Think Bayes: Bayesian Statistics Made Simple (2012) - <AUTHOR> http://www.greenteapress.com/thinkbayes/html/thinkbayes001.html <comment><USER2> For me the best so far book on Bayesian probability was "Probability Theory: The Logic of Science: Principles and Elementary Applications" by E. T. Jaynes.

The book starts from the deduction of Bayesian theorem from the first principles of logic and shows its applications to a wide range of topics. There is thorough discussion of various "paradoxes" and the author sharply criticizes the frequentist statistics. In addition there is a lot of historical references.

<comment><USER3> _Probability Theory_ is available as a PDF.

[http://www.med.mcgill.ca/epidemiology/hanley/bios601/Gaussia...](http://www.med.mcgill.ca/epidemiology/hanley/bios601/GaussianModel/JaynesProbabilityTheory.pdf)

<comment><USER4> Thanks. I was about to buy the book on Amazon for ~$90 but at least now I can give it a read first to see if it's worth, for me at least, buying.

</comment></comment></comment><comment><USER5> For those unclear on the concrete (rather than philosophical) difference between Bayesian and frequentist statistics in the first place, I hope it's not inappropriate for me to share this 5-minute example that I wrote a while back: [https://news.ycombinator.com/item?id=11096129](https://news.ycombinator.com/item?id=11096129)

<comment><USER6> You write that the frequentist doesn't answer the question, but it does. It answers

        P(H') = (H/H+T)^H'

You also write that the frequentist solution fails to give an error estimate, yet you don't show that the Bayesian solution does give one.

If the goal of the article is to show that Bayesian is more correct than frequentist then it leaves the reader unconvinced. If the goal is to show 3 ways of finding a probability, you should either say each is fine under its own paradigm, or argue why only one paradigm is correct.

<comment><USER5> > You write that the frequentist doesn't answer the question, but it does. It > answers: P(H') = (H/H+T)^H'

The question was asking for P(H' | H, T), not P(H').

> You also write that the frequentist solution fails to give an error > estimate, yet you don't show that the Bayesian solution does give one.

Because there _is_ no error? In the proof I assume P(p) is known and then after that every step follows from a law of probability. There is no error to be accounted for in the procedure. The only caveat is that we need to know P(p) to be able to perform the procedure, which is a caveat that I point out at least 3 times in the page.

<comment><USER7> > The only caveat is that we need to know P(p) to be able to perform the > procedure

I think this is a very confusing way to put it. P(p) is not an objective value that you can know or not know, it is rather a model of our subjective knowledge, and therefore it doesn't really make sense to say "the caveat is that we need to know what our knowledge is" ... yeah, we do, but that is always the case by definition, so pointless to bring up.

</comment></comment></comment></comment><comment><USER8> I regularly forget how Bayes works. Everytime that happens I browse up to that page: [https://www.bayestheorem.net/](https://www.bayestheorem.net/)

I love the way it's explained there.

<comment><USER9> How Bayes kinda works, or how I see it.

Conditional probability (with some caveats that someone in the comments can fill in on):

        P(a,b) = P(b,a)
        P(a|b) * P(b) = P(b|a) * P(a)
        P(a|b) = P(b|a) * P(a) / P(b)

a can be model and b can be data so it becomes

        P(model | data) =
        P(data | model) * P(model) / P(data)

We have or can estimate the things on the right side. We want to ultimately get the thing on the left side.

<comment><USER10> To clear up your first set to have conditional probabilities for everything, Bayes' theorem is just a restatement of the product rule:

        p(a and b | context c) = p(a|b,c) * p(b|c)
                               = p(b|a,c) * p(a|c)
        or = p(a|c)*p(b|c) = p(b|c)*p(a|c) if a and b are independent of each other

        so Bayes only matters when there is dependence:
        p(a|b,c) = p(a|c) * p(b|a,c) / p(b|c)

        otherwise it's just p(a|c) = p(a|c)

I like to put things in that order because p(a|c) is the "prior belief" and with some handwaving say things like "updated belief = prior belief and new evidence about belief".

</comment></comment></comment><comment><USER11> My youngest has Allen Downey as a professor this year. She says he is crazy. And she means this in the best way possible. His productivity is prolific having written Think Java in 13 days. He memorized pictures and bios of all 90 students in the first year class at Olin College of Engineering.

Edit typo

<comment><USER12> >He memorized pictures and bios of all 90 students in the first year class at Olin College of Engineering.

It's impressive not so much that he did that, but that he bothered to try.

Most lecturers (myself included) will try very hard _not_ to learn anything about their students because they consider actually dealing with undergrads (particularly first-years!) on an individual level is beneath them.

<comment><USER11> At Olin everyone is an undergraduate. Olin is about reinventing engineering education. They consider faculty as very important to the process but they are guides not instructors. The students most of the time have to seek information and approaches out.

</comment></comment></comment><comment><USER13> Thanks for posting this. The Jupyter notebooks (and the fact Github has built- in support for them) really help illustrating the concepts.

The book I've used so far to study is "Probability and Statistics: The Science of Uncertainty", by Michael J. Evans and Jeffrey S. Rosenthal. This book is not being published anymore and is free in PDF form.

<comment><USER14> The book you mentioned is available at [http://www.utstat.toronto.edu/mikevans/jeffrosenthal/](http://www.utstat.toronto.edu/mikevans/jeffrosenthal/)

<comment><USER13> May also want to take a look at: "Introduction to Statistics and Probability using R"

[https://cran.r-project.org/web/packages/IPSUR/vignettes/IPSU...](https://cran.r-project.org/web/packages/IPSUR/vignettes/IPSUR.pdf)

R has builtin functions for most of your needs. You can get a lot done with very few code.

</comment></comment></comment><comment><USER15> "I broke this rule because I developed some of the code while I was a Visiting Scientist at Google, so I followed the Google style guide, which deviates from PEP 8 in a few places. Once I got used to Google style, I found that I liked it. And at this point, it would be too much trouble to change."

Why would you write a book that targets the Python community and ignore PEP8 styling, inconveniencing an entire community, simply because it would be too much trouble for you to change?

"Also on the topic of style, I write "Bayes's theorem" with an s after the apostrophe, which is preferred in some style guides and deprecated in others."

It is deprecated in all modern style guides and should not be used. You'll get dinged in college English and writing classes for using this outdated and redundant style.

I'm sure this book is great, but, as a point of constructive criticism, I would suggest the author do a better job at adhering to the styles of code and English expected by his target audience, rather than what is comfortable for him.

<comment><USER16> From the PEP8 style guide:

"Many projects have their own coding style guidelines. In the event of any conflicts, such project-specific guides take precedence for that project."

and

"A Foolish Consistency is the Hobgoblin of Little Minds".

And, throughout, PEP8 makes it clear that it is a set of recommendations, and that if a project or community already has an established style, it need not be changed.

<comment><USER17> Why are you arguing against PEP8? As you mentioned in your final sentence, the Python community DOES have an established standard. It is called PEP8. The parent has made a valid point. Why would you criticize or trash his "karma" for stating it?

<comment><USER16> You say I'm arguing against PEP8 by quoting PEP8? That's hard to understand. Whose karma am I "trashing", and how? I certainly didn't downvote him, if that's what you mean.

</comment></comment></comment></comment><comment><USER18> My introduction to Bayesian probability was accidentally reinventing it while trying to invent my own AI system. It naturally followed by constructing a network of information which could be queried to get back whatever had been fed into it and perform deduction/induction.

</comment><comment><USER19> previous discussion:

[https://news.ycombinator.com/item?id=4634843](https://news.ycombinator.com/item?id=4634843)

<comment><USER20> With some comments from the author. Hopefully he'll see this too.

</comment></comment><comment><USER21> I was surprised to learn about the 'Likelihoodist', an interpretation of bayes that avoids ambiguities with choosing a prior.

An Introduction to Likelihoodist, Bayesian, and Frequentist Methods

[http://gandenberger.org/2014/07/28/intro-to- statistical-](http://gandenberger.org/2014/07/28/intro-to-statistical-) methods-2/

</comment><comment><USER22> Let's take a recent election as an example:

A Bayesian pollster began with a certain set of prior probabilities. That the college educated were more likely to vote in previous elections, for example, informed the sample population, because it wouldn't make much sense to ask the opinions of those who would stay home.

Thus, based on priors that were updated with new empirical data, a new set of probabilities emerged, that gave a certain candidate a high probability of victory.

Members of the voting public, aware of this high probability, decided that this meant with certainty that this candidate would win and therefore decided to stay home on election day.

In reality the Bayesian models were incorrect as amongst other factors, a much higher number of non-college educated individuals decided to vote and to vote for the other candidate.

As it is with Bayesian intelligence, shared as much by pollsters as machine learning algorithms:

      Real-time heads up display
      Keeps the danger away
      But only for the things that already ruined your day.

<comment><USER23> I suppose you aren't talking about Andrew Gelman... [https://www.nytimes.com/interactive/2016/09/20/upshot/the- er...](https://www.nytimes.com/interactive/2016/09/20/upshot/the-error-the- polling-world-rarely-talks-about.html)

<comment><USER22> You mean the same Andrew Gelman who did not predict the election of Trump and took the time to reflect on the issues with polling methodology?

[http://andrewgelman.com/2016/12/08/19-things- learned-2016-el...](http://andrewgelman.com/2016/12/08/19-things- learned-2016-election/)

I'll have to write another poem about pithy rebuttals that cherry-pick a counter-narrative!

Now, what rhymes with anecdotal...

</comment></comment></comment><comment><USER24> It should also have one called "Think Markov Chain Monte Carlo" \- even the simplest reference is intractable and others began very simplistically and ends incomprehensible enough to disgust the subject altogether.</comment>


Show HN: YTFind - search YouTube dialogue - <AUTHOR> http://ytfind.com

<comment><USER2> One of the creators here, we are really interested in making it better so feel free to send suggestions.</comment>


The Best Commit Messages of My Networks Class - <AUTHOR> https://www.slideshare.net/bsotomay/uchicago-cmsc-23300-the-best-commit-messages-of-2017 <comment><USER2> Two hours into a gnarly debugging session I got called in to try and lend a hand. We start bisecting around a bit to get at root cause... 500 commits, 250 commits, 125 commits...finally we arrive at the faulty SHA.

"Can't stop this magic"

<comment><AUTHOR> Amazing. Just amazing.</comment></comment>


Crawling is harder than it looks - <AUTHOR> http://glinden.blogspot.com/2008/05/crawling-is-harder-than-it-looks.html <comment><USER2> Great document!

I architected and implemented a crawler, reading this documents really confirmed problems encountered and taught me a thing or two on how to improve.

This document goes the same scope as: Why Writing Your Own Search Engine is Hard - by Anna Patterson, Stanford University ([http://www.acmqueue.org/modules.php?name=Content&pa=show...](http://www.acmqueue.org/modules.php?name=Content&pa=showpage&pid=143)) for those interested in search engines.

</comment><comment><USER3> That probably explains why most humans prefer to walk, once they've developed the necessary motor skills. It's a much more efficient way to move and puts a lot less strain on the wrists and knees.

(Just in case someone mistakes this for seriousness, I did RTFA)</comment>


Hidden water below antarctica provides hope for life on Mars - <AUTHOR> http://www.theverge.com/2015/4/28/8507769/antarctica-salt-water-life-mars

<comment><USER2> There is life on earth more than a mile below us all. You can sink a mine shaft down almost anywhere on the surface and find life deep underground. If we wanted to find life on Mars this is where we should be looking.

One this topic there is so much rock transfer between Mars and Earth (about 100kg a year) that both planets are effectively one ecosystem.

<comment><USER3> That raises an interesting point. There are actually two different concepts of life on Mars:

      1) Life that has a shared lineage with Earth life.
      2) Life that is unrelated to Earth life.

#1 would be neat news, but it wouldn't be particularly earth shattering news (hah). As you mention, this would be through ejecta transfer - some primordial bacteria hitching a ride on interplanetary asteroid impact debris.

The thing about #1 is that we're almost certain it's completely plausible. We have extremophiles on Earth that live in conditions just as harsh as some of the places on Mars. The tricky part would be getting them there. Sadly, biological transfer between planets doesn't really help us fill in any of the variables in the Drake equation...

But #2 - that would be incredible. If we were to find life on Mars _and_ we could prove that it had no relation to life on Earth, that forcibly changes everyone's cosmic perspective. Proving that life evolved independently twice in the same solar system would mean the universe must be teeming with it.

<comment><USER2> If I had to make a bet I would predict that we will find that there is life in a number of locations within the solar system (Mars, some of the moons of Jupiter and Saturn) and they will all be related to life on earth. The Earth has a cosmic cold and has been sneezing in all directions for billions of years.

One of the interesting things about bacteria is that there are two major lineages here on earth (the archea and the true bacteria). Some people have speculated that one arose on Earth and the other on Mars, but I doubt we will ever find good evidence for this speculation.</comment></comment></comment>


The 10000 hour rule and why it matters - <AUTHOR> http://connecteev.com/the-10000-hour-rule/ What is the 10,000 hour rule and how can you use it? What does it take to achieve mastery at anything? <comment><AUTHOR> This is a controversial topic. Curious what's your take on this?</comment>


The Heretic - An opinionated newsletter on all things startup - <AUTHOR> http://theheretic.me/

<comment><USER2> Pascal's newsletter is one of the best "blogs" on entrepreneurship and innovation out there. He's just awesome and has a ton of reflected experience and a great pool of guest posters. You'll love the format. It's concise and to the point. I also recommend going through the archive. A ton of great holistic advice in there.

If you are into startups and shaping the future subscribing will be one of the best things you did today.

</comment><comment><USER3> Better than a blog, Pascal is offering insightful and informative information in quick reads delivered right to your inbox.

I've enjoyed every writing, and found something useful, helpful, humorous or challenging in each.

</comment><comment><USER4> yeah this is way more fun than a blog - it's like a little inbox treat (and ass-kick) every day with nuggets of actionable wisdom. He's a great mix of benevolent advisor and drill sergeant.

</comment><comment><USER5> Pascal's newsletters are the best! Pithy and to the point I feel inspired each time one lands in my inbox.

</comment><comment><USER6> No Bullshit from one of the brightest and most honest minds in tech. Pascal lights a fire under my ass.

</comment><comment><USER7> The best blog about startups and entrepreneurship on the net. And very funny to read.

</comment><comment><USER8> Pascal is awesome. I really recommend subscribing to his Newsletter.

</comment><comment><USER9> the heretic offers priceless advice for anyone. it's great to get insights and thoughts and they are brought to you in just the right quantities. definately my personal must-read.

</comment><comment><USER10> Just go for it, great posts!</comment>


21 android apps ripped off, exploits added and republished. 200k d/ls. - <AUTHOR> http://www.reddit.com/r/netsec/comments/fvhdw/someone_just_ripped_off_21_popular_free_apps_from/ <comment><AUTHOR> Apologies if the headline seems a little cryptic. This a link to an ongoing discussion on reddit about how 21 popular apps on the android marketplace were downloaded, had root exploit code added before being repackaged and put up on the official android market for download. There's since been between 50,000-200,000 downloads of these trojaned apps in the past 4 days.

There's some commentary here: [http://blog.mylookout.com/2011/03/security- alert-malware-fou...](http://blog.mylookout.com/2011/03/security-alert- malware-found-in-official-android-market-droiddream/) along with a list of publishers and applications.

If you're an android developer you might want to check this out. If you've been affected I'd love to hear your thoughts and feelings about this here.</comment>


Detained and interrogated for 10 hours in North Korea - <AUTHOR> http://www.bbc.com/news/magazine-36200530 <comment><USER2> While no doubt terrifying, the actual procedures and interrogation methods here are little different than in western nations. US agents are free to grab people as the leave the country. And 10 hours is nothing. A US court won't think anything of a detention lasting less than 24 hours. Even the questioning seems to follow standard law enforcement procedure, with teams of age-diverse interrogators being rotated in and out periodically. So while I have great respect for Rupert Wingfield-Hayes and will continue to do so, he should talk to those who have been detained at other airports on similar accusations.

North Korea surely has a more dramatic penal system, a deadly one. But as this reporter feared the labour camp, those at US airports faced with FBI agents accusing them of terrorism see Gitmo and the black sites.

<comment><USER3> It is not in fact normal in Western nations to be detained at the border and threatened with a month's additional detention for writing that the nation's people have the voices of dogs or ugly faces. Be careful about false equivalence. Every Western nation does, or has recently done, many bad things. Perhaps the US has done more bad things than most. But none of them are comparable to North Korea.

This rhetorical point-scoring is so old it has several names; "tu quoque" is a formal one, but the more evocative of them is "And you are lynching Negroes".

<comment><USER4> No one claimed that it _is_ normal to be detained for insults in Western nations, you're the only one arguing that point. Parent comment specifically mentioned terrorism accusations in the context of treatment that Hayes experienced and the fears he envisioned. Had they said that all travelers to the US have fears of being held on terrorism charges then you would have a point, but they didn't. It was limited to how people _already_ accused of terrorism are treated [0] and what fears they have, not travelers in general.

>Perhaps the US has done more bad things than most. But none of them are comparable to North Korea.

Playing that game won't be productive.

[0] [https://varnull.adityamukerjee.net/2013/08/22/dont-fly- durin...](https://varnull.adityamukerjee.net/2013/08/22/dont-fly-during- ramadan/)

</comment></comment></comment><comment><USER5> Sincerely, people should just stop going there. Historically it is extremely difficult for a real regimen change towards democracy to be forced from the outside. And by going there we are only giving them credit, since they show what they choose to show that does not correspond to the reality of the country.

Just close the contact, close the product transactions, let them (the party) to rot for a while. The people will suffer a bit more for a time, but it could be the trigger to have the people finally rebel against the regimen.

<comment><USER6> > Sincerely, people should just stop going there.

Because that worked so well in Cuba.

<comment><USER7> Americans might have stopped going but there has been 3 millions of non- Americans tourists in Cuba every year.

<comment><USER6> It's the same situation in Korea, just a different mechanism. The refugee crisis that would result from a DPRK collapse would land on China's doorstep, so the Chinese will do whatever it takes to prevent that from happening. U.S. tourists (or any tourists for that matter) not going to the DPRK won't change that.

What _might_ change the situation is people in the DPRK meeting U.S. tourists and seeing with their own eyes that we are not the monsters we have been made out to be. Big societal changes can grow from small seeds of doubt.

<comment><USER8> Unfortunately, you can't actually meet DPRK citizens on a tour to the DPRK. The only way you can visit is by going on a DPRK government-sponsored tour where you are herded between 'culturally important' landmarks by government approved tour guides. The DPRK is leaps and bounds ahead of you on controlling this sort of 'cultural creep.' Also, they appreciate the significant donation to their government for the short tour.

<comment><USER6> > you can't actually meet DPRK citizens on a tour to the DPRK.

Of course you can. Your government minders are DPRK citizens.

> The DPRK is leaps and bounds ahead of you on controlling this sort of > 'cultural creep.'

Of course they are. But a tourism embargo is not going to change that.

Look, it's possible that the DPRK really is an evolutionarily stable strategy, and they might be able to maintain their totalitarian regime forever. But _if_ there's a way to crack it, the most likely mechanism is through instilling doubt into individual North Koreans that everything that they are being told is true. The best way to do that is to _show them evidence_ that some of the things that they are being told is not true, and you can't do that if you're not there. You might not be able to do it even if you are there, but at least if you're there, there is a possibility.

</comment></comment></comment></comment></comment></comment><comment> saiya-jin I, as anybody here have no sympathy for any oppressive regimes, and NK one is extreme out of extremes.

that said, journalist detained is an idiot. either completely incompetent and uninformed on what it actually means visiting such a regime (hard to believe), or just plain old ignorant bloated ego "I am above". from his own words on description of situation, I am not surprised he was detained, rather that he got out so easily from such a place.

<comment><USER9> I think you might need to do a bit more research on Rupert Wingfield-Hayes... he's neither an idiot, nor an attention seeker - indeed from the reports I've seen him do from various undesirable places on BBC News over the years, it appears he's a very competent journalist and not one who's afraid to be in a dangerous place to get a story out.

Did you actually read the comments that the DPRK officials made about his statements? Typical frame-up things, intentionally taking offence where none in particular was meant. There are plenty of things that RW-H could have said since being released which he appears not to have done.

The naivety of some of the comments on this thread is baffling to me. North Korea isn't a problem which is just going to go away. It's far more stable than the Syrian civil war, and that's been going on for years. NK could continue indefinitely by doing what it's doing.

<comment> saiya-jin if you write a rather insulting article about half of the countries in this world (probably most/all muslim ones, and all non-democratic ones), you can expect they might hit back when you visit again. surprise surprise - they did, and in rather standard (and non-violent) way for these regimes.

it's a ridiculous place, nobody argues about that. most folks have common sense and don't poke a lion in the eye with the stick in his own territory. would you? probably not. then why should I have any sympathy for this guy? he did exactly that, and his surprise when they detained him just shows what I've written - ignorance.

would you go to Iran and write before an article in BBC saying how their officers are idiots barking around? (i loved visiting that place, but common sense is needed, and this guy didn't show much).

</comment></comment></comment><comment><USER10> This is just attention seeking, not a real article. I have never worked as a journalist but even I know: When you are in North Korea, you don't write articles about North Korea. And if you have written western style articles about North Korea in the past you don't ever go there. Everything else can only be considered on purpose. There is no harm done here. I'm surprised that with his attitude they only kept him for 10 hours.

<comment><USER11> _> I have never worked as a journalist but even I know_

Curious, and how would you "know"?

<comment><USER4> It can be as simple as reading the WikiTravel article about the country. Doing the slightest amount of cursory research beforehand will clue you in. The journalist has been there before, so it is safe to assume he is in the know. It seems like resisting the urge to write the most trite garbage imaginable was too much for him. The articles he wrote have been written countless times before, so what was the value in his visit?

</comment></comment></comment><comment><USER12> Issue is he thought that because he was a reporter that he was not at risk, which was foolish.

Anyone entering North Korea should realize that there is the very real chance that they may be held against their will, be killed, etc.

Knowing this, only then should someone decide if it makes sense to visit.

<comment><USER13> The point of the detainment was to get "an apology" for the published articles for the purpose of making an example of the journalist for other news agencies and also for internal audiences who may have read the articles.

These articles (and the "follow-up" detainment article) provided a valuable glimpse into a closed society. I am confident Mr Wingfield-Hayes is a responsible adult who can make his own decisions about risk.

</comment></comment><comment><USER14> I was detained and interrogated for 12 hours in Congo, accused of being a spy for the CIA. The whole thing was very scary.

<comment><USER15> Czech game developers face 20 years of prison in Greece... They took photos of public buildings

<comment> maze-le They were released over 3 years ago, after over 100 days in jail... They were arrested for photographing a military base, wich is not exactly a public building (and illegal in every country I know of).

<comment><USER16> It is legal to photograph a military base (or any other government property, for that matter) in the US, provided that you do it from the public right-of- way (or any other place you would otherwise have a right to be). Unfortunately, MPs, sheriff's deputies, and municipal police officers (if applicable) are very likely to hassle you about it anyway, and possibly also detain you on any convenient pretext, should you attempt it.

This had bred a variety of protester that will stand on the public sidewalk, photographing things, until a cop shows up. The police encounter is recorded in its entirety. Depending on what the cop does, the protester may then sue for rights violations, and typically receives a settlement offer after the judge sees the video, which then gets posted to the Internet to fan your outrage.

<comment><USER17> I may have misread your tone, but you sound as if you find such protesters distasteful. I for one hope they bravely continue, until such time as one need not fear being detained on convenient pretexts for legal activities.

<comment><USER16> Yes, you definitely misread. The only thing I find distasteful about such protests is that those cops who enforce laws that do not exist are not generally held personally accountable for their actions in any meaningful way, even when they cost their county/municipality tens of thousands of dollars for just a few minutes worth of unprofessional conduct.

</comment></comment></comment></comment></comment></comment><comment><USER18> Lesson: Don't go to North Korea.

<comment><USER19> I saw here on HN the other day a guy in the USA who's detained for 7 moths without charge. Lesson: Don't go to, or stay in, the USA.

<comment><USER5> Are you not allowed, as a visitor to the USA to go and report about any place inside the USA were any other citizen of the USA is allowed to go and to report about?

<comment><USER19> I don't know. You tell me, as you seem to be so well informed and ready to jump in the defense of the USA. Are you not allowed, as a visitor to NK to go and report about any place inside NK were any other citizen of NK is allowed to go and to report about?

<comment><USER20> No, you are not, as evidenced by the presence of escorts throughout your stay and the search of all of your digital media upon entry and exit of the country.

<comment><USER19> Is that evidence that NK journalists don't get the same treatment as foreign journalists? How so?

</comment></comment></comment></comment></comment></comment><comment><USER21> Sounds like the US for the wrong nationality/demographic, to me...

</comment><comment><USER22> WTF does the BBC endanger their reporters by publishing anything while they are in such an incredibly dangerous country?

<comment><USER23> Pure Gonzo journalism

</comment></comment><comment><USER24> I would like to point out the figurative middle finger the BBC is giving to NK. The offensive material that they pointed to are still published on the BBC website, even though the apology stated that they'd be taken down.

</comment><comment><USER25> I'm curious if the decision to detain him came from the very top. Additionally if it was actually because of the nuclear bomb question he asked the student in the video.

</comment><comment><USER26> 10 hours of questioning? What an authoritarian monstrosity of a state. Civilized countries limit their overreaching interrogations-cum-intimidations of journalists to 9 hours.[0]

How brave of the BBC to report dispassionately on this alien, backwards nation.[1]

[0]: [http://www.bbc.com/news/uk-23782782](http://www.bbc.com/news/uk-23782782)

[1]: [https://www.youtube.com/watch?v=9pnt_uT5YzQ](https://www.youtube.com/watch?v=9pnt_uT5YzQ)

</comment><comment><USER15> > _I was told that my reporting had insulted the Korean people, and that I > needed to admit my mistakes. They produced copies of three articles that had > been published on the BBC website, as I reported on the visit of the Nobel > laureates._

Hate speech is punishable even in UK.

<comment><USER27> Yes, but using "bark" as a synonym for "shout" doesn't count as hate speech.

<comment><USER15> It has negative connotation. People were charged (and jailed) for less.

Plus he wrote a bit more.

<comment><USER28> It has a negative connotation so it is hate speech? I think not. [edited: used to read hate crime, wasn't paying attention]

<comment><USER29> You're the first one to bring up hate crimes here.

Edit: downvotes? Maybe you should look up UK hate speech laws before deciding that violating them constitutes as hate crime.

<comment><USER30> You're responding in a thread that started by someone claiming this was hate speech, and your response to one of the child posters is that "You're the first one to bring up hate crimes here". I imagine this is the reason for the completely warranted downvotes. Context matters, and you're just diverting the discussion without adding anything.

<comment><USER29> hate speech=/=hate crimes

UK has had, and still does have very aggressive legislation to combat "hate speech" and offensive speech in general.

It's not very far fetched that such a statement could have been in violation of said laws, but that certainly wouldn't make it a hate crime.

While jkots wording could have been better, there's still a very important distinction here.

<comment><USER31> Well, if there's _very aggressive legislation to combat "hate speech"_, is it unreasonable to call this target of combat "hate crimes" (or hate "crimes")?

With such aggressive legislation, I'm a bit wary of even going to the UK (I'm not a native speaker of English.)

<comment><USER29> Yes, hate crimes are generally defined by the perpetrators motivations.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: Best way to teach programming - <AUTHOR> What is the best way to teach a programming language to someone with little to no software development experience? How have you seen or experienced it first hand?<p>Some of us are self taught, some learned in a classroom. What methods exist other than self teaching with book and a compiler and what have you seen work best? I'm not talking about something that can be mastered in a few hours like some of these "teach yourself to code" tutorial sites. I mean what is the best way to help people go from 0 to average? <comment><USER2> I was a frontend hobbyist a couple of years before I decided to pursue this full time, and for me, I found that a bootcamp for fullstack web development was the way to go to REALLY get up and running. I found that dedicating half my day (or more) learning and coding in a classroom with like minds was the only way I was able to go from a passing interest in this field to something that I could actually see doing for the rest of my career (and for my own benefit beyond that).

Having seen more than one person go through them and on my experience though, not all bootcamps are created equal (in addition to how much work you put into it). Mine was fantastic, I got lucky. So also be sure to do the research first, and ask other (hopefully impartial) developers what their thoughts are on whatever ones you're interested in.

If that's not an option, before I went to my bootcamp and I had some confidence in my basic skills, I started to ask people who wouldn't have been able to afford a custom built static site on their own if they'd like a free one. It gave me practice with my frontend skills, they got a neat product, and I could have a portfolio piece. Everyone was happy, and I met a lot of neat people along the way. The TL:DR; on that is I'd suggest doing some practice, then finding something that you'd like the build (because you need it or want it), and then try building it with a mentor and plentiful tutorials.

</comment><comment><USER3> To get the basics down, I'd recommend [http://codeacademy.com](http://codeacademy.com), [http://teamtreehouse.com/](http://teamtreehouse.com/), or a [http://udemy.com](http://udemy.com) or [http://lynda.com](http://lynda.com) course.

I'm self-taught as a youngster, just pure curiosity, started in Visual Basic 3.0 to 6.0, and eventually Visual Basic.NET, and eventually got into web design (PHP, Javascript).. but I have no idea what would've been had I learned it later in life. But my girlfriend has used codeacademy.com in the past to learn the basics of javascript, html, css, etc.

While these are definitely good learning areas, the best way to learn is to have a real assignment in practical application. In other words, it would be coming up with a few applications that are useful.

To-Do lists. Reminder lists. Building a contact form. Learning how to use and implement API. Learning how to connect and utilize a MySQL database.

As for what program to learn? It is best to look up whats in demand and what is likely going to be in demand in the future. And for that, I could only suggest learning Ruby, Python, or Java/Javascript.

Go, R, Swift, C++, C#, C, PHP are all languages that wouldn't steer anyone wrong, either.

Learning the basic concepts of at least two different programming languages and syntax are especially important. If you can grasp the concept of at least two, you can most likely learn them all and it wouldn't be much of a hard transition for any of them.

</comment><comment><USER4> Do you mean you will be teaching someone or what you can suggest to someone that goes and reads/does etc to get him to an average programmer?

For me it was always great to see results when learning programming (a website, a mini app). My first contacts in a classroom environment with programming where not successful as they where teaching more theory or how something would work. I really caught on when someone showed me how to write a real (very basic) app. What I was taught had a purpose and output I could immediately see.

Since I started learning rails and used his tutorial I still think that Michael Hartls Rails Tutorial is one of the best to get started. He teaches you the proper concepts (TTD etc.) and techniques while keeping it simple and still building something right from the beginning. Ah yes, and it is free (railstutorial.org/book).

If you will be teaching it to somebody you could also use this book as a guideline, make them work through it and help him with problems. He/she will have a working app in the end and have learned the basics of web development by then.

</comment><comment><USER5> After you have some experience, go to a hackathon

Try to narrow your scope and come up with a short achievable idea. Then, implement the project with the timeframe of the hackathon. If you have issues, just talk to the engineers on-site from different companies. They are all more than happy to help on architecture and application design questions etc. etc.

Somehow, we learn better under pressure and under fire. This is how I got into python :)</comment>


OPNsense - Open source FreeBSD based firewall and routing platform - <AUTHOR> http://opnsense.org

<comment><USER2> Most of the features described come from the fact that FreeBSD ships with OpenBSD's PF (among others). Why would you build it pick FreeBSD considering their PF version is _very_ outdated ?

I think going with an OpenBSD base would make more sense for a 'routing platform' as OpenBSD ships with various routing daemons and other network daemons that fit the description better (isakmpd/iked for IPsec with IKE/IKEv2, npppd for L2TP based tunnels ...). Obviously, you can install and use OpenVPN, pretty much any DNS implementation of your choosing to provide additional features. You also get a bunch of security features to mitigate attacks.[1] Most of them are enabled by default too, contrary to FreeBSD [2](though I have not checked if OPNsense enables them -- it makes sense to enable them, even more so on the network gateway)

AFAIK, FreeBSD has better MP support than OpenBSD (though that is a work in progress), and more actively developed wireless stack. Are there any other motivations for using FreeBSD ?

[1] [http://www.openbsd.org/papers/ru13-deraadt/](http://www.openbsd.org/papers/ru13-deraadt/)

[2] [http://networkfilter.blogspot.fr/2014/12/security-openbsd- vs...](http://networkfilter.blogspot.fr/2014/12/security-openbsd-vs- freebsd.html)

<comment><USER3> FreeBSD pf might be outdated, but it's not insecure and it has been improved with SMP. I don't want to argue over benchmarks but some say OpenBSD is faster, others say that's only true on old hardware, etc etc.

A lot of those in [1] are coming to FreeBSD via the HardenedBSD project. But honestly performance, ports, support for higher end NICs, etc are probably the reason. I've heard from several that the network stack in FreeBSD in general scales better. I guess it depends on who your audience is.

It sounds like you'd personally be more interested in Esdenera

[https://www.esdenera.com](https://www.esdenera.com)

</comment></comment><comment><USER3> They've beaten pfSense to a release on FreeBSD 10, have modernized the web interface (still PHP though), and will hopefully work on tightening up security while simultaneously cooperating better with their upstream BSDs.

I wish them the best.

<comment><USER4> I, too, wish them the best.

But pfSense 2.2 is clearly based on FreeBSD 10.1.

</comment></comment><comment><USER3> test? last post didn't work

</comment><comment><USER3> test comment</comment>


Keen IO Raises $2.35M For Its Custom Analytics Platform - <AUTHOR> http://techcrunch.com/2013/10/23/keen-io-funding/

<comment><USER2> Built a custom analytics tool around Keen.io. Fast and reliable. Good docs. Good support. Looks to be steadily improving too.

Glad to hear they are being rewarded for the good work!

<comment><USER3> Thanks for the kind words. :)

</comment></comment><comment><USER4> Kyle and crew are a top tier laser focused team who consistently sets the bar with their products. I couldn't be more excited for them!

</comment><comment><USER5> super stoked for this team. trajectory: upwards and onwards.

</comment><comment><USER6> Nice!</comment>


Remarks at NBER Conference on Diversifying the Science and Eng Workforce (2005) - <AUTHOR> http://www.harvard.edu/president/speeches/summers_2005/nber.php

<comment><USER2> No need to access the Wayback Machine. You can read it here: [http://www.harvard.edu/president/speeches/summers_2005/nber....](http://www.harvard.edu/president/speeches/summers_2005/nber.php)

IIRC, that was the speech that got him headed out the door at Harvard.</comment>


Malware blamed for fatal Spanair plane crash - <AUTHOR> http://www.msnbc.msn.com/id/38790670/ns/technology_and_science-security/?gt1=43001

<comment><USER2> To clarify, the malware was running on the system that the mechanics use to log incidents. The plane had had three recent incidents that would have grounded the plane had they been known, but they weren't. The reason they weren't was a combination of the mechanic's neglect and possibly that the system was crippled by malware.

Here is a better article (Spanish to English translation): [http://translate.google.com/translate?js=y&prev=_t&h...](http://translate.google.com/translate?js=y&prev=_t&hl=en&ie=UTF-8&layout=1&eotf=1&u=http://www.elpais.com/articulo/espana/ordenador/Spanair/anotaba/fallos/aviones/tenia/virus/elpepiesp/20100820elpepinac_11/Tes&sl=es&tl=en&act=url)

<comment><USER3> Good clarification --- a quick read of the MSNBC piece leads you to believe that an on-board system was infected.

<comment><USER2> That's how I read it at first too. I think it's partly the result of a gramatical ambiguity:

"(a central computer system used to monitor technical problems) in the aircraft was infected with malware"

vs.

"a central computer system used to monitor (technical problems in the aircraft) was infected with malware"

<comment><USER4> Interesting, I read it with the second meaning and not the first.

I'm italian and in my language sentences are less structured, allowing you to move parts around "almost freely". So for me it's natural to bond "complements" to the nearest "object" in the sentence (sorry, I don't know the right words for this).

Is it different in English?

<comment><USER5> It's ambiguous, so the behaviour is undefined. The author should change the sentence to make it conform to the standards.

</comment></comment></comment></comment></comment><comment><USER6> Airliners.net has an interesting discussion about it by industry professionals [http://www.airliners.net/aviation- forums/general_aviation/re...](http://www.airliners.net/aviation- forums/general_aviation/read.main/4904992/)

(and nutheads who like planes...)

</comment><comment><USER7> I suppose that the author of this malware was prepared to accept imposing financial costs on their victims. After all, it's only money, right?

I wonder how they feel now that people have died as a result of their law- breaking.

<comment><USER8> s/author of this malware/person that decided to run critical safety equipment on a network connected OS known to be vulnerable to many many viruses from many many vectors/

s/law-breaking/incompetence/

Spanair crash - Windows Malware implicated

BP Deepwater Horizon oil spill - Windows BSOD implicated

Incompetence and penny pinching

<comment><USER9> Airplane crashes and things like deepwater horizon are caused by a series of cascading failures and in some way insinuating that it is just malware (or Windows) is goofy. Obviously someone has an agenda.

<comment><USER8> The series of steps that allows something with such a large attack surface as a Windows network to operate as last resort air traffic safety shutdown system.

It's IT Dept. incompetence. I'd go so far as to call it negligence, maybe even culpable.</comment></comment></comment></comment>


Make An iPhone, Android App Without Knowing A Line Of Code - <AUTHOR> http://www.fastcompany.com/1825568/mobile-apps-close-to-the-apps-20-era-become-almost-off-the-shelf

<comment><USER2> This service appears to basically be the same as the existing limited- structure app building services like AppBakr, iAppBuildr, Mobile Roadie, etc.

Nowyouknow introduced Codiqa which looks pretty sweet as it doesn't restrict you to a small subset of functionality and fixed structure, but it is limited to producing web prototypes.

Alternatively, Blueprint (<https://blueprint.io>) lets designers build their native iOS apps directly, with a similar interface to Illustrator or Codiqa.

Blueprint differs from such limited-structure services in that you get very fine-grained control over the design & functionality of your app. Designers deserve better than a list of checkboxes of what should be in their app!

</comment><comment><USER3> After finding Codiqa as the top post earlier and it blowing me away, this app to create an app seems to be subpar.</comment>


Teespring signs up with the NFL to sell custom fan t-shirts - <AUTHOR> http://www.forbes.com/sites/alexkonrad/2015/08/26/teespring-and-nfl-team-up-for-tees/?

<comment><AUTHOR> I'm so excited by this news, Teespring CEO Walker Williams used to hang out on the #startups IRC channel on Freenode, and talk about startup ideas.

I remember him talking about Teespring, and I remember testing it too, on one of my FB pages.

I'm not employed by them or anything, but I feel extremely proud of what they've accomplished!

</comment><comment><USER2> This is fantastic. It's always heartening to see successes like this. Well done, Teespring!</comment>


The new version of JS.Coach website released - <AUTHOR> https://js.coach/ <comment><AUTHOR> JS.Coach is a website that helps you choose the best library by using different categories and filters. In the latest update, we tried to focus on improving the performance and support of small screens; Also now you can see the bundle sizes and the download time on different Internet speed in package detail page. We will be supporting a wide range of frameworks and more libraries in Javascript world soon.</comment>


Sqlmap – Automatic SQL injection and database takeover tool - <AUTHOR> http://sqlmap.org/ <comment><AUTHOR> AFAIK...SQLmap is pretty old, right? I definitely have vaguely heard of it before...however, I was surprised to see it have not just a spiffy Github Pages homepage (after being on SourceForge), but a pretty highly followed Github account with commits in just the past couple of days.

But honestly, I have never heard another developer talk about using it (though I imagine full time sysops and security folks know it well)...even though it seems like it has an API easy enough to use and throw in as part of your dev toolkit (e.g. run it as part of an integrated test quite).

<comment><USER2> SQLmap has been part of many hackers' toolkits for quite some time now. It's very well known in the security industry as you suspected, and many of us penetration testers use it quite a bit for automating web app testing. I do imagine that it could be very useful for web devs, to test their security, and I wish more of them used it regularly!

</comment></comment><comment><USER3> The "-g GOOGLEDORK" and the "\--tor" flags are key to any script kiddies arsenal. That's why you see so many low-level db breaches posted on things like Pastebin. Set those two flags and you have automated sql injection for easy targets.

</comment><comment><USER4> "Full support for six SQL injection techniques: boolean-based blind, time- based blind, error-based, UNION query-based, stacked queries and out-of-band."

Prevented with prepared statements - correct?

<comment><USER5> As long as you use prepared statements correctly.

I can't tell you how many times I've seen someone passing a query though the prepared query method but still crafting the query dynamically

Stuff like:

prepareQuery("SELECT something FROM table WHERE col='"+userInput+"' and otherCol=?", otherUserInput);

That is still vulnerable even though prepared statements are in use. As long as user input doesn't find its way into the query string though you should be safe from these assuming the issue isn't internal like bad stored procedures creating queries based on input.

<comment><USER6> >prepareQuery("SELECT something FROM table WHERE col='"+userInput+"' and otherCol=?", otherUserInput);

This is very dumb, yet too common. :-/

</comment></comment></comment><comment><USER7> I played with SQLMap a bit on Kali. Easy tool to use, plays nicely with SOCKS5/TOR. I'm amazed at how prevalent SQLi is as an attack vector still. With PreparedStatements/PDO/other query libraries I would have bet this vector would have been all but eliminated many years ago.

<comment><USER8> I've been doing penetration testing of web applications professionally for about 5 years now. The incidence of SQLi has definitely decreased over the years but I would estimate that we still identify it on approximately 1 of every 5 web apps that we test for our clients. Usually, the more obvious SQLi has been found and patched already years ago. An example of obvious SQLi is 'error based SQLi' where the application returns verbose error messages such as:

      "You have an error in your SQL syntax; check the manual
      that corresponds to your MySQL server version for the
      right syntax to use near '\'' at line 1"

As soon as we see an error message like this, we know we can dump the entire database in a matter of minutes.

These days, we usually have to work a bit harder to find the more difficult to identify and exploit SQLi (e.g. boolean-based blind and time based) but the end result is the same once we do. SQLMap is a standard tool in a any good web app penetration tester's toolkit. It's not always going to work but when it does it automates away a lot of the grunt work. I applaud the SQLMap developers who seem to know SQL inside out and actively acknowledge feedback from the community.

For any devs, this is decent guide for preventing SQLi:

[https://www.owasp.org/index.php/SQL_Injection_Prevention_Che...](https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet)

<comment><USER7> My experience is fairly similar. How often does SQLMap (or another SQLi automated tool) fail to recognize a hole that is later uncovered through a manual investigation?

<comment><USER8> As per my other comment below, the intended use case for SQLmap is more around exploitation rather than identifying injection points. Penetration testers will usually identify the injectable parameters through other means (e.g. using purpose built security HTTP proxy software such as 'Burp Suite' and 'Zed Attack Proxy'). After they have confirmed the existence of SQLi, they will then feed the HTTP request and vulnerable parameter into SQLMap to automate exploitation (i.e. dump DB contents and hashes etc).

I would say that SQLmap is normally effective at determining whether a HTTP parameter is injectable with a high degree of confidence. However, sometimes there will be Web Application Firewall (WAF) filters or unusual/inconsistent application behaviour on certain inputs which means it can't confirm whether the parameter is definitely vulnerable or not (less than 10% of the time in my experience). For the same reasons, often it won't be able to successfully automate the exploitation for you. On those occasions, we have to craft our queries manually to exfiltrate database contents and so forth.

</comment></comment></comment></comment><comment><USER9> When using something like LINQ or Entity, I assume that SQL injection is a "solved" problem. As long as you aren't doing something crazy like writing stored procedures which internally concat user strings with query language, it's a whole class of attacks which you know will not succeed. Has anyone ever proven this wrong?

And then there's the VTech's of the world.... sheesh!

<comment><USER10> It is disturbing to know how many web applications simply forgo any sort of strong type enforcement on arguments and variables supplied directly to SQL as raw strings, simply because developers "don't like" or rather can be bothered with the wrestling matches needed, when explaining to non-technical people, the reason why it will take so long to add new features to an already expensive investment of development effort.

Many people out there just simply don't feel like writing prepared statements, entity classes for domain specific problems, or pushing past SQL query strings, and treating a data access layer as more than a scriptable text-based input vector to a glorified command line tool.

For as long as there are SQL databases, so too, there shall be successful SQL injection attacks.

<comment><USER11> >simply because developers "don't like" or rather can be bothered with the wrestling matches needed

In all fairness, I'd say it's more like web application security is a huge field (larger than just SQLi) and a developer typically has their hands full wrestling the technologies they use on a daily basis.

I am the most senior developer here in a team of 6 and we all know just the most basic facts about SQLi (use stored procedures), XSS (use sanitizing libraries) and it ends right at CRSF. Of the OWASP top 10, we have an eye on the top 4 and I wouldn't wager a high bet we have them nailed down.

It feels bad, but considering the resources we'd need to pour into getting one of our better devs trained in all the facets of web app security, it's unlikely to change any time soon.

<comment><USER12> >It feels bad, but considering the resources we'd need to pour into getting one of our better devs trained in all the facets of web app security, it's unlikely to change any time soon.

Consider the resources you'll have to expend in the event of compromise and compare. While this analysis doesn't _always_ prove the slower but more secure approach to be cheaper, it usually does. Unfortunately, you usually can't get the people holding the purse strings to accept the trade until they've been bitten.

<comment><USER11> The last time I wrote a longish mail why we should at least pour _some_ resources into this, my superior (who straddles technical and managerial role and is responsible for budget oversight) answered:

"Thanks for bringing this topic up, Mr. iSnow.

Looking at it pragmatically, we have no real use-case for that right now, so I don't think it's the right time to dive into it. I will, however, keep it in mind and would ask the team to collect information on this and keep an eye on the subject".

And of course, without dedicated time and budget for such a large area, developers can either cheat and hide learning it between feature requests or don't do anything about it. So, I am totally not surprised things like the VTech break-in happen all the time, I just don't think it's fair to blame developer's inertia for it.

</comment></comment></comment></comment></comment><comment><USER13> I used this just today to demonstrate to our developers why their attempts to fix SQL injection via real_escape_string and regex wasn't a good idea. Great tool.

<comment><USER6> Why using real_escape_string wouldn't help fixing sqli? Could you provide some examples?

I know prepared statements are the way to go but proper escaping, even if tedious, seams to be OK for me.

<comment><USER13> Some examples can be found here: [http://stackoverflow.com/questions/5741187/sql-injection- tha...](http://stackoverflow.com/questions/5741187/sql-injection-that-gets- around-mysql-real-escape-string)

</comment></comment></comment><comment><USER14> This looks like a great time and money saver. Thanks for this to all contributors. I will test drive it soon on my app that requires high security level.

<comment><USER8> In my opinion, this is not really SQLMaps intended use case. It's essentially an exploitation tool for penetration testers and doesn't provide a proper mechanism to just scan your app looking for SQL injection points. There are better tools for that (google 'Burp Suite') and if your app requires a high security level you should be engaging a full time infosec professional to manually assess it.</comment></comment>


In Mark Zuckerberg's world, lying is the only way to be yourself - <AUTHOR> http://www.theverge.com/2012/10/4/3437364/mark-zuckerberg-facebook-world-lying-only-way-yourself

<comment><USER2> > "If someone can be completely encapsulated by a bunch of photos, links, and > pokes, do you really want to be friends with them anyway?"

That about sums it up.</comment>


Anonymous declares war on religion - <AUTHOR> http://www.webpronews.com/anonymous-declares-war-on-religion-2012-03

<comment><USER2> If this is true then it appears to be a change in the MO of Anonymous generally they have targeted groups such as Scientology, MPAA/RIAA that actively attack critics and abuse laws and systems to victimize people. Actively perusing organizations that are voluntary in nature and that are not actively abusing anyone outside of their organization who voluntarily associate with that orginization seems like a step in the direction of the oppression that they claim to be fighting against. Kind of like becoming the thought police, where if you don't view the world like Anonymous (or at least a segment of them) well then you are "Fair Game". There is a lot of hypocrisy in their statement if this is now their new mantra and this is in the end the problem with vigilantism. absolute power corrupts absolutely, Anonymous is not immune to that reality, if they are attacking organizations that mind their own business then they themselves have become the aggressors and oppressors.

<comment><AUTHOR> Religion? Minding its own business? Anybody with the ability to read a history textbook or pick up a newspaper can see what religion's about. The major religions of the world (Christianity, Islam, Hinduism) have been responsible for mass murders among other crimes in the past. Even today people are killed/maimed in the name of religion in a lot of countries. Human progress is stifled in the name of religion. People can't exercise certain rights because the religious won't let them. The world would be a better place without religion.

(I know there are so many intelligent religious people who've contributed more to society and science than most of us probably will but in my opinion it's hard to ignore something that you've been brainwashed into believing as a child. I think these people would have been just as awesome if they were born in a world devoid of religion)

Edit: I don't approve of Anonymous' activities. I don't think defacing websites solves anything. I just didn't agree with your argument that Anonymous is targetting a bunch of people who're harmlessly minding their own business.

<comment><USER2> _The major religions of the world (Christianity, Islam, Hinduism) have been responsible for mass murders among other crimes in the past_

Actually secularist governments in WW2 where responsible for more deaths than any other human atrocity the second largest atrocity was the An Lushan Rebellion and it was a secular land war as well, should we outlaw governments? But that is really besides the point, the point is people use religion et. al. as a scape goat for mans inhumanity to man. Human nature is complex and men have used all kinds of excuses to drive men to kill one another. If anything religion proves this, I mean all of the books pretty much universally say be a nice person, yet "men" are some how able to convince others that they say kill at the whims of your religious leader. Religion does not by any means have a monopoly on driving men to war. Look at the Army commercials they are geared towards appealing to the new secular godless man. They just replace god with Nobility, Honor and country. Men will kill each other over football, to see it as anything other than human nature is to mask the real issue, and prolongs finding the solution.

 _I just didn't agree with your argument that Anonymous is targetting a bunch of people who're harmlessly minding their own business._

So you argue that they should be held accountable for the sins of their fathers, because some religious person somewhere along the way killed a witch, then every religious person today is guilty. If that is the case should we not be held accountable for the sins of our fathers, any genocide committed by our fathers should it not also be our fault as well. I personally know many religious people and churches that have never persecuted another person and I personally think that yes they are harmlessly minding there own business. Unless we want to hold them accountable for history in which case we should be willing to take the same critical look at all groups we are linked to through history. I for one am German by ethnicity but I really don't want the sins of my history put on my shoulders, especially given the fact that I don't even live in Germany nor have I ever stepped foot there.

Further another often overlooked statistic is that religious organizations contribute to philanthropic causes 10 to 1 over secular organizations. We like to model the secularist billionaire like Ted Turner as the new model of giving but the reality of it is, the churches are still doing the lions share of the work. But just as we should not hold them accountable for the past of others we should not give all religious organizations credit for that giving and betterment of humanity. Each group is different, each church is different and each person is different and they should be judged by their deeds and not generalized with blanket statements about religion. Because religion can be both good or bad because it is an organization of men. And men are both good and bad.</comment></comment></comment>


Ask HN: Best web host for personal use? - <AUTHOR> I would like to host a web site for personal use. I may want to mess around with it to install different web apps or other slightly technical modifications (wallabag?). I have looked at Lithium Hosting and A Small Orange, but I'm having trouble finding any reliable sources for information. Basically, I expect low traffic but would like to have flexibility to use it as a bit of a sandbox. Thanks! <comment><USER2> DigitalOcean, Linode, Google Cloud Compute.

</comment><comment><USER3> aws t2.nano is less than $5 a month</comment>


Rules for Working From Home - <AUTHOR> http://www.inc.com/articles/2010/02/the-office-telecommute.html <comment><USER2> > Also, if friends and relatives believe you are less than seriously employed > they will start adding you to their lists of People Who Can Easily Host a > Last-Minute Book-Club Meeting or Pick Up My Child After School.

I can completely relate to this. When you tell people you are working from home today, they say "Oh, you're (using hand quotes) 'working from home' _wink_ _wink_ ", are you free to help me take my blah to the foozbar?

</comment><comment><USER3> I work from home frequently and love the casual dressing part. At least do not have to be in formal suit all the time. It make everyone looks the same... that my POV, people might differ.</comment>


The Microsoft Millionaires Come of Age - <AUTHOR> http://www.nytimes.com/2005/05/29/business/yourmoney/29millionaire.html <comment><USER2> Compared the the influence the Paypal gang the M$-types are just irrelevant in retirement as they are in computing science.</comment>


CLOCKER – CREATING A DOCKER CLOUD WITH APACHE BROOKLYN - <AUTHOR> http://www.cloudsoftcorp.com/blog/2014/06/clocker-creating-a-docker-cloud-with-apache-brooklyn/

<comment><USER2> Author here. This project uses jclouds to provision VMs in a cloud, installs Docker on them and then deploys an application across those VMs in Docker containers. There's a more detailed post on my blog as well:

\- [http://abstractvisitorpattern.blogspot.co.uk/2014/06/clocker...](http://abstractvisitorpattern.blogspot.co.uk/2014/06/clocker- implementing-docker-cloud-with.html)</comment>


Show HN: Themes and styles for SQL reporting services - <AUTHOR>

Made this a few months ago (http://reportsoup.com).
Think of it as a bootstrap for Microsoft's SQL Server Reporting Services (SSRS) reporting tool. Lets you share styles/fonts/elements across reports. I also included a few report templates to get you started.
This is my first run at a digital product and I tried to pick something I'm somewhat familiar with and saw a need for myself. Honestly though I'm just happy to have shipped something!  While I never had the courage to actually "launch" it...  what I actually did is run an adwords campaign for a few days, but paying almost $1 CPC with a conversion rate of 1% seems like a good way to lose money.
I started working on some other projects, then last week 4 sales came in (with the adwords campaign off) and I started getting a little excited.. and couldn't stop thinking of some things I could do to keep it alive:
1. Launch a more efficient adwords campaign.
2. Write some quality content: General tips on designing/creating business reports e.g. color selection, fonts, etc. and get some nice (free!) organic traffic.
3. Hire a designer and build some great looking report templates.
4. Offer a free trial. (I know patio11 would jump all over this one, I was worried about people stealing the templates and sql tables, but I realize now it doesn't really matter).
Or... perhaps I should just opensource it.
Suggestions or comments on any of the above would be appreciated. And don't pull any punches HN! <comment><USER2> My vote is for #2 and #3. Although I am not a customer for this tool, my gut tells me that your users are more interested in getting good looking reports as soon as possible (and at minimal cost), rather than the ability to design their own custom templates. So I think more great-looking templates will lead to more customers.

That being said, one critique I have of the website is that I think the most important image for your tool is the end product - the report. And unless I'm mistaken, I have to scroll down to the bottom to find it. Some non-technical people might think that the first screenshot is the report and that's not a good impression to give. I suggest moving the templates front and center. If they catch people's eye, they will scroll down to find out more about the tool.

Another minor gripe is the size or zoom level of the screen shots. I don't think they give the best impression of the reports or the UI. I instinctively squint when I look at them.

One feature idea would be to set up a companion site or sharing feature within the tool that allows people to make their templates public and have them get voted/rated. You could eventually crowd-source some of your templates that way.

I also want to say thanks for sharing your experience. Stories like this about side projects potentially turning into small businesses are inspiring to me, whether they succeed or not. Congratulations on your first sales!

<comment><AUTHOR> Thanks. I was putting the editor front and center, but you are right, perhaps the templates themselves can provide more value. I think I'm going to go further than bigger screenshots and let them download sample reports in .pdf generated straight from SSRS using my templates.

</comment></comment><comment><USER3> Very cool. You need a video or something explaining it. There's not enough "meat" on that page for me to want to pay $60 (and I've been a SQL Server guy for 15+ yrs). I find it hard to really suggest a model for it without knowing more about what it does/is/how it works.

Also, you need licensing info (how many servers can I use this on? One license per dev/server? etc). Also, you need a TOS for any corporation to take a serious look.

Cool stuff though - I like the idea.

<comment><AUTHOR> Good point. I've been dying to have a reason to use <http://www.powtoon.com> for videos, maybe it's a good time to try it.

I received a request for a multi-user license, so this is definitely tripping up others. I'll create some volume discounts and make that clearer before the checkout process.

If anyone would like to give it a try use the coupon code HACKERNEWS at checkout for a free download.

<comment><USER3> Sorry - not trying to question your business sense but powtoon.com just doesn't seem like a fit for what you have IMO. Just download Camtasia, get a decent headset mic, and do some screenshot videos that show people how quick/easy/etc. If nothing else, it will be a good exercise for you. "I have four minutes. How can I create interest during that four minutes?" Notice that I sad "create interest", not "cram every feature possible into four minutes" (which is what a lot of first timers try to do).

Once you create interest, then what? During the video creation/planning stages, write down any questions you think people will have and write (and edit/rewrite/check for typos) succinct answers. Make an FAQ and put it up there. Don't subdomain that - put that on your domain.

Next, take your best and most logical questions people will have and craft a landing page around that + your selling text. This is what landing page design and conversions are all about. You start out with an idea ("I need a video"), and one month of hard work later, you have an amazing site that starts really bringing in the traffic (and the traffic turns into money). Once you do that, start running some Google AdWords with targeting the SSRS keywords.

It's your product - no one knows it better - and you should be able to do a good video on it. Upload the vid to YouTube and embed it on your site. If you don't like YouTube, buy a sub to Vimeo for $60 and embed it using Vimeo (no ads). You can do a lot on Vimeo that isn't available on Youtube (search the web for that).

I like it - looks cool. I'd love to see it succeed. If you do ultimately decide to open source it, I'm sure the CodePlex community would dig it. Maybe you could put a trial/limited version up there that includes a nag/ad/etc for the full version. I don't know their TOS though so maybe that's not a good suggestion.

</comment></comment></comment><comment><USER4> I sent this around. This has always been one of my biggest issues with ssrs.</comment>


Ask HN: How do you keep track of replies to your comments on HN? - <AUTHOR>

  Being one who reads HN daily, but rarely comments,
  here's something i have always wondered -
 How does one keep track of responses to one's comments on HN?

  Often times the responses are several hours later.
  I haven't noticed any notifications on HN.
  Is there some obvious setting/trick i'm missing?...
 <comment><USER2> I have a list of forums and pages I visit daily. One link is to my comments, where I'll see if someone replied to my post. Nothing fancy.</comment>


Punchfork acquired by Pinterest - <AUTHOR> http://punchfork.com/pinterest

<comment><USER4> ...5 minutes ago

"Paul, come look at this cool new recipe website. This is awesome. It's like a really good recipe sharing site" - Sonia (she points to Punchfork on her screen).

"Oh, I just saw on HN it got acquired by Pinterest." - <USER3>

"Wait what?" (Sonia reads the announcement) "'we will soon be retiring the Punchfork site, API and mobile apps'..." What the? I just found this site and now it's gone??"

"Yup." - <USER3>

Maybe congratz to the founders who got an early exit, but it seems like another unfortunate case of users getting the short end of the stick.

Maybe we need better business models. Maybe Sonia would have paid $10/month for Punchfork. Who knows. I paid for Sparrow, and that didn't seem to help.

Sigh.

</comment><comment><AUTHOR> I rather liked Puchfork for its integration with DuckDuckGo and overall higher quality of recipes (and better design!) than other recipe websites. Unfortunately, I'm far less likely to go to Pinterest for my recipes now and will probably just continue to search for recipes through DDG and have to sift through the results by hand.

<comment><USER5> I agree. Punchfork is a really cool site. Pinterest has too much of a stigma associated with it.

<comment><AUTHOR> For me it's less an issue of stigma and more a question of convenience. I use DuckDuckGo for almost all of my searches anyway, and having quality content from Punchfork integrated into my search results is much more convenient for me personally than finding recipes through Pinterest.

...but I'm not a Pinterest user (yet), so I ought to curb my griping. When it comes down to it, I can see the acquisition of Punchfork really benefiting Pinterest users.

</comment></comment></comment><comment><USER6> Congratulations Jeff!

For certain categories of data, it's quite helpful to have a site that scrapes, parses and collates it into a consistent format. This was Punchfork's strength for recipes. Sounds like a good fit.

</comment><comment><USER7> Jeff is the man. Punchfork is one of the vegan/veg-friendliest recipe tools I've used, and it's a gorgeous application. Excited to see what Jeff can make of it with Pinterest's firepower behind him. Congrats!

</comment><comment><USER8> A huge congratulations to the founders! Getting acquired can be a great thing.

While I'm sad to see the site go the way of the dodo, I'm very excited to see what sorts of things you'll bring to Pinterest. Perhaps I'll have an excuse to actually use their service yet...

Cheers, and good luck!

</comment><comment><USER9> Congrats to Jeff, However, I will miss the punchfork recipe/ingredients API.

<comment><USER10> Me too. Is there a timeline for when the API will be retired? Will it come back in a different form?

</comment></comment><comment><USER11> Awesome news Jeff! Tasty!

</comment><comment><USER12> Congrats Jeff!!</comment>


Effectiveness of surgical masks against influenza bioaerosols (2013) - <AUTHOR> https://drive.google.com/file/d/11oQ2EkT7WYzZqC6BYrklRa-Tw2pz5KN9/view <comment><AUTHOR> > Live influenza virus was measurable from the air behind all surgical masks > tested. The data indicate that a surgical mask will reduce exposure to > aerosolised in- fectious influenza virus; reductions ranged from 1.1- to > 55-fold (average 6-fold), depending on the design of the mask.</comment>


Ask HN: Has anyone used the Freebase Wikipedia Extraction? - <AUTHOR>

Has anyone used the Freebase WEX? Are there better ways to get Wikipedia article summaries easily? The Wikipedia API doesn't seem to have a simple way to extract just an article summary (i.e. the first paragraph). <comment><USER2> Using WEX for a web application will require a ton of work that you want to avoid if possible.

Freebase _does_ have a summary of each topic, typically pulled from wikipedia.

<comment><AUTHOR> Yes, but there is no way to get the summary from Freebase directly. They dont include the summary in the TSV textfile downloads they offer. On their site, it says the only way to get the summaries is via WEX.

Are there other good ways to get the Wikipedia summaries?

<comment><USER3> You can just download all their data in a giant tarball and pull it out of there yourself.

</comment></comment></comment><comment><USER3> Totally wondering about this myself. Not convinced Freebase is perfect for me.</comment>


Show HN: Bloom Filter - <AUTHOR> https://sacert.github.io/Bloom-Filter/ <comment><USER2> The problem is this doesn't _really_ do much to actually show how it works. It sort of shows what it does, but the utility of it isn't clear ("Why would I want to know if something was _possibly_ found?") and the process by which it determines whether something is found is not really elucidated.

For those who are interested, this page does a really great job explaining it:

[https://llimllib.github.io/bloomfilter- tutorial/](https://llimllib.github.io/bloomfilter-tutorial/)

\</comment><comment></comment><comment>---

Nonetheless I applaud the author for making it anyway. Takes effort to build these things. Just offering a supplementary resource here.

My own note of explanation about how to use them: when a Bloom filter says something _isn 't_ present, it's guaranteed to be true. But a lot of the time it will instead basically say "I'm not sure," and it can never guarantee that something is definitely present. So the point is to use them in contexts where all that matters is to very quickly filter out as many "first occurrence" cases or "this doesn't exist" cases as possible.

That is to say, contexts where you want to identify things that you haven't seen before and which therefore aren't present in the dataset you're checking against, but for which it's _okay_ to be wrong-- cases where being wrong slows you down a little or slightly reduces content quality rather than actually breaking anything. Bloom filters are about increasing quality or speed. Examples here~ [https://en.wikipedia.org/wiki/Bloom_filter#Examples](https://en.wikipedia.org/wiki/Bloom_filter#Examples)

In all the examples you can see how it's _okay_ for the Bloom filter to be wrong. But it saves a lot of time by being right in the majority of cases.

My initial thought when I learned about them was "why not just use a set and be right 100% of the time?" And the answer, I believe, is that the set requires you to store all the items in memory in order to tell whether you've seen one before, which is expensive. A bloom filter is much, much, much smaller. A set is for when you need a 100% accuracy rate, a Bloom filter is not.

<comment><USER3> It's especially confusing if, like me, you're only aware of bloom filters from post-processing shaders ([https://github.com/cansik/processing-bloom- filter](https://github.com/cansik/processing-bloom-filter)) and just keep typing words waiting for a pretty halo to appear around the text or something.

</comment></comment><comment><USER4> With Cuckoo filters visualized too:

[https://bdupras.github.io/filter-tutorial/](https://bdupras.github.io/filter- tutorial/)

</comment><comment><USER5> This was the key to our data analytics url de-deuping platform back in 2011. We were pulling in 50k social media messages an hour and there were lots of duplicate links running though our pipeline. We had a 100GB bloom filter backed by Redis to keep a list of all links that came though our system and it worked beautifully.

<comment><USER6> A 100GB bloom filter? What does that mean? How many hash functions.. how many bits?

<comment><USER7> I would guess that a 100GB bloom filter would have 800 gigabits.

You can make some guesses, with 7 hashes and a false probability of 1%, a bloom filter designed on a cardinality of 100 billion elements is a little over 100GB.

</comment></comment></comment><comment><USER8> The "not found" message does not clear, so repeated not founds repeat the message.

<comment><AUTHOR> Oops - accidentally appended in the wrong spot. Fixed, thanks!

</comment></comment><comment><USER7> You can get lots of mileage out of bloom filters as well by just using them off of disk. If you're smart about it and use mmap'd files, you only ever end up reading a few bytes at a time. On modern SSDs you can get some really incredible performance not too far off using them in RAM, or you can use a bunch of them for a simple classifier.

here's an implementation: [https://axiak.github.io/pybloomfiltermmap/](https://axiak.github.io/pybloomfiltermmap/)

</comment><comment><AUTHOR> For anyone interested, the source code is here: [https://github.com/sacert/Bloom-Filter](https://github.com/sacert/Bloom- Filter)

</comment><comment><USER9> I add qwerty, fire, water, qwerty, land, air, bottle, laptop all this I search for fig and figure and it does mess..</comment>


Tesla's real problem is that their cars are unreliable - <AUTHOR> http://www.vox.com/2016/6/9/11880450/tesla-doomed?utm_campaign=vox&utm_content=article%3Atop&utm_medium=social&utm_source=twitter <comment><USER2> They have a pretty good point. Right now people love their Tesla's because if something breaks, Tesla bends over backwards to fix it for you. Which is great if you own a Tesla, but it still means you don't have that car for a while.

Right now, most of Tesla's customers are the kinds of people who have a second or third car to drive while their Tesla is broken, and don't have the kind of job that you lose if you show up late once.

As they move downmarket, they will start to get customers who may only have the one car and their entire life can be ruined if their car breaks down at an inopportune time.</comment>


Wood fired camping stove that powers your phone too - <AUTHOR> http://www.biolitestove.com/campstove/camp-overview/features/

<comment><USER2> Nice. Reminds me of the <http://www.suntactics.com/shop/usb-scharger-12/>, but uses scrap wood instead of the sun.

</comment><comment><USER3> A reasonable sweet-spot pricing too, but someday I hope to see DIY tinker'ers get some real meat and potatoes wattage off a steampunk wood stove -without a dangerous and difficult DIY boiler.</comment>


Ask HN: What's not great about Golang? - <AUTHOR> There has been an active good thread about what's not great about Elixir. I come from Python/Django background, I've been thinking to rewrite a serious project of mine to Go because it's much faster and economic in terms of memory footprint. I need to know some the disadvantages of the language. <comment><USER2> You are absolutely right to ask about possible downsides of a language before deciding to make the switch.

However, there is a problem with your question: Define "not great".

Every programming language has - and lacks - specific features, and this can be either great or not great, depending on who you ask.

For example, Go has no OOP type hierarchies and hence no inheritance and no polymorphism in the OOP sense.

Ask two persons about their opinions on this, and one will answer, "What, no inheritence? Total crap!", and the other one says, "Wow, that's great! No more projects that have gone unreadable and unmaintainable due to blown type hierarchy trees." Both of them may be right - from _their_ perspective.

It also depends greatly on what you plan to use the language for. Take generics as an example. If you work in the data sciences realm, you would want generic programming for your numeric libraries, or for generic data containers. So Go would not be the language for you. On the other hand, many would never need generics at all in the area they work, and many even _love_ the absence of generics and other complicated language constructs because it's precisely this what keeps the language definition small and the compiler blazingly fast.

Bottom line - take a closer look at the language features - both the ones that exist and the ones that were left out - and decide for yourself if this this is what _you_ need for _your_ project.

I chose Go in 2011 as my favourite "personal" programming language, and I don't regret it. Finally, I have a language that is clear and easy to read, that has no "magic" features that you never really can completely explain how they work, that compiles insanely fast, that cross-compiles to other architectures, that needs no pre-installed VM (ever struggled with Java VM version incompatibilities?), that has first-class language support for concurrency, and so on and so forth. I know about the downsides but they never have been an issue _for me_.

</comment><comment><USER3> You're asking three questions:

1\. What is wrong with the language syntax?

2\. What is wrong with the implementation?

3\. What is wrong with the community (other people's code, libraries, packaging, docs)?

Question 1 would lead to a pretty boring discussion, dominated by third-year CS students and fanboys of esoteric languages. Question 2 is almost as bad as question 1.

<comment><AUTHOR> I didn't ask any three questions, you did!

<comment><USER3> If you're game for watching Go, Erlang, Rust, Clojure, and Hakell fans pontificate about languge theory all the way to the right side of your screen, be my guest. Enjoy your Saturday night.</comment></comment></comment>