The Moralist (2016) - <AUTHOR> https://medium.com/thebigroundtable/the-moralist-ad8159ebe6be <comment><USER2> > "I said, `How about that, `Let him who is without sin cast the first > stone'"?

This is awfully convenient in locking down the stone throwing arm of sinners. But it's immoral to the extent that it prevents sinners from reforming and trying to reform their institutions. For that, stones cast by insiders can be particularly valuable, as in this case.

It's like, if you're a slave owner you may be a hypocrite if you work toward abolition. But it's better to be a hypocrite paying a compliment to virtue than to be a non-hypocrite wallowing in vice, ignoring virtue.

<comment><USER3> In the bible, Jesus says that in order to prevent a fatal stoning for the crime of adultery.

It's not normally taken to mean "if you've ever done something bad, don't try to discourage others from doing similar bad things."</comment></comment>


Google: Our Green Data Centers Got a Lot Greener - <AUTHOR> http://greenercomputing.com/blog/2009/01/29/google-our-green-data-centers-got-a-lot-greener?

<comment><USER2> I am responsible for some aspects of power and datacenter design where I work. What they're doing is really admirable (and hard), but they're going to do a lot more than many other, particularly smaller, datacenters simply because of their scale. From [http://www.google.com/corporate/green/datacenters/measuring....](http://www.google.com/corporate/green/datacenters/measuring.html) :

 _Figure 1_ (chart showing aggregate 1.19 PUE, some as low as 1.1) _summarizes the PUE results from all Google-designed data centers with an IT load of at least 5MW and time-in-operation of at least 6 months._

5MW is quite a bit of power. At a PUE of 2.0 that's 25000 amps (@100v), or about 8000-12000 idle servers. In Seattle, the breakover for the largest tier of power is 3MW, making 5MW about $194,000/mo (tariff 40) -> $0.053192 * (24 _365.25/12)_ 5000 = $194,283.

Obviously at these power levels being green is truly a matter of saving hundreds of thousands of dollars _per month_. It's a considerably tougher sell to justify high-efficiency construction in a small 100-200KW center, especially when colocating where cooling prices are obscured in the contracts under $/sq/ft instead of $/watt.

</comment><comment><USER3> While this is nifty, the PUE figure they cite is a ratio of total datacenter energy consumed to total server energy consumed.

It's impressive what they have done to reduce the numerator, but it'd also be nice to see what they have done to reduce the denominator (even if that makes the headline PUE number worse in the short term).

I remember something from long ago about Google deploying it's own hardware to make the servers themselves more efficient. Anyone seen any updates on this? My google-fu must be weak.</comment>


Ask HN: How do startups apply for credit cards? - <AUTHOR>

Do the founders personally guarantee the company? <comment><USER2> My partners and I took our seed funds that we put up on our own into a bank account. We signed up for a saving account, checking and got a credit card at the same time. It's based solely off of the founders for a bootstrapped firm.

</comment><comment><AUTHOR> And what have people found is the best card to get for early-stage (pre-series A) startups?</comment>


NYC housing court, created to protect tenants, has become a tool for landlords - <AUTHOR> https://www.nytimes.com/interactive/2018/05/20/nyregion/nyc-affordable-housing.html <comment><USER2> I'm curious, and maybe this is not the right forum for this kind of discussion, but it seems to me at some level there's going to be a tradeoff between the ability of current tenants to afford their current housing and newcomers to afford housing. In markets like NYC, where demand is ever- increasing and for various reasons supply cannot keep up with demand, maintaining rent-controlled apartments necessarily drives prices higher overall. This prices a large group of people (especially the working-class young) out of the market. At the same time, were landlords allowed to adjust to market at-will, people who potentially have lived in a community for decades could be displaced without notice. Both situations are undesirable, since it would seem that someone gets screwed either way.

I've been wondering this for a while, but haven't come up with a satisfying answer: to what extent do people have the right to live in a given community? Does this depend on if people have lived in a community for some time? Does it only depend on whether they can afford to live there? I feel like these questions aren't black and white, but there's also no clear middle part I feel comfortable committing to.

<comment><USER3> I'd ask a slightly different question: why is so much of our economic policy centered around new and higher paying jobs in a certain area, in disconnect with the current residents preferences for housing policy? It seems like these things are controlled by very different interests that end up fighting in ways that treat the non-high-income/wealthy existing residents as collateral damage.

We want housing to be more affordable in LA, [a different but still local] we also want Amazon to come to town and bring in a bunch of new workers from out of town. Those two goals seems hard to reconcile.

<comment><USER4> We are started an a startup (Openland, W18) to find a way to product more housing and during initial research i found that there are a lot of empty lots in LA that costs about $10k-50k. Tried to search in different states and found same lots at Long Island.

So why people are not trying to buy land and build something on it instead? Buying a house will cost magnitude more than buying land and building your own house. Building will take time and resources, but... paying for a loan for 30 years? I think i can spend two years building my own home for the fraction of a cost of buying existing one.

Why no one is doing this?

<comment><USER5> Pretty sure you can't just build a house in America. What about all the zoning, permits, regulations, planning, environmental impact etc.

The paperwork alone would be a nightmare!

Housing has come a long way since the days of the mail-order Sears & Roebuck assemble it yourself house.

<comment><USER4> There are a lot of startups and services to solve this problems. Unfortunately, This market is in its very early days.

</comment></comment></comment></comment></comment><comment><USER6> The truth is, big real estate companies have the resources and the incentive to be aggressive.

But perhaps that's the root of the problem? With so many units at below market rates, the current new to the market units get priced to cover the "loss" of the controlled units? And then of course there's the incentive.

I'm not defending the practice. But I am suggesting - similar to housing and a college edu - that "government intervention" often has unintended consequences.

<comment><USER7> The government intervenes on behalf of Global Capital in the housing market all the time, allowing them to turn a basic necessity (shelter) into a vehicle for things like international money-laundering and finacialized speculation.

These are the circumstances that have created the housing crisis we have now and previously took down the entire economy. I'm confused as to why you single out trying to intervene on behalf of the average person over the wealthy as the source of the problem when the "free market" term setting has caused the massive distortions and unaffordablity.

<comment><USER8> Common myth of the 'free market' \- the reality is the market is totally constrained in many ways by the political and legal system.

There is definitely something very 'i am very smart'-like about tech nerds defending 'the market' against any attempts of humanizing life. "um, actually the free market will..."

Governments exist to provide super-market force. Safety regulation being kind of a prime example, especially for employees. OSHA is anti-free market -- there should be no safety regulations, and let employees the freedom to choose safety or pay and let the free market work it out.

Right?

<comment><USER9> The market is very good at allocating resources, setting prices, and meeting demand.

Countries with freer economies like Switzerland and Hong Kong have higher standard of living on average. Countries which free up their economies have higher relative standards of living after doing so. Countries which oppress their economies have lower relative standards of living after doing so. (By relative, I mean relative to the growth rates of neighboring countries and before the changes, as standards of living rarely decrease absolutely).

<comment><USER10> That said, those economies have some weird aspects to them. Both are small states. Both have much lower proportions of their population in poverty than larger states. Both are centers of global commerce.

In general I agree with you that markets allocate resources far better than the most earnest central authorities. That said, market failures often happen without regulation from governments.

</comment></comment></comment></comment></comment><comment><USER11> Evictions destabilize neighborhoods and ruin lives.

Evicted by Matthew Desmond is a great book on this issue. It is infuriating some of the predatory, senseless, ruthless, scumbag business practices that slum lords use and crazy to discover that this is a recent development starting from the 60s.

Also shout out to Justfix.nyc, a startup using tech to tackle this issue. One of their projects is this website they made to help.

[https://www.evictionfreenyc.org](https://www.evictionfreenyc.org)

<comment><USER6> I read Evicted. Great book! A must read.

Word of advice to anyone who picks it up. Read the final chapter or two first. It's where he gets into the weeds of the data and such. If you start at the beginning and get bored, get distracted, give up, etc. before the end you're going to miss the best part.

Don't get me wrong, the stories are great. But just the same it gets disheartening, if not depressing.

<comment><USER12> I read this over christmas and was completely engrossed (to the extent of being borderline antisocial).

I can certainly understand how you might find it disheartening and depressing, but I don't know I could quite see bored. The retelling of the situations was captivating, and the descriptions of how the system fails those most in need was harrowing at times. I've been recommending it to anyone who will listen.

<comment><USER6> I'm not saying __I__ got bored :)

However, the truth is, plenty of books get started and are never finished. Since the bit at the end was so factually important to the discussion of the issue, I didn't want that to be missed.

Imho, he should have started there.

<comment><USER12> I'm certainly guilty of getting partway through books and never returning, but I don't know that if I'd jumped into the data first I would have been so engrossed.

(Obviously this is entirely a personal perspective.)

<comment><USER6> Engrossed? Maybe not. But a lot of myths would have been busted. For me, it's about trying to understand an issue, bumping into some ignorant ahole, and being able to say "read this book...read __this chapter__."

Few enjoy such books. But more need to be more aware of the (data) truths that define the issue.

<comment><USER11> The data on the number of deaths from domestic violence in cities/states that have a law for penalizing landlords with properties with too many police calls was infuriating.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> A similar thing has happened in New Zealand.

The Tenancy Tribunal exists to mediate disputes between the landlord and tenants, both the landlord and the tenant can bring cases. For example, landlords can use it to get tenants to pay for damage caused, and tenants can use it to get the landlord to fix something they are legally obliged to fix. The tribunal is non-biased, and the decisions they make tend to be fair.

The problem though is that all tenancy tribunal case are public. With the names of the tenants and landlords published, as well as the case and the outcome.

A lot of rental applications ask if you have ever been to the tenancy tribunal, and a lot of real estate agents will search the tribunal records (which go back 5 years) when you apply for a rental. It doesn't matter if you were in the right or wrong, or if you won or lost. Landlords are reluctant to rent to anybody that has been to the tribunal, as they are considered troublemakers.

Because of this, tenants are scared to go to the tribunal, even for justified cases, where they are in the right and would win. The opposite doesn't occur for landlords because there is more demand than supply for tenants, and also tenants often don't know that they can search the tribunal records.

</comment><comment><USER14> > Rent-regulated apartments, often the only homes in New York that people of > modest means can afford, are vanishing as gentrification surges inexorably > through the city's neighborhoods

Rent regulation in NYC is easily the least effective way to make housing affordable for people of "modest means". It's criticized even by advocates of affordable housing for this reason. The only reason it still exists is because there are a large number of tenants grandfathered into the system (over a third of all NYC tenants) and that makes for a formidable voting bloc.

Rent control is all-but-gone - only a very small number of units are still eligible, and that's because the tenant has lived there continuously since 1975. Rent stabilization is less broken, but still horribly broken. Anybody can live in a rent-stabilized unit, regardless of whether or not they'd be able to afford the market rents, and there's no effort made to make those units available to people who can't afford market rents.

There are plenty of other programs in NYC, like Mitchell-Lama, which are much more effective at providing affordable housing. Rent regulation is not one of them.

<comment><USER15> > since 1975

Early 1970, actually.

> Anybody can live in a rent-stabilized unit, regardless of whether or not > they'd be able to afford the market rents, and there's no effort made to > make those units available to people who can't afford market rents.

But there is a strong effort to eliminate these units. Most of the rent stabilized inventory is not in desirable places to live. The rent can be increased every two years.

The rent guidelines board has voted for a freeze only one time in its 49 year history. On average the increase is 2% every vote and two increases of about 7.5% in the last 5 years. This interest compounds, obviously and also scales up MCI rent increases for capital improvements.

Once your rent hits $2700/mo, you are no longer stabilized. If you actually work out some examples, you'll find from this chart that rent stabilized tenants have had their rent increased _at minimum_ by roughly 34% for two-year leases in the last decade. If your landlord is anything like mine, it's probably close to 45%.

[http://www1.nyc.gov/assets/rentguidelinesboard/pdf/guideline...](http://www1.nyc.gov/assets/rentguidelinesboard/pdf/guidelines/aptorders2018.pdf)

<comment><USER14> > Once your rent hits $2700/mo, you are no longer stabilized.

That's actually not true. At $2700, landlords have the option to petition for deregulation, but there's no guarantee that they'll succeed.

Under $2700, they can't petition for a high rent deregulation. The income threshold also only kicks in at this threshold, so a unit rented for $2000 can be occupied by a person who makes $500,000/year, and there's nothing that the landlord can do about it.

In addition, I'd have to check, but I believe the increase for the two years before DeBlasio was reelected was 0% for single-year leases.

<comment><USER15> They don't have to bother with that, they just don't renew your lease or use the court to evict you and the apartment automatically becomes unregulated.

I've seen this happen in building after building going on 20 years now. Usually they just wait for a few tenants to hit around 2500/mo and then stop renewing leases and let the vacancy rate pull the rents over the threshold for them. It's really easy.

(Note: they also lowered the tenant's personal income threshold in 2015 to ~200k/yr for two consecutive years)

<comment><USER14> > They don't have to bother with that, they just don't renew your lease

They are required to renew the leases of stabilized tenants.

> or use the court to evict you and the apartment automatically becomes > unregulated.

Nope, the apartment is still regulated even if they re-rent it. They have to go through the deregulation process through the courts if they want to take it off rent regulations.

<comment><USER15> > They are required to renew the leases of stabilized tenants.

Most public benefit programs in NYC require you keep on-file a current lease agreement. Withholding a paper lease is a deliberate tactic to make people choose between keeping their apartment and keeping their benefits.

I mean, we can keep doing this back and forth about where we agree on how things should work and I'll agree with you, but then I can tell you about how my family or I have been going to court with our landlord at least every other year since the late 80s.

I am a rent controlled tenant in a 95% rent stabilized building and the landlord does incredibly shady shit to try and get myself and others out. In fact we're going through the regular "didn't pay rent" routine right now that will bring me to court again probably this August or September -- the bank checks that I send certified mail every month are being refused delivery by the management company again.

<comment><USER16> The European way of paying rent, e.g. recurring wires, has the benefit that the recipient can't just refuse the physical object. And for legally binding documents the tenant has to deliver within a deadline, he can, if it's that bad (at least in Germany), pay a court bailiff to deliver the document and certify this delivery. That is legally binding on the date it is put in the mailbox.

<comment><USER15> I agree wholeheartedly and it seems like it would be nice to live in a civilized part of the world like Germany instead of my city and country of origin.

<comment><USER16> Move here. It's not that difficult if you want it, and have the skill needed to find someone to marry. The legal system here is (almost) still 'rule of law', and the constitutional court has a history of voiding the police state laws that crop up. Well, unless you are in Bavaria. I'd advise against setting foot on that state. The arrest laws there are about as bad as civil forfeiture, except that they can at worst lock up what you have on you, instead of being able to turn it into funds. Also you, once you are a citizen, don't have to worry about your employer firing you or so, if you can sit that out in a frugal lifestyle.

Landlords here actually like non-agressive social-benefits tenants, as the rent get's wired directly by the state and the benefits won't pay for an apartment in an expensive area anyway, which, combined with the apparently rather liberal zoning, as far as high-rise buildings are concerned, makes the situation rather bearable.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> This is what happens when you have rent control in your city. Residents who are lucky enough to live in under market housing become reluctant to move as they will be unlikely to receive another apartment at the rate they currently pay. Landlords have no reason to invest money back into buildings if they cannot recoup the investment. Rent control is bad public policy and should go the way of the dodo.[0]

[0] [http://www.igmchicago.org/surveys/rent- control](http://www.igmchicago.org/surveys/rent-control)

<comment><USER15> The data in NY shows pretty clearly that buildings with significant amount of stabilized and controlled units get an outsized share of Major Capital Improvements because that is the way you get your units to cross the stabilization threshold.

<comment><USER18> Can I get a source on that? Asking honestly, i'm curious about how that might work.

<comment><USER15> I'll have to find it again but the MCI increase rate is capped at 6%/yr for stabilized tenants for this very reason.

My landlord has hit between 4.8% and 6% every year without exception since 1991...for what? Besides the lobby I can't tell.

<comment><USER19> I would think that _27 years_ of such capital investment, if genuine, would result in _some_ tangible, visible effect.

</comment></comment></comment></comment></comment><comment><USER20> The worst aspect of high rent costs in cities is that it forces a long commute on the poorest residents. Those are the people who could benefit the most from extra time in their day. These blue collar workers, who basically run their city, have to live outside it and spend hours each day commuting into it after a short night's sleep. The long term health effects of such a routine are terrible, and even worse for families.

</comment><comment><USER21> More generally: When you give the government more power, you can expect the powerful to try to use it.

What? You thought that power was going to be used on behalf of the powerless? That may have been the stated intent. But the powerful tend to know how to use power better than the powerless do...

<comment><USER22> And if you don't give the government more powerful, you can expect the powerful to grow their power unchecked.

<comment><USER23> Not at all - the gov often concentrates power because they make the laws. This is what happens in regulatory capture - a company can ensure themselves a monopoly / advantages through the right laws in a way they could never guarantee in the free market.

</comment></comment></comment><comment><USER24> certainly its also dysfunctional that we legislate that random property owners must provide the safety net for the poor & elderly.

<comment><USER25> >random property owners must provide the safety net

Doing business (which renting out property is) is not a given right. The cost of doing business (taxes and regulations) is what makes possible the existence of the state at all - far from being a 'dysfunctional' concept.

<comment><USER26> Doing business -- freely associating and voluntarily contracting with other people to exchange goods and services -- is in fact a natural right. The state is largely a parasite on top of this activity.

<comment><USER27> That's sometimes true, but I don't think it must be. The state provides an incredibly valuable service to those exercise that natural right: enforcement and conflict resolution. It makes sense to fund the state to perform this functions, and possibly others.

</comment></comment></comment></comment><comment><USER28> Large corporations have more resources than you. They will always attempt to abuse the system to extract money from you or to abuse you.

Hopefully the NY Times names and shames these crimelords and their companies.

</comment><comment><USER29> Not mentioned here - the imputed cost of easy eviction on rental prices/ability to rent. I've lived in tenant friendly cities (NYC) and landlord friendly cities (HOU). And guess what, its way easier to rent an apartment in a state where it's easier to get evicted. Perversely making it hard to evict a tennat can make the hurdles to be being able to qualify for an apartment to high for many people. I'm not saying that there should be no protections, and as a renter i would prefer to have stronger protections, but with those stronger protections come costs....

</comment><comment><USER15> I loved how NYC landlords sought a 7% increase on rent stabilized apartments and the RGB voted them a 7.4% increase instead.

Meanwhile the vacancy rate on rent-stabilized apartments over $2000/mo is 7.42%...

</comment><comment><USER30> Meh. This sucks but what can you do.

When you have a government where corruption and dysfunction is is tolerated or expected in some parts (police and MTA come to mind) that dysfunction inevitably seeps in everywhere else given the time.

As another commenter said the big real estate companies have the resources to work the system until they get what they want so as long as the system supports sloppy decision making and incompetence they can just work the system until they get the desired result.

Sure this is bad but it's not gonna change until the politicans apply pressure. They won't do that unless someone with connections gets screwed and makes it their mission to right the wrongs or something thrusts the issue into the public eye. It will probably take someone going postal for this to be thrust into the public eye because the people being screwed are mostly poor and nobody cares about what poor people do unless there's violence involved.

Without the politicians to applying pressure no change will happen and they won't apply pressure unless this affects people with connections or provokes outrage. Unfortunately that's just how these sorts of governments usually work.

</comment><comment><USER31> This entire problem can be explained with one line from the above essay:

>Punishable conduct is rarely punished.

As long as judges allow landlords to break the law without facing serious sanctions, they will continue to do so. Its the same behavior that encourages police officers to perjure themselves constantly on the stand and prosecutors to hide evidence and perform other misconduct in the pursuit of criminal convictions. In many cases throughout society, unfortunately, the law has become nothing more than a tool for the wealthy and powerful to punish and control the poor and powerless. Anyone interested in reading an excellent book on this subject should check out Glenn Greenwald's _With Liberty and Justice for Some: How the Law Is Used to Destroy Equality and Protect the Powerful_.

</comment><comment><USER32> Tomas Sowell's Basic Economics has a chapter on the failures of rent control, specifically addressing New York City (among others).

These controls suffocate supply and now the owners of an artificially scarce basic resource have a lot of power. It's not exactly a surprise.

</comment><comment><USER33> I live in a Croman building now in the LES, it has been absolute tell since he bought in 3 years ago.

</comment><comment><USER34> "Regulatory capture? What's that?"

<comment><USER35> "Nobody said freedom and Democracy were easy. You don't get to coast, enjoying the fruits of all the hard labor that brought us to this point. You have to maintain your institutions lest criminal elements in the corporate world or elsewhere gain power."

Who are we quoting again?

</comment></comment><comment><USER36> _Even if a case is shown to be baseless, just being sued can hurt a tenant's ability to rent a new apartment._

We have this list, we have credit score lists, CLUE, and even sex offenders lists... How about one more:

The "I'm a cartoon villain" list. If you, for example, evict a little old lady in your greed for more rent even though your net worth exceeds some given amount, you get added straight to the list. Because that's _cartoon_ level villainy right there. That should follow you for life.

<comment><USER37> if the property is owned by a REIT, which is itself owned largely by retirees, who exactly goes on the list?

(i just looked up a bunch of major REITs, and only EQR, Equity Residential, has >1% ownership by insiders. despite that, it has ~96% institutional ownership, with vanguard at 14.4%.)

<comment><USER36> As tempting as it is to just completely diffuse the blame and claim its "nobody" or "the system", there are _humans_ at the tip of the spear. Even if its just the lawyers who choose to take the case or the muscle who shows up to do the eviction.

"I'm just doing my job" when you're obviously taking a helpless old lady's home factors out to "I knew it was wrong, I just did it for the money".

Our loss of shame as a society and as individuals is truly dumbfounding.

<comment><USER38> Sounds like you might be interested in David Hogg's boycott of Vanguard, albeit for different reasons.

To me, it's just tilting at windmills, but that seems to be becoming more popular these days.

</comment></comment></comment></comment><comment><USER39> I wonder if the Orbach Group has any ties to Jerry Orbach, 'Lenny' from Law and Order and the father figure in 'Dirty Dancing'.

<comment><USER40> Fun fact he was known as "Mr Broadway" in his early career he performed in numerous shows. Completely off topic but that really was the golden era of law and order</comment></comment>


Curated Resources to get your ML journey started - <AUTHOR> Resources to get you started on your Machine Learning journey!
Who's this for?
> Technical people who want to get up to speed on machine learning quickly
> Non-technical people who want a primer on machine learning and are willing to engage with technical concepts
> Anyone who is curious about how machines think
Here goes..
1. Introduction video - https://www.youtube.com/watch?v=NKpuX_yzdYs&feature=youtu.be
2. Visual guide - http://www.r2d3.us/visual-intro-to-machine-learning-part-1/
3. Bookmark this guide - https://medium.com/machine-learning-for-humans/why-machine-learning-matters-6164faf1df12
Hope it helps! <comment><USER2> Here are some others that are also commonly recommended on HN:

Andrew Ng's Machine Learning MOOC: [https://www.coursera.org/learn/machine- learning](https://www.coursera.org/learn/machine-learning)

Andrew Ng's Deep Learning Courses: [https://www.deeplearning.ai/](https://www.deeplearning.ai/)

David Silver's Reinforcement Learning Youtube Series: [http://www0.cs.ucl.ac.uk/staff/d.silver/web/Teaching.html](http://www0.cs.ucl.ac.uk/staff/d.silver/web/Teaching.html)

Fast.ai Courses on ML and Deep Learning: [https://www.fast.ai/](https://www.fast.ai/)

<comment><AUTHOR> Thanks for sharing!

</comment></comment><comment><USER3> This has come up in similar forms before if you do a search on ML/Machine Learning/AI/Data Science etc. For example:

Ask HN: How to Seriously Start with Machine Learning and AI [https://news.ycombinator.com/item?id=16167620](https://news.ycombinator.com/item?id=16167620)

Machine Learning 101 slidedeck: 2 years of headbanging, so you don't have to [https://news.ycombinator.com/item?id=15919115](https://news.ycombinator.com/item?id=15919115) (comments are also worth a read)

<comment><AUTHOR> Will check these out as well! Thanks :)</comment></comment>


Ask HN: Web developers on this forum, how do you manage user sessions? - <AUTHOR> Do you maintain session information on the server or do you use web token and make server state-less? Why did you choose one over the other?
The way I am handling sessions is by embedding an "ephemeral session id" and a username in a web token and having that same id set as a separate cookie.  When a request is received by the server then the "session id" embedded in the token is compared with the value stored in that separate cookie. If that matches then the username is extracted from the token. In response to that request, a new session id is generated and a new token is created and the value of a separate cookie is set to this new session id.
Do you see problems with this approach? Are there better ways to handle sessions without storing state on servers? <comment><USER2> A lot of your auth and session architecture depends on if you are doing a multi-page application or a SPA. If you are doing an SPA, I would just use a JWT and keep it in memory, don't put it in a cookie.

If you are doing a MPA, I would only use a session cookie and set the secure only flag as well as the same origin flag for the cookie. Obviously any auth and session management should be done via TLS (and only allow the last few latest and greatest, don't let the client downgrade you to something that can be exploited), if they compromise TLS we all have bigger problems than the fact that they got your cookie and a user session. If the client is owned by a hack there is not much you can do, as they already have the client, you just have to protect your endpoints from that client exploiting your server for more than that users information or privileged escalation attacks.

But honestly the best thing to do, is not roll your own. Use an existing auth solution. Httpd is pretty hardened and they are plenty of auth solutions for it, if you are using it.

<comment><AUTHOR> > If you are doing a MPA, I would only use a session cookie and set the secure > only flag as well as the same origin flag for the cookie.

I am doing an MPA. I am setting a session cookie, the secure only flag and the origin flag. But I am using JWT to store the ephemeral session id which is then compared on the server-side to the session cookie as a cross-check. A new JWT with new id is created for each request. That way the server remains stateless and the client gets new token back for each request; this token is then used in the next request. The only question I have is what are the disadvantages of doing this i.e. making each request independent of the other requests and then cross-checking the validity of incoming request by comparing id stored in the JWT with the one stored separately in another cookie.

> Httpd is pretty hardened and they are plenty of auth solutions for it, if > you are using it.

I am not using httpd.

</comment></comment><comment><USER3> You need to implement expiring tokens that are refreshed, otherwise there's no way to revoke a token.

Embed a time stamp in the encrypted token, extract the time stamp and if it's been longer than X minutes check the DB to see if the session is still valid, and if so issue a new token.

Otherwise a leaked token is good forever.

<comment><AUTHOR> > You need to implement expiring tokens that are refreshed, otherwise there's > no way to revoke a token.

I create a new token for each request. Store expiry time and ephemeral id in the token and the cookie, set a separate ephemeral session cookie. Then on the server side check the expiry time and then cross-check the id stored in the token to the one in the session cookie. And then in response to the request generate a new token with a new id and expiry time.

> check the DB to see if the session is still valid

I am trying to build a stateless server. But I am trying to understand the advantages and disadvantages of stateless and stateful way of managing web sessions.

<comment><USER3> So how do you revoke sessions? There's no way to logout or invalidate sessions? That may be okay for your use case but it means if a session token is ever leaked it can be used presumably forever. I would recommend maintaining a table of active sessions in the DB and periodically checking the client's session token against that. That way you avoid DB queries on each request (session is verified cryptographically), but every X minutes you check that the session is still valid by asking the DB.

I'm not sure what you mean by stateless server. The server keeps state regardless of whether you use a session verified by the database or verified by encryption.

<comment><AUTHOR> > So how do you revoke sessions?

Because the token is generated per request, there is no requirement to revoke the token. Each request is a session in itself. The private payload of the token contains the username if the user was authenticated, else that information is not present in the token. That gives an indication to the server that the request is from already authenticated user.

> There's no way to logout or invalidate sessions?

A logout request from user will contain the token that was sent in the response to previous request from that user. Because the token is generated per request, the way the server can "invalidate" a session is by simplying logging out the user by removing the username from the next token. If a token is compromised then that will create a problem for that single request because the next token will be different and will be using a new key for encryption.

> I'm not sure what you mean by stateless server.

Stateless means the server does not have to maintain session information.

<comment><USER3> > If a token is compromised then that will create a problem for that single > request because the next token will be different and will be using a new key > for encryption.

I don't follow. What stops a user from replaying any token/request?

Request 1: User sends credentials.

Response 1: Server sends session token encrypted using server's private key.

Request 2: User sends token from response 1.

Response 2: Server sends a new token, encrypted using server's private key.

Request 3: User sends token from response 2.

What stops the user from using the token in response 1 multiple times? How does it become invalid?

</comment></comment></comment></comment></comment><comment><USER4> Can you use something tried and tested over something custom?

It's common for people to suggest not inventing your own hashing algorithm because you'll likely make a mistake and open yourself up to security exploits - I'd go further and say don't write your own login system at all if you don't have to.

<comment><AUTHOR> > I'd go further and say don't write your own login system at all if you don't > have to.

Do you mean login using google, facebook etc?

I don't want to use third-party login services. Are there any pre-built self- hosted systems for this?

<comment><USER4> > Do you mean login using google, facebook etc?

I mean logins, passwords, password recovery, sessions, user roles etc.

> I don't want to use third-party login services. Are there any pre-built > self-hosted systems for this?

If there's a specific language or framework you're using (e.g. Django, Laravel), look for the standard battle tested solution that everyone else is using.

You're just asking for trouble implementing this yourself. I wouldn't discount a third party service either.

</comment></comment></comment><comment><USER5> I think more context is needed to understand what your web application does. When you say web token, I assume you mean JWT, which uses a process of encoding/decoding and can be hacked.

If an attacker can interfere with the JWT/cookie on the client and change the user id they can become any user on your system.

Don't put any user info on the client (JWT/cookie page rendered stuff is fine), just a hash that refers to the session id. This would make it harder for someone to change ids or guess usernames. And use HTTPS for all traffic.

Its okay to use lightweight sessions, a hash for the session id and a user id in a sessions table on the server should be enough to keep track of who is who.

Most web frameworks have this problem solved so maybe look into that for whatever language you are using (unless this is a comp-sci quiz question testing your understanding of sessions/security, haha).

<comment><AUTHOR> > I assume you mean JWT

Yes.

> JWT/cookie page rendered stuff is fine

Please could you elaborate on this?

> And use HTTPS for all traffic.

Yes, that is done.

> unless this is a comp-sci quiz question testing your understanding of > sessions/security, haha

No it is not :)

<comment><USER5> What I meant was don't put identifiable user information (ids, email addresses, etc.) on the client in a JWT or cookie and use that as a session identifier. If the JWT or cookie gets hacked then someone can impersonate anyone on your system.

Putting their info (email, name, etc.) on a user profile type of page should be fine if your app has a need to do that.

<comment><AUTHOR> I am just storing ephemeral id and username in JWT and put the encrypted id in a separate cookie.

</comment></comment></comment></comment><comment><USER6> I make it to not need session IDs; for logins, I use the HTTP authentication (no cookies).

</comment><comment><USER7> You might find this article informative: [https://developer.okta.com/blog/2019/10/17/a-thorough- introd...](https://developer.okta.com/blog/2019/10/17/a-thorough-introduction- to-paseto)</comment>


New York governor orders probe into Facebook access to data from other apps - <AUTHOR> https://www.reuters.com/article/facebook-new-york/new-york-governor-cuomo-orders-probe-into-facebook-access-to-personal-data-idUSKCN1QB2BK <comment><USER3> Anyone else working in tech for the past few years having more frequent existential crises about what they have enabled?

I have never worked at FB, but I've worked at a few well known yet somewhat controversial companies (in fintech, marketplaces, etc.) that I sometimes feel uneasy about.

<comment><USER4> Took me several years past school just to get used to the ordinary level of dishonesty and scumminess that's common to pretty much all business, let alone the worse stuff. Sometimes I think my parents (and, to be fair, children's media) messed up by giving me such a keen sense of right and wrong. Enough otherwise-decent people (like, almost all of them) seem to just look at you like there's something wrong with you when you bring this stuff up that I caved, since the alternative seemed to be becoming a living-off-the-land recluse, or a monk or something.

But I still hate it. Still feel like I'm kind of ruined in some sense for not going the really, really hard route to avoid it all. Every day. Some jobs more than others, but even at the best I sometimes go home catching whiffs of something that make me think my _soul_ must have stepped in some dog shit on the way.

<comment><USER5> It's difficult to tell from your comment how old you are, but I'm in my late 40s and it took me until well into my 30s to find the balance that works for me. It's difficult when so much work seems to require being unquestioning / amoral at best and immoral at worst. The only fixed ideas I had in my head were not working for defence or advertising companies (thanks, Bill Hicks). I now make a nice living running a digital agency that builds websites almost exclusively for third-sector clients (education, non-profit, government etc.) but it took me quite a while to build the skills that would allow me to do that. I can highly recommend starting your own business, no matter how humble, once you've gained enough skills to make what you do valuable to the kind of people you want to work with. The added benefit of working in the third sector is that I'm generally working with nicer people. I think this is partially just the kind of people the sector attracts, but also because the people who work in it aren't so conflicted about the value of what they're doing. So many people I've worked with in corporate environments get fixated on things like status and money, and it just seems to make them bitter and miserable. Along the way I remember one guy in HR in particular who got incredibly excited about me building a link between their HR system and their website so a job that was posted on their HR system automatically turned up on their website. I couldn't believe how small his world had become.

</comment></comment></comment><comment><USER6> Ever wonder why Facebook is giving everyone on earth so much free software and processing power? They seem to be making money, how do they do it?

[10 minutes of deep thought]

Ok, we get it. If someone offers you something of value for free, politely say "no thanks" and run the other way.

Edit: If a for-profit company offers you something of value at no cost, you or someone else will end up paying for it later. Advertisers pay Facebook for your personal data, and you suffer because your privacy has been violated.

<comment><USER7> > If someone offers you something of value for free, politely say "no thanks" > and run the other way.

Where does free software fit in this?

<comment><USER8> It's great that "if it's free, you should run away" or "if you're not the customer, you're the product" or any of those other sayings are finally been seen as extremely reductive.

<comment><USER9> > It's great that "if it's free, you should run away" or "if you're not the > customer, you're the product" or any of those other sayings are finally been > seen as extremely reductive.

Is it really the case that we've forgotten "There's no such thing as a free lunch?"

<comment><USER10> That's not the same thing.

</comment></comment></comment></comment></comment><comment><USER11> I assume this is other apps using FBs analytics toolset? Where I can send a custom event with {email:email@example.com, data: {likes_dogs: 1, likes_cats: 0}} or what they are mad about is {weight: 120, has_hiv:0} ?

IDK seems silly to me or maybe I'm in too deep and can't see the forest for the trees.

<comment><USER12> if this is related to the Facebook Mobile SDK it seems that it is sending a lot of data home by default and that setting it up for ethical data collection isn't straightforward for most developers[0]

[0] at least for android, based on this talk: [https://www.youtube.com/watch?v=y0vlD7r-kTc](https://www.youtube.com/watch?v=y0vlD7r-kTc) (35C3 - How Facebook tracks you on Android)

edit: add video title

<comment><USER13> Thanks for posting this - great talk!

</comment></comment></comment><comment><USER14> nit,

> Facebook is facing a slew of lawsuits and regulatory inquiries over privacy > issues, including a U.S. Federal Trade Commission investigation into > disclosures that Facebook inappropriately shared information belonging to 87 > million users with the defunct British political consulting firm Cambridge > Analytica.

Cambridge Analytica is not defunct, but rather changed its name to Emerdata. It's too bad Reuters didn't get that part correct.

[https://www.theregister.co.uk/2018/05/02/cambridge_analytica...](https://www.theregister.co.uk/2018/05/02/cambridge_analytica_shutdown/)

<comment><USER15> > Cambridge Analytica is not defunct, but rather changed its name to Emerdata.

Not technically correct, but basically the truth. Cambridge Analytica declared bankrupcy in May of last year and the creators of that company created Emerdata and rehired many previous employees of Cambridge Analytica. Their HQ is even in the same exact building.

They're just playing the shell game, really. "Oh no, we're not the bad guys, we are just mostly made up of those old bad guys and do exactly the same thing in exactly the same way with the exact same location as those old guys... But, as you can clearly see, we have different bank account numbers and a different company name, so we're not the same thing at all."

<comment><USER16> The trouble is, it works. Depressingly well.

Every story out there is about Cambridge Analytica, only a tiny proportion have been written recently enough to mention the phoenix. Yet they often won't, or give entirely the wrong impression like TFA here (defunct - <USER2> that's a relief it's all over then). The number of old pieces that have had an update is so low as to be effectively none.

So we have to wait for the next scandal.

<comment><USER15> > The trouble is, it works. Depressingly well.

It does... if countries allow it. There was either some fear that this was happening or deliberate intent to keeping this from happening with the case of North Korea's sanctions - my memory's a bit fuzzy since the class I took where this came up some many years ago.

E.g. Some unethical people would setup a black exports shipping company to ship stuff to North Korea, and then when they got caught, they'd declare bankruptcy, liquidate hardware to some shell or holding company, shut that company down, create a new legal entity, rebuy all of the same equipment from the holding company, and restart the same old behavior. While the courts waste their time chasing defunct companies, the bad actors get to continue their bad behavior. This is just a new version of that game that's even easier since there are far fewer physical assets that need to be shelved or hidden (perhaps even none if the servers are all in someone's cloud).

Countries have largely stopped this kind of sanction-avoidance behavior by arresting the people in charge, ceasing assets to prevent them from being relabeled under the new company, and freezing accounts to prevent recapitalization under these kinds of shell corporations, in addition to requiring strict compliance around interactions with these sanctions countries and business entities.

tl;dr: the CA folks should be sitting in prison right now, and Facebook and Google should be sanctioned and require strict supervision in the way it shares data with its customers, to prevent this kind of microtargeted- electioneering-as-a-service. Laws like the GDPR won't actually stop anyone from collecting onerous data, since it basically only requires people to consent to it, and as we've seen with EULAs, people are willing to click through anything if it gives them the end result of using an application. The time for a law like that would have been literally 15-20 years ago, before companies like Facebook could tell you what someone's likely eaten for lunch or Target could tell when someone's gotten pregnant by their purchase histories. Unlikely we're going to be unringing that particular bell now...

</comment></comment></comment></comment><comment><USER17> Playing dumb doesn't cut it. Prosecutors needs to go gangbusters. In the meantime, I am now alarmed enough to Kill Facebook with fire(wall rules). [https://topnetworkguide.com/how-to-block-websites-using- pfse...](https://topnetworkguide.com/how-to-block-websites-using-pfsense- firewall-feature/)

</comment><comment><USER18> > "The report said that the company can access data in some cases even when > the user is not signed into Facebook or does not have a Facebook account."

I realize frivolous comments on HN are frowned upon but frankly this leaves me speechless.

<comment><USER19> They're called "shadow profiles". [https://yro.slashdot.org/story/11/10/18/1429223/facebook- is-...](https://yro.slashdot.org/story/11/10/18/1429223/facebook-is-building- shadow-profiles-of-non-users)

<comment><USER20> How does nobody know about these? Shadow profiles have been standard in every large advertising network for 15-20 years at least.

If your ad content is on lots of different web properties, you can "track" a user across each one, inferring data about the user one piece at a time, until you have a large profile. Then you use that profile to target ads/marketing. They never have to directly give you any data, but you can make money off of what you learn.

That's the entire reason "tracking" on the web exists. To build shadow profiles for direct marketing. Nobody thought Facebook was doing it too?

<comment><USER18> One reason could be that FB has __never__ publicly (afaik) positioned itself as an "advertising network." It's also gone on record (afaik) to say it's __not__ akin to traditional (print) publishers. It has said time and again it is a social network, and it's going to save the world.

Mind you, I'm not completely naive. I don't trust MZ & SS, but your expectation that every know and understand the inner workings of all the large aadvertising networks feels a bit excessive.

<comment><USER20> I don't expect most people to know about it, I just find it odd when news outlets make industry knowledge seem like a secret they're only now revealing.

"This just in: Door locks on most buildings can be easily picked, film at 11"

</comment></comment></comment></comment></comment><comment><USER21> Direct response to the WSJ article published _a few hours ago_ : [https://news.ycombinator.com/item?id=19226480](https://news.ycombinator.com/item?id=19226480)

That was fast.

<comment><USER22> Outline'd WSJ Article: [https://outline.com/ZUGZzz](https://outline.com/ZUGZzz)

Tangentially related article, with demands made earlier this month, by Germany's Federal Cartel Office (WSJ): [https://outline.com/Rwbzv4](https://outline.com/Rwbzv4)

>The authority ordered Facebook to make changes to its terms of service and how it collects user data. Data collected by the social network from third- party apps and websites can't be assigned to a user's Facebook account without their consent. Data gathered from Facebook-owned apps such as WhatsApp and Instagram also can't be assigned to Facebook accounts without user consent, and if consent isn't given, the data can only be used within the scope of those apps.

</comment></comment><comment><USER23> For years it was common knowledge the extent to which Facebook collects data but only now it is fashionable to speak up. FB's lobby machine will make sure no action is taken, ever.

</comment><comment><USER24> Is there some sort of a security site which rates android apps by their level of respecting privacy, something above and beyond the quality gates of the play store?

</comment><comment><USER25> The Reuters link is crashing Fennec F-Droid, the version of Firefox without the tracking. Anyone know why?

</comment><comment><USER26> yes, they access to personal data

</comment><comment><USER27> Serious question: what do people expect will come up from all these lawsuits? AFAIK Facebook has been sued over and over again since almost the beginning. None of these suits are criminal in nature so noone will go to jail. Even with billion dollar penalty these are penuts and usually gets the stock up now that investors know this specific case is closed. So really whats the purpose of all of this? Its like hitting Moon with millions of asteroids and whether craterred or not, it keeps spinning.

<comment><USER28> The point of a lawsuit isn't to destroy Facebook or its leadership. It's to stop them from doing some specific thing, and get compensation for the damage that specific thing caused.

<comment><USER27> Oh I see thanks. So they only break law once get punished and never break it again. Because 0.000000005% of their revenue will teach them a lesson.</comment></comment></comment>


Spolsky on "Commoditizing Your Complements" - <AUTHOR> http://www.joelonsoftware.com/articles/StrategyLetterV.html <comment><USER2> > Sun is the loose cannon of the computer industry. Unable to see past their > raging fear and loathing of Microsoft, they adopt strategies based on anger > rather than self-interest. Sun's two strategies are (a) make software a > commodity by promoting and developing free software (Star Office, Linux, > Apache, Gnome, etc), and (b) make hardware a commodity by promoting Java, > with its bytecode architecture and WORA. OK, Sun, pop quiz: when the music > stops, where are you going to sit down?

Eight years later, we finally know the answer to Joel's question.

<comment><USER3> They weren't making _all_ software a commodity though, just the ones that their rival had market dominance of, or where they had no chance of gaining dominance themselves.

It's easy to point and laugh at Sun, but that's the same approach to open source (and standards) that Apple used to get out of the shadow of Microsoft and they seem to be doing okay.

(The same probably applies to Sun breaking lock-in to Intel based hardware architectures. Again this applies to Apple as they had to switch from PPC to Intel, but their cross-architecture experience gave them the leg up on ARM based phone and tablet markets.)

<comment><USER4> And I've seen it argued [1] that the newer Sun multi-core Sparc CPUs actually made sense for database and webserver loads.

We may still get to watch Oracle making hay on that.

[1] for example here: <http://blogs.zdnet.com/Murphy/?p=1701> (There may be better pieces out there, my interest in this is limited.)

</comment></comment></comment><comment><USER5> Joel missed the commodity/complement parts of Java. Sun's approach with Java was to commoditize the language, especially as it ran on PCs, so that they could license the Java Virtual Machine (JVM), especially on embedded systems (e.g. phones). The Java language is the complement of the JVM. Sun was actually pretty successful in this approach.

[http://en.wikipedia.org/wiki/Java_%28software_platform%29#Li...](http://en.wikipedia.org/wiki/Java_%28software_platform%29#Licensing)

Having said that, recent history indicates that Joel's take on Sun's problems with their strategies (plural because they flip-flopped strategies) ultimately was correct.

<comment><USER6> I think the other bit he missed was the early focus Sun placed on Java Applets. I think they initially saw Java and JVM primarily as platform for distributing client side code to web browsers, to set-top boxes, to mobile phones, etc. In this way Sun's focus on Java is analogous to Netscape's efforts to distribute a free web browser--they are trying to commoditize the client to sell more servers.

Of course, as it played out Java got a lot more traction on the server side than the client side. (I think the ability to easily develop on Windows and deploy to Unix/Linux played a role in that.) But by 2002 Java had already pretty much lost on the browser side, supplanted by Flash and later robust JavaScript. I think 2002 might have been the thick of their JavaME (mobile platform) efforts though.

</comment></comment><comment><USER7> I think Joel's missing a very basic assumption in the Linux comparison. Economics is about incentives. The basic assumption he's making is that money (or lack thereof) is an incentive for producing open source software.

I seem to recall Mother Teresa being told by a reporter that they couldn't be paid enough money to do what she did. Mother Teresa's response was something along the lines of "You couldn't pay me enough money to do it either". For me the loss of time and money is negligible compared to what I gain in learning, which is immeasurable.

<comment><USER8> He's not making an assumption about cost == money at all. In fact, he says "...when an economist considers price, they consider the total price, including some intangible things like the time it takes to set up, reeducate everyone, and convert existing processes".

So when he's arguing against the "claim that it's OK for every Linux kernel revision to make all existing drivers obsolete, because the cost of rewriting all those existing drivers is zero", he's saying "there is a cost, it's just not monetary." The alternative to requiring people to rewrite device drivers is having some people make the kernel backwards-compatible with old drivers. Presumably that's simpler than rewriting every driver. What else could you add to Linux if that many developers could do something that wasn't rewrite working code?

</comment></comment><comment><USER9> FYI the article is dated June 12, 2002.

<comment><USER10> Yeah, and it is funny that he has 'retired' from blogging yet his stuff still makes it to the frontpage. I personally think some of these old articles were the best.</comment></comment>


Rust has relationships with DoD contractor Palantir Technologies - <AUTHOR> https://twitter.com/whitequark/status/1267519958235459589 <comment><USER2> And this is noteworthy because...?

</comment><comment><USER3> > Rust believes that tech is and always will be political- take some time > today to invest in your community.

Is this the stated official policy? In my head, tech (esp programming languages) were the last bastion where religion, political opinion, etc were private matter and was decoupled from the tech at hand.</comment>


Ask HN: Good finance books? - <AUTHOR>

In a recent post by Don Dodge, he says: "Diluted earnings per share are expected to be in the range of $2.12 to $2.18." I'm a compsci guy, and have no idea what something as sexy as diluted earnings per share is, let alone why it is important, what the other metrics exist, or why I should care.<p>Googling it brings up a lot of definitions, but its hard to grasp the big picture with these. The finance section of the book store is an intimidating section at first glance -- can anyone recommend a good book that will bring me to a level where I can comfortably read a financial blog post or the WSJ? <comment><USER2> Here's what I did in the past when I encountered the same situation:

1\. Looked up what reports a company has to file. The key one I liked is 10-Q.

10-Q: (from investopedia) A comprehensive report of a company's performance that must be submitted quarterly by all public companies to the Securities and Exchange Commission. In the 10-Q, firms are required to disclose relevant information regarding their financial position. The form must be submitted on time, and the information should be available to all interested parties.

2\. Look up your favorite public companies 10-Q. For me: Google's 10-Q filing => [http://www.sec.gov/Archives/edgar/data/1288776/0001193125072...](http://www.sec.gov/Archives/edgar/data/1288776/000119312507238468/d10q.htm)

3\. Get a book like Brealey, R., and S. C. Myers. Principles of Corporate Finance. 7th ed. Irvin McGraw-Hill.

4\. Using 10-Q, book, and google, go through each line of the financial statement to figure out what it means.

5\. For some insight and wisdom, look at Warren Buffet's letters to investors. => <http://www.berkshirehathaway.com/letters/letters.html>

enjoy!

<comment><AUTHOR> i will do just this, thank you for the pointer.

also, i scanned through one of buffet's letters, and wow, what a wealth of information.

<comment><USER2> great. I haven't made it through buffet's letters, but from the one's I've read I've always been very very impressed. Also worth reading are the writings by Buffet's business partner, Charlie Munger ( with this one being my favorite => The Psychology of Human Misjudgement => <http://vinvesting.com/docs/munger/human_misjudgement.html>).

</comment></comment></comment><comment><USER3> Have you checked out Investopedia?

<http://www.investopedia.com/terms/d/dilutedeps.asp>

They hyperlink to all the related terms too. Probably the easiest way to get around financial terminology.

<comment><AUTHOR> nos, thanks. i did see that site and have come across it several times while looking up terms. but as much as wikipedia and investopedia help, its tough to link everything together in the meaningful way a book might.

where to most people learn these terms? econ degrees and mbas?

<comment><USER3> Probably not an econ degree - I took a couple econ courses and they didn't cover any standard financial terminology. Pretty sure a typical MBA doesn't cover it either. Maybe accounting, but I've never taken an accounting course.

I think most people learn through going to work at a financial firm. My friends in hedge funds actually have classes (with tests, and homework) that they take within their employer, and they cover a lot of the corner cases of financial terminology. I guess I learned most of what I know through osmosis from former I-bankers and quants when I worked at a financial software startup.

If you don't mind a book from the 1930s, you could also try Benjamin Graham's _Securities Analysis_ , widely considered the bible of the field. Warren Buffett learned from that, and from pestering Graham until he hired him for his investment fund. It's really dry reading, but covers almost everything you need to know to understand income statements and balance sheets, including little adjustments you have to make to the company's numbers because they always try to paint things a little better than they are.</comment></comment></comment>


Your Ignorance Does Not Make a Programming Language Suck - <AUTHOR> http://coffeeghost.net/2008/03/19/your-ignorance-does-not-make-a-programming-language-suck/

<comment><USER2> I disagree with this. The argument seems to be that the only valid reasons to discredit a language are extrinsic to the language itself. Granted, one should always take into account the language's problem domain and design principles before criticizing for lacking X or having X, but this doesn't mean that the language itself can be poorly designed or have issues.

Java really is verbose. Perl really does have an inconsistent syntax. C++ really does lend itself to memory errors.

Do each of these languages solve the problem that they were meant to solve? I think so. Do each of them still have issues that deserve criticism? Of course.

I think that there is nothing wrong with criticizing a language. If we didn't criticize nothing would improve and there's always room for improvement.

<comment><USER3> The author seems to want to say that _language features_ are invalid criteria on which to judge the quality of a language (instead, he suggests that you should look at the quality of the documentation, the libraries, the community, and perhaps the syntax).

It's true that there are some language features, like type checking and memory management, on which reasonable people disagree. I think that those represent opportunities for innovation. Type inference, for example, seems to be changing the terms of the debate about static vs. dynamic typing.

<comment><USER4> I think of it more like this: a programming language's features are like its genetic code. A dog is not a "bad" cat, it is just a dog. Nothing more, nothing less. A cat is badly suited for some dog-like tasks (dogsled racing), while a dog is likewise badly suited for some cat-like tasks (hairball production).

However, there are some ways in which a dog can be badly designed. It can be prone to cancer or congenital diseases. It may be blind from birth. Such things are not features of dogs, but rather extrinsic properties, just as the ones listed in the article.

Or, to put it simply: it is not what you do, but how you do it.

<comment><USER3> I think it's fair to look at language features as benefits and drawbacks in languages, as long as you're aware of what those features have to offer, and what the costs are.

It makes sense to want a way to judge languages not on the presence or absence of particular features, but on their ability to achieve some goal. But what should the goal be? Popularity? Lowest time required to write programs, or to read them? Approachability for new users, or convenience for experts? Utility for writing fast programs, or for writing programs fast?

You can specialize languages down to the point where there's a different best answer for every possible goal, but because I don't want to maintain fluency in 50 different languages, I'm most interested in languages that do very well in a wide variety of ways. If you want to get down to figuring out where the trade-offs really are, and which goals can be achieved simultaneously, you can't take the attitude that every language is just great at being itself. You have to allow for the possibility that some languages really would be better all around with the addition or alteration of certain features.

</comment></comment></comment></comment><comment><USER5> Lack of closures is hardly an "invalid" reason to dislike a language, especially if the reason for lacking closures is that they're too confusing for less-skilled programmers.</comment>


Show HN: GameTime – JS emulator supporting SNES and GBA - <AUTHOR> https://matthewbauer.us/gametime-player/?repost

<comment><USER2> I managed to run some SNES roms. How to control? Keyboard didnt seem to have any effect. Would like if it would support NES as well.

</comment><comment><USER3> When dropping a rom in the window, i get this error in my browser :

> Uncaught ReferenceError: extesion is not defined(anonymous function) @ > build.js:3

<comment><USER4> Looks like a simple typo. The line in question:

[https://github.com/matthewbauer/gametime- player/blob/5f982df...](https://github.com/matthewbauer/gametime- player/blob/5f982dfd5261e6778b0f80438a23bbdb8bf00127/index.coffee#L48)

</comment></comment><comment><USER5> WOW! this is awesome. Just tried on Edge with the first rom I found, and it works almost great. Sound cuts a little.

</comment><comment><USER6> Looks great! Would really kill for some touch support!</comment>


Rewriting Reddit (2005) - <AUTHOR> http://www.aaronsw.com/weblog/rewritingreddit

<comment><USER2> > My friends over at reddit.com rewrote their site from Lisp to Python in the > past week. It was pretty much done after one weekend.

It should probably be noted that this is from 2005.

> The Lisp newsgroup, comp.lang.lisp, was upset about the switch that they're > currently planning to write a competitor to reddit in Lisp, to show how > right they are or something.

Here's what became of that: <http://www.cl-user.net/asp/new>

<comment><USER3> From that site: [https://groups.google.com/forum/?fromgroups=#!topic/comp.lan...](https://groups.google.com/forum/?fromgroups=#!topic/comp.lang.lisp/KMdpv4MwI4M)

"The Common Lisp Directory rewritten in Python" ;-)

<comment><USER4> [https://groups.google.com/d/msg/comp.lang.lisp/KMdpv4MwI4M/A...](https://groups.google.com/d/msg/comp.lang.lisp/KMdpv4MwI4M/ANhvu-43-RwJ)

An April fool's joke.

</comment></comment></comment><comment><USER5> Though the article is new to me I don't understand the context of this submission.

(Never using web.py and not being fully aware of Django's status in 2005) I see that overall they seem to have faired well. All you need is a settings.py file to run a Django app. The templating is slow performance-wise but pretty expressive.

I love that the Django community as a whole is pretty responsive to criticism. The 'Why Django Sucks' talk at DjangoCon is an example. My biggest complaint was the horrible User model (you cannot not have 'username' for a Django app using the User model). But they've fixed it now. The major complaint against Django is that it is monolithic, but the devs have worked hard to keep the system decoupled allowing one to replace most modules. But if you want something small Django is not the one for you I guess, and there is nothing wrong in it. One size fits all is never possible to achieve and not a good solution too.

<comment><USER6> Django 1.5 has pluggable user models (at last!)

If you're looking for a nice Python web framework, try Pylons/Pyramid

Pylons is loosely coupled. Not Django.

Django is _not bad_ and it certainly makes it easier for 99% of projects out there (CMS style). But for the 1% it's a pain.

<comment><USER7> I'd suggest Flask. Flask is a very lightweight microframework, yet it contains everything you need to write a web app in Python. If you want to write everything in one file with Flask, you can. If you need several files, you can do that. You can use proper views if you want. Or not.

<comment><USER8> It doesn't contain everything you need at all - that's why it's called a microframework.

If you want to use an ORM, or have database backed sessions, or user logins, you need to write all that yourself. For example: <http://flask.pocoo.org/docs/patterns/sqlalchemy/>

Depending on what you're doing, that might be a good thing - but I find writing things which are already included in Django pretty annoying.

<comment><USER9> Depending on the complexity of the project it might take you just as long to read how a monolithic framework decided to tie everything together (warts and all, because that will inevitably have historical cruft and technical debt).

The extensions were mentioned; User logins for example are just a "pip install Flask-Login" and "from flaskext.login import whatever" away. I had reason to roll my own, ~100 simple lines that were easily plugged.

There are pros and cons, neither is "better", the right tradeoff depends on what you're making.

<comment><USER8> Well, except that the login process for Django has a lot more people looking at it, and you know that the parts are going to work together pretty well.

For example, Flask-Login ([https://github.com/maxcountryman/flask- login/blob/master/fla...](https://github.com/maxcountryman/flask- login/blob/master/flask_login.py)) imports md5 and sha1 - not a very good sign. How do I make it use something sane? Well, there's Flask-Bcrypt, which provides bcrypt hashing... except that it makes no mention of Flask-Login or how to integrate it. Flask-Login also doesn't mention Flask-Bcrypt.

So... you're back to hacking on or digging into Flask-Login to figure out how it works and making it use Bcrypt or some other hashing algorithm.

Wait - I just realised that Flask-Login doesn't handle _storing_ user data or models, or checking passwords, just logging them in. So what do I need for that? Is that Flask-Principal? And just WTH is an IdentityContext, anyway?

      An IdentityContext is the context of a certain identity
      against a certain Permission. It can be used as a
      context manager, or a decorator.

You see why people use Django now? :) Sometimes you just want the standard user-logging-in-and-storing-in-the-database without having to write it yourself.

</comment></comment></comment></comment></comment></comment><comment><USER10> Though this is 'old news' I was surprised by knowing who stands behind web.py.

Several years ago I was doing a little cozy web questionary tool and after trying Django, PHP, Perl, etc I've come to web.py framework. It was pleasure to work with databases, web templates, etc in web.py environment. I really enjoyed making the tool and the result code was tiny, clean and easy for understanding. Though it was a tiny tool I was very proud and next time I used web.py for a bigger project (proprietary for internal use only) and it was pleasure again.

Recently I've read three parts of "raw nerve" articles and found them interesting. But I didn't even pay attention on author's name. Now reading "Rewriting Reddit" all the pieces has been bringed together and I'm thankful to Aaron for his web.py and "raw nerve" articles.

</comment><comment><USER11> This is from 2005.

I'd be very interested in hearing which of the criticisms against Django are still relevant, and which have been fixed. I've been using Django for a few years, and love it, but I don't really know what the state of Django was in 2005 and many of the things mentioned seemed, to me, to no longer be present. Then again, I haven't used web.py, so maybe there is a better way than Django in some areas I'm not aware of.

<comment><USER12> web.py was viewed as a big joke, because it was quite crude.

Django has merged the magic-removal branch a long time ago, pre 1.0 and since the newforms branch (also merged aeons ago) it can generate forms and validation. The template language is limited by choice which might or not be a good thing. Personally I think the idea is good, just the execution is inferior to Jinja2. If you don't like it, you can replace it, that's what loosely coupled means. aaronsw things loosely coupled means it is a library. It is not, it has stayed a framework and that hasn't changed since 2005.

<comment><USER13> > web.py was viewed as a big joke

and a few years later flask started as an april fools joke.

</comment></comment></comment><comment><USER14> when talking about the API he states ": I imagined how things should work and then I made that happen... So how should things work? The first principle is that code should be clear and simple. If you want to output some text, you call web.output. If you want to get form input, you call web.input."

This is beautiful and exactly what programmers need. I can't emphasize enough the importants of simple intuitive APIs. This, for example, is in my opinion the #1 reason why jQuery dominates web frontends.

</comment><comment><USER15> Please put 2005 in the title.

<comment><AUTHOR> Oops! no way to edit now :(

</comment></comment><comment><USER16> Heh:

 _Oh, and isn't reddit's real problem that they're busy changing implementation languages (!) while digg is sorta kicking their butts? I don't know which site is doing better financially (does either one even have a biz model? What might it be, one wonders), but digg seems more polished, has a more pleasent UI, seems more featureful, and more popular.

Setting aside the Python v. Lisp debate (which is so boring and pointless), I'd hate to be in what seems to be reddit's position: serious, robust competition and remaking fundamental tech decisions.

Eek!_

<comment><USER17> That was true back then. Nobody could foresee that Reddit would get acquired, and Digg would swing for the fences and fail.

Among other things Digg got overly ambitious, and took what turned out to be too much funding in the subsequent years. In the meantime, Reddit was growing organically under Conde Nast without the pressure of VCs looking for a return. Digg was forced to take big risks, and we know how it turned out.

</comment></comment><comment><USER18> Even as somewhat of a lisp weenie myself, I still think they made the right decision at the time. If this had taken place in 2012, it would be another story. Clojure is an awesome web language, and so is Ruby/JRuby. Hell, even Node.js would be a good fit for reddit.

</comment><comment><USER19> This Arc language mentioned in the comments should be a big thing right now.</comment>


Our holiday / vacation policy – unlimited with bonuses  - <AUTHOR> http://blog.boxedice.com/2011/08/19/our-holiday-vacation-policy-unlimited-with-bonuses/

<comment><USER3> I like this sort of policy a _lot_ more than I like "Just take off whenever", because it establishes specific expectations that _taking a day off TODAY is actually OK._

The all-you-can-eat-no-tracking-but-watch-out-for-the-evil-eye vacation policies scare the bejesus out of me, because of the potential for (planned or unplanned) social pressure to never leave. It is like "Take as much salary as you want!" coupled with getting guilted for every $5 bill you took out of the drawer. "Whoa whoa whoa, $3,000 this month? Somebody's a big spender! Dude, you don't even have a family, what do you need $3,000 for!?"

<comment><USER4> _The all-you-can-eat-no-tracking-but-watch-out-for-the-evil-eye vacation policies scare the bejesus out of me_

This is how I feel about leave in academia. I _can_ basically take as much leave as I want. But because there's no clear expectation of how much leave to _actually_ take, there's this (totally implied) social pressure to never leave.

I kind of would much rather be at a place like this where they say " _use_ your time off" and clearly signal this by either have "use it or lose it" policies or this kind of vacation bonus.

Incidentally, in Sweden vacation bonus (semestertillägg) is mandated by labor law. For each vacation day taken, you get something like an extra 1% of your monthly salary.

</comment></comment><comment><USER5> I really like this. They're an English company, of course, and must adhere to the European legal minimum of 28 days a year. I've never understood the American attitude towards vacation - unnecessarily macho, and geared towards burning people out (and, at the two-weeks-a-year end of the spectrum, effectively forcing people to never leave the country).

<comment><USER6> Depends on the company. In my home country in Austria I've got 25 paid days off + public holidays per year. Here in the US I get 15 paid days off (+ public holidays). While it's lot less it is not that bad.

<comment><USER7> Three weeks seems pretty unacceptable to me. I would be alright with four weeks and happy about five.

<comment><USER6> Just take the holidays between the jobs. :) I took 4 months off between my last job and my current job, even though I would have had the chance to start immediately.

In addition, some companies here also allow you to take unpaid holidays if justified. Even with an additional of two weeks of unpaid holidays I would earn more money here in the US than in Austria (and the available jobs are much more interesting).

<comment><USER7> I guess that's an alternative but what if I don't want to switch jobs all that often?

I personally need regular breaks. Irregular and really long breaks do less for me than regular breaks.

</comment></comment></comment></comment></comment><comment><USER8> I'm not a huge fan of the "unlimited" time. I've never worked somewhere with that policy, but it seems an unintended result would be that nobody knows exactly how much time is considered "reasonable". The policy likely sounds way better than it ends up being.

I say pick a number that you think no productive employee should exceed. Make that the yearly number, and make sure everyone knows that they will be encouraged to take ALL their days. Make the days expire after a year, so people don't feel the need to "bank" days. Then, everyone knows where they stand in terms of how much vacation they "should' be taking.

For the record, If I were starting a company now, I would make the number of days in the aforementioned system start at 20, and then increase with seniority.

<comment><USER9> As someone else noted many of these ideas won't work in countries where large chunks of payed holidays are enshrined in law.

In Australia most of us have 40 days per year that roll into the next year if you don't take them. There are options for employees to turn in some of their days for cash if they accrue a lot which is nice.

<comment><USER10> _In Australia most of us have 40 days per year_

Err.. most of us have 4 working weeks of paid vacation per year. That's 20 days, not 40 (although it excludes paid sick leave - usually 10 days - <USER2> public holidays). Vacation leave usually rolls over, but sick leave varies. Public holidays don't.

(I'm Australian, and I've never seen variance on this except on the roll-over rules. The one exception is my current employer that offers an extra day off on your birthday)

<comment><USER9> Gah you are quite right maths on a hangover obviously isn't my strong suite.

</comment></comment></comment></comment><comment><USER11> Unlimited*

*Means 'you can't have a year off!' I'd report you in Australia if you abused that word here.

Don't apply buzz words to your own employees as they do not want to feel like a sale; especially if they live in a country where people have got burnt for 'Unlimited' (ISPs, Shared Hosting, etc). Be more clear: "You can have up to most of the year without much restrictions (We might need your help!)" etc.

</comment><comment><USER12> Caution to US workers: if layoff time ever comes around, you get paid $0 for your unused vacation time under this kind of policy. I know, it happened to me.

<comment><USER13> True, but that's not entirely bad. It even further encourages you to actually take your vacation. Since there's a checkpoint at the end of the year, you should never have more than a year's worth of vacation "saved up", and really, a policy like this wants you to take vacation slowly and steadily and never burn out.

Also, if you're a US worker and your employer is yelling at you for taking fewer than 5 weeks off, not including public holidays, you're in a pretty awesome situation.

<comment><USER12> Most years, I schedule a solid 2 or 3 week vacation to completely unplug from the office. For US people, that would consume most of your "socially acceptable" vacation time allotment during a calendar year. That particular year, my 3 week vacation was scheduled for September and I get laid off in July, so yes, it _was_ entirely bad.

At my next job there was an annual allotment of 3 weeks of vacation that accrued little by little every pay period. I was able to "borrow" time from the next year so that I could take my already-booked vacation. And, for the duration of that job, I maintained a negative vacation-time balance vowing to not get screwed again.

Unfortunately, whenever I hear of the "fantastic unlimited vacation time benefit," I can only view it as a way for the CEO to milk an extra month of work out of employees before laying them off at no cost.

</comment></comment></comment><comment><USER14> Worst use of the term "unlimited" since bandwidth-throttling ISPs. Basically they seem to be flexible about holiday timing and to have a Japanese-style minimum vacation policy.

</comment><comment><USER15> If you have a small team and everyone is passionate and good at their jobs, does it really matter what the policies are?

The real challenge is in a larger company, where that assumption may not hold. Are there any existing examples of anywhere near as liberal a policy in such a company?

<comment><USER16> Correct. And a big company saying you can take any number of days off as you want is a big earning sign for me. One of the reasons I don't even think about joining Netflix.

</comment></comment><comment><USER17> I think you can have this kind of policy in a smaller company because you are assumingly in a closer relationship and also lack of funds , so that you must adapt to each others needs and work out in the interest of the company.You must trust each other more i think and that you must be closer and respect the other persons situation

On the contary....

Most bigger companies are impersonal and see you as mere statistic and will not be so felixble as they would say" many other guys would take your job". So thats why such actualy fair holiday conditions seems weird.

<comment><USER18> Best Buy corporate was at least testing a similar setup a few years back. I'm not sure what happened, but I'm not sure this is exclusively small company.

</comment></comment><comment><USER19> This is considerably better than others since he comes out and s ays it's 30 days off.

But it leaves many questions unanswered. Is it paid holiday or not? I see there is a bonus for unused days, that seems to imply it is paid holiday.

The bonus scheme clearly is designed to wrap up so things don't carry over from year to year.

That does prevent someone from banking time to be able to take a 3 month sabbatical to write a book. Whether that would be permitted is not disclosed.

<comment><USER4> _I see there is a bonus for unused days_

You read it wrong, there is a bonus for _used_ days.

<comment><USER19> Hm, well thanks for the clarification. I just reread it several times and it's not clear. I'll agree that it's ambiguous. It would be interesting to know more. Is this a fixed 25 day cut off then, or is it prorated? Kind of alarming is the part where the monthly salary as an example is £100, surely he meant to type £3000?

It sounds like you might work there? If so I have a couple questions for clarification, in addition to (1) clearing up that the £100 thing was just a random number and not representative (since some Chinese developers do make in that range, so it's not an impossible salary to claim). (2) Did "What's normal for time off varies from country to country" mean that US employees of the company (for example) are expected to use less days than european ones? That the cut off for what is considered "unreasonable use" differs depending on company. (3) If the answer to that is yes, then are salaries matched to standard market rate in the economy each employee lives in? Are SF based employees paid 20 times as much as the guy in Bangladesh for the same work? (4) With a worldwide workforce, how does the company handle paying social insurance tax and providing for benefits in each country? Are competitive insurance plans offered, a different one for each employee? Or is there some insurance company that is able to provide insurance for all employees regardless of what country they are citizens of and resident in? Thanks for any clarification you can provide, these are all interesting subjects.

</comment></comment></comment><comment><USER20> We have a similar policy but even more open. The one rule is that any time-off needs to be approved by the person's team: can the team still meet their commitments?

We figure that if we need to trust teams of people to make complex technical decisions and want to have people around who are basically programming artists... Well, then we should be able to trust those teams with managing their own time.

So far, no one has ever taken advantage of this.

<comment><USER8> That policy is crap.

Any time someone takes vacation their team is going to move a bit slower on the current project. Commitments should be built around vacation, not the other way around.

<comment><USER20> Sad to see responses like this on Hacker News (referring to your usage of the word crap). Ah well.

Why we know this isn't "crap".

Commitments are built around Vacation AND Vacations are built around commitments. It doesn't have to be an either/or proposition and here is why:

We apply Agile and the management aspect of our company uses Scrum. The teams are self-organizing. This even includes who is hired into the team and who is fired from the team. The team commits to an amount of work (it isn't forced on them by management).

This commitment process is very well defined in Scrum through the iteration planning meeting. If someone wants to take time off to go on vacation, then during the planning meeting (and hopefully they talked about it with their team members before), they let the team and product owner know at the start of the planning meeting (every team member, as Scrum requires, let's everyone know the number of hours they have available to commit directly to the current log).

In this case - Commitments are built around vacation.

On the other hand, the team has been given the authority and responsible of getting out potentially shippable product increments (a part of Scrum). The team, as a whole, has taken on this responsibility so, as a whole, must take that into consideration when taking time off.

In this case - Vacations are built around commitments.

Our approach to time-off and vacation aligns quite nicely with the Agile process and, in my opinion, is an other example of why Agile (and Scrum in this case) is such an amazing way to manage the production of software.

<comment><USER4> Aren't people chronically optimistic about how much time something will take? Unless your teams are awesome time estimators, this sounds like it would mean that if the schedule slips, out goes your vacation? And that sounds like a recipe for a burn-out spiral.

</comment></comment></comment></comment><comment><USER21> I'm very confused about the bonus calculus.

More days of = more bonus, fewer days off = more bonus, or you always get the same bonus?

<comment><USER22> If you take at least 25 days off, you get the bonus. Fewer than 25, no bonus.</comment></comment>


Ask HN: Best time series database currently - <AUTHOR> I am looking for a database to store time series data from sensors and found CrateDB. It looks very interesting. Does anyone have experience with it?
I need something that will scale well horizontally, which it seems CrateDB should be able to do, and CrateDB also has a MQTT broker built into their enterprise version.
Or maybe some other alternative that will scale well?
I am looking at influxdb and Prometheus also but the MQTT broker in CrateDB really appeals to me. <comment><USER2> Just have a look at Timescale. It's a open source postgresql extension, and can sit side by side with other stuff. Scaling postgresql should be no problem for you.

[https://www.timescale.com/](https://www.timescale.com/)

<comment><USER3> I don't think PostgreSQL scales nice horizontally. I do use TimescaleDB though and it scales really nice vertically, but would probably be hard to make it run on multiple machines.

<comment><USER2> I see timescale more as an alternative option, since the OP also aksed for this. - And you're right, since Timescale is an postgresql extensions, it also has the same benefits/problems as postgresql itself in this manner.

<comment><USER4> Thanks for the recommendation of Timescale :)

Here are some more details on our future plans for clustering. We do have horizontal scale-out clustering on our roadmap and it's hard to say exactly when it will be released, but we are aiming for the 2nd half of 2018.

That said, we do often find that there multiple reasons why people ask about "clustering" or say they need scale-out:

A. Because you want to scale the amount of available storage - (we allow you to elastically add disks to scale-up the capacity on a single hypertable, have had customers scale a single hypertable to 500B rows)

B. Because you want high availability - (we support this today, via PostgreSQL streaming replication and will be documenting this further)

C. Because you want to support more concurrent queries - (supported today across primary replicas)

D. Because you want to support high ingest rates - (depending on your use case, we have users doing 100-400k rows / second)

E. Because you want to parallelize individual queries (that touch a lot of data) - (some support for parallelization today, more to come)

So we do meet the needs of many today without support for full scale-out clustering (scaling vertically, as jurgenwerk points out). If your requirements are closer to millions of rows per second inserts and storing 100s of TBs / PBs of data, we can't yet support this, but working towards it!

</comment></comment></comment></comment><comment><USER5> OpenTSDB scales well, 10 million DPS writes on a 36 node cluster for example. It's not easy to get working _well_ at scale out of the box. That is something we really need to work on in that community. There is a project called Splicer (github.com/turn/splicer) that will shard the incoming queries into 1 hour blocks and cache the 1 hour blocks, it also sends the queries to the same node where the region server is that hosts the data. This makes the queries VERY fast.

</comment><comment><USER6> how about kdb, the time series in memory db, long history in financial services

</comment><comment><USER7> We use DynamoDB at my place. We had to make some tooling around it and figure out some growing pains, but now we have an extremely scalable solution.

</comment><comment><USER8> I don't know anything about this, but it might help if you provide information on what you want to do with the data.

<comment><AUTHOR> My main concern for now is to be able to store/write the data collected from a million IoT devices in a scalable fashion, so there is not really a requirement for what to do with it other than, when the data is there it will be analyzed on an adhoc basis and then we will see what we can do with it.

<comment><USER9> That is going to be hard to achieve.

To know how to store the data, you need to know how you will query it.

If you know how you will query it, you can say devise a way to store it in Cassandra.. which will scale up to PB.

If you just throw in a PB of data, I am not aware of ANY system that is going to let you drop ad-hoc queries at the data and get fast answers. You effectively need to load most / much of the data off disk to process it.

If you only want to store it and not query it yet.. store it off on flatfile. When you decide how you will query it, load it from the flatfile and switch writes to your new system.

<comment><AUTHOR> I recently built a system capable of handling this load, but is was based on MongoDB and thats not an option in this project because of hardware constraints.

Cassandra may be an option. I will look into it.

<comment><USER2> Maybe this is a better option for you.

[http://www.scylladb.com/](http://www.scylladb.com/)

</comment></comment></comment></comment></comment><comment><USER10> It may be worth looking into what AWS has to offer. Their IoT offerings seem to be pretty solid.</comment>


IOS7, now available for the public - <AUTHOR> http://apple.com/ios

<comment><AUTHOR> You can upgrade to iOS7 though Settings => General => Software Update

<comment><USER2> Make sure you're on wifi. This one racks up at 752MB.</comment></comment>


Ask HN: What are interviews like in non-software engineering professions? - <AUTHOR> Currently going through the hackerrank/algo DS process.<p>What is it like for other fields, especially other engineering fields? <comment><USER2> I am a chemical engineer currently working in a consulting niche (air emissions control and regional air quality management). My interviews have very consistently been designed to test my writing and public speaking skills, which are admittedly crucial in my job, rather than specific engineering knowledge. At this point, my resume contains reasonably strong evidence that I possess such knowledge, but that wasn't the case when I was starting out and the interviews weren't really any different. The closest things to technical questions I can remember being asked are of the form: "Imagine a piece of equipment you are responsible for isn't working. What are some steps you would take to identify and solve the problem?"

I have also occasionally interviewed for non-SWE positions at tech companies (usually data scientist or regulatory compliance positions, both of which are closely related to my current field), and I have found the interviews to be similarly light on technical material, but with much less emphasis on speaking and writing skills.

Not having been through any SWE interviews myself, that's about as much as I can say in comparison. My loose impression is that SWE interviews are relatively heavy on logic puzzles and mini coding problems, but that's all I know. I am happy to answer more specific questions about my experience, of course.

</comment><comment><USER3> Less stupid technical questions, because there are much less cheaters and you can trust the given educational background.

I worked as architect, mech. engineer and various other engineering sectors. There are some technical questions of course but nothing like whiteboarding binary search or tree traversal.

</comment><comment><USER4> A young rocketry startup once offered to an applicant a challenge to show skills with hardware. This kit - [https://www.sainsmart.com/sainsmart- balancing-robot-kit-v2.h...](https://www.sainsmart.com/sainsmart-balancing- robot-kit-v2.html) \- was required to assemble and in general to make working in a week and bring back the results. The kit was given by the company.

</comment><comment><USER5> Reading at the comments, it tells me how easy, fast and cheap it would be for a machine to crack a software job interview with TODAY's technology. It tells me software dev jobs are the first inline when AI will take over.

<comment><USER6> Nah, the standard software engineering interviews don't represent the day-to- day reality of a software engineer. That's why they're so frustrating and impractical. So maybe you can build some deep learning bot that can pass an interview, but it won't know how to gather requirements or deal with vague and contradictory requests. We're far away from AI figuring out that what people want and what they need are often very different things.

</comment></comment><comment><USER7> I've often wondered if non-SWP interviews involve homework... I hate this aspect of interviewing for positions.</comment>