Generation Y Internet users aspire to become rich and famous rather than work for their country - <AUTHOR> http://www.hero.ac.uk/media_relations/18020.cfm

<comment><USER2> It's a shame that so many people will not attempt to follow on with their "dream job" goals.

At my UK University there is a strong culture of getting a good degree in a quantitative field, perhaps doing a PhD in a similar (but still quantitative) field and then being plucked out by a large investment bank to work as a "quantitative analyst". The salary is good, but I'm sure the work becomes tedious after a while. The process is almost as precise as an automobile assembly line!

I wish the culture of entrepreneurialism was stronger than the desire to go and price financial derivatives. After all, two/three hundred years ago nearly everybody was an entrepreneur (farmers). How things have changed...

</comment><comment><USER3> False premise. Do Larry & Sergey do less for the world than politicians? Does the median politician even have a net positive effect?

<comment><USER4> To answer your first question, absolutely yes.

[http://en.wikipedia.org/wiki/High_Performance_Computing_and_...](http://en.wikipedia.org/wiki/High_Performance_Computing_and_Communication_Act_of_1991)

I don't know the answer to your second question, nor could I answer it for the median of whatever group Larry & Sergey represent.

<comment><USER3> <http://en.wikipedia.org/wiki/Iraq_War>

<comment><USER4> I see the current Iraq war as evidence that more talent and smarts should be applied to politics.

On the other hand, the comparison isn't so useful. How many young people are choosing between politics and hacking? The two skill sets overlap only slightly.

</comment></comment></comment></comment><comment><USER5> This is pretty hilarious. Is "campaigning for green issues" going to do more for green issues than starting a startup like Craigslist that saves the world more wasted newsprint than all those activists put together?

<comment><USER4> It might, depending on the talent of the person running the campaign. My talents aren't suited to being effective politically, but I wish more people who did have such talents would use them to change things. Many of the world's biggest and most important problems are political, not technological.</comment></comment>


It's Up to the Shareholders, Not the Government, to Demand Change at a Company - <AUTHOR> http://www.icahnreport.com/report/2009/04/its-up-to-the-shareholders-not-the-government-to-demand-change-at-a-company.html <comment><USER2> Too bad most people own stock indirectly, through retirement or mutual funds among others. The money managers for these funds are certainly the ones who want to rock the boat, if they care at all. Even when they own it directly, few have the time and energy to do anything about it. There are also no real platform _that I know of_ for shareholders to freely share ideas other than stock picks and the like.

<comment><USER2> I can't edit the post any more. I meant they _aren't_ the ones who would want to rock the boat.</comment></comment>


Case of the Missing Women - <AUTHOR> https://numbersofindia.github.io/stories/population-06-2019/#ckpt2 <comment> lota-putty Make all Indian women more independent and self-reliant.

\- They often don't have a say in choosing a life-partner \- They're often don't have a say in pursuing higher studies

Public(free) health/education is utmost importance. Even most Govt. primary school teachers send their kids to private schools, others don't have private schools near by.

These issues are not black/white like most microbial diseases.

India is a democracy; democracies are flawed coz, like everywhere else power attracts corrupt people; and corrupt fight bloody.

Does health of NGOs in a country and their ability to influence Govt. policies within a term(4-5yrs) tells us more about a Country?

<comment><USER3> this is a hit piece. it is likely that they either manipulated the time period in which the data was taken or they cherry picked the towns the took the data from. most likely they did both. with a population of over a billion. it is easy to manipulate population numbers. what they did is find towns with only one or two births for a given time period and selected a time period that would push their narrative.

the other possibility is that these towns have some messed laws that encourages people to not register their daughter's birth. this is an issue in many countries and people just ignore these rules and just register their kids in the most beneficial way. of course racist people will take this and claim misogyny.

there is a logical disconnect of people stereotyping countries with the largest population as mistreating females. the lack of critical thinking is appalling. it takes nearly a year to birth a child and requires that the female is a willing participant. they have done this more times in india than in most other countries.

<comment> em-bee manipulated numbers to what end? you think the gender disparity is not real? china has the same disparity. you can find it in official reports by the chinese government. so it's real, all right. why would india not have the same problem? do you have evidence for your claim?

</comment></comment></comment><comment><USER4> There was some discussion about this issue 10 years ago:

[https://news.ycombinator.com/item?id=651028](https://news.ycombinator.com/item?id=651028)

</comment><comment><USER5> I see some problems in India with the allocation of seats in the upper house of the parliament split unequally among the states, unlike the senate in the USA. That means states with more population have a bigger say, rather than having all states having an equal say.

<comment><USER6> "Fails to be as anti-democratic as the remaining remnant of the US Constitutional design to protect slavery" is an odd _criticism_ of another government's structure...but okay.

</comment></comment><comment><USER7> The tone of this article makes my skin crawl. It reads as if the author believes women are possessions that every man is entitled to own. Can we all start treating female humans as humans please, that is the only way that the root cause of this kind of problem will ever be eliminated.

<comment><USER8> Hey! I'm the author of this article. I completely understand this criticism. I was very afraid of how this might come across. My sincere apologies for this. My intention was to highlight the effect skewed sex-ratios have on the population, as an aggregate. I abhor the thought of men acting entitled to women, and being treated as possessions. But I also wanted to highlight the impact that is already being felt in countries such as china where 'family life' is taught to be a 'truth' that every human must go through. Sorry again!

Some articles that got me thinking : [https://www.ft.com/content/d44122c0-a435-11e5-873f-68411a84f...](https://www.ft.com/content/d44122c0-a435-11e5-873f-68411a84f346)

[https://www.economist.com/special- report/2017/11/23/a-distor...](https://www.economist.com/special- report/2017/11/23/a-distorted-sex-ratio-is-playing-havoc-with-marriage-in- china)

<comment><USER9> It has to be possible to talk about the effects of this phenomenon on all people, as well as the related changes in behavior people choose. We're all new to that, so I think we're all figuring out what language is appropriate. So we all have to be open to discussing that too. Thanks for that openness!

</comment></comment></comment><comment><USER10> "eroding the next generation's pool of women"

What a way to phrase things. I really wonder how this article is relevant to HN?

<comment><USER8> Hey! I'm the author of this article. I apologise for that particular phrasing. I sincerely meant it as a pool of men, pool of women kinda way. I was trying to be dispassionate about it, which may have come across as insensitive. Apologies. I was trying to base my tone on these articles that got me thinking Economist's analysis of marriage in China : [https://www.economist.com/special- report/2017/11/23/a-distor...](https://www.economist.com/special- report/2017/11/23/a-distorted-sex-ratio-is-playing-havoc-with-marriage-in- china)

FT's article on 'missing brides' : [https://www.ft.com/content/d44122c0-a435-11e5-873f-68411a84f...](https://www.ft.com/content/d44122c0-a435-11e5-873f-68411a84f346)

</comment></comment><comment><USER11> It's just people reacting to market conditions. If your society provides incentives for abortion, abortion is going to happen.

I can't judge people living in other parts of the world. But I know that massive populations ruled by a single government don't work. There's no reason 1/6 of the world should be under the control of a single government. They need to decentralize and maybe create a federation of independent states.

</comment><comment><USER12> I have a pet (non-scientific) theory/query. Wouldn't such prolonged & sustained periods of female foeticide eventually cause the human body to mutate...and stop giving birth to the female sex entirely?

<comment><USER13> > I have a pet (non-scientific) theory/query. Wouldn't such prolonged & > sustained periods of female foeticide eventually cause the human body to > mutate...and stop giving birth to the female sex entirely?

It's the opposite, actually.

It is evolutionarily favorable to give birth to the sex that is less numerous at sexual maturity. If female babies started dying, for whatever reason, the chance the average baby is female would gradually increase until the ratio of sexually mature females to males balanced out.

Incidentally, this is presumably why there are slightly more males born than females [1] - males tend to die more frequently than females during childhood.

___

1\. [https://en.wikipedia.org/wiki/Human_sex_ratio](https://en.wikipedia.org/wiki/Human_sex_ratio)

> In humans, the natural ratio between males and females at birth is slightly > biased towards the male sex, being estimated to be about 1.05[2] or 1.06[3] > males/per female born.

<comment><USER14> >If female babies started dying, for whatever reason, the chance the average baby is female would gradually increase until the ratio of sexually mature females to males balanced out.

Perhaps I'm missing something, but how does the human body have internal knowledge of the current gender ratio in society such that it will attempt to fix the ratio to balance?

<comment><USER13> > Perhaps I'm missing something, but how does the human body have internal > knowledge of the current gender ratio in society such that it will attempt > to fix the ratio to balance?

It doesn't.

This process happens strictly through natural selection.

If average female fertility is F, the number of sexually mature females is f and the number of sexually mature males is m, then the average male fertility is F * f / m (each child is conceived by exactly one male and one female). This means that the less numerous sex has a higher fertility.

It is not true that each child is equally likely to be male or female. Some parents are more predisposed to have male children and some parents are more predisposed to have female children. The parents predisposed to have more reproductively successful children will have their genes flourish - <USER2> the sex balance of new babies slightly in the corrective direction.</comment></comment></comment></comment>


The Usefulness of Abstracting Over Time - <AUTHOR> https://maxhallinan.com/posts/2018/08/17/the-usefulness-of-abstracting-over-time/ <comment><USER2> I get why removing global state is a good thing in general, but here you are replacing it with a whole lot of complexity for not a particularly clear reason. Is tracking the user count with an integer dangerous _in this case_ (Have you run into problems with it)? Is your solution not using global state anyway, just wrapped in a library?

All in all, are the abstractions (a bunch of new concepts plus a new library) _worth it_ to just replace an integer?

       function timerFunc() {
          if (connectionCounter) get results();
       }
       socket.on('connect', function() { connectCounter++; });
       socket.on('disconnect', function() { connectCounter--; });

The real problem is you want to start and stop the timer when someone connects. Just keep it simple and keep it going, but not doing anything if there is nobody connected, like above.

<comment> s-shellfish That always depends on whether whatever is contained within the abstraction is something that might change. Sigh, humor.

Leaving it as a primitive basically says 'you may have to hack the programming language or framework in order to modify code that depends on this piece of the logic'. Global state is something you can manage in terms of modular components. Allows for dynamic orchestration of components.

It's more the long term issue that keeps repeating (more humor) than it is just replacing an integer. Being able to decide 'is this component something that needs to be reasoned about in it's own independent logical layer from the rest of the system or is it not' or 'does this component relate to other components in a well defined way'.

Connect is an action, an observable action has occurred. An abstraction can trigger a behavior to other abstractions through that predefined relation. That's the point.

</comment></comment><comment><USER3> Hmm...

"The server always asks for new location data, every 30 seconds, even when no one is listening."

...

"Our task is to pause the timer when there are no websocket connections and start the timer when a client connects."

That sounds like asking for trouble. Maybe there's something I am not understanding, but why not have the timer run continuously and have the timer _action_ check whether it needs to request location data?

Yes, that will cause the process to wake up every 30 seconds even if there is no action, but unless circumstances are very special that won't be a significant problem.

<comment><AUTHOR> Thanks for reading! I like this suggestion.

The central problem of this post is not whether the timer is running continually. The central problem is _how_ does the timer know when to stop/start making requests.

It's a problem because knowing this depends on access to information that is trapped in a different context. For example, the number of closed connections is only knowable within the context of the connection event handler. So how do you share this information with the timer?

One approach is to mutate global state. You move the information into a shared context where it's accessible everywhere. A second option, which is the focus of this post, is to look for better abstractions. In this case, those are abstractions over time. And when you have those abstractions, you can eliminate the global state.

<comment><USER4> A question unrelated to your programming concepts: If you only query your source when a request comes in, doesn't the first requester get old data? This is a problem I have faced before.

<comment><USER5> Couldn't you make the first requester wait until you've made your query?

<comment><USER4> Sure. But I assumed one goal was to offer low-latency access to a high-latency service. I.E. Act as a cache.

<comment><USER5> Oh. That would be a tough spot to be in. I assumed that's not an issue here though.

</comment></comment></comment></comment></comment></comment><comment><USER6> Very nice explanation. Gives a good insight how you can "think in observables". Two small things 1. instead of merging zero$ into connectionClosed$ you can use the startWith() method. 2. Instead of using the head method to pluck the first item of an array you could use array destructuring. (But I can understand that you wouldn't do it in this to limit the amount of "new" concepts)

</comment><comment><USER7> Send a message to a queue asking for refreshed data... ignore messages that occur within a given timeframe.

Or put your server in front of a CDN / Nginx, set cache headers for 30 seconds ;)</comment>


Ask HN: Would you pay to have web app built? - <AUTHOR>

Freelancers or company that builds prototypes for startups...Which route would you take? Any suggestions? <comment><USER2> If you don't have any coding experience I'd suggest looking for freelancers, you could potentially get them on board for a longer term relationship.

</comment><comment><USER3> Build it yourself, much more efficient. If you only want a prototype to show investors, etc then you can even just use Keynote.</comment>


Inside "MinWin": the Windows 7 kernel slims down - <AUTHOR> http://arstechnica.com/microsoft/news/2009/11/inside-minwin-the-windows-7-kernel-slims-down.ars <comment><USER2> Also check out Singularity: <http://en.wikipedia.org/wiki/Singularity_(operating_system)>

And Midouri: <http://en.wikipedia.org/wiki/Midori_(operating_system)>

Two cool projects that are part of Microsoft's research in managed code operating systems.

</comment><comment><USER3> > Am I the only one scared that notepad on the latest Windows can still > display a dialog box that comes straight from NT 3.1?

As the article states the reason for this is:

 _Because Windows Explorer and many of the components of the Shell aren't included in a Server Core install, applications like Notepad' which would normally show an Open dialog box like this: (show the original File Open dialog)_

> Why the hell does it still have that DLL built in?

To display the file open dialog in Windows all you do is call the __GetOpenFileName __Win32 function.

Back in the days of Windows 95 Microsoft got into the habit of changing the look of the File Open dialog for every new release of Windows and they stored these new dialogs in the common control dll.

So I suspect deep inside of Window itself there is pseudo code that works something like this:

        GetOpenFileName()
            if Common Control DLL installed
                Call New Explorer GetOpenFileName dialog
            else
                Call the very first every GetOpenFileName dialog built into Windows itself

<comment><USER4> Wouldn't it be easier (and more elegant) to skip the built-in dialogs altogether and just ship it with a common controls dll that didn't use Windows Explorer elements? I am fine with Microsoft moving things around, but layer upon layer of obsolete functionality doesn't strike me as even professional.

Hell... If one of my developers even attempted such a stunt we would have a long code review session discussing it.

</comment></comment><comment><USER5> Money quote for me:

" Microsoft says there are still about 600 interconnected DLLs and other binaries, totaling hundreds of megabytes. None of these could be safely removed without causing other parts of the system to break. Even Mark Russinovich, widely regarded as one of the world's top experts on Windows internals, admits that they still can't predict what exactly would break."

As much as I like Windows 7, that kind of thing makes me want Microsoft to create an emulated environment similar to OS X Classic and surround it with a from scratch, managed, modern cruft free OS.

<comment><USER6> Except OS X is far from cruft free. It has a lot of cruft from NextStep floating around.

Af for the interconnected DLLs, have you ever worked on a largish project that tried to release independent parts? It's hard. The practical problem is that you get two seemingly independent modules that want to work well together, not duplicate code between each other, and be independently distributable. These can conflict, and if you're not dedicated to all of the goals, and clever, you fail in one or more.

<comment><USER4> That is what package management solved long ago in the Linux world: you have three products: two you launch, and the third is a dependency of both.

Simple, elegant and, since I am writing this, it works.

</comment></comment></comment><comment><USER4> Am I the only one scared that notepad on the latest Windows can still display a dialog box that comes straight from NT 3.1?

Why the hell does it still have that DLL built in?

<comment><USER7> Programs back then probably weren't designed with modularity in mind, which is why its hard to remove even the slightest detail of code without extensive testing..

I really hope Microsoft gradually improves this situation with the MinWin project.

<comment><USER8> Not that rewriting NotePad should ever be any daunting task.</comment></comment></comment>


Stare at boobs for longer life - Study - <AUTHOR> http://www.themedguru.com/20091206/newsfeature/stare-boobs-longer-life-study-86131320.html

<comment><USER2> Urban myth: <http://www.snopes.com/humor/iftrue/breasts.asp>

<comment><AUTHOR> Bah! It would be nice if it was :)

Thank you for the clarification.

</comment></comment><comment><USER3> Brainiac disproved this at some point in the past:

<http://www.youtube.com/watch?v=-D6NI_8-Zks></comment>


Always-on Alibaba office app fuels backlash among Chinese workers - <AUTHOR> https://www.businessinsider.com/r-ding-always-on-alibaba-office-app-fuels-backlash-among-chinese-workers-2018-8 <comment><USER2> After working for that company for awhile... The entire goal is to look busy, so people create work and don't accomplish a whole lot. 10-12 hour days are expected whether or not you have work to do, or if your work efficiently. The Chinese are also very suspicious of anyone that is not Chinese, and you're very much considered an outsider and will be informed on a need to know basis if that's the case. They're wildly successful inside China, but that's likely more do to government protected Monopoly than actually having a product that works. The best part of working there is when I pointed out builds with failing tests were making it to production, and the architect in charge told me that they can still release, it just decreases the 'quality score'.

<comment><USER3> If it works, it works. I remember standing at the base of the new Tencent double tower, when it was being constructed. They were almost done with the concrete skeleton and the beams looked all crooked standing there looking up at the structure - each column on each floor was slightly misplaced compared to the previous one. I am no construction engineer, but I believe they should have been placed in a straight line, but maybe I am wrong..

<comment><USER4> Chinese construction leverages concrete by a fairly unskilled work force. To make up for the safety problems with that, they overbuild a lot, so precision isn't very necessary, but the building will deteriorate a lot faster without much more maintenance. So a newish building in China that is only a few years old will often feel much older than that, but at least it won't fall down.

Similar construction is utilized by India, and exported to other countries that utilize Indian construction labor (Singapore, Dubai, ...). Really it is just a trade off that soaks up cheap labor, which is very much in these country's best interest ATM.

<comment><USER5> You explained what people used to tell me how GCC buildings didn't last as long thanks.

<comment><USER6> GCC?

<comment><USER7> I assume Gulf Cooperation Council. UAE, Saudi, Quwait etc

</comment></comment></comment></comment></comment></comment><comment><USER8> "If you come into Starbucks in the morning and you are told you can't buy coffee because their staff hasn't arrived, will you accept that? Even the Europeans won't accept tardiness."

It's often done that someone appeals to examples from other cultures that might not be entirely accurate. Being a bit late, particularly if you live in a city with bad traffic, is absolutely accepted. Also, who in the UK hasn't heard the "we don't have train drivers" excuse?

The thing to think about is why there's demand for this sort of corporate leash. I guess there's a lot of bosses who distrust their employees. A friend of mine works for a firm from home one or two days a week, and it turns out they check whether your mouse is moving.

I run a tech team that's 100% work from home. I think if I insisted on GPS and face recognition it would quickly get miserable for everyone.

There's something I call the "ghost rower" effect. If you've ever rowed a boat (think Oxford and Cambridge) it's possible to move the oar in such a way that you look like you're rowing, but you are not really contributing to the boat moving faster. It works because someone on the shore can only check that you're sliding back and forth, and your oar is in the water.

Most modern desk jobs allow the same. You can show up, you can have Excel open, you can attend meetings. All without doing anything useful.

If you want more ghost rowers, install DingChat.

<comment><USER9> Believe me or not, we installed a computer vision powered check in system at our office. They are surprisingly cheap.

<comment><USER10> It might be surprisingly cheap but seems incredibly miserable to work there. It shows that the company does not trust their own employees and is a sign of bad management.

<comment><USER11> It depends how the check in is used. When I worked in Germany we had time cards and the main purpose was to make sure you worked only 35 hours a week or you got overtime paid. It was more about not trusting management.

</comment></comment></comment></comment><comment><USER12> _On top of this original feature, the company has added a wide range of functions that include automatic expense claims, a clock-in system to monitor the whereabouts of employees, as well as a "daily report" function that requires workers to list completed tasks.

As DingTalk has grown, many Chinese office workers have vented their frustrations online about the service, saying it is inhumane and destroys trust._

"Inhumane and destroys trust" doesn't sound too far off the mark to me. But it's not so _very_ different from working in an open office with daily standups, and that's become pretty well-accepted in technical fields over the last few years. I hope we see some changes -- more trust and less demand for pervasive visibility -- but it's hard to be terribly optimistic on this point right now.

<comment><USER13> A lot of these have automated analogues in American companies.

> _automatic expense claims_

\- Expense claims seem like a smart thing to automate.

> _a clock-in system to monitor the whereabouts of employees_

Zendesk, ServiceNow, and other issue tracking ticket systems provide numerous metrics about user activity, including a timer for each ticket. Many tech support shops use the total ticket time, divided by 40 hours, as your "utilization", and target an 80% utilization, or you're productive for 32 of 40 hours per week.

> _as well as a "daily report" function that requires workers to list > completed tasks._

This could be an automated report in the system above. Or it could be mandatory release notes, but daily is excessive for that. This sounds like a daily standup, over email.

<comment><USER14> Those aren't terrible per se, but I think the relentless immediacy of you're manager's chat or request would get annoying, especially on a weekend or holiday as the article discussed.

<comment><USER13> At my last job, we were expected to monitor the Slack channel, and jump in to help - when we were off shift, at the store, day off, vacation - oncall was the first person paged, then whoever was awake. And this is to answer customer phone calls and emails needing cloud technical support, and the occasional 3am VPN tunnel rearchitecture.

On the other side, when the line laying union threatened to strike, they told us we'd be working 12 hour days and help out laying line during the strike.

</comment></comment></comment></comment><comment> EZ-E My office uses it in China. We use some of the features like the clock-in and the one to file expenses. My company fines you if you clock-in late on the app, but won't hesitate to use the "ding" feature to send you SMS/phone calls after 9PM that records the time seen/confirmed.

Overall it's more a company/cultural issue, but the app certainly makes it easier to pressure employees to always be on.

<comment><USER15> China is really weird. They already have the bigbrother level of social media in place (social media credit scores), this just takes it a whole another level now. They are really heading towards a dangerous unethical path right now, and with google's censorship engine that just brings more worry honestly. China is paving the future of George Orwell's 1984. When other countries see how successful China is at doing this, others will potentially follow suit

<comment><USER16> 6079 Smith, W. Yes, you! Bend lower!

</comment></comment></comment><comment><USER17> Man the setup in that first photo looks terrible office wise.

>Instead, Wu's team sought another niche, tackling a common managerial complaint in China: workers who fail to reply to messages and later feign ignorance.

So they built a messaging platform to hassle people... about other messages?

That seems brutal.

<comment><USER2> Yep. And 90 degree office temps are not uncommon.

</comment></comment><comment><USER18> This is an app that will not work in the west. And frankly it shouldn't. It's an insult to the intellect of an employee.

<comment><USER19> It will probably be a feature of Slack within a year.

<comment> brown9-2 Hard to think of a feature that could destroy whatever good will Slack has with users (if it still does) then a feature that lets you "ping" and notify someone else endlessly.

<comment><USER20> Slap some copy about empowering end users/workers and some illustrations of people with heads much smaller than the rest of their bodies, and it's ready to bring about a new VC round.

</comment></comment></comment></comment><comment><USER21> >Like WhatsApp, DingTalk lets senders see if recipients have read messages, but it also has a "ding" feature that can bombard recipients with repeat notifications, text messages and phone-call reminders.

"Sorry boss, you're breaking up. "

 _hangs up phone and turn on airplane mode_

Either that or "accidentally" leave your phone on silent after a meeting.

<comment><USER22> Not to defend ding, but how is that different from PagerDuty?

<comment><USER23> Pagerduty is specifically for on call staff who's job is to respond, immediately, to alerts.

<comment><USER24> And it's expected that they only respond when they're "carrying the pager", that is, on their on-call shift.

One of PagerDuty's features is figuring out who's the right person to page right now.

</comment></comment></comment></comment><comment><USER25> Considering where it's from, I wonder to what degree all of the messages are funneled in plaintext through a centralized censorship engine. What happens if you start pasting excerpts of the wikipedia article for Tiennamen square to your coworkers?

<comment><USER26> This seems to be allowed in WeChat. But such text will be blocked if you try to send it in a group chat. I guess CPP allows you to talk privately but not publicly in a 300 people group.

<comment><USER27> By that means they can easily identify dissidents without allowing them to spread their message too far

</comment></comment></comment><comment><USER28> [...]"daily report" function that requires workers to list completed tasks [...] Despite the grumbling, Wu believes the service will translate across borders and cultures

He is right, managers will love this - it's just daily standup (everyone loves it, so agile!) on steroids. I'm pretty sure that it will be added to "western" tools within months.

<comment><USER29> Status Hero was used this way at my last job. My manager would have it opened at all times in his office. And I just got fired, so I guess it "worked". The only way to accomplish the tasks fast enough was to work weekends, and once I quit working on weekends (which I was told "of course you don't have to work weekends!), they got rid of me within a couple weeks. Really terrible place to work.

</comment></comment><comment><USER30> So let me get this straight, a new 'free' version of Slack that sends all your companies internal communications straight to Chinese government servers. Now they don't even have to hack us, we're giving it to them voluntarily.

<comment><USER31> Fun fact: This is how Slack looks from a European perspective.

<comment><USER32> That is also how it looks when someone has a SaaS hosted in AWS. Then wonder why potential clients are asking for self-hosted.

</comment></comment></comment><comment><USER33> It's good to remember we are all human. We all have the same limits as workers.

</comment><comment><USER34> I feel grateful for my old age and limited future participation in the workforce when I read these stories. Anyone that thinks North American companies will have ethical problems with these technologies just isn't being honest.

</comment><comment><USER35> BusinessInsider now redirects Tanzanian users to [http://pulselive.co.tz](http://pulselive.co.tz) which doesnt resolve. This website is such garbage.

</comment><comment><USER36> I have added a DingTalk line to my checklist for next job interview.

<comment><USER37> At this point if you are in the EU or the US, you will probably make them look it up more often than not, contributing to this app's growth.

</comment></comment><comment><USER38> Anyone else getting a 404 on this page now?

<comment><USER39> Only if it redirects you to your local business insider, that's pretty bad I would say.</comment></comment>


FDA: Sampling finds toxic nonstick compounds in some food - <AUTHOR> https://www.apnews.com/e9c5fa42a1244de48e3edea7a1bb14eb <comment><USER2> Any one have a source to the FDA publication they took this from?

This is the best source I could find. [https://static.ewg.org/pdf/alex-530.pdf](https://static.ewg.org/pdf/alex-530.pdf)

PS. News agencies that don't provide the public source deserve a special place in hell.

</comment><comment><USER3> Not too surprising for anyone who has owned a parrot - you're clearly warned to not use nonstick since cooking with it can kill them. Not surprising that there's at least some traces there.</comment>


Researchers identify command servers behind Google attack - <AUTHOR> http://arstechnica.com/security/news/2010/01/researchers-identify-command-servers-behind-google-attack.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss

<comment><USER2> Where is this report they talk of? Is it not released to the public [yet]?</comment>


Scientists Control a Fly's Heart with a Laser - <AUTHOR> http://spectrum.ieee.org/tech-talk/biomedical/devices/scientists-control-a-flys-heart-with-frickin-lasers <comment><USER2> I was far less impressed when I read in the first paragraph that the fly was anesthetized and stuck to a microscope slide... :-)

</comment><comment><USER3> How many flies were gibbed before they got it to work?</comment>


Why it sucks having your own company - <AUTHOR> http://wahrman.fi/10-reasons-why-it-sucks-having-your-own-company/

<comment><USER2> Agreed. Without any 'core values' and a 'mission statement' I have to focus on dumb things like working hard and making the customers happy. Also, the time I would have spent making crap up for my annual performance review, I wasted by learning a new programming language. Yeah, I really feel stifled by the lack of 5 layers of management and me doing my job.

</comment><comment><USER3> Remember when you left on vacation without a care in the world and didn't touch a computer for 2 weeks? That's not happening for quite awhile.

<comment><USER4> I've been running my own business (web dev) for more than 6 years and I take vacations whenever I want (except when we are delivering a project) I only make sure to travel places where I can find good internet access.

<comment><USER3> Yeah, I took 3 weeks of vacation this summer but I had to keep an eye on email and make sure everything was working - they just aren't as relaxing as they used to be.

<comment><USER5> I find vacations without access to internet boring if vacation take more then one week. No matter if I am freelancing or working full-time, 'cos even if I am working full-time I also do own stuff...

</comment></comment></comment></comment><comment><USER6> _I can no longer relate to Dilbert._

As long as you don't start to relate to pointy haired boss, you should be okay.

<comment><USER7> I guess I should watch it with the hair gel before I get too close ;-)

</comment></comment><comment><USER8> Wow, the domain name rang a bell big time. Sure enough, I met the guy's cofounder/cousin at an informal gamedev meetup when he visited London a few years back. Haven't kept in touch, but good to see he's doing well. (hi Nicke!)

</comment><comment><USER9> 1-8 made me smile, but #9 cracked me up. I can relate - unless bullet points on a scratch pad count as a spec.</comment>


VMware: Don't shut down that virtual machine - <AUTHOR> http://news.cnet.com/8301-1009_3-10016173-83.html <comment><USER2> what a frigging cock-up. VMWare is essential for my work but their customer service is a joke. Clearly their QA testing team has issues as well.

<comment><USER3> I guess they shouldn't have fired the CEO who built the company and replaced her with a suit from a company that's widely acknowledged to have screwed the pooch on virtualization.

</comment></comment><comment><USER4> DRM: screwing over genuine customers since 1996.

<comment><USER5> 1996? Don't you remember DOS copy protection?

</comment></comment><comment><USER6> If I were to try to imagine the worst bug possible for a virtualization product, this would probably be it. Though I suppose data corruption would be worse.

</comment><comment><USER7> Well, you can't really blame QA all that much. This would have only been caught if the QA team decided to turn the clock forward a few days just to see what would happen. This was the Developer's fault for not checking the code for expiration on a BETA. Glad we waited to Update to U2 tho!

<comment><USER8> Sure, you can blame their QA.

QA for such a big company, with calendar-sensitive products, should be running full acceptance tests at a number of dates in the future. Malware researchers do this with honeypot machines to see if certain actions are triggered at upcoming dates.

VMWare should be doing this even if for no other reason than to verify that their intended license-expiration works as expected.

<comment><USER9> Big corporations that have software everyone wants to use can treat their paying customers as beta testers. You know this drill as Microsoft pioneered the practice a long long time ago.

<comment><USER10> Big corporations also treat their production staff using in-house software as beta testers, even if this costs them many millions of dollars in the few days after each release. (Because hiring a test staff for less than a million would be "too expensive.")

It says a lot when a company can treat customers in the general public like in-house employees it can abuse.

</comment></comment></comment></comment><comment><USER11> Software licensing - the worst invention since tangled cables.

I don't want key infrastructure to have license keys in it and need new license keys to unlock more features. ESX Server? Firewalls? Routers? No! As little code as possible, as high quality as possible, please.

</comment><comment><USER12> How much you wanna bet some disgruntled eng snuck that bug in?

</comment><comment><USER13> yup... software licensing... it's buggy!

</comment><comment><USER14> Quite an unfortunate bug.</comment>


Google's acquisition of Motorola approved by EU and U.S DoJ regulators - <AUTHOR> http://googleblog.blogspot.com/2012/02/european-commission-clears-motorola.html

<comment><USER2> The good: a flagship Android phone that doesn't have to have a manufacturer's special sauce added to it.

The bad: in the US, they still have to dicker with the wireless carriers.

The ugly: every Android manufacturer will suspect they are being disfavored.

<comment><USER3> _a flagship Android phone that doesn't have to have a manufacturer's special sauce added to it_

Is the hardware between devices really all that different? Phones are basically giant screens attached to giant batteries. Where do you go from there? Put in CDMA and GSM radios that each do a bunch of frequencies, and you're done developing phones forever.

(Even the iPhone 4 and iPhone 1 look approximately the same. Big screen. Home button. Power button / volume buttons / vibrate switch. Android devices are even simpler because they only need a power button.)

The problem with phones is that they are all the same in an abstract sense, but all different with respect to drivers and hardware bugs. That means you can never write phone OSes like you can write desktop OSes, which is a huge drag on innovation. Imagine if you could choose between Ubuntu and Mint on your phone. Instead, you're stuck with whatever you get from your carrier, which is worse than nothing at all.

Phones are all software these days, and the hardware manufactures cannot code their way out of a wet paper bag.

<comment><USER4> > _you're done developing phones forever_

There are dozens of different form-factors. Take a look at the diversity of the Android or even the WP7 market. Landscape sliders, portrait sliders, 4.3", 3.7", 5", 3", some with dual core, some with quad core, some with AMOLED screens, some with SAMOLED screens, some LCD screens. Some with removable SD cards, various amounts of storage, various price points of the market.

> _Even the iPhone 4 and iPhone 1 look approximately the same_

That's because Apple designed them all the same. The way Apple designs their products does not have any relation to the amount of possible designs.

> _Android devices are even simpler because they only need a power button._

Android phones are supposed to have four face buttons. This is not strictly required (allowing for variation), but the phones expect you to have four buttons. Windows has three. Apple has one.

> _you're stuck with whatever you get from your carrier_

Except there _is_ a _huge_ amount of variation in the custom ROM world, which many Android devices allow.

> _Phones are all software these days_

A common misconception that will at some point pave the way for true innovation in hardware like we've seen in the past when the smartphone market stagnated (then the iPhone was released and it was exciting again).

</comment></comment></comment><comment><USER5> I really hope that Google will make a commitment to consistently and quickly update all Motorola phones to the latest version of Android that the phone can handle so that it becomes the standard expectation from all phone manufacturers.

<comment><USER6> ha - they don't even do that with their phones!

<comment><USER7> Actually they do.

And if you are talking about the Nexus One or G1 in particular, no provider continues major-version support of 2+ year old phones.

<comment><USER8> The iPhone 3GS was released on June 19, 2009, and runs the newest iOS releaes. That was 2 years, 7 months ago.

<comment><USER7> And not very well IMHO, probably about as good as a Nexus One would ICS. There is something to say for UX/UI standards.

<comment><USER9> I would just like to emphasize that this is not a cop-out. Not only does my top-of-the-line (when I bought it) iPhone 3GS with iOS 5 feel much more sluggish than my girlfriend's very low-end Android phone, but apps — even Apple apps — crash all the friggin' time due to memory exhaustion. Assuming the experience upgrading an old Android to ICS would be similar, I'd say Google is simply doing better QA than Apple.

</comment></comment></comment></comment></comment></comment><comment><USER10> As a mildly disappointed Galaxy Nexus owner who significantly prefers Motorola hardware to Samsung's, I really hope this means truly outstanding Nexus devices in the near future.

</comment><comment><USER11> I'm hoping this leads to Android being developed completely in the open, with open-source drivers as well.

<comment><USER12> How would this have that effect?

<comment><USER13> As to drivers, what reason does Goggle have to not release the driver code? This would be helpful to us that still want to use the latest Android more than 2 years after we spend $800 on a nexus phone.

Sadly, the binary that is always locked down is the modem. That might not have anything to do with the manufacture. Who knows what code carriers and requiring manufacturers I hide in there.

<comment><USER14> I wouldn't hold your breath--in his recent State of AOSP post, about getting companies to support AOSP, JBQ wrote: "I've given up on HTC, Motorola and Qualcomm, as it's clear at this point that they're not going to help in that area"

This was just before the CDMA/LTE (Qualcomm) devices were eradicated from AOSP.

[https://plus.google.com/112218872649456413744/posts/75aLL1dW...](https://plus.google.com/112218872649456413744/posts/75aLL1dWY2u)

<comment><USER13> Now that Motorola IS Google, it'd be safe to say google is interested in helping google?

</comment></comment></comment></comment></comment><comment><USER15> Can anyone explain why the US DoJ announced that they were OK with it less than four hours after the European Commission?

They haven't come out and given it as a joint decision, but it seems too close to be a coincidence - had they just co-ordinated PR releases, or was one of them pushed into a decision by the other, or...?

<comment><USER16> The DoJ announcement does say "During the course of its investigation of the Google/Motorola Mobility transaction, the Department of Justice cooperated closely with the European Commission."

So yes, it does sound like the Google/Motorola portion of the decision was coordinated. The DoJ was probably waiting for the EC announcement before releasing theirs, or maybe they just agreed to release them the same day and the DoJ one was released a few hours later due to the timezone difference.

<comment><USER17> It's time zone differences. The 4 hour lag is the difference between Eastern US time during Daylight Saving Time and GMT.

The EC announcement, assuming that the Google blog is on Pacific time, would be around 5-6 PM GMT. That's after normal trading hours ends, which makes sense for announcements like this.

The DoJ announcement was at 5PM ET as well.

<comment><USER18> I think he was suggesting the coincidence of two independent investigations finishing at almost exactly the same time.

</comment></comment></comment></comment><comment><USER19> Anybody know a good place to see how much google had to spend on lobbies to get this through? It'll be interesting if it's high or low.

</comment><comment><USER20> Motorola made a lot more than just phones. Did Google buy all their radio business as well.

Think about every Law Enforcement vehicle in the US; every single one of them has a motorola comm system in them. Will Google be making these?

<comment><USER14> Motorola split into Motorola Solutions (the robust, profitable part you're thinking about) and Motorola Mobility (the volatile, floundering part that was weighing Motorola down) early last year. Motorola Mobility are mobile phones and cable top boxes, that's the part Google bought. That other stuff is Motorola Solutions.

After the split Motorola Mobility went into "ah oh, somebody better buy me or I might do something stupid" mode playing Microsoft and Google against each other. This is also when Motorola was leaking the rumors of a full private Android fork that cuts Google out (replacing the market, gps/navigation libraries, etc), threatening to sue other Android manufacturers, etc. After Microsoft/Apple et al got the Nortel patents, Google couldn't afford for Microsoft to also get Motorola's.

<comment><USER21> Thanks for the comment. I seemed to remember that Google was acquiring a _division_ of Motorola (Mobility, specifically), but I couldn't decide if the headline was either sensationalized or I completely missed out on something. You've quelled my surprise!</comment></comment></comment>


The world is full of bulls**t jobs and you might have one - <AUTHOR> https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12053320 <comment><USER2> Some variant of this seems to happen to organizations after they reach a certain size of people. I used to work at a startup that raised a massive round of funding and began a hiring spree. I joined one of the satellite offices shortly afterwards, excited and eager to get to work. What I found was that the vast majority of our 50-person office was more or less spinning the hamster wheel, so to speak. The work that needed to be done was parsed and diluted across so many people that there was hardly any work to fill a full 8-hour workday. I recall missing a day of work once and forgetting to notify my boss (I had a midterm and was likely in some sort of panic mode). The next day as I walked in he greeted me by saying, "Hey! Nice job yesterday." He wasn't being sarcastic either. The amount of work to do was so minimal that my boss forgot (or didn't even notice) that I wasn't at the office.

I've read some articles recently stating that Netflix and Facebook experience increases in traffic during traditional work hours. It's an interesting data point. I think most jobs don't need to exist. They exist for a variety of reasons: signaling (the company must signal growth), incompetence, inefficiency, etc.

</comment><comment><USER3> it's always seemed to me that a likely endgame of automation is government bureaucracy continuing to make more and more busywork jobs in order to keep people doing something for their income. I think it's a more likely outcome (although distasteful to me, personally) than universal basic income, given historical political trends.

This is all assuming we'll reach a level of automation where the majority of humans don't actually have to work to produce goods.

<comment><USER4> I don't know how to say this lightly, but it seems to me that many of the "administration" type jobs have become this. Admin jobs seem to have proliferated most industries I can think of that otherwise may not need quite so many (medical, legal, financial, increasingly technical with some of the "Agile frameworks"). Most the of those are likely unnecessary, but they're there to supposedly abstract away some BS.

</comment></comment><comment><USER5> I dont think there is enough karma in the world to upvote this topic. I've seem it in every organisation I have worked at and scratch my head in wonder at the number of meetings, powerpoints and spreadsheets I see that achieve nothing.

To me it looks like a lot of the pointless jobs are formatting datasets that nobody reads</comment>


Show HN: TrackingTheTrackers – Is a website disguising its 3rd-party trackers? - <AUTHOR> https://trackingthetrackers.com/ <comment><USER2> From the site:

 _> While our analysis tool were not able to confirm that session cookies were sent as well, a long list of leaking cookies could mean that they would be. Anyone in possession of those cookies can impersonate you on that website — i.e., access your account._

I hadn't considered that before, but they're right, it's _extremely easy_ to accidentally leak session cookies through first party subdomains. I look forward to the inevitable conference talks that will be discussing this vulnerability.

</comment><comment><USER3> We now have trackers acting like first-party properties, but where do you draw the line between first-party and third-party? What I mean is, if I build my own in-house analytics app that does a lot of what Adobe's product does, should that be blocked too?

I specifically mean for site analytics, like Experience Cloud or GA, not serving ads. Ad block is different IMO.

If this is hosted on a first party subdomain you're already blocking the ability of it to set third-party cookies and track you across sites. So, in practical terms, what's the difference between this CNAME trick and building the same thing in-house to run your own analytics?

<comment><USER2> It depends on why you care about the distinction. If you're talking from a purely privacy perspective, the important questions are (1) are you taking analytics? (2) what are you doing with them? (3) is that in line with users' expectations?

Third party, or third party disguised as first party, is only problematic because of an implied "there's very little keeping the third party from using your data for things that aren't just analytics for the first party." It's the red flag for "this site may not be using your data the way you would want it to."

Third party ad trackers disguised as first party cookies specifically violate the general assumption that first party data stays first party, because those third parties have specific mechanisms to track you across multiple first parties.

<comment><USER4> > violate the general assumption that first party data stays first party

How? Because they can't do that with cookies.

I think the most prominent objection to 3rd party cookies is they allow systematic tracking. This seems like they just help eg apple or whomever understand what you're doing on that same site.

<comment><USER5> There are plenty of other ways to fingerprint a user. [https://amiunique.org/](https://amiunique.org/)

<comment><USER4> That really doesn't answer the question. Munchberry claims these analytics tools have cross domain tracking and I'm asking how, precisely. In part because of professional interest, and in part because I don't actually think it's true.

<comment><USER2> Thanks for getting my username right. ;)

You specifically got one detail wrong: it's not just for analytics tools. It's the adtech industry in general using this technique, and Adobe offers its analytics as part of its marketing software suite.

From their own site: " _What is Adobe Experience Cloud? It 's a collection of best-in-class solutions for marketing, analytics, advertising, and commerce._"

<comment><USER4> Apologies Munch _bunny_ , gonna blame that on a need for new glasses.

fwiw, Adobe Experience Cloud is generally not the sort of adtech that attempts to sell information.

<comment><USER2> You're right, Adobe Experience Cloud doesn't sell information, so how problematic you find the product depends on where you draw the line on privacy.

Specifically, Adobe Experience Cloud definitely offers retargeting capabilities (ads following you around the internet) and the ability to get statistics on the effectiveness of that advertising. If they're at parity with competing marketing suites, then they also have attribution capabilities to track you with per-user, per-interaction granularity.

A site that serves Adobe Experience Cloud cookies in the third-party- disguised-as-first-party way is likely enabling this capability for all marketers that are going through Adobe Experience Cloud. So the interesting question would be whether you, a visitor to Fox.com, consider being watched by marketers who aren't Fox.com to be a privacy problem.

<comment><USER4> All of the above is more private than eg google analytics because of the lack of cross domain tracking... I'd consider it a big improvement vis-a-vis google's product suite.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> A few websites that are disguising third-party trackers:

Fox News: [https://trackingthetrackers.com/site/foxnews.com](https://trackingthetrackers.com/site/foxnews.com)

CNN: [https://trackingthetrackers.com/site/cnn.com](https://trackingthetrackers.com/site/cnn.com)

BBC: [https://trackingthetrackers.com/site/bbc.co.uk](https://trackingthetrackers.com/site/bbc.co.uk)

WebMD: [https://trackingthetrackers.com/site/webmd.com](https://trackingthetrackers.com/site/webmd.com)

ESPN: [https://trackingthetrackers.com/site/espn.com](https://trackingthetrackers.com/site/espn.com)

Ars Technica: [https://trackingthetrackers.com/site/arstechnica.com](https://trackingthetrackers.com/site/arstechnica.com)

Go.com (Disney): [https://trackingthetrackers.com/site/go.com](https://trackingthetrackers.com/site/go.com)

Washington Post: [https://trackingthetrackers.com/site/washingtonpost.com](https://trackingthetrackers.com/site/washingtonpost.com)

Walmart: [https://trackingthetrackers.com/site/walmart.com](https://trackingthetrackers.com/site/walmart.com)

Weather.com: [https://trackingthetrackers.com/site/weather.com](https://trackingthetrackers.com/site/weather.com)

Apple: [https://trackingthetrackers.com/site/apple.com](https://trackingthetrackers.com/site/apple.com)

NFL: [https://trackingthetrackers.com/site/nfl.com](https://trackingthetrackers.com/site/nfl.com)

T-Mobile: [https://trackingthetrackers.com/site/t-mobile.com](https://trackingthetrackers.com/site/t-mobile.com)

State Farm: [https://trackingthetrackers.com/site/statefarm.com](https://trackingthetrackers.com/site/statefarm.com)

<comment><USER6> Seems like most of these use Adobe Experience Cloud. I'm guessing they offer some kind of HOWTO to set it up as disguised.

Good on Adobe for keeping it up. Flash wasn't enough to fuck the internet up for years.

<comment><AUTHOR> Yes, for Adobe Experience Cloud, see: [https://docs.adobe.com/content/help/en/core- services/interfa...](https://docs.adobe.com/content/help/en/core- services/interface/ec-cookies/cookies-first-party.html)

<comment><USER7> > In order to circumvent tracking limitations imposed by browsers and > programs, you can implement first-party cookies.

Well at least they're forthcoming about knowing they're intentionally circumventing users privacy settings.

</comment></comment></comment></comment><comment><USER8> So, other than simply not using the site, is there anything a user can do to avoid third-party tracking at sites like these?

<comment><USER9> NextDNS blocks those trackers, see: [https://medium.com/nextdns/nextdns-added- cname-uncloaking-su...](https://medium.com/nextdns/nextdns-added-cname- uncloaking-support-becomes-the-first-cross-platform-solution-to-the- problem-e3f437f84342)

<comment><USER10> That's like a tiny bandaid; in the next iteration they'll copy the A/AAAA records instead of CNAMEing them; that would make CNAME uncloaking useless _and_ save one DNS roundtrip reducing browser latency.

<comment><USER11> Without using CNAMEs the third party tracker IP addresses would be less dynamic making them easier to block with a firewall.

</comment></comment></comment></comment><comment><USER12> Back when I was working for a site on their first-party in-house analytics, the only blocker to catch it was [https://apps.apple.com/ca/app/better- blocker/id1080964978](https://apps.apple.com/ca/app/better- blocker/id1080964978) (Better blocker) and since then, I've been running it on my phone. Incidentally, it was not a fun job to have and I left shortly after.

Better blocker is by [https://ind.ie/](https://ind.ie/) and the rules are online at [https://better.fyi/](https://better.fyi/)

That said, it's not comprehensive, so I run it alongside another blocker that uses more traditional rule sources (1Blocker). I find that a diversity of rule sources and sometimes simply building rules manually for individual sites is required. I do think this kind of lookup/service is very useful though in advancing the state of tracker blocking. Next we'll probably have to do behavioural analysis until they move the trackers into site code or binary data flows of the rest of the site... there is a point at which you have to decide if it's worth putting up with tracking to use a site or service... as much as I dislike it. If it's integrated, at least it will be faster than third-party, I suppose.

</comment><comment><USER13> This tool is limited. It cannot be used to assess subdomains. For example, checking news.ycombinator.com redirects to checking ycombinator.com.

<comment><AUTHOR> Fixed, not sure why we did that in the first place.

[https://trackingthetrackers.com/site/news.ycombinator.com](https://trackingthetrackers.com/site/news.ycombinator.com)

<comment><USER13> Cool, fast update!

</comment></comment></comment><comment><USER14> What used to be the web is now a toxic wasteland filled with increasingly obnoxious advertising backed by increasingly creepy/ invasive tracking. This makes using tools like Apple's News App greatly more appealing to me personally.

</comment><comment><USER15> It has been known for quite some time that CDNs like akamai are basically 3rd party tracking mechanisms.

What's funny is they have basically gone 180 degrees from their original design.

Originally they were meant as caching mechanisms.

Now they are cache-busting tracking mechanisms.

</comment><comment><USER16> What if they have a tracking tracker buster?

<comment><AUTHOR> This is a v1 of our analyzer, but it's already doing a lot of things to mimic a real user (like using a real browser, moving the mouse, scrolling, etc.).

<comment><USER16> Lol sorry, didn't think this comment would be taken seriously, it's a reference from The Big Hit

[https://youtu.be/Iw3G80bplTg](https://youtu.be/Iw3G80bplTg)</comment></comment></comment>


Is the supremacy of object oriented programming coming to a close? - <AUTHOR> http://blog.objectmentor.com/articles/2009/04/20/is-the-supremacy-of-object-oriented-programming-over

<comment><USER2> "The ceremony of object wrappers doesn't carry its weight."

This nails it. I find so much of my programming now is shoving data into objects, only to almost immediately pull it out again into JSON, XML, HTML templates, or relational databases (in both directions). Most of the code in these "objects" are just getters, setters and member declarations, with very little in the way of actual logic. There is little point in having objects at all for this kind of programming, as opposed to a map, struct, or type class of some sort.

<comment><USER3> If you're just working by yourself, then by all means use whatever you want. If you're working on a multi-developer team, or someone else might have to work on or try to fix your code later, please use structured objects, not Maps.

The point of having named and typed member variables is that I actually know what's in there. I know that a User object has a displayName property, so I can use that. I know that the address property is actually a List of Address objects, not a string, and not a Map. And I can know this instantly using my IDE's auto-complete and tool-tips. It's also exposed via Javadoc, which means if your front-end team is writing the JSPs, they can just look at the Javadoc to know what they have access to, without bugging me every 10 seconds.

Not only do I know, but the compiler knows, and can let me know if I'm trying to access something that doesn't exist, or I typo'ed the name, or if I'm trying to treat a String like a Date.

If you're using a good IDE, creating the members and even getters and setters shouldn't take you much time at all, and will be well worth it in maintainability, compile-time checking, debugging, extensibility, etc...

<comment><USER2> "If you're using a good IDE, creating the members and even getters and setters shouldn't take you much time at all"

I don't totally disagree with what you say, but having your IDE auto-generate lots of code automatically for you gives me the heebie-jeebies.

The problem is that with a language as verbose as Java, you quickly have a bajillion files filled with far more characters than it should take just to define some property names and their types. Especially considering how having a public field in an object is a Java Mortal Sin.

I could go on, but Yegge has summed up the problems with generating mountains of code with an IDE, that then requires an IDE to move around, here:

<http://steve-yegge.blogspot.com/2007_12_01_archive.html>

</comment></comment></comment><comment><USER4> I largely agree with the author, but I think the reason for the "failure" of the object oriented model has more to do with the promises it made. Object Oriented Programing was supposed to make programming more understandable to the average human brain. In this respect, it's largely failed.

If functional programming is thriving, I feel that it's only because FP has been more honest with its goals, and has done a better job achieving them. FP is _supposed_ to be mathematical in nature. It's uncomfortable to learn, but once you do, FP languages, for the most part, live up to their billing.

What is really needed is a new paradigm that is what OOP was supposed to be: programming that matches the patterns of human thought. In this respect, I think the author's suggestion of OOP-style modularization with FP-style pattern matching and function mapping is the future of programming.

<comment><USER5> While I'll concede that OOP is not the be-all-and-end-all of programming paradigms, I have a hard time thinking of it as a failure.

It seems to me that since the advent of OOP hitting the mainstream, the world has seen more and better software than ever before, written by more people. So in what way is this a failure?

</comment></comment><comment><USER6> I don't think OOP is at an end. In fact, I think newer functional languages are giving it new life (and giving us alternative ways to use OOP). Consider clojure. It's fully object-oriented, but not in the traditional way (although you can still use Java objects).

</comment><comment><USER7> Object oriented programming has been a success, it's just not where people are looking for answers any more. The lifecycle for modestly successful technologies often goes like:

nobody understands it -> everybody scrambles to use it -> people start to get some benefit from it -> people overuse it -> people hate it and say it's dead -> people retreat to where it makes sense.

Objects are as dead as methods or loops. They're not super interesting anymore, they're just fixtures.

I agree that functional programming (while hardly new) will probably start to gain traction, similar to the cycle above. I think FP will also be a successful technology, eventually becoming a fixture in mainstream languages.

</comment><comment><USER8> You mean that real programmers have coded an Account class with a Withdraw method and a Balance property, like in OO for Dummies? Sure glad I'm not a real programmer then.

I wrote my first object oriented program a few years ago, and it seemed obvious that database fields would keep getting added, deleted and changed. My goal was to isolate this stuff from the rest of my program, not try to hardcode it everywhere.

I got a bit lost in all the buzzwords, but if that what his point, I agree.

</comment><comment><USER9> Objects as a language feature aren't going anywhere, nor should they. Like functions, they are simple, fundamental, versatile and work well with nearly every other language feature.

Object Oriented Programming, as an all-encompassing paradigm that will solve all your problems if you faithfully and blindly devote yourself to applying it, and only it, anywhere and everywhere that you possibly can, is dying.

Hopefully, the notion that such a paradigm can ever exist will die with it.

<comment><USER10> "X Uber Alles" Meta-Notion Considered Harmful!

(Also "X Considered Harmful" Considered Harmful!)

</comment></comment><comment><USER11> FP plus lighter and more dynamic objects doesn't sound like the end of OOP supremacy, but rather another stage of it. I'm curious to see where it leads / what comes out of it.

<comment><USER12> Also curious. Horizontal scaling, distribution, concurrency; that's where I see the tech heading. I think whatever will make those easier to deal with will have a huge advantage going forward.

</comment></comment><comment><USER13> The worst thing in the world is working with code written by an inexperienced programmer who thinks he has to use OO _everywhere_ for _everything_.

Same goes for table normalization.

One of the greatest things about experience is that you know when you should use the "proper" way of doing things and when you should make things work faster/better/more directly.

<comment><USER10> Funny that. If you use OO for everything in Smalltalk, often it's pretty. If you use OO for everything in, say, Perl 5, it feels quite cumbersome to me. (Ever meet one of those guys who uses one instance of polymorphism in their whole project and talks as if they've mastered OO?)

Look inside the Smalltalk image sometime. There is a clear attempt at OO _everywhere_ for _everything_ and it feels natural and unforced. (Well, it's about 70%, to be completely accurate, because there's also some functional and some OO newbie code in there.)

"proper" is all about cost/benefit tradeoffs, and it's very context-dependent. Expressing things polymorphically in an environment like Smalltalk, Python, or Ruby has low coding overhead.

Sometimes, it is just better to crank out an old-fashioned procedural routine and be done with it.

One of the key tradeoffs: Am I trapped, or will I be able to change my mind? So long as you can keep yourself from getting trapped, you're mostly safe.

</comment></comment><comment><USER14> The answer to this question depends on how you define OOP and FP. I think the answer is "sort of".

The problem with OOP is that it encourages the proliferation of mutable state. If each object has mutable state, then a large object-oriented program has distributed mutable state, potentially in hundreds of different silos. Problems like concurrency become impossible to reason about.

FP encourages the careful sequestration of mutable state. It's false to say that FP outlaws it entirely, since it's hard to do anything useful without side effects. However, functional style limits and sequesters mutable state to such a degree that it's usually easy to reason about what side effects are happening.

<comment><USER15> "The problem with OOP is that it encourages the proliferation of mutable state."

It should be pointed out that this is a characteristic of the languages and not actually OOP. The original insight, something like "Hey, let's bundle together data structures and their methods into one unit, and communicate with them via messages!" (which got turned into "method calls") actually has nothing to say about mutability. You can and people have build object systems based on immutable objects.

The implications of doing that are deep and profound and color the rest of the system and are beyond the scope of this posting, but it can be done.

<comment><USER14> This is a great point. Given how I tend to get annoyed when people reflexively associate static typing with Java, I shouldn't be so quick to make the leap from OOP to mutable state. Many OOP concents (e.g. inheritance) are mutability-agnostic.</comment></comment></comment>


Android 3.0: Hell Yes It's a Fork. But Who Cares? - <AUTHOR> http://www.zdnet.com/blog/perlow/android-30-hell-yes-its-a-fork-but-who-cares/15703?tag=nl.e539

<comment><USER2> Why every journalist paints google in gold and say that ONLY the evil operators add customizations to android?

I have a google phone and if I want to install from source I will miss several niceties that can't be added without closed google code. I will also have others niceties that are availabe to everyone but my google build

...lastly, try to uninstall amazon mp3 store from your GOOD google phone</comment>


How we overcame the security flaws of performing REST API calls in JavaScript - <AUTHOR> http://blog.algolia.com/handle-security-realtime-search/ <comment><USER2> Um, eek?

You can't safely use SHA256 in that construction. The hash is simply the value of the SHA256 internal state after the last block. An attacker can take that hash and resume "hashing" from that point, adding additional data to the original data.

That attack is called "length extension", and it's the reason we have the HMAC construction. Here, I think you want the HMAC-SHA256 of the filter and user ID, with the API key as the HMAC key.

<comment><AUTHOR> Thanks for the feedback guys, gonna edit the blog post and update our code. Having security gurus reading us is definitely a strength of HN!

</comment></comment><comment><USER3> I suggest you investigate oAuth instead of rolling something yourself. That's how Google, Facebook, and Twitter solve this problem. Pick whichever version suits your needs,

[http://oauth.net/core/1.0a/](http://oauth.net/core/1.0a/) (2009)

[http://oauth.net/2/](http://oauth.net/2/) (2012)

<comment><USER4> We care a lot about the simplicity of our API. oauth adds too much complexity and does not fit well our use case (we don't need authentication).

<comment><USER5> You don't need to authenticate. You can use OAuth for just authorization: [http://tools.ietf.org/html/rfc6749#section-1.3.2](http://tools.ietf.org/html/rfc6749#section-1.3.2)

<comment><USER4> But this would reduce the ease of use of the API, increase the latency because of round-trip and will not provide a better security. The fit is not very good.

oauth is a good standard when used for the correct use case, which is not the case for this. Sometime a simple solution is better than a framework

</comment></comment></comment></comment><comment><USER6> I just use the normal cookie sessions over HTTPS. Rolling your own encryption just seems like a bad idea, and I don't understand why people do it.

</comment><comment><USER7> I'd say that's what OAuth2, with its scoped access tokens, was made for.

</comment><comment><USER8> Sounds like this is not an _authentication_ but an _identification_ protocol applied for a very limited API calls rate-limiting use case. While there are some question about this use case as well (e.g. it there is a DOS attack possible against legitimate clients if the secured_api_key is leaked), it might be practical and acceptable in some limited set of cases.

The danger here is that the same protocol will be used for access control use cases for which it is not suitable (for a variety of reasons). A very good documentation (including thread modeling with attack vectors analysis) should be added to make sure this kind of mis-use does not occur. I would also change the title since it is too ambitious and misleading.

</comment><comment><USER9> Sounds like you've implemented a type of JWT: [http://openid.net/specs/draft- jones-json-web-token-07.html](http://openid.net/specs/draft-jones-json-web- token-07.html)

<comment><USER10> It does seem a bit odd - they say:

"Our backend checks if a query is legit by computing all the possible hashes using all your available API keys"

So why not just forget about the crypto (with all the risks of getting it wrong) and use an opaque bearer token?

<comment><USER11> If you want to validate a bearer token, multiple backends in different datacenters need to share a datastore that replicates at least somewhat fast. If you use HMAC-Signed URLS you just need to replicate the API keys that you use to calculate the token and the required guarantees are lower than for a bearer token. In principle, the method is sound - AWS uses a similar approach for signed URLs that allow access to S3 resources.

<comment><USER10> Yes - that makes sense - thanks.

I guess it's a question of where do you store application state - do it at the server and then you have to replicate the database that stores that state. Store session state at the client and pass it to the server means you can go to any data center at the potential risk of getting the security wrong.

</comment></comment></comment></comment><comment><USER5> This is what the implicit grant is for in OAuth: [http://tools.ietf.org/html/rfc6749#section-1.3.2](http://tools.ietf.org/html/rfc6749#section-1.3.2)

</comment><comment><USER12> I believe Keen.io does something very similar to this as well. iirc they use hashed API keys with some user ID in order to show user specific metrics.

I always thought there approach was interesting. Kudos for coming up with something very similar.

</comment><comment><USER13> read about: SHA1 HMAC

</comment><comment><USER14> Uh oh</comment>