Why a federal high-tech start-up is a money loser - <AUTHOR> https://www.washingtonpost.com/news/powerpost/wp/2016/11/02/why-a-federal-high-tech-start-up-is-a-money-loser <comment><USER2> I don't care if 18F makes money, and in some cases it may make sense for them not to.

In a perfect market, they would be able to sell their services at the same price as the value of those services. So if they build a system for the Veterans Administration (VA) that saves $1 million, they should get $1 million for it. Their EOY revenue would reflect their value created.

But they are actually selling to themselves. They are a part of the federal government, and their customers are other agencies. So the price they should charge is actually (value created - effort to get paid).

If they waste $500,000 of man-hours to get that $1m, then the government loses $500k for no reason, other than for 18F to be able to point to $1m in revenue as proof of services provided.

The government as a whole also loses out if price is an issue for the buyer, but a net win for the whole organization. If bureaucracy means that a department isn't willing to spend $1m to reap $2m in savings, because maybe the benefits are nebulous or internal politics or any of the other crazy things that people do in big organizations, then it actually benefits the government as a whole for 18F to do it for free.

While I like that they focus on revenue to prove the impact they are having, selling products to other agencies shouldn't be profit maximizing. Any inefficiencies, either to the buyer or seller, are taxing to the organization.

Side note: $32m is nothing. I'll take that any day over people building GIF hosting and SnapChat.

<comment><USER3> Ultimately, the issue is whether 18F is more effective than other means and accurate accounting is important to that end.

Let's say that the VA gets bids to create a new system for something. 18F says they can do it for $900k and ContractorX says they can do it for $1M. 18F gets the contract and produces a system that cost the VA $900k. Let's say the system cost taxpayers an additional $1M that isn't billed to the VA. That means that taxpayers are out $1.9M rather than $1M going with ContractorX. The issue can be that 18F isn't accurately pricing their services and hiding the actual cost to the taxpayer.

That isn't to say that I like contractors. I don't. But the point of 18F should be to prove that the government can create its own digital services at a lower cost than contractors. If they're "cheaper" in that they're charging agencies less, but then just taking money from a slush fund to cover the fact that they're not efficient, that's not a good thing.

Also, price being "value created - effort to get paid" isn't a good metric. You need to look at alternatives. If a system saves $1M, but you could pay one source $100k for it and another source $900k, you want to go with the $100k source. If we had to pay the value created for things, we'd stop a lot of economic activity. In fact, why would the VA want to do anything at all given that they're going to be charged the full value of any savings? 18F shouldn't be credited with $1M in savings if they spent $900k to achieve it when a contractor could have done it for $100k.

The value of 18F is if they can produce digital services better than other methods. Other methods are generally paying some non-governmental company for the services or hiring direct employees for the agency. In order to determine if 18F is a good model, they need to charge agencies enough to cover their costs. Otherwise, it's ridiculous. Someone in Health and Human Services would say, "we could hire people to do this project directly, but then we'd be paying 100% of their cost, but with 18F they'll charge us a fraction of the employees cost. In fact, we'll tell them to hire the dozen people we were going to hire and we'll only pay X% of the salary rather than 100%".

Plus, if agencies don't have to pay the full cost, they'll do projects that don't make sense. Let's say that a project for the VA creates $1M in savings. 18F says they'll do it for $900k. The VA green-lights it to save $100k. Great, right? $100k for spending on other things. But 18F actually spends $2M on the project. The VA gets another $100k in their budget, but the government is actually down $1.1M. When people see situations like this, they want to take advantage of it since they're able to basically spend other people's budgets. "If you use 18F, a bunch of the money for your project doesn't come from your budget," is the kind of thing higher-ups dream of.

I think 18F will get better at this. Figuring out how much one needs to charge is hard since it's hard to know exactly how much effort a project will take. I'm guessing that 18F is looking to generate good-will with agencies rather than going back to them with cost over-runs. Still, 18F needs to prove that it's a more effective way than alternatives and it can't do that by just under-charging and subsidizing whatever projects they get given. If 18F just offered free services, then every agency would want infinite 18F work (since it isn't coming out of their budget). Then which projects should be worked on? The ones 18F finds interesting? 18F wasn't created to be the arbiter of what the government should do. As such, they need to price accurately based on their costs. They will get better at this. They will likely have to start passing along cost over-runs to agencies. But if they get great, motivated people, they could provide digital services at a lower cost - it just has to actually be a lower cost.

Even if you hate contractors, a lot of agencies have tens of thousands of employees. Health and Human Services has ~80,000 employees. The VA has ~313,000 employees. _Why shouldn 't they just hire an engineering team? Why should they outsource a project to 18F?_ Agencies that large certainly have enough engineering projects to keep an internal team busy. They're not some restaurant that outsources their website because they don't have enough work to keep a dev busy. Well, maybe 18F can gain efficiencies through hiring better people at higher pay who can create better code and re-use stuff across agencies. Or maybe the overhead of outsourcing outweighs those efficiencies. That's something important to figure out and it's an answer that we can get closer to if 18F accurately charges agencies.

<comment><USER4> "Let's say that the VA gets bids to create a new system for something. 18F says they can do it for $900k and ContractorX says they can do it for $1M. 18F gets the contract and produces a system that cost the VA $900k. Let's say the system cost taxpayers an additional $1M that isn't billed to the VA. That means that taxpayers are out $1.9M rather than $1M going with ContractorX."

If the government is paying itself $900k from one department to another, how are they out $1.9m?

<comment><USER5> Those $900k are not staying within "the government", they are being spent in salaries, machines, services or whatever. Total government spending would be $1.9mn in that case, $1mn with the contractor option.

</comment></comment></comment></comment><comment><USER6> Activities that can't be billed to other agencies are another drain. One example is staff time totaling 727 hours on a logo change. The old logo was a blue square with 18F in the lower-right-hand corner. The new logo, a black square with 18F centered and a different font, wasn't worth the time and doesn't look as good.

for anyone else curious:

(new) Black Logo: [https://18f.gsa.gov/assets/img/logos/18f-logo.svg](https://18f.gsa.gov/assets/img/logos/18f-logo.svg)

(old) Blue Logo: [https://upload.wikimedia.org/wikipedia/commons/b/b3/18F_logo...](https://upload.wikimedia.org/wikipedia/commons/b/b3/18F_logo.png)

<comment><USER7> Meh. I'm sure google spent millions on their logo change, and it was just a font tweak. Hackernews was gushing. God knows what they spend per week on google doodles.

There's no winning here for 18f. Either their sites are archaic disasters and they are criticized for not being up to par with the top tier consumer sites. Or they spend some money to bring them up to par and its "OMG! An $800 toilet seat!"

<comment><USER8> I _want_ government sites and buildings to look like archaic disasters, because it at least implies that my tax dollars aren't being pissed away on frivolous opulence.

Google can spend ten billion dollars changing their logo because they're profitable and they answer to their board & shareholders. I don't remember anyone asking me if I wanted to contribute money to a government tech startup.

<comment><USER9> "I want government sites and buildings to look like archaic disasters"

And what do you propose doing about people who use arguments of the form: "Can you believe this government $thing? It looks like an archaic disaster. Government can't do anything right. Therefore..."

<comment><USER10> We'll have those people either way. Just ignore them

</comment></comment></comment></comment></comment><comment><USER11> Did I misunderstand or is the story also - A government department was started with the ambitious goal of "zero budget" and this year with a 183 person team will have recovered 68.75% of its costs.

And did we forget that fast growing startups don't usually break even either?

<comment><USER12> But fast growing startups are funded by private investors, not taxpayers.

<comment><USER13> And fast growing startups are usually working _for_ private investors, not taxpayers.

</comment></comment></comment><comment><USER14> I'm currently working for a UN-agency as a contractor, and my team is modelled in a similar way, like a private development agency so to speak (calling us and 18F a startup is a bit click-baity IMO). We only work internally for our agency, not the whole UN, but there are structures like that too - e.g. ICC provide ISP and hosting services to the whole UN. I'd imagine it's a fairly common structure in large companies/organisations.

Anyway, whenever a department wants a new IT project they have the choice of releasing a tender to the public or going to us. We then work like an agency, providing an estimate, then billing them for X days of development.

The first bit where it gets tricky for us, and I'd imagine 18F, is the specs usually aren't clear. Customers decide they want something different, didn't explain what they wanted properly, or something just takes longer than you estimated. Unlike an agency we have to deal with the code and people for a long time, so we can't just say "no you only payed for X days work" and leave something broken.

The other part is maintenance - that is paid for by our internal budget, but as with any software projects there are always tweaks/changes that need to be done. Unfortunately the level of beuracracy is quite high, so getting budget for something that is say 3 days work is more effort than it's worth, so it often just comes out of our budget.

Anyway, even if we lose money I think it's a lot better for us to do this than an external agency. For starters an external agency would be a magnitude more expensive. As we know all our systems we can recommend and build systems that are more integrated with each other, where as an external agency would just build one system in isolation as per the spec. I'd imagine it's similar for 18F.

Our design decisions are Bootstrap for everything, so no we aren't spending a crazy number of hours on just a logo :-)

</comment><comment><USER15> This is disappointing to read, given I love what 18F has done. No matter whether we think they _should_ be breaking even or not, they shouldn't be creating wildly inaccurate revenue projections and then falling drastically short of them. That looks like something is going drastically wrong with management there, especially considering greater macroeconomic conditions have not changed drastically enough in a way that would cause something like this. I'd hope there is something other explanation though.

<comment><USER11> How many fast growing startups have accurate financial projections?

<comment><USER16> But most [investors|employees] disapprove of bad projections.

<comment><USER17> That's typically a hindsight position.

</comment></comment></comment></comment><comment><USER18> It is clear that they have not billed enough to break even internally, but have they saved/made more for other agencies to break even for the government overall?

Presumably (maybe a bad presumption), agencies that use their services save more/make more than they are billed for.

It would be a shame to kill a group that was saving money overall because they did not bill enough internally.

</comment><comment><USER19> The sniping about 18F seems pretty transparent: federal IT shops don't want to do anything differently, and private IT vendors don't want any more competition for their contracts.

18F might be one of those ideas where you can tell that it's working because it's getting attacked.

</comment><comment><USER20> One piece of 18F that I've always appreciated is their published API standards - [https://github.com/18F/api-standards](https://github.com/18F/api- standards). They spawned it off the frequently mentioned White House API standards, and it phrases a lot of the opinions well without being preachy.

But more than anything else, this made me feel like there are real humans behind 18F. So I wish them all the best and hope this article (and ones like it) falls into the camp of "Haters gotta hate" and just inspires them to find more visible success.

<comment><USER21> I fully agree that they should be doing stuff like this... but I doubt it falls under billable hours.

With all the government outsourcing it's difficult to have a consistent stack. I have hopes that 18F brings some sanity.

</comment></comment><comment><USER22> > The new logo, a black square with 18F centered and a different font, wasn't > worth the time and doesn't look as good.

That was a really odd injection of opinion to read in what appears to be a news piece.

<comment><USER16> A surprising number of news pieces actually end up giving you some sort of opinion.

As a made-up example, a news article on Samsung's falling stock might focus on its Note 7 failures, making the assumption (and thus giving the reader the impression) that the mobile phone is the main cause of the company's decreasing revenues, when in fact the company's general electronic components sales have been dying for months. But this slow decrease is much less sensational and might've missed the headlines. This sort of "opinion" is far more difficult to notice, but still exists in reporting in the form of attempting to speculate on the reasons behind the facts.

This article just happens to be particular blunt about its assumptions.

<comment><USER23> > This sort of "opinion" is far more difficult to notice, but still exists in > reporting in the form of attempting to speculate on the reasons behind the > facts.

But that's how it's usually marked – as a seperate, independent part of the article, marked opinion or speculation, or by putting it in context.

</comment></comment></comment><comment><USER24> Hi Silicon Valley! Thanks for visiting our nation's capitol!

kisses,

DC

\--

Seriously, this shouldn't be surprising. It's a noble effort, the work is probably worth the so-called "losses", but the reason the government is the government and not Silicon Valley is that in government, there are a bajillion rules to keep you from screwing up too badly.

There's been a fetishization in DC of Silicon Valley techniques, but 1) it's not at all clear that the current Silicon Valley ethos really is worth replicating, and 2) the conditions aren't right here, it can't be replicated without fundamentally changing the conditions. One of the conditions is that there's oversight over everything, and there's the press.

One little article in the federal section of the Post isn't going to kill off anything alone, but it will be interesting to see what happens to 18F after the presidential transition. If there isn't high level cover for it, it will be ground to dust.

<comment><USER25> It is people that make the difference, not the place or techniques.

<comment><USER24> Well, the people here in DC are rule-makers and rule-followers. So there are a lot of rules and a lot of people enforcing the rules.

</comment></comment></comment><comment><USER26> 18F gives me the creeps because of [https://18f.gsa.gov/2016/01/12/hacking- inclusion-by-customiz...](https://18f.gsa.gov/2016/01/12/hacking-inclusion-by- customizing-a-slack-bot/)

Something about government robots and goodspeak speech correction feels Orwellian, even if it's really tiny.

<comment><USER27> Ha ha ha this Americans and their political correctness. I cringe every time I see things like this and the HN community doesn't escapes from it, in fact, I have seen more _" political correctness"_ towards sexism here more than in other communities on the Internet _(at least the ones I visit)_. I still do not understand why people pay so much attention to these things. I can only imagine how people would react in countries with a language with Latin roots like French, Portuguese, Spanish where there are multiple ways to refer to a individual or group of people with different genders more than in neutral languages like English.

<comment><USER28> > I still do not understand why people pay so much attention to these things.

Quite a lot of people who respond as you do actively don't want to understand. But in case you're one of the ones who is actually curious:

Historically, sexism has been a problem. For millennia, women were basically property. The last couple hundred years, we've been unwinding that. E.g. less than 100 years ago, women finally got to vote. They didn't have equal access to credit cards until 1974. In the 1990s, US states finally all made marital rape illegal. In the early aughts, women reached parity in the proportion of people getting medical and legal degrees. (The proportion of actual doctors and lawyers hasn't caught up yet; it's around 33% now, and I'd guess it will hit 50% about 2040.)

One place that sexism still resides is in language. That language at least sometimes shapes thinking. Many women in professional contexts reasonably object to gendered language that excludes them. So to be polite, many workplaces are shifting to use more inclusive language.

So, TL;DR: we're in the middle of overturning millennia of pervasive sexism, a language shift is part of that, and if we're lucky we'll be done with the project in only decades.

<comment><USER29> What is your solution for gendered languages?

<comment><USER30> Regardless of what speakers of those languages do, we can do everything we can to remove gender bias from English. We don't have to keep doing something just because others are doing it.

<comment><USER28> Yup. I don't have a solution for gendered languages because it's not a problem I deal with much. I'm going to work on English, and I'll trust that other people will find the right solution for their cultures.

<comment><USER31> Are you working hard at not referring to ships using a feminine pronoun (i.e. "this is her maiden voyage")?

<comment><USER28> Nope. Gendering ships has always felt awkward to me.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> They're essentially an internal dev/consulting shop and they needed to approach it from this stand point or they'll continue to be underwater. Every contract that IBM or Accenture, et al wins, 18F should have made the sale that they'll be there guarding the hen house as the project progresses - easy sale and easy project staffing. Branch off from there and take down small dev jobs to build mass and it'll snowball from there if managed properly.

Leadership heads need to roll, ranks thinned, and they need to focus on the mission.

<comment><USER33> So they should nickel and dime them on scope changes and deliver solutions that meet the requirements but are useless? I know I'm straw manning a bit here but asking them to operate like these contractors is highly questionable. Their mission isn't to be cheap and competitive but to change how the government uses technology and make it more agile. To drive culture changes and set standards that allow government agencies to produce solutions that are aligned with their goals.

How many failed government IT projects have we read about that fulfilled a contract but was ultimately useless? Or stories about government inefficiencies and a failure to keep pace with modern technology?

I don't know why there's an expectation that they do this cheaper or at the same price as government contractors. Have we forgotten what happened with the healthcare.gov site already?

</comment></comment><comment><USER34> I love 18F! A few months back they published a set of web design standard [0] that I really liked. Accessibility is among their top concerns, so it's legible in all devices and there's a lot of contrast.

I used their color suggestions for my blog [1] (still haven't updating syntax highlighting, terribly sorry about that). The two things I changed were typography sizes and fonts. I decided it would be best to use preinstalled fonts instead of loading a third-party font. I don't think third-party fonts justify slower load times for a static website like my blog. But overall, I really like their color scheme, as it's very comfortable to read on any screen.

[0] [https://standards.usa.gov/getting- started/](https://standards.usa.gov/getting-started/)

[1] [https://blog.cesarandreu.com/](https://blog.cesarandreu.com/)

<comment><USER35> Doesn't it seem wasteful that 18f spent all that time on the standards, instead of maybe a guide/theme on how Gov't sites should adapt, already open- sourced (bootstrap), frameworks?

<comment><USER36> Take a look at [https://github.com/18F/web-design- standards/blob/staging/LIC...](https://github.com/18F/web-design- standards/blob/staging/LICENSE.md) and count the number of existing open- source projects which they're re-using. This looks to me like an experienced team who did their homework to assess how much flexibility and control they needed and reused as much open-source as possible while still meeting their other requirements.

</comment></comment></comment><comment><USER37> FTA:

> "Since its launch in March 2014, 18F has struggled financially," says GSA's > Office of Inspector General (IG), citing loses every year, now totally over > $31.6 million.

And from a random site that seems to agree with a few others:

> In fiscal year 2015, military spending is projected to account for 54 > percent of all federal discretionary spending, a total of $598.5 billion

In 3 years 18F has spent 31.6 million. Even if it lost 31.6 million every year, it could do that for NINETEEN THOUSAND YEARS and still not equal what we spent on the military in one year.

Imagine a country where 18f had a budget of 600 billion dollars a year.

<comment><USER26> I don't get your point at all, I'd say the US's ability to project force is worth 19,000x a year more to me than what 18F does.

<comment><USER37> Why is it that 18f _lost_ ~10 million dollars a year, but the military does not _lose_ 600,000 million dollars a year?

Sounds like a double standard to me.

<comment><USER38> It's about what an organization spent compared to their budget. It sounds like 18F was budgeted $0 since they were expecting to earn back their costs in revenue by charging other agencies for their services. Since they did not fully recoup their costs, they "lost money".

If you budgeted the military $1 trillion and they spent $1.1 trillion, then they would also have lost money.

</comment></comment></comment></comment><comment><USER39> They could've created feature/bug bounties and/or grants for open source contributors, and tried to build an open source community around what they're building. This would naturally attract/increase volunteer contributions, but they might also be able to control costs better with such a model.

18F is an uniquely special position since they are building software for the general public, and so are in a great position to attract OSS contributors, as contributing to 18F would be a way of helping your community/country, and would make people feel better.

<comment><USER40> They've actually done almost exactly this and are working to scale it up within limits of contractor system:

[https://micropurchase.18f.gov](https://micropurchase.18f.gov)

<comment><USER39> Wow, Micro-purchase @ 18F is very awesome. That is exactly what I had in mind -- it's so cool they're already doing it!

</comment></comment></comment><comment><USER41> _One example is staff time totaling 727 hours on a logo change. The old logo was a blue square with 18F in the lower-right-hand corner. The new logo, a black square with 18F centered and a different font, wasn't worth the time and doesn't look as good._

How is that even possible?

<comment><USER42> 727 hours is a team of 10 working for less than 2 work weeks. Or a team of 6 having a couple 1-hour meetings with other groups in addition to doing the design work. It'd be hard for any medium to large organization with an internal design team to rebrand without using hundreds of hours of staff time.

<comment><USER43> that said, assuming you are working in the US, are you willing to work an extra few minutes over the course of the next year to generate the tax revenue for this?

<comment><USER19> The entire budget of 18F is about 10 cents per taxpayer. 700 staff hours is far below a penny per taxpayer. I'm fine with it.

In addition, most 18F employees are salaried, so this is not likely to be an actual cost overrun, but rather an opportunity cost.

</comment></comment></comment></comment><comment><USER44> > Activities that can't be billed to other agencies are another drain. One > example is staff time totaling 727 hours on a logo change. The old logo was > a blue square with 18F in the lower-right-hand corner. The new logo, a black > square with 18F centered and a different font, wasn't worth the time and > doesn't look as good.

I thought newspapers were supposed to report facts, and leave opinions to either the op-ed pages, or quotes from sources. Who made Joe Davidson a design critic?

</comment><comment><USER45> Why is this a problem?

IT is a cost center in most organizations, not a profit center. 18F serves a similar function - it streamlines other organizations, with the hope being that at the end, the cost savings in those other orgs is more than the cost to run 18F. As long as we are saving money overall, then less taxpayer money has to be shelled out to keep the country running, and it is a win. Or am I missing something?

</comment><comment><USER46> If they booked 0 in revenue but helped other agencies save money by lower procurement cost or generate revenue, is that a problem?

<comment><USER47> I assume their financial model is to charge agencies for their services. Often times by competing with private vendors. If such an agency is 10 percent over budget, it means they're undercharging agencies by that much. By failing to charge their true cost, they're potentially undercutting vendors who would have cost the taxpayers less overall.

It sounds like upper management doesn't want to do the hard work of accurately pricing their services, or maybe is intentionally undercharging to ensure they get to provide the service. In some ways, they're definitely in a bind -- if they undercharge, they're crowding out private competition, and if they overcharge, they look like greedy bureaucrats.

</comment></comment><comment><USER48> I have a unique perspective here, as I helped run a .gov (although not at the Federal level) that aspired to run as a self-supporting business.

It's difficult to do because the government isn't a business, and the decision cycle isn't the same as a commercial. Government is appropriation based, uses cash accounting and _loves_ capital expenses. Businesses are diametrically opposite.

There's also a weird calculus for what factors into an ROI calculation and what doesn't. If money is appropriated, there's little incentive to reduce spending (and incentives _to_ spend unnecessarily!) and rate structures don't influence decisions.

In short, I'm not supportive of government waste, but it's pretty clear that any money appropriated to 18F is delivering a positive return. The OMB people should address the perceived shortfall by just taking money away from targeted programs.

</comment><comment><USER49> "The new logo, a black square with 18F centered and a different font, wasn't worth the time and doesn't look as good."

LOL now WaPo writers are also design critics. There's no citation for this statement, it's literally just the author talking shit in an ostensibly "news" article.

</comment><comment><USER50> Alternate title: Government agency produces many times more value than its miniscule 32 million USD cost.

</comment><comment><USER51> 2014: $0

2015: $22.26 million

2016Q3: $27.82 million

This looks like encouraging growth to me.

</comment><comment><USER52> The issue here is showing the world how it is possible to be in government and still produce modern open software development.

It is about changing the game not making a profit.

Government software should be all open source ([http://www.oss4gov.org/manifesto](http://www.oss4gov.org/manifesto)) but it should also be developed using modern best practises - which is what the GDS in U.K., 18F in the US are trying to prove - they are trailblazers, not profit maximisers.

</comment><comment><USER53> If 18F means a single healthcare.gov disaster is averted, doesn't it basically pay for itself?

</comment><comment><USER54> The article is remarkably uninformative. Is 18F doing a terrible job at consulting? Or at navigating governmental accounting? It does matter.

</comment><comment><USER55> Looks like some big bloated money-wasting federal contractors that are seeing their margins hit by 18F caught the Post on a lazy day and had their Press Sec feed the Post a pre-written piece so the reporter could get to happy hour early. I expect better from the WP.

</comment><comment><USER56> Two questions: How much do they pay? Where are they located?

That should be enough to determine if they have any chance at success.

\---

I worked for government projects in a small European country. It was actually a decent job in a decent company. I could recommend to people to work there. Salary and perks were average for the area, shit for the world (not much room to do better in the area, no great companies).

IMO: In the major USA locations, this has absolutely no chance to work. There are numerous tech companies who will offer better pay, better work conditions and better perks. Anyone will a brain cell would just go to a tech company and avoid government like the plague.

And if someone wanna try anyway, he'll quickly realize that all his peers are elsewhere, and he's gotta leave to join them.

</comment><comment><USER57> 18F is the Military Occupational Specialty code for something in Special Forces, that can't be a coincidence.

</comment><comment><USER58> Whether or not it's worth the money, many true startups that lose that much money die out. The threat of dying off if the company can't figure out how to get sufficient revenue is one major source of creativity in startups. So, it's just another government agency.

</comment><comment><USER59> The real question is if the start up model will extend to them going bankrupt and being shut down if they don't reach at least break even in X amount of time. If not then they were never really a startup model they were just a standard bureaucracy.

</comment><comment><USER60> Government imitating Silicon Valley again.

</comment><comment><USER61> Because most startups lost money ?

</comment><comment><USER62> Governments can never provide value like this, government is not a business! Sometimes this trade off is worthwhile. I'd like to have my housefire put out in a timely fashion. I will sacrifice some of my income for this. However, the idea that the government can become some kind of silicon valley startup is just absurd. I can't believe as taxpayers we are forced at gunpoint to fund these ridiculous ideas. And people wonder why we are 20 trillion in debt and our currency is being devalued every year.

<comment><USER28> This is actually intended as a cost-saving measure. Government IT is enormously snarled. Quite a lot of money is spent on outdated systems and giant contracts with enormous overruns. Very few people with serious technical chops actually want to work for the government as a lifetime career choice.

The theory of 18F is that you bring in high-grade technical talent for 2-4 year stints. You have them jump in to help unsnarl knotty problems, using approaches that are obvious to we Silicon Valley types but not widely adopted in government IT circles.

I know all this because a couple of years back I interviewed with them. I decided to stay in private industry, as I didn't want to leave SF. But they have a lot of really smart and dedicated people who want to change the way the US government does technology, making it faster, cheaper, and more effective.

So I think the real question is not, "How much was spent?" but "How much did they save?" That's a harder question to answer, but I think it's the only real way to evaluate 18F as an initiative.

</comment></comment><comment><USER63> that 727 hours for a logo change is pretty wild. here's the difference: [https://twitter.com/deanc/status/794150888940113920](https://twitter.com/deanc/status/794150888940113920)

</comment><comment><USER64> LOL! Who was expecting different results ? Fatcats in DC use our money to gamble over programs and lose the money. This is not the first nor the last in fact this is the template in which major plans like Obamacare have been molded.</comment>


The Comcast MIT Career Fair Programming Challenge - <AUTHOR> https://www.linkedin.com/pulse/article/20140920001500-7852436-the-comcast-mit-career-fair-programming-challenge

<comment><USER2> It took me longer than I'd like to get all three solutions but I sure had fun finding them. Two are easy while I had to think more to get the third.</comment>


Microsoft: 70 percent of all security bugs are memory safety issues - <AUTHOR> https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ <comment><USER2> Just a painful reminder that they scrapped Midori[0] their managed Operating System based on Microsoft Research's Singularity project[1].

Even if it only replaced Windows LTSB/Embedded, I'd still prefer an ATM, checkout, or gas station terminal I was using was running on managed code. Doubly so for the next generation of Nuclear Powered submarines[3].

Plus between virtualisation and silo-ed software management ("Apps") it seems entirely plausible to move the PC/Laptop to the next generation.

[0] [https://en.wikipedia.org/wiki/Midori_(operating_system)](https://en.wikipedia.org/wiki/Midori_\(operating_system\))

[1] [https://en.wikipedia.org/wiki/Singularity_(operating_system)](https://en.wikipedia.org/wiki/Singularity_\(operating_system\))

[3] [https://mspoweruser.com/uks-nuclear-submarines-runs- windows-...](https://mspoweruser.com/uks-nuclear-submarines-runs-windows-xp- submarines/)

<comment><USER3> Midori, as cool as it was, was Microsoft's "no output division" (see [https://archive.computerhistory.org/resources/text/DEC/dec.b...](https://archive.computerhistory.org/resources/text/DEC/dec.bell.no_output_division_C- I_TF;productivity_review.1982.102630376.pdf) for context). It existed so that very senior engineers wouldn't go elsewhere and cause trouble for Microsoft. It had fullfilled its purpose in that regard. I strongly suspect that some of Google's more ambitious endeavors serve the same purpose.

<comment><USER2> > Midori, as cool as it was, was Microsoft's "no output division"

Considering you have absolutely no proof of that it seems rather disrespectful to act like that's a fact rather than your supposition.

<comment><USER3> It always cracks me up when people demand "proof" of something like this. I mean, I know some of the people from there from way back, and the project was eventually canceled, so there literally was "no output". And they had pretty much complete carte blanche on everything and could bikeshed over the most inane and inconsequential things for months on end. It was a fun "job" while it lasted, though.

<comment><USER2> Now I'm starting to wonder if you even read the "No Output" letter and understand its implication? You essentially called a bunch of Microsoft employees productivity drains on the rest of the company.

The fact that you think a cancelled project means it is the same as DEC's "No Output" team likely means you don't understand what the "No Output" team even was at DEC or the implication for the people within it.

You absolutely do need to present proof of what you're saying, because it is a serious charge for both Microsoft and those employees alike.

</comment></comment></comment></comment></comment><comment><USER4> I hope Rust comes of age in a few years. Java, Go, and C# are above 50% "native" speed in every benchmark I've run across, but the mantra continues to be "why would I pick something slower?".

Rust is the answer everyone wants, even if they don't really need it.

An aside, C# in .NET core is getting very close to native speed. It's passed Java in many benchmarks, mostly due to type reification and lack of boxed primitives.

Java is trying to catch up, with active research projects for copying C#'s native types, a "Java on Java JIT" (Graal). And most interesting to me, fiber based green threads.

If these projects bear fruit, we may be only a few years away from Java exceeding native code speed in most applications

<comment><USER5> I hardly use C++ since 2006, only when I am forced to step outside Java/.NET or happen to actually do some hobby projects in C++.

Meanwhile at work, a couple of C++ servers have been replaced by managed ones across a couple of projects.

Even with the current stacks, not every business needs the ultimate performance across all stack, as an example Siemens and Zeiss use .NET on their digital imagining solutions, with native code only in the hotspots.

</comment></comment><comment><USER6> It's a pity Modula-2 did not gain wider adoption 30 years ago - it has almost all the memory safety of managed languages and none of the performance penalties. Array bounds were checked by compiler and the only available unsafe operation was deallocate, all other unsafe operations were sequestered into separate module which could be easily isolated, audited, and/or banned as appropriate. Life could have been so much better.

<comment><USER7> Luckily now we have Rust! :)

<comment><USER6> 30 years of pain tho? Plus however many more years it will take to phase out existing C-based code, so another 30 at least.

<comment><USER8> It depends how it gets prioritized by the companies that own and contribute to these codebases - both open and private source. Right now there's not much incentive financially to migrate away from any of the existing code, so more often than not it will not happen.

One reason why we're seeing stuff like the [FirecrackerVM]([https://firecracker-microvm.github.io](https://firecracker- microvm.github.io)) or [AzureIoTEdge]([https://github.com/Azure/iotedge](https://github.com/Azure/iotedge)) is that the companies behind them know they will attract privacy-/security- minded customers they might not otherwise have.

There's other reasons as well, but this is just what stands out to me first.

</comment></comment></comment></comment><comment><USER9> As an industry we should deprecate all unmanaged code. We've proven time and time again that even very professional and highly scrutinized unmanaged code can have critical data safety faults.

Yes, I understand this includes Linux, Windows, BSD, Darwin (iOS, MacOS, watchOS, etc), The Android Runtime, and lots of critical software that runs on top of those systems.

We have the tools to write very efficient managed code. Critical security flaws involving unauthorized access to data will continue to appear until we make the transition. The cost of these security flaws is likely to become more expensive than the cost of replacing the existing software. To make matters worse we are continuing to write more unmanaged code everyday.

<comment><USER10> _The cost of these security flaws is likely to become more expensive than the cost of replacing the existing software._

Expensive to whom? When was Microsoft or RedHat or Oracle or the FreeBSD foundation last fined or sued because of a security flaw - an unmanaged memory one, specifically?

When was a random company or developer fined or sued for same?

<comment><USER9> The bandwidth costs for Globalsign incurred for revoking SSL certificates in response to Heartbleed was estimated to $400K in a Cloudflare blob post [0] and eWeek estimated the total cost of Heartbleed to be $500M [1], although admittedly this price tag is an educated guess.

You're question is expensive to whom. The answer is the expenses are spread across the entire industry. Every time a software author needs to write a patch the bigger cumulative expense is to all of their customers that need to apply the patch.

[0] [https://blog.cloudflare.com/the-hard-costs-of- heartbleed/](https://blog.cloudflare.com/the-hard-costs-of-heartbleed/) [1] [https://www.eweek.com/security/heartbleed-ssl-flaw-s-true- co...](https://www.eweek.com/security/heartbleed-ssl-flaw-s-true-cost-will- take-time-to-tally)

</comment></comment></comment><comment><USER11> Rust couldn't solve all of these bugs, but it certainly would have drastically reduced the total amount. The code would also be drastically easier to write and debug. C++17 is still a total mess to write, despite what Microsoft might tell you in their docs. Really doesn't make sense to me, outside of the sunk cost fallacy, why Microsoft isn't pivoting to Rust if they want to write C++.

<comment><USER12> you could ask the same question for every os. And none choose Rust even the recent like fushia. BTW go ask Linus to switch to Rust I'm waiting for you there.

<comment><USER11> Fuchsia is using Rust for some pieces. That's what I assume MS would do. MS is a company with tons of products, not just an OS, and certainly not a single monolith. You wouldn't rewrite everything in a day, you would slowly move things over time.

</comment></comment></comment><comment><USER13> To quote the article:

```

Furthermore, as Microsoft has patched most of the basic memory safety bugs, attackers and bug hunters have also stepped up their game, moving from basic memory errors that spew code into adjacent memory to more complex exploits that run code at desired memory addresses, ideal for targeting others apps and processes running on the system.

```

Is all we can hope for in the security game a series of mitigations? As soon as we add layers of security (Stack cookies, ASLR, memory "safe" languages with exploitable runtimes, etc.) it seems like new methods are invented to bypass them and those methods gradually become widespread (ROP chains, runtime fuzzing, rowhammer, speculative execution exploits). What is the next "70 percent" of security bugs? Is there an end to this race?

I think the only thing in the future that can ever be as secure as in-person conversation and paper records is devices using zero-intermediary communication, in the style of an ansible [https://en.wikipedia.org/wiki/Ansible](https://en.wikipedia.org/wiki/Ansible), and extremely restricted storage which can only store data and not arbitrary application state.

<comment><USER14> sel4 shows that an endgame is possible wrt to memory safety, it's formally verfied to be memory safe.

It's sitting at ~25 to 1, proof code to implementation code. I think you could probably get that down to 5 to 1 or so by treating a lot of the work they did as a library. The proof covers a full equivalence from abstract spec to machine code, and you could reuse a lot of that. Sort of how it's not fair to include the LOC of your compiler even though you need that for your program ultimately.

<comment><USER15> That's not an endgame if the resources required to block an attack are significantly greater than those required to make one. Moreover, verification is done with respect to specific properties that ensure no attacks of a _particular kind_. The more kinds of attacks you need to defend yourself from, the harder you need to work (and you will miss some). Not saying we're not making steps in the right direction, but no one thinks it's an endgame.

<comment><USER16> > Moreover, verification is done with respect to specific properties that > ensure no attacks of a particular kind.

No. seL4 proved functional correctness. It eliminates all attacks, not just particular kinds.

Functional correctness means implementation matches specification. As a corollary, seL4 has no buffer overflows. Proof: Assume seL4 has a buffer overflow. Exploit it to run arbitrary code. Arbitrary code execution is not part of specification, hence implementation does not match specification, leading to contradiction. QED.

Above proof applies to use after free, or any other exploits enabling arbitrary code execution, including methods which are not discovered yet.

<comment><USER17> I read this and thought, "this can't be right, they must be assuming some things."

According to them, they, sensibly, are indeed assuming some things to be correct without proof: [http://sel4.systems/Info/FAQ/proof.pml](http://sel4.systems/Info/FAQ/proof.pml)

This is effectively the same idea behind Rust's `unsafe`. It represents the things you assume to be true. Of course, when compared to seL4, the scales are massively different. :-)

</comment></comment></comment></comment></comment><comment><USER18> > Terms like buffer overflow, race condition, page fault, null pointer, stack > exhaustion, heap exhaustion/corruption, use after free, or double free --all > describe memory safety vulnerabilities.

Page faults are fine. Null pointers are fine; just don't dereference them. Race condition is a much more general term that can cover non-memory races too; perhaps they meant data races.

<comment><USER19> Yes, I don't think race conditions should feature in a list of memory safety issues. However page faults can be _not_ fine - on some hardware it can be a hard fault.

</comment></comment><comment><USER20> Link to the presentation this article is based one but doesn't site for some reason: [https://github.com/Microsoft/MSRC-Security- Research/raw/mast...](https://github.com/Microsoft/MSRC-Security- Research/raw/master/presentations/2019_02_BlueHatIL/2019_01%20-%20BlueHatIL%20-%20Trends%2C%20challenge%2C%20and%20shifts%20in%20software%20vulnerability%20mitigation.pdf)

</comment><comment><USER21> First 38% of bugs at Airbnb could have been prevented by using type safety. Now 70% of all security bugs at Microsoft could have been prevented by using memory safety.

<comment><USER4> Exactly, this explains why my Java code is 108% bug free

</comment></comment><comment><USER22> In 2015 they become the first gold contributor to OpenBSD

[https://www.zdnet.com/article/microsoft-becomes-openbsds- fir...](https://www.zdnet.com/article/microsoft-becomes-openbsds-first-gold- contributor/)

</comment><comment><USER23> we should all be using Rust then :)

<comment><USER24> > Microsoft: 70 percent of OUR security bugs are memory safety issues

Fixed the title. This is not an analysis about general software errors.

<comment><USER25> Every project with millions of lines of C or C++ is going to be around the same, Firefox is over 50% as well.

</comment></comment></comment><comment><USER26> This late? With Microsoft's move to C# and the Static Driver Verifier? The latter pretty much fixed this for drivers, which used to be the biggest source of kernel crashes. I thought Microsoft was past this.

<comment><USER5> There is still a strong C and C++ community at Microsoft.

They are the only OS vendor (on consumer space) still having a full stack support for C++, with internal pushes to keep it going.

[https://kennykerr.ca/2019/01/25/the-state-of-cpp-on- windows/](https://kennykerr.ca/2019/01/25/the-state-of-cpp-on-windows/)

</comment></comment><comment><USER27> Where can I find the original presentation from Microsoft's engineer?

<comment><USER28> [https://twitter.com/epakskape/status/1093488162318491648](https://twitter.com/epakskape/status/1093488162318491648)

[https://github.com/Microsoft/MSRC-Security- Research/blob/mas...](https://github.com/Microsoft/MSRC-Security- Research/blob/master/presentations/2019_02_BlueHatIL/2019_01%20-%20BlueHatIL%20-%20Trends%2C%20challenge%2C%20and%20shifts%20in%20software%20vulnerability%20mitigation.pdf)

</comment></comment><comment><USER29> Fuzz testing is a useful tool for finding these types of bugs. See [https://en.m.wikipedia.org/wiki/Fuzzing](https://en.m.wikipedia.org/wiki/Fuzzing)

</comment><comment><USER30> 29% SQL Injection?

</comment><comment><USER31> Linux is also written in C.

<comment><USER32> And it has MORE reported CVEs than Windows:[https://www.cvedetails.com/top-50-products.php?year=2018](https://www.cvedetails.com/top-50-products.php?year=2018)

<comment><USER33> It's also OSS and it is much easier to surface security bugs for Linux than for Windows.

In my own research, I have attempted to send Microsoft security bugs only to be told they would be backlogged and reviewed later (which never happened to my knowledge).

<comment><USER32> > It's also OSS and it is much easier to surface security bugs for Linux than > for Windows.

Shouldn't then the number of bugs decrease much faster, since they are easier to find? Unless they are introduced at even a greater rate than the ones in Windows.

<comment><USER16> You are right. One current estimate is that Linux is introducing security bugs at a rate faster than they are fixed.

<comment><USER34> New and better tools are finding bugs in old code, so it isn't really that more and more bugs get into new code:

 _" But, your editor wondered, could we be doing more than we are? The response your editor got was, in essence, that the bulk of the holes being disclosed were ancient vulnerabilities which were being discovered by new static analysis tools. In other words, we are fixing security problems faster than we are creating them. "_

[https://lwn.net/Articles/410606/](https://lwn.net/Articles/410606/)

</comment></comment></comment></comment></comment></comment><comment> hk-mars 90% of these memory bugs of MS are related to C++, bad designers I think; C is still good in low level of system hack.

<comment><USER5> Google thinks otherwise, hence Linux Kernel Self Preservation Project.

<comment><USER34> Kernel Self Protection Project (:

[https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr...](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)

<comment><USER5> I always get it wrong. :)</comment></comment></comment></comment>


Humble Bundle Books: Artificial Intelligence - <AUTHOR> https://www.humblebundle.com/books/artificial-intelligence-books <comment><USER2> I've read mixed reviews about PacktPub- can anyone comment on the quality of these?

<comment><USER3> They are very hit or miss. On balance, I don't bother with them, unless there's something interesting looking on their daily free book page, or it's one of these bundles where they come out to $.75 apiece.

Some of the ones I've gotten don't look like they ever got near an editor, or even a spell-checker.

If I'm going to spend money and time, I'd rather go to Manning and have some confidence that it'll be quality.

<comment><USER4> When they contacted me to write for them I did a bit of research I found enough horror stories to not follow up. In fact it just confirmed the feeling I got as a reader.

Go with Manning, PragProg, NoStarch or even (with some caution) O'Reilly if you want quality content.

<comment><USER5> As someone who writes for Packt (Posting under a throwaway for obvious reasons), I think you made the right decision. The first title I was proud of, had good editorial control and decent technical review. The second title had an awful premise that was insisted upon and stunningly poor editorial control. Disappointingly I now feel like I have to apologise for something that carries my name.

My next title will be self-published onto Github on a 'freemium' model. It'll allow me to develop the content in the open, and if people are so disposed, they can pay for an edition that carries additional explanatory text. Either way, I won't be writing for Packt again.

</comment></comment></comment></comment><comment><USER6> I love humblebundle and think it's awesome for games, programs, etc, but the model seems like a hard sell for programming books. How many people need machine learning books in a dozen or more programming languages?

<comment><USER7> To bad IGN bought them. I won't use them anymore since it is now a broken system. A reviewer owns the store.

<comment><USER8> Does IGN review books now? I genuinely don't see any conflict here.

</comment></comment></comment><comment><USER9> Im scepticall of a collection of 20 books without any known name. Still for 15 bucks and a morning skiming through them maybe some random gem will show up

</comment><comment><USER10> I will be getting this when I get home.

<comment><USER11> Cool.</comment></comment>


Enough is enough: Tenants join landlord in Bay Area exodus - <AUTHOR> https://www.eastbaytimes.com/2018/02/23/enough-is-enough-tenants-join-landlord-in-bay-area-exodus/ <comment><USER2> If housing etc become a liberal vs conservative issue, we will tear ourselves apart much the way the 60s generation tore itself apart over the war and feminism.

To the conservatives who want to go, few here will miss you.

Much better to set aside our different perspectives on high taxes and regulation that are arguably due to the necessity of dealing with a high density culture and instead work for common ground.</comment>


Fatal disk errors on an Amiga 4000 unless the clock app is just so - <AUTHOR> https://www.theregister.co.uk/2020/04/10/on_call/ <comment><USER2> This answer seems to have some likely leads for the cause:

[https://forums.theregister.co.uk/forum/all/2020/04/10/on_cal...](https://forums.theregister.co.uk/forum/all/2020/04/10/on_call/#c_4012741)

which refers to: [http://www.jeacle.ie/pub/articles/4008/](http://www.jeacle.ie/pub/articles/4008/)

There were various revisions of Amigas and various different SCSI cards and software workarounds - without more info little can be concluded.

"models of the A4000 were shipped with a broken Buster chip which prevented many Zorro-III boards from working correctly."

"The Fastlane card, on the other hand, was smart. It knew about the broken Busters and had a work-around to compensate. Performance wouldn't be quite as good as with a fully functional Buster, but the card would still work well."

"The problem with old Zorro-II cards [snip] is that the Amiga 4000's 32-bit RAM is outside of the 24-bit DMA-able address space which these controller cards can see, so data can't be transferred directly from the SCSI device into main memory. This means the CPU ends up dealing with requests and individually copying a few bytes at a time to and from 32-bit memory."

</comment><comment><USER3> Interesting problem and one of those quirky solutions that start of as a temporary fix and yet become ingrained as standard working practice. May even be few related quirky solutions across systems that all add up to the real issue and that may very well of been network timing and without digging deeper and other tests, be hard to eliminate.

Was this unique to this system, could it be plugged into a different network port and have same issue, could another system have the same issue. Was the system bios/os levels the same. So many things that without knowing, won't narrow this down. May even be settings of a dip switch on an HS causing timing issues and as these early systems did much in software upon the CPU over dedicated chips and corners saved. System clocks and timing circuits can become one of those things that spring up with the quickest and most intermittent and apparently unrelated forms of fun in IT.

Hence the usual process of elimination to narrow it down lacking in this problem and solution outlined and with that, could be many factors at play, even a dying capacitor or a bent ribbon cable/poor connection. SO many possible reasons for it to cause this kinda quirk. But certainly a good example of one of those mysteries you get and real issues that are fun to investigate albeit time/pressure to get things working can and often do see the temporary solution become part of working practice.

</comment><comment><AUTHOR> Via [https://old.reddit.com/r/amiga/comments/fz7qh6/amiga_4000_my...](https://old.reddit.com/r/amiga/comments/fz7qh6/amiga_4000_mystery_in_the_news/)

</comment><comment><USER4> And that's why I'll never use an OS without memory protection..</comment>


Ask HN: Is there an IRC channel for founders to hang in whilst they work? - <AUTHOR>

<comment><USER2> #startups on irc.freenode.org?</comment>


CouchSurfing.org Raises $7M - <AUTHOR> http://techcrunch.com/2011/08/24/couchsurfing-raises-7-6-m-will-users-cry-sell-out/

<comment><USER2> Just discovered that the new members can't send messages to the verified members of CS without paying.

</comment><comment><AUTHOR> technically the original AirBnB without a business model.

<comment><USER2> CS actually is based on the concept of free hospitality. I am very curious to know what happens now that they are B Corporation.</comment></comment>


Rosetta Code  : similar programs written in various languages - <AUTHOR> http://rosettacode.org/

<comment><USER2> Such a great site. The page on flattening arrays blows me away at how different and beautiful some languages can be (especially Ruby and Erlang's take).

<http://rosettacode.org/wiki/Flatten_a_list>

<comment><USER3> I'll give you Erlang, but the Ruby solution is cheating rather.

<comment><USER4> How is Ruby's method and different than Groovy or JavaScript? I think their all pretty neat. Goes to show that there is always more than one way to skin a list.

<comment><USER2> True. I guess built-in functions shouldn't count.

</comment></comment></comment></comment><comment><USER5> There's also <http://99-bottles-of-beer.net/>, which is basically the same thing but only for printing out the lyrics of the 99 Bottles of Beer song. It has a version in pretty much any language you can think of. However, some of the versions are made not to show the language's normal way to print the lyrics but to show a strange way only possible in that language.

</comment><comment><USER6> They did JavaScript concurrency wrong! omg! <http://rosettacode.org/wiki/Concurrent_computing#JavaScript>

We have workers now. But seriously, it is an amazing resource. I was looking this stuff up on wikipedia but that has almost no detail.

</comment><comment><USER7> Michael Mol did a demo of rosetta for the Lansing, MI perl mongers and it was a riot (far better than my DBIC/architecture talk).

There are fewer better forms of entertainment for geeks than eating pizza while discussing common programming expressions implemented in bizarre and obscure languages.

<comment><USER8> Yeah, the site is fantastic. He's a funny dude.

I helped out with RosettaCode a few years back, hosted it for a little while on my SliceHost instance when they had some trouble. My good](http://rosettacode.org/wiki/User:Mwn3d>good) friend contributes all the time.

Glad to see the site still exists and is flourishing, albeit slowly.

<comment><USER9> And much appreciated. I don't know when I'd have had the stones to switch to VPS (I still don't think of myself as a sysadmin all that much) if you hadn't helped us jump over to Slicehost. I've got a 2GB RAM node over at prgmr.com, now; more RAM than I know what to do with.

Site grows slowly because it's growing steadily. Well, that, and I haven't had the time to set up income or the really nice features that would depend on it. :)

If you ever hit the GRR area, I need to buy you a drink.

</comment></comment></comment><comment><USER10> It's worth having a look through Rosetta-stone tagged questions on Stack Overflow. There's a large overlap with code golf entries.

<http://stackoverflow.com/questions/tagged/rosetta-stone></comment>


Next Big Tech Corridor? Between Seattle and Vancouver, Planners Hope - <AUTHOR> http://www.nytimes.com/2016/10/03/technology/next-big-tech-corridor-between-seattle-and-vancouver-planners-hope.html?_r=0 <comment><USER2> You had me at "planners"</comment>


Ask HN: How are you feeling about your future as a "senior" developer? - <AUTHOR> Nervous?
If you comment, let us know your age if you're comfortable doing so, your core technology focus and how you feel about your propects for employment into your 40's, 50's and 60's.
Are you planning to stay in this career or do you feel you have to find something else? <comment><USER2> Nope. Not at all. Feels awesome. The whole world is trying to exploit and be the boss of developers and that is power. Power for the developers. Even when I an 75 and about to die someone will be trying to hire me, lol. I already make more money than all my professors and almost everyone I ever went to school with. All I have to do to stay employable is study a few hours a week to stay up to date. Sure, I won't be able to work at established companies that have the luxury of age discrimination, but those are the boring companies with the shittiest managers. Barring a head injury and death there is nothing that can stop me.

</comment><comment><USER3> Early 40s here. No problems.

I get a sense that senior devs who complain about age discrimination are the ones who haven't kept on learning, and haven't been keeping their skills up to date.

I could be wrong, but I have no problems finding opportunities. I see others my age or even much older who exhibit enthusiasm and a youthful wonder and they seem to be swimming in opportunities.

</comment><comment><USER4> I don't feel good at all. I don't see that many old developers working around me.

<comment><AUTHOR> What do you think happens to them? Do they leave for other industries or are you working for a "young and hip" startup company that tends not to employ older people?

<comment><USER4> No don't work for a hip company. Its a pretty big corporate company. Actually there are some older developer just not very many. I don't really know where they go. They get laid off. It seems me like CS is one of the profession where experience isn't as valued as other industries like business or medicine. I basically built my company 8 million dollars worth of product, but I don't really feel appreciated, but I really don't want to go through the whole white board exercise which I have already done enough of.

<comment><USER5> It depends on several factors like country, sector, and who you work.

But as you grow older you are forced to either become a manager or sales person.

I guess the question is not about age, but wages. In your 20s you still don't know how much money you'll need for a living. When you realize how much you need, you buy a house/car/whatever else expensive enought not to be paid upfront, then unexpectedly have family, then kids and you know you need money. Much more than you get from a technical position.

BTW, remember for the business you are an expense, something they need to build the product, but eventually all technical stuff can be bought or outsourced.

<comment><USER4> They did try outsourcing to Infosys. They had so many issues they decided to bring it back in. In fact they ran out Infosys a few years ago.

The thing with infosys they just go hire a bunch of people to fill their numbers. Some of those guys aren't really CS guys. A lot of them do it so they can get a good high paying job and it gives them a way out of India. We hired some of their good talent.

</comment></comment></comment></comment></comment><comment><USER6> I feel great! For me, age doesn't really factor into it. I'll probably push my last code from my deathbed - hopefully in the form of committing my conciousness (kidding, not kidding).

My career just keeps getting better. It's not hard to stay up to date if you stay interested and engaged. And if you're interested and engaged, you find yourself not really aging in the way a lot of people do.

Another nice benefit of aging that's helped my career is wisdom earned from experience. I started at AOL in '98 when I was 16 (it was cool then) and have worked in the industry since. There's not much in the way of team dynamics or project mishaps I haven't seen, and that gives me clarity and calm during crisis, which tends to make people want to put me in charge.

I've also learned a lot about interpersonal relationships, confidence and finding mutual benefit. While those aren't typically skills most people associate with staying relevant as an engineer, they are skills that put you in positions to succeed in any walk of life.

I'd say the problem for some veteran developers isn't aging itself, it's getting into a mentality of aging. As long as you embrace the new in technology instead of clinging to old methodologies, you'll be fine. I know developers much younger than me that gripe about new frameworks and libraries like it's a chore to learn. It's still as exciting to me today as the 2400 baud modem I got from my parents in '92.

</comment><comment><USER7> I'm 42, and I'm not particularly nervous. But I've made it a point to continue learning aggressively throughout my whole career and to this day I still spend a lot of time on Coursera and EdX taking classes, and I keep subscriptions on Safari, Lynda.com, Pluralsight, Egghead.io, etc. so I can constantly keep updating on new stuff. Lately I've been working pretty hard to expand from my core base as a Java developer, to pick up some skills on the "data science" side of things... R, Octave, (more) Python, machine learning and the like. And for the past 4 years or so my dayjob had me focusing on pretty trendy / sexy stuff like Hadoop, Spark, Neo4J, cloud APIs, etc. So unless something really crazy happens (AI comes along and eliminates all development jobs) I expect I'll be able to stay employed in this field for the forseeable future. And I'm working on a startup of my own on the side anyway.

As to whether or not age discrimination is an issue... if it is, I haven't really noticed it as such.</comment>


Coconut – Pythonic functional programming language - <AUTHOR> http://coconut-lang.org/ <comment><USER2> This is cool, but you can go pretty far w/ FP idioms in Python without requiring a DSL/transpiler:

\- Toolz ([http://toolz.readthedocs.io/en/latest/](http://toolz.readthedocs.io/en/latest/)) provides the same primitives from Clojure (including partial functions, compose, juxt, etc)

\- Pysistence ([https://pypi.python.org/pypi/pysistence/](https://pypi.python.org/pypi/pysistence/)) provides immutable data structs

\- For parallel map you can use [https://pypi.python.org/pypi/python- pmap/1.0.2](https://pypi.python.org/pypi/python-pmap/1.0.2)

\- TCO is achievable w/ a decorator regardless of AST manipulation (like Clojure's `loop/recur` construct)

The only thing left is pattern matching and more powerful destructuring (Python already has limited support for it), I guess.

<comment><USER3> No, you can't, because lambdas.

<comment><USER4> Could you elaborate on that?

<comment><USER5> Python lambdas are explicitly artificially limited to a single expression. Python has statements which are not expressions, mostly control statements and looping constructs.

<comment><USER6> The syntax isn't the greatest, but you can get pretty far with Python's ternary expression. Generators in my experience remove the need for most loops. Where lambdas feel really subpar for me is the lack of 'let' and error- handling.

</comment></comment></comment></comment></comment><comment><USER7> > ...joining the over 30,000 people already using Coconut...

This triggered my BS detector.

It turns out 30,000 is the sum of all downloads on PyPI since the very first version was released. But there are only 534 downloads on average for each release since version 0.2.2, excluding the blip for 0.3.2. So there is no way there are on the order of 30k users when downloads are roughly 1.8% of that for each release.

This matters because exaggerated claims reduce trustworthiness in a project and are off-putting to potential users.

<comment><USER8> Since they just before that wrote that all valid Python is valid Coconut, I thought that it would be a joke about every Python user being a Coconut user.

<comment><USER7> Are you saying there are only around 30k Python users? :)

<comment><USER8> Nah, when I got to the number, I realised that it wasn't going to be a joke like I thought.

</comment></comment></comment></comment><comment><USER9> While I resonate with the sentiment, I just wish Python would add better syntax for functional programming. Having written a lot of JavaScript lately, I wish Python's built-in functional tools supported something cleaner, kinda like Underscore/Lodash.

<comment><USER10> Specifically?

<comment><USER11> Not really a fan of the lambda syntax in Python. Comparison:

JavaScript:

      let arr = [1, 2, 3]
      let sumOfSquares = arr.map(n => n * n).reduce((a, b) => a + b) // 14

Python:

      arr = [1, 2, 3]
      sum_of_squares = reduce(lambda a, b: a + b, map(lambda n: n * n, arr)) # 14

<comment><USER12> Is there a more Pythonic way to do it? Lambdas are cool but usually not the first place you go in Python. I would think something like (my best guess, not a Python pro)...

        sum_of_squares = sum([x*x for x in arr])

Which I think is easier to read than either example post above.

Of course you will point out that this is less powerful than full map and reduce.. but meh... pros and cons to both styles

<comment><USER13> What's the advantage of list comprehension over lambdas (assuming the lambda syntax is decently lightweight)?

I feel like I come down hard on the side of lambdas, but I've never really spent enough time in a language with list comprehension, so there's a good chance I'm missing something.

<comment><USER14> I'm not positive, but I think it saves the need to create a new execution frame for each lambda call, since the whole loop executes in single frame used by the comprehension.

In theory I suppose the VM could have a map() implementation which opportunistically extracts the code from a lambda and inlines them when possible; but doubt CPython does that. OTOH, I'd be surprised if PyPy _doesn 't_ do something like that.

<comment><USER6> Since Python 3, both generators and lists create a new stack frame. [1] (2nd to last paragraph)

[1] [http://python-history.blogspot.com/2010/06/from-list- compreh...](http://python-history.blogspot.com/2010/06/from-list- comprehensions-to-generator.html)

<comment><USER14> I'm not meaning when the comprehension is invoked, but during each iteration of the loop within the comprehension.

When doing something like `map(lambda x: 2+x, range(100))`, there will be 101 frames created: the outer frame, and 100 for each invocation of the lambda.

Whereas `[2+x for x in range(100)]` will only create 2: one for the outer frame, and one for the comprehension.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> > Supports pipeline-style programming

>

> "hello, world!" |> print

Please follow the Elixir convention and call this by its proper name: illuminati pyramid operator.

</comment><comment><USER16> This is an impressive effort, but one major problem is that the Python runtime lacks efficient support for tail calls. I see that there is an annotation for self-recursion, but this is only a special case. Scala has a similar problem with the JVM. Still, it does permit a nice functional syntax above perhaps lower-level imperative code.

<comment><USER17> That is a problem but it's not like Python is "efficient" or performant in other areas that don't call an underlying C library.

</comment></comment><comment><USER18> Your function in the tail recursion optimization exemple is actually not tail recursive. Factorial needs an accumulator parameter to get that tail call.

<comment><USER19> Maybe the decorator rewrites the AST. I've seen this before.

<comment><USER20> It does, when the function is actually tco optimizable. The example is not. On the docs however it's correct [http://coconut.readthedocs.io/en/master/DOCS.html#recursive](http://coconut.readthedocs.io/en/master/DOCS.html#recursive)

<comment><USER21> Good catch! I'll fix it right away.

</comment></comment></comment></comment><comment><USER22> The example algebraic data type isn't an algebraic data type at all. It's a single type with a single type constructor. How is this different from a regular class?

<comment><USER23> It looks like _data_ declarations get translated to immutable subclasses of _collections.namedtuple_ in such a way that you can match on the resulting values. So it's really less like an algebraic data type and more like one of Scala's case classes.

<comment><USER24> When I used namedtuple that way it tended to blow up on me, because namedtuples implement 'dunder' methods to act as sequences, which is not what I expect for some random algebraic datatype. This makes bugs manifest as very head-scratching behavior. Nowadays I use my own struct type builder with only the equivalent of 'derives Show' and such.

</comment></comment></comment><comment><USER25> Interesting. Looks more polished than mochi[1] and hask[2].

[1] [https://github.com/i2y/mochi](https://github.com/i2y/mochi)

[2] [https://github.com/billpmurphy/hask](https://github.com/billpmurphy/hask)

</comment><comment><USER26> Well, so far nobody's complained about Python 3 support yet :)

Seriously now, this looks pretty neat, and even includes Jupyter support.

I suspect it manipulates the AST like Hy, and I can't see any reason why it shouldn't work on Pypy.

<comment><USER27> It works with python3 just fine. The 'coconut-lang' and 'coconut-lang-git' packages on the AUR both use py3.

</comment></comment><comment><USER28>
      $ coconut
      Coconut Interpreter:
      (type "exit()" or press Ctrl-D to end)
      >>> match [head] + tail in [0, 1, 2, 3]:
          print(head, tail)

      CoconutParseError: parsing failed (line 2)
          print(head, tail)

</comment><comment><USER29> What are all the _$_ for? They seem ugly..

<comment><USER30> Quoting from the tutorial:

        Second, the partial application. Think of partial application
        as lazy function calling, and $ as the lazy-ify operator,
        where lazy just means "don't evaluate this until you need to".
        In Coconut, if a function call is prefixed by a $, like in this
        example, instead of actually performing the function call, a
        new function is returned with the given arguments already
        provided to it, so that when it is then called, it will be
        called with both the partially-applied arguments and the new
        arguments, in that order. In this case, reduce$((*))
        is equivalent to (*args, **kwargs) -> reduce((*), *args, **kwargs).

[https://coconut.readthedocs.io/en/master/HELP.html](https://coconut.readthedocs.io/en/master/HELP.html) (about a third of the way down, just search for "$" and look near the first occurrences)

I agree though, it makes the code look very... noisy.

<comment><USER31> I'm all for syntactic sugar, but my experience with teaching programming is that Python is easy to pick up because of the lack of weird operators. Decorators are an obvious example where many struggle; and this looks like another.

It will take someone cleverer than me to come up with an alternative solutions; I suspect they chose "$" because it isn't an operator in Python and you have to do a lot of partial application, so the logic was probably "short is better". But having something more intuitive would be great (more pythonic?).

<comment><USER30> Python has lots of weird operators.

List/dict comprehension, list slicing, * and __in arguments. Comma for tuples (which make sense to me, but add a lot of magic, especially since, in my experience, beginners often assume that the parentheses are what make tuples). There 's many more examples, but those are the ones that immediately spring to mind.

Reading actual production Python code is not any easier than many other languages and certainly far from "executable pseudocode"

<comment><USER31> That's fair - * args and * * kwargs does feel like a hack, although denoting "zero or more" as * has a bit of tradition. I'd have to disagree with list/dict comprehension, pretty natural considering e.g Javascript/JSON also use [] / {} for each, respectively (Obviously completely subjective).

I also get that there's only so many symbols to pick from. Would have been cool if it was *, which is already used for arguments.

I think my larger point is that even the small decisions when making a language matter. There isn't really right/wrong or better/worse, but IMO Python operators feel more cohesive/uniform than Ruby or Perl. Also, describing how operator usage feels is hard.

Edit: Asterisks causing italics.

</comment></comment></comment></comment></comment><comment><USER32> How does this compare with Hy?

<comment><USER19> Hy doesn't push FP idioms AFAIK. It's a clojury in clothing lisp.

<comment><USER32> Oh, I should read more :) thanks!

</comment></comment></comment><comment><USER33> I'd suggest fixing the front page, which claims ADT support which seems untrue, and the tail recursive example isn't tail recursive at all. Errors like that make this too easy to dismiss.

</comment><comment><USER34> Have you ever looked at Perl 6, by any chance? We have most of the features you list, except for instance Tail Call Optimization, but we'd love to have someone implementing it!

<comment><USER35> I think the purpose of coconut is not to give the world new functional programming features, but give you "real" functional programming with access to pythons vast library.

</comment></comment><comment><USER36> Is there a Pythonic declarative programming language?

<comment><USER37> Yep! [https://sites.google.com/site/pydatalog/](https://sites.google.com/site/pydatalog/)

(Technically it's not a separate programming language, rather a lot of Python magic.)

</comment></comment><comment><USER38> Reminds me Ocaml, a nice language that deserves more exposure on HN.

</comment><comment><USER39> Is coconut strongly typed? Is it closer to Haskell or to Lisp / ML?

<comment><USER40> You probably mean _statically typed_.

<comment><USER21> Coconut is a superset of Python, and Python is dynamically typed, so Coconut also has to be.

</comment></comment></comment><comment><USER41> Rise of the LISP.

</comment><comment><USER42> What's "pythonic" exactly?

<comment><USER43> I googled it for you:

[http://stackoverflow.com/questions/25011078/what-does- python...](http://stackoverflow.com/questions/25011078/what-does-pythonic- mean)

<comment><USER42> Doesn't really help in this context. What's the difference between "pythonic" and "idiomatic"?

Does Coconut being pythonic mean it's written in idiomatic Python (then why is it a different language?) or does it mean it's written in idiomatic Coconut?

I don't think they thought this through.

<comment><USER44> They just mean "this language looks in general like Python." You're overthinking it.

It's like saying that JavaScript looks C-ish or Java-ish. It definitely doesn't look exactly the same; if you see e.g.

        var result = [].slice.apply(vals, 0);

then you can be highly certain that that's JS and not Java or C. But the idea of having blocks of code enclosed in curly braces, which are formed out of statements usually delimited by semicolons (except for special forms like if- statements and for-loops which don't need to be followed with a terminal semicolon), etc. is very much a C-style thing.

</comment></comment></comment></comment><comment><USER45> Name issues. E.g. Google: Coconut-Lang cookbook ...

</comment><comment><USER46> > There should be one-- and preferably only one --obvious way to do it.

[https://www.python.org/dev/peps/pep-0020/](https://www.python.org/dev/peps/pep-0020/)

<comment><USER43> Over the years I have come to dislike that phrase more and more. I think it hindered Python from growing.

Also Python 2 and Python 3 gives me at least two was to print :)

<comment><USER47> I've never understood why that phrase applies to Python when the language still has the map, filter, reduce, etc. functional functions. Generators and comprehensions completely removed the need for those, yet the functions remain even in Python 3.

On the subject of printing, there are actual reasons for having this duplicate functionality. The main way to print is of course the print function in three, or print statement in two. The print function was lacking the ability to flush the buffer before that was introduced in three. You would have to call sys.stdout.flush(), whereas now the print function includes the boolean "flush" keyword argument. The second way to print is to call sys.stdout.write(), which does not automatically append a newline. That functionality was implemented in the print function with the "end" keyword argument. You can pass it an empty string in place of the newline.

So for most use cases, print() is just fine. Sometimes you want finer grained control, and for that you would use the sys module.

<comment><USER44> Python 3 at least changes the semantics of map and filter so that they are generators.

Lazy sequences are the sort of thing that you don't care about until you need to process a ten-million-line file (or whatever) and suddenly find that your program is slowing down for pointless memory allocations up-front -- then they become unbelievably important.

<comment><USER47> Yes, you are absolutely correct. In our production code, which is currently running 2.7, we make extensive use of the itertools versions of those functions (imap, ifilter, etc.) for this reason. The itertools functions behave exactly like the Python 3 builtins, as iterators. The memory footprint is minimal, and they are just overall faster.</comment></comment></comment></comment></comment>