Git is cheap - <AUTHOR> http://coderwall.com/p/wxowig

<comment><USER2> I strongly half-agree here.

 _Commit early_ , hell yeah!

 _Branch often_ , umm, no. I feel that the excellent branching features of modern DVCSes have made people lazy and afraid to confront the inherent concurrent nature of working in parallel with people on the same codebase. Sure, if you're a 200 person team, there might be no way around it some decent branching setup. But don't forget: _every feature branch means postponing continuous integration_.

Continuous integration is the _core_ of any productive and effective agile-ish team. Daily standups are nice, backlogs are lovely, but without continuous integration you can't get that design-develop-test cycle short enough to deploy/demo early and often.

Therefore, when working on a product or component with a limited team size (say, up to 15 people that are in close contact with one another), I believe that it is best to get your code on the mainline _as fast as possible_. Often, in git terms, the simplest way to do this is simply directly committing and pushing to master. Doing this helps signal conflicting concurrent work early, and it helps avoid double work. It encourages necessary but unforeseen design sessions _before_ the work is done, rather than refactoring sessions afterwards.

The only strong downside to super-fast continuous integration that I can see is the chance that you "break the build" (or the tests, or whatever your situation has that needs to be OK for developers to be able to add features). If the team is in close contact, this is typically fixed within minutes ("hey Mike, you broke xyz.cpp" "oh damn, sorry, i'm right on it"), and if it isn't, well, git has cherry-picking features for a reason! You can use the tools to avoid the broken code for a few hours until the guy who broke it is back from the hairdresser.

Sure, you can do good CI with feature branches, but people have to be disciplined, and push their feature branch with master very often. Like, multiple times per day. I've never seen that work in practice. This doesn't mean that it can't work in practice, but it does mean that "branch away, buddy!" may be bad general advice.

When committing straight to master, the danger is of course that people hold back pushing their commits over the line entirely, which is bad too, but I find that once the horrible, horrible "whoever breaks the build gets pie" rule is replaced by the "whoever pushes more than x changed files/lines at a time gets pie" rule turns that culture around just fine.

I'll be the first to admit that this might work less well with e.g. highly distributed teams in different timezones. But that's hardly the most common scenario.

Continuous integration is called that for a reason. If you do A-few-times-a- week-integration, then call it that. And in my opinion, you're missing out.

<comment><USER3> DVCS does not discourage Continuous Integration as long as the developer pushes remotely on a regular basis to their own branch and the CI server is setup so that it builds the known active branches.

I've been working on solving this problem over the last year. We added the ability to Bamboo (CI server by Atlassian) to detect new branches as they are created in the remote repository and automatically test the merge with master and optionally push the branch to master if everything is OK. If the merge or the tests fail, Bamboo lets you know immediately via email/XMPP/HipChat/etc.

Yes, it relies on developers being disciplined (read: responsible and professional) enough to push back to master in order to have the merge tested and the tests run.

Developers actually do it though because the benefits to having their feature branch tested regularly against master are huge: code is regularly merged and tested with master to ensure integration state and other team members are isolated from changes that can potentially damage development velocity.

Anyhow, if your interested in learning more, see my blog post called "Making Feature Branches effective with CI". I'd love more comments and thoughts if you have them.

[http://blogs.atlassian.com/2012/04/bamboofeature-branch- cont...](http://blogs.atlassian.com/2012/04/bamboofeature-branch-continuous- integration-hg-git/)

Disclaimer: I am product manager for Bamboo @ Atlassian

<comment><USER2> that looks really interesting, thanks!

<comment><USER3> No problems! If you have any questions, feel free to email me email@example.com

</comment></comment></comment></comment><comment><USER4> I absolutely agree with this. I recently started working on a small web app as a side project. I was dealing with a lot of elements that were new to me and was constantly pushing the limits of my knowledge and breaking things. I realized I wasn't using the power git provided me with branches.

Once I started branching things got quicker and more effective because I could bounce between tasks without affecting my deployment (master branch). In five days of frantic coding using git branching I now have a clean easy deployment of about 750 lines, which I iterated on through four different branches and, probably over 3000 lines of code.

It's not perfect, but it's eliminated any apprehension about aggressively changing my application, and made me far more ambitious. I feel great about it.

<comment><USER5> I've had a similar feeling of empowerment, although less structured. With hobby projects where sometimes I realize I was thinking all wrong about a certain solution, I'll just check in what I have and commence the deleting of large blocks. Occasionally I'll go back and find something that maybe was a good idea, but for the most part, having an excuse to part ways with bad ideas has alone been really great.

<comment><USER4> That's great, reducing the barrier to entry for new projects allows for more experimentation. More experimentation increases the likelihood you'll stumble upon something you really like!

What I meant to say more clearly is that I probably iterated through the creation of that web application so quickly because in five days I committed to git 75 times. In my time at Microsoft I don't know that I would have made 75 commits in a year, and creating new branches was very costly.

I got numbers on my git repository by using GitStats: <http://gitstats.sourceforge.net/>

</comment></comment></comment><comment><USER6> There is another good reason to break commits down into small "bricks" (as the author calls them) and that is bisect[1]. Up until very recently I only used a tiny fraction of the git toolbox, but when I was complaining to a friend about how an app I was working on deployed fine on one machine but not on another with the exact same configuration he told me to run bisect.

It took me a matter of minutes to zero in on the exact commit that broke the app on that one machine. This would have been something I would have spent hours, possibly days trying to figure out by going over every tiny config detail (it wasn't a config issue).

Bisect is a powerful little tool to have in your back pocket when you know something you introduced at _some time_ broke _something_ and you need to find out what. The smaller and more "relevant" you keep your commits, the easier it will be to use. Obviously the opposite is true, if you have these massive commits which change large amounts of different files and/or multiple features, bisect becomes significantly less useful, almost worthless.

[1] <http://git-scm.com/docs/git-bisect>

</comment><comment><USER7> As this is a positive article about git, if the OP reads this, I'd suggest using the word "inexpensive" next time. Cheap often has a negative connotation that something is low-cost at the expense of quality.

Just a pet peeve. Git is most certainly not cheaply made.

<comment><USER8> Yes, but the phrase "x is cheap" often means -- just use it. "x is inexpensive" doesn't have the same connotation. E.g. "memory is cheap"

</comment></comment><comment><USER9> Is there any best practice for a large team of 50 developers to work in Git? We have about 20 separate (almost completely separate) projects.

We currently have everything under one big SVN directory. I use git for personal stuff so it's always a pain to work in SVN.

<comment><USER10> In git, I would create a seperate repository for each project. No need to mix up history of several projects into one repsository.

<comment><USER11> That's possible to do in SVN as well.

</comment></comment></comment><comment><USER12> He compares it to SVN, but makes a classic error. In SVN branches and commits are just as cheap as in git (albeit marginally slower to create usually). It's the _merges_ that are expensive.

It's there that git wins, with it's better understanding of how content moves around, and the ability of the merge tool to see the history and identify the common ancestor.

<comment><USER10> Branching in SVN is not cheap. It basically has to copy the entire directory structure into a new subdirectory (branches directory).

In git, it just creates one file with a 40 byte hex.

<comment><USER12> Errr, no - while that's what you see in the directory tree, that's not how it's done internally. SVN has a data model where multiple paths in the repo tree can point to the same underlying file object, so a branch requires no file copies, just updating what the directory tree looks like. Even that is done in a very efficient way. It might not quite be 40 bytes, but it is negligibly small.

This technique is in fact extremely similar to how Git works.

</comment></comment></comment><comment><USER13> Sorry for going off-topic, but I tried to open this on iPhone and it never finished loading. It's 1.25 MB for one page of 3500 chars of text. Maybe the ratio of polish vs content is a bit too skewed here?

<comment><USER14> It's strange that coderwall doesn't seem to gzip their CSS nor JS files. It'd cut down their biggest file (~450k) to less than 50k.</comment></comment>


Coding Horror: Your Internet Driver's License - <AUTHOR> http://www.codinghorror.com/blog/2010/11/your-internet-drivers-license.html <comment><USER2> I am not sanguine on the idea, but the _marketing_ for the idea is beyond terrible. The IDL is a leaky abstraction because the most salient features of drivers licenses are a) you have to apply to the government to get one, b) the government can take yours away with as much ease as they can do anything else, and c) if you lose your license, you will be denied the ability to use one or more critical goods/services (driving).

That is what your mother thinks of when she hears Driver's License. _Why on earth_ would that be the branding you pick for OpenID or federated authentication? You are practically trolling your own idea at that point!

Observe the kinds of things people are going to say about any federated identity scheme which you call a License:

"Jeff Atwood thinks the government should be able to take away your Facebook account! He's fascist!" "I didn't say that!"

"Jeff Atwood thinks your mom shouldn't be allowed on the Internet until she stops calling it 'the Googles'! He's an elitist bastard!" "I didn't say that!"

"Jeff Atwood thinks that if you get kicked off a WoW server you should lose your Gmail account. He's in bed with corporate interests!" "I didn't say that!"

<comment><USER3> Perhaps a more accurate metaphore would be "Internet Passport". Government's can't take it away and it has no real entitlements. However Jeff Atwood is from the USA which has a strangley low number of passport holders. Perhaps they are used to using a driving licence instead of passport as general ID.

<comment><USER4> > However Jeff Atwood is from the USA which has a strangley low number of > passport holders.

It's not strangely low; Americans can travel to far more than the equivalent of the EU without one. (We can go to all 50 plus Canada and Mexico.)

<comment><USER5> I am under the impression that we can no longer go to Canada without a passport.

:(

Edit: Since June 2009.

<comment><USER6> You can't go to Mexico without a passport either. You can't come back without one, anyway.

The US Gov does now issue passport cards which are a form of national ID card that allows citizens back in at international LAND borders. You should ask for one when you apply for your passport; they're nice to carry in your pocket when you're abroad and the full passport is safely locked away.

</comment></comment></comment></comment></comment><comment><USER7> I was hoping this article would touch on the issues raised in the "Open ID is a nightmare" article - [http://blog.wekeroad.com/thoughts/open-id-is-a-party- that-ha...](http://blog.wekeroad.com/thoughts/open-id-is-a-party-that- happened) \- rather than restating the conceptual basis for using Open ID authentication systems

<comment><USER8> Or even _link_ to that article; it was clearly the motivation behind this post.

</comment></comment><comment><USER9> > _It always pained me greatly that every rinky-dink website on the entire > internet demanded that I create a special username and password just for > them. ... For the vast, silent majority of normals, who know nothing of > security but desire convenience above all, this means one thing: using the > same username and password over and over. And it's probably a simple > password, too._

> _This is the status quo of identity on the internet. It is deeply and > fundamentally broken._

What I do is, I have a couple of hard passwords that I use for email and Dropbox and important services like that, and then I have a couple of stupid usernames and passwords that I use and re-use and re-use for services whose security I don't care about. (I've arrived at this strategy after years of using the internet.)

A couple of times, I have actually tried to register an account with my usual username, found that the name was taken, wondered "Hmm, did I already create that account?", tried logging in with the usual password, and found that the login worked. "Oh, yeah, now I remember making that account..." I took this as a good sign, that I wasn't wasting brainspace on that login.

I think my strategy works fine for dealing with "a dozen websites who all want a username and password", given that only one or two of them are critical. And therefore I'd question the need to change, as opposed to people figuring out a strategy like mine and passing on the idea. Also, currently, anonymous throwaway accounts are easy to create; would it be that way if sites required something like OpenID? (I guess if the idea is just to reduce password complexity for customers, then sites could just add OpenID as a secondary means of logging in--rather than having it be the sole means--and you could still make throwaway accounts. Note that I don't know anything about OpenID; maybe there is a way to do anonymous throwaways within OpenID.)

<comment><USER10> I do this too. This system fails pretty badly when you encounter a site that insists on certain formats for their passwords. For example not allowing special characters.

Generally that's a red flag and I just don't use the site, but I don't always have that luxury. The service my company uses for performance evaluations has this limitation. Hmmm, a website I go to at most 3 times a year, requires a significantly complex password due to the site's nature, and yet won't let me use special characters making all my memorized "hard" passwords impossible? Yup, I have to request a new password everytime I visit it. Very annoying.

</comment></comment><comment><USER11> I miss the point why we really need some sort of "identity providers" when it's _we_ who possess _our own_ identities.

It's the login-password pairs which are inconvenient (and, a lot of time, insecure) part out there. So, logically, the straight answer seem to be to get rid of this part in favor of something more usable, users can possess to prove their identities. For example, improving browser support for public-key crypto and key storage (think HTML5 <keygen> element). However, world has gone in a completely different direction, created "identity providers", who now actually _possess_ users' identities (so you don't own your identity anymore), and, as a result, introduced more failure points to the auth process.

OpenID is neat and convenient when done right, but it was just a protocol invented to sign comments at other persons' blogs. It was never meant for personal identity management and architecturally lacks a lot of important points for that. XRIs may be considered some sort of solution for that (I-numbers are guaranteed to be persistent), but still feel somehow wrong.

<comment><USER12> > However, world has gone in a completely different direction, created > "identity providers"

That's because the question answered wasn't: "How do we solve the problem of user identity on the web?" The actual question answered was: "How do we solve the problem of user identity on the web _using web services_?" Once you define the problem that way, OpenID becomes the logical best solution. However, it's hardly the best way to do it in any general sense.

</comment></comment><comment><USER13> If I went to a party or a meetup where they asked to check my ID at the door I'd probably just walk out and never come back. I don't like parties run by the socially inept. Who asks their friends for an ID card?

I'm willing to show my ID at bars and airports, to cops, and when opening bank accounts, because it's the law. And at least most of these venues have excuses -- banks want to link large amounts of your money to your ID, so they need to make sure they've got it right; cars are deadly weapons; alcohol is a potentially deadly drug. (The airlines? They really love nontransferable tickets with big change fees. And security theater. And, uh, did we mention that it's the law?)

But in general nobody asks for your ID unless they have a good reason. And I just don't see a good reason why my as-yet-nonexistent Stack Overflow karma needs to be linked to any other aspect of my identity.

At least I have a straightforward answer to my question: No, the Stack Overflowers will not give me the simple username and password that I want. It's against their religion. Good to know. I'll ask again five years from now.

<comment><USER14> No need to log in; it is possible, and always has been possible, to participate as a cookie-based user indefinitely.

We have some users that juggle cookie based accounts for as long as a year. And as of about 6 months ago we can reinstate your cookie on the "forgot my login" form, provided you gave us a valid email address to start with (we don't validate emails).

</comment></comment><comment><USER15> Driver's License is the wrong metaphor for OpenID. If you had an Internet Driver's License, it would be your email address. You always have that with you at all times.

OpenID is more like a Von's Club card. An inconvenient scrap of plastic that would just take up space in my wallet so it gets left at home. Every time I go into a Vons, I have to ask the cashier for a new one and it pisses me off that little bit, just like every time I go to StackOverflow I need to dig though my email to figure out what OpenID provider I used to sign up for my account there.

Just like the Grocery Store Discount card, where I find myself more driving out of my way to go to a store that doesn't make me use one, I generally don't bother with sites that want me to dig out my OpenID just to use them.

<comment><USER16> Just curious: why use more than one OpenID account in the first place? I've genuinely never understood why people would do that. Am I missing something?

<comment><USER17> With all the little icons, I generally forget which one I clicked in the first place. Then I remember that I used Google's, but forget which email address. It's not so much forgetting because I have a bunch of OpenID accounts, it's that I don't use it enough to remember the one that I do use.

Just give me the "Save username and password" option in Firefox and I'm happy.

<comment><USER12> Have your saved username and passwords sync to the cloud, and you'll be even happier. Jeff is still beating a still-born horse here -- yes, a problem exists, but OpenID is the wrong solution.

</comment></comment></comment></comment><comment><USER18> If you want to have freedom then you have to accept that a free life is a messy life.

I don't support centralized internet ID systems for the same reasons I don't support a national identity card: it's a central point of control that will inevitably be used by the government against its citizens and corporations for profiling and targeting all of us.

As much as it may appeal to the tech mind to have things in nice little boxes this is a terrible and dangerous idea.

<comment><USER19> That's why, in theory, I like OpenID. It's decentralized, anyone can be a provider, and I still choose when logging into your site which provider you should use to validate my credentials.

</comment></comment><comment><USER20> I'm not sure he's talking about a _separate_ "Internet ID" that should exist. I think he's talking about websites adopting OpenID and/or OAuth as authentication methods, with a smaller number of trusted entities as authorities (Facebook, Twitter, Google, MyOpenID, Verisign, etc).

I'm not sure where people are getting this idea that he's talking about creating a new concept called an Internet Driver's License. He's just trying to encourage service providers to adopt OpenID/OAuth instead of traditional logins.

<comment><USER21> Oauth .. I just went to check it out, <http://alicious.com/img/OAuth_1290599253386.png>

Ironic.

</comment></comment><comment><USER22> IMO, A big danger of implementing centralized authentication across multiple sites is that will make social engineering schemes aimed at stealing a user's credentials more plausible and effective.

I know that systems such as OpenID and others perform authentication directly between the user and thetrusted provider (google, facebook, twitter, etc), and that the site ends up with a one-time token that confirms the user's identity. The site requesting authentication never gets the actual password to the openID account, which makes this approach viable in a technical security sense.

But here's the thing: _general users are getting used to entering their centralized credentials to perform actions on untrusted sites_. Technical users understand the design. We can confirm that, yes, TwitScoop does indeed direct us to twitter.com/oauth/... (no HTTPS, but that's another story).

Regular users posting a comment on a blog, though, don't see any difference between giving their credentials to a trusted Google login site and entering their credentials into some form on a blog.

If, for example, logging in with Facebook credentials becomes common, it would be trivial to create a rogue blog which collects login information. Fill it with a few incendiary posts, possibly create an official-looking Facebook login page that doesn't display its URL, and it would be possible to capture quite a few sets of credentials.

<comment><USER14> I think phishing is a more generalized problem; blaming OpenID or OAuth 2.0 for that is like blaming the weather.

</comment></comment><comment><USER23> Isn't one of the main benefits and best things about the internet is anonymity? Obviously FB and Twitter have information about my real identity, but why would Instapaper, or Reddit? Having a global login takes away that anonymity.

<comment><USER24> Anonymity (or pseudonymity) is fine, but it's not even in my top ten favourite things about the internet.

</comment></comment><comment><USER25> tl;dr: Jeff Atwood says websites should offer OpenID or OAuth authentication.

edit: ok, the sarcasm in this comment may justify it being downvoted, but can someone kindly explain what is being said in this article apart from: "having many logins/passwords for each site is not nice, we should all support OpenID/OAuth"? Because I really don't see any other piece of information.

<comment><USER26> Take this with a pinch of salt, because I didn't downvote your comment, but your comment doesn't add anything to the article. It's just noise and doesn't advance discussion.

<comment><USER25> Fair enough. I guess the merit of this article is to create the opportunity for this discussion.

Reminds me of someone (can't really find who now) who said a few months ago that HN is like going out for a movie and a dinner. The value of it isn't really the movie and the dinner, but the opportunity of discussions it creates.

So... yeah :)

</comment></comment></comment><comment><USER27> I have all my logins saved in Firefox and there's not one site I'm using where Firefox is able to autocomplete OpenID details, it forces me to enter my ID, leave the page, authenticate with OpenID, go back and submit. It needs to either die or get way more convenient than this.

</comment><comment><USER28> The problem is, a lot of the time I _don't want_ my various internet IDs linked together - I want something more like the coffee club loyalty card for each website I visit. I definitely don't want facebook knowing which sites I use (frankly I don't trust them enough) and I'm not too keen on Google knowing either.

The crucial difference between a drivers license and some kind of centralised internet ID is that anyone can verify a drivers licence with a reasonable degree of accuracy - they don't need to contact the government each time to see if it's genuine.

With an internet ID the provider gets to collect a lot of information about me and what I'm doing (not saying they would, just saying they could), which makes me nervous.

</comment><comment><USER29> I love the title "Internet Driver's License" - it's an analogy that I'm very fond of, but Open ID won't be the solution for this for the same reason the semantic web has never really gained any serious traction.

It takes private companies w/ consumer interests in mind to achieve that sort of global scale and user adoption. In this case, namely Facebook.

</comment><comment><USER30> I don't like the idea of having one identifier which can be used to tie together all information about me - because linked data provides an unwarranted amount of power to people who have access to it.

I think 'an internet drivers license' would basically become an ID card.

<comment><USER31> Your email address probably already links all of your online accounts.

Unlike an ID card you can have as many OpenID accounts as you wish – they can be freely created just as easily as email addresses. The solution is the same as for email: Give a different account to each site.

<comment><USER30> That's true - and the identifier token sent as verification can vary as well iirc.

</comment></comment></comment><comment><USER32> Isn't the point of asking you to provide some credentials for a new site usually so they can use that contact info to push products at you in the future? An internet driver's license (and OpenID) defeat those purposes.

</comment><comment><USER33> Wow, something from coding horror where he isn't trying to sell us something?

</comment><comment><USER34> You really have to be behind the times to still be advocating OpenID. Technology is made up of alternatives, and one wins. No matter how much you love something, if it's dead, it's dead, now move on.

Every hyped technological product has a a short window in which to dominate, and if it does not, it will remain confined to a nice. That's the case with OpenID. It's over, the battle is lost. Same goes for RSS, DRMed music, Django, etc.

The coding horror guys made a poor technological decision. Instead of just giving up, they are doubling down on it. That's not very clever.

<comment><USER35> Huh? I'm confused. I still log in to all sorts of places with my Google account, including Hacker News. And... RSS is dead? _Django_ is dead? I'm getting the sinking feeling that I'm being trolled right now, but...

Source?

<comment><USER36> Must be a new Slashdottism... The "BSD is dead" joke would, someday, get old...

</comment></comment></comment><comment><USER37> "The whole online identity situation may seem as impossible as peace in the Middle East at this point."

I hardly expect such comments from guys like Jeff.

</comment><comment><USER38> Something about using one set of credentials for a bunch of unrelated sites rubs me the wrong way.

I think it has something to do with what commenter Kevdog said:

> Here's where the driver license analogy breaks down: I have physical control > over my license, it stays with me. No one can lose my license for me.

<comment><USER31> You can be fully in control of your own OpenID if you want. Just host it on your own domain/server.

Or even easier: use delegation. Add some meta tags to the header of your blog (or any HTML page under your control), and sign up for sites using your blog URL as your OpenId.

See an example at my domain (the content is currently blank, but the meta tags are in the source code): <http://jmh.id.au>

I can sign up anywhere by typing in 'jmh.id.au', and it uses myopenid.com for login. If for some reason I didn't trust myopenid.com I can change providers by editing that page. So I'm not tied to any one provider.

<comment><USER2> I have multiple problems with this answer.

The first is practical: you are not qualified to run OpenID on your server. Really, you're not. I'm not and I have actually implemented both OpenID providers and Relying Parties for clients before, at the old day job. If you run OpenID, you are exposed to every threat your OpenID provider is currently vulnerable to _in perpetuity_ , unless you make it your mission in life to stay up to date on OpenID security. The people who actually _do_ that missed a timing attack which compromised the security of nearly every OpenID-using system on the Internet. You will _not_ do better than they did.

The second reason this is bad advice is because OpenID has a feature which should make it unnecessary: delegation, which lets you nominate any OpenID provider on the Internet as "your" provider. You are theoretically able to change that after having done it, so if you want to move your identity from Google to Yahoo you can. _Delegation is a misfeature_. It makes the OpenID spec roughly ten times more difficult to understand than it already was. Very few people implement delegation correctly -- of particular notice, very few _relying parties_ implement it correctly, which means that when you come back in a few years with the same OpenID but a different underlying provider they have _no recollection of you at all_. That is a pretty bad failure mode for a federated authentication system, and many relying parties coded by smart people walk straight into it.

Then we come to the real meat of the matter: for an authentication system to be useful, you have to be able to use it without being able to implement it. OpenID is a user experience _nightmare_ for non-technical users. Just the experience of actually logging in is bad enough. It also teaches your users to fall for phishing attacks against their holiest of holy credential, because every sane person uses OpenID through their email provider and OpenID teaches you that you can go to any random site, the screen is going to flash, and then you should type in your email address and password. This is phishing heaven, and losing one's email account means you lose practically your entire online identity (banks accounts, domain names, Google AdWords accounts, etc etc) even before OpenID explicitly makes your email king of all credentials.

<comment><USER39> I'm getting some cognitive dissonance here, since the grandparent says _[I] use delegation_ and you say not to run your own server and to use delegation...

Anyway, is delegation going to get better, or should I not bother setting it up and just stick to using the same password for all my non-interesting sites? In particular, is it the site I delegate to, or the site I am authenticating myself to, or both, that can screw it up?

<comment><USER31> Sorry, that confusion was my fault: I posted the first line of my reply, and then realised I should mention delegation, so I edited it in. He must have loaded the page between the two.</comment></comment></comment></comment></comment>


Reporting bias: A comparison of clinical trials and online product reviews [pdf] - <AUTHOR> https://www.gwern.net/docs/nootropics/2017-debarra.pdf <comment><AUTHOR> aka 'why does every herbal or homeopathic remedy seem to work when you ask just their fans'.</comment>


Is cybersecurity a good career choice right now? - <AUTHOR> Considering a career in the field. Would appreciate insights from those already in it. <comment><USER2> Hi! I was doing similar research a little while back and I thought this page was super helpful: [http://cyberseek.org/heatmap.html](http://cyberseek.org/heatmap.html)

Lots of info you can dig through based on location, job title, etc.

Btw, that course looks super interesting! Def something I wish I had a year ago when I was starting out.

</comment><comment><USER3> Having spent the last few years in a hybrid role ranging from security practitioner, to curriculum designer, and educator, I'd say that cybersecurity has the luxury of being both a challenging and enjoyable career field.

As far as 'good career choice', I can't accurately respond to that without knowing what a good career looks like for you. That being said, if we use # of openings + starting salary as metrics... it does look like a promising career. CSOOnline predict 3.5 million unfilled jobs in cyber by 2021 ([https://www.csoonline.com/article/3200024/security/cybersecu...](https://www.csoonline.com/article/3200024/security/cybersecurity- labor-crunch-to-hit-35-million-unfilled-jobs-by-2021.html)).

I'd recommend taking a look at [https://www.cyberdegrees.org](https://www.cyberdegrees.org) to figure out what roles interest you and the experience / certifications that will help you get there. Additionally, if you are looking for materials to read/learn/practice hands-on activities in security, I'll share the (constantly growing) list I've curated: [https://www.exeltek.net/accesscyber](https://www.exeltek.net/accesscyber).

Feel free to reach out with any specific questions you might have, and best of luck!</comment>


BTrDB: Time-series db in 4709 lines of Go doing 119M queries/second with 4 nodes - <AUTHOR> https://blog.acolyer.org/2016/05/04/btrdb-optimizing-storage-system-design-for-timeseries-processing/ <comment><AUTHOR> This entire blog is great reading material for technical papers: [https://blog.acolyer.org/](https://blog.acolyer.org/)</comment>


Your Software Is Priced Wrong - <AUTHOR> http://taprun.com/mistakes/ <comment><USER2> Another example of non freemium features that people will pay for is privacy: github is free to OSS projects, but there's a charge if you don't want your code to be public.</comment>


Joel Sposky's Take On Equity Allocation In A New Software Startup (2011) - <AUTHOR> http://money.stackexchange.com/a/26370/2250 <comment><USER2> Can a mod change the date? It's a repost of his original answer from 2011: [https://web.archive.org/web/20110416041922/http://answers.on...](https://web.archive.org/web/20110416041922/http://answers.onstartups.com/questions/6949/forming- a-new-software-startup-how-do-i-allocate-ownership-fairly/23326)

There's been a lot of discussion since, including [https://news.ycombinator.com/item?id=2445447](https://news.ycombinator.com/item?id=2445447) and [https://news.ycombinator.com/item?id=3489719](https://news.ycombinator.com/item?id=3489719).

Also, at the time, Dan Shapiro argued against it here: [http://www.quora.com/What-do-you-think-about-Joel- Spolskys-a...](http://www.quora.com/What-do-you-think-about-Joel-Spolskys- advice-to-split-equity-50-50?share=1)

I also think the share distribution Wizards of the Coast (Pokemon, Magic the Gathering) accidentally used was interesting: founders had no shares, and worked their way up into the single digits, which supported small, individual investors, but it's probably not recommended if you're planning for traditional investment: [http://www.peteradkison.com/blog-entry-2-wizards-of- the-coas...](http://www.peteradkison.com/blog-entry-2-wizards-of-the-coast- equity-distributions-part-1/) and [http://www.peteradkison.com/blog- entry-3-wizards-of-the-coas...](http://www.peteradkison.com/blog- entry-3-wizards-of-the-coast-equity-distributions-part-2/)

<comment><USER3> The "if you're going to argue yourselves to death, do it now" advice seems incomplete to me. It presumes a model where a team is either going to argue itself to death or not; the outcome is predestined, and so it's better to know early. But reality as I've experienced it is that arguments degrade teams (and relationships of all sorts). A team that might have survived can be killed by inviting a pointless argument.

A team has a capacity for arguments that depletes over time as arguments exhaust the team members. Arguments happening in rapid succession set up a vicious cycle, because there's a migraine aura of bad communications surrounding any big argument, and difficult decisions that happen in that aura spark needless new arguments. Lots of arguments also carry a potential for resentment, which creates a longer-term communication problem which sometimes insidiously builds as the company runs.

The "trial arguments" theory that Quora comment suggests seems to me a little like those parents who throw "chicken pox parties". It's probably fine and maybe even pragmatic, but it's a risk.

<comment><USER4> Off topic: Given the existence of a chicken pox vaccine. A chicken pox party is not even pragmatic. :)

</comment></comment></comment><comment><USER5> "Don't resolve these problems with shares. Instead, just keep a ledger of how much you paid each of the founders, and if someone goes without salary, give them an IOU."

The IOU solution is not a good one:

1\. Not taking salary when a startup starts is basically a very risky loan. An IOU simply doesn't take into account the risk involved.

2\. This is not symmetrical to how investors are treated. In both cases there is an investment in the company which can be measured in terms of dollars. In the case of the employee he is only getting an IOU, but in the case of the investor, he is getting shares. I don't see any reason why these should be treated differently.

<comment><USER3> So don't use a dollar-for-dollar IOU. You can pay interest.

What you're trying to avoid is bringing company valuation into totally mundane cash flow problems like "who pays for plane tickets to first customer meeting".

It's a sign of very bad founding team cohesion when the founders look at each other as negotiating adversaries. Founders should prefer solutions that have a quick and intuitive sense of fairness over technical solutions that attempt to ensure fairness.

<comment><USER6> Honest question, what happens to IOU's when the company fails? E.g. in the described scenario, one founder takes a salary and the other takes IOU's (+ 5% interest). The founder with the salary took less risk but still received 50% of the shares (even though they are worth zero when the company failed).

<comment><USER3> They're zeroed out.

<comment><USER7> Perhaps more specifically, in a liquidation the IOU-holder is a creditor in line behind others (but ahead of common stock-holder)

</comment></comment></comment></comment></comment><comment><USER3> The most important bit of advice in this post pertains to vesting. If you do nothing else Spolsky advises, make damn sure you pay attention regarding vesting.

</comment><comment><USER8> My startup does not fit well with Joel's model of employee layered risk. I've bootstrapped early and every layer the last 3 years got payed a normal, market salary, and on time every month. We also payed bonuses and the CTO even drives a company car from day one. Almost everyone was hired either straight out of college or was unemployed, although that was not intentional but probably my subconscious deflecting the extra pressure of being responsible for screwing up someone's career. Now I'm boarding our first investor and we're planning what our option pool will look like. I feel nobody but myself took any considerable risk coming to work here, and whenever there were troubled waters, my compensation was the only one that suffered.

I finally decided I favor giving stock as bonuses based on individual merit, as a payback for any extra effort and dedication in the past and as a motivational tool in the future. Unlike Joel, I'm reluctant to see employee risk-taking as relevant or even measurable or fair, and I wonder if that is really the case at other startups. I mean, can one say their new hires are actually assuming uncompensated risk, beyond the reasonable risk anyone assumes switching jobs, as to be entitled to equity mainly for that reason.

Employee risk seems like an oxymoron to me.

<comment><USER9> If you were profitable when paying that company car and those salaries, and your cash flow was secure in that you either had a lot of clients or long terms contracts, then yeah I agree your employees did take on zero risk.

If you were profitable from day one, I assume you run a services business?

<comment><USER8> It's a product business bootstrapped with consulting.

If we were not profitable, we would not be able to hire them or pay salaries etc. so most of them would probably leave or sue. The resillient ones that stay behind would be given IOUs. I don't see much risk taking, unless you're really working for future pay that may never come, which may be the case for employee 1, 2, 3, but I doubt that's the case for layers and layers of new hires.

</comment></comment></comment><comment><USER10> Interesting bit about diluting shares when new investment comes in. Joel's answer is very simple and seems extremely fair.

How common is this straightforward approach, where everyone is diluted in the same ratio of existing shares to new shares? I'd be interested in hearing about experience/knowledge other people may have had here.

<comment><USER3> Not super common in my experience; typical equity schemes are both much fussier and way more opaque.

</comment></comment><comment><USER11> Can someone explain to me why being hired in a later round of hiring is really that much less risk? It sounds right on the surface, but is that really the case in practice? Not in my experience.

I've never known startups to be steady long-term job providers. Seems like most live on the edge, always with not more than 3 months cash in the bank. Even when you get a big round of funding and hire more people, the investors want to use that money even faster than your last round.

<comment><USER12> 1\. Investors see it that way when they participate in later rounds at higher valuations. When you disconnect from "market" it creates serious problems.

2\. Skills risk, being at the top of your profession globally requires constant focus and professional support. The atmosphere at a very small company is hostile to this level of focus by necessity. It has a dulling effect.

<comment><USER11> Your second point is something I hadn't thought of, thanks!

</comment></comment></comment><comment><USER13> Open question: how do you look at the equity where one of the co-founders (Founder A) does not have to work for X number of years, since they've cashed out of another company. They have the capacity to work full time, whereas the other "co-founder" (Founder B) is only able to work part-time. Founder A has the means to not work for a lengthy period of time. While they're taking on an opportunity cost, is their risk viewed the same as some other guy that quits his job (kills his income) and maxes out his credit cards?

EDIT: According to Spolsky in his hypothetical situation, Founder B was not a co-founder because he kept his job. Founder A, OTOH was essentially unemployed and took on all the risk, and therefore was a "legitimate" founder.

</comment><comment><USER14> TL;DR equal shares in the same layers and vesting are the big points.

For the top layer: the real nature of a person comes out when they have a perceived opportunity to win big at someone's expense... hence good friends can make good cofounders. Failing that, find someone that plays well with others and considers the long-game of their actions. (You're gonna stick together for the next venture if this app doesn't work out, right?)

For the second layer: should be people you'd like to work with that may be founders in the future or people that have been recommended.

Third layer are more/less startup employees. So not regular corporate like employees that need to be thought for or are super niche, but T-shaped folks that can take initiative and worry a little more about details.

</comment><comment><USER15> Honest question - wouldn't a large stack of IOUs (say, 200k) tend to cause problems in the next investment deal? Wouldn't most investors demand to wipe that out before they are putting money in?

<comment><USER3> Maybe (I've had friends who tried to negotiated deferred salary into A-rounds). But there's also no rule saying that the IOU has to be paid back at the A-around.

</comment></comment><comment><USER16> This sounds like very bad advice for tax consequences. Is an IOU tax deductible? Does one declare IOUs in an 83b election?

Beyond tax implications and VCs, the IOU system strikes me as particularly terrible advice. In what realm is it reasonable to simply ignore hard interpersonal problems until they go away? If some group of people can't quickly come to an equitable arrangement for the division of equity, they shouldn't form a business. After all, founder breakups are a leading cause of failure.

<comment><USER3> No, one doesn't declare IOUs on an 83b election, because the 83b is about up- front valuation of equity, not about loans.

Different loans have different tax implications. If the "IOU" you're taking is a deferred salary arrangement, and you are eventually paid a year's salary as a lump sum, that will obviously be taxed as income. If you're paid back a loan you made to fund operational expenses, and the loan carried no interest, the tax implications are likely to be minimal.

In any case, if your equity is worth anything, you're working with an accountant. Actually: if there's money changing hands in any direction, you're working with an accountant.

An IOU doesn't "ignore hard interpersonal problems". It's one of several _resolutions_ to those problems. Your last sentence can be true without IOUs being unreasonable.

</comment></comment><comment><USER17> I really like the fairness and simplicity of this system. The resolution for not taking a salary could be made fairer by adding interest to the IOU (eg: 5%).

</comment><comment><USER18> 50/50 splits can be a terrible idea. If you're stuck with an unreasonable partner, the company can be deadlocked at every decision.

<comment><USER19> If you're stuck with an unreasonable partner, the company will fail anyway, so I don't think deadlock will be a problem here. :-)

Also, the moment you have investors, the person's shares go below 50% and deadlock goes away.

</comment></comment><comment><USER20> "Now that we have a fair system set out," I had to laugh at that line. Our IT startup model is the poster child for the inequality that defines our age. Founders own 50%, everyone else should be happy on the crumbs.... There's got to be a better way. Hang on, there is. It's called the partnership model, from the Law Industry. If you work really hard, you can become a joint owner (no matter when you start), and share in the profits. When you leave, you get nothing. That model is fair!

<comment><USER3> It's fair for law firms. It's not fair for product companies:

(a) It only works when employees have control over revenue; the partner model disenfranchises important company roles that happen to be distant from revenues.

(b) It rewards the best salespeople and punishes people who prefer less business-facing and more technical-facing work.

(c) It works for investments/companies who are valued on continuing revenues from services, but breaks down totally when the company is valued based on forward revenues, which almost every software firm is.

(d) It creates an up-or-out model in which it is almost axiomatic that team members who fail to make partner will leave; in other words, it creates teams comprised of short-timers led by an aristocracy of long-term strivers. It also begs for churn and selects for ladder-climbers.

Even lawyers don't like the biglaw partner model. It does work, but know what you're getting into.

(I co-manage a consultancy that is larger than most YC companies).

</comment></comment><comment><USER21> Umm that's a whole bunch of pulling numbers out of thin air. The 50-10-10-10-10-10 progression is proportionate to what exactly? The article would sound just the same if he recommended 75-5-5-5-5-5 or 40-30-20-10 instead.

<comment><USER3> This would be a trenchant criticism if Spolsky hadn't addressed it directly: 75-5-5-5-5-5-5 or 77-3-1-4-1-5-9, it doesn't matter as long as everyone agrees that it makes sense.

<comment><USER21> Yeah, it's quite symptomatic of pulling numbers out of thin air to then claim a large amount of imprecision. No system that nonchalantly allows say, a six- fold variation for the first employee can be said to be absolutely fair and correct. And "it doesn't matter as long as everyone agrees that it makes sense" just begs the question.

<comment><USER3> No, it does not beg the question, because the question Spolsky is answering is practical, not epistemological. He's describing the best, simplest _structure_ for equity allocation. He didn't give you a magic calculator.

<comment><USER21> Well, you know, you're working in the kitchen and I'm waiting tables. Last night's tips were $100 and I have a perfectly fair system for dividing them. I get $50, here's $40 for you, and I'll give $10 to the busboy. Or maybe it's $80 for me, $20 for you, and screw the busboy. It doesn't really matter as long as everyone agrees and it makes sense. But my system is really fair, you know.

<comment><USER3> This would be wittier if dividing tips was anything at all like allocating equity; in reality, the only thing the two problems share is arithmetic operators.

<comment><USER21> Blunt contradiction does not really make an argument. If you had something more precise to say than "give less equity to people who joined later" \- now that would be interesting.

<comment><USER3> Well, in comparing tip splits to equity allocation, I observe that only one of those activities involves predicting the future.</comment></comment></comment></comment></comment></comment></comment></comment>


The story of Radar, a location based classifieds born out of a hackathon. - <AUTHOR> http://radar-app.posterous.com/hello-world-this-is-radar-your-friendly-neigh

<comment><AUTHOR> Hello HN! I am nubela, the dev for the app. Just wanted to share my publishing of a simple location-based classifieds app, and also would love to have a discussion about my ongoing startup.

A little bit about the software stack about Radar if you are into geek porn like these. It is a Phonegap app, with SHPAML and SASS, and a little file watcher that I wrote (<https://github.com/nubela/transcompiler-watcher>). This massively speeded up my web dev for Phonegap.

My backend was a written in Flask (Python Microframework), with a MySQL DB, ORMed by SQLAlchemy,

The app interfaces with the backend via a ReSTful interface (Not so restful for my first try, took this attempt to learn about ReST).

AMA! :)</comment>


Why Stephen Hawking is more afraid of capitalism than robots - <AUTHOR> http://www.vox.com/2016/2/27/11119804/stephen-hawking-robots <comment><USER2> Ideal Scenario--

People win:

The constitution and the tax laws are changed to promote redistribution.

Capitalists Win:

Things continue as they are.

Most likely Scenario--

Regional and Civil Wars are fought over the extreme income inequality.

People Win: Laws and the constitution are subjected to root and branch reform. Capitalists are thrown in jail or executed.

Capitalists win: A world wide totalitarian government set up by the capitalists.

Most dystopian scenario--

People Win: The common folk won't care about the 8th amendment to the US constitution when dealing with the Capitalists.

Capitalists Win: capitalists will use weapons of mass destruction or mass extermination against the commoners.

</comment><comment><USER3> Today when people say capitalism they usually mean corporatism.</comment>


Ask HN: 3 NL tech guys in SF, meetup? - <AUTHOR>

Subject:Ask HN: 3 NL tech guys in SF, meetup?
Hi, we're 3 guys from The Netherlands visiting the USA, we're now in Bay Area/SF (with an RV, see http://3guys1rv.com/ for our latest pictures ).
Is anyone interesting to meetup with one (or more) of us?
Remy (31): hardware developer for Plugwise (Dutch startup in smart energy and sensor networks)
Martin (32): freelance hardware developer and industrial design engineer. Worked on projects for various Silicon Valley hardware startups.
Me/Benjamin (28): independent software developer/hacker, phone: mainly Android, web: mainly security & some HTML5/JS, prog: mainly C#/PHP, always learning, currently working on a web app with my brother to easily sign documents (we know the already existing solutions)
We're always willing to share ideas & give (free) advise! <comment><AUTHOR> BTW Today I (Benjamin) can be found at some App World events.</comment>


Internal documents show how Amazon scrambled to fix Prime Day glitches - <AUTHOR> https://www.cnbc.com/2018/07/19/amazon-internal-documents-what-caused-prime-day-crash-company-scramble.html <comment><USER2>
        Sable is used by 400 teams across Amazon and handled a total of 5.623 trillion service requests,
        or 63.5 million requests per second, during last year's Prime Day, according to an internal document.

Incredible figures!</comment>


Bitcoin Target Price: $23,809.52 - <AUTHOR> https://medium.com/i-m-h-o/468e11b9f95

<comment><USER2> It reminded me of one of the mistakes Guy Kawasaki said here [http://www.youtube.com/watch?v=HHjgK6p4nrw](http://www.youtube.com/watch?v=HHjgK6p4nrw) about linear thinking in valuations.

Not that I disagree with the post. I could only verify those figures in the future.

</comment><comment><USER3> Indeed he's not an economist (not am I). GDP is not highly correlated to money supply, and the value of bitcoin will largely depend on how it is implemented in that 1% of transaction. If bitcoin is used as a transactional currency, there is much less value than if it is used as a value store.

</comment><comment><USER4> The story doesn't render as readable on mobile- just a pic that doesn't scroll. Could someone paste it in comments maybe?

<comment><USER2> His model:

A = World's GDP = 50$ Trillion USD

B = % of world transactions reached with BTC = 1 % BTC/USD

C = Total BTC = 21 Million BTC

A*B/C = 23,809 $

D = Chance of this happening = 10%

"So a BTC price of roughly $2,400 wouldn't be a crazy price today."

</comment></comment><comment><USER5> Isn't his math incorrect at the 10% value?

He solves for $2,3809.52, shouldn't it be $238,095.20?</comment>


Why the "Open Data Movement" is a Joke - <AUTHOR> http://tomslee.net/2012/05/why-the-open-data-movement-is-a-joke.html <comment><USER2> If you're purely interested in holding government accountable for their actions, I can see why you might write this. A lot of the open data released has been things that will benefit entities other than political campaign groups.

Consider data on train positions in the UK. It's been locked up in various ways for a long time, or at least with restrictions that amount to non- commercial usage. So what you ask? Providing a live train-times service from the data costs money: I've been told it's upwards of 500 messages/second and there's a lot of problems you have to work around.

Releasing the data behind it is starting to help people to find cheaper tickets, make a more truthful record of train punctuality than official figures, etc. Many companies will benefit financially from this (rather than the current monopoly) but _the public will benefit_.

There are cases where accountability is at least starting to be possible. Last year I helped a newspaper look at published NHS data for things buried under the carpet - think hospitals that are failing to treat certain age groups for conditions like Diabetes. That's accountability. The UK pupil database is similarly promising.

Things need to get better but it's not as bad everywhere as the author claims of Canada or the USA.

<comment><USER3> >Consider data on train positions in the UK. It's been locked up in various ways for a long time, or at least with restrictions that amount to non- commercial usage. So what you ask? Providing a live train-times service from the data costs money: I've been told it's upwards of 500 messages/second and there's a lot of problems you have to work around.

>Releasing the data behind it is starting to help people to find cheaper tickets, make a more truthful record of train punctuality than official figures, etc. Many companies will benefit financially from this (rather than the current monopoly) but the public will benefit.

That's the point of the entire post. If someone's making money off of the data, then they should pay for it. Taxpayers shouldn't be funding the release of the data just so companies can charge them to access it.

<comment><USER4> They already paid for it. The service is value added, which the taxpayer didn't pay for.

</comment></comment></comment><comment><USER5> This is balderdash and largely character assassination.

The author's post contains essentially two points:

\- "Open Data hasn't resulted in 100% government transparency"

\- "There are corporate influences in the open data movement, therefor the open data movement are just corporate sockpuppets"

These two points are ridiculous on their face.

Movements are things that take time. They are a process. They require citizen engagement, advocacy, and political pressure. The fact that the open data movement hasn't radically altered the way that politics are done in Canada (or the location of your choosing) does not mean that progress is not being made, or that we shouldn't stop demanding better data and better accountability.

Second, if one is to write off any movement with a corporate interest, we may as well give up on the open source software movement. That a company like O'Reilly views open data as worth their time and attention does not mean that they wield undue influence over the subject material of what it is that people work on or wish to achieve. I would _love_ to hear any accounts of O'Reilly or ESRI or Microsoft or Omidyar killing or interfering with projects because they disagree with them.

The notion that open data is some how tainted by corporate touches is also so freaking frustrating because there already _are_ businesses built around open data that everyone uses.

Is government weather data somehow suspect because the Weather Channel has built a business around it? Should we block someone from building a business like the Weather Channel on government data? If so why? It's freaking open data, it's not like the Weather Channel controls it.

</comment><comment><USER6> Having been involved with several open government initiatives in the past five years, both as a consumer and as a consultant to municipal governments trying to to take positive action. I can understand the frustration and anger that such initiatives can provoke. And how it's almost worse when an initiative almost completes it's aim but is perverted by incidental contact with some outside agenda.

That said, any politician who attempts to rig the national census is an idiot. Yes it may win your party momentary advantage this year, but at the cost of causing the government to abandon the reality principle altogether. I'd go so far as to say that doing away with accurate data gathering and attempting to suborn demographic statistics to meet political goals is a pathological symptom of the Beige Fascism [1] failure mode of representative democracy.

1\. See Charles Stross's excellent summary of the issue [http://www.antipope.org/charlie/blog- static/2013/02/politica...](http://www.antipope.org/charlie/blog- static/2013/02/political-failure-modes-and-th.html)

</comment><comment><USER7> I'm not sure what the point of this article is. There's nothing wrong with governments providing their data in standardized machine readable formats. This makes it easier for groups of informed citizens, hackers looking for a side project, and non profits like CFA to process and visualize this data. They then can create tools to make it easier for citizens to see and understand what is going on 'under the hood'.

It's ludicrous that governments should keep the data about what they are doing with our taxes locked inside proprietary enterprise databases. Oftentimes, the only information available is a small subset or overview released once a year as a PDF. Anything more usable and parseable is a big improvement on this.

It's true, governments will start by only releasing things that make them look good (or at least not bad). But this is not the end goal. Eventually the stuff that they don't release becomes glaringly obvious and people start asking why.

The author has what sound like some valid complaints about the Canadian government. But somehow he thinks it's logical to conflate these issues with the entire open data movement. I don't get it.

For example, politicians will sometimes justify bad laws by claiming that they are 'for the children'. This article is the equivalent of complaining about these laws by saying 'children are a joke'. Nice straw man.

</comment><comment><USER8> I can see both sides of this argument.

We should all note, however, that when the establishment appropriates the language of the upstarts and insurgents the aim is often to disenfranchise the movement while paying lip service to that movement's original aims.

How to counter this? Not a simple question. That said, once government promises "open data" or "open government" it might be time to think up a new (more pressing) demand with a new slogan to boot.

</comment><comment><USER9> Crooked Timber put together a series of essay about open data last summer discussing these issues in more depth (including one by Aaron Swartz):

<http://crookedtimber.org/2012/07/17/open-data-seminar-2/>

</comment><comment><USER10> What does open data have to do with small government? What does the Liberal government firing Canadian scientists in 2004 have to do with open data? What does the Canadian Association of Journalists have to do with open data?

Content-free political spew makes me sad. This doesn't belong on HN.</comment>


Search Engine Hacker News Has Been Asking For - <AUTHOR> https://www.runnaroo.com/blog/the-search-engine-hacker-news-has-been-asking-for <comment><AUTHOR> I launched Runnaroo here through a Show HN a couple months back [0].

Since the frequent conversations on HN around search improvements always resonated with me and were such a large influence on many of the choices with the project, I just wanted to share a blog post on the topic.

Hope you find it useful!

[0] [https://news.ycombinator.com/item?id=22422604](https://news.ycombinator.com/item?id=22422604)</comment>


Uber introduces surge pricing in downtown Sydney during hostage siege - <AUTHOR> http://mashable.com/2014/12/14/uber-sydney-surge-pricing/ <comment><USER2> I'm all in favor of price surging and all that, but it saddens me that Uber spends so little time thinking about PR. Particularly, there's an obvious fix that will probably win them a lot of support: during surges, only charge the 20% fee on the base price. That way they can very justifiably claim to be earning no profit from surge incidents and are increasing fares solely to create enough availability.

<comment><USER3> It is better for Uber to be as honest as possible about their practices. This gives everyone else the greatest insight into the corporation and allows us to form more accurate opinions about their practices and to decide whether or not to support them.

A company hiding their intentions through obfuscated PR techniques is detestable. It also does not appear to be a great long-term strategy. Look at Comcast, they love to play the PR games and they are almost universally reviled because of it.

People will support honest organizations that are improving things. Trying to wrap fundamentally flawed systems in the pretense of nobility is a silly game to play and many are tiring of it.

</comment></comment><comment><USER4> How is this bad for anything except Uber's public image? If prices remained the same, cars would be unavailable. If you want that outcome, then simply don't order a ride. There's absolutely nothing wrong with surge pricing when there's an actual spike in demand - the alternative would have been not getting a ride at all which you can still do with surge pricing. This problem is exactly what happens with traditional taxis - you simply can't get where you want to not matter how important it is. This was meant to be one of Uber's strengths - greater availability. Now that gave us a little, we expect charity from them too?

</comment><comment><USER5> Dispappointing to see this post on hacker news. Most of the people getting angry at uber don't even understand how their system works.

Some random guy shared a screenshot of a 4x surge on uber black and now the media is saying "uber making $100 off fares in a hostage situation!". So silly.

<comment><USER6> A lot of other industries have regulation in place to stop price gouging during emergencies, such as this one. I'm all for Uber raising prices at 1am on a Sunday morning, due to supply/demand -- that's fine! But during an emergency, people find it icky that a business would take "advantage" of it like that. I initally thought it was just an algorithm, which doesn't excuse it entirely but is more understandable, but from Uber's tweets it seems they were aware and OK with jacking prices up that high despite the fact they _knew_ it was an emergency.

tl;dr -- Taxis aren't going to jack prices up 4x in an emergency, because it's illegal, and that's a good thing. Uber made a misstep here, and I've in favour of Uber normally (and finding the media backlash against them lately fascinating). It's a good thing they've gone back and reversed their position, this is an emergency and peoples safety is more importantly than a multinational company's profits, according to society.

</comment></comment><comment><USER7> Marketing bullshit. Really not that hard to get out of "downtown Sydney". Took me 2 minutes this morning to get out of walk out of the Sydney CBD to a relatively safe zone.

<comment><USER8> People are acting like there's a hurricane. Trains still run. Why are people entitled to a black car?

</comment></comment><comment><USER9> Right now, everything is fine on the train system. Go to Town Hall and you'll be fine.

</comment><comment><USER6> I always assumed it's an algorithm, not a conscious human flipping a switch.

<comment><USER10> Unfortunately, appears not:

[https://twitter.com/Uber_Sydney/status/544319760809222144](https://twitter.com/Uber_Sydney/status/544319760809222144)

"We are all concerned with events in CBD. Fares have increased to encourage more drivers to come online & pick up passengers in the area."

<comment><USER10> And it looks like now they've about-faced:

[https://twitter.com/Uber_Sydney/status/544329935943237632](https://twitter.com/Uber_Sydney/status/544329935943237632)

"Uber Sydney trips from CBD will be free for riders. Higher rates are still in place to encourage drivers to get into the CBD."

<comment><USER11> The problem with Uber is that the right thing to do never seems to occur to them naturally.

It's an issue that will continue to hound them until they take active steps to change their thinking.

</comment></comment></comment></comment><comment><USER12> This is simple supply->demand. Hotels do the same thing when there is a big event in town.

<comment><USER3> Is it really 'simple' supply & demand? From Uber's Tweets it sounds like they actively alter the prices. Does Uber actually offer a truly fluid, lasseiz- faire market?</comment></comment>


Python for JavaScript Programmers - <AUTHOR> http://hg.toolness.com/python-for-js-programmers/raw-file/tip/PythonForJsProgrammers.html

<comment><USER2> still prefer javascript... I just cant get into Phython for some reason</comment>


Portugal Gives Itself a Clean-Energy Makeover - <AUTHOR> http://www.nytimes.com/2010/08/10/science/earth/10portugal.html?hp=&pagewanted=all

<comment><USER2> Being Portuguese, I applaud this, but as the article said, lets not forget about the environmental (and local social) damage it creates. A lot of small shops that based their business alongside the rivers are now closed. Many fisherman that fished at those rivers can't anymore. Job creating has been close to none, and in a country where many people live near poverty (minimum wage is 500 euros a month, in Porto (second largest city), the average wage is about 700), high energy (home and car gas) costs are a big deal to many.

But hey, still happy we are doing it, just hoped it would create more wealth to the 'little' people as well.

<comment><USER3> I can't quantify but in my home town, Moura, it had a good impact in local economy. They built there one solar plant with 46 MW capacity which was at the time the biggest in the world. ([http://translate.google.pt/translate?u=http://economia.publi...](http://translate.google.pt/translate?u=http://economia.publico.pt/Noticia/maior- central-fotovoltaica-comecou-hoje-a- funcionar_1354423&sl=pt&tl=en&hl=&ie=UTF-8)) They also built a fotovoltaic pannels factory for constructing the solar plant and which now exports pannels.

Considering how bad every economic aspect goes there it was really a blessing. The jobs it created, qualified or non-qualified; the population it brought (desertification is one of the worst problems there). And they really deserve it, right now it might be 45ºC there. I work in Lisbon and when I occasionally go there in the weekend I can barely do anything(hint: fresh beer tastes like gold there!).

Regarding the cons, the fotovoltaic power doesn't have an environmental impact as bad as the dams. I guess the only one could be the visual impact. It even creates the possibiility to cultivate new cultures behind the solar pannels.

But, and there is always a but, there is much controversy about the solar power. The thing is that you can't store electricity, and as the production hours depend on the sunlight you will have a period of abundance and a period of scarcity that will not adjust very well. This will lead to an unbalanced match of supply and offer and so the efficiency of solar power is lower than other energies (a similar thing applies to wind power) like the hydropower where you can control when you want to generate it.

It makes me really proud to see so many good references to Portugal here in HN, for a country that is in such a bad shape it's good to see some things might change in the future.

<comment><USER4> The problem of storing energy is true for many renewable energies but there is work being done to solve it too.

An example for solar power is the use of special salty compounds that maintain the temperature for much longer (though I'd imagine at the cost of taking longer to reach high temperatures, i.e. they have a very high heat capacity) and hence provide a more constant output.

Another one is to connect one of these to an hydroelectric plant: any spare electricity is used to pump water up the dam.

Finally solar power has the advantage that it's plentiful during the day and especially in the summer which is when the electric demand is highest.

In the end solar power alone won't solve anything, but bundled with other renewable and with gas/nuclear to provide a steady baseline it should be fine.

<comment><USER3> In this case they do it, like 10 kilometers from the solar plant is the dam that created the biggest artificial lake in Europe. The dam is prepared to do that as it has a smaller dam after it.

The biggest controversy here in Portugal is if we have reached the limit of util unstable renewable energy, and how much/longer it should subsidized. And also the need of nucler energy.

</comment></comment></comment></comment><comment><USER5> _Nearly 45 percent of the electricity in Portugal's grid will come from renewable sources this year, up from 17 percent just five years ago._

Very impressive makeover, indeed.

</comment><comment><USER6> i'm proud of mother nation :)</comment>


App Store Heresies: Higher Price, Better Ratings. Don't Discount Your App. - <AUTHOR> http://www.mobileorchard.com/app-store-heresies-higher-price-better-ratings-dont-discount-your-app-at-launch/

<comment><USER2> I have a theory, not specific to the app store, that there is a strong correlation between customers who are extraordinarily price sensitive and pathological customers. This is based on every software vendor I've ever spoken to saying "After we increased our prices, we dealt with a lot less crazy people -- what's up with that?"

Anecdotally, when I increased prices by 20%, I noticed a marked change in the number of... customers with unique understandings of the world. For example: "I think Bingo Card Creator should print holiday cards. Except, not on my printer, on your printer. And you should mail them for me. What do you mean you don't do that, YOU THIEF, don't make me call my husband on you." (You _will_ run into this customer eventually. A refund and apology is the quickest way to preserve your sanity.)

Specific to the App Store, I think that Apple is _training_ their customers to become pathological customers. From the perspective of the small software developer, "The cost of this app is less than my information search cost, so I'll just buy this app to see if it does what I want rather than reading about it. Bought. It doesn't do what I want?! SUCKS! YOU FREAKING THIEVES!!!1 ONE STARZ!" is just about the worst possible reaction a customer can have to you. The App Store is training people to think of their software in that sort of disposable fashion, but that means you're entrusting your corporate reputation to a lot of people who have one-click access to LOLZ LAAAAAAAME.

<comment><USER3> I think this really touches on something that Marco had mentioned in his blog as well about the dichotomy of the app store. We all know people who have Iphones and literally refuse to buy any apps that cost money, even ones that are a dollar. Usually they are less savy users with far different expectations. Pick any app in the top 25 that is under a dollar and you'll surely see a bunch of oddly worded reviews, mostly hyper-critical and complaining about what a waste of money it is.

Raising your app price will undoubtedly weed out these users and, while sales will be lower, it will be a more quality, educated user. JMO

</comment></comment><comment><USER4> Wishful thinking.

The correlation between price and perceived quality is very easily explained by the data source. He's only looking at the apps that actually sold!

Free applications can be mediocre and still be widely-downloaded enough to make it into the top 10.

Top-selling paid applications _must_ be of very high quality to sell at all.

<comment><USER5> and further, people will only decide to buy a paid app if they know it fills a specific need. they will read reviews, check to make sure this app fills their need. free apps are downloaded before the user decides if they are useful- and thus obviously aren't.

i don't think this has "proven" that is makes any sense to keep your app at a high price. it is a correlational relationship, not causal

</comment></comment><comment><USER6> One critical tipping point that I've observed (as a developer) is the difference between $.99 and Free.

Early in the app store Apple decided they you could only leave feedback for apps that you actually installed. From that point on, you had to download the app to rate/review it and if it was a paid app, you had to pay for the privilege.

This seemed to filter out allot of the off-the-cuff negative comments for paid apps; maybe because it raised the "bozo threshold" or maybe because when you pay for something, you try harder to get something out of it. Either way, negative reviews for paid apps dropped for me (and seemed to across the board).

I'm experimenting with this again by making one of my paid apps free for a week, we'll see what the score looks like after that.

<comment><USER7> _we'll see what the score looks like after that._

Please do share when you have the results!

<comment><USER6> So far the results are surprising. I expected a large influx of critical (i.e., bad) reviews (given the large increase in downloads) but instead I received just a few but they were either positive or if not completely positive, very well-thought-out and constructive.

The next test will be to see what happens when the price goes back up (tomorrow is the last day the app will be free).

</comment></comment></comment><comment><USER8> I think this is true up to a point with many things. Also, if I spend $9.99 on an app, I'm going to be looking to justify spending the dough. If it isn't doing it for me, I'll likely try to figure out why by spending more time with it -- and often times I'll figure out what I like about it.

<comment><USER9> this is exactly what I want from my users to do. :-)

</comment></comment><comment><USER10> Would like to see proof that higher ratings are good for revenue, any devs want to share their income/ratings plot?

<comment><USER11> We've had our sales revenue killed overnight by one review when we pushed out a big update a few months ago. We were doing ~$150 a day from one app, running up the Top 100 charts in Social Networking and about to break the Top 50 fold when everything went downhill as soon as that review was posted. Sales dropped to under $30 a day.

The review was written by an Apple technician who worked at an apple retail store. His review sounded very "authoritative" to the average consumer in terms of features and problems with our app. He even cited the SDK but I knew he was misinformed when many of suggestions were forbidden (integration with Calendar, re-route native SMS/phone calls through our app, etc.) Nevertheless, consumers trusted his review and that was all she wrote for that month of sales.

Long story short, we tried contacting Apple to have it removed, no response as usual. After about 3 days of google stalking, I found him on Flickr and sent a PM. I gave him free app codes for his friends, and asked that he kindly change his review so it's factual. I told him I didn't mind honest feedback, but that his post sounded like an authoritative developer and was in fact wrong. He kindly changed the review, and we exchange emails to this day. He's trying to get into development.

Sales recovered some but certainly killed our momentum (and momentum is a big deal on the appstore, the more folds you can break through generally means more stable revenue for a time). The one-way street review system is extremely frustrating... yet another major complaint I have about the store. Wayyyy to much power given to the consumer.

<comment><USER12> I completely agree with you. We have a lot of apps with >$14.99 price tag and as soon as there is a negative review the sales go down a lot.

I also agree with you with the momentum aspect. If you are gaining momentum a bad review can ruin it all for you. It happened to us on a $1.99 app in education which made it to top 25 in that category but 1 bad review and it was downhill ever since. It will be really helpful if Apple allows threaded review system in which the developer can comment on the reviewers comments and the reviewer receives an email notification to respond and change.

</comment></comment></comment><comment><USER13> A good, data-driven, analysis of the relationship between price and customer perception of iPhone applications.

</comment><comment><USER14> Correlation != Causation

<comment><USER11> I get so tired of this comment - but I digress. Did you read the article? If so, do you have anything of value to add based on personal experience?

Just curious...

<comment><USER15> It's actually a valid point which I happen to agree with, stated with a minimum number of words.

The article says that lower prices imply lower ratings, but the data presented only shows that lower prices correlate with lower ratings. One could equally well draw the conclusion that lower-priced software is of lower quality, hence the bad ratings.</comment></comment></comment>