Kali Linux 2020.3 - <AUTHOR> https://www.kali.org/news/kali-2020-3-release/ <comment><USER2> I think the move of Kali Linux from bash to zsh is sane. I sometimes have to use the default shell of Linux distribution, especially on servers, and my main pain points with bash are:

\- The history is editable by default. If I move to a previous history line and change it, the old line disappears. Hitting Ctrl-c will remove it from the history.

\- If I use simultaneous shells (screen, tmux, or several ssh connections), the history saved will be the one of the last shell to quit. The bash config `histappend` should be the default, IMO.

\- Most of the time, I search the history by the beginning of the command I just typed, which zsh maps to alt-p and which bash does not map by default. I rarely use the ctrl-r search.

\- No way to pause a command and view the man. With zsh, `git clone<alt-h>` will display `man git-clone`, then return to the incomplete command line.

\- No way to set a command aside. E.g. if I realise while typing that I'm not in the right directory, `git clone<alt-q>cd src<return>`.

<comment><USER3> Not to mention:

\- Oh-my-zsh has a lot of plugins for auto-completion

\- FZF (fuzzy finder), for command history is a big hit (supports bash too)

<comment><USER4> > \- Oh-my-zsh has a lot of plugins for auto-completion

As does bash-completion, which is available in many (but not all :-/) Linux distros and via Homebrew on MacOS and [pre- dates]([https://github.com/scop/bash- completion/tree/09b07d57a7031d9...](https://github.com/scop/bash- completion/tree/09b07d57a7031d904223b31c3a240adab0533546)) [oh-my- zsh]([https://github.com/ohmyzsh/ohmyzsh/tree/5da20b9dddb1f7a91106...](https://github.com/ohmyzsh/ohmyzsh/tree/5da20b9dddb1f7a9110675ded5df59c4c3ed1b83)) by about 6 years.

But, zsh users and oh-my-zsh fan-boys seem to be entirely ignorant of bash- completion.

<comment><USER5> I never understand comments like these. Why do you have to twist this to be about "ignorant fan boys"?

Not enough drama in the world already?

<comment><USER4> Sorry, but I've read too many posts that say "bash sucks, it doesn't do <thing that bash has done for years before zsh did it> like zsh does".

<comment><USER5> And there's a constructive way to respond to those posts, if you must absolutely respond.

Yours ain't it.

<comment><USER6> Ironic response.

<comment><USER5> Fair point

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I always thought Kali wasn't really for daily use. Not a vehicle for every day driving around town, more like a secondary vehicle you only use for work. HiDPI, tool icons, and gnome themes make it seem otherwise. Sure, these things are nice whether you're using it for work or play, but I wonder. Is anybody running kali as their daily driver?

<comment><USER8> You definitely shouldn't use it as a daily. However, Offensive Security is trying to make it a smooth experience given that quite a bit of time is spent using it for penetration tests, CTFs, etc in addition to "competition" from ParrotOS. Most folks that I know would switch to it anyway so having it be the default makes it easier.

<comment><USER9> Can you elaborate why someone shouldn't use it as a daily driver?

I have used Linux for a decade now and I just got a friend interested in it and his pick was Kali because he was interested in learning about security stuff.

I took a quick look at it and saw that it was debian based and XFCE is my favourite desktop environment so I figured he'd be alright with it.

<comment><USER10> It used to be that Kali would start a ton of services at boot and open those ports up to the LAN interface. Stuff like Postgresql that you probably don't want to expose any wider than localhost.

It also defaulted to running as a root user for everything, but they recently changed that.

<comment><USER11> Hmm I don't remember that ever being true. Items like Postgress would listen on localhost only. No services outside of DHCP were even enabled by default going all the way back to BackTrack.

</comment></comment></comment></comment></comment><comment><USER12> Fascinating that the conversation goes to zsh over bash.

You'd think a decent Bluetooth risk tool was more relevant given the covid19 dependency on more bt always on and so more bt drive-by

<comment><USER13> People who don't use Kali comment on whether move from one shell to another was right for the Kali users. This drive by commenting is sadly omnipresent in the open source world. OpenBSD uses CVS? They should use git. XServer? Why not Wayland? Oh, libsdl is using Mercurial, but they should totally use git. And on, and on.

<comment><USER14> Drive by comments are typically from people who want to _sound_ like an expert.

<comment><USER15> I find it extremely amusing that your comment has been sufficiently downvoted that it's grey...

</comment></comment></comment></comment><comment><USER16> With a heavy heart I join the rest of the zsh discussion because these aren't even factual:

> You can do a lot of advanced things with bash, and customize it to do even > more, but ZSH allows you to do even more.

Bash can do a lot of things zsh can't, and vice versa.

> Fish is a nice shell (probably nicer than ZSH), but realistically it was not > a real consideration due to the fact that it is not POSIX compatible.

Neither is zsh, really. There's emulation modes but I never got the impression that fidelity was a goal there.

<comment><USER17> Zsh isn't posix compatible? Citation needed?

Also what can bash do that zsh can't? Genuinely curious, after using both for years.

<comment><USER4> > Also what can bash do that zsh can't?

I have noticed that a lot of the features listed in [https://www.gnu.org/software/bash/manual/bash.html#Major- Dif...](https://www.gnu.org/software/bash/manual/bash.html#Major-Differences- From-The-Bourne-Shell) aren't present in zsh, but I am not sure of all the ones that aren't in zsh.

Ones that I have used in bash that aren't in zsh (there may be many more, I stopped using zsh in many scenarios because of some of these):

* Some of [https://www.gnu.org/software/bash/manual/bash.html#Shell-Par...](https://www.gnu.org/software/bash/manual/bash.html#Shell-Parameter-Expansion) (e.g at least ${LOGNAME^^}, `(FOO=BAR;echo ${FOO,,})`)

* -p option to read for the prompt, e.g. `read -s -p "Enter the DB password: " PW`

</comment></comment></comment><comment><USER18> > Q.) Why did you make the switch? What's wrong with bash? A.) You can do a > lot of advanced things with bash, and customize it to do even more, but ZSH > allows you to do even more. This was one really large selling point.

AFAICT this is the entire motivation provided. Since they start with stating that it's a very large change, It would be useful to flesh out the motivation a bit. For instance, some concrete examples of those "even more" things that you can do with zsh but not with bash would go a long way.

</comment><comment><USER19> One nice thing in zsh is that you can type `/u/lo/b<tab><return>` and be in `/usr/local/bin`.

<comment><USER20> Bash does the same thing here, typing tabs instead of slashes.

        /u<TAB>lo<TAB>b

same number of keystrokes actually

<comment><USER21> Not quite. Zsh can use the subfolders to disambiguate which parent you meant, bash can't.

<comment><USER20> Wow. While this is quite slick (and must have been funny to implement), I actually hate this kind of "magic" behavior.

<comment><USER22> I usually hate magic too, but I have to say this is one of the cases where I like it. It's convenient without any danger attached to it since you're just switching directory and not actually executing something against this "unknown" path.

</comment></comment></comment></comment></comment><comment><USER23> Can anyone recommend training for offensive security and/or Kali Linux pentesting?

I've been wanting to explore that branch for a long time, I'd really appreciate some great resources for an engineer with no pentesting experience.

<comment><USER24> No better place than the source: [https://www.offensive-security.com/courses- and-certification...](https://www.offensive-security.com/courses-and- certifications/)

<comment><USER23> I'm honestly quite skeptical. Unless I hear personal recommendations, I'd be very wary of spending 1k+ on a training in "pentesting"...

<comment><USER25> I did the OSCP (the course was called Pentesting with Kali Linux [PWK]) back in 2017. Costly, but the resources were top notch. A pdf with several hundred pages covering everything from basic Linux commands to modifying existing exploit code to suit your use case. Metasploit was included but the course was not Metasploit heavy. Writing your own remote exploit backend forces you to really understand the mechanics so it felt a bit old school in a good way.

Bundled with this I also got several (i.e many) hours of recorded and narrated video to accompany the pdf.

The best part though is the lab network. During the course I had access to a huge number of virtual machines to scan and exploit. The courseware really encourages you to experiment and evolve. The exam, if you want to try it, is an all out practical pentest from start to finish and 24h to complete. A comprehensive report covering the entire pentest is mandatory.

All in all the OSCP was totally worth the $ IMHO.

I do however recommend that total beginners should start with the free resources and other great sites like overthewire. Get your feet REALLY wet before you pay the $ and lab days start ticking.

</comment></comment></comment></comment><comment><USER26> I'm totally fine with bash if it could share history between processes by default. That's pain when I operate in someone's server.

</comment><comment><USER27> Their image says 'zsh auto-suggestions rocks!' but I had to add quite a bit to my .zshrc (in macOS at least) to get them to be good.

</comment><comment><USER28> That's a funky prompt they're showing there. Since it came by default on macOS, I'm using zsh. But to be honest, my Linux box still remains on bash. The differences, to my usage, are minimal.

<comment><USER29> Fun fact: That's a legacy openstep thing. I was using an x86 version of openstep in a VM just for fun a few months back and it had a 1994 copy of zsh on it. I also remember using it on OS X server 1.0 in around 1999.

I have an actual nextstation in my parents garage. I wonder if it's on that...

<comment><USER30> OS X used tcsh as the default shell way back. Later it used bash 3.x as the default up until Catalina. As of Catalina zsh is the default for new users (and the version of zsh that ships with macOS is relatively up to date).

<comment><USER29> Alright. I never claimed it was the default shell... That was obviously csh, everyone knows that. It's a bsdism. FreeBSD's default was tcsh essentially until I stopped using it maybe 15 years ago.

Zsh was placed onto the hard drive of the computer by the operating system installation cd and was an available executable program that could be invoked from the terminal.

There, is that better?

</comment></comment></comment></comment><comment><USER31> Still my OS of choice for my first-ever generation Samsung Chromebook (exynos). Unfortunately, they stopped providing images - does anyone know if the build scripts still work for exynos based chromebook? (Or if other distros do?)

</comment><comment><USER32> Aren't the people who know and understand the tools they use, the same people who can install security utilities on any distro?

What is the purpose of this distro in regards to that?

<comment><USER33> Less hassle. Plus if you are part of the community you get a better view on what tools are getting more prominent and what fixes or updates are being released.

I'm sure nobody who uses Kali needs it to exist, but that doesn't mean it doesn't add value.

</comment></comment><comment><USER20> Since this has turned into a bash/zsh thread...

The only _real_ (non-cosmetic) feature missing in bash that zsh has is process substitution using files. In bash you can use <() to capture the output of a pipeline into a filename, but it is implemented as a non-seekable pipe. In zsh, you have that, but you also have =() that gives you a real, temporary file. It is extremely useful in the rare cases when it is needed.

</comment><comment><USER34> I wonder why this zsh thing is such a huge change. Bash is just a chsh command away :)

</comment><comment><USER35> Kali Linux still exists? I thought after it was used in so many more or less good films and series it is not cool any more. :D

<comment><USER36> It's very lively and actually the cancer of certain parts of the internet (like the subreddit dedicated to Virtualbox).

<comment><USER37> i just took a look. wow, the number of people who have just discovered fire over there.</comment></comment></comment>


I'll write you a Slack bot in return for a $5K donation to ScriptEd - <AUTHOR> http://dopeboy.github.io/bot-for-a-cause/ <comment><USER2> This is a good idea, but the execution is distracting. What are you selling me, a slack bot or the pleasure of donating to charity?

What I'd suggest instead is a clear message of "high quality slack bots for a flat 5000" and a prominent note that all proceeds go to the charity. Maybe you could also mention that when it comes time to pay, you'd like me to pay the charity directly, but you don't have to lead with this. The charity is the icing on the cake, but you're building the cake on icing.

<comment><USER3> It's not a tiny detail. It's not tax-deductible if someone pays directly. It has to go straight to the charity

<comment><USER4> >It's not tax-deductible if someone pays directly

It would be an expense and would ergo be 100% tax-deductible (e.g. a reduction on $5000 of taxable income). There is another aspect relating to whether the firm gained an asset but that applies to both scenarios.

This makes no sense as a tax scheme.

<comment><USER3> This only works if you're a business. Individuals can't deduce expenses... (I wish)

</comment></comment></comment></comment><comment><USER5> Honestly, I like this model a lot, but I think the focus is like 2:1 charity:slackbots, where I'd like to see the reverse. For example, more examples of slackbots you've made, how long it might take you, and maybe throwing in the app store thing unless that's a big deal, so businesses can get the value out of the bot as simply as possible.

Basically, I would recommend focusing on value instead of the charity (despite the fact the charity is the most delightful part -- it's still a price point businesses need to be _sold_ on, not just pitched on).

<comment><AUTHOR> I really appreciate the feedback hawkice. Totally get that. Will do that for the follow around. To answer some of your questions:

* I made the bot for my startup [0]. It supports interactive messages (buttons, dropdowns), slash commands, and @ commands. Put another way, I use (and have knowledge of) pretty much all parts of the Slack API.

* You're getting a backend with the bot. This backend could just save stuff into a database or do more sophisticated things.

* I'm happy to work with the non-profit, ScriptEd, on some content marketing material so that the person or company that sponsors this gets public recognition.

* Timing - I'm doing this in tandem with other things. Obviously depends on what I get but let's say roughly 2 months.

* We're pretty close to getting our startup's app in the app store. I'm happy to help with this process now that I'm more familiar with it.

[0] - [http://braidhq.com/](http://braidhq.com/)

<comment><USER6> Nitpick: at the bottom of braidhq it says '2016' ;-)

<comment><USER7> Assuming 2016 is when they started working on this, that is the correct date. It should convey the first date of publication and not be some listing of what years it is copyrighted.

</comment></comment></comment></comment><comment><USER8> Chiming in as a rep of the nonprofit - happy to answer questions about our work! We operate in NYC, San Francisco, and Oakland. We're also looking for a few more volunteers to teach web dev in high schools - and especially in Oakland! Apply in the Bay Area at [https://bit.ly/ScriptEdSFBAYvolunteer](https://bit.ly/ScriptEdSFBAYvolunteer) or in NYC at [https://www.scripted.org/volunteer](https://www.scripted.org/volunteer) !

<comment><USER9> Do you have plans to scale out? I'd volunteer time but I'm not near any of the cities you currently work in. (For others who are in the same position -- inquire with your city / church / local refugee support org, you may find there are similar local initiatives for refugees.)

Also, this being (I assume) a weekday daytime commitment, do your volunteers get typically get their teaching time 'donated' by their employers?

<comment><USER8> Hi! We don't have formally announced plans to scale - though if you send me a message at email@example.com I can chat with you more. I'm fairly well connected with other orgs nationally that I might be able to recommend to you, depending where you're located!

Some of the companies our volunteers work for have paid volunteering time included as part of employee benefits - however that amount of time is usually 1 day / month, which is less than the amount of time we ask people to volunteer (2x a week, for 1.5 hours each session). Most commonly, our volunteers employ some flex time and make up the hours they spend with us by either coming in to work earlier, or staying late. It does require manager / company support to get approval to do so, however!

</comment></comment></comment><comment><USER10> I like this. A long time ago I offered to add features to TortoiseCVS (that alone probably tells you how long ago it was) for people who would donate (much less than $5000) to a charity that was important to me. I did it because at the time the TortoiseCVS build system was a PITA to get working, I had already gotten it working to offer patches that would scratch my own itches, and most of the other requests I saw on the mailing lists were not hard.

It garnered a few (promises of) donations... I never did follow up to see if the charities I specified had gotten them. But I was young and happy to do the patches anyway, so it felt like a bonus.

</comment><comment><USER11> I work as a software developer for an NGO and we sometimes get coders who want to volunteer their time to us. Quite frequently, this turns into a lot of overhead for us with little to show for.

Given the choice, I'd prefer this model.

Donation cash is the sweetest thing an NGO can have, and doing development work in exchange for a donation like this seems like a really cool way to raise it.

<comment><USER12> >Donation cash is the sweetest thing an NGO can have

Also involves the least amount of transparency and not much assurance that the cash is not going directly into the pocket of someone.

</comment></comment><comment><USER4> Just to clear up a bit of confusion, the company making the donation has no tax advantage over just paying this guy directly. In many jurisdictions there would be a tax _disadvantage_. Add that many firms would never engage in such a relationship because it has a confusing, legally dubious compensation and accountability structure.

Further, why not just charge the $5000 and donate it yourself? Why the gimmick?

[https://dennisforbes.ca/index.php/2015/10/01/the-gradual- dem...](https://dennisforbes.ca/index.php/2015/10/01/the-gradual-demonization- of-money/)

<comment><USER13> I think the presumption is the tax incentive. I wonder if setting up something like "gofundme" but for this sort of transaction, would simplify accountability.

So you donate/pay X, a non-profit organization, then they send the work to one of their contributors to build. This way you don't have the, "I paid so and so, but for something some other person built".

</comment></comment><comment><AUTHOR> Honored this made it to the front. Happy to answer questions here.

<comment><USER14> Simple and to the point offer, I applaud you for what you're trying to do.

</comment></comment><comment><USER15> Is $5000 a good deal for this amount of work?

<comment><USER16> For comparison, I write Alexa skills (close enough IMO). I charge about $1200/day so $5k would be about a weeks worth of work. Seems reasonable to me given the scope described in the post.

<comment><USER17> Christ what have I been doing with my life...

<comment><USER18> Seems reasonable for a freelancer. If you're doing less, you can work easier and worry-free as an employee. I'm 19yo, building software as a freelancer and earn 520$/day. If it would be less, I would try to get an employment. If you factor in employer's contribution to your pension plan and health insurance, sick days and insurances for freelancers e.g. IT liability insurance and income protection, this money is spent before it's earned. And you have to make sure that you always have enough contracts and that they don't interfere with each other.

I don't think everyone has to live such a life. It's a great relief to be in an employment without having to think about making money all the time. I chose freelancing because I want to choose what to work on and don't need any security for now, but I can imagine to work for $4,500-5,000/month in the future when I have kids and mortgages to pay for and need security.

The problem I have with freelancing is that you start to measure your life time in your hourly rate, because the time = money equation is ever-present. One has to be mature to resist this temptation, sometimes I'm not able to do it. It's a constant fight between the attitude that money isn't everything and the impression that it actually is.

</comment></comment></comment></comment><comment><USER19> OP might want to check the tax implications of this e.g. Joe Louis.

</comment><comment><USER20> So I donate $5000 and in return you push more HTML/JS developers to the market, making me getting paid less?

Well, what a deal!

<comment><USER21> I find it somewhat hard to believe that helping some less fortunate schools teach coding is really going to have a negative impact on your pay. But by all means keep bashing something that is actually doing some good.

</comment></comment><comment><USER22> Honestly, I did not like that at all. How about the people who need that $5K and want to write a bot to get food for their family?

If someone is willing to buy that bot, they will be more inclined to pay you to do that since is "charity" than the dev who need food. If you want do donate, it's OK donate as much as you want for anyone, but brag/sell your services for charity just degrades our profession.</comment>


I'm Hung Up on Main Memory Databases - <AUTHOR> http://www.oreillynet.com/mac/blog/2002/03/im_hung_up_on_main_memory_data.html <comment><USER2> Dates from 2002. More questions than answers.</comment>


Show HN: CNN Model Recognizes Sketch in Real Time - <AUTHOR> https://www.gradio.app/hub/hub-sketch-recognition <comment><USER2> Great response time. I drew a frog, then the Mona Lisa.

[https://imgur.com/a/AJHVApG](https://imgur.com/a/AJHVApG)

</comment><comment><AUTHOR> I used Gradio[1] to wrap an interface around this model[2]. Main contribution is making run predictions in real-time.

[1]: [https://github.com/gradio-app/gradio](https://github.com/gradio- app/gradio) [2]: [https://github.com/trekhleb/machine-learning- experiments](https://github.com/trekhleb/machine-learning-experiments)

</comment><comment><USER3> This is incredible. Amazing work. Surprisingly accurate.

<comment><AUTHOR> Thanks so much :)</comment></comment>


Pledging for unit tests - <AUTHOR> http://weblog.madebymonsieur.com/pledging-for-unit-tests/ <comment><USER3> Unlike, it seems, everybody else I find unit tests to have very little use, but hey if you want them do so.

TDD on the other hand is both an unprofessional waste of time (write code that you know isn't going to work just to make a test that you know isn't comprehensive enough pass? Really?), and an unprofessional way to structure your design - instead of a bunch of well behaved classes that abstracts and neatly encapsulate their behavior, you have to insert hooks so that you can inject your mocks.

At the end of the day, you end up testing software and find some, but far from all, of your bugs.

If you are concerned about software quality, great - write better code, do root cause analysis, but most of all: use a language with a good static type system.

<comment><USER4> I think there's a "baby and bathwater" issue here, on both sides.

IMO, the basic principle of TDD is solid: write the tests, then write the code. Like most ideologies, this takes an acorn of wisdom and grows it into an oak tree of folly (or some other really pompous metaphor -- that sentence rather got away from me).

The problem comes when people think the tests are something valuable in and of themselves. They aren't. They are only valuable insofar as they show a developer (a) if something is broken and (b) what it is.

I generally agree that Mocks are more trouble than they are worth -- they are an entire mini-codebase that doesn't contribute business value and must be maintained. But usually you can get most of the benefit without spending the effort: e.g. instead of a Mock::DB, have a separate instance of your prod DB running a snapshot; instead of a Mock::HTTPConection, just do a real HTTP request.

In short, I relate to your philosophy and share it to a certain extent, but I encourage you not to let the TDD zealots drive you away from what can be a useful tool.

<comment><USER3> >IMO, the basic principle of TDD is solid: write the tests, then write the code.

This is where we disagree: the value of the code is secondary to the tests (this shouldn't be that big a point of disagreement: would you rather have no tests and the code of a functional program, or great tests and no program?), but if you design the tests first, you are going to design the program such that it is easy to write tests for.

Write the program first, then write tests for it in the places where it is reasonably worth your time to do so.

<comment><USER4> Ok. I'm not actually that wedded to the order you do the two operations in. I think there is some value in writing tests first, so that you can verify they fail (before the code is written) and then work (once it is complete). But I think it's less important to do them first than to do them.

IMO, the "killer app" for unit tests is regression testing. If I make a change and the test suite still passes, I can be reasonably sure that I didn't break anything. All the other benefits are "nice to haves" in my mind.

</comment></comment></comment></comment><comment><USER5> "It will make our work so much more efficient"

The common complaints he lists at the start and acknowledge actually all boil down to the fact that unit tests do not _always_ make work more efficient. It's a tool in the toolbox. Sometimes they are great for your project. Sometimes they are a waste of time. It's still not magic pixie dust.

In my current project we have a test suite for our public webservice APIs and various clients that interface against those. Those tests are invaluable. For other parts of the project unittests don't make sense, so we don't have them, since making them would be a colossal waste of time.

So yes, you still need to defend unit tests, just like you need to defend _every other_ choice you make during development. No specific tech gets carte blanche.

</comment><comment><USER6> From a bit philosophical point of view a program is the specification of what the computer should do. Unit tests and type annotations both are some kind of checksums.

Generally I am for brevity: the program should be short. So I prefer that the 'checksum' also should be short. Unit testing is a really elegant and good tool if you can test a quite big chunk of functionality with a short test. If the test is for example longer than the tested functionality then its value is more controversial. Ok, for extremely important code, like the control of an airplane, put there as much redundancy in the checksum as you think is needed. But otherwise, it can be questionable.

The issue is quite similar with static typing. I am a static typing fan, but dynamic language guys always complain that you have to type too much in static languages. And they are right to some extent, although better static languages have good type inference, so it is not that big of an issue. In fact I don't really understand dynamic language guys. They always state that they like terse code, but with modern statically typed languages like Scala you really don't have to type much more than in dynamic languages. The difference is negligible compared to that those same guys are usually unit testing fans and their unit tests sometimes really make the code base significantly bigger.

TL;DR;: I value terseness, and I prefer to use both static typing and unit tests only if it does not increase the code size significantly.

<comment><USER7> When I'm working in a static language such as Haskell I very rarely write traditional unit tests, instead preferring to use QuickCheck (<http://en.wikipedia.org/wiki/QuickCheck>). I like the adversarial nature - <USER2> specify invariants and I challenge the computer to prove me wrong! This seems more likely to find bugs than me writing my own tests.

Wanting to find bugs seems to be an important factor in writing quality tests. It's easy to write soft tests when the same person writes the code and does the test. Maybe that's why pair programming and TDD seem to go well together, as the other person is more motivated to try and break your code?

</comment></comment><comment><USER8> As both a TDD and HN fan I'm really quite surprised to hear the anti TDD rhetoric here. To the detractors here are some honest questions:

1) How many projects have you worked on that were 100% test driven and written outside-in?

2) Do you have the knowledge to test any code, regardless of web APIs, filesystem etc.?

3) When you deploy an app without 100% coverage how can you be confident that there are no regressions?

4) When you add new functionality are you comfortable changing the existing code or do you try to leave it alone and build on top of it?

<comment><USER9> I like TDD, but it has its place. I think you'll find the rhetoric here is a reaction to the inflammatory tone in the article more than anything else.

It's perfectly possible to develop and maintain large, complex systems without 100% code coverage. Clearly some level of testing coverage between 0% and 100% is optimal. The case for it being 100% is, to my mind, extremely weak.

<comment> tuomas-mbm A bit out of topic, but what is it that makes the article to have "inflammatory tone"? Would love to hear some feedback about this too to improve my writing skills.

<comment><USER8> It's effectively said that anyone that doesn't practice TDD isn't professional. Telling people they're unprofessional tends to piss them off :)

edit: In response to child post - That was my interpretation of this "It will make our work so much more efficient, motivating and a bit more professional."

<comment> tuomas-mbm I have to admit that I have a bad habit to write things a bit extreme way to start a conversation. How ever where did I do such a claim that if one does not do TDD is not professional?

It seems that I definitely need to improve my English. :)

</comment></comment></comment></comment></comment><comment><USER10> I also can not believe how hard it is to convince people of the advantages of testing.

I often see stories that are not accepted multiple times simply because the product owner has changed the intent of the original story. Tests really help to define what it is that the product owner wants before a line of code is even written.

In the bigger picture, how much "more time" does it really take?

Dumb story, but my dad taught me how to do word working: making European Cabinets. So many times he would say "Measure twice, cut once." This, in some convoluted way, could apply to software engineering.

<comment><USER11> There's a reason they say that though. Unless you happen to have a board stretcher in the truck, cutting something too short ranges from "expensive" to "irrecoverably fails the entire project."

Compare that to writing code. Fixing something you did wrong is so trivial that I'll often find myself writing 3 variants of a bit of code and testing rather than pulling out a sheet of paper and doing a bit of math to make sure I code it correctly.

"Should this be cos(theta) or -cos(theta)?"... code, compile, check, whoops, delete, compile, check, done.

That's waaay better than "134 inches, I think", cut, fit, whoops, phone Jerry: Hey, could you pick me up a new piece of #4 crown moulding on the way in?

<comment><USER12> I'm intrigued to know whether your "code, compile, check" anecdote was meant to argue for or against TDD as it could go either way.

I guess the point you're responding to meant that "eyeballing" whether something actually works is the equivalent of "estimating" a length, a couple of easy tests is the equivalent of "measuring once" and "measuring twice" is taking the extra effort to build a small suite of tests with corner cases, a small sign of having learned from bitter experience.

Of course with automated tests you are literally measuring twice (indeed, measuring many times) even as the tools and materials change out from under you.

</comment></comment></comment><comment><USER13> Again with the "professional" slander, as with the TDD article…

I hereby declare that anyone who doesn't follow Jackson Structured Programming is a two-bit script kiddy!

</comment><comment><USER14> I wonder if the split between pro/anti unit testing comes from folks in traditional developer positions vs startups (since there is a decent mix of both here).

As a pure developer working on an established codebase, the benefits of automated testing are quite clear, especially if you have paying customers and the cost of failure is high.

But as a startup, every extra line of test code you write slows you down from launching, and the most important thing at this point is launching and figuring out whether you actually have a market for your product.

After all, what's the point of having 100% test coverage for a product that no one wants to use?

It's also entirely likely that you're going to end up throwing large sections of your codebase out as you pivot towards something else.

Here's the way I see it:

It's rather pointless to have 100% test coverage of a product that no one is using, but it's also dangerous to have 0% coverage of a product with live, paying customers.

Intelligent developers will have the find the right balance between the two (as it shifts over time).

<comment><USER15> If you're ever intending to pivot, chances are that there's going to be a refactoring involved, just as much as you're likely to throw things away. I have difficulty seeing how that's going to be quick and easy without either a rock-solid type system, good test coverage, awesome IDE support, or all three.

</comment></comment><comment> tuomas-mbm Hi all,

I'm the author of the blog post. I'm very glad that it has gained already so much opinions and feedback.

As user ollysb, I'm quite surprised to notice that there seems to be more against the post than for it. And that was one of the reasons why I actually wrote it: You are smart guys, please proof me wrong about unit tests. I can only find good things in unit testing, so it seems that I have not fully thought it through.

ps. Did the post have "inflammatory tone"? It was definitely not my intention. Sorry if it did. I have done computer programming for living only just about 10 years and I am definitely not a professional in it yet. Which parts made it sound cocky? I would love to hear feedback for that too improve my writing.

<comment><USER5> "I can only find good things in unit testing"

Then you are simply not very experienced using it. You're in the love-phase where everything about some new technology seems wonderful, and since it's solved so many previous problems for you, you are blind to the warts and problems that come with it.

We understand your enthusiasm for it, unit testing and TDD are good tools, but they're just that. Tools. That you can choose to use if they fit the project.

Your blog post (and the previous one) both said that unit tests and TDD are always awesome for all projects. This is not true, and this is what people here are reacting to.

<comment> tuomas-mbm Thanks for the nice reply Henrik.

Yes, most likely the truth is that I'm not experienced enough of using it and the type of systems I build are limiting my view.

I also understand unit testing is a tool with it's limitation.

However, for me, unit testing is a good tool that helps me to proof that the code I did works. And I hope I would see more of unit tests on the field.

But as you said, probably the way to find the dark side of unit testing is just doing it and finding the problem. So I'll keep using the tool until I do.

I think I also really need to learn to write better. :) Where did I do such a claim that the TDD and unit tests are always awesome for all projects? I think I even did the opposite.

</comment></comment></comment><comment><USER16> Importance of unit tests varies with the projected lifetime of the software you're writing. If you're writing libraries or system services, then unit testing is smart, as those are bound to live on for many years. Simple end- user applications might be a different case.

On the systems side (in this case, a PHP framework), I've found that once test coverage passes 70% you can make optimizations and refactor the code without having to actually run it - the tests will tell whether the changes you did still maintain API stability.

</comment><comment> brown9-2 There's a bit of a solution to this out there: if you are a developer who really cares about unit tests, make sure to ask any prospective employers how they feel about them during the interview process.

</comment><comment><USER9> More time spent writing unit tests does not imply the product will be better for it.

<http://news.ycombinator.com/item?id=1846841>

</comment><comment><USER17> Completely unrelated, but just this made my day. After upvoting:

Pledging for unit tests (madebymonsieur.com) NaN points by koski 1 hour ago | 11 comments</comment>


Should we still write Internet with a capital 'i'? - <AUTHOR> http://thenextweb.com/media/2012/03/24/should-we-still-write-internet-with-a-capital-i/

<comment><USER2> I just found an answer to this yesterday:

"An internet (lowercase "i") is any collection of separate physical networks, interconnected by a common protocol, to form a single logical network. The Internet (uppercase "I") is the worldwide collection of interconnected networks, which grew out of the original ARPANET, that uses Internet Protocol (IP) to link the various physical networks into a single logical network. In this book, both "internet" and "Internet" refer to networks that are interconnected by TCP/IP."

<http://www.morninj.com/2012/03/internet-or-internet/>

<comment><USER3> I like this approach; "I can't access the Internet, my internet connection is down."

<comment><AUTHOR> Yes, I like this too.

</comment></comment></comment><comment><USER4> The capital is unnecessary for two reasons. First, common parlance does not distinguish any old _internet_ from the global one. From a descriptivist standpoint, the battle is already over. Second, we already use an article to differentiate the two uses: _an internet_ is to _a world_ as _the internet_ is to _the world_ —not _the World_. Same goes for _a web_ versus _the web_.

What _does_ bother me is that it's called the _World Wide Web_ and not the _Worldwide Web_.

<comment><USER5> Speaking of which, in this day and age, I find it inexcusable for example.com not to be a valid alias for www.example.com. (Are you listening old media??)

<comment><USER4> Yeah, I always 301 the "www" subdomain to the real site. Some agree with us[1], some disagree[2], and some disagree disagree[3].

[1] <http://no-www.org/>

[2] <http://www.yes-www.org/>

[3] <http://www.www.extra-www.org/>

<comment><USER6> The reason you should use a www.domain is because then you can serve static assets from a cookieless domain. If you don't use a www-domain, then you'll be setting cookies at root and they'll populate down to say static.example.com too.

<comment><USER7> But aren't there other aspects of same-origin policy that could bite you if you outsource static.example.com too?

E.g., it may not stop static.example.com from setting malicious cookies at the root.

<comment><USER6> > static.example.com from setting malicious cookies at the root.

It does. Subdomains can't set cookies for other subdomains. So long as you don't read root cookies, you'll be fine even if you do put static.example.com on some companies box that gets hacked without your knowledge.

However, outside of hacking (which is an issue no matter how you layout your domains), I can't think of a single problem with www-.

<comment><USER7> > So long as you don't read root cookies

I wonder how many web apps are coded to reject cookies from a parent domain when they're expecting specific-subdomain cookies?

<comment><USER6> Now that you mention it... I looked did a little investigation and it turns out you can't tell where a cookie comes from.

document.cookie in javascript just returns a string, and HTTP_COOKIE doesn't have any identifying information.

So yes, you're right. I was wrong. You can get poisoned by cookies on a root and there's really nothing you can do about it except hope that your browser is smart enough to make prefer your good.example.com cookies as opposed to the root cookies set by evil.example.com

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> "I view it like a utility or books" isn't valid justification, it's an horrible misunderstanding that "the Internet" is the name of THIS network. Iran aims to create their own. And surely we'll have others eventually, we just haven't had serious consumer networks yet.

<comment><USER9> There's already Internet2. It's mostly for academics. My university is a member, so file transfers with some other universities will go REALLY fast.

</comment></comment><comment><USER10> It's a shame that Google's trends tool doesn't allow us to compare case- sensitive terms. One could scrape through the first N results, but N would be an order of magnitude smaller than what a proper Google implementation could accomplish.

<comment><USER11> why not just look at the Google Books corpus (ie Google Books n-gram viewer) [http://books.google.com/ngrams/graph?content=Internet%2Cinte...](http://books.google.com/ngrams/graph?content=Internet%2Cinternet%2Cseries+of+tubes&year_start=1985&year_end=2008&corpus=0&smoothing=3)

</comment></comment><comment><USER12> I thought we stopped doing that in 1995.

</comment><comment><USER13> Question:

Does treating the Internet as a proper noun legitimize it relative to nation states? How about the opposite, i.e. does treating it a a regular noun delegitimize it relative to nation states?

<comment><USER7> I wouldn't think so.

I don't think there are very many people who would consider the internet to be something that would ever be in the same category of thing with nation states such that they could be related. 'The internet', even when used as a metaphor to refer to some collection of humans, is far less tangible and definite compared to a nation state.

</comment></comment><comment><USER14> Still? Why would anyone write 'internet' with a capital 'i'? Internetisapropernout.net is just _wrong_ : it's not a proper noun; if it were, why would we precede it with an article?

If we capitalized any noun that referred to a specific thing, every word that followed 'the' would need to be capitalized.

The internet over which I'm posting this comment simply happens not to have a name.

<comment><USER15> Why is the White House preceded with an article? I don't think it's significant.

</comment></comment><comment><USER16> I have always capitalized Internet and Web.

</comment><comment><USER17> If you were at an institution with Internet2 connectivity, "the internet" would be ambiguous in a way "the Internet" isn't, perhaps? Anyone here part of such a group? For most of us though, it makes no difference and it wouldn't be the first time informal and formal usage have differed :)

<comment><USER18> Since Internet2 doesn't have different user-facing characteristics, I don't think most researchers distinguish, unless it's their area of research specifically. From a user perspective it just looks like another set of long- haul internet pipes, alongside both the commercial ones run by Level3/etc., and other educational networks like CalREN and NORDUnet. I don't even usually know when my data is being routed over Internet2 or some other network unless I make a point of tracerouting, and often it transparently takes some mixture of routes.

<comment><USER17> _and often it transparently takes some mixture of routes._

Whoa. I always thought it was pretty much separate. Might have to go and hunt down a documentary or something about this, seems an interesting topic.

</comment></comment></comment><comment><USER19> The basic question is whether or not the word "Internet" is a proper noun (i.e. a specific named entity like the "Interstate Highway System") or just a regular noun like "public highways".

</comment><comment><AUTHOR> I do still write it with capital "i". What do you think?

</comment><comment><USER20> I use a lower case "i". These days internet is just a common noun.

</comment><comment><USER21> The Internet (the iPhone automatically capitalized it for me) is kind of like air - it's ubiquitous, and yet we don't see the word air capitalized.

<comment><USER7> Yeah, 'air' is another word that's sort of nebulous about its extent.

"The bug in the jar is running out of air" c.f. "Don't pollute the air" (i.e., Earth's atmosphere)

<comment><USER22> Yes, but "air" is not really comparable, is it? You'd never find someone saying "if we remove the wall from this room, we can make an air", or "you have your air, I have my air, and we should connect them to the Air".

There can be (and are) multiple internets. Hundreds, thousands of internets. There is only one Internet. The people who decide the nomenclature of the technology should be the network engineers who have the knowledge to build it. People who argue for "internet" don't seem to understand how internets work.</comment></comment></comment>


Electric Generation in Spain – Latest 24 Hours - <AUTHOR> http://energia.ningunaparte.net/en/ <comment><USER2> I think we killed it :( At least I don't get any data plotted anymore when loading the site.

I agree it's neat, but I dislike that the plot legend has the text at an angle with poor contrast and in the "wrong" order compared to the plot colors. I'd also like a better color scheme with more distinct colors. I'm also not s fan of fading out the colors with time.

<comment><USER3> Same issue here on the latest version of Chrome. Seems our hug of death might have spread to the official data source too as I just get a blank page there as well.

</comment></comment><comment><USER4> Neat looking visualization. Sorry for the nitpick but personally a straight line (rather than circular) plot 00:00 - 24:00 will help see the peaks and compare high-low better. The time could you also show by time of generation rather than local. (it is weird to see peak solar at 0200 hrs )

<comment><USER5> Personally I quite like the polar coordinates, though it's a pity that by convention, a watch face only holds half a day, as we would otherwise have a nice mapping of generation time to a watch-face equivalent.

My nitpick is that this is ultimately a stacked bar chart, so as with cartesian stacked charts, it obfuscates some of proportions, in particular the very interesting cyclicity of renewables. The author has wisely put the higher-variance variables first, mitigating the problem somewhat, but not completely, as can be seen by comparing to the gridwatch UK equivalent.

<comment><USER6> [http://www.gridwatch.templar.co.uk/](http://www.gridwatch.templar.co.uk/)

</comment></comment></comment><comment><USER7> It's glitchy in Firefox. Here's the official real time graph [https://demanda.ree.es/demandaGeneracionAreasEng.html](https://demanda.ree.es/demandaGeneracionAreasEng.html)

<comment><USER8> "Alternate HTML content should be placed here. This content requires the Adobe Flash Player. Get Flash"

Not happening.

</comment></comment><comment><USER9> The equivalent for the UK: [http://gridwatch.templar.co.uk/](http://gridwatch.templar.co.uk/)

</comment><comment><USER10> Very well done. Here is a similar thing for Ontario [http://media.cns- snc.ca/ontarioelectricity/ontarioelectricit...](http://media.cns- snc.ca/ontarioelectricity/ontarioelectricity.html)

</comment><comment><USER11> Irish Dashboard here - [http://smartgriddashboard.eirgrid.com/](http://smartgriddashboard.eirgrid.com/)

<comment><USER12> Were you involved in building it? Nice.

Does the percentage of renewable generated (wind) go up a lot during the night?

<comment><USER11> No, we built a simple traffic light on top of it. [Red/Amber/Green] to indicate how much electricity is wind generated, and so if its a good time to charge your electric car, etc..

</comment></comment></comment><comment><USER13> Most grid operators have displays like that. The California ISO has one.[1] PJM's is the most elaborate; search for "eData Guest view" to view it. It's too much information at first, but click on the "Big Picture" tab, then change one of the smaller panes to "Wind", and one to "Load", and you can see current load and how much wind power is contributing. Note the 5:1 variation in wind power over a day, across most of the northeastern US. "LMPs" shows the wholesale price of electricity at various points in the system. (It costs money to transmit power, so it's not the same everywhere.)

You can view the PJM's network issues by clicking on "Constraints" or "Emergencies". Typical message today: _" As of 17:10 on 11.20.2015 a Post Contingency Local Load Relief Warning to maintain WARD 115 KV at 106 KV in the PN area has been issued for Transmission Contingency Control. Additional Comments: Pre-contingency voltage too high for caps at Mansfield and Niles Valley"_ Minor problem, already handled. If you really want to understand all this, PJM has lots of training materials. Start with "PJM 101".[2] Anyone running a big network or "cloud" may find it useful to see how a very large power grid is run. The main control room in Valley Forge, PA usually has less than 10 people.[3]

[1] [http://www.caiso.com/outlook/SystemStatus.html](http://www.caiso.com/outlook/SystemStatus.html) [2] [http://pjm.com/Globals/Training/Courses/ol- pjm-101.aspx](http://pjm.com/Globals/Training/Courses/ol-pjm-101.aspx) [3] [http://www.elliottlewis.com/pjm-mission-critical- site/](http://www.elliottlewis.com/pjm-mission-critical-site/)

</comment><comment><USER14> It's a neat tool however please keep in mind that Spain is actually a very big importer of energy.

Earlier this year a major construction project has ended: a double 65km tunnel below the pyrenean of 1000MW capacity. It doubled the previous existing capacity.[1]

Spain is a very large importer of energy, ENTSOE data for October is 525GWh FR->ES [2] Since the energy mix of France is roughly 75% Nuclear, in reality Spain relies much heavily on nuclear than what is displayed.

Based on ENTSOE data, Fraunhoffer built another very nice data visualisation of import/export of electricity between Germany and its neighbours [3]

European electricity networks are very tightly interconnected, and although I don't have a source at hand, I remember being told that preventing a domino effect between countries has been a massive feat of engineering. Basically, the fear of every energy provider/network is something similar to the blackout that happenned in northern america in 2003[4]

As a side note does anyone know what "balearic exchange" refers to? I guess something the Baleares islands, but my google-fu failed me

[1] [http://www.inelfe.eu/?Liaison-electrique- souterraine&lang=fr](http://www.inelfe.eu/?Liaison-electrique- souterraine&lang=fr)

[2] [https://www.entsoe.eu/db-query/exchange/detailed- electricity...](https://www.entsoe.eu/db-query/exchange/detailed-electricity- exchange)

[3] [https://www.energy-charts.de/exchange.htm](https://www.energy- charts.de/exchange.htm)

[4] [http://www.nature.com/news/is-the-us-grid-better-prepared- to...](http://www.nature.com/news/is-the-us-grid-better-prepared-to-prevent-a- repeat-of-the-2003-blackout-1.13559)

<comment><USER15> Spain is a net exporter of electricity; its net exports were 3406 GWh in 2014 (vs. total consumption of 243,530 GWh). It imported 5963 GWh from France and sent 2395 GWh back; For Portugal it was 6345 GWh imported vs. 7247 exported, and there was an exportation of 5839 GWh to Morroco (vs. 3 GWh of importation).

Exports and Imports vary depending on the season. From January to April, when the most hydro power is produced, Spain is a net exporter to France and a net importer from Portugal. The rest of the year, the balance is mostly reversed. The export to Morroco is roughly stable all year.

In 2014, Spain's nuclear power plants produced 57,376 GWh. Assuming all energy imported from France (5963 GWh) was from nuclear plants, that would add 10.4% to nuclear-source electricity, for a total of 63,339 GWh, or 26% of consumption (vs. 23.6% if you don't count French imports).

Edit: source for all that: [http://www.ree.es/es/publicaciones/sistema- electrico-espanol...](http://www.ree.es/es/publicaciones/sistema-electrico- espanol/informe-anual/informe-del-sistema-electrico-espanol-2014)

<comment><USER14> Didn't know that, thanks!

</comment></comment></comment><comment><USER16> New Zealand power generation and transmission, live: [http://www.em6live.co.nz](http://www.em6live.co.nz)

Shows a breakdown of how the energy is generated and where it is going.

</comment><comment><USER17> same for germany here: [https://www.energy- charts.de/power_de.htm](https://www.energy-charts.de/power_de.htm)

<comment><USER18> Select "alle Quellen" on the left side to get a finer breakdown and then "Import Saldo" on the top right for adjustment for imported or exported power.

</comment></comment><comment><USER19> The lack of solar is completely baffling. [EDIT] I was referring to solar on average.

<comment><USER20> Lack? It's around 10% during daytime

<comment><USER21> The times are presented in the viewer's local time. For me it looks like solar peaks in the middle of the night.

<comment><USER20> Oh, didn't realise since I'm in GMT+1 (actually, I'm in Spain, but well.) In any case, solar is pretty visible with the color choice and, well, it's actual presence.

</comment></comment></comment></comment><comment><USER22> Interesting that Hydro is dropping to almost zero at times. I would have though at least some of it would be always going to maintain flow of rivers etc.

<comment><USER7> In the official graph it actually goes negative.

<comment><USER15> Probably because of pumped storage: [https://en.wikipedia.org/wiki/Pumped- storage_hydroelectricit...](https://en.wikipedia.org/wiki/Pumped- storage_hydroelectricity)

</comment></comment></comment><comment><USER23> We took it out. Can anyone share a cached copy ?

<comment><USER24> Well, at least this is the official data portal of the Spanish grid: [https://www.esios.ree.es/en](https://www.esios.ree.es/en) if someone is interested.

</comment></comment><comment><USER25> How can there be solar at 21.15 GMT+1? Even if just 0.30%. Is this from the accumulated residual during the day?

<comment><USER26> Concentration solar... It melts salt that still provides energy for a few hours. [https://en.wikipedia.org/wiki/PS10_solar_power_plant](https://en.wikipedia.org/wiki/PS10_solar_power_plant)

<comment><USER27> wiki says they're using superheated water for storage, lasting 30mins and the salts are under consideration - sounds like a serious improvement, do you have more info?

<comment><USER28> Click through the list of solar power plants, In particular I found this one: [https://en.wikipedia.org/wiki/Crescent_Dunes_Solar_Energy_Pr...](https://en.wikipedia.org/wiki/Crescent_Dunes_Solar_Energy_Project)

> Melting about 70,000,000 pounds (32,000,000 kg) of salt takes two months.

</comment></comment></comment></comment><comment><USER26> I find it so awesome that some days 50% of the electricity comes from wind... Just great. A good example.

<comment><USER29> If you had to pay one of the world's most expensive electricity bills, I guess you wouldn't find it so awesome.

<comment><USER30> That appears to be down to weird non-marginal pricing: [http://elpais.com/elpais/2014/01/01/inenglish/1388590410_230...](http://elpais.com/elpais/2014/01/01/inenglish/1388590410_230748.html)

The wind energy itself is cheap, but all producers are paid at the cost of the most expensive dispatch!

</comment></comment></comment><comment><USER21> Can someone explain "special scheme"?

<comment><USER15> I think it refers to the rest of the production that is done under the "Régimen Especial": [https://es.wikipedia.org/wiki/R%C3%A9gimen_Especial_de_energ...](https://es.wikipedia.org/wiki/R%C3%A9gimen_Especial_de_energ%C3%ADa)

The scheme includes energy generated from waste, biomass, hydro, wind, solar and co-generation. Since hydro, wind, solar have their own categories, that part of the graph would correspond to waste, biomass and co-generation.

<comment><USER15> It may include everything, though, because the scheme only applies to installation of less than 50 MW: [http://www.endesadistribucion.es/es/oficinaOnline/RegimenEsp...](http://www.endesadistribucion.es/es/oficinaOnline/RegimenEspecial/Paginas/regimenespecial.aspx)

So a micro hydro plant or a rooftop solar installation would be counted under the special scheme.

</comment></comment></comment><comment><USER31> I have new clock</comment>


Useful Client Feedback Generator - <AUTHOR> http://wonderfulfeedback.com

<comment><USER2> Meh. I agree with the gist of providing feedback on the goal, however... I've just completed a project with some designers that seemed more worried about how the site looked in their portfolios than the wishes of the client or the efficacy of the interface.

It would be one thing if they could demonstrate/substantiate their decisions with statistics (A/B tests) or research, but they had no such inclination. It was terribly disappointing to see how far they would go to defended choices and design inconsistencies.

They fought nearly every change, until the client made it clear that they knew what they wanted, knew why they wanted it, and to just get it done (they were paid for revisions). As a designer, you should be able to state the why & what of your design. Your task (also) consists of educating _and_ convincing the client.

There are too many (self-perceived) artists, and it seems too few with user interface/interaction experience.

Even worse are the ones who design something but have no clue about the limitations of the technology (an example: enticing a client with special fonts that are not available as web fonts, then suggesting that the site be created as a series of images, please bro... hand back your diploma, you fail)

<comment><AUTHOR> that's exactly the type of feedback the document is designed to stop

<comment><USER2> I know, but I'm telling that's understandable, but only acceptable _IF_ the designer knows what he's talking about _AND_ understands the problem/company.

</comment></comment></comment><comment><USER3> I've had a lot of clients who would get pretty snitty if they received a document like this. They're great guidelines, but not for the client to read; they're good for the developer to use to guide the conversation when presenting to a client, live, which is the only way to do it.

<comment><USER4> This comment violates the rules. Too prescriptive. How about "We want to emphasize keeping clients and not getting fired".

<comment><USER5> Given that the parent site for this charges for job leads, something tells me 'not getting fired' isn't high on their priority list.

<comment><AUTHOR> You're the one saying your clients would get "snitty" if you gave them a document like this. Maybe you should work on getting better clients instead of being "snitty" yourself.

<comment><USER3> Note that I am not jarcane.</comment></comment></comment></comment></comment>


We'll build a free MVP for you - <AUTHOR> https://www.getafreemvp.com/ <comment><USER2> This is not a Show HN. Please read the rules: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html).

Also, voting rings will get your accounts and sites banned from Hacker News.

</comment><comment><USER3> No "about us". No names. "send us your business idea". No link to the blog or github repo.

<comment><USER4> Red flag.

</comment></comment><comment><USER5> "We'll publish a blog post for each app we launch, detailing the development process and the business it was built for."

Is this blog already up and running? If so, what is the URL? (I am curious to see what they have done so far)

"The code we write will be published as a public repository on GitHub."

I could not find the account on GitHub (if there is one already started). Could you provide the URL please?

</comment><comment><USER6> > _How much does it cost? - > We don't take any money / equity from you_

> _You can support our initiative by donating_

No offense but this is a bit absurd. Either you need money or you don't. If you do need money, _make it easy for businesses to pay you_ by providing something for a fee, with a proforma.

Donations are very difficult / impossible to do for small businesses (probably your core audience).

<comment><AUTHOR> Donations are not the main CTA. If you want to support the initiative you can donate. We don't need money to build the MVPs for people but if we get donations we might convince other devs to join (they would get paid).

</comment></comment><comment><USER7> I'm guessing this serves as marketing for their consultancy business? If it is, it's a pretty fun way to go about it.

</comment><comment><USER8> In principle ideas are 'cheap' and execution is everything. By publishing the MVP to github, are you simply enabling competition?

<comment><AUTHOR> If you don't want competition then you have to pay for the execution

</comment></comment><comment><USER9> Do you have portfolio? I find it hard to believe anyone serious would send you an entire spec for their product.</comment>


Ask HN: What are the Implications of GPT-3? - <AUTHOR> From what I've been hearing, it's a game changer. <comment><USER2> Preface: I'd wait a few months before declaring it a game changer. There currently is a huge OpenAI marketing campaign going on touting how amazing GPT-3 is. Almost all the GPT-3 press comes from OpenAI's friends and network of YC founders who got privileged access and promised to build apps on top of the new API. You can see that by looking at the most popular tweets and posts. It's usually ex-YC people who are now working on new GPT-3 powered apps. Their examples and demos are clearly cherry picked. It's the typical Silicon Valley VC pitch deck smoke demo approach that you would expect from SV startup people. Let the hype and marketing campaign settle down.

That being said, if it all works as promised and the model becomes widely available it's quite amazing and has the potential to change a few things. The obvious one is that it becomes much easier to automatically create plausible- looking content such as news stories, comments, etc. This will create many more bots and spam than you are used to seeing. The other obvious one is to act as a natural-language based search engine or database, where you can ask questions and get facts as answers. This would be restricted to non-subjective things that are in the training data of course.

On a longer time scale, it could drive the adoption of technologies around fact and identify verification. As it becomes so much easier to automatically generate content, we need to better ways to establish trust. Safety and bias is yet another, since anything generated will obviously be biased to whatever is most common in the training data.

<comment><USER3> > They're probably being paid for it and their examples and demos are clearly > cherry picked.

This is a hefty and ungrounded accusation. You get access to the API by sending an email with a use-case; this has been said independently by multiple people, eg. [1]. Gwern has also commented that you don't have to cherry pick nearly as much as you did for GPT-2; a decent fraction of samples are simply good.

One of the key points of OpenAI API is that they can vet users to prevent abuses like malicious bots and spam.

[1] [https://www.reddit.com/r/MachineLearning/comments/hs9zqo/p_g...](https://www.reddit.com/r/MachineLearning/comments/hs9zqo/p_gpt3_aigenerated_tweets_indistinguishable_from/fy949br/)

<comment><USER2> You're right that this is an ungrounded accusation and I changed my comment.

For what it's worth, I know several people at competing labs who applied for access and didn't hear back. If you are doing science, aren't other scientists, especially those who are critical, the first ones that should get access?

</comment></comment></comment><comment><USER4> Link in case anyone wonders what GPT-3 is: [https://news.developer.nvidia.com/openai-presents- gpt-3-a-17...](https://news.developer.nvidia.com/openai-presents- gpt-3-a-175-billion-parameters-language-model/)

</comment><comment><USER5> Its a game changer if you are into trivia or generating nonsense. [http://lacker.io/ai/2020/07/06/giving-gpt-3-a-turing- test.ht...](http://lacker.io/ai/2020/07/06/giving-gpt-3-a-turing-test.html)

</comment><comment><USER6> I enjoyed Robert Miles' take on it

[https://www.youtube.com/watch?v=_8yVOC4ciXc](https://www.youtube.com/watch?v=_8yVOC4ciXc)</comment>


Paypal Looks to Crush Amazon's Fledgling Payment Service With A New, Secret API - <AUTHOR> http://www.techcrunch.com/2009/07/06/paypal-looks-to-crush-amazons-fledgling-payment-service-with-a-new-secret-api/ <comment><USER2> I've used both PayPal and FPS. PayPal allows you to get on your feet quickly, but limits what you can eventually do. FPS has a massive feature set, coupled with a massively complex API.

Amazon needs to tackle the complexity issues. FPS has a thousand error states, and payments fail all the time with little to no explanation. Good luck with the resolution process, too. Here's my most recent attempt at getting some help on failed transactions: <http://files.getdropbox.com/u/145070/fps_error.png>

<comment><USER3> I can't help but notice the attitude you show when filling out the support form. The guy on the other end reading it probably isn't the one at fault for the lack of clarity in the error message. Answering messages like yours all day long really sucks.

Cryptic error messages are frustrating, but there's no need to be nasty.

<comment><USER4> I agree about his tone, but he does have a point about the API complexity.

On the surface, FPS is quite simple, but when researching all the ways to use the marketplace API, it seemed like, more often than not, the only way to figure out if the API could do what I wanted was to ask in the forum and hope the FPS people answered me. Thankfully, they often do, so at least we know they care.

(The last time I seriously looked at this was almost a year ago, so take my anecdote with a fist-full of salt.)

<comment><USER2> The lack of a full-featured web console means that you're pretty much still right.

They need a way to log into your account and run some of the API operations, like making a Caller token. As it is, you have to script up some kind of kludge. You end up spending several hours just getting off the ground.

</comment></comment></comment></comment><comment><USER5> "Crush" seems extreme. It seems like PayPal is trying to build hype while undermining its prime competitor by leaking documents to a pliant TechCrunch writer. It would have been nice to have comment from Amazon or developers who actually are considering these types of services.

Edit: Developers out there considering such a payment service -- does the fact that Amazon offers other useful cloud services (EC2, and the storage service) potentially make its FPS more attractive than PayPal's offerings? In the enterprise IT world, some companies like to go through one vendor to streamline vendor points of contact (or they are forced to go through one vendor, owing to a lack of interoperability) -- is there a similar desire among small, online-oriented companies that might use these payment services?

<comment><USER6> For one thing, to use Amazon payments person to person, you had to hook a bank account to your account. Which makes it basically useless - most people won't, they like using paypal credit card based cashes.

</comment></comment><comment><USER7> Paypal has brought very little innovation since they were acquired by eBay. I'd be surprised if this suddenly changed.

<comment><USER8> Me too. But there was a suggestion floating around the Internet that eBay management is "tired" of eBay (which many would argue they have ruined with their changes in the last few years) and looking to PayPal to be their main cash cow. In which case, they do have to at least keep up with their competitors.

<comment><USER9> Both brands can go much, much further. We can't predict much about the web 10 years down the road but it's pretty safe to say that more and more buying and selling will be occurring on the web. If I was in charge of ebay, I would slightly rebrand to form an online commerce umbrella.

<comment><USER10> Back to the paypal/ebay vs Amazon, I think you're right. These are both really online commerce enablers.

I would place my bets on Amazon coming through on top. They have a stronger history of innovating & consistent improvement over time.

Paypal & Ebay have this aura of scaling down to the 'I'll sell you my hat' level. They do. But I wonder how much of Ebay's (or paypal's) bottom line comes from the not-a-business crowd vs from actual businesses.</comment></comment></comment></comment>


The Chernobyl Story in pictures - <AUTHOR> http://imgur.com/a/TwY6q <comment><USER2> We speak of technical debt at times here on HN and other places where workers struggle with complex systems. The Chernobyl incident can be characterized as a consequence of technical debt. The test that was being performed had been deferred since prior to the start of plant operations and the operators were attempting to complete it while under pressure from multiple sources, including securing their own annual bonuses.

Dr. Paul Josephson covered a lot of the inside baseball surrounding Chernobyl and other aspects of Soviet nuclear power and weaponry in his book Red Atom (2005).

</comment><comment><USER3> This is an excellent collection! Igor Kostin is mentioned in one paragraph but I do _highly_ recommend reading his "Chernobyl: Confessions of a Reporter" if you can get your hands on it. Confessions is an incredible bit of photojournalism. Everyone I've ever lent the book to has been moved by the scale of the unknowing sacrifices that were made to bring the plant under control.

</comment><comment><USER4> I had never heard this story before about the Swedish nuclear worker who tested positive for radiation was what led to the discovery of the incident. I would love to know how they traced it back. This is fascinating and really incredible that the U.S.S.R. didn't feel any responsibility to share such information with Europe.

Amazing research and effort by the author. This is the Amazon link:

[https://www.amazon.com/Chernobyl-01-Incredible-Nuclear- Disas...](https://www.amazon.com/Chernobyl-01-Incredible-Nuclear- Disaster/dp/0993597505)

<comment><USER5> Chernobyl occurred prior to the warming in relations that resulted from Gorbachev's reforms, so it is understandable that the Soviets perceived a significant threat from admitting the accident occurred. Unlike Fukushima, Chernobyl slowly released radioactivity for days due to the fire. Initial Soviet assessments of the accident severity were optimistic. I'm not saying that they were right in delaying, but the fire was still burning and the atmospheric release ongoing when they publicly revealed it.

<comment><USER2> The Soviets also covered up Kyshtym in 1957, a cover up that lasted for three decades. Many officials in the West were complicit in that cover up, adopting extraordinary skepticism of the available evidence to discredit those that either knew or believed a major nuclear incident had occurred.

One of the victims of that cover up in the West was Zhores A. Medvedev. He wrote a book (Nuclear Disaster in the Urals) in response to critics of his claims of a major nuclear disaster. The book is a truly fascinating survey of open sources of academic work published by Soviet researchers that reveals the incident indirectly; the papers (typically studies of the effect of contamination of various organisms; fish, plants, worms, deer, etc.) could only have been written if a large area of land had been heavily contaminated, and this subtlety was lost on the state censors, who were themselves not aware that Kyshtym had happened.

Medvedev was eventually vindicated when the Soviets fessed up in the late '80s.

</comment></comment></comment><comment><USER6> Amazing photos, but please see my other comment about this caption:

> It... was considered to be the best and most reliable of the Soviet Union's > nuclear facilities

[https://news.ycombinator.com/item?id=13349940](https://news.ycombinator.com/item?id=13349940)

</comment><comment><USER7> I still remember this. When it happened I was 7 years old and I was living in Germany. The town were I was living in blocked all playgrounds for weeks. And my parents warned me more about picking stuff up from the ground.

I actually never knew if this made a difference.

<comment><USER8> Exactly the same experience for me. I remember we stayed inside for weeks.

</comment></comment><comment><USER9> About as haunting a set of photos as you can have. Imagine going from a carefree existence as a child and in two days being evacuated with nothing, and not idea if you are going to die soon or not.

</comment><comment><USER10> I had no idea that there could have been a second explosion. However, I didn't really get from this article why that is no longer a possibility.

<comment><USER11> My understanding was that until the "elephant's foot" and other radioactive lava flows were found, everyone was under the impression that there was still fuel in the reactor, which carried the possibility of a second explosion. The existence of the lava flows instead indicated that everything had melted together and spread throughout the lower parts of the building: radioactive, but no longer prone to an explosion.

</comment></comment><comment><USER12> Amazing collection! Really expanded on a few less-known aspects of the disaster

</comment><comment><USER13> BRILLIANT.</comment>


Better networking with SCTP - <AUTHOR> http://www.ibm.com/developerworks/linux/library/l-sctp/?ca=dgr-lnxw07SCTP <comment><USER2> SCTP does two things that I think are hugely important.

First, it provides a datagram/record transport that is TCP-friendly. The most important thing TCP does isn't reliability; it's the insanely complicated interpretive dance it performs with other TCPs to keep them from melting the network. Right now, your only scalable transport option is TCP, which means you're boned if you want real-time.

Second, it provides reliable out-of-order delivery, which is exactly the happy medium that I assert without evidence 99% of UDP apps actually need. Reliability good. Enforced ordered delivery bad; means updates lag behind stale data.

The big issue with SCTP is that firewalls will block it.

<comment><USER3> I recently learned about SCTP because I had to write a SIGTRAN interface for work.

SCTP is interesting to me because it offers choice:

\- Do I want reliable or unreliable?

\- Do I want ordered or unordered?

\- Do I want multiple streams per connection?

\- Do I want multi homing?

And a few other benefits:

\- Resistant to SYN attacks

\- Proper shutdown procedure/no half open connections

IMHO, it IS the superior protocol. Obviously since its not widespread, it won't work too well for some things yet.

<comment><USER2> Meh. SYN floods are pretty much a solved problem. Try to take something behind an F5 offline, for the simplest example.

I agree that, on paper, it's a more useful protocol. Remember though that TCP is about the congestion control algorithm. The rest of what TCP does is trivial.

<comment><USER3> You're right, of course. They each have their uses. I still think SCTP has more potential though, but I'm not able to back that up, so whatever :-P

<comment><USER2> Not trying to shoot you down FWIW, just trying to dispel the myth of the TCP SYN flood. You'd be surprised how many otherwise very savvy clients ask us about them.

<comment><USER3> I'm actually not terribly familiar with how they work, so no worries! I'm happy to be corrected.

</comment></comment></comment></comment></comment></comment><comment><USER4> Not questioning the OP's intentions, but a remote vulnerability in most SCTP stacks was published last week: <http://pastebin.com/m6863ef05> CVE-2009-0065

<comment><USER2> This is a vulnerability in one SCTP stack. Linux's. I'm not sure there's a single mainstream protocol that hasn't had a vulnerability.

<comment><USER4> Its not every day you see remote code execution exploit of a _Transport_ layer protocol, and what OS do you think people are going to be toying around with SCTP... Linux. This is serious.

edit: needed to review the OSI model.

<comment><USER2> WTF do I care if the protocol you broke was transport layer or application layer? Code execution is code execution. What a strange argument.

<comment><USER5> Simply because a vulnerability in the transport layer results in every service relying on that protocol to be vulnerable? Are you saying that a remote code execution vulnerability in TCP would not be worse than one in for instance FTP?

(I am aware of your credentials so I'm trying to figure out what I'm missing, not trying to be snippy)

<comment><USER2> Ok. Fair point. TCP would be worse than FTP, because you could hit it from ports 21, 22, 80, and 443.

FTP would be far worse than SCTP, because you're much more likely to be using it.

I'll admit, my mind jumped immediately to "vulnerability in the kernel! much worse than vulnerability in a web server!", which is exactly the wrong way to think about the problem --- once you've conceded code execution to an attacker, you've conceded the box.

Maybe that wasn't his argument. Thanks for calling me out on that.

Either way, the Linux advisory he cited should have absolutely no impact on your consideration of SCTP.

</comment></comment></comment></comment></comment></comment><comment><USER6> "Since then, it has found its way into all major operating systems, including GNU/Linux, BSD, and Solaris. It's also available for the Microsoft® Windows® operating systems as a third-party commercial package."

I don't think that you can really exclude Windows from the category "major operating systems". It might not be your favorite operating system (it certainly isn't mine), but give the devil his due.

</comment><comment><USER7> What would be really cool would be a sctp option for vnc. When you're working on a poor connection, it's really annoying when vnc becomes blocked waiting for some rectangle to be retransmitted, when it could perfectly well keep going updating the other rectangles.

</comment><comment><USER8> Would it be ideal for HTTP to be delivered over SCTP instead of TCP? If so, how the heck can the internet migrate over to SCTP?

<comment><USER9> If nothing else, it's possible to tunnel tcp over sctp. But you could write a webserver that delivered HTTP messages over sctp directly. In fact that would make a good research project for someone. And it would likely be useful, if only for the sheer amount of stuff that uses HTTP as a transport. The thing is that as an asynchronous protocol HTTP doesn't get that much benefit from being delivered over sctp whereas protocols that depend on continuous session state like ssh or XMPP or VOIP streams would potentially gain much more.

<comment><USER10> I think it could be useful for a reverse proxy when talking with the backends. SCTP would be contained to your LAN traffic so adoption on the open internet & firewalls is a non-issue, and you get some benefits from avoiding head of line blocking. Possibly. Discuss below! :)</comment></comment></comment>


Ad blocker breaks webapp with HTML IDs containing "AD" - <AUTHOR> https://www.reddit.com/r/SampleSize/comments/6hdori/comment/diylrgj <comment><USER2> Flagged for misleading title. The actual text of the comment is this:

> _" AD6" which I looked up and Ad6 is an advertising network so perhaps that > was triggering content blockers_

It's much more reasonable for an ad-blocker to block "AD6" than "ad".

Either way, the problem is not the add-ons, but rather the fact that the web isn't safe or usable without them. I'd rather have an occasional broken page (which I can fix by disabling my ad-blocker) than not to use an ad-blocker at all.

</comment><comment><AUTHOR> Yeah, I myself use an adblocker because there is no other reasonable choice - but the poliferation of add-ons that can break pages that are not tested with them is concerning.</comment>


Bypassing Flash's local-with-filesystem Sandbox - <AUTHOR> http://xs-sniper.com/blog/2011/01/04/bypassing-flash%e2%80%99s-local-with-filesystem-sandbox/

<comment><USER2> Interesting - but reading this, this is when you open up a local .swf file - not one loaded over the internet - it would have to be downloaded and then re- opened.

The same could be said of any software you download and run - most have even less restrictions than flash.</comment>