Dear Facebook, It Could Really Be This Simple - <AUTHOR> http://m.techcrunch.com/2012/08/02/zucks-karmas-bitch/?icid=tc_home_art& <comment><AUTHOR> Sorry posted the mobile URL by accident. Desktop URL is [http://techcrunch.com/2012/08/02/zucks-karmas- bitch/?icid=tc...](http://techcrunch.com/2012/08/02/zucks-karmas- bitch/?icid=tc_home_art&#038); .</comment>


Aviary launches Music Creator - <AUTHOR> http://aviary.com/blog/posts/online-music-creator <comment><USER2> This is fun, but you're stuck making simple loops. If you could actually start multitracking and lay out a full song, it'd be awesome. For now, I think I'll stick with FL Studio :)

</comment><comment><USER3> Is it just me or do some of birds look like pokemon. The blue one looks like articuno and the red one looks like moltres.</comment>


Peekr: Free Security Scanner for Container Images - <AUTHOR> https://peekr.scalock.com/ <comment><AUTHOR> Disclosure: I work for Scalock, the company behind Peekr.

<comment><USER2> How does Peekr work, in a technical sense?

<comment><AUTHOR> Peekr downloads the image you select (container:tag), opens it up and scans it to find known vulnerabilities (from a database of millions of vulnerabilities), then runs the container in isolation trying to detect any behaviour which can be considered malicious or dangerous, such as fork bombing for example.</comment></comment></comment>


How to Become a Pure Mathematician (or Statistician) - <AUTHOR> http://hbpms.blogspot.com/ <comment><USER2> (2008-2012)</comment>


Ask HN: Why so much hate towards Microsoft-Nokia deal? - <AUTHOR> Ever since the deal between Microsoft and Nokia was announced, everyone everywhere has done nothing but slate them and already pronounced the death of Nokia for agreeing to work with Microsoft. The question is: why? is it really that obvious and I'm overlooking the failure in the not so distant future?!<p>Is it still fashionable to hate Microsoft without analyzing the big picture from the POV of Nokia? Is it because it seems like an illicit move by Elon to sign up with his ex-employer? Or is it a manifestation of iOS/Android fanboyism? <comment><USER2> Here's one take:

Look at Samsung, LG, and HTC. All of them are making both Windows Phone 7 devices and Android ones; if Windows Phone 7 takes off, they're in the race, but if it doesn't, they'll have other stuff that's working for them.

Now look at Nokia. The difference isn't what Nokia _will_ be doing --- making Windows Phone 7 devices; it's what they _won't_ be doing --- making Android phones. They've taken a big, risky bet, which they could have hedged, and haven't. And the platform they've bet on is one which allows manufacturers _less_ freedom to customize and differentiate themselves than the one they've shunned. Heck, if they just shipped stock Android, _that_ would differentiate them from most of the phones on the market. (Contrast to Windows Phone 7, where Microsoft is being very restrictive in what manufacturers can dink. Nokia may get more freedom than some as part of this deal, but not nearly as much as the HTC Sense experience for Android.) And you could try to say that they don't have resources to handle multiple platforms --- but if that's the issue, why are they still talking about shipping Maemo?

In short, this is still different from what other manufacturers are doing, but based on the announced terms of the deal, it's not really clear why it's better, and it is pretty clear why it might be worse. There might be unannounced terms of the deal that change that calculus, but for now, people can only judge from what they can see.

</comment><comment><USER3> Lots of Apple/iOS fans. Lots of Android/'open' fans. Lots of europhiles unhappy to see their continental champion cede platform leadership to Redmond, WA, USA. Lots of plain old MSFT-hate. A perfect storm of armchair antipathy!

<comment><USER4> Also people who like nokia. I think wp7 is a great and original UI. I think the phones will be cool. but this turns nokia into another LG. It also throws away a really decent OS in the form a maemo, which due to nokias symbian addiction was never given the proper place it should be.

</comment></comment><comment><USER5> I think a lot of it is indeed "M$ bad herp derp" - I've seen about 30 separate comments all making variations on the burning platform/sinking ship would-be witticism, which is clearly not justified if you take an objective look at MSFT since Vista.

Personally, I'm pleased by the news. I want WP7 to be competitive - that can only help consumers.

</comment><comment><USER6> Those that ignore history are doomed to repeat it.

I can't think of a single high profile company that has done well out of a deal with Microsoft. However the the road through computing history is littered with the burnt out wrecks of companies that did do deals with Microsoft.

<comment><USER3> Intel and Microsoft had a pretty good run. Also Microsoft and Dell.

Microsoft's 1997 investment of $150 million and firm recommitment to develop for MacOS turned out pretty well for Apple, too!

Those who ignore history, indeed.

</comment></comment><comment><USER7> Well, the thing is (my own opinion though, so I could be wrong) Nokia has invested in the past a lot of their time and money on their developers and on creating a great platform for them. The had the Symbian OS which was very popular as far as smart phones go, and they had more recently acquired QT, which played nicely with the Symbian OS.

Now, it's worthy to note, that the smartphone market today and the one before are quite different. Smartphones were way more expensive, and development for them wasn't quite as easy. However, those that invested in having one, and in developing for them found a great deep appreciation for their phones. These smartphones had no restrictions whatever. You bought it, you own it. If you can compile something that runs on it, go ahead! This is something that fans of the Symbian OS praised, and followed them religiously because of it. So, although Nokia's platform took a lot longer to spread in fame than say iOS, they had existed for so long that they had built quite a large following of dedicated and loyal users/developers. So loyal that even though their smartphones are quite a bit more expensive than the competitors, they still believe (and probably rightfully so) that the investment is worth it.

How did Nokia achieve all this? Again, they invested a lot of money and resources on it. Nokia is a huge company. As a result, they are a huge part of the Finnish economy as well. Their business is based around these investments and the large user base that they have built because of them. Not only that, but they were also in collaboration with other companies in building MeeGo. MeeGo was meant to be a Linux based OS that would bring the gap between PC and cellphones even closer, since it was meant more as a Linux distro (like say Redhat, Ubuntu or Suse) rather than a derivate of Linux (like Android and OpenMoko).

Now, taking all of this into account, they announce that they will be focusing on Windows phones. Their huge user based is feeling betrayed because essentially all the hard work they may have put into the Symbian ecosystem (which I haven't personally experienced, but have heard it has quite a learning curve) will go to waste, the MeeGo platform may not come to full fruition because of conflict of interests, and surely a lot of layoffs are bound to happen since it seems they are going to let the majority of their software division die out. Not only that, but they had always been pro open source and open platforms, and they are now announcing the will probably go with the company that many see as a rival to these ideals. Is the user base biased against Microsoft? Probably, but that isn't it either. I'm almost certain had they announced that they were going with Android, there still would have been a major backlash. Maybe less so of one because Android is an open platform, perhaps facilitating porting efforts and the move to another OS, but I'm almost certain there still would be a lot of people in uproar.

In conclusion, I think the problem here isn't that Nokia is investing in Microsoft. Thats not it at all. Its that its not investing in itself and its loyal user base. Thats what seems to be the problem....at least from what I can interpret.

</comment><comment><USER8> Nokia keeps on changing their strategies.</comment>


The millennial generation: Young, gifted and held back - <AUTHOR> http://www.economist.com/news/leaders/21688856-worlds-young-are-oppressed-minority-unleash-them-young-gifted-and-held-back <comment><USER2> I suspect this could be true. A lot of my friends from Princeton and Upenn still don't have jobs, and its been a few years. The ones that did well were engineering and finance degrees, and even then most were looking for jobs from around 3 months to a year.

I've also noticed their parents seem more desperate to support their families, some taking part-time jobs post retirement. The most extreme example I can think of is one friend's dad an engineer who couldn't get hired became a barber(in the midwest). It really seems like a bad situation for everyone, like there aren't enough jobs for everyone.

</comment><comment><USER3> Of course, part of this is due to a vicious cycle in regards to voting. More older people vote, so the governments listen more to the older folk. So younger people think that government and politics is 'irrelevant' to them and decide not to vote, so then in turn give the government less reason to listen to them.

Not sure what the solution is here.

<comment><USER4> I believe millennials have only recently overtaken baby boomers as the larger voting demographic.

[http://www.pewresearch.org/fact-tank/2015/01/16/this-year- mi...](http://www.pewresearch.org/fact-tank/2015/01/16/this-year-millennials- will-overtake-baby-boomers/)

The article also seems to miss the student loan problem and how education costs are no longer paid by working a summer job and often take ten years into a career just to pay off.

<comment><USER5> But millennials also have access to a virtually unlimited amount of education for free right in their pocket because of the Internet.

Older generations didn't have that advantage.

College is but one route and only required in a few select licensed fields like medical doctors, patent attorneys, etc.

It amazes me that millennials are still going to college even when the costs are like 10x what it was for our parents. At some point the lost opportunity cost from all that debt outweighs any additional income they could earn from the degree.

You also need to factor in that someone has a 4-5 year head start if they just start working immediately and gain education in the field.

If you go the college route, there is 4 years, and another 4 years to pay off the debt. Contrast that to someone who works for a lower wage but can get into a home earlier. A home in Silicon Valley at $500K and 4% appreciation for 8 years comes out to $684 or $184K ahead than the college graduate who is now making maybe $15K more a year.

Also, someone with 4 years of actual work experience is not going to be that far off from someone with a college degree and no work experience.

After 10-15 years of working in a field nobody cares whether you have a degree or not and any income differences from college are now outweighed by personal talent and ambition.

<comment><USER6> A significant number of employers won't even consider a person for an interview unless they have that piece of paper with their degree on it from any given college.

</comment></comment></comment></comment><comment><USER7> Agreed. Various Waterloo and U of T friends here in Ontario are primarily underemployed, unless they move somewhere booming like SV. Lots of late 60s, early 70s people still banking up cash for retirement in technical roles that young people should (ideally) be training for.</comment>


Can We Really Inherit Trauma? - <AUTHOR> https://www.nytimes.com/2018/12/10/health/mind-epigenetics-genes.html <comment><USER2> This sounds like eugenics by another name</comment>


Snowden's Comment on Article About Himself (June 13, 2013) - <AUTHOR> http://www.nakedcapitalism.com/2013/06/top-national-security-experts-spying-program-doesnt-make-us-safer-and-spying-leaks-dont-harm-america.html#comment-1287922

<comment><AUTHOR> Before this became well known ([http://arstechnica.com/civis/viewtopic.php?p=3411014](http://arstechnica.com/civis/viewtopic.php?p=3411014)) this is likely Snowden posting on an article about himself.

</comment><comment><USER2> Likely, but we don't know for sure.</comment>


Something is amiss with the Internet in Asia & North America... - <AUTHOR> http://www.internettrafficreport.com/

<comment><USER2> I don't know about this, almost every router measured the same problem? <http://www.internettrafficreport.com/namerica.htm> Click any of those and you see the same dip. I'm inclined to think it's a problem in collecting the data and not a real issue.</comment>


Ask HN: Geek Attractions in NYC [non-tech] - <AUTHOR>

i'm spending next week (including christmas eve) in NYC with my wife - celebrating christmas and our 1 year anniversary. are there geeky attractions in NYC that would be worth visiting? already have plans for spider man and pee wee's playhouse. i was hoping there was something geeky/nerdy/computer-science-y i could show her.
not exactly your typical HN content/question, but i figure if anyone would know where to visit in NYC it would be you guys (or at least that's my best bet)
thanks in advance... <comment><USER2> Forbidden Planet (<http://www.fpnyc.com/>) is downtown on Broadway.

Whenever I'm in NYC I also like to visit the giant animatronic T-Rex inside the Toys R Us store in Times Square, but that may not be as entertaining to others as it is to me.</comment>


Google releases location data to show if coronavirus lockdowns working - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-google/google-releases-location-data-to-show-if-coronavirus-lockdowns-working-in-131-countries-idUSKBN21L0P7 <comment><USER2> The actual data is here:

[https://www.google.com/covid19/mobility/](https://www.google.com/covid19/mobility/)

(I haven't seen a link on the reuters article)</comment>


Discovering SQLAlchemy Core: the Relational NoSQL API for Python - <AUTHOR> http://stackful-dev.com/discovering-sqlalchemy-core-the-relational-nosql-api-for-python.html <comment><USER2> You didn't provide not even a single reason why we should use NOSQL instead of SQL.

If sqlalchemy is good for you, then you don't need NoSQL database.

Btw, sqlalchemy is awesome.

<comment><USER3> Some NoSQL databases e.g. Cassandra scale better and are easier to manage than some SQL databases e.g. PostgreSQL.

[http://labs.spotify.com/2013/02/25/in-praise-of-boring- techn...](http://labs.spotify.com/2013/02/25/in-praise-of-boring-technology/)

<comment><USER2> you cannot combine sqlalchemy with Cassandra, Cassandra can scale so well because it isn't relational.</comment></comment></comment>


Latest email from MTGox 12/08/2014 - <AUTHOR>

To whom it may concern,
This is a notice related to the bankruptcy proceedings of MTGOX Co., Ltd. (the Tokyo District Court 2014 (fu) no. 3830), which we are sending to you pursuant to the request from the Tokyo District Court.
On July 24, 2014, the Tokyo District Court 20th Civil Division issued an order to change the period for filing proofs of claims and the date for investigation of claims as follows (please refer to the attached file.).
Detailed information for the filing of proofs of claims, including the form of the filing document and the process of the filing will be disclosed through the website of MTGOX Co., Ltd. at a later date. Your patience would be very much appreciated.
(Old Date)
Period for filing proofs of claims:     until November 28, 2014
Date for investigation of claims:       February 25, 2015 10:00am
(New Date)
Period for filing proofs of claims:     until May 29, 2015
Date for investigation of claims:       September 9, 2015 1:30pm
This email address (email@example.com ) is used only for the purpose of sending messages, and we are unable to check and respond to any replies to this email address.
Since we plan to provide the information regarding the filing of proofs of claims and the bankruptcy proceedings by posting it on the website hosted by the bankruptcy trustee (http://www.mtgox.com/ ), please check this website.
Bankrupt MtGox Co., Ltd. Bankruptcy trustee Attorney-at-law Nobuaki Kobayashi
https://www.mtgox.com/img/pdf/20140728_announcement.pdf <comment><AUTHOR> I'm not sure if each individual needs to file a claim, but these are at least the dates that you need to keep in mind.

<comment><USER2> A similar question: In what cases does a claim need to be filed?

<comment><USER3> All creditors of Mt. Gox, including depositors, should file claims. Gox will likely arrange a mass process for depositors and "strongly encourage" the use of it. If you're not a depositor or you have a complex situation you should find a lawyer in Tokyo to walk you through the process, as I expect wheels failing to squeak may not get as greased as they'd like.</comment></comment></comment>


Lessons from Highly Effective Onboarding Experiences - <AUTHOR> https://www.midtype.com/blog/6-lessons-from-highly-effective-onboarding-experiences/ <comment><AUTHOR> My co-founder at Midtype, Neel, wrote this article by looking at onboarding flows of a dozen or so successful companies.

We have picked up a few tips on how to improve our own onboarding process.

What is a good onboarding that you experienced recently?</comment>


Rescale (YC W12) raises $6.4M - <AUTHOR> http://blogs.wsj.com/venturecapital/2015/07/14/rescale-emerges-with-6-4m-to-make-complex-product-design-easier/ <comment><USER2> Congrats! Coincidentally, I was just showing the Rescale website to a colleague of mine, as an example of a platform that we could align with for a uncertainty analysis toolbox that we're developing.

I haven't had the chance to use Rescale yet, but everything I see and read makes it come across as a winner. I think there's a lot of growth in MDO (Multidisciplinary Optimization) for multiple industries and Rescale seems like the perfect platform to leverage integrated, high-fidelity simulation tools.

For instance, Concurrent Engineering (CE) is quite popular in the space industry these days but only really works for preliminary mission design, because of the lack of cohesion of tools during later phases. I think that Rescale has the potential to extend the idea of CE to detailed design phases too, and that would truly be a game-changer.

Definitely going to keep an eye on their jobs page!

<comment><USER3> Thanks!

You hit it spot on - we are also a big believer in the potential of MDO, and basically built the Rescale platform as the plumbing to make it really easy for engineers and scientists formulate their MDO problems and complex workflows, running across any of the 120+ commercial and open-source packages available on the platform turnkey.

We are working with some exciting customers on detailed design concurrent engineering, MDO, and co-simulation type workflows and processes. Many of these were simply infeasible to run in-house, so a great net new opportunity when you have access to unlimited hardware and software resources.

Great - we are definitely hiring! :)

<comment><USER2> That's awesome! MDO is definitely the way forward, especially in the aerospace sector. Having cloud infrastructure that can scale seamlessly to meet the tooling requirements is a prerequisite to being able to focus on improve the tooling itself I think, so sounds like you're on the right track.

Out of curiosity, do you also sponsor H1-B visas? I seem some jobs listed on your website that peak my interest, but have hesitated about applying because I was unsure if you do.

<comment><USER3> Regarding H1-B it depends on the position and role - but please feel free to send us your info at email@example.com to see if there is a good fit.

</comment></comment></comment></comment><comment><USER4> We've had discussions talking about how cloud industry could learn from supercomputing industry's successes/failures and vice versa. Pretty awesome for me to see a supercomputing-style company with the cloud model. That could've been great for research I did in the past where I needed supercomputer time but it's cost or administrative issues were prohibitive. I expect to see interesting things come out of this.

<comment><USER3> Thanks for your support! We certainly hope to lower the barrier as much as we possibly can for users to get immediate turn-key access to supercompute resources without the need to be a hardware or computer science expert to get things up and running.

</comment></comment><comment><USER5> Using the cloud to make machines that soar through the clouds? Brilliant!</comment>


Memorable SF Characters of the Essential Authors - <AUTHOR> http://www.scifiwright.com/2012/03/memorable-sf-characters-of-the-essential-authors/ <comment><USER2> I think this is a fair critique, if a bit hyperbolic.

One point overlooked is that the predominant form of science fiction was, for some decades, short stories. Salvor Hardin was as richly imagined a character as Bayta Darell, but he only appeared in short stories (or novellas); he was the hero for about half of Foundation. The sequels were novels; the women were accordingly more memorable; and by the way, I found grandaughter more memorable than grandmother anyway.

Another point overlooked is the happy introduction of the vivid, lovable rogue. Nicholas van Rijn is an excellent example, even if by profession he is a tycoon. Lazarus Long is another; I found him a lot more vivid than the article's author evidently did. Fafryd and the Grey Mouser are Exhibits 3A and 3B, although that's fantasy, and even Lord of the Rings had vivid characters, so perhaps the criticism never applied to fantasy at all.

On the other hand -- as much as I adore Zelazny, his heroes are pretty much all the same. They're jaded and cynical, witty in their cynicism, and usually very altruistic even so. Usually they're quasi-immortal demigods too, with the most important counterexample that part probably being the poet in A Rose For Ecclesiastes.

Dune deserves a mention as being fairly early in the genre for having great characterization. Also Ann McCaffrey's Pern books, but those are really fantasies with a thin SF veneer.

Getting more modern yet, I agree that characterization is the norm rather than the exception. My favorite is probably Miles Vorkosigan. I have no idea how that series could win so many Hugos and Nebulas and still seem to be relatively unknown.

<comment><USER3> I've been reading Asimov's short stories recently, and not only are they brilliantly imaginative, they also have unusually vivid characters.

They're not as developed as they would be in a novel, but they're certainly _not_ emotionally flat. In fact they're colourful but economical - just a few choice phrases and snatches of dialogue paint enough of a picture to bring them to life, complete with complex, sometimes hidden or unexpected motivations, and inner conflicts.

They may be of their time, but they're certainly not cardboard.

<comment><USER2> Susan Calvin was certainly an interesting character, now that you mention it. And so were both the partners in the Caves of Steel books. And when I mentioned Salvor Hardin before, I could have mentioned Salvor Hardin as well.

I.e., I agree with you, both on the vividness of the characters and the restrictions on characterization imposed by the short story format.

</comment></comment></comment><comment><USER4> Haven't been up on SF works outside video games. Personally, I think they did a good job with Shepard and Reaper plot on Mass Effect 1. Kind of integrated a lot of themes into the ultimate villain and ability to artificially mitigate the threat of biological evolution. Maybe it was a knock-off of someone but I thought it was clever. Reapers remain my favorite, SF villains. :)

Need to get back into the genre at some point. Anyone got recommendations on especially interesting or innovative works?

<comment><USER5> I don't know if it is especially innovative, but I've gotten a lot of enjoyment out of James A. Corey's Expanse novels lately. Hopefully the SyFy channel doesn't butcher it when they put it on TV.

</comment></comment><comment><USER6> I know Vonnegut was reluctant to embrace the SF author moniker, but surely the characters in Player Piano and Cat's Cradle merit a mention?

</comment><comment><USER7> After all these centuries I still remember R. Daneel Olivaw, I wonder if I ever meet him again.

</comment><comment><USER8> This is an essay by John C. Wright who has written, among other things, regret that he didn't physically assault Terry Pratchett: "I sat and listened to pure evil being uttered in charming accents accentuated by droll witticism, and I did not stand up, and I did not strike the old man who uttered them across the mouth: and when he departed, everyone stood and gave him an ovation, even though he had done nothing in his life aside from entertain their idle afternoons." ([http://www.scifiwright.com/2011/10/the-watchtowers-of- atlant...](http://www.scifiwright.com/2011/10/the-watchtowers-of-atlantis- tremble/) )

<comment><USER9> You miss the context, though. The unnamed writer (presumably Prachett) advocated suicide as something positive and talked an audience member into suicide. All for the sake of feeling better (or, rather, not feeling). For Wright, humans are made in the image of God, and to kill yourself as if you were a horse with a broken leg is a travesty. To advocate doctors killing people, even if they want to be killed, is to treat people in an amoral, atheistic way that destroys civilization. And in the comments, Wright regrets that he did not have the gall to stand up and do something about this evil.

It's a bit like, if you knew what would happen when Jar-Jar proposed giving Palpatine dictatorial power, regretting not actually doing something instead sitting while everyone else pulled civilization down around you.</comment></comment>


The Maddest Hacker – How to Rob an Industry Venture Capitalist [song] - <AUTHOR> https://soundcloud.com/marak/the-maddest-hacker-how-to-rob-an-industry-venture-capitalist <comment><AUTHOR> Lyrics are now up on Genius

[http://genius.com/The-maddest-hacker-how-to-rob-an- industry-...](http://genius.com/The-maddest-hacker-how-to-rob-an-industry- venture-capitalist-lyrics)

[Intro: The Maddest Hacker]

This song is dedicated to Aaron Swartz

A visionary ahead of his time who died

Because of this fucked up industry

(hacker news. i'm posting this to hacker news)

[Verse 1: The Maddest Hacker]

And yo the bottom line is, i'm a hacker with no deal

If you don't sign those papers, i'll rob and steal

You better recognize VCs, i got the drive to succeed

As you sit back and watch your portfolio bleed

Rob Jessica, Paul you want to see her again?

Get your ass down to the nearest A-T-M

I had dreams of applying to YCombinator

But I told Alexis to fuck off ( I'm a hater )

When I apply open-source, son it ain't even funny

I'm about to stick Tim Draper for some of that Bitcoin money

Coinbase? i could take your servers everytime

Have you sweating, asking Mark Karpelès, can I borrow a dime?

Since these Ycomb people seem to all be fam

I'll put my gun to Sam Altman tell him, "Tell your man"

Buttercoin haha, well at least you scammed them, I mean damn

The only excuse for being broke is having no funds

Ya can't run, a company with none

Hack Ripple, but that'd be a waste of time

Centralized currency, its always theirs, not mine

I'd follow Marc Andreessen for four blocks with no reason

Plotting to get Netscape money, yo son stop teasing

What, Oculus sold to Facebook, got 2 billion in bank

You don't want me to knock on your door with metasploit, thanks!

I'll manhandle Zuckerberg like "dope, get on the ground!"

You can't steal from the twins no more, where you gonna get your ideas from now?

I been scheming on Facebook and Google since they found me G

HR don't pull that recruit ( bullshit ) on me

I'm a cracker ( nah not for real son I'm sick )

I'm about to drop a memory stick in the parking lot they'll pick it up quick

Right now I'm venting and when I get like this I don't think

I'll beat Peter Thiel in chess, and make his island sink

Rob Reid Hoff without a gun, grab his laptop and run

Dude weighs 400 pounds, how he gonna catch me son?

[Hook: The Maddest Hacker] x2

This ain't serious

Being broke will make you delirious

So we hack and crack to get something to eat

Marak? how it feel to rob an industry vc?

[Verse 2: The Maddest Hacker]

I'll catch Ashton Kutcher and Sean Parker up in the club

Maybe they'll give me money, if I give them some drugs

I'll run up on Elon Musk with a remote and be like guess whats next?

You give me the cash or I'll crash a space-x

I figured it out, people been hacking Bill Gates before

That's why he don't wanna be an investor no more

My attitude was Steve Ballmer, you could be my new creditor

But all he would say was DEVELOPERS DEVELOPERS

H. D. Moore wanna get down? well you tell homie

But I'm on that solo-founder, I do my sploits all by my lonely

I should hack into Uber, man, their shit did well

I wanted to hack Sam Lessin, but his shit ain't sell

I hit Sand Hill, take VCs' ( laptops ) and leave

Catch Dave McClure, break his glasses so he can't read

Tell Naval give me the Angel list money before I crash your site

Get every syndicate to invest ( allright )

Howard Cox, at Greylock, I would not touch any day

I'd get water-boarded by the CIA

I'm a keep sticking VCs until I'm picked up

Or i'ma hack their systems like i'm 'Marty' Bishop

Ron Conway give 600k to me

I got more influence in the city than Edwin M. Lee

I caught Larry Page riding on his private plane

I told him I wanted it all ( My Markov chain! )

Did you ever think that you would be this rich?

Did you ever think that your portfolio would have these blips?

Did you ever think that I'd hack your line?

And download your shit just like it's mine?

I'ma keep ( redacted ) VCs, its my new hob

Rob Xerox like I'm the new Steve Jobs

Fundersclub? I got a crowd sourced mob

Yo I'm hungry for real, I'm about to hack Mark cuban

That dude still eating with the Mavericks still losing

When i stick First Round, I'll make them look so silly yo

Like the people dancing in their stupid videos

Is you feeling me? Well then bump through your speakers!

As I stomp on VCs wearing Phin Barnes sneakers</comment>


Some Remarkable Résumé Designs - <AUTHOR> http://www.noupe.com/graphics/remarkable-r-sum-designs.html

<comment><USER2> Almost any of those resumes would get you a job offer from us (Shopify) after the most basic cultural fit evaluation.

Putting something like this together demonstrates a tremendous amount of desirable skills: Design skills, creativity, humour, but most importantly: resourcefulness, the desire to combat status quo, and the ability to ship a project and be proud enough to (literally in this case) put your name all over it.

Here is a great example of an applicant who build an entire Shopify store to get hired recently. Turned out we had the position already filled but we created a new position out of thin air just to get him. He starts on wednesday: <http://mikefreeman.myshopify.com/>

<comment><USER3> That's brilliant. "(Mike Freeman not pictured)". Make sure you look at the "Book a meeting" page.

</comment></comment><comment><USER4> Nice designs, but terrible at conveying information.

(I found the one with the box particularly funny.)

<comment><USER5> I think it's perfect for the target audience. Most of them, if not all of them, were for designer positions. This demonstrates their skillset for design, especially if the job is for advertising creative work.

If it's for creating functional user interfaces, maybe not as great, but I think it still achieves the overall goal of demonstrating their skillset for design work.

</comment></comment><comment><USER6> If we're going to have these Resume submissions, I wish someone would post some really good ones, not this style-over-substance bullshit. Suppose you're an engineer and you're actually really good at what you're doing, what are some good examples that communicate that?

<comment><USER7> Here's a good example <http://www.feross.org/youtube-instant-media-frenzy/>

</comment></comment><comment><USER7> This is the (never sent) resume that I prepared when I was considering to apply for Posterous <http://dl.dropbox.com/u/1720553/Screenshots/3n.png>

Edit: never finished and never sent

</comment><comment><USER8> I may be getting old but if something like this came to my desk for any job besides graphical artists, I would be mildly annoyed.

<comment><USER9> All of the resumes pictured were for graphic artists or UI designers.

I'm not sure why say an engineer would even have this skillset, much less think he or she needed to show it off while interviewing for say C# developer of the line.

<comment><USER8> I think the S/N is too low in those resume.

</comment></comment></comment><comment><USER10> Most of them seem over-designed.

<comment><USER3> Some certainly are but they do demonstrate a lot of flair and technique.

<comment><USER10> Agreed, but knowing when to stop is the hard part.</comment></comment></comment>


An Interview With Earnest: Ethical data science for better lending - <AUTHOR> http://codeinsider.us/i/6.html

<comment><USER2> I really enjoyed this!

I'm really interested in knowing more about the tech stack you are using. I work for Analytical Flavor Systems[0], where we do heavy data science in R and then display everything in R Shiny. Currently I'm looking at different methods of moving off the R Shiny platform as our application has gotten really complex.

The main problem is we are constantly running our algorithms when new data comes in per producer and we have to display it.

[0] [https://www.gastrograph.com](https://www.gastrograph.com)

</comment><comment><USER3> I hope I'm never in so desperate need for a loan that I have to sign up for LinkedIn.

</comment><comment><AUTHOR> Really enjoyed this interview - some pretty interesting insights. Brian and the Earnest team (along with myself!) will be hanging around the HN comments for extra questions.

</comment><comment><USER4> Good article. The correlation between having more than 0 LinkedIn connections and financial responsibility surprised me. I wonder though if the correlation will decrease in the future though, as financially irresponsible people game the system by simply creating a LinkedIn profile and adding a few connections before applying to Earnest.

</comment><comment><USER5> Interesting article. It does raise a tricky question though: What separates ethical/unethical or fair/unfair factors on which to discriminate. I choose not to use LinkedIn based on their privacy policy among other things. Is it fair for me to be discriminated against because of this?

<comment><USER3> Right now you will have a lower credit rating with 0 credit cards than with a small number that you do not maintain a balance on. I know several people that don't use credit cards out of privacy concerns.</comment></comment>


Why I disagree with the Just a Ship It mentality - <AUTHOR> http://www.inc.com/neil-patel/why-i-totally-disagree-with-just-ship-it-startup-mentality.html?cid=sf01001 <comment><USER2> A number of years ago, this practice was known as the "good enough to ship" philosophy and attributed to Microsoft.

Mr. Patel nailed it. This does a disservice to the client by giving them a bug ridden product that had neither sufficient time for a proper QA/regression cycle nor for supporting documentation.

QA and documentation groups need time to verify features and operation. Agile development seems to be the culprit when I encounter this situation.It's seems fine for smaller projects with small dev groups. However, I have yet to see Agile function smoothly: i.e., a smooth development cycle where all the pieces fit, sufficient QA/regression cycles, and documentation that matches reality.

What I do see are missed release dates as a matter of course, purposely short QA and regression in vain attempts to release on time, and docs that have to be written against thin air, as their writers didn't have the finished product until the clients did. And even then it doesn't work like that wonderful idea from the beginning. Some companies can only push the releases so far before violating delivery contracts.

New does not mean panacea.</comment>


Foxconn deliberately sabotaging their BIOS to destroy Linux ACPI - <AUTHOR> http://ubuntu-virginia.ubuntuforums.org/showthread.php?t=869249 <comment><USER2> [http://antitrust.slated.org/www.iowaconsumercase.org/011607/...](http://antitrust.slated.org/www.iowaconsumercase.org/011607/3000/PX03020.pdf)

</comment><comment><USER3> "it appears they're trying to crash the kernel by locking a region of memory that shouldn't be locked"

...or, they're second-rate programmers who don't test their code very thoroughly.

Yes, he is going overboard by claiming "deliberate sabotage." Every hacker wants his 15 minutes of /., and he got his. However, the important overlooked fact here is about halfway down in his post:

"I've found separate DSDT tables that the BIOS hands to Linux specifically, changing it to point to the DSDT tables Vista gets fixes all Linux issues with this board."

That is, the problem isn't that they screwed up the Linux implementation of their BIOS, it's that they created different rules for Linux to follow when the Vista ones worked just fine. I still have a hard time attributing it to malice, but this is very asinine indeed.

<comment><USER4> Interestingly enough though...

FoxConn says in the email replies that they DONT SUPPORT Linux.

However, they have code specifically written for it.

Strange, even if it isn't deliberate sabotage.

<comment><USER5> This was what made me thing they did it intentionally. They don't support Linux, and yet they intentionally detect Linux and have special code written for it that doesn't work, when the standard code does work. That's incredibly suspicious, it's like when Hotmail decided to "only support Internet Explorer" by sniffing the user agent string when it actually worked fine on Firefox

</comment></comment></comment><comment><USER6> To quote wikipedia! "A technical standard is an established norm or requirement. It is usually a formal document that establishes uniform engineering or technical criteria, methods, processes and practices."

If they're following the standard they shouldn't need to cater for different OS's - one will do.

From the sound of it they've probably copy/pasted chunks of stuff, then edited the windows stuff to make that work and forgot about the linux bits.

There's probably no malice involved here but it sounds like a massive bodge, which is totally unprofessional for a commercial product.

</comment><comment><USER7> This is a very informative thread for anyone having ACPI problems with a Foxconn board, but it's a stretch to say they've gone out of their way to deliberately sabotage their own product in order to inconvenience the tiny percentage of their own customers who choose to use Linux. More likely, this is simply incompetence.

I've been using Linux for almost 10 years so I'm very familiar with this sort of experience and understand this guy's frustration completely. However, he is jumping to a lot of conclusions based on very little information. Before even asking for help he sent off a complaint to the FTC. Foxconn's support tried to work with him after that to fix his problem and he acted like a total jerk.

With these chicken little types of articles and forums threads being plastered all over every social news site it's no wonder a lot of hardware vendors don't want to officially support Linux. When something doesn't work people always assume the worst and they get burned for it. The more likely scenario is that many of these companies don't have enough Linux experience to ensure the same kind of quality they can with something as familiar as Windows.

<comment><USER8> I don't see where Foxconn "tried to work with him", frankly. They asked one question (which completely missed the point: removing RAM doesn't tell you anything about ACPI behavior) and then punted with "we don't support linux". I don't know about you, but that's not the support that _I_ want from my hardware vendors.

I mean, sure, the guy might be a paranoid jerk. But Foxconn is hardly blameless here.

<comment><USER7> Of course they're not blameless. They're just another crappy vendor that, at best, puts a half effort into supporting Linux. Even cursory research probably would have revealed this before the guy purchased the hardware. The first clue that a little research might be necessary is that Foxconn doesn't even claim to support Linux.

The point I was trying to make is this is about the worst way to go about solving a problem like this. Assuming, and then treating people as if they're out to get you is going to get this guy and the Linux community exactly nowhere.

What do we know? Maybe Foxconn made a genuine attempt at providing some unofficial Linux support and just screwed up. Dealing with them as if they're part of some conspiracy to destroy Linux is not only downright foolish but really hurts the cause. If all a company is going to get is grief from a bunch of rabid bloggers, who can blame them for falling back on the "we don't support linux" excuse?

The simple solution is to let them know in a polite and respectful way that you're having a problem with the hardware. They can choose to fix it or not and you can choose to keep buying their products or not.

</comment></comment></comment><comment><USER9> So you are using a motherboard under conditions that they state it's not certified for... Where's the news here?

Is this just a pissing match gone bad?

"I'll be damned if I'm going to buy a copy of Vista just to get the crashing caused by Foxconn's BIOS to stop, I am not going to be terrorized."

Isn't this whole thing the result of bad research before purchase?

About the only thing interesting about this is if the guy gets sued under DMCA for disassembling the BIOS of the motherboard.

<comment><USER10> The point is that the motherboard was advertised as being ACPI compliant. It is not. In fact, it checks specifically for Linux ands hands back ACPI data which crashes the machine.

I'm not certain what the potential anti-trust implications are.

<comment><USER9> But it's still not Linux certified.

About the DMCA, yes it sucks, and yes, it would be irrational to sue because of that, that's why it would be interesting. Anyway, not that I am hoping for that. Stupid laws should go away.

<comment><USER8> I'm not following your logic. ACPI is a published, open standard. Foxconn doesn't need to do _anything_ for "linux" or "windows" specifically. They just put the tables in memory and hand them to the OS to use.

But they aren't. They're specifically testing for OS versions and handing back different (and, in this case, broken) data to "linux" software. At best, that's horribly broken and a reason to avoid Foxconn hardware. Excusing it with this "Certification(tm)" canard is just spin, and you appear to have fallen for it hook, line and sinker.

<comment><USER9> Well, you guys can mod me down all you want, but the fact remains, they said the motherboard itself is not certified for Linux, so putting Linux on it is a gamble, regardless of the ACPI standard. "Run an O/S we support, and tell us if the motherboard still does not work": Pretty standard response when you try to do something unsupported and then run into trouble. There's no manufacturer that's going to tell you otherwise. Try and complain to Intel about overclocking problems with their motherboards: They will first say "turn off the overclocking and tell me if it does not work still. Oh, and you have just voided your warranty."

Just switch brands already. I have my own brand that I like for MBs exactly because I have never had to put up with this cheesy crap from the mfg I use. Foxconn sucks for pulling this crap, so the guy writing the article should stay away from retard brands. Next time, spend the extra $10 or whatever and get a good motherboard. That is the real lesson I see in all of this.

<comment><USER11> I don't think you understand the problem here. The board works under Linux if the BIOS is modified to follow the ACPI spec, but under their own implementation it does not follow the spec. Thus at the minimum it is a faulty product that does not match the advertisement, and at worst it is an anti- trust violation. Certified or not, recommended or not, warranty or not, it does not fulfill the spec. The fact that Vista covers this up does not mean that it fits the spec when running Vista, no matter how you slice it, it is broken.

<comment><USER9> I just think that it's gonna be hard for anyone who can do something about this to give a sh*t. Anti-trust instead of false advertising? Now I know for a fact nothing's gonna happen. Anti-trust cases are about the hardest to do.

Anti-trust... Why would that be anti-trust anyway? Where do monopolies come into play?

<comment><USER9> From: <http://mjg59.livejournal.com/94905.html>

"Anyway. Accusing companies of conspiring against us when the most likely explanation is simply that they don't care is a fucking ridiculous thing to do and does nothing to get rid of the impression that Linux users are a bunch of whining childish hatemongers. Next time, try talking to someone who actually understands this stuff first?"

Thank you, Matt.

Now all you downmodders, please upmod me :-)

Seriously, you guys should not downmod just because a post disagrees with you.

<comment><USER12> "I think it's ok to use the up and down arrows to express agreement." -- PG

<http://news.ycombinator.com/item?id=117171></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ingress: Google is broadcasting your address to everyone. - <AUTHOR> http://algorithm.dk/posts/ingress-the-flawed-game

<comment><USER2> They've responded by saying that they're randomising locations - OP finds it's always 1km from his location.

If it's a fixed distance (radius) then only the angle can be randomised. This means that graphing even just a few points from a consistent location will lead to a circle centred precisely on the user's address. Even if it's only partial, an arc can be extrapolated to a circle without any loss.

</comment><comment><USER3> Can you explain a bit more how you pulled this off? You are submitting requests to m-dot-betaspike.appspot.com and spoofing Ingress?

</comment><comment><USER4> This is very easily solved by not using Google.

<comment><AUTHOR> I can't understand how they think this is OK.

<comment><USER5> I'm not sure I completely comprehend the issue: so you want to play a location-based massive multiplayer game, AND you don't want to let your location be known. Hmmm.

<comment><AUTHOR> Why can another player retrieve my current location just because I posted a chat message? This information is not displayed in the game, but the data is retrieved. Every time the event list or the chat is loaded, along with each post content the location of the player who has been the source of the event is also coming from the server.

<comment><USER6> It's not the current location that's retrieved. It's the approximate location of when you sent the message (or as I mentioned previously, the location of your map view in intel if you send the chat from there) or other "alert" event.

Considering most of the alert events are location specific events (playerX captured/attacked/deployed portalX, linked portalX and portalY), playing the location based game exposes your location to other players.</comment></comment></comment></comment></comment>


How does perf work? (in which we read the Linux kernel source) - <AUTHOR> http://jvns.ca/blog/2016/03/12/how-does-perf-work-and-some-questions/ <comment><USER2> I'm not an expert, but I believe I can answer some of the questions at the end of the article.

>are kprobes and ftrace the same kernel system? I feel like they are but I am confused.

They are not. kprobes and kretprobes have been around in the kernel for a lot longer than ftrace, and are exposed to multiple tracing programs. ftrace, perf, bpf, etc, all can make use of kprobes. (ftrace is pretty heavily dependent on kprobes for being useful, kprobes are still useful without ftrace)

>what is the relationship between perf and kprobes? if I just want to sample the registers / address of the instruction pointer from ls's execution, does that have anything to do with kprobes? with ftrace? I think it doesn't, and that I only need kprobes if I want to instrument a kernel function (like a system call), but I'm not sure.

Kprobes make a copy of the instruction you are probing, and replaces the first bytes of the instruction with a breakpoint instruction. When the CPU hits this, a trap occurs, and the registers are saved, and passed to the kprobe

Perf has the ability to collect CPU performance counters, tracepoints, kprobes, and uprobes. Tracepoints are added to the code of the application - they will include a definition in the header, and the actual tracepoint statement in the code itself. uprobes allow dynamic tracing of user level and library calls. You echo in a probe name, executable location, and offset, and then you can start tracing that probe.

</comment><comment><USER3> Nice!

Here's another way to view/understand the kernel and user space code:

[http://www.srcmap.org/sd_share/14/a2313bc5/Cross_Reference_C...](http://www.srcmap.org/sd_share/14/a2313bc5/Cross_Reference_Code_on_Perf_in_Linux_Kernel_and_User_Space.html)

</comment><comment><USER4> "rdpmc" is shorthand for "read performance monitoring register". It's exactly what the author guessed - a register that increments every time an instruction is executed.

</comment><comment><USER5> rr uses perf_events_open - I know because it gives me an error when I run it on VirtualBox... Initially I thought it was a capabilities issue, so I ran it as root. Then it segfaulted.

Not sure what's going on. I probably need to file an issue.

</comment><comment><USER6> rdpmc will give a cycle count, so presumably perf stat hooks into the scheduler to the maintain the count per process?

</comment><comment><USER7> I made a comment directly on the blog post which I'll copy here:

I've also spent a lot of time recently trying to understand how 'perf' works at a low level. I'm getting closer, but a lot of it is still pretty impenetrable. There are four main resources that I'd recommend.

The first, which you've almost surely found, is the "Perf Wiki": [https://perf.wiki.kernel.org/index.php/Main_Page](https://perf.wiki.kernel.org/index.php/Main_Page) There's not a lot there, but it's a good introduction.

The second, which you might have stumbled across, is the text documentation scattered throughout the kernel source. Most are in [https://github.com/torvalds/linux/tree/master/tools/perf/Doc...](https://github.com/torvalds/linux/tree/master/tools/perf/Documentation), but the most useful one is up one directory at [https://github.com/torvalds/linux/blob/master/tools/perf/des...](https://github.com/torvalds/linux/blob/master/tools/perf/design.txt).

The third is Andi Kleen's PMU Tools: [https://github.com/andikleen/pmu- tools](https://github.com/andikleen/pmu-tools) The 'jevents' library within this illustrates how to use 'perf' to set up the counters while using 'rdpmc' from userspace to read them.

The fourth is Vince Weaver's Unofficial Linux Perf Events Web-Page ([http://web.eece.maine.edu/~vweaver/projects/perf_events/](http://web.eece.maine.edu/~vweaver/projects/perf_events/)) and his associated Perf Event Testsuite ([https://github.com/deater/perf_event_tests](https://github.com/deater/perf_event_tests)). Tests make wonderful examples.

The deeper I got into it, the more I realized is that 'perf' is still evolving, and there is a lot of anger and discontent below the surface. There were (and are) competing alternatives, but 'perf' is politically in control. Much of what you read about 'perf' should be probably be viewed through the lens of "history written by the victor", and "the vanquished" may have different perspectives.

\---

Separately, in case anyone is already familiar with the internals, here's an aspect where I'm currently stuck. There is an "offset" field which one is supposed to add to the result read from "rdpmc", but when I do so I get strange problems: [https://github.com/nkurz/pmu- tools/commit/f2ab49207d4c7b7ddd...](https://github.com/nkurz/pmu- tools/commit/f2ab49207d4c7b7dddf37a00aa293b47c7f7b897)

</comment><comment><USER8> perf is simply awesome.</comment>


How I bought an IPhone 5 for 90$ using Python (2013) - <AUTHOR> https://medium.com/@luismig11034821/how-i-bought-an-iphone-5-for-90-using-python-8bee68dbf6ef#.q26znnamr <comment><USER2> "I am not particularly proud"

Still, he's bragging about it.

No, it's not criminal. Not even illegal.

But it means I wouldn't ever want to do anything with the author.</comment>


Gmail Date actions chrome plugin - <AUTHOR> http://www.mymindleaks.com/article/gmail-date-actions-chrome-plugin.html <comment><AUTHOR> just made one of my private plugin public. let me know your feedback.</comment>


Quadrupling Ansible performance with Mitogen - <AUTHOR> http://pythonsweetness.tumblr.com/post/171589071872/quadrupling-ansible-performance-with-mitogen <comment><AUTHOR> > An experimental extension to Ansible is included that implements host > connections over Mitogen, replacing embedded shell invocations with pure- > Python equivalents invoked via highly efficient remote procedure calls > tunnelled over SSH. No changes are required to the target hosts.

This approach looks really promising. By default Ansible opens a ton of SSH connections (to the same host..) and it also spawns a ton of subshells for a typical run.

That is of course really wasteful and inefficient, and this project tries to fix it.

[https://mitogen.readthedocs.io/en/latest/ansible.html](https://mitogen.readthedocs.io/en/latest/ansible.html)</comment>


Ask HN: Are there any remote internship opportunities? - <AUTHOR> I am a CS student from Athens, Greece. It's this time of my life that I must get into a demanding and high throughtput work environment with lots of learning opportunities (aka internship). Unfortunately good  internship opportunities in Greece (I cant speak for other countries) are very rare. Especialy for modern technologies like Rails etc (lack of a mature startup ecosystem).
Are there any Ruby/Rails startups willing to accept remote interns/apprentices? If yes please include email to send CV/Motivation letter. I guesss a lot of people (including me) would really love working for a startup (especialy one that is using our favorite programming languages, tools etc.) . Additionaly I think that such opportunities would benefit both sides as well as the general local ecosystem (eg. more experienced people in Greece).
PS. This question is for both paid and unpaid internships. <comment><USER2> If you're going to work remotely, I would recommend skipping the internship. If you know rails and can throw together a nice webapp, and you're studying CS, you're qualified to do real work. Just apply for some contracts on the basic freelancer sites out there, get some experience, then apply to more ambitious places.

Open source participation could also provide meaningful interaction with others on par with an internship.

<comment><USER3> "If you know rails and can throw together a nice webapp, and you're studying CS, you're qualified to do real work."

Dead on. I cannot stress this enough. The world is full of people that need little apps done. I'm a CS major, and I've never been without a friend or two bugging me to do a project for them. There are also many companies that need a competent web developer. With time and effort, you can effectively shortcut the internship and gain real experience, doing real projects and get paid real money.

</comment></comment><comment><USER4> Why would you want to do it remotely? I have worked with interns from a lot of countries, and this is something especially the EU makes a lot easier (but I've also worked with interns from e.g. Egypt). And while we have done remote internships, I'm convinced being in the same spot works a lot better, for both parties.

Depending on the company, you won't get rich, but we have always tried to make sure interns could at least break even, and off-course learn a lot. Some of them stayed, and I have now one remote person working for us in Egypt, who used to be an intern (and stayed in Amsterdam, where we are based, during the internship).

<comment><AUTHOR> It is not much of a choice. While I have no problem travelling for an internship, I am pretty much limited only in EU and I was rather unsure if there are a lot of offers that include living and travelling costs. Does your company offer intern positions at the moment?

</comment></comment><comment><USER5> Are you dedicated to staying in Athens? Or are you just figuring that no one will be willing to pay for you to come to the US/UK/whereever. Because if it's the latter, I think you would be surprised.

<comment><AUTHOR> Travelling is not a huge problem for me, apart from the fact that I would have to be in Athens for my exams. I had the impression that it would not be very easy for a startup to pay for travelling expenses for an intern. I would love if you could you point me at some. (Although, I have the impression that travelling to the US for an internship could be rather hard due to immigration limitations.)

<comment><USER5> Visas for interns are actually pretty straight forward in the US. <http://en.wikipedia.org/wiki/J-1_visa>

<comment><AUTHOR> I see! Although (correct me if I am mistaken) a lot of US internship positions require that you are already eligible to work in the US, clarifying that they cannot offer help with visa applications etc.

<comment><USER6> That's what me too have observed. In the application forms they have a special option to choose if u have a US visa

</comment></comment></comment></comment></comment><comment><USER7> We love remote working. We have the right processes and tools setup for this (campfire/pivotal/github/BDD and the right mindset).

Checkout our product at <https://supportbee.com> and our developer site at <https://developers.supportbee.com> and email me at prateek AT supportbee.com if you find this interesting. Thanks!

</comment><comment><USER8> Once upon a time, I found a software product I really liked. I emailed the (very small) company and asked if I could intern, and they said yes.

A year later, I did it again, with a different company.

I only tried this twice, and it worked both times. In both cases, I was paid enough to cover expenses, and the second company offered me a job. You could probably start by doing the same, but be clear "remote only".

</comment><comment><USER9> Have you considered Google's Summer of Code? <https://code.google.com/soc/>

<comment><USER10> I just want to second this. I participated in GSoC 2009 and absolutely loved it. I'm from the US and worked with 2 mentors in Switzerland, a student in India and a student Colombia.

We worked on a package management system like APT for Windows, and while it was a bit unrealistic for 3 students in 3 months, I learned more in those 3 months than entire years at college.

Edit: There's also a Ruby Summer of Code in the same respect as the Google one. <http://rubysummerofcode.org/>

<comment><USER11> Have you ever checked out Chocolatey? Interested how it compares to what you were working on. ( <http://chocolatey.org/> )

<comment><USER10> That looks pretty similar. We were building a GUI tool for it and a really diverse hosting service that would let you torrent the packages and what not.

</comment></comment></comment></comment><comment><USER12> I tend to prefer having face-to-face interaction with interns, because it lets me determine more easily what they're understanding and what they're struggling with. Physically being in the same space can also create a more helpful environment where interns are comfortable to ask questions as they arise. Still, this is becoming less and less important with virtual offices, and tools like StackOverflow that can be better than asking a coworker anyway. Also, I've found that with introverted interns, communication can often be better through email than in person. Since I work on a distributed team at Coshx Labs, feel free to ping us about our intern program and if we'd be a good fit for each other.

<comment><AUTHOR> Great! I have contacted you via your contact form!

</comment></comment><comment><USER13> Hi - you say startups, but have you considered going a bit larger? I work for a large mobile (~800 employees, NASDAQ listed) technology company whose co- founders were Greek, and our largest engineering team is in Athens. I know some of our products are Ruby based (not my department, I deal with native mobile apps).

If you want to get in touch with me I can forward your CV to the right people. Just checked and we're recruiting Athens based interns right now (and they're paid). Plus you'll get to do a lot of work with our offices in SF and London. Send me a DM on Twitter (@objclxt) and I'll ping you my e-mail.

<comment><AUTHOR> Great thanks!!

Update: Well I checked out your employer's intern opportunities and they are only employing state-funded internship positions in Athens (and I am overeducated to be eligible for a state-funded job, they are only for high- term unemployed with lower education). On the contrary they offer real intern opportunities in London. This is a great example of how twisted intern opportunities (and jobs in general) can be in Greece, unfortunately. If there are offers for university students, and they just are not on display on the website, please let me know :)

</comment></comment><comment><USER14> We'd love to talk to you - firstname.lastname@example.com ... working on V2 of the service (<http://www.pedalr.com> | <https://angel.co/pedalr>) and business model. Please send your CV if you'd be interested in working on the intersection of content and ecommerce with a fun group and some great advisors. We're Ruby, MYSQL, Wordpress.

</comment><comment><USER15> Email us at internships [@] crowdtilt.com. There may be a unique opportunity to do something remotely with our API (just launched to the public this week).

</comment><comment><USER16> All the team members of BigBinary work remotely.

Anyone looking for internship opportunity can contact us.

<http://bigbinary.com/>

</comment><comment><USER17> lol isnt the point of an internship to learn?

Best place to learn is right next to someone. There are significant communication barriers in remote working. Sure they can be mitigated but presence and a piece of paper is not to be underestimated.

If you can intern remotely just get a job as you would have to be capable.

</comment><comment><USER18> Fellow greek located in the us, interesting start up opportunity avAliable. Email email@example.com

</comment><comment><USER19> If you fancy some backend stuff for social games, send an email to firstname.lastname@example.com

</comment><comment><USER20> Drop me your cv by email firstname.lastname@example.com

</comment><comment><USER21> Have you tried the open-source product startups? They are approximately all set up virtually. I have never run into one that actually had a real office. It should not matter to them where you are physically, since they are not dragging along a costly legacy of habits that requires it.</comment>


Sin(y)=tan(x^2) - <AUTHOR> http://www4a.wolframalpha.com/Calculate/MSP/MSP44871b6i9a8c34e4955600005h4bebhd9i4a7h46?MSPStoreType=image/gif&s=37&w=200.&h=283.&cdf=RangeControl

<comment><USER2> All I get is this error:

> Sorry, this page does not exist on the Wolfram|Alpha site.

I guess you wanted to submit the graphic of:

[http://www.wolframalpha.com/input/?i=sin%28y%29%3Dtan%28x%2F...](http://www.wolframalpha.com/input/?i=sin%28y%29%3Dtan%28x%2F2%29)</comment>


Home Depot breach bigger than Target at 56M cards - <AUTHOR> http://www.reuters.com/article/2014/09/18/home-depot-dataprotection-idUSL3N0RJ5VJ20140918 <comment><USER2> Part of me wonders if security will ever be something people actually care about, and value.

Home depot had a huge, huge security breach. Their stock price? Up 12 points from last year.

I'm not sure what it would take for people to really value a major security breach. The tech guy inside me is screaming, "why wouldn't you care about this?", but the regular guy inside me thinks, "who cares? the banks will handle any stolen credit card info."

<comment><USER3> I don't really know much about this sort of thing. I assume that to the retailer that gets pwned, they get a few weeks or months of bad press then pass the cost of that breach on to future customers.

The "regular guy" in me thinks, "Meh, I'll probably ending up paying 5 cents more for light bulbs because of this. Oh well."

I feel bad for the sysadmin/security guys at these companies, probably screaming for budget and not getting it. What do you think they're doing now? Helping some high paid IR consultant restore logs from backups. Good times!

</comment></comment><comment><USER4> Could someone please explain to me why Home Depot and Target would even have the information of 56M cards?

Is this a result of not using chip and PIN, relying on offline transaction processing or some weird subscription plan?

I understand that there would be a cost involved in implementing chip and PIN across the entire US and it may not solve the issue if they insist on having the card on file. Online credit card processing has been pretty much standard for the last ten years here in Denmark. Terminals are connecting to the credit card processor, either via an ISDN/ADSL/phone/GSM connection, everything is encryptet and the store never has anything expect the cardmask.

So why do companies like Target have the card information of their customers?

<comment><USER5> From this link: [http://krebsonsecurity.com/2014/09/in-home-depot-breach- inve...](http://krebsonsecurity.com/2014/09/in-home-depot-breach- investigation-focuses-on-self-checkout-lanes/)

"The malicious software that unknown thieves used to steal credit and debit card numbers in the data breach at Home Depot this year was installed mainly on payment systems in the self-checkout lanes at retail stores, according to sources close to the investigation."

So it's not that Home Depot (i'm not sure this applies to Target) had the credit card info stolen from their servers. It's more that it was skimmed from their self-checkout machines, though by software though rather than hardware.

<comment><USER6> Skimming would imply that someone physically altered the self-checkout lanes to capture credit cards in the same way an ATM skimmer works. Since this was installed malware, it would mean access to Home Depot's network. I wouldn't be surprised to learn that credit card data was stored in plaintext somewhere in their system.

<comment><USER7> I will say, one time a few years back I needed to get a receipt from a purchase more than 60 days old. I called the local store, and she said "just give me your credit card number and I can lookup your transactions". With just my card number she was able to see every transaction I made with that card (and find my purchase I needed the receipt for). So (at least 3-4 years ago) it was being stored somewhere searchable by people in the back office.

<comment><USER8> Or at least a hash generated from it was stored.

</comment></comment></comment></comment></comment><comment><USER9> The sad thing is we will probably never learn the exact problem and that means we the industry will never learn from their stupidity.

</comment><comment><USER10> If they would have followed Payment Application Data Security Standard as many others do, they wouldn't have had this problem.

<comment><USER11> PADSS is a CYA tool, little else.

You can't checklist your way to good security.

<comment><USER10> Well, it's not only that. Technically it's helping a lot. Because often there is dedicated hardware with it's own certified software which deals with all card data. So the POS PC doesn't get anything else than the transaction identifier and confirmation of the payment. Therefore, what ever malware is running on the PC, can't access the card data at all. Without this arrangement, I'm sure we would have seen a lot more of credit card data thefts. Especially from smaller stores which do not care about security at all. You can ask your local non-chain random el cheapo Pizza Kebab about their IT department and security standards they're utilizing. ;) Actually I've been planning this for a while, it would be fun. Even stores which rent videos, should have documentation (by law) about how their customer register data is stored, protected and used etc. I'm quite sure there are many stores which do not have that.

</comment></comment></comment><comment><USER12> Any idea why the market punished Target stock so thoroughly but doesn't seem to care about Home Depot?

<comment><USER13> Target stock was fine until they put out this press release that updated guidance lower due to reduced sales after the announcement: [http://investors.target.com/phoenix.zhtml?c=65828&p=irol- new...](http://investors.target.com/phoenix.zhtml?c=65828&p=irol- newsArticle&ID=1889763&highlight=)

</comment></comment><comment><USER14> So, I assume Apple Pay will solve some of these kinds of problems? Otherwise, what's the point?

<comment><USER15> > Otherwise, what's the point?

Funneling more cash to Apple?

<comment><USER16> And where exactly does Apple make money from their NFC payments?

<comment><USER17> By siphoning a small portion of the swipe fee. (Estimated at 0.15% of transaction value).

<comment><USER18> From the bank's cut apparently although I hadn't seen the amount before.

</comment></comment></comment></comment></comment><comment><USER19> After having my card cancelled from the Target theft, and now this, I'm done with Home Depot.

<comment><USER20> I kinda feel like having to replace a lost/stolen card number is just part of the cost of doing business by credit card.

<comment><USER19> Yeah but I don't want to support a company that has millions of credit cards stolen from malware.

<comment><USER21> As consumers, we really don't have many ways to make an impact, so I can understand why you would be so exacting. With that being said, a particularly skilled engineer could find his or her way into just about any closed system. Check out CVE Details[1] to get an idea of how many security exploits are reported for software that surely you use daily.

For most companies, the mess that Home Depot is facing never occurs. Not because they were so successful at anticipating security holes, but because they were never targeted by a successful attacker.

Details have not been released (and may never be fully released) regarding the attack; but this is just food for thought.

[1] [http://www.cvedetails.com/](http://www.cvedetails.com/)

<comment><USER22> Pay cash at retail establishments. Use paypal at as many online stores as possible. Use prepaid debit cards elsewhere, don't keep much money on them normally, drain them and switch to another card every month.

<comment><USER23> > Pay cash at retail establishments.

Your cash can be stolen, lost, misplaced. No recourse. If you lose a credit card, you just call and get a new one mailed to you.

> Use paypal at as many online stores as possible.

I can't believe someone just recommended using PayPal on HN.

> Use prepaid debit cards elsewhere, don't keep much money on them normally, > drain them and switch to another card every month.

Don't use debit cards to pay for things. Ever. Credit cards give you substantial consumer protections that you don't get from debit cards.

Bottom line: use credit cards everywhere you can. Find the best rewards program for you and rack up points. Check your account activity once a week. Report anything you don't recognize. If you're part of the social class to which credit cards are actually available, it's quite foolish not to use them.

<comment><USER22> > Don't use debit cards to pay for things. Ever. Credit cards give you > substantial consumer protections that you don't get from debit cards.

A: This is simply not true any more. Most banks offer essentially the same level of protection for debit cards as for credit cards, the only issue with debit cards is that potentially you could have a period of time while still missing funds, but I've never seen that be an issue with any reputable bank within the last several years.

B: You must have missed the part where I talked about using "prepaid debit cards". If you are extremely paranoid you can only add money to them just prior to use, leaving them with a low balance most of the time.

C: The problem isn't just fraud and potentially having a period of time without funds available to you that should otherwise be there, it's also the enormous hassle of replacing a card (and updating everywhere you use that as a payment instrument such as amazon, your bills, etc.) That problem isn't improved at all by using a credit card vs a debit card.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Home Depot? I'm good. Tell me when Amazon gets breached.

<comment><USER25> What's your robot butler thing? That sounds interesting.

</comment></comment><comment><USER26> I could never decide if I preferred Home Depot or Lowes. This makes the decision easy for me.

<comment><USER27> They've kept things cleaner and have more people to answer questions in my experience.

<comment><USER28> Which one is "they" to you?

<comment><USER27> Home Depot.

</comment></comment></comment></comment><comment><USER29> This stuff goes on while my picture is taken at least three times if I want to buy a nut at that rediculios store.

By the way, HD does not necessarily have the lowest price anymore--shop around.

Oh yea, your employees hate your company more than your customers do. If there's shortage--It's probally Internal?

Hay Chantel--a manager asked if I wanted to have you written up. I figured working there was punishment enough.(bad customer service experience--really bad.)</comment>


When Bash scripts bite - <AUTHOR> https://blogs.janestreet.com/when-bash-scripts-bite/ <comment><USER2> I highly recommend ShellCheck[0] if you're writing any bash. With the warnings and stylistic advice it provides, I feel like I can actually be confident that my scripts are doing what I think they're doing.

[0]: [https://github.com/koalaman/shellcheck](https://github.com/koalaman/shellcheck)

<comment><USER3> I second this, it's a great tool.

However, don't let it give you a false sense of security.

Shellcheck probably won't say anything about the "biting" parts from the article – because they are valid, just behaving a bit different than the user expects…

That goes for any linter or static analyser i guess.

<comment><USER4> Dunno about this particular case but I'd say linters are exactly for finding things that are valid but behave differently than the user expects.

E.g. "if (x = 1)" is valid C but i'd be pretty unimpressed if a linter didn't flag it up!

</comment></comment></comment><comment><USER5> This doesn't mention one of my favorite bash gotchas, which is using `set -e` with `pipefail` at all. Try this:

        set -euo pipefail
        yes | head

That will consistently exit because `yes` gets sigpipe and quits. Which is expected, but triggers a script exit. But more exciting is that something like:

        generate_data | head

only _sometimes_ fail. It's a race that depends on whether generate_data is able to stuff all of its data into the pipe buffer before head calls close().

EDIT: I seemed to remember sharing this bug not too long ago, and indeed I did. pixelbeat responded with some interesting links: [https://news.ycombinator.com/item?id=13940628](https://news.ycombinator.com/item?id=13940628)

<comment><USER6> I don't know that this obviates the need to check PIPE_STATUS after the statement.

As another poster mentioned, set -e and set -o pipefail are crutches and tell me the script it sloppy.

</comment></comment><comment><USER7> As an aside, I like reading Jane Street's blog. They're one of the few companies in our space (I'm also in "automated trading") that discusses even non-proprietary stuff openly. When you work in an information vacuum, it's comforting to know that presumably similar people face the same challenges.

When the author wrote "a particular production bash script (if that doesn't sound horrifying, hopefully it will by the end of this post)," I couldn't help but smile...

<comment><USER8> They're a pretty neat company from what I've seen, they also host a puzzle site here: [https://www.janestreet.com/puzzles/](https://www.janestreet.com/puzzles/)

I interviewed there, but unfortunately didn't make the cut.

<comment><USER9> Same here. Interviewed with Jane St along time ago, got rejected in the end but came away massively impressed.

</comment></comment></comment><comment><USER10> The error handling is one reason I prefer Tcl to Bash or POSIX sh if I need a nontrivial script that shells out to other programs. Tcl handles errors, substitution, etc. properly (unsurprisingly) by default:

      > set foo [exec /bin/true][exec /bin/false][exec /bin/true]
      child process exited abnormally
          while executing
      "exec /bin/false"

      > exec true | false | true
      child process exited abnormally
          while executing
      "exec true | false | true"

      > set sp "hello world"; exec echo $sp; # No need to quote $sp there.
      hello world

Not all shell-like things are as convenient to do in Tcl as they are in sh (the most significant difference to me is that you cannot pipe to or from functions), and it is more verbose, but because everything is a string in Tcl I find that it integrates with *nix (or Windows!) command line programs better than other scripting languages. E.g.,

      > lmap x [split [exec ps | tail -n +2] \n] {lindex $x 0}
      4540 5767 5768 31161

What happens here is that you take the output of `ps | tail -n +2`, split it on newlines, then map over it treating each line (that is something like "5814 pts/0 00:00:00 ps") as a list and taking the first element in it. The result is a list of PIDs (a string containing the PIDs separated by whitespace).

I can recommend trying Tcl to anyone fighting Bash who doesn't want to replace it with Python/Ruby/etc. If you try it, though, use version 8.6 or at the very least 8.5. The previous versions are EOL but are still common in the wild. If a recent Tcl is not available on your system, you can build a self-contained static binary interpreter with [http://kitcreator.rkeene.org/kitcreator](http://kitcreator.rkeene.org/kitcreator).

<comment><USER11> >you cannot pipe to or from functions

You, like many others, underestimate Tcl. I present to you, command pipes for Tcl:

[http://wiki.tcl.tk/17419](http://wiki.tcl.tk/17419)

Tcl can be any language you want, because it's already the language you need.

<comment><USER10> >You, like many others, underestimate Tcl.

Not in this case, at least :-), since on that wiki page there is one implementation of command pipes that I wrote and a link to another (in fptools).

What I mean when I say that "you cannot pipe to or from functions" is that while you can pipe data from one external process to another in an [exec] command, you can't pipe it from an external process to a proc or vice versa, which would be analogous to what the POSIX shell can do. Functions and external processes are less similar in Tcl than they are in sh.

The best you can do with a simple command pipe implementation like those on the wiki page is pipe data from [exec foo] to [bar $arg] to [exec baz << $arg], which, unlike [exec foo | baz], will read foo's entire output before passing it along. The only real solution that I know to allow you to treat snippets of Tcl code and external processes as basically interchangeable in a gradually read pipeline is rkeene's pipethread library. I am a big fan of it, but using an external dependency that isn't in your operating system's package repositories adds considerable friction to writing and distributing a simple script. (I do hope pipethread ends up in Tcllib.)

</comment></comment></comment><comment><USER12> Not that people should be expected to know this, but here's an idiom that does work:

        if res="$(ldap-query-for-valid-users)"; then
            echo "($res)" > "/tmp/all-users.sexp"
        else
            handle_failure
        fi

I second the recommendation to use [https://github.com/koalaman/shellcheck](https://github.com/koalaman/shellcheck) – you really shouldn't be writing shell scripts without it – but in this case it doesn't seem to handle the issue (with default settings at least).

<comment><USER13> Since 'set -e' is used already, a simpler variation is sufficient:

      result=$(ldap-query-for-valid-users)
      echo "($result)" > "/tmp/all-users.sexp"

Decoupling the process substitution from another invocation allows the error to be detected.

</comment></comment><comment><USER14> Slightly more useful than `set -e` is `set -E` and `trap exit ERR`.

But still there's basically no way to make this consistently useful.

Even if you religiously set -e/E in every scope just in case, if you're anywhere in a scope inside the non-final operand of a bunch of &&/||s, or as the conditional expression in a control structure or whatever, -e/E will just do nothing, you can't turn it any more on, you just don't get early termination on errors no matter how many nested function calls you're actually removed from the original ||. It's not great.

</comment><comment><USER15> I was just thinking how cool would it be to have a module in python to really ease generating bash style scripts, with less overhead than normal `subprocess` methods have... And there was it just a Google search away: [https://pypi.python.org/pypi/sh/1.12.13](https://pypi.python.org/pypi/sh/1.12.13)

<comment><USER16> Ok, looks great, but... I wonder what "gotchas" this module (and Plumbum) has? Does anyone use this in production?

EDIT: just learned that PBS is now sh.py, so I removed it from the comment.

<comment><USER17> Author of sh.py here. It seems to be used by many people in production around the world. I've actively maintained it since 2011, and it supports python 2.6-3.6, inclusive. Most of the gotchas have been worked out by now, but the FAQ covers the most common stumbling blocks: [http://amoffat.github.io/sh/sections/faq.html](http://amoffat.github.io/sh/sections/faq.html)

<comment><USER16> Thank you! Can I suggest that you link to documentation from your pypy page? Nice work btw.

<comment><USER18> Yes please do that. I failed to find the documentation when I had a brief click around earlier today. (Mind I wasn't trying very hard.)

</comment></comment></comment></comment></comment><comment><USER19> Does error handling in your bash scripts ever become annoying enough to warrant a rewrite in, say, OCaml?

<comment><USER20> Definitely not OCaml, but usually python or ruby will do the job better.

<comment><USER21> We use node at work now. The fact is it's not worth it trying to get everyone to write good bash scripts. Js doesn't have nearly as many foot guns and there's a library for just about anything you could want to do.

<comment><USER22> Error handling in asynchronous JavaScript is quite notorious for being easy to screw up.

<comment><USER23> True for async code, but if you use something like ShellJS [1] (which would be an easy way to rewrite a bash script that was getting out of hand), all commands are synchronous, so error handling is just try/catch.

[1] [https://www.npmjs.com/package/shelljs](https://www.npmjs.com/package/shelljs)

</comment></comment></comment></comment></comment><comment><USER24> I was in a meeting with a major vendor and a bunch of fintech leads recently and major vendor's techie said '...no-one likes bash scripts...'

After the meeting I said to colleagues, 'I quite like bash scripts, actually', and they all said 'I thought that too...'

<comment><USER25> Well, shell scripts are extremely convenient. It's easy to write very simple ones since they're a natural extension of shell usage.

So it's really easy to go from

$ command1

$ command2

to:

#!/bin/bash

command1

command2

As a result, everybody "likes" bash scripts since they're so easy to write, initially.

And these shell scripts will work well in 80% of situations and you can get them to 90-95% just by sprinkling a few ifs around.

Once thes script becomes longer and more complex and you want to make them easier to read and DRYer, that's when the pain begins. Or when you need to handle a bit of logic which would be trivial to do with better data structures such as arrays or dictionaries or sets...

You can work around these issues, of course, but almost every workaround is either ugly or a hack (as someone was joking, "elegant hacks" for older Unix hackers, "gross hacks" for younger ones :) ).

<comment><USER26> I agree - in my experience bash is extraordinarily easy to write the first time. It becomes a nightmare to maintain, because most people aren't actually that familiar with how bash error handling, flow logic etc. actually works. It's bad because it fails in surprising, non-conventional ways.

<comment><USER27> I just over-log absolutely everything. If it fails log it. If it succeeds and you might need to know about it, log it. That's not great error handling, but it helps with debugging.

<comment><USER28> What about "set -x"? Same effect, but you only have to flip the switch once.

</comment></comment></comment></comment></comment><comment><USER14> Another fun one is that

        set -e
        export x=$(false)
        echo ok

prints ok, but

        set -e
        export x
        x=$(false)
        echo ok

exits early because of the `false`.

<comment><USER12> But here [http://www.shellcheck.net/](http://www.shellcheck.net/) gives

        Line 4:
        export x=$(false)
               ^-- SC2155: Declare and assign separately to avoid masking return values.

</comment></comment><comment><USER29>
        echo ... > "/tmp/all-users.sexp"

No, this is not a secure way to create temporary files.

Please use mktemp(1).

<comment><USER30> Honest question: what security principles does this violate?

<comment><USER31> /tmp generally has more open permissions than the rest of the file system, and if you're using a known file name, you're open to that file being abused by an attacker.

I know of no good reason to not use mktemp.

</comment></comment></comment><comment><USER32> What this really boils down to is you should avoid subshells where possible and handle this with either variable assignment or and streams (pipes).

eg:

set -euo pipefail

foo() {

       false

       echo "hello world"

     }

variable=$(foo) # fails

foo | do_stuff # fails

My preference is to handle things as streams

</comment><comment><USER33> Yes, subshells can be tricky. Don't rely on stuff like pipefail, rather check return codes and react accordingly. Bash also provides a way to read return codes of piped commands. See PIPESTATUS in man bash.

</comment><comment><USER34>
        echo ($(ldap-query-for-valid-users)) > /tmp/all-users.sexp

should be something like

        x=$(ldap-query-for-valid-users);
        test ${#x} -gt 0||exec echo no valid users >&2;
        echo \("$x"\) > /tmp/all-users.sexp;

This way they would get the message "no valid users" to stderr and the script would exit. According to the blog post that is what they wanted.

Alternatively,

        x=$(ldap-query-for-valid-users);
        test ${#x} -gt 0||exit 100
        echo \("$x"\) > /tmp/all-users.sexp;

if they prefer a nonzero exit code to a message to stderr.

</comment><comment><USER35> A related annoyance is that when you write a for-loop in a Makefile, every iteration gets run even if one of them fails, due to how the shell calculates exit codes of for-loops.

So most of the time you should do "set -e; for XXX". Otherwise your Makefile loops will "succeed" incorrectly.

</comment><comment><USER36> How about just writing safe code.

Really... Check your damn return values. set -e is a crutch of a sloppy programmer.

Ok, yes; you can do this really slick thing in one line by stringing together a bunch of commands. However, just because you can does not mean you should.

Bash makes it simply with 'if ! <command>; then <failure commands> fi'. Try not to string ten things together. Keep conditional true state in your scripts execution flow.

<comment><USER37> That means that you have to write everything to temporary files first. If you want to do that then maybe Python is already more convenient.

<comment><USER38> > That means that you have to write everything to temporary files first.

Using the example from the post,

        echo "($(ldap-query-for-valid-users))" > "/tmp/all-users.sexp"

you have at least a couple alternatives to an additional temporary file.

        if ! valid__users=$(ldap-query-for-valid-users)
        then
          ... failure case ...
        fi
        echo "($valid__users)" >/tmp/all-users.sexp

or

        {
            echo -n '('
            if ! ldap-query-for-valid-users
            then
                ... failure case ...
            fi
            echo ')'
        } >/tmp/all-users.sexp

<comment><USER39> And when multiple bash scripts do that, it is easy to have them accidentally overwrite each other's temp files. Plus an attacker can play with temp files in a number of interesting ways to turn their use into an attack.

<comment><USER38> I was just illustrating the error checking using commands functionally equivalent to the original post. Temporary files are best avoided entirely unless some command actually requires a seekable file, in which case use mktemp(1) or equivalent (and 'trap 0' to clean up after yourself).

</comment></comment></comment></comment></comment><comment><USER40> I use Xonsh[0] for scripting now. I explain why in my blog[1], basically because we are in 2017 and I like python.

[0]: [http://xon.sh/](http://xon.sh/)

[1]: [https://william-droz.com/xonsh-a-modern-shell-that-enable- py...](https://william-droz.com/xonsh-a-modern-shell-that-enable-python-in- your-terminal.html)

<comment><USER41> then why not use python? Installing another shell just for running another script seems wrong unless it is only for you personally and you are ok with this.

<comment><USER40> Xonsh let you interact with other bash commands.

      >>> out = $(echo @(x + ' ' + y))
      >>> out
      'xonsh party\n'
      >>> @("ech" + "o") "hey"
      hey

In raw python, you have to play with subprocess by yourself.

</comment></comment></comment><comment><USER37> I don't think the problem is (ba)sh the language, but rather the idioms it implements.

It's usually a bad idea to begin writing the result before knowing that all input is there. That's like a server announcing a 200 OK and beginning to stream, only later detecting I/O error. It's difficult to deal with such a server as a client.

More generally, in pipelines we deal with pairs of programs that are only connected by a text stream, with no possibility to communicate out-of-band conditions. In `PRODUCER | CONSUMER`, PRODUCER can't tell from a sigpipe whether CONSUMER crashed or has read all the data it needs. And CONSUMER can't know whether PRODUCER crashed or if it should take action on the results.

Most scripts don't really need the take-action-immediately level of concurrency. It's sometimes nice to be concurrent (use multiple CPUs at once). But the cases where the processed data can't be buffered at least in a temporary file before taking action are really rare.

</comment><comment><USER42> Some more edge cases : [http://mywiki.wooledge.org/BashFAQ/105](http://mywiki.wooledge.org/BashFAQ/105)

</comment><comment><USER41> When I see very long bash scripts I get angry. There is a reason why perl & later python were invented and they are both in 98% of cases available on Unix compatible systems.

Not that I'm not ok with short bash scripts or for systems were you only have bash... but if your Unix compatible system only has bash there is something else wrong with your system in my point of view.

<comment><USER43> I'd much rather have 200 lines of bash than the 300-400 lines of python to replace it.

I have recently rewritten a lot of Python and Perl (over 10kLOC) to a small collectiom of 10-ish bash scripts that weigh in at about 700LOC total. There are some tasks where Bash is the only appropriate tool.

Much simpler code, much easier to read, and a _lot_ faster too.

<comment><USER44> How is bash faster than Python?

<comment><USER43> When what you need is a pipe, Python won't do anything positive to performance. Plus, CPython is horrendously slow in general.

Other than that, the simpler design also allowed greater parallelism.

</comment></comment></comment></comment><comment><USER45> Yeah, naively using errexit won't get you the whole way. BashFAQ, ShellCheck and StackOverflow have quite a bit of information, and you can often write things that are pretty robust if you take in all the information. Particular cases that come to mind are:

1) command substitution. you can catch this with an explicit error handler inherited by child processes. 2) pipefail SIGPIPE false positives. pretty hairy, command dependent whether this is a "real" error. often not, so you can work around it by ignoring SIGPIPE 3) process substitution. As far as I know, there is no way to workaround this whilst still using the convenience syntax. You have to carefully use explicit named pipes and carefully use wait on the PIDs (carefully!). Maybe still with races...

In my experience, you can write moderately robust shell scripts if you care enough and use all these flags and linters. But by the time you are at this stage you probably shouldn't be using shell scripting. More like training to spot problems in other people's code.

</comment><comment><USER46> This works but it gets ugly when you have to use 'set -e' everywhere:

set -e

      foo() {
          /bin/false
          echo "foo"
      }
      echo "$(set -e; foo)"

</comment><comment><USER47> The use of global values within programs is generally deprecated, for good reasons. The use of global values that modify the semantics of its interpreter probably deserves even more skepticism.

The inheritance of these flags by subshells, which may have been written assuming different semantics, would be potentially even more problematic, so I think bash is right in this case, though arguably the inheritance could be limited to subshell code defined in the same file.

</comment><comment><USER48> set -euo pipefail should NEVER be used in a bash script. If you feel tempted to do so, then you are trying to make the shell scripting language be something that it is not.

This is the time for a full scale programming language such as Python or perhaps Groovy on the JVM or Go language. When you need to write robust code, use the tools that were created for writing robust code.

Bash just has too many quirks.

Note that this is related to the most common way that people build a Big Ball of Mud. You have a simple app and you need a couple of features so you add them on. Rinse and repeat. Before too long you have an app that does too much and was never designed/architected to do that much stuff. You are probably ignoring a number of techniques for integrating functionality in large apps such as message queueing, microservices, separate libraries or packages, multiple languages.

Shell scripts suffer the same trajectory towards too much complexity. When you see it happening, and before the task gets too complex, replace the script with an app and apply all the normal software engineering techniques to make it robust.

<comment><USER49> The good thing about Apache Groovy (on the JVM) is when the big ball of mud starts forming, because its syntax is close enough to Java's, it's easy to quickly split parts off and rewrite it in Java. Only the lambda syntax and some other inconsistencies like the behavior of == are different.

</comment></comment><comment><USER50> I wasn't sure about the title of this post chose to view it when I saw janestreet.com

</comment><comment><USER51> Use sh -c

-c Read commands from the command_string operand instead of from the standard input. Special parameter 0 will be set from the command_name operand and the positional parameters ($1, $2, etc.) set from the remaining argument operands.

</comment><comment><USER52> I still think Bash scripts (or unix scripts, or shell scripts, or whatever they are called) are awful.

</comment><comment><USER53> Use ansible instead of bash.

Everything bash can do, ansible can do it better.

</comment><comment><USER54> There are so many awful things about shell scripting. It's always so difficult to do simple things with it.

</comment><comment><USER55> Why write new bash scripts in this day and age...

<comment><USER56> They are fast, ubiquitous, 0-dependencies, short, espressive... most of the time. The fact is that we don't have anything better to glue commands together (afaik).

<comment><USER57> > 0-dependencies

Actually, quite the opposite. All that shell scripts do is glue together other programs they depend on.

That makes them not portable. You can't just move a bash script from Linux to macOS because it uses ancient pre-GPLv3 versions of bash and all the other GNU utils.

<comment><USER37> Just use POSIX-compatible sh instead of bash. It's also not hard to use mostly POSIX-compatible commands (grep, sed, cat, cp, mkdir ...).

For scripts where you need something unstandardized, say, imagemagick, you would wind up with up with a dependency in most other languages as well.</comment></comment></comment></comment>