The Tiger Mother versus Cost-Benefit Analysis - <AUTHOR> http://econlog.econlib.org/archives/2011/02/the_tiger_mothe.html

<comment><USER2> Cost-benefit analysis of various parenting styles seems like a good idea but, when the article goes much further than that and claims that Chua's parenting style has no benefits whatsoever, its arguments fall flat. The crucial passage:

"But hasn't all the musical practice indelibly shaped Chua's children's characters? Highly unlikely."

is supported by three claims, and when you follow the links that support turns out to be rather shaky.

 _Claim 1_ : "Behavioral genetics finds roughly zero effect of parents on personality."

 _Supporting link_ : [http://econlog.econlib.org/archives/2010/01/implausible_wim....](http://econlog.econlib.org/archives/2010/01/implausible_wim.html)

The claim is implausible (if such parenting can make the kids neurotic, other personality changes must certainly be possible), and the link is to an article where the blog author is not convinced by a book arguing the contrary of this claim. The argument is roughly analogous to saying the heliocentric theory has zero credibility because "De revolutionibus orbium coelestium" didn't contain enough measurements.

 _Claim 2_ : "contrary to teachers' fantasies about changing their students' lives, learning is highly specific"

 _Supporting link_ : [http://econlog.econlib.org/archives/2011/01/the_case_agains_...](http://econlog.econlib.org/archives/2011/01/the_case_agains_5.html)

The study cited here seems to show that German students who take Latin as a foreign language perform no better on general intelligence measures than those who take English. Again, the _non sequitur_ is staggering. The analogous argument is that practicing the piano is useless, because people who practice the violin get into colleges at least as good as those who practice the piano.

 _Claim 3_ : "the effects of environmental intervention erode over time"

 _Supporting link_ : [http://econlog.econlib.org/archives/2010/11/fade- out_teache....](http://econlog.econlib.org/archives/2010/11/fade- out_teache.html)

The link shows that good teachers can make students a lot better on immediate test results than on longer-term measures of subject mastery. While this is interesting, it has zero relevance to the main argument, which was that grueling hours of practice have no effect on students' character.

Overall, the question posed and the approach are very interesting, but the subsequent argumentation turns out to be shaky and implausible. What a disappointment!

<comment><AUTHOR> If you follow the links further, Bryan's case seems a little more solid.

 _Claim 1: ...The claim is implausible (if such parenting can make the kids neurotic, other personality changes must certainly be possible), and the link is to an article where the blog author is not convinced by a book arguing the contrary of this claim. The argument is roughly analogous to saying the heliocentric theory has zero credibility because "De revolutionibus orbium coelestium" didn't contain enough measurements._

Bryan Caplan cites his own blog post ("Implausible Wimps"), which explains that it's not a problem of too few measurements. From his post:

"...a massive twin and adoption literature on personality finds that family environment has little or no effect on personality...my complaint isn't just that Marano's case isn't airtight; my complaint is that she doesn't even try to rebut the hereditarian presumption long-established in personality psychology."

The book "Unequal Chances" is cited, which allegedly reviews the field and shows that personality is primarily hereditary.

Regarding Claim 2: Caplan cites his post "Don't miss the invisible gorilla", which in turn cites hist post "Magic Potencies", which cites the book "How People Learn":

<http://www.nap.edu/openbook.php?record_id=6160>

This book appears to talk about more than just learning Latin, though it also uses Latin as an example.

Regarding claim 3, the underlying paper being cited is here: [http://www.google.com/url?sa=t&source=web&cd=4&v...](http://www.google.com/url?sa=t&source=web&cd=4&ved=0CCYQFjAD&url=http%3A%2F%2Fecon.byu.edu%2Ffaculty%2FLefgren%2FAssets%2Fpapers%2Fpersistenceformatted.pdf&ei=I_rmTML4A8Gblge0-KiODA&usg=AFQjCNHqVsT9QtugjYxywzG5PFVrn_9cbA&sig2=ALfI_x7z8ixNrFqO6vEVYw)

This particular paper attempts to measure (among other things) "how the knowledge learned from a particular teacher influences student learning of new material."

I think Bryan Caplan is mainly guilty of too many self links, which obscures the original sources he is basing his opinions on.

<comment><USER2> Maybe claim 1 is true, but I still think it's badly supported here. Without having read "Unequal Chances", its subtitle "Family Background and Economic Success" seems to indicate that it's not mainly concerned with personality and character issues. The least that Caplan could do is source the relevant part of this book directly, instead of linking to his own blog post, which only mentions the book in one sentence with hardly any detail.

Again, about claim 2, if there is better support available, why not quote it directly? It's hardly good writing to make an important claim that requires the reader to go through reference to reference to reference and read a whole book in order to find some passage that may or may not be what Caplan's claim is based on.

Regarding claim 3, I still fail to see how that has any bearing on teacher's influence on character. Even that weak claim is not supported, much less the central issue whether parental influence (presumably much stronger, at least in this context) does, or does not, affect the formation of character and personality in their children, particularly in the case when parents choose to be very intrusive.

<comment><AUTHOR> Amazon's preview feature suggests Chapter 7 ("Personality and the Intergenerational Transmission of Economic Status") is the relevant one. The introduction also discusses "genetically based behavioral characteristics" and how they relate to labor market success. Skimming chapter 1, it also appears that statistics on transmission of personality traits are given.

 _Again, about claim 2, if there is better support available, why not quote it directly?_

Agreed, Caplan should cite his sources better.

As for Claim 3, I guess it depends on what one means by "character". Caplan's source suggests that whatever character effects do exist, they do not significantly effect schooling.

(This would imply that character traits like conscientiousness and a desire to appease authorities are not influenced much by environment, but perhaps not a trait like being kind-natured would be.)

</comment></comment></comment></comment><comment><USER3> This sounds a bit, well, stupid. It assumes that the only long-term benefit to knowing how to play the piano is that you can then earn money as a musician. Bull. He cites a paper that finds that learning _Latin_ does not affect other test scores. He twists the results in this article by saying "X" instead of "Latin" -- which is dishonest of him, he should have quoted what he actually said in the other article. Numerous studies have found correlation with musical ability and math test scores, although I'm too lazy to look them up for a comment on HN. The other thing going on is that by practicing so intensely you are getting better at practicing things. That is an extremely valuable skill, or an extremely valuable habit if you wish to look at it that way. Now I don't have any studies to back this up, so take my assertion with a grain of salt.

What's most sad about this article is how little he sees his own cultural bias.

He says that playing the piano is a worthless skill. I don't see how that statement can be anything other than a value judgement about culture -- music is culture. He says "Cost-benefit analysis is not a Western prejudice." However, the particular cost you assign to training and the benefit you assign to the resulting skill is inherently relative, and his judgement that forcing a kid to learn piano is bad and knowing how to play a piano is worthless IS a prejudice.

His main attack on the science of the book is that he says there's no evidence that parents have any effect on a child's personality. Let's assume this is true. So what? What about skills and habits? Aren't those important? (He mentions skills but not habits. I assume that you can give a kid habits, such as brushing teeth before bed.)

It's also torturous to have to read how he discusses questions #1 and #2, which are presented up-front in the source material and don't really need 23 cm of article dedicated to them.

Now I'm not one to say that Amy Chua's method of parenting presented in "Tiger Mother" is superior. I suspect I'd find "Tiger Mother" to be just another pop science book. But this cost-benefit analysis is a particularly unsound attack on the practice.

I want to see evidence, one way or the other. Sadly, it's not likely to come any time soon.

</rant>

<comment><USER4> You should re-read the article. Caplan didn't say knowing how to play the piano is worthless, he said "Unless you love music from the bottom of your heart, a career in music is folly." Chua wasn't just encouraging her daughters to practice an hour a day, she was emotionally abusing them in order to force them to put in the huge amount of work necessary to become a professional musician.

</comment></comment><comment><USER5> The most important benefits of musical education are harder to quantify than awards in competitions. Unfortunately, the latter are easier to use as college application fodder.

Why study music? Because it can let you explore the edges of what your fine motor control is capable of, and what your senses and consciousness can perceive. Because it is a doorway to the mysteries of art and being. Because it can bring people together. Because several years of intense study can bring someone pride in skill and deep joy and happiness for the rest of their lives.

Prioritizing a short-term gain (like enabling your kids to signal to college admissions officers in their teens) over all of the above strikes me as shallow. To me, there is no excuse for besmirching something so wonderful as music by turning it into drudgery for the sake of impressing strangers.

That said, prioritizing an even shorter term gain -- like being untruthful to your kids and praising them for looking cute and making noises so they can experience an ersatz pride -- is an even shallower wallow in mediocrity.

<comment><USER6> Honestly, I wish I could play the piano so I could play piano music I like, and more easily compose music. No financial gain, but I think I'd just enjoy it. Unfortunately as an adult w/ little time to practice, it seems like learning to play is not likely.

I can listen to recorded piano music, but it's not like actually playing.

<comment><USER5> Towards this end, it's useful and good to make your kids practice when they are very young. Your brain is actually changed by doing music before the age of 12, in a way that's actually visible on MRI. If I ever have kids, I'll do this for them when they are young but let them find their own way to music or artistic expression of some kind as young adults. (Despite the circumstance that I'm an accomplished musician.)

If you aren't an excellent player of music yourself, but genuinely enjoy music, the thing to do is to take your kids along to see live music, outside of the paid perfomance context. If you can be there, taking joy in music that's not paid for, but played for the pure joy of it, then there's a good chance for your kids to pick up on the magic of it and be influenced to do music for the right reasons. (Yes, I've been a firsthand witness to this phenomenon.)

Then again, there's also a chance that it won't become your kid's thing, or that you could lock them in a tower and forbid them to do anything musical, and they'll still find their way to playing music. By these lights, making your kids engage in musical drudgery in order to impress judges so they can impress college admissions officers is about the worst thing you can do.

</comment></comment></comment><comment><USER7> It all comes down to what you want long term and how success is measured.

My wife and I seek long-term quality relationships with our children. Relationships are based on common value systems, regardless of what those values are. (link to small pdf book [http://media.blackstripespublishing.com/RelationshipAndValue...](http://media.blackstripespublishing.com/RelationshipAndValueSystem- DarrenTwa.pdf)).

The conflict that we create over the years of parenting will affect our relationships with our children. I never want my children to spend time with me because they feel obligated, but because they enjoy being with me.

The goal of parenting is to get your child to adopt your value system. Children may be grateful for what you made of them, but they still might not like you later. For me, that is failure.

For us, parenting is a balance between pushing kids past their own laziness so they benefit later in life, and enjoying relationship with them now and, hopefully, in the future.</comment>


Delicious.com launches major redesign - <AUTHOR> http://www.theverge.com/2013/1/10/3864010/delicious-completely-redesigned-social-bookmarking-service

<comment><USER2> hmmm, the new <http://delicious.com/> start page has a

      <meta name="robots" content="nofollow" />

in the <head>.

strange SEO strategy of one of the most valuables sites on the internet.</comment>


Titan M makes Pixel 3 our most secure phone yet - <AUTHOR> https://blog.google/products/pixel/titan-m-makes-pixel-3-our-most-secure-phone-yet/ <comment><USER2> A different perspective, from another link to a Pixel3 review I clicked here in HN this morning:

"I wanted to share all of the information this phone captured about me during the long weekend I spent reviewing it. But there was simply too much of it, and in too much detail. Publishing it would put me in real financial and perhaps physical peril. And, besides, I'm not even sure if I am aware of it all, or if I even could capture it all. What's out there? We have no idea."

( [https://www.buzzfeednews.com/article/mathonan/google- pixel-3...](https://www.buzzfeednews.com/article/mathonan/google- pixel-3-review-android) )</comment>


Nest Cam status lights can no longer be turned off for privacy - <AUTHOR> https://www.androidpolice.com/2019/08/15/nest-cam-status-lights-can-no-longer-be-turned-off-in-the-name-of-privacy-and-customers-are-pissed/ <comment><USER3> Previous discussion: [https://news.ycombinator.com/item?id=20700810](https://news.ycombinator.com/item?id=20700810)

</comment><comment><USER4> Having a status light ON for an outside camera seems smart for both sides – pro-privacy & communicating the property is under surveillance. What sounds frustrating is that when your network / wifi connection goes down the status light flashes amber – there was never a way to turn this feature off even if you had the status light off (previously). If you're a potential thief and you see am amber flashing light on a Drop/Nest cam, you know you're not being recorded. That's the bummer with cloud-only camera recording, there is no redundancy. I wish there was an option to "hide" error states in the status light and just keep it on as if nothing is wrong.

Of course the discussion so far has been limited to whether you should have a choice when your camera is inside the home and used for things like a nursery/baby cam? Should you have a choice "hiding" a camera to record anyone who breaks in?

I don't have good blanket answers, however I think it's illegal in Germany to record someone without consent, even if it's an intruder in your own home. Right now it seems the decision has been made for Google camera owners.

<comment><USER5> I don't know how nest camera is built like, but can't you cover the light with a bit of tape and be done with it?

<comment><AUTHOR> Yes, but you risk also blocking the IR illuminators that let it work at night.

</comment></comment></comment><comment><USER6> >As it turns out, many people use these security cams to secure their homes and don't want thieves to know that they're being watched

I don't get this argument. The whole reason the fake security camera market exists is to deter crime by giving the illusion of being actively watched; if you want to play spy and switch it off to prove a person's true nature it is your business, but at the end of the day the crime has still been committed and your stuff is still gone

<comment><USER7> I think it's a mix of people who like using their camera's to spy on family/guests/neighbors, and people who just genuinely do not know the camera works better as a deterrent then as evidence.

<comment><USER8> If this was an exterior camera, I would agree. But if someone is already in my home, I feel like them seeing the camera light isn't going to make them turn around and leave but it could lead to them destroying my camera and then I would lose evidence of their next moves.

Maybe the camera should contain a switch allowing me to choose which mode the LED should work in (on when being viewed, always off, or always on).

<comment><USER9> We have roommates who leave messes in the kitchen and blame others, have overnights guests more frequently than its allowed, etc.

Don't even get me started on the uses for kids.

</comment></comment></comment></comment><comment><USER10> How about don't put Google surveillance cameras in your home? You don't "own" anything Google or Microsoft sells you. You are licensing their tech and you are their bitch when they decide to pull the rug out from under you. People tolerate such abusive, anti-consumer behavior and invasion of privacy all in the name of convenience. In any relationship people have an ethical responsibility to not enable abusive behavior (to the extent possible) -- this goes for people just as well as amoral corporations. So just don't fucking use their shit.

<comment><USER11> I talked to someone yesterday who didn't trust Amazon enough to use an Alexa device after the recent audio recording publicity.

Imagine their surprise when I let them know who owns their Ring doorbells and security cameras.

<comment><USER12> To be fair, Amazon only recently bought Ring (early 2018), and I recall the products being quite popular even before Amazon's acquisition. So really it may be the case of someone actively choosing not to buy a FAANG product, only to be sucked in later by Amazon's blackhole.

<comment><USER11> That's exactly what happened. Same deal for anyone with Eero mesh routers (Amazon) and Nest/DropCam (Google). It's impossible to avoid them in technology because they just buy everything.

</comment></comment></comment></comment><comment><USER13> The privacy of whom?

Google seems to favoring the privacy of those who might be recorded by the camera. The owners of the cameras object. I'm not entirely sure why: do they expect privacy while recording others?

<comment><USER9> You really aren't using your imagination if you can't figure out potential uses for a hidden nanny cam.

What if I want to see:

* If my cleaning person is stealing?

* If my cleaning person is using the right chemicals on my stove?

* If the nanny is shaking the baby?

* If my husband is having an affair?

* If my teenager is doing drugs?

* Which sibling actually started it / threw the first punch?

Those are just off the top of my head, I'm not even being creative.

<comment><USER14> > _What if I want to see:_ If my cleaning person is stealing?*

Use your camera. The status light doesn't disable its ability to record and transmit video. You want to record these people without their knowledge. That is just wrong.

More fundamentally, change the people you interact with or your relationships with them.

<comment><USER15> > That is just wrong.

I suppose it depends on what you mean by "wrong"?

For instance, it's perfectly legal to record inside your house - visibly or not - provided it's not in an area or place where the user would expect privacy (usually meaning a bathroom or similar place - but could be extended to bedrooms depending on consent and other reasons).

It might be considered unethical, perhaps even immoral, depending on the reasoning or ulimate purpose for those recordings. But legally there isn't anything wrong about it.

Note: This all depends on your local or other laws of course...

</comment></comment></comment></comment><comment><USER16> Not hard to work around... open the device up, desolder or just cover up the LED? Or if you're lazier, electrical tape on the exterior... Works for all kinds of annoyingly bright status LEDs!

<comment><USER8> maybe im too much of a consumer, but I bought a pack of led dimming stickers like the ones linked below to cover all the status lights on my computers and such cause I hate led lights in my house at night.

[https://www.amazon.com/LightDims-Original-Strength- Electroni...](https://www.amazon.com/LightDims-Original-Strength-Electronics- Appliances/dp/B00CLVEQCO/)

<comment><USER17> A black magic marker would work too.

<comment><USER18> Depends on how bright LED is

<comment><USER15> Nothing's going to get thru a black industrial sharpie; if that doesn't work, though, black fingernail polish, or if you don't mind the expense - <USER2> Testor's acrylic paint - will do the job.

</comment></comment></comment></comment></comment><comment><USER19> my concern is that people become conditioned to look for these lights, and draw the conclusion that light off = camera off. This is a bad precedent, as multiple built-in laptop webcam attacks to disable the led recording lights can attest to. If you need privacy, don't be in front of a camera or microphone. don't trust a clearly software controllable status light.

</comment><comment><USER20> I'm glad I ditched all my nest stuff.

</comment><comment><USER21> I'm pissed because the whole point of an outdoor camera is to not advertise when someone is watching. If they don't back pedal on this I'm switching to ubiquity and running my own NVR so I don't have to worry about someone in california deciding to change how a product I own works.

<comment><USER22> >> is to not advertise when someone is watching.

Are you doing a Ph.D in social sciences?

<comment><USER21> Why the snarky comment? When you're outside or on my property you have no expectation of privacy.</comment></comment></comment>


Gigabit Seattle priced at $80 per month - <AUTHOR> http://arstechnica.com/business/2013/06/gigabit-seattle-priced-at-80-per-month-just-over-what-google-fiber-costs/ <comment><USER2> This article is proof to me exactly what Google has been pioneering I feel.

I remember reading that when Google launched fiber, it wasn't looking to become a provider, but more so to push the industry due to the US being behind in speed. If more areas have faster speeds and are affordable, then products like Google Drive and YouTube (4K HD videos) will thrive. Basically, Google is hedging it's future, by pushing the industry.</comment>


No security ever built into Obamacare site: Hacker - <AUTHOR> http://www.cnbc.com/id/101225308 <comment><USER2> This sounds like grandstanding horseshit. Fewer than 1 in 10 companies we work with even attempts to "build security in from the start", and far fewer come close to succeeding. Any consultant that told a client to "start over from scratch" after finding little more than _open redirects and username enumeration_ † would be laughed out of the room. Actually, scratch that: you can expect to be laughed out of the room for suggesting a rewrite after finding remote code execution.

Like every other piece of software put on the Internet by the government, banks, health care consortiums, arms manufacturers, cat sharing startups or network equipment vendors, Healthcare.gov will achieve some semblance of security over the long term by having the crap beat out of it in production. Hopefully by good people first. They won't get there by starting over on the advice like this.

This story is an embarrassment for my field.

† _I found the "report" to Congress; documented vulnerabilities include "undisclosed", open redirects, attacker control over the XML output of a search endpoint, a "test" subdomain on the Internet (no additional findings), Google search results with the token "test" in them (no additional findings), publicly indexed profiles on DATA.HEALTHCARE.GOV (the public dataset site), username enumeration via "this name taken" errors, the fact that they use Experian, the presence of jquery.fileupload.js, and CORS. I'm not sure any of these would even be sev:medium in a Matasano report; many would be sev:info, and a few, like Experian, wouldn't be documented at all._

<comment><USER3> I don't think it's unreasonable to expect that a website which people are legally obligated to use by a certain deadline, entering very sensitive information in the process, have a decent standard of security at launch. I don't see "having the crap beat out it in production" as a good strategy here, and certainly is worth complaining about, even if not worth re-writing over. Would you be comfortable entering your SSN at healthcare.gov?

<comment><USER4> Fun fact: You can guess an individual's SSN using information often available on their Facebook profile and about 100 lines of code. (Someone demonstrated this to me using a TI-82 program in high school. The result has since been replicated in more reputable literature. [http://www.ssnstudy.org/](http://www.ssnstudy.org/))

<comment><USER5> Man I remember learning this and having my mind blown. It's scary.

</comment></comment></comment></comment><comment><USER6> In a project this convoluted...not in terms of actual feature complexity, but the shitwork that was generated by bureaucracy and political infighting...how could Healthcare.gov _not_ have serious issues with XSS and SQL?

Think back to Egor Homanov's amazing hack of Github using a Rails vulnerability to well-known to Rails core team that argued it was not an issue because only fools wouldn't use attr_protected. Github has brilliant programmers and (one would hope) a well-oiled engineering environment and still was vulnerable to this fatal flaw.

Now imagine a project with far lesser engineers, highly paid but no real ownership, controlled by people who care more about political deadlines than actual functionality. And top it off with what seems like a hodgepdoge of arcane technology and processes. How could there not be at least a few catastrophic holes?

On a sidenote...I've seen a few references to "MarkLogic" being the datastore for Healthcare.gov. It's not open-source and has little adoption in the developer community:

[http://slashdot.org/story/13/11/24/1437203/nyt- healthcaregov...](http://slashdot.org/story/13/11/24/1437203/nyt- healthcaregov-project-chaos-due-partly-to-unorthodox-database-choice)

Whose genius idea was it to use a non-notable proprietary database software for this? And what was the reasoning? Technical, or political?

</comment><comment><USER7> I don't have the reference handy, but I recall an article from this past Summer that said the designers of the site had put security on the back- burner. Their plan was to get the system working and worry about security afterwards.

That really alarmed me. Being more than a little involved with security implementations over the last decade, the #1 rule is that you can't tack-on security afterwards. If you try, it will be fragile and ultimately ineffective. You absolutely must design with security as a major requirement from the start.

So, I am not surprised to see this report, it lines up exactly with what I've been expecting since Summer.

<comment><USER2> Well then the #1 rule is also the most widely violated rule on the Internet.

<comment><USER7> Yep. Hence the constant stream of security issues.

</comment></comment></comment><comment><USER8> >According to the Department of Health and Human Services, which oversaw the implementation of the website, the components used to build the site are compliant with standards set by Federal security authorities.

This sounds similar to saying the steel plating on the Titanic was compliant with industry standards. All because you have sound components doesn't mean they will result in a sound product. Unfortunately, I don't expect many people outside this industry will realize how hollow this statement is.

<comment><USER9> You'd think by now someone would have done a weekend project open-source version of this site. I wonder if the specs are available (I have no idea how involved the site actually is, but surely it's not 500M LOC worth.).

<comment><USER4> I think you may have misunderestimated the scope of this "site." To be fair, you'd be in pretty good company with many people in the Administration.

The following would not be easy to complete during your weekend:

1) HIPAA compliance

2) Verifying income against IRS records to determine eligibility for subsidies.

3) Automatically forwarding gathered information to insurers, in a patchwork quilt of formats, many of which are under-specified

I believe one could get to at least two dozen requirements which are similar in complexity to the above three without breaking a sweat.

<comment><USER10> Also verifying citizenship with DHS, verifying no benefits are currently being received by Medicare, Medicaid or through Veterans Affairs. I'm sure a lot more.

It's a nightmare combination of legacy DB integration where if you make one mistake that ends up in an illegal immigrant getting healthcare your ass will be hauled into Congress to testify.

</comment></comment></comment></comment><comment><USER11> The bit about the federal government not being required to alert users to any security breaches is alarming as well.

I guess that's not surprising. But, "monitor your own credit" isn't a risk I'm willing to take just to use a barely functioning website.

</comment><comment><USER12> This guy claims SQL injection and XSS.

<comment><USER2> Where did you see those claims? I would not be amazed to learn that there was SQLI on the site, but I don't see it in his report.

Are you talking about his report to the press earlier in November? He appeared to have been referring to cached search autocomplete terms with SQL syntax in them, evidence of people attempting SQL injection against the site. Which, of course, people would do whether the site was Healthcare.gov or CatBnb.com.

<comment><USER12> Maybe he didn't, I tried to guess what he meant when he says,

> "Everything from hacking someone's computer so when you visit a website it > tries your computer back to being able to extract first names, last names, > locations"

at 0:24 and guessed XSS + SQLI but I could be wrong about the SQLI now that I'm paying closer attention to how he phrased it.

</comment></comment></comment><comment><USER13> "Poking and prodding" can get them in legal hot water. I understand (and please correct me if I am wrong) Only NSA legally, are allowed to "poke and prod sites". Well, and I guess by legally you can interpret that as "they are legally allowed to" or "nobody is really prepared to tell them no".

Anyway, a lot of anti-hacking laws are written that "poking and prodding is not benign" admitting to too many details of that on national media might be a case of bad judgement.

<comment><USER14> You are very wrong. Poking and proding is completely legal and isn't going to send anyone to jail.

He's not performing a full pen-test on the site. He's not looking to get a shell. He's just checking out best practices. Is there an HSTS header? Is my input validated? etcetc.

The main hacking law that applies here is the CFAA and Dave definitely isn't violating it. To violate it you have to access something you're not allowed to. Nobody will EVER go to jail for an XSS or the types of things he's poking around for. This is because the computer the code is running on is his own....

<comment><USER2> Reflected XSS testing can easily end up disrupting the whole site for every user; all it takes is for input to some endpoint to get stored and replayed across the site. Relying on the idea that any kind of active testing against a site you don't own is safe, technically or legally, is a bad idea.

<comment><USER14> Reflected XSS? Do you mean stored? If Dave is testing for reflected XSS he's going to be alert(1)'ing or using img tag....Which is not a persistent xss...

For reflected xss to affect every user on the site he's going to have to use his own toolkit to send a malicious link to every user on the site....

<comment><USER2> I mean _reflected_. The kind you _don 't_ expect to get stored. If that's a surprise to you, you might not test a lot of websites, because this comes up somewhat regularly.

By the way, the XSS payload has nothing to do with the persistence of the attack. You alert() stored XSS in testing too.

<comment><USER14> I do test a lot of websites actually but I mis-understood what you meant.

Like the other guy said this area is grey. If he accidentally finds a stored xss of the magnitude you suggest I'm 100% sure he still wouldn't go to jail. Who tests with a malicious payload? There would be no malicious intent in the situation and no unauthorized access...still.

<comment><USER2> You didn't say this was a grey area. You said "Nobody will EVER go to jail for an XSS" and then cited the CFAA as evidence of that fact, suggesting that you might have some minor gaps on how XSS works and that you _definitely_ have major gaps on how CFAA works.

Pro-tip: avoid stringing "Nobody will EVER go to jail for" and "CFAA" together in the same paragraph.

<comment><USER14> Let me rephrase. Nobody will go to jail for the level of poking and prodding I expect Dave is trying. I'm 100% sure the CFAA won't send anyone to jail for alert(1)

My 100% is a gut feeling. I'll quit computers if I'm wrong

<comment><USER2> I doubt anyone is going to get in trouble over the PDF report I read about Healthcare.gov, but that's not why I'm commenting.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> This'd be a great use case for a bug bounty. It's a situation where you have tons of bugs[1] and tons of cash to pay out a bounty. It'd probably be cheaper to open source all the code and hire one full time person to manage the bounty program then whatever they're trying out right now.

[1]: Pure speculation as I have neither used the site or looked at the code but I'm assuming most people will agree with me

</comment><comment><USER16> I'm sure by putting that message out there, we are about to see HealthCare.gov be put to the test...

<comment><USER17> It has been and will be put to the test by all hat colors regardless of press.

</comment></comment><comment><USER18> David Kennedy's Bio: [https://www.trustedsec.com/about- us/leadership/](https://www.trustedsec.com/about-us/leadership/)

<comment><USER2> His bio said he spoke at Black Hat. I can't find anything listed by him except for an "Arsenal" talk, which is a lightning talk people can give about open- source tools they've written. Can someone find a real BH talk this guy has given?

<comment><USER18> Under his site's "Presentations" section ([https://www.trustedsec.com/downloads/presentations/](https://www.trustedsec.com/downloads/presentations/)), it lists this talk...

"July 2010 – Blackhat and Defcon Presentation on PowerShell" ([http://www.trustedsec.com/files/PowerShell_Defcon.pdf](http://www.trustedsec.com/files/PowerShell_Defcon.pdf))

<comment><USER2> Thanks. Yep, that counts.

<comment><USER19> The guy co-authored Metasploit: The Penetration Testers Guide book. Doesn't the fact that you're unaware of this prominent person call into question your own credibility?

<comment><USER2> Exactly why would I be impressed by someone writing a trade press book about a tool someone else wrote?

I know who HD Moore is. I know who Matt Miller is. They started the Metasploit project. Most people in my field know those people. They're famous. HD Moore has, last I checked, a special Metasploit Porsche. It says Metasploit on it, in neon or some shit. (No disrespect to the Metasploitmobile, whatever it is).

Similarly: I know who Gordon Lyon is; he wrote nmap. Everyone knows him.

Who the hell knows the authors of _Nmap In The Enterprise: Your Guide To Network Scanning_? Nobody.

The author of "Metasploit: The Penetration Testers Guide" does not drive a special Metasploit: The Penetration Testers Guide Porsche.

</comment></comment></comment></comment></comment></comment><comment><USER20> This is what happens when you build a website with contractors from several different places. Things slip through the cracks, in this case security was one of those things.

</comment><comment><USER21> Does anyone in California know if you can get a discount on private health insurance if you're currently unemployed (healthy non-smoker) trying to start a business and don't want to sign up for Medi-Cal because the only doctors are far away and crowded?

Also the Covered CA site has an expired security certificate.

</comment><comment> Kilo-byte sensationalist headline with little content to back it up

</comment><comment><USER22> Smart power ™

</comment><comment><USER23> I see a whole lot of blowhards running their mouths about _potential_ security problems with the site. I've heard of one actual password-reset vulnerability. If the site were completely full of holes like people claim, there would be scores of "security research companies" clamoring to be the first to name them. Yet we're not seeing that. I'm really not buying it.

<comment><USER5> That's not quite right.

The site does have issues. Naming the vulnerabilities is subject to responsible disclosure. Hypothetically, were Tinfoil Security to find any issues, we would disclose them to the feds and give them ample time to fix the issues (which, for the government, would potentially be months) before we went out publicly to name what the issues were.

<comment><USER2> Post a SHA1 hash or two, here or on Twitter. I believe you, but let's keep it concrete.

<comment><USER5> I hear you, but I can't. I considered not even posting that comment at all, but thought the greater point deserved to be aired.</comment></comment></comment></comment>


Air Pollution Is Shortening Your Life. Here's How Much - yaseen-rob https://www.nytimes.com/2018/08/22/climate/air-pollution-deaths.html <comment><AUTHOR> By "a little more than four months on average."(for USA)

And taking a statin drug will extend my life by about 4 days.

I'll have to put both in the same category of importance: despite the factor of 10 difference, neither has much effect in the long run.</comment>


What is the most effective thing you did to improve your programming skills? - <AUTHOR> http://stackoverflow.com/q/76364/280598 <comment><USER2> I wrote build scripts for my projects that tracked:

1\. Syntax errors on compile (it was C). 2\. Test failures. 3\. Time of the run. 4\. Lines of code.

Then I used R to create graphs and reports that were generated periodically. About once an hour I'd go look at them and see what synax+failure levels were per line of code at that time. I'd then plot this as a run chart and start trying to find causes of my high defect indicators.

Eventually it got to where I found a bunch of the ways I wrote defective code and started to avoid them. I have a set of macros for C now that prevent it, and I use the patterns in my other coding.

It was pretty insane though. I don't recommend it for anyone, and definitely not on a project you have to do for a living. Well, maybe if it's a missile command system or medical device.

<comment><USER3> Has anyone made a plugin or anything of that sort which abstracts away the grunt work of using this sort of system? It sounds like a great thing to try out were it not for the opportunity cost of trying it.

<comment><USER2> Not that I know of. I imagine emacs or vim has good error-line parsing which you could steal/copy and get really good results. You could then extend it to work on any language you wanted.

Biggest thing I couldn't get right was automatically connecting frequency of errors to particular lines or modules. I found that I made the same mistakes over and over, and I had to just spot them and jot down what not to do or think of a ninja way to avoid it. I also found that there was a strong correlation between syntax/test failures while writing code and how bad the code was.

What would have helped is if I could calculate the stats per function, line, or file and then have some pattern analysis spit out common grammatical structures that I do which are correlated with errors. It'd be something like:

function/while/if/return 24% chance of defect found in blah.c:func1 and blah.c:func2

Then it'd get closer to predicting defects and letting me go check the spots it recommends.

But, never got around to it since it became really insane after a year already without that level of analysis.

</comment></comment></comment><comment><USER4> I wrote a framework.

Instead of thinking, "How do I want this program to work?" I had to think, "How do I want _every_ program to work?"

Instead of organizing this data, I had to organize _any_ data.

Instead of worrying about what my customer needed, I had to worry about what to put in my toolbox before I called on that customer.

Instead of handling the current outlying case, I had to learn to _anticipate_ possible outlying cases.

Instead of worrying about instances of what we do, I had to worry about _classes of instances_ of what we do.

Instead of benchmarking and optimizing performance, I had to understand the kinds of things that affected performance.

Instead of scaling, I had to design an architecture that would scale.

Instead of conducting analysis and design, I had to build an application to handle and apply system parameters.

Instead of covering bugs, glitches, and inefficiencies, I had to _eliminate_ them before they compounded exponentially before my eyes.

Instead of having fun, I had to build a world within which I could always have fun.

<comment><USER5> Big design up front? Seems like a lot of your advice flies in the face of prevailing agile principles.

What do you think about YAGNI?

<http://bit.ly/cpbljR> (YAGNI Wikipedia article -- apparently HN doesn't like apostrophes in urls.)

<comment><USER4> _Seems like a lot of your advice..._

I gave no advice. I shared my experience. Take it or leave it.

 _What do you think about YAGNI?_

Never gave it much thought before. But after reading your referral, let me rephrase the question: "How do you know what you're going to need?"

After servicing hundreds of customers, I built a framework that provided what over 90% of had already needed. I figured it was a pretty good bet most new customers would too. So far it's worked out great. The framework has easily replaced one or two other programmers.

But then again, that isn't even what the original question was about. OP asked the #1 thing that made me a better programmer. This was the #1 answer by far. I think everyone should write a framework, whether you need one or not. You'll never think the same way again.

<comment><USER6> The key to your success is the "after servicing hundreds of customers". YAGNI is for the people who try to build the framework first, before they serve any customers.

</comment></comment></comment></comment><comment><USER7> One was to write a book about programming. Your programs literally have to be exemplary. It was interesting how much work that took.

<comment><USER8> I usually don't upvote pg's comments, because he could say "I like turtles." and get 1,000 upvotes, but pg's advice here is gold.

You should do this. You don't even need a publisher, you could approach your topic like Zed Shaw did with "Learn Python The Hard Way".

Or you could do a series of blog posts. You WILL get feedback and this will improve your skills.

<comment><USER9> If you're only focusing on the 'writing really good code' aspect, sure. But in the wider world, writing a book can be a spectacularly bad way to invest your time.

I've made way more money from my "Slicehost vs Linode" article than I have from my portion of "Tcl and the Tk Toolkit, 2nd edition", even though the latter required a ton of hard work.

<comment><USER10> I think the value is in the _writing_ itself, not the monetary feedback.

<comment><USER9> Yes, I acknowledged that - but I think that most people would do well to at least consider the other aspects of writing a book as well.

</comment></comment></comment></comment></comment><comment><USER11> Introducing variety into my routine always improves my programming skills.

I started in high school writing homework helpers in Java and C++, and writing graphing calculator scripts to make fun patterns. Then I worked with other programmers, and started structuring my code to make it understandable to others. Then I started ACM programming competitions, and learned to rigorously solve problems. Then I found Python, and learned that finishing can be quick and easy. Then I got an internship at a major corporation, and discovered I never want to be an enterprisey programmer. Then I got a GSoC gig and learned to collaborate remotely and make estimates. Then I got a real job and learned to work with code for months and years, instead of churning out small projects, and the importance of finishing early and often. Then I experimented with Lisp, and learned the importance of abstraction, community, and salesmanship. Then I played around with Tornado and started learning about the web. Recently, I got a better job and started learning the importance of testing, the importance of listening to users, and the value of a second set of eyes. Recently, I've started experimenting with the Android SDK, learning the power and limitations of major constraints.

I can't wait to see what the future holds.

</comment><comment><USER12> As a freshman in CS, I took a course where we reimplemented several of the standard Unix commands (like date, ls and cut) and much of the standard C library.

We also had to implement a subset of the bash shell, a lynx clone, a GNU make clone, a Lisp interpreter and a Lisp-to-C translator.

Having to implement many of the tools I've come to use on a daily basis was a transformative experience for me, and a great way to learn how to write efficient yet safe C code.

That experience inspired me to take the compilers class the next year, where I programmed in a functional language (Standard ML) for the first time. I was impressed with the expressive power and robustness of functional programming, and I've clung to it ever since.

These two experiences also set me on the path to becoming a professor. Now I teach and research compilers and programming languages for a living. I find hardly a day goes by where I don't learn something to improve my programming skills.

</comment><comment><USER13> I wrote a parser and lexer by hand. Building the mental abstractions to figure out how a syntax tree should be constructed and walked was amazing. It gave me the tools to visualize how code is structured, how to avoid poorly structured code, and how program flow actually works.

The first revision took me around 6 months to implement, and the second about 3 days. Worth every moment of futzing around and hacking and designing.

The language is getting rewritten (this time with an actual grammar!), and I'm finding it still has a mountain of useful things to teach me about programming. I can't recommend it enough. :)

<comment><USER14> Did you cheat and use a regex library in your lexer, or did you build a regex engine aswell?

I built recursive descent parser, and a lexer using the posix regex libary in 2 days first attempt and extra 14 days for semantic analysis and x86 code generation which operated by walking the ast. Most of those days were mostly learning x86 assembly. I can't understand 6 months, unless you did everything from scratch like the regex engine I.E Constructing NFA's, converting to DFA's etc etc.

<comment><USER13> I think I cheated and used an existing regex library - it's been a while.

As far as the 6 months, it was my first major, major project and required so much learning and research on just how to structure code that it took a long time to craft. It didn't help that the design was so complex that debugging it was a chore. :)

Hence the V2 rewrite that took a couple of days.

</comment></comment></comment><comment><USER15> For me, they are:

      * become more sensitive to your daily pain points and
        move to eradicate them
      * read other people's code
      * before sitting down to build anything, think:
        "is there an easier way to solve it?
      * learn about good architecture and engineering
        practices, but don't worry about them until
        a) you know what you're building
        b) they're a problem.
      * learn programming languages in different
        programming paradigms.

<comment><USER16> Your idea about tracking daily pain points was the most important thing I ever did, as well-- sort of.

I tracked, over a one year period, every single defect that made it into production that I had to correct. I did this at the inspiration of a book on continuous improvement I read. I analyzed the underlying causes of the defects, organized them by category, made Pareto charts, and looked at my underlying procedures to see how I could avoid them.

What I learned surprised me, and changed the way I approached projects from then on. What I learned was that by far the number one problem I needed correct in order to avoid production defects and downtime had nothing to do with my code.

I discovered that the number one cause of avoidable defects in production had to do with the quality of my test data, differences between production environments and test environments, and discipline in how code gets promoted to production. And of course establishing a process for such things as promoting code-- a process which is formalized, followed, every time, and continuously improved as needed.

Learning this gave me a new respect and appreciation for the importance of a faithful and realistic staging environment that mirrors production as closely as possible. It's often impractical or expensive to various degrees to replicate or simulate a production environment faithfully for a variety of reasons. What I learned is that not all projects deserve the expense and trouble of that faithful reproduction of the production environment, running production loads in staging. But to whatever degree we don't do that, we take on more risk, and it's good to at least understand those risks.

Perhaps I'm talking more about project management, infrastructure, process and procedure than about pure "programming". But what I learned through this one year exercise was that often times when people think about wanting to get better at programming, improvements in some of those areas are really what's needed to get to the higher tiers of excellence.

<comment><USER17> "I tracked, over a one year period, every single defect that made it into production that I had to correct. I did this at the inspiration of a book on continuous improvement I read."

Which book?

<comment><USER16> It was "Improving Software Quality: An Insider's Guide to TQM" from Wiley. A lot of people fear the idea of formalized process, thinking that it is going to saddle them down with the useless baggage of unneeded red tape and forms. It's actually quite the opposite. It's all about keeping processes as simple as possible, even simplifying existing processes.

</comment></comment></comment></comment><comment><USER18> I coded, a lot, on things _just_ beyond my ability. IMO this is the path to success in anything: practicing, a lot, on something just beyond your current ability. It's not always the most fun though, because since it's just beyond your ability, it's hard and sometimes frustrating.

</comment><comment><USER19> Start getting paid to do it. Once you have feedback coming in from customers who are your bread and butter, and you start trying to implement that feedback to keep them happy only to find your framework was ill thought out, you'll quickly learn to do things right from the start. Reading proper technique is useful, peer review is useful, but that first time you sit up all weekend revamping several core routines because you didn't plan well you'll learn more than the other two combined about not cutting corners. (edit: this also applies to learning to test properly too)

Disclaimer: the above comment may or may not be based on several moronic experiences the poster is too embarrassed to confess to over his 20-ish years in the 'biz'. Maybe.

</comment><comment><USER20> Co-founded a tech startup as CTO with no developers on staff - yet. I ended up having to code the tools I wanted/needed and learned things I would have never learned if I'd just, "learned to program" in my free time. Have a goal.

EDIT: I have a comp-sci degree; it taught me very little about 'programming'.

</comment><comment><USER21> It's not something I did per se, but one former employer had mandatory pre- checkin code review. This is a controversial practice but in my experience, only with people who haven't really tried it.

Not only does this help find bugs, it will force you to write code that isn't embarrassing. You will end up communicating much more with colleagues; before, during, and after the code review process. I believe it will clean up, or at least address, almost every bad habit you have.

If you can't get this at work, try an open source project that has a similar review process.

<comment><USER22> I've implemented this too. You take a branch of the mainline, work on your feature, integrate mainline if it has moved on in the meantime. When your ready to submit you tell one of the reviewers. They checkout your branch, do a diff and if it's good they submit. If they have questions you talk about it and if something is not right or missing, they get told to add it.

It stops lazy check ins and it means at least 2 people know what code has gone in recently.

</comment></comment><comment><USER23> Started an extraordinarily ambitious open source project when I was just naive enough to not know better.

<comment><USER24> Mind if I asked why it was extraordinarily ambitious?

<comment><USER23> Well, at the time (2004), it was extremely unexplored territory. Social networks themselves were almost brand new, and the idea of creating a distributed, open source one was almost unheard of. The nearest project (DiSo) didn't show up for two years after that.

Also, my intention quickly became more than just a social networking app, and I really wanted to turn it into a framework for social apps. So that brought up all kinds of issues of MVC framework design and how to build an API and other large architectural issues.

Not to mention that a lot of the project I've had to do myself, with both very little precedence, and very little help (comparatively). Some of that was my fault, for not being better at documentation and project management, but I also learned that soliciting help for open source projects is a lot harder than The Cathedral and The Bazaar made it out to be.

It's easier now, that the groundwork has been set, and there are competing projects I can look at and learn from, but the first few years of flying blind was a hell of a crash course.

</comment></comment></comment><comment><USER25> A lot of these mention working with people that are better than you.

I currently work at a startup where I am the only developer. I'm also starting a company on the side where I am the only developer.

Does anyone have any advice on how I can supplement this? I'm currently looking into working on large open source projects, so I can work with other people, but I'm just not sure if that will work.

</comment><comment><USER26> I build apps, quite a number of them. And force myself to push every single one of them to completion (launched and deployed).

Every app must have at least 1 non-monetary gains for myself. Examples:

* When I build an app with Tornado, it's because I want to see how event driven server works and how to interact with epoll.

* When I build an app with Rails, it's because I want to experiment with things I probably won't do for professional rails work. E.g. using Rubinius or Erubis.

* One of the older app I killed was written in Zend framework because CakePHP was (a while back) too slow and I think modularity in PHP app is a good thing.

* The latest one is being written in Lua because I have heard so much awesomeness about its JIT.

* With every single app that stays running, I continually learn something new about Ubuntu administration and jQuery plugins.

Of course I killed my apps if they don't take off because VPS renting gets expensive fast.

</comment><comment><USER27> My first paying programming job was adding peer-to-peer multiplayer to an already fairly mature game that was not designed for it. This gave me a LOT of experience debugging other people's code. That style of multiplayer, common in RTS games, requires every computer to run the same calculations in lockstep. This particular code base had complex AI... with a surprising number of uninitialized variables. I guess it wasn't THAT bad looking back, but tracking them all down took me months, and I learned a lot about developing and debugging large projects in the process.

(The game was Close Combat, if anyone was going to ask)

</comment><comment><USER9> Be born to parents who got me a computer when I was 5. Computers have always felt 'natural' to me as a consequence, even if, clearly, there's lots to learn about what actually makes them tick.

</comment><comment><USER28> Got employed writing software full time. Tried to make my job a little bit easier every day.

</comment><comment><USER29> Lot of good things here, but there's 2 I haven't seen:

Learn a new language. In particular, learn one that requires thinking about programming in a different way. Coming from Basic, C, C# and PHP, learning Ruby was a real eye-opener and improved my coding.

Find a mentor. Watching someone code who is better than you at some (or all) aspect(s) is a very quick way to polish your skills. Especially if you can ask questions and have them suggest improvements.

</comment><comment><USER30> There were 2 projects back in the university that made me improve my programming skills: building an OS (multithreading based on a DOS system) and building a compiler (using JavaCC).

In a different way, learning Lisp and Prolog, which basically widen your perspective.

Also, I have a question; most people say that they learn by reading good code, which I agree. Do you have any recommendation of a piece of code that you consider it has "something to teach"?

</comment><comment><USER31> Here's what I did to make me better at shipping software (which is slightly different than the question asked.)

I read moneyball (<http://en.wikipedia.org/wiki/Moneyball>) - a book about using sabremetrics to create a winning baseball team and realized that everything I knew about being a great programmer and creating a great team was wrong.

The key takeaway I took from the book is that the things we think make a great baseball player (such as RBIs and HR) aren't what help win a game. There are better stats, such as on-base percentage.

In the world of software, I correlate between winning a baseball game with shipping software. And I suspect that what we traditionally recognize as strong individual performance isn't really what leads to shipping great software (same as having someone hit a lot of HRs on your team doesn't mean you'll win a lot of games.)

Right now, I suspect that (so-callled) soft skills around communication and time management are the fundamentals stats that are more important. So I've focused heavily on things like personal and team time management, and writing skills.

</comment><comment><USER32> Read lots of books to understand how expert programmers _think_ about problems. (SO and other sites don't qualify as this as they as they are focused on "How do I do X?" which is a completely different thing -- mostly trivia)

Pair program/code review to learn what you're doing wrong.

Teach it if you want to really know it. PG's idea of writing a book is great, but I've found the interactive nature of hands-on teaching really makes me grok something. Writing, for me, helps me organize my thoughts, but coding is something you never do "perfectly" -- the goal is to solve a problem for real people, not create the perfect mathematical construct -- so I'm much more interested in how different personality styles and moods approach problem- solving in a language more than I am the details of the language itself.

Each of these works at a different level: strategic, quality-control, and tactical. Depending on personality type, folks have a tendency to get hung up on one level or another -- as if learning all the syntax of a language or how to use the IDE is the same as mastery -- but for me I've found I need all of them in equal parts.

</comment><comment><USER24> Before you can learn programming, you must first learn programming concepts. This is why smart universities teach you how to do programming rather than teach a language alone. eg: You can implement a SQL JOIN query but do you understand what the SQL JOIN query does?

Otherwise, you may find yourself being stuck to certain languages (and functions!) which can be pretty bad. eg Using if then when a switch would be clearer and quicker. Or, applying indexes to every field in the hopes it'll make the database quicker. etc.

That said, I found the best way to learn a language is to do an (Extremely small!) side project for a certain area. eg eCommerce website? Pretend you only want to sell 4 items (2 per page) and attempt to make it pretty so you understand how designers design. And aim to understand WHY the code does what it does. (There are more ideas and projects out there)

If you're going to attempt a start up, I suggest learning frameworks and APIs. Both typically save lots of money and time until you become commercially viable to cost (by then, you should be profitable).

</comment><comment> alok-g This is not something I did, but something that happened. Nevertheless, this was a valuable lesson for me:

I learned programming on a machine (ZX Spectrum+) which performed syntax checking as I typed. On the other hand, run-time errors often led to crash, making me loose my programs (system had no hard-disk!). Without me realizing then, it taught me how to write bug-free programs (since penalty for bugs used to be so high). Yet, with PC-based code editors, my programs have a lot of syntax errors.

I realized this when I met someone who could write five thousand lines of code without compiling even once and yet with less than two syntax errors!! This person was trained by writing programs on paper, and penalty for even syntax errors was set too high.

My lesson has been to dislike test-driven development. I like to certify my programs as correct by looking at them. When bugs are found during testing, my brain ends up getting trained automatically not to repeat those bugs without requiring tests to discover those bugs.

<comment> alok-g After-thought: Best way to learn something is to let the human brain do it in ways that humans don't currently understand...!

</comment></comment><comment><USER33> Not the _most_ , but: take code by a master and try to improve it. Someone like Ken Thompson or Peter Norvig. It's best if you can get an early version and then see what _they_ did with it, after your own work, though that isn't often possible. (Norvig's PAIP has answers to some of the exercises -- lots of such opportunities there.)

</comment><comment><USER34> Single most effective thing I do to improve my programming skills?

Refactor.

It might be enough to get a hack done to get some functionality working but if you never revisit it you wont learn what you did wrong or what you could have done better. Refactoring your solutions trying to improve efficiency, or usability (of the code), the process of examining your previous work and discovering how it could be made better will greatly benefit your learning process. Some times you may realize right away after finishing a piece of code how you could have done it better. Other times, its not until months or years later when you've learned and experienced more that upon revisiting the code you realize how you could improve it.

It's one thing to learn about programming techniques and designs, but it's refactoring your old attempts with those new techniques and designs that leads to understanding and empowerment.

</comment><comment><USER35> Touch typing.

<comment><USER2> Yes! This. A thousand times this. You wouldn't believe how being able to type your code and watch it while you type improves what you write.

</comment></comment><comment><USER36> The most effective thing I did to improve my programming skills was to join a team that was accountable for a goal with a real deadline.

If you don't have accountability, you don't need to make progress. No one knows or cares that you didn't work on your software project if you don't tell them. But if you have people counting on you, you have to make weekly deadlines.

Accountability is the key to success. Especially one it is accompanied by a strong desire to gain acceptance and approval from the cool kids (e.g. the really good coders who you are working with).

</comment><comment><USER37> Hands down: Taking on projects far beyond your skill level, and getting to the end of them.

<comment><USER38> I'd add to that having already been paid for it and needing to hand off to others to maintain. I guarantee that the next project you do will be at a whole new level.

</comment></comment><comment><USER39> Personally I've taken great strides every time I've changed job - being forced to learn a new set of skills and new problem domains, plus interacting with different (hopefully more experienced) people have always been very beneficial to me.

</comment><comment><USER40> I learned to communicate my programming desires and thoughts in concrete ways including but not limited to domain modeling via UML-ish diagrams on the white board.

</comment><comment><USER41> \- Learn new stuff. But not every new thing. Yet another framework/language/library for xyz isn't usually worth it.

\- Work with the smartest people you can.

\- Strive for beautiful code.

\- Keep simplifying.

</comment><comment><USER6> I learned Ocaml. The type discipline I learned in that language improved my code in all other languages, especially dynamically typed ones.

</comment><comment><USER42> Write code with testing it in mind. Testing is often introduced far too late in the programming learning process, if at all.

<comment><USER43> Every book I read by a real-world programmer - never does this. They always put testing in a separate chapter or never address it at all, example: programatic programmers.

Even any tutorials online or in a user group - it's never done. It's always talked about. I come from a engineering background so I really wanted to programming the "right" way. But here is so little code that includes testing that I can use to "tutor" myself. Even opensource.

I find this very odd.

<comment><USER44> Have you looked at this Rails tutorial? <http://railstutorial.org/chapters/>

Source code control, deployment and testing are all baked into the tutorial from the very first section where coding is started. It's also available in print form.

<comment><USER43> Thanks, I will when I get back into rails. I have given up on it as of right now. It nice to know there are more resources that include testing than there were 2 years ago for rails.

</comment></comment></comment></comment><comment><USER45> reinventing the wheel many times, in the form of implementing all the kind of algorithms and programs I could find interesting, was very useful for me. Chess programs, device drivers, data structures, network servers, and so forth. About design skills, I think reading many RFCs is a great help.

</comment><comment><USER46> Get involved with a community related to the programming language; I've had great success with IRC.

</comment><comment><USER47> Read Steve McConnell's Code Complete. This book takes you from apprentice to journeyman.

</comment><comment><USER48> For me it's: learn one little thing every single day (even a really small one).

</comment><comment><USER49> Write short functions.

</comment><comment><USER50> If it doesn't hurt, you aren't trying hard enough...

</comment><comment><USER51> after you get the tactical stuff down, find someone smarter and more experienced than you and turn him into a mentor.

</comment><comment><USER52> Read, code, read, code, read, code...

<comment><USER53> Throw a "read code" in there too.

</comment></comment><comment><USER54> Fix my own bugs.

</comment><comment><USER43> program. recreate ones in tutorials from scratch several times. Then modify them to make them do what I wanted them to do. Then create my own.

Program 16 hours a day. 7 days a week. Then sit and beam at my work.

PS don't program 16 hours a day. I had put ice packs later on my arms from the pain.

also get a super monitor, awesome keyboard, and a comfortable chair.

</comment><comment><USER55> Unit tests. I also read code recreationally.</comment>


A Modern Day Take on the Ethics of Being a Programmer - <AUTHOR> https://kateheddleston.com/blog/a-modern-day-take-on-the-ethics-of-being-a-programmer

<comment><USER2> This is especially relevant given the AM data dump.

I have often found myself in situations where the timeline and feature requirements meant that testing and security were put to the wayside. CEO's and product owners don't want their timelines bogged down, and don't want to spend dev dollars on "edge cases".

As an engineer who takes the quality of his work seriously I find this frustrating, and it has accounted for many of my early departures from companies. We build our reputations on our work, and one bad line of code can potentially end a career.

As programmers we need to push back against over zealous timelines that leave our users at risk due to inadequate testing and security precautions. No system will ever be bug free and unhackable, but it is our job to make sure it is to the best of our ability.

I hope that the tech community as a whole will take the time to realize the data we are hoarding can have extremely negative impacts on people's lives if leaked. If we can't be sure it is secure we should not be storing it.

Instead of rushing to a buyout or IPO, we should instead be building scalable secure apps that protect the trust our users have placed in our work.</comment>


Techu - RESTful full-text searches with Sphinx, Redis, Nginx and Django - <AUTHOR> http://georgepsarakis.github.io/techu-search-server/

<comment><USER2> An extremely informative and well-designed site. I wish all open source projects had a section which explained why they chose the components that they have chosen and a high level diagram of how the technology works.

<comment><USER3> I agree, this is really well designed. But it seems to lack an easy to access link back to the github repo. It has a giant download link, but who wants to download and manage versions when they can clone a repo?

<comment><AUTHOR> You are right, we corrected this.

</comment></comment></comment><comment><USER4> Why do you recommend easy_install (vs pip)? I have hardly any experience with easy_install so I'm always curious when projects use it.

[http://stackoverflow.com/questions/3220404/why-use-pip- over-...](http://stackoverflow.com/questions/3220404/why-use-pip-over-easy- install)

</comment><comment><USER5> This could be very powerful if it gets:

Clustering & distributed indexing/searching

sphinx performance per node is amazing but it lacks clustering and if that comes along it will put serious pressure on ElasticSearch.

</comment><comment><USER6> Project looks great. Great Github page too – is this a stock Github template?

<comment><AUTHOR> Thanks! It's a custom design. The designer's page is <http://danaepanopoulou.com/>

<comment><USER7> It's really beautiful, thanks for the link!

</comment></comment></comment><comment><USER8> For faceting, there's the fSphinx library:

<https://github.com/alexksikes/fSphinx>

<comment><AUTHOR> Thanks, I'll look further into that project.

</comment></comment><comment><USER9> Or, you know, just use elasticsearch.

<comment><AUTHOR> Sure, elasticsearch is absolutely great, no question on that. Nevertheless, a) it requires running Java and configuring JVM, b) Sphinx full-text search engine is really powerful, reliable and fast. So why not build a handy interface around Sphinx also? There is always room for more open-source software :).

<comment><USER10> Wouldn't this have a lot of moving parts as compared to Elasticsearch? Redis, django, nginx, sphinx all have to be configured. Elasticsearch already has all the feature you list as coming soon, and I imagine it would be very hard to add transparent clustering to this setup.

<comment><AUTHOR> Seemingly yes. My most basic argument on that is that these components are commonly found in modern server stacks, so chances are that you are already using them, you know how to configure and setup. If I am already using Nginx & Redis and Sphinx as a full-text search engine, why not have something to facilitate the search in modern manner, almost out-of-the-box? As far as the clustering part you are referring, I don't have an exact scenario on my mind at the moment but I believe it can be done. Please keep in mind that this is the very first beta version and hopefully with several contributions, it will undergo many significant changes.

<comment><USER11> I notice that MySQL is being used, is that a hard dependency or can/will we be able to use Postgres?

<comment><AUTHOR> In order to handle realtime indexes Sphinx requires using SphinxQL which in turn uses MySQL client protocol. So you'll need the MySQL client package. MySQL server is not strictly required and I am guessing can be replaced by Postgres since Django models make the DB backend transparent to the developer.</comment></comment></comment></comment></comment></comment>


Google's Groupon Competitor Goes Live - <AUTHOR> http://mashable.com/2011/04/21/google-offers-goes-live/ <comment><USER2> Is there some unwritten rule that Google has to expand into all areas of the web? It's a tall order that they can't possibly fill. (Buzz et all have proven that.)

Why do they need to compete with Groupon? Why don't they just make search kick more ass? (And no I don't mean clutter it up with more knobs/switches and social bullshit. I mean win the war against the SEO gamers.)

<comment><USER3> Google is going to partly win the war against SEO gamers by integrating "social bullshit."

<comment><USER4> HBgary's social networking software; might be a counter to that argument. If they use social as a major signal SEO's will start making fake social signs as they did with fake link signals (buy / build them)

</comment></comment></comment><comment><USER5> Google won't be able to break into the market. They are late to the game. Has anyone heard anything about Facebook Offers? Google is good at three things: acquiring startups, email, and search.

It is like Google has ADD.

<comment><USER6> Breaking into this market just requires plastering the internet with display ads, a TV ad or two, and a few deals that are too good to be true (think $20 amazon gift card for $10). It doesn't take a rocket scientist to get people to signup for email coupons. It takes cash to buy the ads, and with $36B, google has no shortage of that.

<comment><USER7> Also - Groupon spends a ton of cash on Adwords to acquire subscribers. Google can easily just "out bid" those with their own ads for free.

<comment><USER8> Is Google known to use AdWords in this manner?

<comment><USER6> No, the Offers team will have a marketing budget and bid through adwords just like everyone else.

Google has promoted their own products on their own sites outside the ad system in the past, but they got a bunch of greif for it. There is a Chrome ad on the homepage today that targets old IE browsers, but that is the only exception I am aware of.

</comment></comment></comment></comment></comment><comment><USER9> Google and Groupon are going to end up together. In court.</comment>


Why Phone Fraud Starts with a Silent Call - <AUTHOR> http://www.npr.org/sections/alltechconsidered/2015/08/24/434313813/why-phone-fraud-starts-with-a-silent-call <comment><USER2> Everyone should let the robocalls play from start to finish, then press 1 (or whatever) to talk to a live operator. Lie to the operator. Take up as much time as possible, say "ummmm" a lot, ask for the operator's name, insist that you be called "Ed" or something. Take some time to "fumble" for your "credit card". I keep an expired gift card in my wallet to give out to fraudsters. Express "disbelief" when your account doesn't show up at "CitiBank" or whatever. If you have some knowledge of credit card number formats, give out a scrambled card number. I usually end up the call with a few anglo-saxon synonyms for the masculine organ of primogeniture, I reccommend you develop your own abuse technique.

If enough people do this to fraudsters, and the occasional real credit card or bank person, then things will change.

<comment><USER3> I do a milder version of this: I press the buttons, mute my mic, and leave the phone on the desk. Less work for me, but still costs them a little bit in terms of connecting to the phone of a real person who goes through their intro-spiel.

</comment></comment><comment><USER4> Man do I hate robocalls. Every few days now I get these, "Since you are a valuable customer of [insert large consumer company here], we would like to reward you with [cash/vacation/whatever]. Please press 1 to accept." So many calls. Wishing for them to get shut down seems overly optimistic, so I hope they just get better at recognizing people who will never fall for their scam and stop wasting resources on those numbers...

(Seriously though, I feel for the real victims, and obviously having your savings disappear is infinitely worse than being annoyed by scam calls every few days. Still annoying though.)

</comment><comment><USER5> This article did not mention spoofed caller id, which is really scary and annoying. Normally I do not pick calls from numbers I do not recognize. With calller id spoofing, the fraudsters are able to show a phone number that is very similar to mine : the first 6 digits are identical to my landline ; this fools me into believing it is a neighbor or my kid' friends that is calling and I end up picking up the phone.

<comment><USER6> It's not just fraudsters. Until recently, I was a reasonably high-up IT leader at a big corporation and I probably received 3-5 cold calls per day from vendors and other service providers. By the past 12 months, almost all of them spoofed my local area code -- this is what finally put me over the top. I no longer answer calls from numbers I don't recognize unless I am expecting one.

<comment><USER7> In Australia that's flat out illegal. You _must_ present a number, and that number has to be connected to your business so that the person receiving the call can call back.

<comment><USER8> Spoofing caller ID for financial gain is illegal in the US, too, with a $10K per violation fine. But having worked in wholesale telecom a bit, no one actually cares, because no one follows up.

When you complain to your service provider, what happens is the vendor will say to the carrier sending traffic "hey calls from this number are getting us complaints, please shut it off". The call traffic just moves around or changes number. There will be several layers of resellers involved, so it's not like the resellers are being intentionally malicious and generating bad traffic, they're just relaying the calls for their customer and so on.

No one actually wants to investigate, so getting calls from a certain number to stop is usually enough to please everyone. If the FCC wanted to, they could kill this stuff in a week just by adding stronger liability rules and making carriers vet their traffic. If resellers had even a $5000 fine liability for sending bad traffic, they'd pretty quickly figure out a way to limit their exposure. But without real pressure, the FCC is happy to let things stay as they are.

<comment><USER2> That's very interesting. Why is the FTC happy to let people get scammed and annoyed, and let scammers reduce the utility of the phone system in general?

Is the FTC in on this rubbish? Are they getting payoffs? WTF?

<comment><USER8> My guess is the FCC asked carriers how to stop it and carriers said it was too hard. It's unlikely that the people the FCC talks to would say that fining them was a good idea.

Or they proposed a fine, then the big carriers said if there was any liability, they'd stop selling to smaller guys and the whole system would stop working.

</comment></comment></comment></comment></comment></comment><comment><USER9> Microsoft Windows Phone 8.1 has a fantastic feature for weird numbers that immediately hang up. Mostly those are call centers, though, and not fraudsters, at least in my experience.

When you select the suspicious number from the call list you get a menu, on which you can block the number.

It's very straight forward and savers me a lot of having to deal with impertinent assholes.

<comment><USER10> That really helps when it's the same number trying to call you again and again (and for the record, all of my Android phones have had the same feature). Unfortunately, here in the UK it's my landline that gets called (which doesn't have that feature) and almost always from a withheld or international number, which means I can't block just that caller anyway.

<comment><USER11> I kind of feel like saying "don't use landlines then dummy!" I mean it's a bit glib, but in all seriousness, why would you use landlines these days for telephone calls? Maybe it's different in the UK, but certainly here in France even the most basic phone plans come with pretty much unlimited domestic calls making the low-tech problems associated with landline phones just not worth the hassle anymore.

<comment><USER12> Am I the only one who prefers voice quality on a landline?

For conversations longer than 1 minute it's just much easier on the ears, in my opinion.

<comment><USER13> VoLTE (Voice over LTE) and WiFi calling both sound spectacular, but they're still in the process of being rolled out and require both parties to opt-in ahead of time.

Beyond voice quality, a POTS landline (at least in the US) will keep running even when the local power grid is down. Unfortunately, phone lines and power lines share utility poles, so if there's physical damage your phone service will also be interrupted.

<comment><AUTHOR> Where I used to live, the POTS lines were on separate poles from the power lines in a lot of areas, and the phone lines were far and away more robust than the power lines. During the winter, snow would routinely take out the power in huge areas, sometimes for two weeks or longer, but you could still use the phone if you had a basic trimline model (which everybody kept one around for these situations) into the jack.

</comment></comment></comment></comment></comment></comment><comment><USER14> It would be interesting if there was some audio-based exploit that could be used against the systems in question.

It would depend heavily on the nature of the software and the processing done, I realize. But if only one overly-clever person who wants an inordinate amount of praise and fame can manage it. . .

</comment><comment><AUTHOR> I think as telecom-as-a-service grows and facilitates further and further automation of this kind of thing, we may see the growth of phone call spam filtering the same way we have with email. Of course, telemarketing is nothing new, and so far nobody's really attempted anything like that to my knowledge.

What if any technologies exist for PSTN that are analogous to DKIM or SPF in email?

</comment><comment><USER15> Regarding giving out PIN numbers. Banks should make a better effort at informing customers that no other human should ever know their PIN or internet banking password, not even the bank's staff. As soon as you tell anybody your PIN, that means you're being scammed.

<comment><USER16> Unfortunately, scanners have evolved, they will tell you same and will forward you to take automated system.

</comment></comment><comment><USER17> > Company researchers estimate 1 in every 2,200 calls is a fraud attempt.

This number does not pass the smell test for me. About 2 out of 3 landline calls that I receive are fraud attempts.

<comment><USER18> Maybe they're counting cell calls as well? I get _maybe_ one call a month that I would classify as spam.

Also, do you get many calls on your landline, or is it more that you get six calls a month, four of which are spammy?

<comment><USER19> I get almost no legit calls to my cell phone (no land line). So I get percentage-wise a very high number of spam calls. My solution is too add the number to my contact list and mark that contact as silent ring. There's 33 numbers spread across 4 "scam" contacts (a contact can only have 10 numbers). Some of those numbers have called up to 10 times.

Where as if I check my "recent" call list there's been no more than 2 legit calls a month

<comment><USER18> Interesting; I wonder if there's a way to check which company currently owns those numbers.

Then again, I'm sure it's a totally legitimate (no sarcasm) company; hard to make sure that 0% of your customers are spammers.</comment></comment></comment></comment>