from!

Going forward, I would suggest that all PR should be dealt with by you and Jelmer. At the same time though I can understand that that's a whole lot work that you guys would rather not have split between just the two of you. But what else can you do? I know you guys understand.

Anyway, something I know that you guys don't hear enough: Thanks for all of your hard work for giving us a sweet new kickass PHP framework. It really is f*#king amazing and I fall more and more in love with it every time I play with it. As a CI user of 2 years I now feel bored when I have to work on my CI based projects. That's a good thing. Cheers.

</comment></comment></comment><comment><USER10> If the developers are reading this: please for the love of god get a real view/templating engine in there. While you certainly _could_ use raw PHP for your views, it opens up a lot of security concerns and just doesn't have a lot of the features you'd come to expect when coming from other frameworks.

Go look at something like Twig (<http://www.twig-project.org/>) from the Symphony devs. That's step one I would take before using your project, is to hack it to use Twig templates instead of your views.

<comment><USER4> And you can't simply throw the Twig classes in app/classes why? Oh ya...no reason. Why should we lock people into a specific templating system? We are working on something for v1.1, but it will still not be core...it will be a package.

You could add Twig into Fuel in the time it took you to write that comment.

<comment><USER11> I've been using Fuel for a number of weeks now, and I'm generally really liking it. I agree with the Twig recommendation though, and did drop Twig in almost immediately.

To answer your question specifically: it would be smart to use Twig by default, rather than developing your own custom Fuel template engine, because you would need to spend a significant amount of time to get something with the same feature-set, build quality and documentation coverage. Would this time not be better spent elsewhere?

As a pretty content Fuel user, I should also mention that your tone doesn't benefit the project.

</comment></comment></comment><comment><USER12> I like the idea of a fresh start in the crowded market of PHP frameworks.. But also, I think that there if you're willing to do the effort to work with something new, you should also try new languages. The web is moving very fast and the nicest projects in github today aren't built in php.

<comment><USER13> PHP might not be the language of choice if you start hacking a project for yourself. And sure, it has tons of problems and weaknesses but you can't deny one thing: you can very easily get very cheap dev-power when you use PHP.

Sure, those people would also be able to learn Python, Ruby, or whatever the flavor of the month is. But it would take you significantly longer to train them to work on _your_ project. And they might want more money if they realize they now have a more valuable skill ;).

I believe this is why Facebook still uses PHP.

In that light: a new PHP framework that makes things even easier is a good thing.

<comment><USER11> When people recommend writing web applications in Python, they don't point to the language itself as being better for web development. They point to Django or web2py. Same for Ruby, with Rails. So it's odd that people talk about PHP itself in these same conversations. You can write web apps without a framework in PHP, but I don't think anyone building non-trivial applications is still doing that.

"Tons of problems and weaknesses" is largely untrue at this point. Many of the problems that were traditionally pointed to were corrected in 5 and 5.3. There is no interest in breaking backwards compatibility, so the built-in function parameter order inconsistencies are still valid. Most frameworks work around this issue with an OOP wrapper for array and string operations.

It is difficult to find good dev-power for PHP that's cheap. I've tried. You can find many people who have a basic level of PHP knowledge and refer to web apps as "scripts". Finding people who have an understanding of OOP and modern development techniques is much harder and more expensive.

Here's why I program web apps in PHP: it works and I know it well. If I need a library for something web related, I can assume it will be available as open- source. I don't have concerns that I can make a PHP application scale if I need to. When features don't make sense to implement in PHP, I'll snap them off and implement them in the most appropriate language in the background. Most of the heavy-lifting for web applications typically happens in the background.

<comment><USER14> I keep hearing about PHP's "function parameter order inconsistencies". Has that _ever_ been a real problem for anyone? Guess not. Auto-completion got your back and it's debatable if these are real 'inconsistencies' anyway. The amount of really really helpful built-in PHP functions for a lot of common tasks more than makes up for this.

Definitely hear you on the lack of PHP developers with an understanding of OOP and all though. Seen it myself when my previous company tried to hire one, the 'range' of people applying is incredible.

<comment><USER15> The inconsistencies are just more mental friction. It's not a huge cost, but it's no benefit either. If you can avoid such friction, why wouldn't you?

<comment><USER14> Completely getting your point that it could be annoying for some people out there. It never bothered me though and while this is not really a strong argument, it's always one of the first things to come up when people talk about PHP's flaws.

If it really bugs you it could easily be solved with a few helper/wrapper functions.

(Besides that, regarding elegance of syntax, there's no doubt that most other languages used for web dev'ing are lightyears ahead of PHP.)

</comment></comment></comment></comment></comment></comment><comment><USER16> I am a big fan of the Kohana framework, but was very disappointed at the direction they took with version 3.0 of that framework. For the kinds of applications I build in PHP, Kohana 2.3.4 was pretty much the _perfect_ framework for my tastes. Kohana 3 changed everything around, lacked documentation, and made things much more verbose for relatively little benefit (to me and my kinds of projects -- I'm sure it benefits others in some way).

This Fuel framework looks like they took Kohana 2.3.4, cleaned up some bugs, added the command line utility and migrations to it, and that's it. Awesome!

Really only one thing that seems to be missing (and maybe it's in there but not in the documentation): how do you put validation in the model, so you're not duplicating model validation in every action that processes submitted form data?

Other than that, I would also agree with what others have said about the tone of the developers -- it's not going to help the growth of the project's community in the long run.

<comment><USER17> I actually like Ko3 a lot better than 2.x. It just seems to jive with how I think and arrange things. The docs are constantly getting better too.

<comment><USER16> Yeah, I definitely realize that I'm in the minority with my Ko2 love. It just seems to jive with how _I_ think and arrange things. So I would never say that "Ko3 is terrible" (it's still better than most of the other php frameworks IMO), just that I personally was disappointed because I thought 2.3.4 was perfect for me and my projects and my tastes.

And I will admit that the Ko3 docs are now much better than they were a year ago (well, that unofficial wiki is -- the official docs are still severely lacking).

<comment><USER17> Yeah, Ko2.x was pretty nice as well. You could always fork it an maintain it with all the other misfits;) (I kid I kid (about being a misfit))

</comment></comment></comment></comment><comment><USER18> Does anyone know why Fuel uses a mixture of Zend_Style class naming and namespaces? For example controllers are prefixed by Controller_ and are in the root namespace while tasks are put in the namespace Fuel\Task with no class prefix.

      class Controller_Foo{}

      namespace Fuel\Task;
      class Foo{}

It seems confusing.

<comment><USER19> I can't comment specifically on the Fuel framework, but it's probably going to take years (if ever) for "the right" way to use namespaces to emerge among the PHP communities. There's been a decade plus of ingrained name-spacing by convention that PHP developers will need to shed

<comment><USER20> There is already a standard.

[http://groups.google.com/group/php- standards/web/psr-0-final...](http://groups.google.com/group/php- standards/web/psr-0-final-proposal)

Voted on back in 2009 by members of Solar, Cake, Doctrine, Zend, Symfony, Typo3, PHP Core, Yahoo! and others.

<comment><USER6> We actually keep pretty close to that, but have two implementational differences: 1\. Namespaces are linked to a specific directory instead of just translated to a path 2\. Our paths are fully lowercase

And I stand by those. The first allows for more flexibility when it comes to code organization and the second makes mistakes in classloading a lot less common. You can disagree with these but we have documented them clearly. Also it's quite easy to add another autoloader, ours won't even do a filesystem check when trying to load from an unknown namespace so it should add hardly any overhead to attach a Zend (or anything) compatible loader.

</comment></comment></comment></comment><comment><USER21> I wanna know what is the one thing it is aiming for? simplicity? speed (ala Yii PHP framework)? or modularity? Its not clear on any of the page...

<comment><USER22> Judging by their constant use of the words 'simple' and 'flexible', I'd assume simplicity and flexibility.

<comment><USER21> Honestly curious, are existing PHP frameworks hopelessly complex and rigid to have this problem?

<comment><USER23> In my experience Code Igniter does a very good job at being flexible, simple and fast.

Perhaps they should have a page explaining how Fuel is different from Cake, Zend and Code igniter.

<comment><USER6> The most direct comparisson is CI: CodeIgniter was a great framework for PHP4 but it is still very much based in PHP4. They may have started to move towards PHP5 with CI2, but they didn't rewrite it with PHP5 in mind. As such the whole architecture is still dictated by PHP4. Also CodeIgniter doesn't have classes autoloading, HMVC, modular seperation, build in ORM, migrations and a lot of other things we felt were very much missing.

The comparisson to Cake & Zend is a bit apples and oranges. Both are hugemongous frameworks in comparisson, especially Cake has a pretty big footprint. Zend is even a whole other approach in the sense that it is more like a collection of loosly coupled classes, while Fuel is a more intergrated framework. I know for example that some have already been using Zend classes with Fuel, combining the large offerings of Zend with the development base we offer.

</comment></comment></comment></comment></comment><comment><USER24> For users of IE7 and below visiting the site will take you to [http://www.microsoft.com/windows/internet- explorer/default.a...](http://www.microsoft.com/windows/internet- explorer/default.aspx)

That's the worse degrading browser support I've seen :)

<comment><USER8> Why would we care? Get a proper browser. IE9 is out.

<comment><USER25> This is one of my biggest pet-peeves... As a person who is forced to use IE6 at work still, I have come to the conclusion that most sites will not look good in my browser.

Why block your content from people who want to see it; just stop supporting it, put up a blank css file for < IE9, let the site be broken.

Doing this is the easiest way to lose me as a viewer of your website... if I am blocked at work there is no way I would go back to the site once I am home using a modern browser... It just seems silly to me!

<comment><USER6> I get your point but there is one problem with that approach that has lead me to advise some clients to use such a filter. People like most of us reading here know quite well the evils and shortcommings of IE6, but by far the most people still using IE6 don't. I know it is hard to imagine for anyone here but I have friends whom I had to explain that some non-functional website was due to their prehistoric browser. Telling the public their browser is way too old is far better than presenting them a partially functional non-marked up website. It may annoy you and me, but we're not the public most webdesigners should care about.

Now to our own site disallowing IE7 while being targetted at web professionals. Pretty much no-one doing serious web development will be limited to IE6/7 - let alone use it as their primary browser. If you do and your employer is short-sighted enough to keep at IE6, you'll be part of a very very tiny minority which will most likely still not have access to PHP5.3 either.

</comment></comment></comment></comment><comment><USER26> I would like to hear how this specifically differs from say Kohana or Symfony2, both of which are PHP5 only and have good communities already.

<comment><USER16> I know little about Fuel (just discovered it today), but my take on it is that it is pretty much exactly like Kohana 2.3, but less complex and verbose than Kohana 3 (because Ko3 changed so much from 2.3). Symfony/Symfony2 is a _much_ more heavyweight framework -- much more "enterprisey", which I don't mean in a bad way -- the Symfony folks seem to have a much better understanding of OO patterns and best practices than most PHP folks, and if you're building a very large app that needs to be scalable, extendable, etc., Symfony is the way to go. But for more straightforward CRUD apps or sites without humungous user bases or numbers of pages, Kohana/Fuel is a better fit, IMO. The usual lightweight vs. heavyweight tradeoffs.

<comment><USER6> I would like to clarify something: We're not exactly (or pretty much exactly) like anything. Some small parts may have been taken from other frameworks but the whole application flow (Request, Response), autoloader and most of the classes were written from scratch. Being (partially) responsible for classes like Validation, Form, Cache, ViewModel and packages Auth & Orm I can be very clear that while inspiration may have been drawn from many sources they were build specificly & uniquely for Fuel without being ported/rewritten/copied from anything.

We do use slightly modified versions of Kohana's querybuilder & View classes (something we're very upfront about, and from Ko3 btw not Ko2.3) but the framework by and large was build by us originally. And if parts were taken from other frameworks it is mentioned explicitly in the code, but those are the exceptions rather than the rule.

<comment><USER16> Apologies if I am misrepresenting the project (as I said, I know very little about Fuel, just discovered it via this thread) -- didn't mean to put you on the defensive.

I didn't look at the underlying code at all, just browsed through the docs and to my eyes the "API" or "structure" of Fuel looked _very_ similar to Kohana, which is a HUGE compliment coming from me, as Kohana is (was?!) my favorite PHP framework. Definitely not accusing anyone of stealing code -- just trying to answer the guy's question. I don't think anyone could argue that if you compare Fuel to Kohana and Symfony [as was the question], Fuel is WAY closer to the Kohana end of the spectrum.

Anyways, I'm really looking forward to trying this out on my next non-CMS project -- thank you for creating this.

</comment></comment></comment></comment><comment><USER19> Anyone know if this is related to the Fuel CMS (<http://www.getfuelcms.com/>) or are they separate projects?

<comment><USER18> Separate projects. Fuel CMS is powered by Code Igniter 2.

</comment></comment><comment><USER27> I've been using Fuel for <http://gethirely.com> (almost ready to go out of alpha). It's pretty good.

</comment><comment><USER28> I haven't had time to have a good look at this, currently I use CodeIgniter, but I'm always open to change, so I'll grab a copy later and play around with it.

I found a broken link though - <http://fuelphp.com/docs/classes/agent.html> and the error page looks a lot like CodeIgniter/Expression Engine :S

<comment><USER8> The development team (of which I am one) all come from the CodeIgniter community and have built lots of applications and sites using CodeIgniter. The Fuel site runs on PyroCMS, which I also develop as both Fuel and PyroCMS belong to the same company. There's no point us developing a brand new CMS just to run the website for our brand new framework right?

</comment></comment><comment><USER29> The examples are really similar to Kohana, especially view factory. Did you use pieces from it? And is this a MVC or HMVC framework?

<comment><USER8> Yes we've been perfectly open and honest about every sigle class or library that has been taken from another framework. We have several of the Kohana developers hanging out in the #fuelphp IRC channel and we all get along just fine, so no issue there. If something works well, why change it? :)

</comment></comment><comment><USER30> (Sincere question) why would someone use Fuel over, say, Codeigniter?

</comment><comment><USER31> The advertisement at the beginning of each screencast is annoying.

</comment><comment><USER32> Fuel is fantastic, if unfortunately I was going to have to code in PHP I would probably use it as Fuel is really inpsired by Rails e.g. $ php oil generate migrations...

<comment><USER33> There are dozens of PHP frameworks inspired by rails, it's not remarkable.

Symfony (which Delicious 2.0, Yahoo! Answers, Yahoo! Bookmarks, Dailymotion v2009, etc. were built on) has a CLI too ("symfony doctrine:migrate"), and is 5+ years old.

<comment><USER34> Yahoo used a stripped down and customised version of Symfony (called ysymfony). As far as I recall they stripped out the Model part of symfony - <USER3> the entire Propel/Doctrine stuff. Answers for example, wrote their own data query/persistence.

So although you mention doctrine:migrate - Yahoo were not using it on Answers, and if Delicious, Bookmarks and Daily Motion were using the Yahoo version of symfony, neither were they.

<comment><USER33> You don't even have to "strip anything out". It's modular by nature. W3Counter (one of my sites) was built on Symfony and doesn't use Propel or Doctrine either.

</comment></comment></comment></comment><comment><USER35> What put me off is the useless Html class. You have a method named H which produces the H(1,2,3..) tag. How is this useful in any way?

<comment><USER8> This was ported over from CodeIgniter which has a few crazy Hellers for this sort of thing. I wrote an article explaining the benefits: [http://philsturgeon.co.uk/blog/2009/12/Why-CodeIgniter- HTML-...](http://philsturgeon.co.uk/blog/2009/12/Why-CodeIgniter-HTML-helper- functions-rock)

Remember though, that class won't be loaded unless you want it.

<comment><USER6> Sorry Phil, going to correct you a little bit here ;-) It actually wasn't ported over. It was written by Alfie and I did a big rewrite on it before committing.

<comment><USER8> Right you are, but Alfie based this almost directly on CI. You recoded some of it, but the initial purpose and feeling of the class remains as essentially a copy of the CodeIniter Helpers. The sort of thing that is so similar it was just easier to call a port. :)

</comment></comment></comment></comment><comment><USER36> The Lithuum project looks like a promising PHP 5.3 framework from some ex Cake developers. What is different about Fuel?

<comment><USER14> Don't take this as any legit comparison, but from my perspective: Fuel is at 1.0 RC1 as of right now, although it has only been started a few months ago. Lithium has been in development for ages (since 2009) and it seems like it hasn't seen a lot of action lately, the last blog post on <http://lithify.me/> being from November 2010 and the last packaged download being 0.9.9 from December 2010. (Didn't check the activity on the repos.)

That doesn't tell you a lot about the quality or reliability of the framework and what's to come but personally I prefer the "let's get this out there" approach over borderline vapourware.

Besides that, browsing the FuelPHP forum it looks like people are already busy adding functionality through plugins and the team seems to be helpful and embracing it. So they've definitely got 'momentum'.

Also the 'docs' on FuelPHP seem to be pretty 'complete' at first glance, also giving me the impression that they are totally up-to-date while I can't even figure out where the proper 'docs' for Lithium are. They don't seem to have things arranged for 'being in the spotlight' yet.

And I can't comment on what's going on under the hood really, as I am more interested in 'libraries' that are not depending on any framework these days.

But as far as I can see, FuelPHP is sitting there for you along with current docs and a dedicated team to try out and give it a shot.

<comment><USER37> Finishing the ORM seems to be the biggest deal right now, you can have a look at the roadmap (<http://rad-dev.org/lithium/wiki/about/roadmap>).

The links you are looking for:

• documentation (javadoc-style): <http://lithify.me/docs>

• drafts (book-like): <http://dev.lithify.me/drafts/source/en>

• community: irc://irc.freenode.net/#li3

They are hard to find, I agree.

</comment></comment></comment><comment><USER38> Funny it uses Redmine a RubyOnRails based issue tracker for managing bugs

<comment><USER8> We use any product that makes sense. Should we be forced to develop an issue tracker in Fuel before launching the framework? And a CMS? And a forum? :)</comment></comment>


Fifteen Years of Fedora - <AUTHOR> https://fedoramagazine.org/celebrate-fifteen-years-fedora/ <comment><USER2> 15 years... seems like both a long time and not long ago at all. I remember quite fondly using Fedora Core 2 and enjoying it, it was the natural path from Red Hat Linux after all.

Congratulations to Fedora! I admit that you are not my preferred distro any longer, but I am still quite happy that you have made it this far, and I hope that you have many years to come.

<comment><USER3> I've been a big fan of the RedHat line, Yellowdog included, and Fedora has made for an even better experience. From "Core 1" to here it's been quite an experience.

Thanks for pushing the bleeding edge for fifteen years!

<comment><USER4> I hope there hasn't been much blood in all of that. Sometimes we err on that side, but overall, the intention is to provide an integrated operating system that leads but doesn't actually cause injury!

<comment><USER3> When systemd dropped it was a bit of bloody mess, but Fedora people have had years to get used to it.

Always interesting to see what's next. Fedora 29 just shipped:

[https://fedoraproject.org/wiki/Releases/29/ChangeSet](https://fedoraproject.org/wiki/Releases/29/ChangeSet)

RIP Fedora PPC.

</comment></comment></comment></comment><comment><USER5> I started on Fedora Core 4 as a tween, and finally became a packager this year. Its been a fun journey and I'm looking card to the next decade!

<comment><USER6> I also started using Fedora on Core 4 :)

IBM's Fedora doesn't seem like something that will survive 10 years?

Seriously I can't even think of a worst company to buy Red Hat for Fedora then IBM.

<comment><USER7> Oracle or Microsoft could be worse

<comment><USER6> Microsoft?

That would be on my top 3 to buy list.

Oracle already has their own Redhat knockoff they would have to put work into making the product which is something they would not want to ever do. Also Oracle would send Fedora out to the ethers anyways.

</comment></comment></comment></comment><comment><USER8> Nice! Fedora was one of the first distros I used all those years ago, before switching to openSUSE and later Ubuntu/Debian.

I didn't realise that when I started using it in high school, it was still a relatively young distro (2006-7)!

I did expect there to be a bit more about the history and development in the article though. After the heading "A history lesson" I was expecting it to trace through some major changes in the past 15 years.

<comment><USER9> Fedora Core had a history as Redhat Linux (not Redhat Enterprise Linux), with nine major releases. I left rpm based distributions with FC1 (only to return in the 20-something releases).

</comment></comment><comment><USER10> I remember using Fedora Core 1 and being really excited about it (it was free! no more begging my parents to drive me to CompUSA)

That was literally half a lifetime ago.

</comment><comment><USER11> Been using Fedora since Fedora Core 5... it sure has come a long way since then</comment>


Why Privacy Matters Even If "You Have Nothing to Hide" - <AUTHOR> https://write.privacytools.io/privacy-simplified/why-privacy-matters-even-if-you-have-nothing-to-hide <comment><USER2> Lack of respect for the human right to privacy by governments and corporations will lead to mass surveillance, gamified control and microtargeted propaganda.

Every one of these is dangerous, but gamified control is by far the worst of these, as it directly attacks the concept of equality which many human rights are fundamentally based on. "Equal access to public service"? Well sure you _had the chance_ to have a good enough score to be allowed in this part of town. It is your own fault that you are a bad human. Giving up privacy will place governance in the hand of unthinking uncaring algorithms. If you the think the human bureaucrats were bad, wait until you experience the automated ones. But even worse: these three mechanisms empower authoritarianism and are easily abused to reinforce power of a ruling caste.

Modern technology makes it easier to ignore the basic human right to privacy than to respect it. I therefor would not compare privacy to free speech, like Snowden does. Free speech is easy. In my opinion it is far more reasonable to compare privacy to the right to a fair trial: having fair trials is significantly harder than despotism. And in a similar way, most people care very little about fairness in court, unless they are directly impaired, and many are willing to throw it away if they believe some evil is using it to hide from justice.

</comment><comment><USER3> A simpler argument:

It is unlikely that you truly have nothing to hide, but it is even more unlikely that every single person who has any influence over your life has nothing to hide. Protecting their privacy prevents exploitation that could hurt you too.

<comment><USER2> This is a wonderful rhetoric, a nice example of eristic dialectic. I love it. It avoids implying the person argued with has a taint, which would make them defensive, but instead allows them to pick a straw man from their monkey- sphere and create a vague threat against themselves where the best defense is agreeing with the pro-privacy argumentation. There is one way out: "everyone i know is a saint, and if someone is not, i am a saint and would rather get smeared for acquaintance than protect the devil." but it is unlikely any human will react in this way, because it is almost never true.

However your argument is fundamentally flawed, even if it works emotionally: It accepts the narrative that privacy is about hiding something evil, which is the primary attack vector against this basic human right and should be refuted, not reiterated.

Privacy is not about hiding vileness, it was (19th/20th century) about not allowing a totalitarian government to read your private correspondence in search for what they consider dissident opinions. Many people are very lucky that they find this hard to grasp.

Privacy has changed, it had to change because of the "data is the new oil" paradigm. 21st century privacy is _your right to choose who can process your data for what._ Example: You would never agree that your data is processed by an organization with the purpose of changing your opinion to theirs without ever telling you they are engaging you at all. Yet that is happening, it is called microtargeting.

<comment><USER4> > _However your argument is fundamentally flawed, even if it works > emotionally: It accepts the narrative that privacy is about hiding something > evil, which is the primary attack vector against this basic human right and > should be refuted, not reiterated._

Such a distinction doesn't matter much.

Evil is in the eye of the beholder. E.g. for Southern racists in the 50s, the fact that one supported and funded black rights would seem "evil" as well.

As long as what X (= you or someone you know) said or did appears evil to third parties (government, society at large, their boss, private interests, etc), and leaking this could have negative consequences against X, that's enough to justify the argument made.

Whether the thing is actually evil or good is not really relevant (that implies some fixed moral order for eternity and for everybody within a certain time).

<comment><USER2> I like your explanations of "right to hide something". Thank you.

Here in germany the "nothing to hide" argument is mostly used by the spokespeople of the ministry of state security with an implication of crime as defined by the law as written. But let's not focus on the finer points of morality. More important: even if we go from "right to hide some thing evil" to "right to hide some thing" we are not even close to privacy. Because privacy is not about hiding some information about oneself, it is about the right to have some level control about personal information.

A level at which almost everyone suddenly understands privacy is sexuality: no matter if you want to keep your sexuality hidden or not, no matter if you publish on pornhub or not, privacy is the right to not be filmed in your bedroom without your consent. Privacy is not about hiding.

</comment></comment></comment></comment><comment><USER5> The argument is incorrect. I may want to say something in the future but I may not want to hide something because one is legal and other is illegal unless there is a dictatorship.

<comment><USER4> > _but I may not want to hide something because one is legal and other is > illegal unless there is a dictatorship._

There's no democracy vs dictatorship binary. It's a spectrum.

There are all kinds of things that are legal but the public sentiment is against them, so you want to hide them to protect your social life/career/etc. Being gay in the 70s was one of them. Or a communist sympathizer in the McCarthy era. Many things in 2020 too from both the left and right side (e.g. it's not like the right wingers are safe. For example, news that he donated against a popular progressive cause cost someone his CEO position at a major tech company -- and that's despite the fact that the majority of his state voted in the same vein).

There all also things that are nominally legal but the government/law/local authorities will hold against you in a democracy. Being a peaceful human rights activist would still get you a large folder at the FBI, and in Southern towns could get you harassed by the police.

There are also things you want to keep hidden because you just don't want them public, like your sexual preferences of BDSM or "golden showers", your sex tapes with your partners, your gossip mails or chat against a colleague or boss with a third party, and so on.

If you are in any position of relative power or even small influence (that could stop something, or speak out, etc), then people with interests (from government, industry, etc) can blackmail you with your private information on any of those categories, to vote or do something in their favor or look the other way.

Democracy always progresses through people working against certain laws and customs and cultural ideas. Child labor, women's rights, universal vote, black rights, gay rights, etc. And since those things are established, those people work against laws/majority opinion/powerful interests/etc.

So they do have a need to keep their ideas or moves or who sympathizes secretly, etc secret while they work towards their goal (plus anything else that could be used to blackmail them or hurt them, even if not relevant to that cause - e.g. MLK's affairs had nothing to do with his cause, but they could still be used to discredit him at the time).

And since people are people, even a very good person, working towards a very legit cause, or wanting to prevent some bad from happening, could still have illegal activity of his own that he doesn't want to be made public and hurt them. E.g. they could be doing psychedelic drugs.

I don't see why someone in the US e.g. can be so self-congratulating on "nothing to hide in a democracy", when they had Jim Crow until the 40s, segregation until the 70s, McCarthy, Hoover, Watergate, modern mass surveillance, frequent police abuse (from Serpico to Rodney King to today), lots of scandals and abuses that came into light only by whistleblowers (corporate, governmental, etc), often themselves prosecuted or abused for it, and so on.

<comment><USER5> I agree and this is a very sound argument that I would like to see in the article.I am pro privacy and I also like arguments to be solid otherwise they are not convincing enough to turn public opinion. I hope more people read your comment

</comment></comment></comment><comment><USER6> In my opinion, this does not mention the main point. Individuals (plus families, small communities, small businesses) loosing their power (privacy in this case) means corporations and governments get (even) more power. I'll live it as an exercise to the reader to see why the latter trend might not be so good in the long run.

</comment><comment><USER7> It is a good reminder, which needs to happen more often. Only a gut feeling (no real proof), but it seems like the younger generation does not care because they're so exposed from an early age to all kinds of social media, influencers, streamers, etc. The older generation does not seem to care because they're a bit technologically impaired and it's hard enough to try to keep up. There are exceptions though, and depending on the bubble you live in, the number of exceptions will differ a lot.</comment>


Show HN: A tool that guides you through career decisions - <AUTHOR> https://80000hours.org/career-guide/decision-process/ <comment><AUTHOR> Hi all,

We've done one-on-one career coaching with a couple of hundred people, and found ourselves asking the same questions over and over again. So we put the most common questions into this simple tool.

It acts like a checklist to make sure you haven't missed a key bit of our advice. It's on the way to automated coaching.

It takes about an hour to work all the way through. That's long, but people use it for major life decisions.

We built it in Guidedtrack, a simple high-level language for making Q&A tools. It allows our researchers to edit the content quickly. We then overlaid our CSS theme. [https://www.guidedtrack.com/](https://www.guidedtrack.com/)

It gets about 1,000 users per week.

The aim of the tool is to cause people to change their career plans. 17% of users report a career plan change from engaging with us (though not necessarily from the tool itself).

4% make it to the end. That's less than 17% because we have a survey about a quarter of the way in, as well as at the end.

Net promoter score is -10%, and use isn't growing.

What are the most effective ways to make it better?

<comment><USER2> Started it, barely went 10% in. The so far frequent "hey sign up for x" was annoying. And then it tells me to write questions and such, who's gonna answer those? I don't get it. So I closed the tab.

<comment><AUTHOR> Which sign up requests in particular annoyed you?

<comment><USER2> I'll be honest, I did not read most of what was presented to me. Looking back - it might be like ad/banner blindness - I just saw something trying to get me to sign up or such and ignored it.</comment></comment></comment></comment>


TF-IDF in a Nutshell - <AUTHOR> https://manticoresearch.com/2019/04/09/tf-idf-in-a-nutshell/ <comment><USER2> Still waiting for PostgreSQL to implement TF-IDF ranking:

[https://github.com/postgrespro/rum](https://github.com/postgrespro/rum)

</comment><comment><USER3> Good explanation of TF-IDF. Now I can verify if my colleagues have implemented it in the same way.

</comment><comment><USER4> Glad to see some energy from the Sphinx folks. I had not hear about the fork, congrats!</comment>


How to Get a Job at a High Frequency Trading Firm - <AUTHOR> http://quantstart.com/articles/How-to-Get-a-Job-at-a-High-Frequency-Trading-Firm <comment><USER2> While i find the technological challenges in HFT very exciting, i would never want to work for the companies benefitting from that work. If that means i will make less money and someone else will come in and do it, then so be it.

<comment><USER3> There is a thing in most kinds of investing and trading called _slippage_. This is when you decide you want to buy something at say $100/unit but by the time your order reaches the market, the price has moved, maybe it's $101, maybe it's $99. If you are buying a lot, then it's unlikely there's a single counterparty you can trade with, so you will actually be doing it as many smaller trades. Sometimes slippage moves for you, sometimes against but that's not the kind of trading you want to do because it involves taking on more risk, you want confidence that the price you ask for is the price you're going to get, and you don't want your trades to affect the price. HFT techniques are invaluable here.

<comment><USER4> As would trading on a clock. If the market only updated once a second or even a far smaller interval, this whole insane business would be mostly irrelevant.

<comment><USER5> Then proximity to the second tick would be the game. What you are advocating would have people sending orders in the future to arrive at the gateway as timer expires.

<comment><USER4> Perhaps I'm missing something, but why would it matter? Trades execute at the state in t-1 at time t. Assuming people's orders are secret in that interval, you don't actually care when your trade gets queued.

<comment><USER5> because if the trade comes in too early it would automatically rejected by the g/w. Also how could the orders in a published orderbook be secret?

<comment><USER6> You are misunderstanding what he's saying.

He's saying that you could use a periodic-submission order system. Say that the period is (for ease of discussion), 1 hour, ending on the hour. All orders made during the hour are queued up and simultaneously executed at the start of the next hour. If there are too few bids/offers to satisfy all trades, then trades are satisfied using some fixed rubric (i.e., pro rata, max/min price buyer/seller will accept, etc.) Until execution, the orders remain secret (not published to the orderbook). In theory, this allows people to place orders based on a known price.

In practice, in the past (before electronic trading took over), the published orderbook was updated manually as traders submitted bids, offers, and executed sales information to the exchange.

<comment><USER3> Unfortunately there is actually no such thing as "simultaneously", because these are not discrete events; for every buyer, there will be 1-n sellers, all of whom are involved in other trades of their own. You _have_ to impose an order on trade execution, and each trade will take some finite amount of time to process.

<comment><USER4> So you randomize instead of doing first come first serve. Everyone who got there orders in by the deadline gets an equal shot. You do verifiable randomness to prevent the exchange from messing with trade orders.

If you do a simple two phase system, you don't have to worry about the exchange leaking orders. You send in a cryptographically binding commitment to your order(this hides the order now, but prevents you from changing it later). After the time period is up, the exchange publishes a commitment to their randomized order of trades , then every party reveals their actual order. Then trades execute.

<comment><USER3> Sorry, but that's ridiculous. You can't know in that situation what inventory anyone will have at the time you actually make the trade!

I don't think you quite understand that these trades aren't simply converting money to something else. They are actually buying and selling _things_ , abstract things to be sure, but things that your counterparty will either already own or be able to acquire on your behalf. You might as well say Amazon should send things to random addresses and everyone has an equal chance of getting what they ordered.

<comment><USER4> I think your Amazon point is rather inaccurate. With amazon people are ordering different products at fixed prices from one seller. In this case, the question is how do we actually determine the price for one product(say Google's stock) given many buyers and many sellers all with different price points. It's not the same thing at all.

Someone/some algorithm has to match offers for sale with offers for purchases. Buyers are willing to buy at up to some price and seller sell at down to some prince. The question is when the matching is done, how frequently and whether you gain any advantage by being faster (other than having marginally more time to analysis). By contention is that you can accomplish this.

While this may not work for, I don't think amazon or anything like that has much to do with it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I thought there was a consensus in this community on how the leading traders just squeeze money out of all other wannabe sharks. The skills I find most relevant are low ethics and networking (not the technological type of networking).

<comment><USER8> Let's put it this way: if the character of the people you work with matters to you, then HFT is not something you'd want to do.

<comment><USER9> Sources?

Are HF traders known to be objectively more "evil" people than others in the finance industry, or vicars of country churches, or social workers, or cabinet ministers? If so, I'd love to see the studies.

<comment><USER8> I base this on the few people I know in this industry. Not scientific by any means.

Now, people are hardly ever "evil", and they certainly never consider themselves evil. But even strangers would hardly call traders evil; they're just... how shall I put this... if you know some people working on (in?) Wall Street then you know the type. Of course, there are plenty of technical people working on the highly technical aspects of HFT with little regard to the domain itself, who don't fit the prototype; still, there are very few idealists in that industry.

<comment><USER10> > they're just... how shall I put this... if you know some people working in > Wall Street then you know the type.

Well, I don't know anyone working on Wall Street and I don't know the "type." Can you give concrete examples or details to substantiate your claim and make it specific? What is it in particular that you object to about these people?

No offense, but as a disclaimer, I don't want to come across as giving your claim too much credence. In the abstract, any form of trading is a life- supporting activity (someone is voluntarily choosing to trade with you to mutual benefit) and thus is noble, other factors being equal (e.g. you're not committing fraud, etc.).

<comment><USER8> You're right. I'm sorry for taking the ad-hominem path. We should discuss the practice, not the practitioners (what is it that some Christians say? Love the sinner, hate the sin? ;)

<comment><USER10> I'm actually still curious about your anecdotal experience, though, if there's anything you'd like to share. Just because quants are not evil "in principle" doesn't mean there might not be certain personality traits that pop up often. I don't know anybody who works in that space.

<comment><USER8> I don't think it would be appropriate at this point in the discussion. There are numerous articles and books about Wall Street culture; some of them are very true to life.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'm surprised that the morality of HFT firms keeps coming up even among technically enlightened audiences.

I'll preface this by saying I'm not a HFT or affiliated to one but I strongly believe that HTFs and UHTFs play a valuable role in well regulated markets. We can argue endlessly as to whether the financial markets are well regulared but for this discussion let us assume they are pretty close and that if they aren't there's an HFT out there that's working to discover why and capitalize on it.

HFTs also provide massive liquidity and allow people that trade large positions (Pensions, Insiders e.g start up founders etc) to enter and exit into the market without causing massive waves in the instruments they are trading.

<comment><USER8> I think we should be delighted that the morality of anything comes up among technically enlightened audiences. For years, us engineers have been accused (often justly) for not caring.

The value HFT, day trading, and stock traders in general provide is far from clear-cut. When considering the merit of some economic enterprise you can't just take into account its local effects. For example, casinos also provide value: they provide entertainment and they feed a lot of people. But it's uncertain whether our society is better off with them or without them.

</comment></comment><comment><USER8> If we put aside for a second the overall sleaziness of this industry that makes working for it very unattractive, isn't HFT at a dead end? Do people still make a lot of money off it? Hasn't it reached the tail-end of diminishing returns?

<comment><USER12> It really depends on how you define HFT. If we define it as the author does, then it's not so much a dead end, rather it is really hard to move in on. I like to think of latency arbitrage (including pairs trades, exchange arb, etc.) as a utility. It takes a massive amount of investment, but if you do that you can get a very steady return. The problem is that in most of those trades there is no money in being the second best. These leads to an environment where the people already invested are in an arms race to keep at the front.

If on the other hand, you are talking about other forms of algorithmic trading, there is still money to be made by being smart, having insight, having better procedures, or faster time to market etc. The arms race in latency arbitrage has actually made a lot of this easier as it has dramatically brought down the cost of entry to the non-bleeding edge of latency use cases.

<comment><USER8> > there is still money to be made by being smart, having insight, having > better procedures

Other than algorithmic speculation (sentiment analysis, etc), is it still possible to come up with better (non-speculative) procedures that yield substantial profit?

<comment><USER12> Depends on what you mean by "non-speculative" & "substantial". All trading is "speculative" in some sense, but yes you can still make a tidy living in the algorithmic trading space.

</comment></comment></comment></comment><comment><USER13> I'm happy to see this pop up on HN since HFT is something I've been looking into lately. If you're interested to dig deeper into HFT and algorithmic trading, 'Inside the Black Box' will be a good read. Link: www.amazon.com/Inside-Black-Box-Quantitative-Frequency/dp/1118362411

If you want to take your reading further, there are some great recommendations on the review section. And just to get an insider look into quant traders and the effect HFT can have on the market, I also recommend these two short documentaries made by the dutch national TV:

1\. Quants: The Alchemists of Wall Street [https://www.youtube.com/watch?v=ed2FWNWwE3I](https://www.youtube.com/watch?v=ed2FWNWwE3I)

2\. Money & Speed: Inside the Black Box [https://www.youtube.com/watch?v=aq1Ln1UCoEU](https://www.youtube.com/watch?v=aq1Ln1UCoEU)

</comment><comment><USER14> Keep the following in mind..

HFT is not very profitable anymore.There are a fair number of companies in the field now.

HFT tends to be algorithmically simplistic.This is not because stupid people are working there but its very difficult to have algorithmic complexity and speed,and speed is more important.

It is very much a winner takes all game,profits are not evenly distributed,being fast is VERY important.

However good you are you are not a trader.You are a codemonkey. You will never be rewarded or compensated as a trader in most of these firms(some firms like Rentech are an exception to this,but rentech is not typical high frequency).

Your hourly rate will probably not be worth it. When you factor in variable compensation(ie bonus) which is not guaranteed and horrible working hours you would in most cases be better off with some boring bank java contract for compensation.

</comment><comment><USER15> > While many UHFT firms have moved towards custom hardware (both for > processing and networking), some less latency-sensitive systematic trading > firms still make use of multithreaded C, C++ and Java (with custom garbage > collection).

Aside from the hiring theme I have a question. I'd think given that network speeds would start being the bigger bottleneck. Is location at all important to these firms? The speed of light is fast, but the closer you are to the exchanges, the better the advantage over competitors must be.

<comment><USER16> I can't find the story now, but I read about an HFT making a play on the bid/ask spreads between new york and chicago, they spent a large sum of money to build their data center somewhere in the appalachians to save themselves something like 3 ms in total transit time.

<comment><USER17> I think you are referring to an article called "Barbarians at the Gateways" by Jacob Loveless, that recently popped up on HN:

\- Web: [http://queue.acm.org/detail.cfm?ref=rss&id=2536492](http://queue.acm.org/detail.cfm?ref=rss&id=2536492)

\- PDF: [http://portal.acm.org/ft_gateway.cfm?id=2536492&type=pdf](http://portal.acm.org/ft_gateway.cfm?id=2536492&type=pdf)

</comment></comment></comment><comment><USER18> You may have to leave your CONSCIENCE at your home.

</comment><comment><USER14> On the topic of the utility of HFT my personal opinion of is it reduces spread costs but adds systemic fragility. I actually doubt stock markets are socially utile,let alone HFT but that is an argument for another day.

The real trading problem when we look at access and information asymmetry is not HFT but dark pools.HFTs typically all compete for the same pie anyway.

</comment><comment><USER19> Not a helpful guide as the paths listed almost guarantee that qualifying person would be aware of ways to enter. Would be more interested in the guide "Hot to get a job in HF while being a mainstream web dev who graduated from an unknown uni".

</comment><comment><USER20> HFT is

1\. not a growth industry

2\. the regulators are keen to clamp down on this sort of activity.

As such, anyone with the intellectual chops to master HFT, I'd suggest they apply it to greener pastures. Wasn't AdMeld started by former HFT people?

<comment><USER3> That's what I think of, sure, when I think of where programmers could best use their talent for the advancement of mankind. Not curing cancer or AIDS with protein folding, not probing the mysteries of the universe at the LHC, but finding new ways to make people click on ads.

<comment><USER10> jgalt was intentionally giving selfish reasons for people to not go into HFT. Apparently he doesn't share with you the premise that people ought to work on whatever "advances mankind."</comment></comment></comment>


Has The Bubble Burst? The Four Stages of Bubbleness - <AUTHOR> http://onstartups.com/home/tabid/3339/bid/5399/Has-The-Bubble-Burst-The-Four-Stages-of-Bubbleness.aspx

<comment><USER2> You don't need to ask if a bubble has burst. It's _painfully_ obvious.</comment>


2010 Predictions - <AUTHOR> http://www.readwriteweb.com/archives/2010_predictions.php

<comment><USER2> "Google will be distracted by increasing consumer complaints about content farms polluting Google search results."

I've been complaining. I don't know if it has distracted Google yet.</comment>