Floating solar farms could make fuel and help solve the climate crisis - <AUTHOR> https://www.nbcnews.com/mach/science/how-floating-solar-farms-could-make-fuel-help-solve-climate-ncna1020336 <comment><USER2> This is a cute idea, but every part of it sounds impractical.

The sea brings with it storms and waves (as mentioned in the article) but it also brings: saltwater corrosion, barnacles and other sea life trying to live on your equipment, serviceability issues (harder to get to and work on), and more.

There's also the energy needed to extract the CO2 from the water. If you want CO2, we generate concentrated amounts of it on land (like from coal power plants). Why not get that at the source?

We have plenty of flat land in the deserts around the world, and solar farms there are easier to maintain than out on the ocean.

<comment> 08-15 > Why not get that at the source?

Because building a power plant next to a power plant so the power plant can turn the waste of the power plant back into fuel for the power plant is lunacy. It's easier and cleaner to simply turn the coal power plant off.

<comment><USER3> It just turns the power plant into a battery, is all. Doesn't seem too insane to me- if you could synthesise methane or petroleum or so from the high-CO2 output of the plant using excess nearby-produced renewable energy, then stockpile the chemical fuels to burn when the sun's not shining. You could make the whole thing a closed loop.

</comment></comment></comment><comment><USER4> I really think we're just at the beginning of utilising the the seas/oceans of this planet. Between things like this and seasteading with floating cities and farms, the world is going to look very different and we're going to be living in ways that seem strange in a few generations.

</comment><comment><USER5> No they aren't because the idea described is nebulous and technically unsound

Just any electrochemical synthesis process is very inefficient, that's thermodynamics and you can't do anything about that

The most dumb and simple electrochemical fuel production process — electrochemical production of ammonia, is nowhere close to commercialisation despite chemical industry trying to do that for _more than a century_

<comment><USER6> Evidently you are not aware of

[http://www.greennh3.com/](http://www.greennh3.com/)

A much more useful ocean-going consumer of solar power would instead produce ammonia, and release it into ocean currents flowing away from land. Releasing iron oxide dust along with it would amplify its useful effect.

The useful effect would be hundreds or thousands of square miles of additional photosynthesis downstream pulling carbon from the air.

If the unit were also to concentrate CO2 and release it dissolved into the water along with the ammonia, that might speed uptake. The waste oxygen produced along with the ammonia would also be useful dissolved into the current.

Micro-organisms scattered throughout the biosphere are astonishingly efficient at taking up dilute ammonia, and accelerating growth of everything around them.

Ammonia production is the best-fit energy sink for rural wind turbines far from an electric grid. The ammonia is immediately useful to farmers, on the spot, as fertilizer, fuel, and cash crop. Intermittent power causes no difficulty; produce when there's wind, wait when there's not. Kelp farmers would find wind-powered ammonia production equally useful. Unlike solar panels, wind turbines do not block sunlight.

<comment><USER5> Electrochemical direct synthesis of ammonia is not efficient.

Were somebody to do that, that somebody would assuredly be waiting for that year's Nobel.

<comment><USER6> There has been immense progress in ammonia synthesis catalysts, in recent years. There should be a Nobel for them, but I doubt it will happen.

For small-scale production, practicalities of providing chemically pure nitrogen and hydrogen may be gating factors, rather than actual synthesis.

</comment></comment></comment></comment><comment><USER7> Why floating?

Build it in a dessert with high voltage lines

<comment><USER6> Solar-powered ice cream, with bonus electric shocks!

<comment><USER7> >Solar-powered ice cream

:D

</comment></comment></comment><comment><USER8> More fuel? No thanks. We should focus on finding alternatives to fuel, even if it is in some kind of renewable energy.

<comment><USER9> Fuel is just a name for matter that stores energy. Methanol ultimately produced by the sunlight is fully renewable: it's just recycling atoms from molecule to another and burning the produced methanol will eventually recycle them back to square one.

The same thing happens with oil too. It's just that the recycling period is so long that a massive portion of the carbon in the cycle effectively ends up stashed away underground, and the overground ecosystem has time to adapt to the amount of carbon in the atmosphere. When we talk about carbon emissions we mean drilling oil and digging up coal increase the amount of carbon in the active cycle and decrease the amount stashed. Yet it's the same carbon the planet has always had, but just with different proportions of it in different phases of the cycle.</comment></comment>


HTTP Post Denial Of Service: More dangerous than initially thought - <AUTHOR> http://www.acunetix.com/blog/web-security-zone/articles/http-post-denial-service/

<comment><USER2> This attack seems just as straightforward to address in a reverse proxy as "slowloris" (which was, despite the publicity, itself an attack known for many years prior to its announcement).

Two things remain true:

It is straightforwardly possible to bring a conventional full-featured web servers or app server to its knees with leveraged attacks (in which target pain greatly exceeds attacker effort).

 _and_

This doesn't much matter, since even stupider attacks do just as much damage. For instance, during the 2002 Winter Olympics, which Arbor Networks was contracted to do anti-DDoS for, attackers simply got tens of thousands of machines to make vanilla browser HTTP requests to targets.

If anything, things like this "more dangerous than initially thought" request is _easier_ to defend against than the dumbest attacks; it involves unusual patterns of POST requests, unusually large content-lengths, and unusually long-lived connections, all of which can easily make connections a candidate for a random early drop queue.

The fact that tools may not immediately exist to counter this kind of attack is probably not an indication of how hard those countermeasures are to build.

<comment><USER3> The countermeasures you can use today to counter web server resource starvation attacks are:

      * Turn off keep-alives
      * Turn MaxRequestsPerChild/Thread down to a minimum
      * Set your timeouts low
      * Set your MaxClients/Threads to a number your server can handle
      * Enforce LimitRequest* settings
      * Enforce cpu runtime, memory, and other limits on CGI to prevent an overly-zealous set of web apps from loading your boxes
      * Don't accept POST and other methods if you don't need it, and enforce a maximum POST size in your web apps
      * Play with mod_antiloris, mod_qos and mod_evasive and see which works best for your application.
      * Use a single iptables rule to drop more than X connections at a time from any host

You're right that a stupid attack like a plain-old DDoS using normal machines to make normal requests is probably the most effective. After blocking tor and anonymous proxies there's only a few other ways to block a large number of different addresses from flooding your site, usually with packet analysis on # average connections per host and repeatedly requested URIs, but those aren't as trivial to implement as the settings above.

<comment><USER4> Any idea if "accept filters" will help mitigate this attack? See "man accf_http" on FreeBSD; not sure what the equivalents for other operating systems may be.

I know that varnish, Apache, and nginx support this feature. Speaking of... does having a reverse proxy like varnish help in these kinds of attacks?

<comment><USER3> Actually I wasn't aware of such a feature, it's kind of neat. But no, that won't help with this attack (the filter works only on HEAD and GET methods, and this attack is about the content after a POST).

It looks like this filter deals with reducing the CPU required to handle the request portion of an initial HTTP connection. I suppose this could help with preventing the server from being starved of resources for an attack on solely transmitting an HTTP request, but that could be mitigated by a 5 or 10 second timeout on getting a HEAD/GET request from the client initially (which should be reasonable even for dial-up and mobile connections). And I personally haven't ever seen a DoS attack on a proxy layer that ate up more CPU than any other resource, so I don't see this filter as being a significant advantage over the basic tuning you can do with connections on the proxies.

Oh, and as tptacek mentioned, a reverse proxy like varnish can definitely help in different DoS scenarios. I haven't used varnish in the real world so I can't speak to specific advantages, but in general, dedicated reverse proxies are a great way to offload initial processing, provide more resources for a high number of connections and deal with host-level attack mitigation so the app servers don't have to waste time on it.

</comment></comment></comment></comment><comment><USER5> Original paper: <http://www.owasp.org/images/4/43/Layer_7_DDOS.pdf> (well, slide deck)

§ Summary

➊ The _slowloris_ attacks of last year consumed all of a host's available HTTP server connections with minimal bandwidth by trickling out HTTP headers forever at a slow pace. Countermeasures were developed and applied.

➋ This exploit consumes connections similarly, but does so by trickling out data in the content section of a POST request. Countermeasures targeting _slowloris_ are ineffective.

➌ Countermeasures for this will include HTTP request timeouts, but to support distant users operating over potentially saturated links you will have to set the timeout high enough that any well connected attacker will still be able to kill your server. (That has some extrapolation from me.)

§ Discussion

The real solution will be to not consume a process or other expensive resource until the entire POST request has been received by the server. (Expand to PUT and any other method with content in the request.)

This becomes difficult in HTTP/1.1. To really support 1.1 you have to give the request the option to reject before the content is sent. (Yes you other old farts, the client doesn't necessarily blindly send the content, but waits for your server to say "ok, the method, resource, and headers look good, send me the content".) I suppose you could force all those decisions to be made by the HTTP server, but that would be sad.

<comment><USER6> This seems easy to defend against for sites that don't accept a lot of POST data. You could set a really low threshold for content-length. You could maybe even get fancy and only allow large POST data on certain URLs (e.g. low POST content-length threshold on www.example.com, but a higher threshold on admin.example.com; assuming that you can reject the connection as unauthenticated before receiving the data).

<comment><USER7> This makes perfect sense. If for example you're accepting 140 characters there is no reason you should have an excessive content-length for that URL.

</comment></comment></comment><comment><USER8> This is not as dangerous as the authors make it sound like. Just limit the maximum connections per IP (e.g. via mod_evasive in Lighty or firewall like iptables) and voila - attack voided.

This is very similar to what Slowloris does but Slowloris is much more intelligent because it slows the connection down before it all request headers are sent and therefor many modules will not execute their limit checks just yet.

"What's special about this denial of service attack is that it's very hard to fix" "Therefore, to properly fix it would mean to break the protocol"

Not at all as outlined above.

From the paper: "In HTTP/1.1 where chunked encoding is supported and there is no "Content-Length" HTTP header, the lethality is amplified."

No, it changes exactly nothing regarding this attack. Why would it?

I do not know why these guys make such a fuss about something so trivial and obvious to anyone dealing with HTTP servers. But sadly this is quite common in the security industry.

<comment><USER9> All they need is a botnet of at least 256 computers, which can be rented for a small fee off any number of shady forums. Now what are you going to do?

A much better solution is to put a proxy in front that can hold lots of connections very cheaply. nginx and other evented servers can hold 10,000 trickling connections without using significant resources.

<comment><USER8> If you have a botnet attacking you, then it's a whole different story anyways. Those can get your services down easily regardless of what attack they use or what protocol is in play (HTTP,FTP,SMTP, you name it) so the botnet argument does not really hold here.

A proxy in front does not help if it does not limit per IP connections as an attacker can just use up all filedescriptors or connection slots. It just ups the ante a bit but not much. 10k connections can very easily be created from any DSL/cable connection let alone a server in a datacenter.

<comment><USER10> For most websites, sure. But the big boys have to deal with botnets all the time, and (mostly) manage to remain up. They need to figure this sort of thing out.

<comment><USER8> It still is not specific to this attack.

<comment><USER10> Their problem is still not specific to this attack. But they need to figure out how to handle every kind of attack that will come, _including_ this one.

</comment></comment></comment></comment></comment></comment><comment><USER11> (This has been known about for ages.)

<comment><USER5> I agree. I've been killing servers with it since the '90s. The current interest comes from it (possibly) arriving as an attack tool in botnets and not being mitigated by current anti-DDOS methods.

It is time to cope with it.

<comment><USER2> Yeah, because existing anti-DDoS methods are _so effective_ at "conventional" DDoS attacks. Uh-huh.

</comment></comment></comment><comment><USER12> If this became a problem, couldn't we just have the server do triage? Like, monitor the speed of open connections, and when we're nearing saturation, tell some percentage of the absurdly slow connections (maybe with some heuristics to detect more likely attack patterns), "Sorry, we can't support you at this time." If we're going to deny service to someone, it may as well be the problem clients.

</comment><comment><USER13> Use Apache's LimitRequest* directives [http://httpd.apache.org/docs/2.0/mod/core.html#limitrequestb...](http://httpd.apache.org/docs/2.0/mod/core.html#limitrequestbody)

<comment><USER8> This suggestion is impractical as the attack works with even fairly small Content-Length. Say 10000 and sending 1 byte per second will limit you to 10kb uploads but still give each connection hours to run. Since most IO timeouts are fairly large you can even with a limit of 1000 bytes run a connection for hours until you hit this limit.

The only solution is to limit connections per IP and maybe defining a minimum speed can help too.

</comment></comment><comment><USER14> acunetix.com</comment>


The Trouble with TOTP (2013) - <AUTHOR> https://www.miknet.net/security/the-trouble-with-totp/ <comment><USER2> The use case is for a small key fob, or virtual key fob replacement, and the number changes every minute. So, on average, the number will probably change in about thirty seconds from when the user first looks at it.

The user is going to be going back and forth between the key fob and whatever it is they are trying to authenticate to, and they have to quickly memorize the displayed value so that they can type it in, and do all that before the displayed value expires.

Pure numbers are easier to recognize and memorize, and humans typically have a working short term memory good for about seven digits.

There's your design constraints.

Better would be to use a nonce provided by the authentication system as a salt to be added to the time value, which I believe is common in TOTP implementations in software that you might use on your phone.

But ultimately, it's still a Unix epoch time value in seconds that is passing through an HMAC, and that part is going to be pretty easy to guess and to synchronize to.</comment>


State of Bootstrap 4 vs. Foundation - <AUTHOR> http://dannyherran.com/2016/03/state-of-affairs-bootstrap-4-vs-foundation-6/ <comment><USER2> One thing Foundation is doing that I haven't seen done anywhere else is Foundation for Emails ([http://foundation.zurb.com/emails.html](http://foundation.zurb.com/emails.html)). It's a build process that lets you design responsive HTML email templates that will work in most clients. There are so many quirks in Outlook, Gmail, etc that its nearly impossible to keep up, so it's great to have a team of people dedicated to abstracting it away for designers.

</comment><comment><USER3> A few things about Foundation 6:

You do not need to include the whole javascript, you can include just the things you need. However, there have been problems with webpack and Foundation javascript developers seem to have no clue about what is going on in the JS frontend world, acting like isolated on a moon station, disconnected, what leads to problems with integrating other things.

Very problematic is they still have FOUC problems - you have to look for various workarounds, but FOUC out of the box! The menu components and everything related to responsiveness suffer from it. I do not understand how this ever got released.

Foundation 5 was ok, but this 6 release is disappointing. The modular handling of menus is a good idea, but overall execution is bad, lots of micro-problems everywhere, it feels not even pre-alpha. Also very monolithic and non- cooperative, ugly to integrate with anything else.

I would recommend looking at semantic ui instead, which also has a good react integration, something Foundation designers do not have ever thought about.

About the community: the people are great, but Zurb gives them only a totally annoying "forum" that is not able to filter for versions, so when you are searching for things you get all the stuff from previous versions, an information design nightmare, that would be easy to fix, but they do not even seem to have a problem with it - this says a lot about the agency behind it.

Also be careful with installing foundation globally: it will overwrite your Foundation 5 binary, if you are using this, be careful. Not a serious problem, but when you still want to use F5 you have to prepare for it! Even with version 6 they still do not have a clue how to handle versioning, this tells a lot about the code quality you will be confronted with.

But they have great marketing, the site and everything around F6 looks really great!

</comment><comment><USER4> It's 2016 and Bootstrap still doesn't have native RTL support. Foundation had it (excellently) since 2013. When I'm building something for the local market, this has a major affect on my decision.

<comment><USER5> There was an attempt to do so. They were using an RTL-flipping tool and it all looked pretty cool (I built something with it) but then one of the people who manually flipped Bootstrap basically accused them of being culturally insensitive by trying to automate this task and they abandoned it.

<comment><USER6> "Culturally insensitive" wasn't part of the discussion. He listed specific technical and UX issues with their approach. Another commenter in this thread posted a link to the github discussion.

<comment><USER5> Having re-read the thread, I stand by my "in-a-nutshell" summary of it.

I don't think any of his technical arguments hold up. I'm also not sure that he would have convinced the Bootstrap team to have dropped this based on technical arguments if he hadn't seemed so annoyed, and made repeated references to how only people who speak the language should make certain decisions.

Some examples:

* the bug report is a command: "Stop developing RTL for Bootstrap!"

* the bug report ends with an exclamation point!

* the bug starts "I'm really annoyed..."

* "use cases that only natives can understand"

* A second command, bolded: "Remove it!"

I personally was inconvenienced by this because I was writing lots of bootstrap based .less, and if twitter and Bootstrap had worked together on an auto-flipping rtl system for Bootstrap then all the RTL users of my code would have got a far better service. Instead only those who use the Bootstrap CSS essentially as-it-comes get a manually RTL'd version from a 3rd party. A tool that can automate that work sounds like a far better deal for the RTL world, even if it would have annoyed this particular person.

I note that his argument against automated flipping included the fact that you really need one for farsi, one for arabic, etc. Yet he only manually produces one. Maybe with the right tooling he'd have got to where he wanted to be faster.

A link to such a tool: [https://github.com/MohammadYounes/rtlcss](https://github.com/MohammadYounes/rtlcss) (note how it documents various solutions to the 'problems' listed in the original bug report, like changing the font stack when in RTL mode)

<comment><USER6> Agreed that it wasn't raised very diplomatically. That's part personality/choice, part what happens when English isn't someone's first language. Comes with the localization territory. That he produced a coded alternative, regardless of its merits, puts him in good faith in my book.

There's no shortage of insufferably squeaky wheels who aren't acquiesced to, and I don't see any ways this one was treated exceptionally. It looks like the maintainers worked to understand the root of his frustration despite his abrasive style. Kudos. The Bootstrap team acknowledging it's a complex issue (rather than the solved problem they thought it to be) and changing their release plan accordingly seems a reasonable way to handle it, and one I'd encourage for maintainers of widely used projects. Finding the right effort/quality balance is tricky. That some of the issues could be relatively trivial to address (font stack) doesn't invalidate the category.

In particular, the distinction between RTL and "flipping" does seem to be a meaningful one, and fraught with unexpected issues. Eg, next=right and prev=left as a cultural convention that doesn't directly translate. As you note.

Frankly, if tasked with supporting RTL I'd probably start with a repo like the one you linked to, but fully expect it to fall down in a number of ways that could only be identified by a native user. Whether those issues get addressed would be a pretty clear statement on how much those users are valued.

PS upvoted for pleasant discussion :)

<comment><USER5> Just to note, flipping and contributions by native RTL speakers are not mutually exclusive. (I'm guessing that the author of the flipping tool I linked to falls into both categories for example).

This appeared to be the crux of the original complaint/misunderstanding too. The assumption that the core BS devs would auto-flip and leave it at that. But all but the most basic of rtl-flippers allow for case by case overrides to add the final 5% that the simple rules can't handle. Finding and fixing those requires people with an understanding of RTL and Bootstrap could easily have recruited that effort. It's just that they only have to do the last 1/20th of the work, and even without expert input devs building on top of Bootsrap can automatically get 95% for free on any extensions they build themselves.

</comment></comment></comment></comment></comment></comment><comment><USER7> I currently use Bootstrap, but have been looking at Bourbon recently along with it's suite of components (Neat, Bitters and Refills). It offers a nice set of mixins for semantic grids and common components. My only concern is working with other developers where Bootstrap is almost a common language.

<comment><USER8> Something I'm missing on Foundation and Bourbon[0] website is the self explanatory documentation. It is something that is very useful for me as I play around with Bootstrap, because I can find the section of functionality I need and then almost copy and paste their example code or inspect the element to understand it better.

Did I just miss something obvious or does it not exist?

[0]: [http://bourbon.io/](http://bourbon.io/)

<comment><USER7> As Bourbon is just a collection of Sass mixins, I think the intention for the source to be self-documenting. The docs for Bitters [0], Neat [1] and Refills [3] are a bit closer in style to Bootstrap, since they are more opinionated add-ons to the base Bourbon base.

[0] [http://bitters.bourbon.io/example.html](http://bitters.bourbon.io/example.html) [1] [http://thoughtbot.github.io/neat-docs](http://thoughtbot.github.io/neat- docs) [2] [http://refills.bourbon.io/](http://refills.bourbon.io/)

</comment></comment></comment><comment><USER9> The key unanswered question, and for me the fundamental reason I switched from using Bootstrap to Foundation at work, is how designer friendly the two are.

Bootstrap is fantastic when you want a site that looks like Bootstrap, these tend to be put together by developers. Foundation (at least was) much less opinionated and therefore when you're given a PSD by a designer much easier to implement.

Have things improved on that front? Is it easy to override Bootstrap's defaults?

<comment><USER10> Is it really that hard? The templates on [http://wrapbootstrap.com/](http://wrapbootstrap.com/) are fairly varied and don't tend to be obviously bootstrappy.

<comment><USER11> But grabbing a template from a website isn't "working with a designer."

Foundation still blows Bootstrap away in terms of building a truly bespoke site on top of their components.

<comment><USER12> Can you explain or give any examples where this is the case? At my work we build totally bespoke designs with Bootstrap and are having a good experience.

<comment><USER11> I personally find that if I'm spending time overriding a framework's defaults for literally every single thing I do, that it's a badly designed framework.

Maybe there's some sort of Bootstrap "reset.css" type of thing now, but I couldn't handle it back when I tried Bootstrap.

<comment><USER12> In Bootstrap 3 you shouldn't have to override anything.

I think I've found one exception which is the toggle button in the navbar element that seems to have some annoying defaults I have to override every time, but that's it.

(If your experience was with Bootstrap 2, then that explains your feelings, but that situation was pretty categorically fixed with BS3).

</comment></comment></comment></comment></comment></comment><comment><USER13> I've been a big fan of bootstrap, but I find that these CSS frameworks are becoming more and more irrelevant in the age of widespread flexbox support. CSS modules do put the last nail in the coffin.

<comment><USER12> I don't find this to be the case. There are a ton of conventions in Bootstrap, an obvious one being its variables, that are very useful when working in a team, and (in our experience) with outside contractors. I couldn't imagine giving up Bootstrap simply 'because flexbox'.

Also flexbox support in IE is still terrible, so for those of us building sites for the open-web it's a non-starter for things where a 'just doesn't work' fallback is unacceptable, such as the main site structure and alignment of core elements.

Currently I only find flexbox useful for things like vertical centering, where it's not the end of the world if the element doesn't center in IE.

<comment><USER14> I disagree. Flexbox is a _little_ buggy in IE11(and IE10 with auto-preifxer and the old spec) for almost everything it's fine, you just need to remember to set widths on column layouts, which is just one extra line.

Not to say it isn't frustrating, especially since it works extremely well in Edge but MS said they won't port the fixes over.

<comment><USER12> Yes, flexbox is not supported in IE8 & 9, wrong spec in 10 and buggy in 11, therefore the 'terrible'. I'm talking in the context of websites that have to work on the open-web (where unfortunately a lot of people still use those versions of IE).

For contrast if you work against a framework like Bootstrap 3, sites 'just work' all the way back to IE8.

</comment></comment></comment></comment><comment><USER15> The link is indeed down.

Here's the Google Cache version for your reading pleasure: [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://dannyherran.com/2016/03/state- of-affairs-bootstrap-4-vs-foundation-6/)

</comment><comment><USER16> This is Danny here. I didn't expect this much traffic so I am sorting out the database connection issues. The server is overloaded. Sorry for the inconvenience!

<comment><USER17> Static page cache man. If you're using Wordpress check out the Supercache plugin.

<comment><USER18> Thanks for a great writeup, and fyi there's something up with your banner/header code on iOS - scrolling causes the header to drop down, slide up, drop down, again and again (typically 7-10 times)

</comment></comment></comment><comment><USER19> My concern with both of these is that I'm slapping classes on all of my UI everywhere. Why can't a button just get all of the bootstrap btn styles automatically? Why not have forms look right just by selecting the elements that make them up? This is a problem for Foundation too. Does anyone know why they have chosen to do this?

<comment><USER20> It seems fairly over-opinionated for the framework to declare every button as exactly the same. What if a developer needs one orange square button and one normal, greyish-silver boostrap button. If every class is automatically applied to each button, you're going to need to override the styling for that specific orange, square button.

<comment><USER21> Well yeah. The defaults should be defaults, and if you want to change them you override them. No?

<comment><USER22> And the defaults are _provided by the browser_ , are they not?

<comment><USER21> The browsers have really dropped the ball though. Something like 80% of bootstrap should just be the default stylesheet in modern browsers, IMO.

</comment></comment></comment></comment></comment><comment><USER23> I would like to see a comparison of BS4 with Semantic UI, it has a few pretty interesting components

<comment><USER24> Yes Semantic UI has come a long way and changed since I first used them 1-2 years ago. I have just tried it on a new project their annoying build process and lack of official SASS support the style and out of box components are really great.

<comment><USER25> Semantic UI looks the best, but once you start to do your own things, you end up fighting it. I'd love to see some of the stuff Semantic UI does just as an add-in/theme for Bootstrap (Forms are beautifull).

I created an app for a customer in it, and while it looks shiny, it would have been more cost-effective to just have used bootstrap.

<comment><USER26> I've been helping out a developer that has been building sites with Semantic UI and it's making my skin crawl.

It seems like a good start for prototyping and admin interfaces, but for anything else it just adds too much styling and classes that need to be overridden.

The name seems poorly choosen, since you're constantly adding classes that reference styling decisions making it everything but semantic (ui very wide, ui very thin, ui three column doubling grid, …).

</comment></comment></comment></comment><comment><USER27> Bootstrap 4 seems to be the clear winner, according to the article.

If you want to start designing with it already (which is not a great idea; it _is_ still alpha), here's a Bootstrap 4 PSD template you can use: [http://hackerthemes.com/blog/bootstrap-4-psd- template](http://hackerthemes.com/blog/bootstrap-4-psd-template)

<comment><USER3> Nobody should be using Photoshop nowadays to design a website. A competent web designer knows about html and css and - most importantly - has a good understanding for how a website behaves, especially regarding responsiveness and animations.

It is a good reason to leave the room / team / project when "design a website" means "open photoshop".

<comment><USER28> So, I'm not a web designer or developer (anymore). But.. This strikes me as being the same line of though as "Leave the team when your new coding project starts with a whiteboard rather than text editor". Sure, we can just start coding, but the result is rarely as clean.

<comment><USER29> I always have to remind my team that "a few weeks of coding will save us several _hours_ of planning", when ever they just want to dive into code.

</comment></comment></comment></comment><comment><USER30> Do any modern CSS frameworks not rely on jQuery? I'm rather surprised that so many still do.

<comment><USER31> Bulma is JS-agnostic. [http://bulma.io](http://bulma.io)

</comment></comment><comment><USER32> Wow an alpha version is recommended for production. What world are we living in?! :D I tested BS4 but the alpha tag makes me too nervous to use it in production. Things will break and some things are still not there yet (talking about navigation in bs4).

<comment><USER3> Foundation 6.1 was worse than Bootstrap 4 Alpha. They are still cleaning up and completely changing things with 6.2 totally breaking your setup. Boostrap alpha is more stable than Foundation "stable".

<comment><USER16> Totally. When Foundation launched it was broken. Some JS components were unfinished and it didn't work as expected for a "stable" version.

</comment></comment></comment><comment><USER33> I was hoping for a comparison of out-of-box accessibility between the two frameworks.

</comment><comment><USER34> I prefer Foundation because I think the grid system is superior as suggested by the author and I think it's much easier to style in such a way that the site looks like your own. As many have pointed out, many 'Bootstrap' sites look like 'Bootstrap' sites. My biggest gripe about Foundation is that beyond Mad Mimi's Foundation 5 port there aren't as many high quality tools to use Angular with Foundation compared to all the Bootstrap Angular tools.

</comment><comment><USER35> Foundation dropped IE8 and below supports at very early stage. I think it caused them losing the Community.

<comment><USER36> Really? Not even relevant anymore IMO.

<comment><USER37> You'd be amazed :)

I write web applications for internal use at non-profits. If the office boxes still run IE8, IE8 has to be supported by the application.

<comment><USER38> Have you tried talking them into the current century and all of its spoils?

<comment><USER37> Heh, sure have :)

Problem is most (European, e.g. less donation-financed) non-profits have a cash flow fundamentally different to that of a company: Most of the budget comes from a foundation, the government etc. and is _tied to a specific use_.

So if the non-profit got funds for a specific project, they have e.g. full wages for 3 persons, much money for train tickets/renting of cars, food and accomodation, _renting_ of kit, paying people like me for needed solutions, office rent and so on - but with fixed budgets for each! Stuff the non-profit could use after the funded project is finished (like modern computers, office inventory, cars) is much harder to get funded.

This setup is meant to prevent corruption, not save the foundation money. The foundation usually has no qualms to grant 10k for renting cars, but will refute 5k for _buying_ a car.

In short, freely usable funds for upgrading IT equipment can be scarse even in well-financed non-profits.

<comment><USER39> What is the incentive with staying with IE? Do they anticipate that the app might one day be used outside of the non-profit and therefore can not be written for Firefox or chrome?

<comment><USER37> Sometimes switching to Firefox or Chrome works, sometimes not. The more technically literate orgs often don't use IE anyway. The problem are the technically illiterate people.

I'm wary to not inadvertently fall into the IT support role by advising not to use IE. If a bunch of really unskilled folks switch to Firefox because I say so, whom will they call if something doesn't quite work as before? :) I can (and do) say no to calls like these, but I'm always wary it taints the relationship a bit.

An approach that usually works if I explain the reasons beforehand is transparent pricing: The solution costs $x for all browsers incl. IE9+, or more if IE8 has to be supported. That way the argument is about the org being able to afford IE8, not about me being the picky geek.

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> Any opinions about uikit [0]?

From the presentation it look pretty full-featured and modular, I'd be interested to know what people who tried it think...

[0]: [http://getuikit.com/](http://getuikit.com/)

<comment><USER41> I've been using it for about a year now, and have come to prefer it over bootstrap and foundation (it's grid system in particular). It's also well- documented, and has a clean/well-organized codebase.

</comment></comment><comment><USER42> Link is down for me: Error establishing a database connection.

* [http://www.isup.me/http://dannyherran.com/2016/03/state-of-a...](http://www.isup.me/http://dannyherran.com/2016/03/state-of-affairs-bootstrap-4-vs-foundation-6/)

<comment><USER43> Google cache: [http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...](http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fdannyherran.com%2F2016%2F03%2Fstate- of-affairs-bootstrap-4-vs- foundation-6%2F&oq=cache%3Ahttp%3A%2F%2Fdannyherran.com%2F2016%2F03%2Fstate- of-affairs-bootstrap-4-vs- foundation-6%2F&aqs=chrome..69i57j69i58.1119j0j7&sourceid=chrome&ie=UTF-8)

</comment></comment><comment><USER44> Has anyone tried some of the newer css frameworks? Lots of them are listed on cssdb [1]. I especially like skeleton [2].

[1][http://cssdb.co/](http://cssdb.co/)

[2][http://getskeleton.com/](http://getskeleton.com/)

<comment><USER45> Skeleton seems unmaintained. [https://github.com/dhg/Skeleton](https://github.com/dhg/Skeleton)

<comment><USER44> Yes it seems so. But there are forked repositories that are being maintained. They are

1\. Skeleton framework ([https://github.com/skeleton-framework/skeleton- framework](https://github.com/skeleton-framework/skeleton-framework)) and

2.Skeleton Plus ([https://github.com/oltmannsdaniel/skeleton- plus](https://github.com/oltmannsdaniel/skeleton-plus))

I like skeleton plus because of the responsive menu. The colours are not so good :P

</comment></comment></comment><comment><USER46> I am a big fan of creating my own framework, but I have used Foundation in the past due to their earlier adoption of SASS mixins. However, I am just now hearing of Foundation for Emails and that looks like could save a lot of headaches

</comment><comment><USER47> IMO, Bootstrap v4 is much stronger than Foundation for many reasons. Here's one...

b4 has a much stronger "foundation." What do I mean by that? Well to be honest if you actually look at the HTML structure of both frameworks, you'll see that b4 is not only utilizing more modern techniques but that they have reduced and simplified their markup. ie, navigation items. b4 uses <div>'s for each nav element which allows for more control while foundation is using an older technique of unordered list items.

This is just one example of how b4 takes a more wholistic approach to every aspect of their framework. I don't fault foundation at all and it probably has to due with the talent of the core b4 team as well as the massive community that they have, but I can't see a use case where I'd choose foundation over b4.

</comment><comment><USER48> Seems like the post could've done with a read through before publishing.</comment>


Chinese Physicists Smash Distance Record For Teleportation - <AUTHOR> http://www.technologyreview.com/blog/arxiv/27843/ <comment><USER2> For anybody reading this and having visions of teleporting to spaceships, this is not _that_ kind of teleportation.

Imagine two indistinguishable envelopes. Put a red piece of paper in one of them and a green piece of paper in the other. Shuffle them so you don't know which is which. Have a friend take one of the envelopes a hundred kilometers away. Then open the envelope you still have with you. It contains the green piece of paper. WHOA INSTANT TELEPORTATION OF INFORMATION! You know that the other envelope has the red paper instantly, even though it is a hundred kilometers away! Information transfer faster than the speed of light. Amazing.

Now, instead of using envelopes, imagine Alice generates a pair of entangled photons. Alice send one half to Bob and measures the other half. Since the photons are entangled, Alice knows what Bob must be measuring, just like with the envelopes. So what makes quantum teleportation special? What can we do with quantum teleportation that we cannot do with envelope teleportation?

One interesting thing about the quantum world is that we cannot measure something without disturbing it. You can use that property to make an ultra- secure cryptographic system.

Alice generates an entangled photon pair so that the photons are either 'pointing left' or 'pointing right' or 'pointing up' or 'pointing down'. Now, there is no way to measure directly what direction the photon is pointing in. You can choose among two tests. Test A gives you the correct answer if the photon is pointing left or right, but gives you a random result if it's pointing up or down. Test B gives you the correct result if it's pointing up or down but a random result if it's pointing right or left.

Doing Test A or Test B completely disturbs the photon, giving it a random state.

If Alice chooses a direction to measure randomly, and Bob chooses a direction to measure randomly, Bob's measurements will agree with Alice 75% of the time. Half the time, they'll choose the same method and their measures will agree, and half the time they will choose a different method and both get a random result, but through pure chance, they will still agree half the time.

If Eve tries to do a 'Man in the middle' attack, intercepting Alice's photons and copying the result to send to Bob, Eve will send with only 75% accuracy and Bob's measurements will be only 62.5% accurate. Thus, Eve can be detected. Watch this video for more details: <http://www.youtube.com/watch?v=UVzRbU6y7Ks>

This result in the link is interesting because the researchers have been able to transport an 'entangled' photon over more than 100 kilometers, maintaining its state. It is quite hard to do since entangled photons are fragile.

However, the photons are not being teleported, just transmitted, and sticking to the speed limit like good space citizens. It is not that Alice can make a change to her half of the entangled pair and have that be reflected in Bob's, it's just that Alice can MEASURE her half and know what Bob must be measuring.

</comment><comment><USER3> Now I get it. Wikipedia to the rescue:

<http://en.wikipedia.org/wiki/Quantum_teleportation>

An entangled qubit is created and half of it is stored at location A, and half of it is stored at location B. That's the insecure part, but once A and B have two halves of the qubit, the rest of the communication is guaranteed secure.

It's amazing that you can make a change to the half at A, and its reflected in the half at B, because they are quantum entangled. Now B has no idea how to interpret the change since it seems random, but A sends a kind of "public key to unlock the data" over the air to B, and B can use that to measure his half and extract the data.

The data is "teleported", but the public key used to read the data is open. The public key itself tells you nothing about the data. It's brilliant.

Mind = blown.

</comment><comment><USER4> I don't hear too often that anything exciting is being developed in China so I think it's great for them. I expect more of this in the future.

I just don't think having the most secure quantum cryptographic communication system is the type of technology they would gladly want to share with the rest of world. Sooner or later, the secret service (do they have one?) or military will be involved. Will we see another Cold War-ish information technology race?

<comment><USER5> >> I just don't think having the most secure quantum cryptographic communication system is the type of technology they would gladly want to share with the rest of world. Sooner or later, the secret service (do they have one?) or military will be involved. Will we see another Cold War-ish information technology race?

You make it sound as if this selfishness and militaristic lean is specifically Chinese in nature and that other freedom-lovin', rainbow-kissin' nations engage in free and open exchange of knowledge with no military aspirations whatsoever. "Oh if only those poor misguided Chinese shared like the rest of us do we wouldn't have another cold-war." I mean I understand why you might be prejudiced to think that way because I presumably live in the same NATO bubble as you do, but this kind of "our values vs. their values" thinking is the exact Hollywood-like narrative that starts wars in the first place (and by that I'm not accusing only westerners of this, I'm pretty sure it happens in China too).

<comment><USER4> Not at all. I'm quite aware of the US having similar export restrictions of technology (esp. cryptography) in place for the same reasons China will not share this military-grade technology with others. Hence my Cold War mention.

<comment><USER5> For what it's worth I do agree with you that there will be another Cold War and it may in fact take place on a cyber-battlefield. I would argue though that the Cold War never ended (maybe somebody just hit a pause button).

But while technology might be used for purposes of conflict, I think that the digital age also has the potential to break the barriers of distrust and xenophobia between people of different nations. It's sort of happening on a small scale already. You are able to have a conversation with a person in China (when their internet is not being blocked) and realize that they are not a DVD-copying, cat-eating, environment-hating communist that your society might suggest they are. Governments often use the lack of knowledge about different nations to justify going to war or blocking trade. Maybe with the new age of global digital awareness we will not have such an easy time cultivating distrust and hate. Or maybe it's gotten to the point where we all distrust and hate each other on an individual level.. in which case we're all fucked

</comment></comment></comment></comment><comment><USER6> This isn't teleporting as far as I can tell. They're still using a transmission medium (fiber, laser). There is no instant appearance of the information at the target, photons are still constrained by the speed of light.

<comment><USER7> Somehow I wouldn't expect teleportation to be faster than light, even if the information doesn't actually travel through the intervening space.

<comment><USER8> The information does not travel faster than light.

</comment></comment></comment><comment><USER9> I don't quite understand high-level how this works for secure communication. Alice tosses an entangled photon to Bob and he gets the information out by reading the spin?

How do you stop Carol from just grabbing the entangled photon herself and reading the information? How can Alice know that Bob received the entangled photon? Even Carol as a MITM seems possible if she just sent Bob new entangled photons

<comment><USER10> The same way you cannot prevent someone from reading the amplitude of the EM wave you send through generic wired or wireless media?

The trick has always been in encrypting the aggregate information. But, I am sure that quantum cryptography will be a completely different ball game compared to what we have now.

<comment><USER11> No, this is wrong; pejoculant has it right above: the act of measuring the spin state destroys the superposition. It's not physically possible for three observers to see the entanglement at once. There's no cryptography required.

</comment></comment></comment><comment><USER12> I'm missing something. If it's teleportation, why does glass or air currents interfere with transmission? It shouldn't matter what's in the way, right?

<comment><USER11> It's not "teleportation" in the Star Trek sense. They need to get the entangled photons to both places so observers at both sites can see them. That means that nothing can interact with the photons on their path (or rather that any interaction needs to be precisely defined such that it doesn't break the superposition). So you can't just send them through the air.

<comment><USER12> Understood. So this means we can create awesome walkie talkies.

<comment><USER13> A quantum tin-cans-and-string telephone might be a better analogy since the photon beam can be obstructed, unlike a walkie talkie's radio signal

</comment></comment></comment></comment><comment><USER14> It would be awesome to have the web run using this. When you connect to a service they issue you a photon that you then use for transmission of data, relieving the pipes of the burden. I Wonder what the bandwidth is on one of these connections.

<comment><USER3> From the article, 1000 bytes took 4 hours to send. That's 0.5 bps.

<comment><USER15> Who wants to set up the first quantum BBS?

</comment></comment></comment><comment><USER16> I would love if there is a simple diagram or layout that explains how teleportation of information works. Does anyone knows a good resource, video or lecture for that?

<comment><USER17> At Station 1, we prepare a batch of particles that are correlated in a quantum way. Now we have to get some of the particles to Station 2 without destroying their correlations. Someone can intercept the particles on their way to Station 2, but once Station 1 knows the particles are at Station 2, the system is secure.

The operator at Station 1 performs a measurement on a particle there that changes the spin of that particle, as well as a measurement on a desired quantum bit that we want to transmit to Station 2. This process produces 2 classical bits of information. This process destroys the correlation between the particle pair, and affects the particle at Station 2 but in a randomized way that is useless without the operator at Station 2 possessing the two classical bits (thus it is not faster-than-light communication).

Once the laser takes the two classical bits to Station 2, at the speed of light, the operator at Station 2 can use them to decide what measurement to perform on the paired particle. Once the correct measurement is performed, the quantum bit that we measured at Station 1 appears.

The security benefit is that by completing one risky journey from Station 1 to Station 2, we can allow many future quick, secure journeys.

The propagation happens at the speed of light because the classical bits are required to understand what has been teleported. Performing the measurements is much slower than the speed of light. The correlation can only be stored for very short periods of time, currently.

</comment></comment><comment><USER18> I thought this was what they referred to as quantum tunneling. I'm probably wrong about that though...

<comment><USER17> Quantum tunneling refers to the observation that because we can never know position and momentum exactly, there is always a nonzero probability that an particle directed towards a barrier will breach the barrier. E.g. we cannot accurately measure the position and resistance of the barrier so can't say for certain what will happen. This results in sometimes observing subatomic particles on the other side of thin barriers.

And that is how a scanning-tunneling microscope works.

</comment></comment><comment><USER19> "Teleportation turns out to be extremely useful." <= lol! Who doubts it?</comment>


RemixOS is big on GPL violations - <AUTHOR> https://tlhp.ml/remix-os-violate-gpl/ <comment><USER2> Anyone who takes one look at the RemixOS license agreement should run the other way. You agree to censor yourself and all of the content you create or interact with within RemixOS in accordance with the censorship policies of the Chinese government. And you agree to give up all rights to user-created content used with Jide services, which is something within RemixOS (though I am unsure if you have to use it).

</comment><comment><USER3> Do you really need to ship the sourcecode with the product? I thought the GPL says you have to provide the source code if your customer wants it. But you need to always include a copy of the GPL i think.

Is Remix OS and the Android-x86 project somehow related? On android-x86.org they advertise the latest release of Remix OS in a friendly tone, but titled "Console OS" a scam which steals from Android-x86. So I guess Remix OS is somehow tolerated?

Quote from the article "In webpage "About" on the official website, I also can't find information about Android-x86 fork."

They mention Android-x86 in the first paragraph on [http://www.jide.com/en/remixos-for-pc](http://www.jide.com/en/remixos-for-pc)

I don't know about the Unetbootin part, if that was done directly, but it seems to me there is no problem with the Android-x86 part?

<comment><USER4> > I thought the GPL says you have to provide the source code if your customer > wants it.

There is nothing about what the customer wants. You have to either publish the source or provide a link, like a URL, to it.

<comment><USER3> No, you don't have to publish the source code in public. You have to submit source code with your product to the customer, or a hint that the customer can request the source code if he wants to. This can be public, but it doesn't have to be public.</comment></comment></comment>


What have you developed in your spare time? - <AUTHOR> http://n0tw0rthy.wordpress.com/2011/06/15/what-have-you-developed-in-your-spare-time/ <comment><USER2> I take issue with this article because it would come across to me as a red flag about work-life balance. That an employer would _expect_ you to be doing something programming related in your spare time comes across as a bit self- serving.

Instead, I would ask "What would you like to develop in your spare time, if you had any?" That way they can answer the same as his question if they are working on stuff, but can still show interest in programming otherwise.

Frankly, yeah, it can be hard to stay on top of things, and companies that don't foster learning and expect you to do it all on your own time don't help.

<comment><USER3> I take issue with this article because it would come across to me as a red flag about work-life balance. That an employer would expect you to be doing something programming related in your spare time comes across as a bit self- serving.

\</comment></comment><comment></comment><comment>---

I think you're reading too much into it ... I've been doing this for 7 years (not that long) and _without fail_ all the really good developers I've ever known or met have built something in their spare time ... just for kicks, a webserver, a firefox addon, some game, a ruby gem, PHP script, a macro for their favorite editor, some electronic gizmo ... something.

Not all developers do it, but the very best do ... so its not a disqualifying question, but it sure does allow you zero in on the very best developers rather easily.

As an aside ... you should always be looking at code, when you're hiring developers. If they can't give you any examples, then make them write something ... I'm continually shocked by how many companies make $70+k investments in people they've never seen in action.

<comment><USER4> I know some very good developers who didn't do anything in their spare time. One of them was co-inventor of gif format, another was a core contributor to cygwin gdb and so on. But that was all before their day job. When they started their day jobs, that's all they did.

Would you discard them as "not so good" because they don't do anything in their spare time and they concentrate on task on hand? Some people have more demanding jobs and/or prefer to work on their day job in their spare time - not because someone is putting a gun on their head, but because they like doing what they do.

Why would they bother with side projects when they already have real life projects? Impressing the interviewer isn't on their agenda and all other aspects viz. gratification, joy of creation are the same.

<comment><USER3> One of them was co-inventor of gif format, another was a cygwin to contributor to cygwin gdb and so on. But that was all before their day job.

Would you discard them as "not so good" because they don't do anything in their spare time?

\</comment></comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-----

No, because their prior accomplishments speak for themselves.

You need to stop looking at it as some yardstick to get over and understand that it is simply an informal measure of a developer's passion and drive, just because you don't do it doesn't mean "you suck. NO HIRE!"

<comment><USER4> > No, because their prior accomplishments speak for themselves.

I just quoted examples where their prior accomplishments was public. There were many whose prior accomplishments are not public and were for their employers.

> simply an informal measure of a developer's passion and drive.

I don't have a problem with using side projects as informal projects as informal measure of passion. I have a problem with your assertion that all good developers have side projects. I have worked with quite a few and most of them didn't.

<comment><USER3> what I said was

"all the really good developers _I've ever known or met_ have built something in their spare time"

you took that to mean that I saying that ALL good developers have side projects ... I'm not stating that as an empirical fact, and if you read the comments I've left its clear that I understand that.

</comment></comment></comment><comment><USER5> It's easy to point out that this question will exclude some false negatives, good people that don't have side projects. I rarely hear anyone worried that it will produce false positives, crappy people that have a github profile bursting with interesting work.

But here's the thing: If you think that this is a bad question to ask in an interview, I have a challenge for you: Describe a repeatable, objective process for interviewing developers. No hand-waving "I talk to them and decide if they're smart." Be specific: What questions do you ask? What constitutes a HIRE, what constitutes a NO HIRE?

If you actually try to make a repeatable, objective process, you realize that there is no fair interview question. It's impossible to come up with a set of criteria that can't either be (a) gamed by false positives, or (b) overlooks good people as false negatives.

For example, "Successful experience in a similar position" is an excellent criterium. But we all know it overlooks false negatives, people who have done good work in dissimilar positions but will adapt and thrive in this one.

In the end, we must either 'fess up and admit that we make subjective decisions, or set our jaw and accept that some false negatives are a necessary and acceptable cost of trying to standardize our hiring process.

(That doesn't mean we can't _minimize_ the number of false negatives. One way to do that is to ask many questions and to incorporate all of the answers into your decision. If you're very conservative, you take any negative result as a NO HIRE, which leads to having more false negatives but a vanishingly small probability of a false positive. But you can go the other way and allow for some of the answers to be negative, which will create a vanishingly small possibility of a false negative overall but allow some acceptably small probability of a false positive.)

<comment><USER6> _I rarely hear anyone worried that it will produce false positives, crappy people that have a github profile bursting with interesting work._

Actually I do worry about that, and have seen it -- and maybe not surprisingly could have predicted it.

The symptoms are often a very active set of open source projects, often a maintainer, lack of enthusiasm about virtually anything they did in their day job.

My theory is their day job at some point wasn't fulfilling and they moved to the side projects to compensate. But by the time they joined us, their side project consumed them. There's nothing worse than someone being consistently late or delivering poor quality, and looking and seeing they did 200 commits, some very non-trivial, to their side projects last week. As I said to one during the exit interview -- you should consider making the "side project" your day job, because that's your passion. Unfortunately it wasn't working here.

Given a choice between someone who was enthusiastic about their day job, and has some good end results from it, and having no side projects, and one who has a lot of side proejects, but no enthusiasm or anything of interest to say about his last job -- I'll take the person with no side projects.

<comment><USER5> I think about it as well, which is why I follow the strategy outlined in the last paragraph: Asking multiple questions and integrating the responses. Such a strategy embraces the candidates who embrace side projects because they have boundless enthusiasm within and outside of their job, candidates who have enthusiasm for their job but are busy BASE jumping in their spare time, and so forth.

I seriously doubt the author or anybody else espouses any single criterion as the only determinant in hiring. This happens to be the author's favorite question, just as my favorite happens to be about Monopoly.

p.s. FWIW, the question along these lines that I like to ask is for the candidate to describe projects that they are most proud of and have learnt the most from (two separate answers are certainly applicable, although sometimes it's the same one). Some candidates describe a work project, some a side project.

What I have discovered in my small, anecdotal experience is that people with side projects always have an answer to this question, while candidates without side projects sometimes have trouble explaining what they're most proud of and why. But the fact that some people without side projects have trouble articulating their pride does not suggest to me that a person who is justifiably proud of a work accomplishment is _neccessarily_ a NO HIRE. I suspect we agree on this.

</comment></comment></comment><comment><USER7> My passion for programming ebbs and flows. For months at a time I may work all day on one thing and come home and hack on an idea I had for serializing continuations. At other times I will instead focus on art, music, or just having fun.

However, everyone is different. I think having written and shared at least a small utility or library is a good indicator to me, I wouldn't discount someone because they had not written programs or libraries in their spare time. Especially if they come recommended and have a good work history.

I find all too often that interviews are just about impressing the interviewer. Everyone has their own idea of what makes a good programmer. When they sit across the table from a candidate I think many interviewers are looking for people that fit that mould.

 _edit: glaring spelling error_

</comment><comment><USER8> There is an implicit assumption here: that your day-to-day work does not consume all of your programming cycles. As a graduate student this was true, and now as a researcher in industry it is still true. The most interesting thing I'm working on now, the thing that is most likely to make the biggest impact _is my work_.

<comment><USER9> I think this 'spare time' thing seems to come up a lot with people who for whatever reason, aren't getting enough out of their regular job to satisfy them intellectually.

When I think about programming outside of work it tends to be about the work project I'm consumed by at the time. The only time this doesn't happen is when I'm working on something that doesn't motivate me.

</comment></comment><comment><USER10> I see this sort of advice a lot, and frankly, it bothers me. There's nothing wrong with doing programming projects in your spare time, but it's hardly the most impressive thing you can do.

For a variety of reasons, there are many one-dimensional programmers out there -- people who seem to be only interested in computers and oblivious to everything else. Come on people, the world is wide. Programming is not the best way to become an enterprising, dynamic individual. Unless your company is anti-risk and boring, don't you want to hire people who are different from you? People who have taken crazy trips around the world and learned skills that provide lateral insights rather than _just_ what you get out of sitting at a computer writing code and reading Hacker News?

If someone could provide evidence of doing something daring, that would show more initiative to me than a GitHub project.

</comment><comment><USER11> I enjoy my side projects, but to be honest, I work with people who are better engineers than me who never do engineering projects in their free time. I think it's an interesting question, but not as valuable as the author suggests.

</comment><comment><USER12> I truly dislike this question. If you enjoy reading, traveling, playing musical instruments, learning new hobbies, spending time with loved ones and so on, you will likely not have time to program another 2-3 hours a day after an already long day at work as a software engineer (including the long hours that come with the job).

Basically the question can be translated to: "Is programming the only thing you care about in life, if so we're more likely to hire you because we need a machine rather than a human being". As an employer, I can probably see that being a better bang for your buck. In fact if you could have a codemonkey work 12 hours a day without burning out for years for the same pay as a guy who works 8 hour days, would you really turn that guy down?

</comment><comment><USER13> My friend just got a job at Intel. During his interview, he tells me, they were more interested in his side projects then what he did at his previous job.

<comment><USER14> Same here (though not Intel), recently most people I've worked for hired me because of my side projects.

<comment><USER15> Nobody works on a side project for a paycheck (in general). They do it because they love it and are interested by it. If you can get someone who's loves/interests align with what you want them to work on, you stand a decent chance of making them happier while giving you a better output - it makes plenty of sense.

</comment></comment></comment><comment><USER16> Personally I believe often it is the only time you can truly learn. Often you are being paid to do a job, and in my experience (agency work) that job has been the same thing day in, day out, rarely properly learning new cool stuff to play with.

I wrote an article on this recently.

What's the most important thing to know as a developer? <http://sydl.me/1thingtoknow>

I want to keep learning new stuff... the only way to learn is by playing with it. So I create stupid little sites quite often <http://instac.at> <http://isitherapture.com> <http://obamasmessagetoamerica.com>

The list goes on...

</comment><comment><USER17> I love building stuff at home. It lets you test out all these new technologies i keep hearing about on HN :P

I built <http://www.snowboardfinder.com> a little while ago using ASP.Net MVC. Now i'm using it to learn more about mongodb and even creating a duplicate version in django just because I love python

coding should be fun and putting your mind to a personal project lets you explore

</comment><comment><USER18> My brain. My family.

</comment><comment><USER19> In my spare time I let my subconsciousness work through the problems that my conscious-self couldn't figure out. I find music, entertainment, social activities, and natural surroundings the best way to enable this process.

</comment><comment><USER20> I think there is a difference between hiring students and hiring professionals. From my experience (currently in school), my peers that have side projects (including myself) enjoy programming for the challenges and would be, IMHO, better employees. The students that don't have side projects tend to be in school to JUST GET A JOB. They don't experiment with code and generally don't have a passion for it.

In the end, I think the author is correct when it comes to students (however, the author doesn't address the difference between students and pros)... Maybe not such a good idea for the in-the-field professional.

<comment><USER20> Not a valid opinion? Isn't there a difference between hiring a newly-graduated student vs an experienced programmer?

<comment><USER21> Perfectly valid opinion and interesting to read. HN downvoting has become very random.

</comment></comment></comment><comment><USER22> Some of them are here <http://twitterex.com> <http://reduce.li> <http://twitexplode.com>

And am building a facebook application: <http://namesucker.com>

One pattern in all these, I lose interest and they fizzle out. So, if i could pose a question here, how do you keep yourself motivated?

<comment><USER23> Do you have customers? Co-developers? Or are you just working on your own?

Are you struggling to get traction? If so, use analytics (AB testing?) to figure out how to get more customers.

If you are just setting stuff up to satisfy your own curiosity (be honest), then it's quite rational to lose interest once the problem is solved.

<comment><USER22> i start off with enthusiasm and lose it at some point. For atleast one of the projects, I do think something worthwhile can come of it, that's twitterex.com. i am not sure how to go about doing AB testing on a simple site like that

</comment></comment></comment><comment><USER24> Its more liking asking a football player what he does in his spare time. I wouldnt expect him to say i play football. Its his passion and its only right he gets paid for it. Since i already have fun doing it, i would consider going out for a bottle of beer something i do in my spare time. The contribution to open soure answer shows more less of a passion for what one does. More of need to see continuity in ones field.

</comment><comment><USER25> I don't what else to do in my spare time beside developing stuff... outdoor is hot...

</comment><comment><USER26> Everyone I know who was able to turn their passion into a profession have found themselves with diminished drive to work on their pet projects in that field. If someone is satisfied with their work, it gives them time for other hobbies. It is an unbelievable good thing if people can find time for multiple passions in their life.

Aside from the fact I think this line of reasoning is useless there is another -- more important -- issue. I don't care what people do in their off time. That's theirs, not mine. It is the same reason that I don't drug test.

</comment><comment><USER27> Oh gosh, I have a problem with too many spare time projects. My GitHub account has over 60 public repos full with spare time projects. And I have to force myself to get away from the computer for at least a few hours.

I guess this extreme isn't too good either but there's always something to be done :)</comment>


An Advanced Civilization Could Resist the Accelerating Expansion of the Universe - <AUTHOR> https://arxiv.org/abs/1806.05203 <comment><USER2> Heh.

Slightly more sufficiently advanced civilization might encode information of themselves and their civilization into hawking points that are patterns left after even the biggest black holes have evaporated and the universe is timelike. We could see evidence of those civilizations in the CMB Sky.

<comment><AUTHOR> Looks like much of what you are saying comes directly from this - [https://arxiv.org/abs/1808.01740](https://arxiv.org/abs/1808.01740)

<comment><USER2> Pretty much. Conformal cyclic cosmology predicts that you could see the left over ripples from the last universe in the CMB Sky.

<comment><AUTHOR> Would you please point me to some books and research papers which pontificate more on this topic, maybe even be understandable to a layman like me?

The latter part is purely expendable.

<comment><USER2> Cycles of Time: An Extraordinary New View of the Universe by Roger Penrose.

Listen the Sean Carrol's podcast with Roger Penrose, or read the transcript to get the general idea. [https://www.preposterousuniverse.com/podcast/2019/01/07/epis...](https://www.preposterousuniverse.com/podcast/2019/01/07/episode-28-roger- penrose-on-spacetime-consciousness-and-the-universe/)

[https://en.wikipedia.org/wiki/Conformal_cyclic_cosmology](https://en.wikipedia.org/wiki/Conformal_cyclic_cosmology)

</comment></comment></comment></comment></comment><comment><AUTHOR> Related -> [https://news.ycombinator.com/item?id=17892755](https://news.ycombinator.com/item?id=17892755)

</comment><comment><AUTHOR> Definitely something Nick Bostrom would love delving deeper into.</comment>


Koding is giving away 250 TB this week - <AUTHOR> http://blog.koding.com/2014/02/one-more-round-of-awesome-the-crazy250tbweek-is-here/ This week when you register to Koding you will have 3GB of free space and if you come from a referral link then you'll get 4GB of free space, you can earn up to 16GB. Every referral will give you 1GB instead of 250MB.<p>Here is my referral link, sign up with this link to get 1GB more. http://koding.com/R/fatihacet <comment><AUTHOR> This week when you register to Koding you will have 3GB of free space and if you come from a referral link then you'll get 4GB of free space, you can earn up to 16GB. Every referral will give you 1GB instead of 250MB.

Here is my referral link, sign up with this link to get 1GB more. [http://koding.com/R/fatihacet](http://koding.com/R/fatihacet)</comment>


What we see depends on where we stand  - <AUTHOR> http://www.maximsformavericks.com/blog/what-we-see-depends-on-where-we-stand/ <comment><USER2> A minimal overview of standpoint theory. I guess it would be good for some who haven't thought about it much.

<comment><AUTHOR> @mw63214 You're right. It's definitely a minimal overview. Just trying to keep thoughts concise but frequent - allowing others to pull from it what they will.

<comment><USER2> nothing wrong with that man. Heck, it would be good for the entire world if more hackers used sociological theory in forming ideas/products/services/etc...</comment></comment></comment>