Ask HN: How do you manage translations in your mobile apps? - <AUTHOR> I work as developer in a team of ~10 people (dev, designer...) but we struggle (a lot) when we want to add or update translations in our apps (iOS, Android...). We spend a lot (too much!) of time fixing issues and send validated strings to an external translators team.<p>So how do you manage strings to translate (tools, workflow...)? <comment><USER2> Stack Overflow had an article taking about how they did translations for their web app, which I found useful: [https://nickcraver.com/blog/2016/05/03/stack- overflow-how-we...](https://nickcraver.com/blog/2016/05/03/stack-overflow-how- we-do-deployment-2016-edition/)

As someone who has done a few translation projects, you want to always have a dedicated translation team (eng should not be doing the translations). As the article mentions, the business should decide whether they're ok with incomplete translations. You should prefer to keep translations in a standard format such as po files in your source code. It may make sense to bundle it into your building processes. The UI/UX aspect can be the most challenging as suddenly some lines are now two or 3 lines and wrap weirdly.

<comment><AUTHOR> Thanks for the article.

How do you manage translations across multiple projects ? Do you have a database to keep all the strings, or you simply look if the translation has been done in another project when needed ? Who make the list of strings to translate : the specification writer, the developer when coding, another one ?

Do you use an external tool to do that ?

I've started to use CrowdIn but it's not good enough to make it easy for us (as developer) before the strings batch is sent to translators (ie: extract, collaboration).

<comment><USER2> Well the easy way is to have a monorepo, but it sounds like that's not a possibility in your case. It may make sense to have a separate repo where you keep your PO files or whatever you're using and just import that repo into each of your projects. You don't really want to just search for the string in other unrelated projects because the translations may have added context, which is appropriate fro the project it was created for, but incorrect for the new project. The person making the list of strings to translate should be whomever is in charge of actually writing the copy. That's often the product team.

We just email files back and forth, which works ok as long as it's easy to grab the current files from source control. It looks like CrowdIn basically does the same thing but with a web app and the ability to purchase translations as needed (it's weird to see a translation company with grammar errors on it's front page). The essential workflow you're looking for is the ability to send files back and forth in a version controlled manner, possibly with screenshots to add more context

<comment><USER3> Hi there!

Andriy from Crowdin is here! Crowdin is localization management platform where you can upload different kinds of files (including PO) and localize them with help of community or hire professional translators. It's worth mentioning that GitHub / GitLab / Bitbucket repository and sync files automatically back and forth.

Quite often people indeed create a separate i18n repo where localization files are hosted. A good sample: [https://github.com/electron/i18n](https://github.com/electron/i18n)

We do not provide translation services ourselves and I'm sorry to hear you've found some imperfections in texts! If you could point what exactly can be improved, we would be happy to improve that of course!

You are welcome to contact email@example.com or open live chat with us if any questions arise</comment></comment></comment></comment>


One more proof:Interviewing on whiteboard does not work - <AUTHOR> https://medium.freecodecamp.com/you-will-randomly-bomb-technical-interviews-everyone-does-heres-the-data-44475806e32#.lttegggjo <comment><USER2> This is fascinating, but it's nothing to do with whiteboards, and everything to do with individuals making technical assessments of other people. The title of the article is:

        You will randomly bomb technical
        interviews. Everyone does. Here's
        the data.

That's more accurate that the one given here.

</comment><comment><USER3> It would be a good idea to look into data from interviewer side. In my experience I found some people provide much better interviewing environment and some people make candidate nervous.

</comment><comment><USER4> I have the same problem with these analyses from interview.io every time I see them: they are making many of their inferences by fitting linear models to data that is non-linear. Is getting a 4 twice as good as getting a 2? If not, don't use a linear model!</comment>


T-Mobile says it can't be sued by users because of forced-arbitration clause - <AUTHOR> https://arstechnica.com/tech-policy/2019/07/t-mobile-demands-forced-arbitration-to-avoid-lawsuit-over-selling-users-data/ <comment><USER2> Seems to me the consumer response to this should be what happened to Uber. _Everyone_ simply asks for arbitration. At over $10,000 per person, T-Mobile might soon be begging for a single class action.

[https://www.latimes.com/business/la-fi-uber-ipo- arbitration-...](https://www.latimes.com/business/la-fi-uber-ipo-arbitration- miscalculation-20190508-story.html)

Does anyone know what the pitfalls are? Is everyone asking for individual arbitration really feasible?</comment>


Internet Explorer 8 launch fails to dent Firefox - <AUTHOR> http://www.electronista.com/articles/09/03/20/ie8.launch.stats/

<comment><USER2> The people who use IE don't care about launches. They change when:

\- Windows Update downloads it for them

\- Coporate IT depts get enough validation that it will be a safe download

The early adopter crowd is for the most part using Firefox.

<comment><USER3> I really think that as soon we see it in Windows Update, IE7 will leave room for IE8. The people who is running IE6 won't care.

</comment></comment><comment><USER4> I would say Firefox better watch it's back. Chrome, IE8, and Safari 4 are now all far more responsive browsers.

Savvy users may still avoid IE8 because of the mono-culture infection risk, but I think the only thing keeping people off of Chrome is the lack of a plug- in framework.

<comment><USER5> Agreed. With Chrome supporting it's multi-process security and Safari/WebKit exploring the world of ACID3, HTML5, CSS3 and many other advanced "we'll do it later" technologies, the only technical reason why Firefox is still relevant is it's extensions.

(Of course there's more social reasons like Safari for Windows lagging, my guess is that it's too "Mac-based" with the custom windowing and font- aliasing.)

<comment><USER3> The Firefox 4 beta uses Windows font aliasing. And tries to use the default windows theme, with not so great results.

<comment><USER3> I meant the Safari beta, d-oh

</comment></comment></comment></comment><comment><USER6> Was anyone really expecting a big percentage change less than a week after IE8 launched?

</comment><comment><USER7> No surprise. Someone using Firefox is not going to switch back to IE, just like someone who has a favorite text editor is not going to switch to the next version of Microsoft Notepad.

</comment><comment><USER8> How exciting to have yet ANOTHER version if IE to test against!</comment>


Case Study: Accuracy & Fraud on MTurk - <AUTHOR> http://tumblr.gethumanoid.com/post/16940419386/accuracy-and-fraud-on-mturk-case-study

<comment><USER2> Interesting story -- I've attempted to use mturk a few times in the past, but it is actually a lot of work to get it right. Good instructions are really important, as well as a way to measure performance.

Good luck to them as I think they might have made mturk easier to use for people like myself who see the value but couldn't figure out how to "make it work."

<comment><USER3> good instructions are crucial.

</comment></comment><comment><USER4> I just used Humanoid for the first time. I had a job that would have taken about 5-10 hours (look up 50 ad agencies, record their Twitter account, blog URL, and their CEO's Twitter account and blog URL).

Humanoid accomplished the job for under $35. Considering I would have had to do it myself, or nag an intern for a week to do it, I consider it money well spent.

P.S. I don't know what results I would have gotten from going to Mturk directly, but the results from Humanoid were better/cheaper than my old habit of outsourcing to an Indian body shop.

(Disclosure: I am an investor. But I'm giving honest feedback.)

</comment><comment><USER5> Great data, very cool how sophisticated algorithms can increase performance dramatically for human-powere tasks

</comment><comment><USER6> What does the author mean by fraud? Do people submit junk results and hope they slip through the screening process, or it it something more insidious?

<comment><USER7> Junk results, mostly, yes. That way they can complete more taks faster and still make money because most of the time their work is not manually approved.

</comment></comment><comment><USER3> "Humanoid's software identified 8% of the workforce as engaged in fraud." <\--that is a big number!

</comment><comment><USER8> Fails to mention how much they cost on top of the mturk prices to the client</comment>


Ivar Kreuger was the world's greatest swindler. He would have thrived today - <AUTHOR> http://www.economist.com/finance/displaystory.cfm?story_id=10278667 <comment><USER2> The letter at the end by "Sten Kreuger" suggests that the spirit of the "world's greatest swindler" continues to run in the family.

</comment><comment><USER3> I wonder just how illusive the world's economy is today? Every time I hear economists talk about it pre and post crash, it's always with the same kind of confidence that the article ascribes to Kreuger. Since the economy thrives on confidence, there is incentive for economists to lie to us.

<comment><USER4> Nah, it's only economists who are bankrolled by people who have a lot to gain if/when the economy picks up.

The rest of us tell it as we see it.

 _EDIT: It's just we can't get the same amount of air time..._

</comment></comment><comment><USER5> "And once again, financial innovation is moving faster than rules can keep up with it..." More like the rules are being written out of the way to allow for "financial innovation" to break free of order and bring chaos.

</comment><comment><USER6> Only think that comes to mind:

Same shit different day.

</comment><comment><USER7> Shouldn't the world's greatest swindler be someone who's name we _don't_ know?

<comment><USER3> The greatest swindler would be someone who everyone clearly knows is swindling them, but that they voluntarily do not stop. Plus, he gets something extremely valuable.

<comment><AUTHOR> Secretary Paulson?

<comment><USER3> He's swindling me?

<comment><USER8> Are you a US taxpayer?

<comment><USER3> Yes I am. Is he giving the bailout to himself? No.</comment></comment></comment></comment></comment></comment>


PayPal is prohibiting all intra-Russian transactions in 2 weeks - <AUTHOR> https://www.paypal.com/ru/smarthelp/article/faq4280 <comment><USER2> From Google Translate:

 _PayPal stops processing domestic payments._

 _Starting July 31, PayPal disables all domestic payments in Russia._

 _PayPal will focus on international transfers to / from Russia (s), which account for a large share of PayPal's business in Russia._

 _Foreign (international) payments always accounted for a large share of PayPal 's business in Russia. Having assessed the current state of the business, we decided to focus on international transfers and stop processing internal payments between account holders in Russia. Users, as before, will be able to take advantage of the global PayPal network, with more than 300 million customers._

 _Transactions related to the payment of goods in Russian stores or the transfer of funds between Russian users will be automatically rejected. You, as before, will be able to send and receive cross-border electronic transfers._

 _The change is due to take effect on July 31. Users will receive a notification of a change in the User Agreement at least 14 days before._</comment>


Judge: Democracy Now's Amy Goodman Isn't a Criminal - <AUTHOR> http://www.thedailybeast.com/articles/2016/10/17/judge-democracy-now-s-amy-goodman-isn-t-a-criminal.html <comment><AUTHOR> Followup on yesterday's front page story: Amy Goodman Is Facing Prison for Reporting on the Dakota Access Pipeline [https://news.ycombinator.com/item?id=12719333](https://news.ycombinator.com/item?id=12719333)</comment>


Big ideas that I suspect to be true - <AUTHOR> https://invertedpassion.com/big-ideas-that-i-suspect-to-be-true/ <comment><USER2> Maybe stop reading deepak chopra, and read something else for a while?</comment>


Ask HN: Why does Facebook need another $500 million? - <AUTHOR>

From the MSNBC article, "(FB) said the new money will give Facebook the financial firepower to hire new employees away from competitors, develop new products and perhaps gobble up other companies - all without being a publicly traded company."<p>Why can't they do all of that now? <comment><USER2> Here is ticker guy's take on it.

"Facebook: Looking For Bagholders: Don't let it be you."

<http://market-ticker.org/akcs-www?singlepost=2337946>

</comment><comment><USER3> I think that they are circumventing SEC regs on 500 of shareholders for privately held companies. GS could sell the stake to HNW but for the SEC it would appear that only GS is a shareholder.

So basically they get away with all the reporting requirement, Sarbanes-Oxley and what have you to tap public markets by going through GS.

Meanwhile GS passes off all the risk to HNW individuals and keeps some nice change for itself.

Frankly as a libertarian I do not see any problem with this. As long as GS does not come back looking for a bailout.

<comment><USER3> Latest update from John Cassidy (NewYorker) [http://www.newyorker.com/online/blogs/johncassidy/2011/01/fa...](http://www.newyorker.com/online/blogs/johncassidy/2011/01/facebook- goldman-where-is-the-sec.html)

</comment></comment><comment><USER4> At a very modest average value of $70,000 per employee for 3000 employees, that's about 2 years' worth of salaries. That's not a lot of money for FB to spend.

</comment><comment><USER5> They probably can do all of these things, but not at the rate that they would prefer. This funding round would allow them to speed up efforts by a significant factor.

I also wouldn't be surprised if a lot of the capital is actually used for construction. Every time Facebook signs a new lease, they outgrow it. This may buy a huge plot of land to build their own megacomplex.

</comment><comment><USER6> I also believe they will use some of the new money to cash out early investors.

<comment><USER7> Do you think that early investors would want out now with an (Not Confirmed) IPO around the corner?

<comment><USER8> I think early investors always appreciate taking out a good chunk of their original investment if they can leave it with no downside and all upside

</comment></comment></comment><comment><USER9> This seems more like a strategic investment. They're obviously partnering with Goldman Sachs for an (eventual) IPO, and the terms were probably good. Why not do it?

</comment><comment><USER10> Let´s see when the next Web 2.0 FB challenger will come out and then the over $1.5 billion investors have plugged into FB will be gone with the wind :-)

</comment><comment><USER11> They need it to start sending dozens of "Facebook CDs" to everyone, because that worked so well for AOL.

<comment><USER12> The strategy took AOL from a mere 200k users to 25million. It worked very very well for AOL. If they hadn't done it they'd likely be yet another long forgotten online services company like Prodigy, CompuServe or Genie.

But instead they're a multi-billion dollar company which everyone here has heard of.

</comment></comment><comment><USER13> They're not as profitable as they like us to think. I am guessing declining game ad spend and increasing cost from new users in countries that cannot be monetized.

<comment><USER14> You got it. As an advertiser/agency, US traffic is worth significantly more to me than international traffic, and I'm willing to pay a premium for it. Facebook growth in the US is slowing, and international traffic is not doing well.

In some ways, the Facebook ads ecosystem is a replay of the first .com bust. Ad-supported games are buying ads on other games to get users to click on their ads advertising more games. It's not sustainable at all.

<comment><USER3> Besides I think that some marketers are discovering that facebook is not that effective at converting users.

At least that is our experience. We are into enterprise software for researchers and though we can target even grad students at universities these grad students are not in the frame of mind to consider enterprise software while checking out profiles on fb.

Google just turns out to be much cheaper to per conversion.

And I think that our experience is not uncommon. If you are doing something cool/trendy/luxury/consumer facing business then may be facebook is for you. For the rest of the market Google is way more effective

<comment><USER12> I'm building a job board for developers, and Facebook is giving me cheaper conversions than anyone else. But you need to invest the time in building high-performing ads, the current ads we run are performing 50x better than our initial ads. Good ad copy and appropriate demographic choice is critical.

I suspect when a lot of people say they find Facebook ads not being effective, they've just stuck an ad up seen a 0.0001 CTR and given up. Not that I'm complaining, it makes the ads cheaper for me :-)

Facebook could do a lot more to make it easier for advertisers to build high- performing ads, but I suspect they're afraid that it'd mean that the advertisers would end up spending less money of Facebook.</comment></comment></comment></comment>


Applications now open for summer 2008 YC funding cycle - <AUTHOR> http://www.ycombinator.com/s2008.html

<comment><USER2> I liked the Cambridge YC HQ quite a bit. It's much homier than the one in MV.

<comment><USER3> Much smaller too, right? I wonder how they'll fit all the groups if next year they have even more.

<comment><USER4> I'm wondering too. We were pretty much at the limit last summer. When we had investors there for demo day, we literally had to put the founders outside in a tent.

Fortunately we can expand in time if constrained in space: just have multiple dinners per week. That would get us 7x without needing to find a new building. I've had my eye out for places in Cambridge, but it would be really hard to beat the current one.

<comment><USER5> If you need a good architect to build something remarkable for YC, let me know :)

</comment></comment></comment></comment><comment><USER6> Plug: word count Greasemonkey script for yc application form <http://userscripts.org/scripts/show/13291>

<comment><USER7> Bookmarklet version (Safari and Firefox compatible):

javascript:function update(e) { var a = e ? e.target : window.event.target; var s = a.nextSibling; if (!s) { s = document.createElement("div"); a.parentNode.appendChild(s); } var words = a.value.match(/\S+/g); var num = words ? words.length : 0; s.innerHTML = "word count: " + num; s.style.color = (num > 120) ? "red" : "green"; } (function() { var a = document.getElementsByTagName("textarea"); for (var i = 0; i < a.length; i++) { a[i].addEventListener("keypress", update, false); update({target:a[i]}); } })();

</comment></comment><comment><USER8> Not to throw a racial stick into the wheel, but are there any black or latino founders out there applying to Y C?

<http://news.ycombinator.com/item?id=104919>

<http://news.ycombinator.com/item?id=104728>

<comment><USER9> Suspend your disbelief, and irrationally accept what quantcast tells you: (<http://www.quantcast.com/paulgraham.com>)

African americans, latinos, and asians all outrank caucasians in pageviews on paulgraham.com. It also shares with ycombinator.com a slightly female audience, and members who visit also enjoy shopping for horses. ;-)

</comment></comment><comment><USER6> "Are any of the following true? ..."

You forgot "are you a terrorist" ;-)

That question seems to indicate that there will be automated screening out of applications?

<comment><USER4> No, there's no automated screening. We added this question because people's answers are sometimes so unclear that we can't be sure of the answers to these. It serves the same purpose as a check digit in a credit card number.

We certainly wouldn't automatically reject a group that answered this question yes. Loopt would have, among others.

<comment><USER6> Thank you for the clarification!

</comment></comment></comment><comment><USER10> Is there any chance of YC expanding to Europe in the future?

<comment><USER11> What do you mean expand to Europe? European founders can apply.

<comment><USER10> Yes, I know that but we would have to move to US for the summer and thus get visas, which could be difficult.

<comment><USER12> I'm hoping that getting a visa is easy compared to getting a successful startup off the ground. :) pg's views on this have been widely documented.

<comment><USER9> From <http://www.paulgraham.com/america> :

 _"US immigration policy is particularly ill-suited to startups, because it reflects a model of work from the 1970s. It assumes good technical people have college degrees, and that work means working for a big company.

If you don't have a college degree you can't get an H1B visa, the type usually issued to programmers. But a test that excludes Steve Jobs, Bill Gates, and Michael Dell can't be a good one. Plus you can't get a visa for working on your own company, only for working as an employee of someone else's. And if you want to apply for citizenship you daren't work for a startup at all, because if your sponsor goes out of business, you have to start over."_

Getting a visa isn't always something you have control over. My best friend, having found a job at a YC startup, is currently held up at the boarder. The guards didn't seem to believe it was a real company. I was rejected for my TN visa once, and had to prove that the company I was to be working for was incorporated, along with a plethora of other documentation.

I'm still not sure how I'm supposed to get a visa to work at my startup. The rules for the TN-1 visa (for Canadians, I presume the TN-2 for Mexicans work similarly) say you can't be a controlling owner of the business you'd work for. Could you then get a whole bunch of Canadians together, no one of whom would have a controlling share, and found a company in the US?

I've tried to hunt down an answer to this, but to no avail. By the letter of the law, yes, one should be able to: this means that many college educated Canadians could bypass immigration entirely. But in practice it's up to the whim of the immigration guard, and people are kept out of the US, not allowed to work for completely legit companies.

<comment><USER12> It strikes me as odd that this would be decided by some random immigration official at the border. Surely, you'd chip away at getting an appropriate visa at the US embassy back home? Or are there in fact two possible points of failure?

<comment><USER9> For most programmers, there's the H1-B Visa. This is tied to a specific employer, they're given out on a roughly first come first serve basis and there's a quota of them: only 65,000 are given out per year at last count. Last year there were so many people applying that all the visas for FY 2008 (starting October 07) were given out on April 1st -- the next time you'd be able to apply would be April 1st 2008, for October 2008!

For Canadians and Mexicans there is a different visa, called the TN, created under NAFTA. If you read the NAFTA proceedings, you'll come to understand that the method of getting verified at the border was meant to make it _easier_ and _quicker_ to get a Visa, for certain classes of professional. The one professional category involving computers, 'computer systems analyst', was so vaguely defined that one could only interpret it was meant as an umbrella term.

But what's happened in reality is that small-minded border guards have been given the authority to simply reject people. They demand all sorts of things that aren't in the law, and they make no apologies.

<comment><USER13> I wonder how well it'd go over to attend a 4 month long entrepreneurship seminar in Boston. I also wonder how they define 'working in the US'. If my start up is incorporated in Canada, can they stop me from working on it while I'm visiting the US?

<comment><USER9> The law isn't very refined on this point. It's perhaps best to talk with a lawyer, taking the attitude "I'm going to do this, now keep me off the waterboard".

US law doesn't ban individuals from being international actors. It barely even acknowledges the possibility. But ultimately you're subject to the whims of whichever boarder guard your happen to meet.

Canadians are legally allowed to vacation in the USA for up to 6 months. I'm not sure, but I don't think the law is too specific on not being able to _work_ (the semantics of the word are too tricky), but you need a visa to be in someone's employ. That may leave certain possibilities open.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> ooo, new question:

 _Please tell us about the time you, username, most successfully hacked some (non-computer) system to your advantage._

<comment><USER4> There are a bunch of new questions. That one was suggested by Sam Altman.

<comment><USER15> That's a really awesome question.

If you don't already have a copy, you might enjoy Rod Beckstrom's book Brainticklers. It's basically just a book of questions about the year 3,000.

The questions range from

"When we can match or exceed many or all human physical and mental skills with computers or appliances, how will we define our reason for being?"

to

"What will be the most popular baby shower gift in the year 3,000?"

It would probably be a fun toy for the YC dinners.

</comment></comment></comment><comment><USER16> suppoes someone in india then will u consider them?i mean cost of relocating there is high so is it ok?

</comment><comment><USER17> I applied, because, well..

he who never tries, never succeeds? One should never be afraid of failure or rejection!</comment>


Banner ads on CNN.com contain keyloggers - <AUTHOR> https://twitter.com/brannondorsey/status/1019253914133286912 <comment><USER2> Sites bemoan ad blockers but then take no responsibility for the ads that are shown. That needs to change - it's not like print advertising.

<comment><USER3> Google's monopoly status means it fulfills 90+% of the ads. I can guarantee you that CNN has no control. There is no competition. So, erm, maybe the onus is on Google?

<comment><USER4> Google ads container keyloggers? I doubt that.

<comment><USER5> > Google ads container keyloggers? I doubt that.

Just to be clear, I think they are talking about advertisements placed via Google's platform, not ad campaigns by Google.

I think there is only one way to solve this: programmatic ads cannot contain executable code (no access to local storage or network) and ads must come from the same origin as the page they are on. For example, YouTube will host an ad for Subaru on YouTube's servers. The sticking point as people have pointed to me before on HN is fraud. The customer (in this case Subaru) does not trust Google to be honest in counting the number of impressions.

Perhaps what we need is legislation banning this behavior across the board. When no ad vendor is able to allow customers to do what they please on user's web browsers, the customer has no recourse other than to accept that this is not possible. I don't know how such a legislation would work though. Perhaps it needs to be an industry alliance instead of legislation?

<comment><USER4> Again, I still doubt that Google places ads with key loggers via their platform. Maybe I misunderstand something about how they operate though, and I can't recreate anything close to what the original article shows. In fact, I can't even load cnn.com right now.

</comment></comment></comment></comment></comment><comment><USER6> Lots of speculation here, not much analysis, even from lazy gits like me.

Chrome web inspector kindly gives the "Initiator" for every request. In this case it's cnn-header-second.min.js. Load that, and Chrome again kindly detects minified JS and offers to pretty-print it.

The context here appears to be some kind of ad console tool, added by CNN, not by an ad. The relevant function is at [https://pastebin.com/EwgPAM6T](https://pastebin.com/EwgPAM6T)

It's a bit obfuscated/minified, and they don't seem to have a non-minified version available, so it's not clear exactly what functionality this is enabling.

Either way, not really a keylogger if it's not capturing all keystrokes and shipping them off somewhere.

<comment><USER7> Functionality is to enable an "AdFuel Creative Review" form when typing "d o h" anywhere on the page. Try it. Then click the blue icon in the lower right.

<comment><USER8> The tool is for reviewing bad ads and ad stack QA.

</comment></comment></comment><comment><USER9> This is a prime example of how people so easily accept a headline shared on some news authority to be truth. Even the bright minds at hacker news are duped - just look at all the discussion happening here with the assumption the headline is correct.

The guy who tweeted this jumped to a conclusion, naively shared his discovery, then let it perpetuate leaving numerous victims of an erroneously altered world-view.

<comment><USER10> I seriously think people shouldn't be able to comment / see comments on HN unless they've at least clicked on the darn link. I took one look at the "keylogger" source code and recognized it.

</comment></comment><comment><USER11> The point stands, but that's not really a keylogger. It's a library to manage keyboard inputs. Of course, it could also send all key info somewhere externally too.

<comment><USER12> But in what universe would an individual ad need that? This seems like precisely the sort of thing that a third party ad would be prevented from doing.

<comment><USER13> Keypress.js doesn't really help creating a keylogger. It does make creating interactive ads easier though.

<comment><USER14> The 90s called and wants "punch the monkey" back

</comment></comment></comment></comment><comment><USER15> I'm skeptical that this is a) from a banner ad and not from operation of the site b) a full blown keylogger and not a library included that is used for something like a photo gallery (that may have ads in it)

<comment><USER16> Also, the file is served from turner.com domain, which is the company who owns CNN.

</comment></comment><comment><USER17> Scripts from the ad should be iframed no? Doesn't make sense that an ad could run arbitrary JS within the same browsing context as the host.

<comment><USER18> It doesn't make any sense, but it's very popular.

To be fair, when they're desperate real world newspapers are like this too.

A flush successful newspaper will make a deal of its editorial independence and insist you write "Advertising Feature" in big letters at the top of your full page ad, use a completely different typeface and give your company's name, but when money is tight the guy selling those adverts is under pressure to compromise. What if it says "Sponsored content" rather than "Advertising Feature"? And rather than big letters at the top, how about small disclosure text at the bottom? The typeface could be a very good clone of your normal editorial typeface, and still count as "different" right? And lets have a byline which says "Our staff", that's vague, and the poor reader might think it means it was written by journalists, but it doesn't strictly _say_ that, it just says "Staff" which could be anybody...

This is how internationally famous British newspapers end up running content literally written in Beijing or Moscow to let everybody know how free and wonderful those countries are, using weasel words like "in co-operation with". And if the _actual_ news is a bit awkward? Well, you wouldn't want that lucrative sponsored content deal to lapse would you? Maybe a brief mention on page 14 is enough, even if those newspapers which still have a backbone ran it on their front page.

<comment><USER17> Are you sure this approach is popular? AFAIK none of the top ad platforms allow you to inject scripts. Do you know any?

</comment></comment></comment><comment><USER19> It appears to be getting the keypress.js library from ssl.cdn.turner.com. Not clear if the data is being exfiltrated, though, just by looking at that tweet.

<comment><USER20> Exactly it is incorrect to jump to the conlusion that they are using a keylogger. I mean, they're loading a JS library that allows to handle keypress events; but if you talk about a keylogger everyone assumes that they're stealing your keystrokes.

What needs to be done is to navigate the site and typing a given char sequence on every page while logging the HTTP traffic, then do a search for that sequence to see if it appears in any request. That's the basic thing you could do to actually verify if there is a keylogger.

</comment></comment><comment><USER21> >ssl.cdn.turner.com

Obviously bullshit. That's CNNs CDN, not a "banner ad". This guy did not put in the least bit of effort to verify his claims.

The script is included in [https://edition.cnn.com/.a/2.103.4/js/cnn-header- second.min....](https://edition.cnn.com/.a/2.103.4/js/cnn-header- second.min.js)

<comment><USER22> It appears to be used to set up multi-key hotkeys for debugging. Pressing 'd o h' on the page requests some adfuel console resources.

</comment></comment><comment><USER23> This is getting upvoted without getting the context.

</comment><comment><USER24> Here's what is actually being run

[http://dmauro.github.io/Keypress/](http://dmauro.github.io/Keypress/)

<comment><USER25> Why aren't the code snippets in a monospace font? Is there readability ux that thinks this is a good idea?

<comment><USER26> they look monospace to me

[https://i.imgur.com/K5L7xit.png](https://i.imgur.com/K5L7xit.png)

</comment></comment></comment><comment><USER27> How likely is this to be due to accessibility (ie. keyboard-only users) vs. keylogging?

<comment><USER28> Doesn't seem likely that an advertisement would need to embed that kind of functionality.

<comment><USER29> What kind of functionality? This is just a generic library for more easily managing keyboard input, JavaScript itself supports the same but in a more clunky way.

</comment></comment></comment><comment><USER30> I would suggest their "lite" [1] version. It is compatible with addons like NoScript, uMatrix, uBlock, Canvas Fingerprint Defender, CSS Exfil Protection, Privacy Settings and Self Destructing Cookies. I am using FF 52 ESR. Some of these addons may not work in 58+.

They could improve their HTTP header settings a bit. [2]

[1] - [https://lite.cnn.io/](https://lite.cnn.io/)

[2] - [https://securityheaders.com/?q=https%3A%2F%2Fcnn.com%2F&foll...](https://securityheaders.com/?q=https%3A%2F%2Fcnn.com%2F&followRedirects=on)

</comment><comment><USER31> Iframed banner ads _can't_ log keystrokes outside their frame, browsers don't allow that. And no site in their right mind would include ads that aren't iframed.

A keylogger would be possible if there was some kind of zero day exploit, but this isn't that, it sound like the tweeter didn't do their due diligence. I'm curious how someone gets as far as looking through the minified JavaScript without knowing the browser doesn't allow that, obviously(?), otherwise all your passwords and information would have been compromised long ago.

</comment><comment><USER32> as someone who claims they are a programmer and researcher... you would think they would have done some more research on this and also have common sense to know that this isn't a keylogger.

</comment><comment><USER33> Things like this make me happy that uMatrix exists.

<comment><USER34> indeed ! keypress.js is blocked on the easyprivacy list as well.

</comment></comment><comment><USER8> What could an advertiser good to track with key logging? Password to their... CNN account??

<comment><USER35> A password to an individual's CNN account could easily be their same login to their bank or other more important account.

</comment></comment><comment><USER36> CNN, like the vast majority of news sites, is best viewed with javascript disabled. Pages load 10X faster, scrolling is not jumpy, the CPU doesn't go crazy, and text reads just as well. It is hands down a much improved user experience.

</comment><comment><USER37> It's not CNN. It's ads.

Advertising has ruined every medium it has ever touched. It will ruin the web. It is only a matter of time. It did not destroy ancient network television overnight. It did not destroy cable tv overnight.

The last time I saw cable tv a few years back, it had become so bad that after a long run of ads, they would then put bugs and walk on people right over the content of the show you were watching. Sometimes obscuring important content within that show.

<comment><USER38> Which is why NF is so successful and cable is bleeding from the arteries. Consumers want to choose their device, on their schedule, without tampering with the content, and they want good and timely selection of content. They will pay well for this.

</comment></comment><comment><USER39> cross domain script blocking should be enforceable in all browsers

</comment><comment><USER40> press shift-control-z on cnn.com and you will get what this supposed keylogger is (hint - its not a keylogger or comgin from an ad) but merely a cnn internal tool..

</comment><comment><USER12> Dearest Ad Industry,

This is why we run ad blockers. Since you won't regulate your industry, we're fixing the problem for you.

Love,

The Rest of the World.

<comment><USER41> PS: and please burn in hell, asap.

Sincerely,

Concerned users of the Internet.

<comment><USER8> takers of the internet?

</comment></comment></comment><comment><USER42> I've noticed CNN has had a crap ton of redirect ads recently...

<comment><USER8> They come in waves and go away when ad exchanges figure out how to block them. It isn't usually tied to a single publisher, as they are bought and sold across ad exchanges that reach most of the ad funded web. They are extremely difficult for even manual reviewers to spot and reproduce, so the whole industry works to stop them together. Then new ones pop up.</comment></comment>


Where you're happy, is where you should be - <AUTHOR> http://www.flickr.com/photos/kinetic/5245654733/

<comment><USER2> Love this article, and the pictures are great. Your comment is also a good justification for finding an inspiring office space. Unfortunately for startups its tough to find affordable rentals with vaulted ceilings, gallery like interiors and red-brick walls. Maybe this is a good reason to band together with other friendly startups or look into crazy alternatives. Artist studio space can be rented for just a few hundred a month, I wonder if you could get away with turning actual gallery space into an office...

<comment><AUTHOR> being very creative would work, but would it be bad to travel and work? I wonder if there's a cost efficient way. I didn't rent an office, I basically just paid for some coffee and camped out at a few cafes.

</comment></comment><comment><AUTHOR> Just my take on going to a nice place to work.

</comment><comment><USER3> This is a sweet post. In an ideal world, work would be infused with joy rather than stress.

<comment><AUTHOR> definitely. i'll see you in hawaii ;)</comment></comment>


Sulong: Fast LLVM IR Execution on the JVM with Truffle and Graal - <AUTHOR> https://github.com/graalvm/sulong <comment><AUTHOR> Slides: [https://fosdem.org/2016/schedule/event/llvm_sulong/attachmen...](https://fosdem.org/2016/schedule/event/llvm_sulong/attachments/slides/1205/export/events/attachments/llvm_sulong/slides/1205/Sulong.pdf)</comment>


Sick but Not Sick - <AUTHOR> http://www.nybooks.com/articles/2017/02/09/sick-but-not-sick/ <comment><USER2> _That listening is no longer valued in today's medicine. The patient's "history" was once the centerpiece of his medical record, his story written in narrative form. With current electronic templates, information is fragmented into chunks designed to meet so-called quality metrics and maximize revenue from insurers. The patient's story has been reduced to telegraphed key words that trigger prefigured algorithms, which generate pop-ups on the computer screen for further testing or generic therapies._

This finally explains why I find medical care in the US so different than what I had in my birth country (Brazil).

My US experience so far (multiple times): go to the doctor and have 15-20 minutes tops to talk to them (and most of that time is taken by a nurse and then waiting), describe symptoms and general observations I've made about them (I listen a lot to my body). With almost no discussion or explanation, I'm quickly diagnosed with something that almost always sounds bogus to me and I'm prescribed some medicine with no explanation of what it does.

Back in Brazil: go to the doctor and have 30-45 minutes booked. No nurse. Explain symptoms. Doctor asks further questions. I answer and offer general observations. Doctor writes down everything. Doctor appears to _think_ about it. Doctor offers a few possible explanations as to what is going on and what is the course of action from then on. Asks what I think about it. If I'm prescribed something, I receive a full explanation of what the medicine does, and if I'm OK with taking it.

Another major difference I've observed is that doctors in the US tend to attempt to treat things starting from the least concerning ailment. I guess that's why there are so many stories of cancer patients going to doctor after doctor who treat them for minor things, only for a cancer diagnostic to be made when the disease has progressed a lot further. Back in Brazil, the doctors I went to would usually go a completely different route: "it's probably <insert minor/treatable problem here>", but let's rule out the sinister stuff first [like cancer]."

I love 99% of my life in America when compared to Brazil, and have no plans to go back. But going to the doctor here is definitely a subpar experience compared to what I had there.

<comment><USER3> I've had the exact same experience with American doctors. What is that? These people are supposed to be scientific thinkers. They've had years of biology. But I've never met a doctor who applies the scientific method, or cares to. They are a fundamentally uncurious bunch.

<comment><USER4> I suspect it's economic. The faster they can reach a diagnosis, the more patients they can see, the more money they make. It certainly pays to shop around in order to find a doctor that you are comfortable with and then stick with them for life.

</comment></comment></comment><comment><USER5> I often feel like a lot of problems diagnosed as "psychosomatic" illnesses are caused by bad nutrition or even lack of sun. As an example: A lot of people I know recently got sick after living in Seattle for a few years and it ended up being that at least a portion of the cause was severe Vitamin D deficiency. Kind of obvious, but also something that most doctors don't seem to check. When you look up the symptoms of various vitamin deficiencies they have wide spread and hard to pinpoint symptoms - including random neuropathy. I feel like it might be wise to for doctors to suggest to patients they see a nutritionist or to check their vitamin levels if the only diagnosis is "psychosomatic". At the very least the person might end up generally healthier after the experience.

<comment><USER6> From another post of mine on the link between depression and nutrition:

 _" I'd like to encourage anyone feeling depressed to take a good, hard look at their diet and to consider the possibility that they lack some essential nutrients.

I'm not saying that a poor diet or lack of nutrients will necessarily be the only or even the main cause of depression, but these factors could have an impact (sometimes a profound impact) on the severity or frequency of depression.

For most of my life I've had a pretty poor diet, and while I knew diet could affect one's mood, I really didn't realize how profound an effect it could have until poor health recently forced me to make drastic changes in my diet and to consider and study the potential effects of diet on mental and physical health.

What I learned was that many, many nutrient deficiencies could have very severe consequences on one's mental (not to mention physical) health -- including depression, dementia, and even death. Symptoms of a nutrient deficiency are not always obvious, and some of them take a long time to manifest -- so long that they kind of sneak up on you and you could almost feel like what you're experiencing is "normal" or just the way you are (ie. depressed, just because you have a negative outlook on life).

Once I improved my diet and started taking supplements for essential nutrients which my diet still lacked, I felt so much better, and have had much more energy than I'm used to, don't need as much sleep, and my mood and motivation have dramatically improved.

I now firmly believe that many people who suffer mental issues, including depression, may be malnourished or nutritionally deficient in some way. Taking one's diet seriously, reading up on it, and improving it could really change your life."_

<comment><USER7> I couldn't agree more! I have always been prone to severe depressive episodes, at a frequency of around once a week. It got really debilitating and was destroying my quality of life.

I noticed my depression seemed to correlate with my poor digestive health -- chronic constipation and frequent food poisoning. Once I started supplementing probiotics and eating a small amount of kimchi or kraut every day, my depressive episode frequency reduced to only once every few months (and my digestive symptoms disappeared).

There's a strong link between your gut and your brain.

This is anecdotal, but changing my diet changed my life for the better.

</comment></comment></comment><comment><USER6> _" They are medical disorders like no others," O'Sullivan writes. "They obey no rules. They can affect any part of the body…. Almost any symptom we can imagine can become real when we are in distress."_

This description reminds me of Lyme disease, which is known in medicine as "the great imitator" for its ability to present symptoms of so many other diseases, and therefore quite often be misdiagnosed as something else.

</comment><comment><USER8> I went to my doctor a decade ago for sleeping problems. He didn't take me seriously. It wasn't until a random chance orthodontics evaluation that I learned I had sleep apnea.

That was exactly what I wanted my doctor to diagnose. If he had asked the basic questions about sleep apnea, (which I didn't know about,) then I would have been treated much sooner.

<comment><USER9> Seconded on checking for sleep apnea. I'd wake up every night after approx. 4 hours with severe sweating, palpitations, tingling and numbness in hands and feet, acid taste in mouth, disorientation.

I was tested for everything under the sun. EKG, stress test, echocardiogram, blood workup, blood sugar monitoring (diabetes?), Holter monitor, xrays, .. on and on. They showed nothing. Several of the doctors tried to gently broach the idea of "stress" perhaps being the cause. But as far as I can tell I'm mentally healthy and a low stress guy.

I went through years of doing my own "research". I suspected everything from heart valve infection, to kidney disease, to lyme, sleep apnea, to some exotic virus. 8 years of nightly misery and soaked sheets.

I suggested apnea to the doctors several times but it was waved off because I'm thin.

I even had an ENT specialist put a camera down my nose looking for something "structural". Nothing.

And yet, after getting a CPAP my symptoms have all but disappeared. WTF? I felt my doctors were caring and competent. How did they blow this so badly?

</comment></comment><comment><USER10> I have had a pain in my left side for over 4 years now. Its a mix of sharp from my shoulder to my wrist as well as a dulling pain when things calm down. I think it is related to budging disk issues, but who knows because doctors don't do anything. Every doctor has given me some vague explanation and threw medicine my way. I got a medication that is used to treat epilepsy based on a vague diagnosis.

Over the past 4 years I have gone insane. I have to essentially be my own doctor because no one is willing to help me. Like the guy in the article, I too have freaked out thinking it was cancer and probably spread very far.

I gave up on figuring it out. I absolutely despise doctors with a passion, so much so that I would gladly accept cancer and death into my life than have to deal with doctors. However, before death, I demand that med school gives me an MD since I have to do everything myself anyways.

<comment><USER11> If you think it may be along the lines of the article and don't have a resource, I'd recommend Dr. Sarno's A Divided Mind. I had two bouts of knife- jabbing back pain (couldn't walk down a hall without holding the wall) twice, a year apart. While I think the way Dr. Sarno approaches the subject has too much hand waiving, approaching it through the psychosomatic lens gave me better results than anything else I tried, and I haven't had a recurrence for the last few years.

Had another friend with similar back issues who was told it was his disks from some 'top' doctors and he had similar results as me.

<comment><USER10> Awesome, I will check it out. Thanks!

</comment></comment></comment><comment><USER12> The other thing is: medicine assumes you are a white male. If you are not, you're some sort of freak they don't know what to do with. A lot of "it's all in your head" illnesses are strongly typed female. It's a serious problem.

<comment><USER13> Do you have any citation for that? I'm pretty sure doctors are trained to look after different races and both genders. Looking after women's specific biology is its own entire field.

<comment><USER11> It's a real thing. Freakonomics talked about it in one of their recent podcasts. Basically, clinical trials often exclude or under sample women for a number of reasons including the confounding factors of menstrual cycles, pregnancy complications, etc. This has received increasing attention lately and is getting better, but a ton of the current scientific wisdom is based on underrepresentative samples.

[http://freakonomics.com/podcast/bad-medicine-part-2-drug- tri...](http://freakonomics.com/podcast/bad-medicine-part-2-drug-trials-and- tribulations/)

<comment><USER13> I can understand it for drug trials. If men are more "homogeneous" and don't create additional parameters with which you have to consider, then for trialing it would make sense.

Race wouldn't really play a part here I don't think unless a medicine happened to effect a race differently (e.g. African people often have sickle-cell anemia, so you do have to consider race sometimes as well).

But the user above actually said something differently, in that people are treated differently. Like I said, doctors are trained to treat everybody regardless of race/ gender. Clinical trials based on variables of participants, and the general treatment of individuals is completely different.

<comment><USER12> I'm talking about how it works in practice. Ask someone in one of the targeted groups what it's like with getting their problems taken seriously.</comment></comment></comment></comment></comment>


Unlocking the iPhone: Inside the Government's War with Apple - <AUTHOR> https://www.fastcompany.com/90453437/inside-the-10-million-cyber-lab-trying-to-break-apples-iphone <comment><USER2> From the article: ... Vance is skeptical that Apple doesn't have a secret backdoor. "They get into my phone all the time because they upgrade my operating systems and they send me messages," he says.

I do not expect the Manhattan DA to have more than a superficial understanding of technology, but after a statement like that it is fair to expect him to be corrected, educated, and the article to call out "that's not how any of this works"</comment>


Improving Parser Performance Using SSE Instructions - <AUTHOR> http://blog.kazuhooku.com/2014/12/improving-parser-performance-using-sse.html

<comment><USER2> Using SSE4.2 or more is trivial. Same goes for fast hashes with the crc32 intrinsic. Mostly the compiler does it for you (-march=native)

But you cannot assume everybody has such a CPU. Hence you'd either need to compile your own (a la macports, gentoo, perl, ...) or do run-time checks for the CPU feature and switch to the fast version then.

</comment><comment><USER3> I wonder if there is any HTML parsers that use SSE4.2 instructions

<comment><USER4> IIRC Servo is using html5ever for HTML parsing, which (at least in one branch) uses SSE4.2 for parsing.

</comment></comment><comment><USER5> It's an interesting idea, but I found this blog post unenlightening. Does anyone have links to other writeups?

</comment><comment><USER6> clang does a very similar thing in the preprocessor (looking for new lines if my memory serves correctly).

</comment><comment><USER7> can http parsing be done on a GPU?

<comment><USER8> Maybe, but the transfer time to/from the gpu is probably going to kill any gains you might get.</comment></comment>


Why We Should Stop Using Bower – And How to Do It - <AUTHOR> http://gofore.com/ohjelmistokehitys/stop-using-bower/

<comment><USER2> I've been mostly happy with the switch from Bower to JSPM. I like SystemJS and the use of ES2015 modules and transpilation support over CommonJS.</comment>


Invest in startups that pitched at YC Demo Day - <AUTHOR> https://wefunder.com/?demoday

<comment><USER2> If I'm reading things correctly, people who don't qualify as an accredited investor (or prefer not to state) are unable to invest until sometime in this Summer 2013 when the SEC enacts Title III of the JOBS Act.

Is this correct?

<comment><AUTHOR> That is correct. The SEC was told by Congress to implement the entire JOBS Act in January 2013, but they are behind schedule.

<comment><USER2> Thanks! I think it's just brilliant how wefunder is executing on a fundamental market change (by legislation) so quickly. I remember reading about the JOBS Act, but at the time, I really didn't grap what it meant. You did. Had things gone as dictated by Congress, your currently great situation would be even better.

</comment></comment></comment><comment><USER3> A startup for crowd-vesting in startups...

Am I the only one that sees this as some kind of signal that the capital markets are hopelessly fubar'd? That perhaps the dollar is turning to garbage faster than we'd like to admit if everyone's lining up to throw thousands after bad ideas in the hopes they'll strike it rich?

Is this really a good thing? Or maybe I'm being far too cynical here and crowd-funding is really the road to salvation? I don't like Wall-Street controlling capital any more than the next guy...

<comment><AUTHOR> We plan to have quality over quantity, so I prefer to see it as democratizing access to investment opportunities. Previously, only the rich even heard about the best investments. We think all Americans should have the opportunity to invest in innovation... as soon as the SEC implements the JOBS Act.

</comment></comment><comment><USER4> I'm all for "crowdfunding" startups, but I don't like the way that WeFunder is going about it in my case.

I went through their questionnaire and found out I'm not allowed to invest - fair enough, the rules will get fixed eventually. Then today, I got an email today to say "We have this great investment opportunity! Oh, by the way, screw you because you're not accredited."

Until the rules change, don't bother emailing me. Until then it's just a tease, and a little insulting at the same time.

<comment><AUTHOR> That's my bad. I should have segmented the list to exclude people who were certified as unaccredited. I forgot to do that in the rush of things. I'm sorry for the tease!

</comment></comment><comment><USER5> What's the difference between wefunder and Funders Club?

</comment><comment><USER6> Are there any sites that aren't waiting for the SEC to let unaccredited investors invest?

I wonder if there will be a YouTube equivalent in this space: a company that turns a blind eye to unaccredited investors participating, and as a result captures a huge lead in the market. IIRC user submitted illegal content was an early driver of a lot of traffic to YouTube.

<comment><USER7> " a company that turns a blind eye to unaccredited investors participating, and as a result captures a huge lead in the market."

There's a profound difference between a copyright violation (for which DMCA gives some cover for the site) and a blatant violation of the securities act of 1933

<comment><USER6> IANAL so have no idea but I would not be surprised if my comparison was apples to oranges.

</comment></comment></comment><comment><USER8> Hmm, Wevorce raises some questions. I don't know if their disclaimer about how they are not really a law firm would pass muster. If they are providing legal services, they can't raise funds from non-lawyers.

</comment><comment><USER9> This is going to be such a powerful tool in the future. Any investors who sleep on this are going to miss out because whoever wins this space will be a public company, hands down.

</comment><comment><USER10> I really like this. However, I don't see anything regarding the terms and valuation which I would invest at. How can one responsibly invest without know what my $1000 actually gets me?

If the process is that the valuation will be set once funds are raised and I will have the option to back out at that point - then this needs to be spelled out. Some clarity here is needed.

<comment><AUTHOR> You're right; we should do a better job of communicating this. Right now, you have to click on the invest button to see the terms, and to further complicate things, many of the startups use the YC VC Fund Note, which delays the setting of the valuation.

</comment></comment><comment><USER11> _Ramen profitable since Oct 2012_

That's an odd bullet point. "We make barely enough money and we've been doing it for 5 months!"

</comment><comment><USER12> I find it interesting that they didn't go to great lengths to hide the identities of the "mystery" companies.

<comment><USER13> Cofounder here. We hide the identities of the companies for regulatory purposes (complying with current general solicitation rules). We can talk about general things, and if you do some light research you can probably figure out who's raising. But we don't blatantly say "Company X is Raising Money".

<comment><USER14> In that case, I think it's ok if I share that the companies raising are:

Microryza, Goldbely, Zenefits and Strikingly - with Wevorce listed at the top of the page but it says they are 'not currently fundraising'.

Conspicuously absent: wefunder ><

(if I misinterpreted your post, sorry! and I'd be happy to delete this)</comment></comment></comment>


Short-Term Memory and Web Usability - <AUTHOR> http://www.useit.com/alertbox/short-term-memory.html

<comment><AUTHOR> The best UI talk I ever attended was by a psychologist talking about memory. We got to the end and I realized he never talked about computers the whole time, even though it was at a UI conference.</comment>


Why It's Pointless to Debate Which Language is the best - <AUTHOR> http://lostintangent.com/2010/01/22/the-current-state-of-the-web-why-its-pointless-to-debate-which-language-framework-or-architecture-is-the-best

<comment><USER2> Yes, it is pointless, because there is no 'best'.

Just like I have 5 different hammers in my toolbox (Estwing, benchhammer, rubber hammer, plastic head and lead shot filled) I have a whole bunch of languages in my toolbox too.

Picking one is based on what I intend to do with the resulting product, familiarity and the speed with which I wish to get my result. If it is code that will run in production for many years I will pick another language than if it is a quick-and-dirty I need the answer now type thing.

 _Every_ language, your favorite too, has its pros and cons.

If there were a single, perfect language I do not doubt that it would overrun the world of programming in the time it would take to spread the news.

But languages are trade-offs. Space, speed, readability, maintainability, expressiveness. All of those (and probably more) can be changed enough to give a spectrum of possibilities, and with enough spacing between those in the various dimensions you end up with a large number of viable languages.

And that's good. A lisp programmer will solve something in a completely different way from a C programmer or a prolog programmer. There is absolutely nothing wrong with that.

In the end all that matters is that your solution produces correct results (and not just in the logical sense of 'correct', also correct for all the other parameters).

As long as it performs well for you everything else is premature optimization ;)

Incidentally, I put out a little challenge on this exact subject:

<http://news.ycombinator.com/item?id=1073333>

<comment><USER3> Sorry to derail, but it's going to bug me all day if I don't ask.

What do you use a lead-shot-filled hammer for?

<comment><USER2> It's a recoil free hammer.

<http://en.wikipedia.org/wiki/Dead_blow_hammer>

<comment><USER3> Thank you :-)

</comment></comment></comment></comment><comment><USER4> But its not pointless to debate which are _better_ (for a given task).

I personally have five or six languages which I use often, depending on what I'm doing. Ok, some of these I use only because I have to, but others I use purely because they suit a certain class of task.

The great thing about platforms like JVM and .NET is that I can use these different languages together in a single project :-) so each module can be written in the language that suits its task best. I don't _completely_ do this yet, but perhaps in the near future.

</comment><comment><USER5> I don't think its pointless to debate which language is best, or that it is not interesting anymore. I still find it interesting.

But more than that, I think it really doesn't have anything to do with labeling yourself a 'java developer' or 'rails developer'.

When programmers add titles like that, it usually means (or should mean) they have a lot of specific expertise on a particular language/framework. And of course this knowledge is not easily transferable from one technology to the other as one might think.

If you have a shop with ASP MVC product and are looking for a hire, you could hire a 'rails dev' or even a 'struts dev', but that won't be the same as hiring an 'ASP MVC dev' or even any programmer 'like a systems programmer' or 'firmware programmer' to fit the bill.

Of course they can all program, but those are very different beasts and the title makes a difference. The title helps you get a programmer with an experience and knowledge set which is more closely aligned with what you need.

</comment><comment><USER6> Debating which language was best is how I learned to program better, notice flaws easier, and simply argue my case more efficiently.

<comment><USER2> But for such a debate to be meaningful you need context.

Without context (application, and all the other requirements) it is just so much hot air.

<comment><USER6> You don't think that's a learning experience either?

People in the tech, and geek community, are stubborn mother fuckers. You have to have a _badass_ debate skill to get even the most obvious ideas into people's heads. Simply being right doesn't mean a damn thing.

Programming Arguments are one of the best places to get these sort of skills. Not only are you trying to convince the unconvincable, you're trying to appeal to the crowd.

<comment><USER7> Oh please, I don't buy that argument because I have seen too many language arguments devolve into Emacs/Vi pro/anti wars.

The people loving language wars are generally trolls, which carefully craft "arguments" that infuriate people while being wrong in a way that needs long expositions to answer.

I _do_ expect better than that type of garbage from HN.

Edit: I do buy jacquesm's argument about pro and cons for languages; the fit with different problem spaces are different for different paradigms, etc.

For example, I'm personally going back to functional programming now, hoping for a new dawn in the coming mass-multicore world. But I'm not going to do any lisp language wars, since that is as useful as Emacs/Vi "debates".

Edit 2: If someone really think to learn something from language wars, why not just Google for a few? There are lots of them to review, on lots of web sites.

<comment><USER6> You look at me and say "troll", I look at you and say "delusional."

<comment><USER7> I didn't call you troll, just that trolls argue similar positions.

>>You look at me and say "troll", I look at you and say "delusional."

But that comment was quite trollish in just dismissing an argument with a one word insult. Good bye.

<comment><USER6> I know you didn't call me troll. If you read very carefully (And it's clear you didn't) I never suggested you called _me_ troll.

 _post script_ It's 'goodbye'

 _post post script_ My net out of this conversation was +11

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> It seems to me that the author is ignoring the relationship between experience and expertise in a language. Programmers call themselves _[language/framework] developers_ because they've invested a lot of time becoming proficient in that language/framework. Of course there's some skills transference when you pick up another language, but they're not commodities and they're certainly not entirely fungible.

</comment><comment><USER9> I think the Zen Buddhists have it. Most of the thoughts we have are centred around avoiding having to deal with what is right in front of us. In otherwords we are constantly shirking things. The good news is that everythig one is inclined to shirk is an opportunity to develop character by simply doing it and sticking at it until it is done. The Zen Buddhists also repeatedly refer to judging things as good or bad or "picking and choosing this vs that" as the primary shirk mechanism. In my case this is definitely true. Lets face it. Conceptually CS or programming is a very limited domain (compared to something like, say physics, or even electrical engineering). I used to program in C++ all the time. What have I picked up since then in working with/reading about other languanges? I mean what have I picked up that fundamentally/conceptually new? Nothing. (The functional stuff certainly does not introduce any new concept. Objects/interfaces are first class collections of functions) So bottom line is that if I am honest, experimenting with/reading about other languages has been a net loss for me. The only reason I do it is literally because its a form of shopping as in "Modelling real world problems is hard, let's go shopping"

</comment><comment><USER10> I've been working for about 5 years now. I've been teaching myself programming for the last 10 years. Since that time, I've always assumed a position of lacking knowledge, always assuming that others knew more than me. In the last year or so, I've realized that that last assumption is often false. I still assume I don't know enough, because nobody ever could, but I realize that, because nobody else does either, what they have to say that does not jibe with my own experiences doesn't hold a lot of water.

</comment><comment><USER11> I'm not so sure that simply having a grasp of the core underlying paradigms in a given polyglot scenario is really enough to say that you can therefore take your well undestood abstractions and apply them to any other language.

For example; I just spent the afternoon trying to pick up Scala / Lift by way of checking out the open source code to Apache Esme project, I must admit that I'm a little baffled at this stage, I can see tantalising glimpses of familiarity here and there within the framework, but compared to my prior experience in PHP / Django / Ruby on Rails / Grails I can tell this is going to be quite a paradigm shift. Wondering if maybe I should've started on something small and less complex first rather than diving in on Esme.

Time will tell I guess.</comment>


Why some people just won't stay at home - <AUTHOR> https://www.cnn.com/2020/03/24/health/social-distancing-wellness-trnd/index.html <comment><USER2> Maybe they looked at the advice, looked at the numbers and decided that it's worth taking the risk. Isn't that what personal freedom is about?

<comment><AUTHOR> The thing is this is not a just a personal risk. Maybe other people who have no choice but to be outside because of their work or st else don't want to take that risk but this risk is being forced on them. Isn't it our responsibility not to increase the risk on their lives if we can stay at home?

<comment><USER2> Can't you justify banning drinking (think of the children!), driving (you might run someone over!), or pretty-much anything you like using the same argument?</comment></comment></comment>


Help.imgur.com HTTPS invalid certificate - <AUTHOR>

I wanted to send a UI improvement to the devs. So I clicked the hamburger menu, then "need help". This page isn't loading for me: https://help.imgur.com/hc/en-us<p>Was this untested bad configuration or is imgur compromised? <comment><USER2> It looks like their help site is a skinned version of zendesk and imgur hasn't given them a cert to host instead of serving their default *.zendesk.com cert. Not compromised, just not intended to be used over https.</comment>


Is Quora Driving Away All Its Best Users? - <AUTHOR>

There appears to be a mass exodus of all the best members of late. Anyone know what's happening? <comment><USER2> Some of my posts were flagged by the admin saying I was promoting my website even though the answers were relevant and the answers were voted up by other users

</comment><comment><AUTHOR> Apparently a lot of it is forced via banning.

<comment><USER3> That sounds a little counter-intuitive. Do you have a reference?

<comment><AUTHOR> Just observation of the fact that many of their better posters have either willing left or were banned.</comment></comment></comment>


Show HN: The missing Rails pattern generator - <AUTHOR> https://github.com/sungwoncho/pattern_generator

<comment><AUTHOR> When working on Rails applications, I found myself creating files and tests manually by navigating the directory tree, and typing in names.

I didn't like it because:

1) Typos can happen 2) Navigating the directories is pain 3) lazy

Here is my solution. With this gem you can run `rails generate [PATTERN_TYPE] ...` to generate files and its tests in appropriate directories.

Currently you can generate service, policy, and PORO.</comment>


Ask HN: Feedback for my Pomodoro App - <AUTHOR>

Hi,
I recently created a Pomodoro Timer app while playing around with jQuery (I'm a newb as far as front end libraries are concerned). I was wondering if people could give it a whirl and post feedback if any.
It's at http://www.tomato-timer.com
I might add in some more features like chained timers, time stamps + counter for elapsed periods, etc. this weekend.
Thanks. <comment><AUTHOR> clickable link: <http://www.tomato-timer.com></comment>


Reading a VGA monitor's configuration data with I2C and a PocketBeagle - <AUTHOR> http://www.righto.com/2018/03/reading-vga-monitors-configuration-data.html <comment><USER2> If you have HDMI, the EDID comes through on the DDC which is just I2C. You can read it with a BusPirate or any decent LA: [https://www.extron.com/company/article.aspx?id=uedid](https://www.extron.com/company/article.aspx?id=uedid)

HDCP also happens over this interface, so it's trivial to snoop on the key exchange: [https://github.com/ApertureLabsLtd/hdmi- sniff/blob/master/RE...](https://github.com/ApertureLabsLtd/hdmi- sniff/blob/master/README.md)

CEC (control devices via HDMI) happens on a separate channel using a proto also similar to I2C: [http://www.quantumdata.com/pdf/CEC_White_Paper.pdf](http://www.quantumdata.com/pdf/CEC_White_Paper.pdf)

There are a few good ~cheap CEC adapters for HDMI out there. I've used the PulseEight one since they have decent library support plus a CLI. You can also use the HDMI port on a Raspberry Pi to play with CEC: [https://github.com/Pulse- Eight/libcec/blob/master/docs/READM...](https://github.com/Pulse- Eight/libcec/blob/master/docs/README.raspberrypi.md)

</comment><comment><USER3> I came across a monitor with an EDID that was out of the spec for what constitutes a valid EDID, and it actually exposed a bug in the linux i915 driver, I had all this corrupted output.

While the patch was getting merged, I was able to dump the EDID, edit it to be within spec, and then was able to actually flash it BACK to the monitor by using nothing other than this program on github [1], and the HDMI port on a Dell E6430.

I was amazed that was possible to write an EDID from simply connecting to the port, didn't need to open anything up, was able to do it without any special equipment, etc.. I never realized how complicated some of these display protocols can be, but part of it is just i2c, and I guess the hardware is not very restrictive on how that i2c controller can be used outside of display purposes.

Someone with a Raspberry Pi could go around a college campus and wreak havoc if they wanted. Goes to show you that you should not trust _any_ public peripheral, _not ever_. That's especially important in the age of USB-C and mobile devices where charging and data are put on the same port.

[1]: [https://github.com/bulletmark/edid- rw](https://github.com/bulletmark/edid-rw)

<comment><USER4> Oh it's so much worse than that. The EDID is typically implemented with an I2C EEPROM connected directly to the AUX lines. The "edid read" procedure is no more than reading "0xA0", the standard EEPROM I2C address, over AUX. The first time I ever sniffed that bus and saw a simple "read" command to that address I'd seen in so many other places before I almost fell off my chair.

</comment></comment><comment><USER5> Speaking of DDC, this little utillity is really handy for changing the brightness of third party monitors on macOS: [https://github.com/kfix/ddcctl](https://github.com/kfix/ddcctl)

There are probably more fancy things out there that integrate via .prefpane or something, but works good enough for me.

<comment><USER6> The equivalent for Linux users are ddccontrol and ddcutil.

[https://github.com/ddccontrol/ddccontrol](https://github.com/ddccontrol/ddccontrol)

[https://github.com/rockowitz/ddcutil](https://github.com/rockowitz/ddcutil)

</comment></comment><comment><USER7> You can also use the Debian package i2c-tools to communicate with things connected to the busses on your computer.

I once used it to play with a set of Melexis IR sensors I'd soldered to the VGA port on a crap video card. It made writing the Arduino code way easier after figuring out all the hard things with Linux. There was even enough power on the VGA pin to run 4 of them!

Really though, it was just exciting to be able to wire some of my own hardware into the computer and write a program to talk to it. Made me feel like I actually own my computer again.

</comment><comment><USER8> Author cited a Wiki page as technical reference. Worth noting that VESA has made the EDID standard--including errata and other relevant standards--readily accessible to the general public[1]. Now if only they'd do the same for the latest revision of DisplayPort...

[1] [https://www.vesa.org/vesa-standards/](https://www.vesa.org/vesa- standards/)

Asks for name, country, and e-mail address, but otherwise immediately redirects to downloadable content directory.

</comment><comment><USER9> On most linux systems, "read-edid" or "get-edid" will give you this information.

<comment><USER10> Yes, plugging the monitor into a Linux box would have be easier. In my case the edid is exposed under /sys, and edid-decode is from the xorg-x11-utils Fedora package

$ edid-decode < /sys/devices/pci0000:00/0000:00:03.0/0000:0f:00.0/drm/card0/card0-HDMI-A-1/edid

Extracted contents:

header: 00 ff ff ff ff ff ff 00

serial number: 00 b3 00 37 00 00 00 00 01 19

... [ followed by more data and the decoded output ] ...

<comment><USER11> > plugging the monitor into a Linux box would have be easier

As JFK said, we do these things not because they are easy, but because they are hard :-)

<comment><USER10> Even on Linux things don't always work as intended. The reason I am familiar with the EDID information is that my display stopped working after a kernel update and I tried to figure out why. It turned out that my AV receiver didn't like the VIC field being sent in the HDMI infoframes[1]. There is a surprising amount of communication which goes on between the graphics card and the monitor in a modern system.

1: Bug 50371 - [BISECTED] HDMI display blank unless VIC set in AVI infoframe

[https://bugzilla.kernel.org/show_bug.cgi?id=50371](https://bugzilla.kernel.org/show_bug.cgi?id=50371)

</comment></comment></comment></comment><comment><USER12> I2C is a really beautiful protocol, and it shows up all kinds of interesting places - I had no ideal that monitors used it for EDID!

<comment><USER13> I use it in my personal projects a lot, it's very easy to code up an i2c master and/or slave on pretty much any microcontroller. Very handy for abstracting different sensors or actuators by hiding them behind a microcontroller that bridges them to a common i2c bus. Not to mention that boat loads of sensors use the protocol directly. SPI is even simpler, but it requires more wires and also is lower level (SPI is basically just a fancy shift register) so it usually ends up taking more boilerplate.

</comment></comment><comment><USER14> >To read the data over I2C, I used the PocketBeagle, a tiny Linux computer that I had handy. (You could use a different system that supports I2C, such as the Raspberry Pi, Beaglebone or Arduino.)

I keep hearing that the Raspberry Pi's peripheral support for things like I2C is pretty bad - is that no longer the case?

It's a pretty easy interface to bit-bang and not too sensitive to the clock line's precision, but it's nice when you can actually use a chip's hardware peripheral as intended.

<comment><USER10> Perhaps you are thinking of the I2C clock stretching bug[1]?

Bugs like these are not unusual in embedded systems. It is often difficult to fix the hardware and the software will implement some kind of workaround. The web page lists several possible workarounds for this bug.

1: [http://www.advamation.com/knowhow/raspberrypi/rpi-i2c-bug.ht...](http://www.advamation.com/knowhow/raspberrypi/rpi-i2c-bug.html)

</comment></comment><comment><USER15> Something satisfying about talking/listening to hardware.

Seems somehow more "real".

Should have gone into writing drivers but that always seemed so damned tedious. ;/

</comment><comment><USER16> This would be a cool FPGA project as most boards include an FPGA port.

</comment><comment><USER17> This is awesome! I have to try this.

</comment><comment><USER18> Cutting a cable and going through all this effort is stupid when you can probably get the data using your graphics card.</comment>