Cameron 'Porn' Advisor's website 'hacked' – Threatens/Libels Blogger - <AUTHOR> http://www.ministryoftruth.me.uk/2013/07/24/cameron-porn-advisors-website-hacked-threatenslibels-blogger/ <comment><USER2> There is pretty substancial technological gulf opening up between the "ruling class" and the "reasonably well educated folks" out there. This could be as disruptive and problematic as the widening gap between the wealthy and the poor.

Porn filters will be of no concern whatsoever to anyone under 40 with the most rudimentary technical chops (and appetite for porn). What else will be banned? It is getting to the point where fearmongering and shameless populism and shilling for votes by politicians result in useless laws being enacted only to incriminate anyone at all, when the opportunity presents itself to make an example of somebody.

I suspect this technological gap is going to get much worse before it gets better, if it does get better at all. The types of people who participate in the game of politics have very little in common with the types of people who have an understanding of the technical world. But can that last forever? Kids now live online with few exceptions, and a technical understanding of the world will hopefully become second nature to most people, eventually.

<comment><USER3> Like most techies, you're focusing on the effectiveness. This is both missing the point and dangerously underestimating the intelligence of the people behind such measures.

Just like most of the anti-terror security theater, it's not about being effective in any way, it's about slowly getting the general population to accept increasingly repressive measures and a tighter grip of the "ruling class" on society in general.

Once filtering has been generally accepted, they can gradually start figuring out how to censor the things they really don't want us to see (and guess what, it isn't porn) without having to worry about further social or legislative hurdles.

There is no technological gap between "us" and "them". There's a gap in political savvy between "them" and "us", and we're on the wrong side of that gap.

<comment><USER4> I think you're looking at this as too much of a conspiracy.

This is just attempting to gain the control they had before and have now over every other media. They can prevent hard porn on TV or in the window displays of high street video rental shops. Why not the internet?

From their perspective the internet is a loophole they are trying to shut down.

Internet freedom happened incidentally as a side effect of how the technology worked. It wasn't brought around by ideology like traditional "free press" was.

<comment><USER5> > _I think you 're looking at this as too much of a conspiracy._

I agree, but I think that you might be looking at it a little bit too much as of a conspiracy as well.

IMO it's not even about closing loopholes and stuff; it's about increasing their popularity to make sure they get reelected / get more money. That's it. I think short-sightedness of politicians explains pretty much all of it.

Current democracy as a system optimizes strongly for popularity, and optimizes people with any kind of long-term agenda out of the system.

<comment><USER6> "Current democracy as a system optimizes strongly for popularity..."

This is what democracy has always done.

<comment><USER7> I think you're mistaking the popularity of politicians, with the will of the people and vox populi.

</comment></comment></comment></comment></comment></comment><comment><USER8> Aaaaand ... the other shoe has just dropped:

[http://order-order.com/2013/07/24/poll-result-86-of- readers-...](http://order-order.com/2013/07/24/poll-result-86-of-readers-say- sue-claire-perry-guido-has-instructed-lawyers-to-commence-proceedings/)

Guido Fawkes is talking to his lawyers about Libel. (Which under English law -- the reforms haven't gone through yet -- places the burden of proving that she _didn 't_ damage his reputation squarely on Claire Petty's shoulders.)

I'm just astonished that an MP appears to have been so ignorant of the law of her own land (and how it applies to twitter) that she left herself wide open to this.

<comment><USER9> Isn't this the same libel that that has been used to punish journalists who write about inconvenient truths? It seems hypocritical to stoop to that level.

<comment><USER10> What she said could be grounds for a libel suit in the US as well. The real difference is in the defense that she could mount.

Why should journalists abstain from defending themselves from libel in the UK just because others abuse those laws to attack journalists? Suggesting that journalists should not defend themselves from libel just because others abuse libel laws to shut down journalists is damn near concern trolling.

</comment></comment></comment><comment><USER4> I've mentioned this before on one of these threads: I think any focus on the sexual morality of politicians, political point scoring and such is superfluous.

Porn and other "offensive content" has been restricted or banned in pretty much every time and place by various means. Even if an outright ban does not exist in blanket legislation, there _are_ restrictions, codes of practice, industry bodies, laws applying narrowly to certain media channels or something like that.

Basically, porn gets regulated/restricted/banned always by whatever authority has the means to do so. Always. And some authority always has jurisdiction in some way over every mainstream media source. The difference on the internet is that no one _could_ regulate it. There was no authority or industry body. No power that could be appealed to. Now the internet can be regulated, seemingly.

That is the story here. Not "Cameron is a prude" or "Cameron is pro- censorship."

The internet is regulatable now. _That 's_ the story. This probably means that the same restrictions that apply elsewhere (TV, radio, print) will apply online.

<comment><USER11> I'm not sure this is true. Oh, I don't argue with your point about the historical facts of restriction, but I do think that the internet is still far from regulatable. The story is still really that politicians believe it is - it isn't, but they don't have the expertise to comprehend why that's the case. The internet is a mass publishing medium, not just a mass consumption one.

Legislation has historically successfully targeted only publishers, and you can do this when the number is fairly small, but not when that target is "everyone" because of the work required in monitoring (which is still not amenable to automation, despite what politicians may believe - it's still just too hard for the software technology we have).

<comment><USER4> I'm not 100% sure I agree with me either. :)

I agree with your point. Being a mass publishing medium is what has kept the internet in anarchy thus far. In some cases, I think it will be possible to regulate publishers with some success. If you can get 10-20 companies to comply, you're covering most of the web.

For porn, that's not going to work. But, a filter probably will.

Censorship and contend restrictions don't need to be airtight. They never are. It's enough to just move things from mainstream to marginal. Seeing breasts, arses & fleeting (preferably comical) glimpses of balls is normal and OK, but unadvisable for young children. Genitalia in non sexual contexts is new, but now OK too (thank you embarrassing bodies). You can watch that with your friends or teenage kids. Genitalia in a sexual context is not OK. You look at that alone with a laptop in shame. You have to buy it from licensed sex shops with darkened windows.

Regulations & mainstream public opinion cross influence each other but actual line is more or less defined by TV standards and practices.

All internet porn (or political opinion or any subject of cencorship) filtering has to do is reclaim the control of that line. If you have to call up and ask for porn access or use tor to get it, it might let them do that.

<comment><USER12> "Seeing breasts, arses & fleeting (preferably comical) glimpses of balls is normal and OK, but unadvisable for young children. Genitalia in non sexual contexts is new, but now OK too (thank you embarrassing bodies). You can watch that with your friends or teenage kids. Genitalia in a sexual context is not OK. You look at that alone with a laptop in shame."

Did you really just go and claim that seeing breasts is unadvisable for young children?

You complete and utter fuckwit. Do you think breasts are just there for you to leer over in your lonely cave of shame?

<comment><USER13> He claimed that most societies(and at least the Western ones I've had contact with match that pretty well) shun exposing sexual organs to children. I don't see why the rage. This is not a controversial comment to make.

<comment><USER12> Given that breasts are primarily for small children to drink from, to suggest it is damaging for small children to see them isn't just controversial, it is the height of bewildering and crazy idiocy from someone who must be so unconnected with reality that if they ever accidentally encountered a rational train of thought, they'd probably try to throw themselves under it.

And it wasn't rage, it was accuracy.

<comment><USER4> Seeing breasts between the ages of 5-12 is highly likely to make your child a forum troll.

Just sayin.

<comment><USER10> Speaking of trolls... you cannot honestly believe that.

<comment><USER4> 'of" or 'for'?

<comment><USER10> "of".

Are you not aware of what a troll is? Because you are plainly one.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> It worries me that people that have absolutely no understanding of even the basics of how a system works have any ability to regulate it. The worst part is, there are MPs who do have a good technical understanding, but for the most part they're drown out by the shrill cries of 'save us from ourselves!'.

I cannot imagine how much torture it must have been to try and explain the concepts to someone who just does not care. It's wilful stupidity.

<comment><USER15> Its not just technical, is all over government. Education ministers usually have no grounding in education, health ministers usually have no grounding in health, armed forces ministers usually have never serves, home secretaries usually have no grounding in law enforcement, and so on. All they know is what their supporters think and they apply that to garner votes. At best, such people only know how to manipulate parliament.

This is democracy......

<comment><USER16> Government ministers don't even need to be elected MPs. For a UK example: Peter Mandelson in 2008. It's the parties who decide who becomes minister, and as such they _could_ pick and choose domain experts, if they wished.

<comment><USER15> Well, currently we have this Tory media adviser, or what ever he is supposed to be, who is said to have influenced this current government in to not blanking cigarette packets as he is connected to a tobacco company. Dunno why you picked an old example when we have a current one, which has more of an obvious self serving connection. Mandelson can be argued to have been "advising" from principle.

That said, I dont see how any one can be sure an adviser is advising and not setting policy. And if they don't have influence, there is no point having them, but then people would argue that ministers should have advice from advisers, especially as most of them have no grounding what so ever in the department they are supposed to be running.

<comment><USER16> > Dunno why you picked an old example when we have a current one

Sorry, I used to live in the UK but now live in Belgium, so my knowledge of UK politics is somewhat outdated.

In Belgium we had a new minister of finance appointed in March, who as far as I know has never even been up for election for anything: [https://en.wikipedia.org/wiki/Koen_Geens](https://en.wikipedia.org/wiki/Koen_Geens)

<comment><USER17> _> In Belgium we had a new minister of finance appointed in March, who as far as I know has never even been up for election_

Amateurs :) Italy has had a wholly-unelected _Prime Minister_ for two years: he was nominated Life Senator by the President and sworn in as PM a day later. In every other parliamentary democracy, this would have been called a _coup d 'état_, but Italy works more like South-American banana republics.

And the best thing is, he was drafted exactly on the basis of _domain knowledge_ (he was a banker and euro-bureaucrat) for a country still in the grip of wide-scale economic crisis, and all his ministers were appointed on the same basis: lots of academics, high-profile intellectuals, bankers and industrialists. Results were underwhelming to say the least, and last Spring voters basically disposed of this group in a general election. But the President all but re-elected himself (to another 7-year term, which is unprecedented) and again hand-picked a PM who's basically forced to follow the same political platform of his "golpist" predecessor.

So yeah, domain knowledge won't save your ass. Political problems are always _political_ , not technical, and require political solutions, i.e. people shouting that this will not do, do that instead.

</comment></comment></comment></comment></comment></comment><comment><USER18> I find the technological incompetence of our political leaders and advisers very worrying. I doubt any of them could describe the difference between The Internet, The World Wide Web, a web browser and a search engine.

<comment><USER19> It's not only your leaders. Things are same everywhere. In India, one can say anything about government openly but say something on social media site and fool leaders will try to censor you.

There have been multiple instances displaying how bad situation is. A movie company was able to get court orders to stop piracy of their movie and this ended in ban over 70+ sites. Not specific pages, blanket ban on whole sites. [1]

Then we have had a girl arrested over liking a Facebook post criticizing a leader[2]

I had high hopes with our generation but looks like most of the people in early twenties are not much better.

[1]: [http://www.ndtv.com/article/india/singham-effect-file- sharin...](http://www.ndtv.com/article/india/singham-effect-file-sharing- sites-blocked-121249) [2]: [http://newsfeed.time.com/2012/11/19/indian-woman- arrested-ov...](http://newsfeed.time.com/2012/11/19/indian-woman-arrested- over-facebook-like/)

<comment><USER20> > I had high hopes with our generation but looks like most of the people in > early twenties are not much better.

I know a 12 years old who can't watch photos on a usb stick or a cd-rom if the windows dialog "what do you want to do ?" doesn't show up when inserting the disc or the stick on the computer. But he has mean fingers to send a gazillion sms per minute.

I know adults who seem unable to grasp the concept of resolution as they keep adding 4000x4000 pixels images in their powerpoint. And they seem to forget as soon as I tell them where the "shrink images" function is.

My outlook on this is that things haven't changed since the 90's (when I was a teen): some people want to know how computers work or make them work "better" and some just want stuff done. The first are more technologically literate (more like jack-of-all-trades) than the second but I am not convinced they are automatically better set for life as a result or that what they do with the computer is more appreciated.

<comment><USER21> Nah, the other half is just stupid or lazy. It's the same kind of people who will ignore screwdriver and will try to pry the bolt out with pliers unless they have been shown the benefits of using the proper tool in the past 15 minutes.

I work at a large library and the smart, non-tech people are _genuinely_ interested in improving their and their peers' effectiveness and are willing to learn. I frequently chat with a friend who can make shoes, design and construct electrical devices, build small buildings, survive in nature and anonymously watch things he's interested in on the Internet. He frequently asks about relevant things and gives advice from his fields of knowledge.

Some people just _are_ better than the rest.

</comment></comment></comment></comment><comment><USER22> I am not usually the one who laughs at technologically illiterate, but this is hilarious, not because she is blaming the blogger for hacking, but because her people are the ones who are deciding how the internet behaves, and yet they have no understanding of even basic stuff. So I find the idea of them making the decisions about something they are literally illiterate about amusing, and haunting.

<comment><USER23> It's funny if a top politician is clueless about the web.

Unfortunately, this particularly clueless politician is the UK's Secretary of State for Defence. She has nuclear submarines....

<comment><USER11> Thankfully she's only the PPS to the Secretary of State for Defense. The actual SSD is the far more capable Philip Hammond... (Hmmm.)

<comment><USER23> Ah, thanks for the correction. Speed-reading her Twitter header...

</comment></comment></comment></comment><comment><USER24> Carl Sagan once famously said "We live in a society dependent on science & technology, in which hardly anyone knows anything about science & technology" Nowhere is this more true than in Parliament!

</comment><comment><USER25> Libel and blackmail from an MP, why am I not surprised. Does anyone know if Kickstarter allows funding of legal actions? I would be willing to donate some money into putting her in the dock for this.

<comment><USER26> IIRC kickstarted doesn't, but there is plenty of places that do.

</comment></comment><comment><USER27> So now that we can see in real time the ways government tries to censure, control, and surveil the Internet. The speed in which they try to incorporate the Internet under their domain of control is one where we don't need to guess anymore about their intent. Its obvious, clear and show no sign of slowing down. Rather, they are increasing the speed in which censure, control, and surveillance are added.

We can't even claim that this is the initial battle. That fight has already been fought. We had the discussion around common carrier principles when peoples talked about net neutrality. We had the discussion when people discussed piracy. We had them also when wikileaks and SOPA was in the news. Even some of our allies has turned. ICANN is now days dictating under what purpose people are to be privileged to do the simply act of buying a name.

Allowing government to censure, control, and surveillance the Internet produce news article as this one. Expect to see more. Its that, or invent around it in such a way that the censure, control, and surveillance can't be used by the government from an technical standpoint.

<comment><USER15> To play devil's advocate....Why would government not seek to control the internet? They control everything else, and if something goes wrong the public slaughter government for it, saying they should have done something. In the end, doesn't an ignorant frightened government just represent an ignorant frightened electorate?

Surely it has to be up to the tech savvy to educate the wider population, so that we end up with politicians who understand. Forget the politicians and focus on the general public.

</comment></comment><comment> artumi-richard As a father of a young child I'm quite keen on being able to provide him with a clean connection to the internet. I want him to be able to explore without having to watch over him.

We should have solutions to this problem, at the router level, where we can be in charge of the blacklist, and the times various items on it are ok or not ok.

Politicians cannot be blamed for trying to do what is popular, and because we as a community have failed to solve the problem for less technical parents than I, an imperfect solution has been proposed. We should not be surprised.

We are the ones best suited to find the optimal solutions to such problems, and carping on about politicians doing something when we have done far too little is pointless.

<comment><AUTHOR> So, why not install one of the many filtering / blocking solutions that exist?

A simple Google search will show you that this is a well explored space, with many different options.

<comment> artumi-richard There is relatively easy

[https://www.opendns.com/home-solutions/parental- controls#fam...](https://www.opendns.com/home-solutions/parental- controls#family)

But I don't have an easy way to say "No - that site is fine" \- I am not in control.

But actually it's easy only because I know what DNS is and can imagine how to setup my router to use their dns servers.

<comment><USER28> It says you can add whitelists.

</comment></comment></comment></comment><comment><USER12> A Paul Staines vs Claire Perry smutocalypse, oh boy this should be fun. I may need to stock up on beer and popcorn.

<comment><USER29> He is (apparently) considering sueing her: [http://order- order.com/2013/07/24/should-guido-sue-claire-pe...](http://order- order.com/2013/07/24/should-guido-sue-claire-perry/)

I am conflicted. I never really liked Paul Staines' style but I am somewhat afraid of the impact of Claire Perry on the UK Internet regulations. I have to admit I would love to see him publicise the lack of understanding she has in the Internet that she is working so hard to regulate..

<comment><USER30> She deserves to have some sense sued into her. It is frightening how such thoroughly ignorant people seem utterly powercrazed, trying to control that which they don't understand, effectively becoming for more evil than the thing they want to fight. Her stupidity is staggering. Bring on the Streisand effect indeed...

<comment><USER31> > It is frightening how such thoroughly ignorant people seem utterly > powercrazed

 _" We need to take control," says Claire Perry, speaking as a parent. Far too many mums and dads are "ignoramuses" about technology, baffled by the smart phones and computers their children use, she says._

 _"Parents say they want to be involved, but the children have overtaken them," she says. "That's awful. We must be like the first generation whose children learnt to read and write, and we're all blundering about like illiterate ignoramuses."_

(...)

 _"I am not a minister. I have no portfolio. I am simply a thorn in the side of everybody," she says. "This debate crosses so many departments that it is quite helpful to have one person who goes around making a nuisance of themselves."_

 _Mrs Perry is chasing the internet service providers, search engine and social media companies to do more to keep children safe online, and says they are beginning to look "culpable" for allowing the likes of Mark Bridger and Stuart Hazell to view illegal child porn._

(...)

 _She praises the mobile phone companies for imposing filters blocking adult content on the internet, but they don't apply when the images are being created by children themselves._

 _"There will be technology that comes along to solve this, but I don't want to wait. Who is paying for the phone of a 12-year‑old? It will be the parent. We somehow have to get parents, carers and those involved in children's lives to say that this is not acceptable," she says. "Who is keeping our children safe?"_

(...)

 _"Frankly, if we need to, we will regulate," she says. "We have made child porn illegal and it still gets in. That means we have to tighten up, as we do with drugs. We spend a lot of time in this country trying to track down the supply of illegal drugs. It's similar with the internet."_

(...)

 _"Well, my children hate being discussed in anything to do with my job. My 16‑year-old says: 'I can get married and I could join the Army if I wanted to, so why do you think you can read my texts?' I say: 'Because there might be a situation in which you are unsafe.' "_

This is not even funny.

[http://www.telegraph.co.uk/journalists/cole- moreton/10107771...](http://www.telegraph.co.uk/journalists/cole- moreton/10107771/Claire-Perry-MP-Parents-take-back-control.html)

<comment><USER32> > "Parents say they want to be involved, but the children have overtaken > them," she says. "That's awful. We must be like the first generation whose > children learnt to read and write, and we're all blundering about like > illiterate ignoramuses."

I think this is a fascinating quote, because the analogy seems extremely apt to me. Yet she somehow thinks this is a bad thing, as if the invention of literacy was some kind of terrible event, rather than a blossoming of the human intellect.

The younger generations are doing amazing things that the older generations couldn't have even imagined, but her only reaction to this incredible transformation is to say "That's awful."

<comment><USER33> That's an extremely prejudiced reading of that quote.

She clearly describes the [applying the metaphor] technologically illiterate as akin to ignoramuses.

It's clearly not the benefits of technological literacy that is the motivator to preventing young children from being exposed to hardcore pornography.

If some people were saying we shouldn't allow hardcore porn magazines to be sold to children; your argument would be like saying those people are advocating destroying all forms of printed media.

</comment></comment></comment></comment></comment></comment><comment><USER34> The porn filter could be debated in the House of Commons if this petition got 100,000 signatures > [http://epetitions.direct.gov.uk/petitions/51746](http://epetitions.direct.gov.uk/petitions/51746)

</comment><comment><USER35> Even if we ignore all the technical things she seems to be confused about, how can a government official think it is ok to publicly and childishly accuse and threaten this man on a social network. I'm not surprised by her technical ignorance at all, but the lack of professionalism and , well, manners is very worrying.

</comment><comment><USER36> Immature. Pointless. Counter-productive. But Goatse'd! hahahahaa! How wonderfully appropriate :)

</comment><comment><USER37> There's several issues that are worth raising here, but I struggle to understand why the Parliamentary Private Secretary for the Secretary of State for Defence needs to attend a meeting with ISPs about unrelated civilian matters.

<comment><USER38> If it was a committee or some other 'public' meeting, then pretty much any MP or Lord can attend if they so wish. Her role as PPS is separate to her constituency role. From the sounds of the meeting, it wasn't a meeting with Government but with Parliamentarians.

</comment></comment><comment><USER39> Stating the obvious, but there are MAJOR first amendment problems with trying to get ISP's to block porn sites by default. I don't see how something like this could come to a vote without major controversy. There is still such a thing as freedom of expression, last time I checked.

<comment><USER40> Well, the main thing here is that this is happening in England...</comment></comment>


Ask HN: Is the Gitlab stylesheet also busted for you? - <AUTHOR> It looks like the gitlab stylesheet is not being loaded ... <comment><USER2> Does the stylesheet works now?

Do you mind documenting this question in an issue?

[https://gitlab.com/gitlab-org/gitlab/issues](https://gitlab.com/gitlab- org/gitlab/issues)</comment>


Ask HN: Any programmers with long arms? - <AUTHOR> I know it's a weird question, but I've been thinking about the years of shoulder and arm discomfort I've felt throughout my career. I'm beginning to think I have long arms.
It always feels like my arms are too long to find a comfortable position, not just while programming but also while driving a car. Every office chair and desk combination seems to have the arm rests sitting too high relative to my shoulders, which increases the tension in my shoulders and upper arms, leading to intense, lasting pain. I can never seem to adjust my chair to a comfortable position. I've finally been able to minimize the problem by seating my laptop on my lap and using the built-in keyboard and trackpad, ditching the mouse completely, but the pain still comes and goes from time to time because of angled position I have to hold my hands in to type with the keyboard so close to me.
Does anyone else here on HN have this problem? Did you solve it, and if so, how? <comment><USER2> There are guides you can find about how to position yourself.

Essentially, you want your forearms to be parallel to the ground, and your upper arms just resting normally along your sides.

Next, you get your chair the right height. Again, there are guides, but mostly you want your feet touching the ground.

Then you determine your desk height, which is dictated by what's needed to keep your arms parallel to the ground. Desk height, though, is the hardest to alter typically, so you may find that to avoid hassle you end up adjusting your chair height. Not ideal, though.

I'm also 6' tall, but I've never had any obvious problems getting into a comfortable position with normal desks. You shouldn't either, even if you have long arms. Just find the proper setup. I now have a desk I custom-built for myself. I did measure myself first, but I chose a traditional height for the top--something like 29".

For what it's worth, it can be difficult (and uncomfortable) to change your habits in the beginning, if your posture needs adjusting. I'm a slouch and it is not easy to sit up straight for very long.

Good luck!

<comment><AUTHOR> Yeah, I'm starting to think I may need to custom build a desk. Desk height is a clear part of the problem. But I'm afraid that the best desk height for preventing tension is going to be around where my knees end up.

The chair will be difficult, because in order to not have arm tension I'll have to have them resting almost down to where my hip bone is. I can't say I've ever seen a chair with arm rests that low.

I'm realizing that the key issue for me, ergonomically, is the "arm rest," which is really not a good name because it is impossible to truly "rest" my arm on one, meaning relax the muscles.

<comment><USER3> I'm not that tall, and I don't think my arms are long.

but for me having no armrests and keeping my keyboard in my lap (its a shorter kinesis with wells) is the best position to avoid wrist, elbow, and shoulder strain. so I don't really care about the desk height, only the monitor height.

plus with the keyboard on my lap like that I get to shift around in my seat

<comment><USER4> What do you do with your mouse?

<comment><USER3> i usually tape a trackball to the blank center of the kinesis

</comment></comment></comment></comment></comment><comment><USER5> 6' guy here, I removed the arms from my chair and just let my arms hang naturally while typing. This has made a world of difference.

I also invested in a standing desk recently and find myself standing about 1/2 the day, which has also helped quite a bit.

<comment><AUTHOR> Interesting, so do have your elbows parallel to the desk surface or let them hang down below it?

</comment></comment><comment><USER6> If the laptop is in your lap are you not hunched? Neck looking down a lot.

On my first employer's onboarding training we had a full 4 hour session by the company's health & safety officer on how to use our chair and desk, and I've found that extremely useful over the past 15 years.

Some takeaways that I've kept with me:

* Keep the top bezel of the screen level with your eyes. I.e. no bending next to see top of screen, and use eyes to look/scan down, or neck a bit.

* Most office chairs have a knob under where you sit and a latch to pull out on the back allowing inclination/declination/free movement. Set latch to free movement then twist this the knob to a setting where you're lying back in the chair in a free-balance position - equilibrium easy to find. I like to leave me chair in that position.

* Fortune 500 type companies spent a lot of money trying to avoid being sued. White-label chairs are commonplace and far higher quality than alternatives.

* Desks can be adjusted or swapped out for alternatives.

* Consult your health & safety person if you have a persistent problem, or in-house medical staff. Just let your manager know you're contacting them, not related to work.

* If you'd like to sit on a bouncy ball, that's OK too.

This was not a modern technology company or anything faddish. This was advice built up over decades of his experience and a century+ of organisational existence. Just share some 2p.

</comment><comment><USER7> I don't feel I have particularly "long arms", but years at bog-standard corporate issue fixed height desks left me with worrying pains in my wrists.

I've dealt with this by setting my chair height so my thighs are pretty much horizontal, then setting my desk height so that when I am sitting, typing, my forearms are horizontal or nearly horizontal.

I also use a laptop whose palm rest is not huge/deep, so that the front edge is not pressing against/into my wrists, particularly when I am somewhere else and don't have control over the height of the work surface (nor the chair, sometimes). I like the somewhat older Thinkpads for having a palm rest that is not too deep and that has a rounded front edge, e.g. +420, +520 (barely), ++30.

When using a desktop PC with a keyboard, I place a gel wrist rest directly in front of the keyboard -- making sure the final result matches my height/posture/ergonomic preferences. My _PALMS_ rest on the wrist -- ok, _palm_ \-- rest, not my wrists.

I mention this last with regard to your situation. I you can get a keyboard / palm rest / posture combination that leaves the ends of your arms resting rather neutrally on your palms, while you type, this might help?

P.S. As I got more senior and less caring in corporate land, I sometimes just brought in some tools and rebuilt my desk, myself (off-hours), to get it to the height I preferred. Going through formal channels might make this a misery, but people wouldn't bother with the fact that I'd "just done it", as long as the work was getting done.

</comment><comment><USER8> Among the other topics here, I've found keyboards to be too narrow for myself. I kinda need to put some weird tension on my elbows in order to use a laptop keyboard properly.

From there, getting a Kinesis Freestyle was an amazing investment. It seems silly, but the ability to position your keyboard so you don't have to bend your wrists outwards, and so you don't have to put some tension on your elbows is amazing, especially with wide shoulders and long arms.

And yes, on top of that, arm rests are the devil.

[1][https://www.kinesis-ergo.com/shop/freestyle2-for-pc- us/](https://www.kinesis-ergo.com/shop/freestyle2-for-pc-us/)

</comment><comment><USER9> Have you tried a standing desk?

I am short, and my arms don't _seem_ long... but I've had shoulder pain and arm pain. Things that have helped:

1\. Staying warm! Air conditioning is your enemy.

2\. Standing desk. Make sure you have separate levels for monitor and keyboard, so you can put keyboard at exactly right height. Also get a good mat, or your feet and back will hurt.

Long version: [https://codewithoutrules.com/2016/11/18/rsi- solution/](https://codewithoutrules.com/2016/11/18/rsi-solution/)

<comment><AUTHOR> I have not tried a standing desk. Does your standing desk have arm rests?

<comment><USER10> I use a convertible standing desk, and when standing I don't use arm rests. The key is to have the desk/keyboard at a height where your shoulders hang naturally. I used to have serious wrist issues and switching to the kinesis advantage was the magic bullet for me. Also a big plus for exercises to help, I do back flys to make sure to strengthen the muscles holding my shoulders from rolling forward.

My girlfriend has to use a chair with no arms because of her arm to torso height ratio makes arm rests force her shoulders up. Which I think is the same issue you are facing.

</comment></comment></comment><comment><USER11> 6'2" guy here with long limbs and shoulder problems.

Sitting and typing on a computer is unnatural, and causes shoulders to roll forward. There really isn't any other cure other than stretching, doing yoga, and performing strengthening exercises.

It's unfortunate, but many in our profession choose to ignore the cons of being mostly stationary, often involving a bad posture, for most of our working day.

Here's a pretty good resource for addressing a lot of the bad posture problems and corrective exercises:

[https://www.reddit.com/r/Fitness/comments/36r854/a_while_ago...](https://www.reddit.com/r/Fitness/comments/36r854/a_while_ago_someone_posted_a_manifesto_on_posture/)

Direct link to excel sheet: [https://docs.google.com/spreadsheets/d/1EgKFYKjUIzpc_ZG_uRg1...](https://docs.google.com/spreadsheets/d/1EgKFYKjUIzpc_ZG_uRg1pKM3D64UFZ14299K7ppatHU/edit#gid=1601259150)

<comment><AUTHOR> Thanks. I tried doing corrective exercises but didn't find them to be any more helpful for pain than regular cardio or a cup of coffee (which surprisingly works pretty well as a pain killer)

I'm shifting my thinking more towards attacking the problem at the source, which I'm starting to see as the sustained tension of holding my arms in keyboard position. I never had this issue from, say, sitting and playing Nintendo as a teenager for hours, which you could also argue is unnatural.

</comment></comment><comment><USER12> I'd suggest you try a standing desk for a few weeks. You can easily MacGyver something together that will be the exact right height for you. Before I committed fully and built a proper stander, I started out with a drawing board on stacked books, and a monitor behind those.

Keyboard should be at or just below elbow height, and the top bezel of your monitor should be at eye level, so your head is very slightly inclined downward. I've read that this has something to do with our hunter gatherer past, that we're built to walk, scanning the ground ahead of us for food. You may want to put some fruit in your line of vision to simulate this

</comment><comment><USER13> Shoulders down. Palm (not wrist) rests. Fingers curved down. Ergo keyboard with wells. Lap stand. Feet up! [https://www.icloud.com/sharedalbum/#B09JtdOXm0JUpj](https://www.icloud.com/sharedalbum/#B09JtdOXm0JUpj)

<comment><AUTHOR> Yes! That is what I need, right there.

</comment></comment><comment><USER14> 6'8" tall, never in my life have i encountered a chair where my elbows would reach the armrests, and most tables are too low for me to sit at comfortably. Airplanes are the worst...

At home i solved the problem by raising the tables to a "normal" height. Can probably do the same with the armrests, but i'm too used to them never existing to bother. At works i could usually lower the chair way down to get things comfortable.

While it's the opposite of your problem, i suspect the spectrum of solutions would be the same - make a lot of custom stuff.

</comment><comment><USER15> I have this problem. It's exacerbated by co-sleeping with a baby, who is extra demanding on my shoulders.

Posture, particularly sitting up straight, and holding my hands in the correct typing position, helps a lot. Making sure my monitors are at eye level and are directly in front of me is critical.

Sometimes, if I get lazy and slouch, my shoulder will get a bad pain and my pinkies will go numb, which is generally a sign of pinching a nerve. It takes quite a bit of fiddling to get the desk-monitor-chair heights all adjusted just so.

</comment><comment><USER4> > Every office chair and desk combination seems to have the arm rests sitting > too high relative to my shoulders

It sounds like an ergonomics problem. Try a chair with adjustable arm rests. And perhaps a keyboard tray to keep that down low so your arms can be roughly parallel to the ground.</comment>


Did Steve Jobs steal your liver? - <AUTHOR> http://bigthink.com/nicholaslarusso/iliver-did-steve-jobs-steal-your-organ

<comment><USER2> No, he hacked a very poorly designed system. In this case the moral responsibility resides with those culpable for the shameful system, not for people who need organs.

<comment><USER3> I agree. Mr LaRusso confirmed so himself. The current ill-conceived system deserves more attention than Jobs.

</comment></comment><comment><USER4> Summary: No.

</comment><comment><USER5> It's pretty difficult to steal something that the medical industry doesn't consider you to own. At best he stole the medical industries' liver as they seem to have the most rights to organs.</comment>


Ask HN: What do you use to monitor your infrastructure and system health? - <AUTHOR> <comment><USER2> [http://www.shinken-monitoring.org](http://www.shinken-monitoring.org) This is a fork of Nagios which is distributed.

</comment><comment><USER3> [https://schezzle.com](https://schezzle.com), which coincidentally is a side- project of mine. There are lots of other ones out there too though. During my day job we use things like splunk, cloudwatch, etc.

</comment><comment><USER4> Solarwinds Orion Server & Application Monitor, Splunk, Lots of custom stuff using python/selenium/phantomjs to go through end user flows, etc...</comment>


Cult phenomenon game builds confidence, creates opportunities - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2010/11/27/MN841GBAR6.DTL&tsp=1

<comment><USER2> Cult phenomenon?

When I was a teenager me and my friends called it "rolling in the mud"

Often a lot of us kids were very nervous going to clubs and quite scared to talk to girls. So then the more experienced kids, you know those in their late teens, would give the following advice.

Just get out there and hit on everything that moves, accept rejection just roll in the mud for a few hours, that will get rid of the shakes. And it works. Over time you stop being so nervous and have less need to start the night by rolling the mud.

Now the pick up master movement has re-branded this to something which sounds much more glamorous: "Nexting" They're not rejecting you, you're "nexting" them! This is a brilliant sales strategy if you're in the market of selling advice and therapy to shy and nervous guys.

</comment><comment><USER3> "And it has become a cult phenomenon as the idea spreads through Facebook, Twitter, _the Hacker News blog_ and other social media."

HN is a blog? Who knew?

<comment><USER4> HN is like a community blog, like Metafilter (it's even in their tag).

<comment><USER3> Well, I'll buy it. If other people use blog to mean linksharing with discussion, I'll amend my mental definiton. =P

</comment></comment></comment><comment><USER5> I haven't looked closely at rejection therapy, but here is something I don't get about it.

Hasn't every man (Brad Pitt and George Clooney excluded) already done this?

<comment><USER6> You can only be rejected if you ask for something. Many do not do this in the first place, out of fear of rejection. That's what rejection therapy addresses.

</comment></comment><comment><USER7> I've experienced this in my professional career too. When I started being a full time technology evangelist I hardly applied to speak at conferences. Rejection was hard and I just assumed I wouldn't be able to get into a large conference.

It turns out the best approach is just to apply to lots of conferences and build your confidence and skills. Out of the many rejections will come some opportunities to improve and build confidence. After a while the confidence and experiences start to show in your work and then people recognize that.

Two years later I get invited to conferences. All because I overcame my hesitation to try.

</comment><comment><USER8> To take this to the next level of abstraction, the game could be developed into two parts. The first part would help you identify what your worst fears are, and the second part would have you go through the corresponding therapies.

<comment><USER9> You might find this interesting: <http://en.wikipedia.org/wiki/Flooding_%28psychology%29>

</comment></comment><comment><USER7> I know it's SF Gate and all, but it's surprising to me that Hacker News is listed above sites like Reddit and Digg.

I think it says a lot about how our little (but obviously growing community) is seen.

<comment><USER10> Yeah I noticed that too. More than once recently. I think it's the name that's going to blow us up. "Hacker News" is way too sexy.

</comment></comment><comment><USER11> This could probably get real old, real fast for the people around you. If I kept asking all my friends to fold my laundry I'd get some pretty annoyed looks. This game needs some moderation!</comment>


Malaria protein could be an effective weapon against cancer - <AUTHOR> http://www.independent.co.uk/news/science/cure-for-cancer-might-accidentally-have-been-found-and-it-could-be-malaria-a6693601.html <comment><USER2> Odd, I posted this exact link yesterday[1]. I always thought there was link normalisation on HN?

[1] [https://news.ycombinator.com/item?id=10390791](https://news.ycombinator.com/item?id=10390791)

</comment><comment><USER3> The full text of the study is paywalled here: [http://www.cell.com/cancer- cell/abstract/S1535-6108%2815%290...](http://www.cell.com/cancer- cell/abstract/S1535-6108%2815%2900334-7)

Fortunately the summary there has some useful information: "rVAR2 (recombinant malarial protein VAR2CSA) fused to _diphtheria toxin or conjugated to hemiasterlin compounds_ strongly inhibits in vivo tumor cell growth and metastasis"

Anyone know how they're attaching those toxins/compounds to the malarial protein?

<comment><USER4> >how they're attaching those toxins/compounds to the malarial protein?

curious for the same, googled "protein fused to toxin" and it brought like this

[https://en.wikipedia.org/wiki/Immunotoxin](https://en.wikipedia.org/wiki/Immunotoxin) and [http://www.ncbi.nlm.nih.gov/pubmed/8105849](http://www.ncbi.nlm.nih.gov/pubmed/8105849)</comment></comment>


Biggest age group for MMO games: 8-12 - <AUTHOR> http://www.onlinegraduateprograms.com/programmed-for-demise/

<comment><USER2> Hey, look, correlation presented as causation!</comment>


Salsa-as-a-Service - <AUTHOR>

I'm trying to validate a business idea--monthly salsa subscription service at HombreSalsa.com. I'd love any and all feedback. Feel free to email email@example.com :) <comment><USER2> I like the idea...I have several friends who'd appreciate having this as a gift.

<comment><AUTHOR> Awesome, I really appreciate the feedback. Would you mind referring those friends?

If you subscribe + bring in a referral, I'll give you some extra free salsa :)</comment></comment>


$60B Wall Street machine transforming the unusual into investment grade - <AUTHOR> https://www.businessinsider.com/inside-the-60-billion-esoteric-abs-market-2019-1 <comment><USER2> any way to get past the paywall?</comment>


Ask HN: What is the safest way to purchase Ripple? - <AUTHOR> I want to invest some money in Ripple but I'm nervous about the process of actually buying some. It seems overly complicated with many click-bait articles explaining how to do so. Can anyone give a recommendation for a reputable place to buy Ripple from? I'm UK based. <comment><USER2> Buy bitcoin on Coinbase, transfer that to poloniex, then buy ripple using bitcoin on poloniex.

</comment><comment><AUTHOR> Thanks for the responses. Unfortunately I've registered on about 6 different exchanges (including the ones mentioned) but all are pending verification. Looks like a lot of these exchanges are struggling with scale...

<comment><USER3> Why the sudden urge? Ripple has been around for 5 years

</comment></comment><comment><USER4> I have used both Bitstamp and Kraken for Ripple. Bitstamp is probably the easiest, allowing direct purchase using credit cards. Kraken has had major scaling issues but performance seem to have improved after a recent upgrade..

</comment><comment><USER5> I have had good success with Binance. Just like Azurras said buy on CoinBase (BTC / ETC) and deposit to Binance so you can make the purchase of XRP.

<comment><USER6> Word of warning: Binance's withdraw fees are bordering on insane. [https://reddit.com/r/CryptoCurrency/comments/7nyqr1/a_brief_...](https://reddit.com/r/CryptoCurrency/comments/7nyqr1/a_brief_list_of_binances_ridiculous_withdrawal/)

Disclaimer: I have no affiliation with any exchange.

</comment></comment><comment><USER7> On kraken.com you can buy ripple/XRP (I'm not affiliated).</comment>


Avoiding race conditions in Swift - <AUTHOR> https://www.swiftbysundell.com/posts/avoiding-race-conditions-in-swift <comment><USER2> This might be contentious, but I'm going to say it. If your program is multithreaded in a nontrivial way, Swift is not the language for you, at least yet.

First, this article understates the danger significantly. It's not just that your token loader might be called twice, if you call this from two different threads you're fully in undefined behavior. Swift is "safe-ish" in that it's mostly safe in single-threaded contexts, but with data races that breaks down. It's even more confusing because some things are properly atomic (reference counts, manipulation of value types like arrays), but some aren't (access to fields in classes).

Second, the language is missing basic features that in modern programming would help tame this beast - the most important of which is a wrapper for internally mutable state that is protected by a mutex. Grand Central Dispatch can help with some of this.

Third, there are unexpected performance losses. For example, the closure for running a block on a sync "queue" is heap allocated (because the type of such a closure is the same for sync and async, and of course the latter has to be heap allocated). This will probably be fixed, but I think is symptomatic.

Fourth, there's no official concurrency model. Again, it's confusing because there are some things that are obviously intended to run with concurrency. In fairness, Rust doesn't have a formal concurrency model yet either, but it is straightforward to apply reasoning from C++, and also reasonable to expect guarantees if the primitives such as Mutex, channels, etc., are used properly.

Fifth (and related), there are no atomics in the language or the standard library. Apparently OSAtomic is deprecated, and they now recommend the use of C atomics, but you're in the territory about having to reason about the polyglot combination of Swift and C.

Likely all this will improve, but in the meantime it's important to realize how immature Swift's concurrency is.

<comment><USER3> I agree that there are 1000 ways to create concurrency issues in Swift, as shown in the article. However I fail to see how it's worse than most other multithreaded languages. C++, JVM languages, Go, Python - they all don't provide a lot of support for writing correct thread-safe programs.

Swift/Objective-C might even have an edge compared to some of them, due to providing dispatch queues in the standard library - which are fairly easy to reason about, as shown in the article. I see those as better than the average user creating lots of threads on their own, and then try to synchronize things via mutexes. There might be a performance overhead, but I would only look at that after the program is correct.

There might be languages that provide more help here, e.g. Erlang, Haskell or Pony. But those are not mainstream, and might also not good choices for things where Swift is an alternative (client-side applications). Ada might have been better too, with builtin Task and communication constructs, but that falls into a similar category.

Then we have Rust, which might be the thing you are referring to as a better alternative. It is in the sense that it can prevent most threading issues at compile time - I will refrain from saying "all" since people will write unsafe code, and there can still be deadlocks and logical race conditions. However even Rust thought Rust has lots of tools for preventing concurrency issues, it still doesn't have builtin ways for easy concurrent programs - and e.g. for solving the problem that is described in the article. If one would implement the given solution in Rust, there might be lots of fighting with the borrow- checker involved, and potentially the same amount of heap allocations (callbacks isn't a paradigm that works well in Rust). Obviously there are more idiomatic solutions.

<comment><USER4> > However I fail to see how it's worse than most other multithreaded > languages. C++, JVM languages, Go, Python - they all don't provide a lot of > support for writing correct thread-safe programs. Swift/Objective-C might > even have an edge compared to some of them, due to providing dispatch queues > in the standard library - which are fairly easy to reason about, as shown in > the article.

A couple corrections:

\- Dispatch Queues are not a part of the Swift standard library. They are part of Grand Central Dispatch which is almost always present where Swift is present but is actually a separate project.

\- JVM languages, well specifically Java at least, do have synchronization primitives built-in. It's part of the Java language spec. You can mark any method as synchronized for instance and it will automatically be mostly thread-safe.

<comment><USER3> Thanks for adding it. I was actually aware of both things.

While Java has some builtin syntax (synchronized) for mutexes, as well as the notify/wait methods on Objects, I don't see them as a big step forward in avoiding concurrency issues. Programmers still need to be aware that they need to use those constructs, which is in most cases already the Nr 1 issue. The next step is using them correctly. The JVM ecosystem has a huge number of libraries and APIs that aim to make concurrency easier (java.util.concurrent, RxJava, Quasar, etc). But all those must first be found, and then used correctly. Rust on the other hand will remind users that something is missing. And Go at least shows the a bit higher level channels first, instead of mutexes.

<comment><USER5> While it's true that much of the hard work of not writing data races is still in the users hands it's important to remember that Java having a memory model and specification for locks/volatiles is a VAST improvement over the same situation in most other languages. It expressly defines what operations do and do not imply a causal relationship, guarantees things like no word tearing on volatile longs, that variables can't "logically" be optimized out of existence in the presence of out of thread writes.

It's actually pretty great in practice.

</comment></comment></comment></comment></comment><comment><USER6> This code has a significant and common flaw: If the token is cached, it invokes the handler synchronously.

You should never design a function with a completion handler that sometimes invokes it synchronously and sometimes asynchronously. That can cause all sorts of problems, the simplest of which is a caller that expects it to be asynchronous and ends up performing work out-of-order because the handler was invoked synchronously.

The final form of the code in this article accidentally fixes this, by moving the work it does onto a background queue, but this just introduces a separate flaw: it performs the callback from its internal private queue. This isn't necessarily a problem, except in that it will block any other work from running on that queue unnecessarily (as it's a serial queue), but in more complicated code, having external code running on your private queue can indeed cause problems.

\---

There's also another issue, which is that if the AccessTokenService gets deinited before the loader calls its callback, the callback is dropped on the floor. In general, you should not design a function that takes a completion callback with conditions where the completion callback is never fired. There's 3 reasonable behaviors that could be implemented here:

1\. Have the callback keep the AccessTokenService alive. It's pretty common for networking operations to keep themselves alive while executing, so this is probably the approach I'd take.

2\. Have the AccessTokenService fire all of its pending completion handlers with an error in deinit. The error should ideally represent the notion that the operation was cancelled.

3\. Change the AccessTokenLoader completion handler to look more like the initial version, where it still calls the callback even if self is nil. With the pending completion handlers approach, this requires moving the pending completion handlers into a reference-type wrapper and strongly referencing that from the AccessTokenLoader callback. In this case, that's pretty much the same as approach #1, so you should just go ahead and use approach #1, but in a more complex class this approach might have some utility.

<comment><USER7> You have it backwards, it's the caller's bug if they assume order in an async process.

<comment><USER8> No no no no no. He's right, and this is a hard-learned lesson that many practitioners have discovered independently.

Both the caller and callee face huge problems of reentrant function calls when you mix up the behavior.

Generally the right choice is to make every callback invoked asynchronously, unless you _need_ to do something else.

<comment><USER9> Can you explain what problems someone faces if a callback is executed immediately?

<comment><USER8> In these examples let's suppose function (or object) A passes the callback function C to the function (or object) B. Function B is what calls or indirectly causes to be called the callback C.

Scenario 1: Object B has a function body which looks like:

1\. Look at or modify B's state.

2\. Call callback C.

3\. With code that assumes the state hasn't changed, do more stuff to B.

If C calls back into B (for example, if we'd like to perform the operation a second time, or if we'd like to perform a different operation), the assumption on line 3 might be incorrect. Or, some other assumption in the reentrant call might be incorrect.

(One common outcome is that the developers say, "Oh, there's a race condition," and they add a mutex. Later, they say, "Oh, there's a deadlock," and make it a recursive mutex. This is why recursive mutexes are a major code smell.)

Scenario 2: The developer realizes a safe callback has to be called _after_ all other side effects are complete. So the developer writes this for their function body:

1\. Look at or modify B's state.

2\. Decide you're going to call C later.

3\. Do more stuff to B.

4\. Call callback C, literally the last thing you do in the function.

(The developer is an experienced C++ developer and knows to make sure object destructors for variables going out of scope happen before step 4.)

The potential problem here is on A's and C's side. What if they write:

A-1. Acquire mutex M, and look at or modify A's state.

A-2. Call into B, with callback C (which affects the state of A).

A-3. With code that assumes the state hasn't changed, do more stuff to A.

A-4. Release mutex M.

In callback C (in some helper function it invokes):

C-1. Acquire mutex M.

C-2. Do stuff assuming we have exclusive access to the state of A.

C-3. Release mutex M.

If M is non-recursive, you have a deadlock. If M is a recursive mutex (or nonexistant) the assumption on line A-3 is incorrect. Or maybe the assumption on line C-2 is incorrect.

Scenario 3: The developer is now super-paranoid about side effects of their callback. So they write all their callbacks like this:

        E-1: callAsynchronously(function() {
            C-1: Acquire mutex M.
            C-2, C-3: as before.
           }).

Well now you have no performance advantage relative to just having object B call asynchronously.

Oh, and one more.

Scenario 4: The developer's a freakin' genius. Writes out dead-perfect hypersecure code. Can run a 5-minute mile, and smells nice afterwards. Then enough synchronous callbacks happen recursively to produce a stack overflow.

\----

The thing about these scenarios is that if you call the callback function synchronously _every time_ , you're more likely to catch the bug. It'll show up in tests, or you'll just get a deadlock, or some debug-mode "DebugMutex" assertion failure.

Also, if F always invokes asynchronously, and G always invokes synchronously, you can't call F from G. And you have to add a wrapper in your callback when calling G from F.

If, for a particular function, you have inconsistent behavior, you'll have a whole bunch of undertested edge cases. And they might involve any function up the callstack -- If F1 calls F2 calls F3 calls F4, and once in a while F4 invokes synchronously, that could cause F3, F2, and F1 to have that same property (if they don't do further async operations in the callbacks they pass up).

<comment><USER9> Thanks for the detailed reply.

Does scheduling work via queues (channels they call they now right? :)) alleviate most of these issues, while sacrificing some efficiency?

The scenarios you've described are brittle by design - I imagine better designs are out there?

<comment><USER8> I don't know what exactly a queue or channel is as you mean it, so it could depend, but the short answer is if you can throw in real mutexes and won't risk deadlock then that's a big mitigation.

A good way to improve all the scenarios I've mentioned is to return a future instead of calling a callback. Many of the problems basically go away, if you use futures for _everything_. There is still some danger of scenario 2 at the boundary between futures and other code. Some futures libraries in systems that have an event loop (like JavaScript, I've been told) always schedule futures' callbacks asynchronously partly for this reason. But others don't, partly because they're written not to depend on an event loop. A consequence is also better performance, but a risk of stack overflow.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> This seems craaaazy complicated. In C++, I'm only familiar with the abseil libraries for thread safety, but the way to make sure multiple threads don't access shared state is:

       absl::MutexLock l(&mutex_);
       // Critical section.

The idea that you have to write a "waiting queue" every time you need to guard shared state in Swift is mind boggling. Surely not!

<comment><USER11> The waiting queue mechanism in the article is related to the specific requirements of that auth network request rather than Swift in general.

The queues provided by Apples GCD are an abstraction above threads and mutexes. The equivalent to your critical section example is:

let dispatchQueue = DispatchQueue(label: "com.mycompany.myComponent") // Initialize queue, just as you would with the mutex, label will show in debugger

dispatchQueue.sync { // Critical section }

There are several wins here. One is that gcd controls thread creation as needed. But the bigger win is when you have a longer running critical section and mustn't block the calling UI (main) queue. Then you can simply do an async dispatch on the queue and callback to the UI queue on completion. GCD will also introduce the necessary memory barriers for passing data between the queues.

<comment><USER12> I find the lack of language level locking a benefit in Swift, using GCD is really easy now that the syntax is much more polished. I have yet to run into a race condition. When I worked (years ago) on a 3D game engine in C++ we actually removed most of the multi-threading because it was too hard to reason what it was doing and avoid threading errors and race conditions.

</comment></comment></comment><comment><USER13> A while ago I built an app data framework that used similar logic (although a bit more abstracted) to coalesce every GET type request.

It made me wonder why network libraries don't do this for the actual requests by default (or perhaps they do?). I'm sure there are some cases where simultaneous requests are intentional, but it seems like this would be infrequent.

<comment><USER14> I guess the argument against would be that it adds complexity for a use-case which is probably infrequent. How often does the average HTTP client request the same resource multiple times concurrently? In what subset of those cases does it actually matter if requests are redundant?

Why waste your user's clock-cycles on an edge case?

</comment></comment><comment><USER15> This page is completely unusable without js, yet all it is, is short static document :(

</comment><comment><USER16> Nice article. It came to a few conclusions I came before: buffering token requests in a queue once the first request has been kicked off and using named threads for things that need to happen off main but in-order.

I can follow some of the critiques here but implementing both solutions really makes things a lot better than doing without.</comment>


Former Cisco engineer pleads guilty to causing Webex account chaos - <AUTHOR> https://www.zdnet.com/article/former-cisco-engineer-pleads-guilty-to-network-damage-wiping-16000-webex-teams-accounts/ <comment><USER2> See also this post from 19 hours ago: [https://news.ycombinator.com/item?id=24319293](https://news.ycombinator.com/item?id=24319293)

</comment><comment><USER3> What's going on at Cisco where a departed engineer doesn't have AWS credentials revoked for a whole 4 months? Hell, the person probably would have had access indefinitely if they had not had done something to make to make Cisco aware of the access.

<comment><USER4> I imagine it was bad communication between the guys handling AWS credentials and IT.

At most companies IT handles logins and credentials for all internal systems. Things like email, vpn, internal sites, and chat. Usually this is all centralized, and when someone leaves IT revokes that user's access to everything.

I'm guessing what happened here was that the engineer got access to AWS manually. Maybe IT wasn't responsible for handling AWS credentials and it was expected that the person who gave him access would revoke it too. Alternatively, the person who gave him might not have gone through the company's regular policies.

Either way, the process in place for handling credentials here clearly didn't work and they got burned in it. Would love to see the internal postmortem here.

</comment></comment><comment><USER5> When you login at Cisco WebEx, they warn you of criminal liability. However, if you report a security concern at Cisco they treat you like a criminal. Basically, as an employee at Cisco you take on all the liability but they won't protect you from their own negligence.

<comment><USER6> I'm guessing that if Cisco has a documented/known security issue they are more liable in case of future lawsuits. If they simply don't know about it then they are less liable. Someone did the math and found that non-liable lawsuits are cheaper than paying to have security issues addressed properly.

</comment></comment><comment><USER7> Why did it take two weeks to recover from this? Aren't there protections in AWS from simply deleting VMs. Wouldn't AWS step in and help a company like Cisco if something horrible went wrong?

<comment><USER8> Set the termination protection flag on critical instances (like databases), then they cannot be deleted programmatically. This works really really well.

<comment><USER9> > Set the termination protection flag on critical instances (like databases), > then they cannot be deleted programmatically.

Well, not _accidentally_ , but the flag itself can be cleared programmatically, so protected instances can definitely still be _maliciously_ deleted programmatically, if the actor has sufficient access.

<comment><USER8> Oh really? I thought the only way was to go to the web UI and and select instances to remove the flag.

<comment><USER9> Quick googling found CLI instructions (for both the generic and powershell CLIs), and those are just wrappers around the APIs.

</comment></comment></comment></comment></comment><comment><USER10> Based on the other thread from yesterday, I wouldn't jump to conclusions and pin the blame 100% to the former engineer. For such a large company, why the hell did they not put in safeguards to prevent former employees from accessing production environments? The vulnerability wasn't like a week or two... it was 5 whole months.

I read this as incompetence on Cisco's part.

<comment><USER6> If you leave your front door unlocked that doesn't mean a burglar is free to steal your stuff with no consequences.

<comment><USER11> No one said that?

This demonstrates Cisco is shockingly incompetent. Imagine if, instead of basically causing them a business hassle, this engineer decided to grab the list of sales contacts for companies -- easily available by looking at who salespeople are meeting with -- and sell those?

It's cisco's job to make this impossible in more robust ways than hoping every employee they have is a good person.

Cisco are also liars, because they've almost certainly made commitments in SOC2 or 27001 or other audits that this is impossible via policy and procedures. And yet.</comment></comment></comment>


Ask HN: Why should I use Django? - <AUTHOR> I want to build an app allowing users to search local car for rent availability. <comment><USER3> If you want to use Python then use Django. As with any framework, it can be hard to work around but Django gives you the most options to work around the framework than any other framework I've found.

Normally, if you are having a hard time with Django its because you're trying to work around it the wrong way. This takes time to learn but Django can be really elegant to work around and with.

The second option is Flask or Tornado which are pretty great too. Both would give you more freedom but also less structure. I find it better to have the structure because unless your an experienced engineer your Flask or Tornado project will turn messy quick. Django projects can turn messy too, but at least there is a more training and protocols for people to follow.

I use Flask/Tornado if I want to use Python and I know my project is a small service and will probably not get big.

I use Django if I want to use Python and I know the project will grow over time or I need features from the start like a database, migrations, cache, etc.

<comment><USER4> >>Django gives you the most options to work around the framework

So Django stands in my way and its' advantage is that it is easy the work around it?

<comment><USER5> No, I think you're misinterpreting the comment. Django guides you the right way and how it guides you works most of the time. However, when you do hit the edge, Django's very well written docs and thoughtfully designed architecture guide you in building around its limitations. For example, if you want to swap in Jinja over Django templates or SQLAlchemy over Django ORM. Really needing to do so is still the exception to the norm, but just know that Django does more here than most other frameworks.

If you are interested in understanding this a little deeper, I highly recommend picking up the Two Scoops book [1].

[1]: [https://www.twoscoopspress.com/products/two-scoops-of- django...](https://www.twoscoopspress.com/products/two-scoops-of-django-1-8)

<comment><USER6> I second the Two Scoops book. Django documentation is excellent (try the tutorial if you want a quick sense of django). Two Scoops help you understand why to do things in particular ways and make good design choices within all the things django can do.

</comment></comment></comment></comment><comment><USER7> We've built web applications based on Django for small CMS sites, large multi- language CMS sites, up to large custom-built applications (mostly API-based) for the likes of Mercedes-Benz and Deutsche Bahn. I can honestly say that I never regretted the decision.

It scales beautifully (see the likes of Instagram, Disqus, Sentry, etc.), has a great security track record, sane deprecation schedules, and the core team keeps up with the times and new technologies but does so at a sane pace and without rushing things.

Not to mention the documentation - ohmygod, the documentation!

In a nutshell: pick Django, keep learning Python, and try to build something that your users love.

<comment><USER5> I've stopped citing Instagram as an example of Django scaling after learning from one of their engineering managers at PyCon 2015 that they're running a heavily modified internal fork of Django 1.5 or 1.6. It sounds like they really have built their own framework (before today's Django + DRF existed).

Maybe this has changed post Facebook acquisition. I know Facebook is mostly on Python 3 and modern stuff now.

</comment></comment><comment><USER8> Things I really like about django that are objectively good:

* A lot of _very common_ situations and patterns are already solved for you, and they're solved in the cleanest way possible.

* The documentation is excellent, both with "guides", examples, and API reference. Django (along with OpenBSD), has probably the best documentation I've seen around.

* Clean design (of django itself) means that you can extend it, or avoid using bits that for some reason don't suit you.

* Very transparent development, and the developers are really into open source - everything is done out in the open. This last point might not be really important as a user, but it helps if you ever want to contribute (or understand) anything to django itself.

\---

Even after years of django, I very occasionally still come across a functionality in django that I'd overlooked and saves be a bunch of my own code.

</comment><comment><USER9> If you have a usecase that matches Django's niche - i.e. a CMS style CRUD application - you would have a hard time doing better than Django. If you're not in that usecase, think long and hard about it. Django is fantastic to use when writing with the framework, and a nightmare to work around when you need to do something it doesn't easily support.

Your app does sound like it is in Django's wheelhouse (CRUD against a DB with users), so it is probably a good fit.

<comment><USER10> > and a nightmare to work around when you need to do something it doesn't > easily support.

Can you elaborate more on this? And also for what kind of apps one should avoid Django?

<comment><USER9> Nightmarish (without building additional systems): Asynchronous operations (i.e. any task that takes place _after_ you return a response), anything involving websockets or long poll responses, anything involving cross-client communication through the server (like chat). Intelligent master/slave DB routing for read-only queries.

Hard: Using any DB but PostgreSQL. You can use other DBs, but Django silently disables features. Doing anything with the DB that isn't directly managed by Django itself. Doing anything but basic pre-defined URL routing as supported by their routing system.

Use something else: Not using a relational DB as a backend. Not using their user management and authentication system. If you want to use something other than their built-in ORM, templating, and routing.

I personally recommend Flask in the cases where Django is not a good fit. A threading/forking fastcgi model with basic nginx caching is incredibly performant. That said, Flask is pretty terrible at most of the "nightmare" level tasks as well.

<comment><USER11> Are you familiar with django channels?

[https://blog.heroku.com/in_deep_with_django_channels_the_fut...](https://blog.heroku.com/in_deep_with_django_channels_the_future_of_real_time_apps_in_django)

They supposed to make this sort of thing easy and straightforward. I'm still learning them, but this system seems to be well designed and makes a lot of sense.

Django + Django REST Framework + React should give you pretty much everything you need to build whatever you want, including single page apps. At least as far as I understand it.

<comment><USER12> Channels don't guarantee at-least-once delivery, so you can only use them at best as a refinement - you have to assume your clients will miss messages. Which makes it unusable for many use cases (though I'm sure many negligently ignore it too).

</comment></comment></comment></comment></comment><comment><USER12> Django REST Framework is Django's killer app (as Django is Python's killer app). If you need an API, it's a great batteries-included way to build one.

<comment><USER13> Could you elaborate a little about DRF? I spent a day or so evaluating it among some other options for an API in a Django project, and it seemed to be a relatively poor player in the Django ecosystem and be quite complex for the same outcome compared to other libraries. It seemed like it would be ok for a DRF specific project, but in as a single part of a larger project it didn't seem to fit well. That said, I have very limited experience with it.

<comment><USER14> DRF is at its best when you develop an application from the ground up using it. It also "does the right thing," and helps you stay RESTful. In particular, if you use its HyperlinkModelSerializers and its baked ViewSets, it just plain works, no fuss. But it's important to know what these shortcuts are doing so that when you need to write custom APIs that go beyond CRUD, you know what to do.

For very simple APIs, DRF is overkill, and if I only need a couple JSON endpoints, I don't bother with it. But if I need full access to my models, you just can't beat it.

<comment><USER13> Thanks! Much appreciated.

</comment></comment></comment></comment><comment><USER15> Before I was sophisticated enough to investigate such decisions on my own (given the mass of discussion freely available on the internet), I really don't think it mattered which framework I chose.

So I'd suggest you just some popular framework and don't worry whether it's the right one. Pick one and run with it!

</comment><comment><USER16> I picked up Django early 2015 and it has been my choice of backend ever since. Though I haven't used Django to build a fullstack application, I have used Django REST framework extensively for my backend. Impressions over 1.92 years:

1) Great documentation. Well organized, well written. Good balance between theory and examples.

2) Superb ecosystem. Coming from PHP land, I got the sense of a "anything- goes" mentality. On SO, people who help are very much interested in doing things the idiomatic way.

3) You get to practice Python!

<comment><USER17> > 3) You get to practice Python!

Not really. You mostly write Django and need to go really far before hitting any non-superficial Python feature.

<comment><USER18> Agreed. I moved to Python form Perl 5 years ago because of Python. I feel I never know Python as well as I knew Perl, but I do know Django really well. But then the built in functionality means I rarely need to go too low level with my code.

</comment></comment></comment><comment><USER19> Consider Pyramid web framework. Deploy it on gunicorn server with eventlet workers. Use pushpin if you need realtime.

Its easy, it scales, use any DB and Pyramid framework has good documentation too.

Or go with web2py if you need to start simple and easy and fast prototyping. It has an ORM which supports many Relational DB and MongoDB too if you need it. It has good documentation. Its authentication and authorization system is too easy.

Stick to python3.

Really good python learning resources.

[http://www.diveintopython3.net/](http://www.diveintopython3.net/)

and

[http://greenteapress.com/wp/think- python-2e/](http://greenteapress.com/wp/think-python-2e/)

<comment><USER20> Slight nitpick - web2py has a database abstraction layer (DAL) rather than an ORM. It's kind of like SQL except written in Python.

</comment></comment><comment><USER21> Django is a good framework, because it's opinionated about _the right_ things (ie those that fit most very well).

Also, "there's an app for that". The ecosystem is large and healthy.

If you don't want Django cause it's Django, then Flask and Pyramid are other excellent alternatives. There is also a swath of more specialized frameworks (eg. Tornado).

</comment><comment><USER22> I'm copying here what I wrote back in 2013 to some other forum, much of it is still true...

Django is mature, full-stack, flexible, has sound architectural decisions behind it, relatively good security track record. There is a built-in admin and permission systems to help with what you require. Batteries included such as an ORM, templating, routing, forms. The Django third-party apps/module ecosystem is rather large and accessible: from authentication, social media integration, payment gateway integrations, APIs, to whole apps like invoicing, helpdesk, etc.

</comment><comment><USER23> I don't have experience with Django, but you could also just build everything yourself on plain WSGI (the python version of (Fast)CGI).

Note I am not saying "build a new, generic framework because all other frameworks stink". Building libraries with the goal to support other projects is a neverending task.

But only building the support paste as you actually need it is not a lot of work. WSGI is a quite simple interface. I'm doing this myself and the support I currently need is only ~500 lines. The only external library I use is jinja2 templates. As database I use plain sqlite3 from the python standard lib and in some places text files.

If you don't know and don't want to learn HTTP and Web application architecture you will of course end up with a broken design. On the other hand it's very rewarding to learn how to decompose an application into independent components (templates, services, routing, database access, business logic, authorization, session management, config parsing, project directory structure, what have you).

The other big advantage is of course flexibility. If you do a good job the decomposition is better than with a framework. This means flexibility. It's easier to fix problems than with an opinionated framework.

</comment><comment><USER24> I think frameworks like Django, Rails or Grails are excellent tools for building many business applications. Especially when there are plenty of CRUD operations and complex workflows with different administrative roles. These frameworks excels in developer productivity, stability and maintenance over years.

I've been using Grails for over 10 years, my clients are super happy with what I have delivered. I've built complex issue tracking systems, e-commerce web sites, administration panels, data management tools and so on. Code I wrote 10 years ago is still working fine today! I highly recommend learning one of these frameworks, you will make new friends and good money!

<comment><USER25> > Code I wrote 10 years ago is still working fine today

I'm wondering if any of it's been upgraded to Grails 3, or if they're still on Grails 2, or even using a Groovy 1.x version of Grails.

</comment></comment><comment><USER26> If you're using Python and don't use Django (I've tried it as an exercise for one of my pet projects), you have 2 options.

Create your own framework - writing http headers etc from scratch which will take you forever or Use a lightweight framework like Flask or Web.py.

Either way, you'll end up creating your own ways to query the database and creating patterns to communicate with frontend. As you write more code, you'll abstract your code to reusable methods.

About a month into the project, you'll realize that you're slowly rolling out your own framework which has grown organically.

Soon you'll realize you're better off using a polished framework like Django which has abstracted many of the details so you can focus on delivering value instead of clobbering together your own framework which will become a burden to maintain alongside your app.

<comment><USER27> I've always preferred microframeworks for exactly this reason. As you build, you tailor things to what you actually need instead of building features that match the framework. I've got one project that's built on flask + sqlalchemy, but I've been slowly hacking sqlalchemy out of the fast paths because it is just too slow and I'd rather improve my grasp of SQL than spend my time learning SQLAlchemy.

<comment><USER28> Django's opinionated nature means it fits together better. Random django packages will do admin, ORM handling, etc. in a single consistent way whereas flask packages typically don't.

E.g. what seems to be flask's most popular CMS uses mongo as a backend.

</comment></comment></comment><comment><USER29> Any Django developers who have made the switch to Play Franework (in Scala), would you share your experience? About to go down that route, and would like to know if it's as great as everyone says, challenges, etc. The usecase is fairly mundane CRUD app, 10-15 interconnected tables.

<comment><USER30> I have.

Django does a lot automatically: authentication, schema creation, ORM, default forms, admin interface. These are things useful to 95% of CRUD apps.

At a certain complexity, nearly every project would have to replace or mostly replace all of those. A full table scan is prohibitive, you want to customize indexes, you want to customize the design of everything, etc.

The Play Framework provides just that: an web MVC framework with basic routing, templating, and HTTP utilities. It's more general and will scale further in project complexity, but you should expect to spend more time figuring stuff out initially.

\---

Other than that, there are the obvious differences between Python and Scala. Personally, I love, love, love the confidence of static verification, but there are good things about both sides.

</comment></comment><comment><USER31> Django is great for fast prototyping if you need very dynamic pages (because views written in Python are so powerful), a complex site structure (because it has excellent url routing), and lots of database interaction (because of the ORM). If you only need the first two, I recommend Flask instead.

But be careful if you intend to create a stable, heavily-used site. I have so many problems with Django in this use case that I've gotten tired of listing them each time it comes up and collected them into a blogpost: [https://alexcbecker.net/blog.html#django-is- terrible](https://alexcbecker.net/blog.html#django-is-terrible)

</comment><comment><USER32> Django gives you a ton out of the box, with lots of sane defaults, but it still allows you to override those defaults when you're ready for more complicated functionality or business rules. I like the templating language, it lets you drop a lot of dynamic functionality into existing html templates, while staying out of the way for the most part.

</comment><comment><USER33> Lots of people will say not to use Django because ORMs don't scale. In my experience, if you don't use an ORM you end up writing one (and doing a poor job) in the early stages of a project. Usually this happens because you're changing things quickly and favoring iteration time. You don't know what you're building yet, so you can't choose the super optimized solution. Once you need to scale things can become specialized and it's easier to go that route because you have a better idea what you're building.

<comment><USER34> I like Django's ORM specifically because it automatically creates the database migrations for you. Just change the model, then "makemigrations" and "migrate", then you continue with the next task. Great for prototyping.

</comment></comment><comment><USER4> If you want to use python I would give web2py + intercooler.js a try. It is "good enough" for most CRUD pet projects. Reading here the comments about Django's advantages an inner voice always says "fine, web2py has it too" except the excessive documentation and the weird non-pythonic syntax.

If you want to make something really professional just ignore the words of a n00b.

</comment><comment><USER35> Figuratively speaking, Django gets you from zero to 60mph in 2.4 seconds. Getting from 60mph to 100mph takes 20 seconds. Going above that takes a lot more time.

Lacking details, it seems like your app could be a good candidate for Django.

For me, the main appeal is the Django admin. It gives you a great way of interacting with your data with minimal effort.

<comment><USER36> Django admin is great in the early stages of a project, when you just need to quickly bring up a page to view your data.

I highly recommend ditching the admin page as soon as you can though - <USER2> number of things you can do with it is extremely limited.

<comment><USER18> For me the problem was it is easy to go too far with the Admin and hack everything in there. Its not that limited.

</comment></comment></comment><comment><USER11> As far as the backend frameworks go, you have the 3 most popular, very good options:

\- Ruby on Rails

\- Node + Express

\- Django

The major reason I have picked Django is that it is written in Python, which allows me to use an elegant and beautiful language that I can apply in any field, and utilize a huge amount of python apps, scripts, and stackoverflow examples.

Using Django has also enabled me to learn the solid foundations of web development, which I can expand upon and apply anywhere.

For example now I am experimenting with React and Express, and knowing Django helps me enormously, it makes understanding these things way easier.

I have built a bunch of projects with Django, and I am extremely happy about my choice, so I highly recommend it to anyone who is beginning to learn web development.

</comment><comment><USER37> Django has excellent documentation. Whether you're a beginner or an expert, it is appropriate. That is to say: there are good tutorials for starting out and there is good reference material for going deep.

As others have mentioned, Django is opinionated and I think they get it mostly right.

I use Flask myself, in part because I wish for my data modelling language to be a separate part of my stack, but my use of Flask is heavily influenced by Django's philosophy.

I am the primary developer of Flask-Diamond, which attempts to adapt Django's opinionated choices to Flask. However, I would still recommend that most people start with Django.

</comment><comment><USER38> This post about Django vs Flask might help you decide to use Django or not:

[https://wakatime.com/blog/14-pirates-use-flask-the-navy- uses...](https://wakatime.com/blog/14-pirates-use-flask-the-navy-uses-django)

</comment><comment><USER39> The reason I keep sticking with it is the "optional batteries included" approach. User auth, for example, is something that just works out of the box with the admin/ORM, and has a lot of basic security necessities addressed.

In a more a la carte framework, such as Flask, there are packages to help with user auth, but you have to do a lot more work to get them working with whatever ORM you choose.

This means I can spend my time making products instead of wrangling packages together.

</comment><comment><USER40> After spending several years developing in Django, I am currently building something in a Scala web framework (not gonna name names) and the level to which Django just works is utterly amazing.

If your application fits the use case - a mostly CRUD application based on SQL, HTML-based or REST, no heavy real-time component - don't think twice about it. Of course, none of those factors are a hard limitation, but if you stick to them, Django fits like a glove.

</comment><comment><USER41> All you need to do is use Django as the backend create a rest API and then use react or Angular to retrieve the data.

</comment><comment><USER42> Do you want to make a CRUD app and know python with good documentation and batteries included? Use django.

</comment><comment><USER16> Couldn't anyone comment on the pros/cons of using Flask? Currently I've been using DRF and it's been serving my needs pretty well. I'm curious if there's anything to be gained from Flask.

</comment><comment><USER43> Are you proficient in Python?

<comment><AUTHOR> No, I am learning. It's my project.

<comment><USER44> If you're just learning Python, I would not recommend to start with Django, since Django does so much for you. It does sound like Django would be a great choice for your side project.

It seems it's one of those things where you have to decide: Do I want to learn or do I want to build something and optimize for that.

<comment><USER45> I actually taught myself python through Django. Basically started the tutorial without previous python experience. When you start with the ORM and models, views, etc, there is enough Django-specific stuff you have to learn anyway.

Not that I'd recommend this way... but 6 years later it seemed to have worked.

</comment></comment></comment></comment><comment><USER46> Because you're a gentleman of exceptional demeanor, character and surpassing technical judgement, who unfailingly chooses the best tool for the job at hand from the Maelstrom of pretenders.

<comment><USER47> > Because you're a gentleman of exceptional demeanor, character and surpassing > technical judgement, who unfailingly chooses the best tool for the job at > hand from the Maelstrom of pretenders.

      :) :/ ??

</comment></comment><comment><USER48> Popular websites / online services that use Django: \- Instagram \- Pinterest \- Nextdoor \- The Onion \- Disqus \- Washington Post \- Bitbucket \- Eventbrite

</comment><comment><USER49> And thoughts for microservice architectures? I run flask for our microservice backend and have a angular frontend decoupled from the backend

<comment><USER18> No need for them in the vast majority of apps. Well thats my thoughts anyway.

</comment></comment><comment><USER50> [https://youtu.be/Niq-HoraNPo](https://youtu.be/Niq-HoraNPo)

</comment><comment><USER51> Nice documentation in one good reason. The official tutorial is great.

</comment><comment><USER52> I have experience with Flask, that's why I have the same question.

Any answers?

<comment><USER53> if you want to use sqlalchemy use Flask. If you want to use DjangoORM, use Django.

Pros and cons to both. I guess you can find weird solutions that look better one way or the other except the ORM.. but I don't really see it.

I currently like DjangoORM like 10% better, so I would use Django. It is my favorite ORM I have ever worked with. Right balance of saving you SQL writing time, while still having a good SQL escape hatch when needed.

If you hate DjangoORM, seems silly to suffer through it though.. use Flask or something else.

</comment></comment><comment><USER54> I read in an answer of yours that you're learning Python. I learned Ruby myself with Rails in 2005 because I had no other reason to use Ruby back then. Rails was a much lighter framework than Django is now. I would recommend to start with something very lightweight, get the gist of it and move on to Web2py or Django.

What you're looking for could be Flask or even something simpler like

[https://docs.python.org/2/library/simplehttpserver.html](https://docs.python.org/2/library/simplehttpserver.html)

or its Python3 version

[https://docs.python.org/3/library/http.server.html](https://docs.python.org/3/library/http.server.html)

Now, about Django...

I inherited a Django project and after a few months working on it I wouldn't start a project of mine with it. Obviously customers can ask me to do anything :-)

Disclaimer: I might be biased against it because I don't like Python much (it looks like a badly engineered Ruby, and probably the other way around if you like Python, no bad feelings).

First problem: coming from 10 years of Rails, Django is very weakly opinionated, so you can arrange the project as you want, name the db fields as you want, etc. This is not as bad as having no framework or using Flask, but a developer joining a project might have to spend time to get familiar with the general structure of it (and the bill for the customer keeps growing, so the chances he won't be happy).

Second problem: it doesn't import automatically every model and module. It gets tiresome to do that in every file and in the shell (and the bill...) This is not a language thing because Ruby has to import modules too but somewhat Rails works around that. Surprisingly it raised problems for me only a couple of times. The sum of the time lost with Python in the last few months is greater than the one I lost in Rails because of that.

Third: the templating language is not Python but some crippled down language. Somewhat people still manage to write nice code with Web2py which uses full Python in the templates. Rails too. Why not Django? More time lost to learn one more thing.

Web2py is an alternative but it has its share of problems: the first two of Django plus a very risky approach at migrations which are automatically enforced as soon as you run the code. If there is a way to turn that off and you really like Python or have to work with it, look at Web2py.

About the nice points, it's got everything that it has to be taken for granted in a past 2005 web framework: tests, migrations, ORM. It doesn't miss any particular feature, it's got a big community so it's a safe choice and I won't steer customers away from it.

<comment><USER55> Those are all intentional choices and benefits of Python

1\. This gives you flexibility to structure your app in a way that makes sense for what you're doing. In addition, I've found Django's approach to modular apps to be far more manageable and approachable than Ruby's "all the controllers go in the controllers folder" approach.

2\. Explicit imports is a Python thing and a huge benefit. I've looked at plenty of Rails code bases where I had no idea where different functions and variables were coming from. In Python/Django, you can always see the explicit definition at the top of the file.

3\. The "crippled down" templating language is very intentional as well. Django is preventing you from writing your application in the templating logic (something I've seen too much of in Rails) All your template should be doing is specifying how the data is to be rendered in HTML/whatever.

Really Python/Django could be said to be Ruby/Rails flipped on it's head.

Ruby itself isn't very opinionated (there are usually several ways to do something), while Rails is.

Python itself is pretty opinionated (there should be one right way to do things), while Django isn't.

In general it's a matter of opinion and perspective but I personal find Python and Django to be much easier to work with than Ruby and Rails.

</comment></comment><comment><USER56> In theory, one should take a look at web.py and flask first.. It will teach essentialism and minimalism (web.py) and doing the right thing in a right way (all of them and Python in general).</comment>