I'm graduating with a CS degree but I don't feel like I know how to program. - <AUTHOR> http://stackoverflow.com/questions/2823571/im-graduating-with-a-computer-science-degree-but-i-dont-feel-like-i-know-how-to

<comment><USER2> No one's brought up _special sauce_. The trick to getting hired to do interesting software engineering work when you're not a brilliant programmer is to bring more than just programming skills to the table. I didn't start programming seriously until I was in college (TI-89s, LOGO and ActionScript don't really count). And I didn't even major in CS. But I took CS classes, and I learned some Bayesian statistics and some natural language processing and a little machine learning stuff, and I got hired right out of school as a software engineer doing analytics for a company with an information retrieval focus. And I realized that for most of the really interesting problems, just being a good programmer isn't enough. I have coworkers who are more talented programmers than I am. Some of them can code faster, or with fewer bugs or less thought. And I'm grateful to learn from them, and to become a better programmer fostered by an environment with some really good programmers. But the very best projects and problems need some additional creative spark, or mathy trick, or UI magic, or _something_ beyond just the code itself, and sometimes, I get to contribute that something.

So if I was in the OP's shoes (and I almost was, although I wasn't a bad programmer when I left school, just green), yes, learn to program and work on projects on your own. But also learn some stuff that your coworkers aren't likely to know. For me, it was just enough Bayesian stats and applications thereof to have insights that others wouldn't. For someone else, it might be distributed systems, or computer vision, or physical simulations, or information design, or algorithmic game theory, or fancy math, or any corner of the CS or math or statistics literature that has a pratical application but which most programmers don't know. I found that even good programmers won't generally know how to take the KL divergence between two distributions, or write the EM algorithm or put take the MAP estimate of a binomial rate parameter given a beta prior, but there are a lot of software applications for that kind of knowledge. And the world is _full_ of cool problems waiting to be solved by someone who knows how to program, but also knows something else.

</comment><comment><USER3> (To the author) You probably don't, and that's okay. The most valuable things I took away from my education experiences:

1) You've learned (or should have learned) how to learn new things. Don't stop once the dean hands you your degree.

2) There are probably a lot of people out there who are a lot smarter than you, and that's also okay. Use that knowledge to grow from your working relationships with others and learn more from them too.

Focus less on the individual technologies and more on the other skills learned via extended education.

Caveat: Lots of people don't need to pursue higher education to learn these things, it was just a necessary personal experience for me.

(edit) There's a post on SO by user RussellDias which puts this far more eloquently and fully than I could have.

<comment><USER4> Good comment here.

I came from the opposite end of the spectrum: started building "websites" with PHP and have grown to be a full fledged programmer in PHP, Python, Erlang, Scheme, and Objective-C. I quickly learned that my creations were sub-par and poorly engineered because of gaps in my knowledge of abstract concepts.

Learning about the Theory of Computation sky rocketed my skills, shoring up my mathematics education has also greatly augmented my understanding of _why_ certain things work and why certain things are a bad idea to do (even though you have the rope to do it!).

Knowledge truly is power, the rest of it you will gain through experience. The OP will quickly learn that he will be above those that did not get through a CS degree because he _does_ understand the minutia of the system and he will be able to understand the _engineering process_ with precision. Rather than "stabbing in the dark" as I see a lot of my peers doing - who did not even bother to at least _teach_ themselves the basics of computational theory, mathematics, &c...

You're on the right track my friend, as many have already said - just start getting some experience. The best route there, IMHO, is by contributing to Open Source Software; nothing taught me more about software engineering than slowly becoming a core developer for an OSS project!

<comment><USER5> I'm in a similar situation as when you started. I'm coming from a background in web programming and have been wanting to extend my understanding of computers in general and broaden my programming skill-set.

Are there any resources you can recommend in terms of "Theory of Computation"?

Greatly appreciated.

</comment></comment></comment><comment><USER6> It seems to me that people that really are meant to be programmers already started before college. At least that's been the case with guys I've worked with that actually knew what the hell they were doing.

No offense to this guy but the reality is, if you are not into this stuff before you started college (aka writing your own programs because a) it's cool, and b) you got tired of not having a program that did what you need, etc), then it's a pretty brutal career path.

Think about it this way, most good/great programmers are just coders because it's how they've always been. If you are just getting into this industry because it's a good career path then you have to realize you are going against guys like me who started programming the Atari 800 when I was a kid because, well it was fun and just seemed right.

I wish him luck, but this isn't 1998 any more and companies aren't going to just hire you off the street just because you have a CS degree. The competition level for jobs right now is higher than it's been for a long time. With that said, he can certainly make this work, he just needs to start coding on his own to learn and grow.

<comment><USER7> Some of the best programmers i've worked with were weird dudes who learned how to program in college.

Starting early doesn't mean you're any good. 4 years of a serious, programming intensive CS degree is better training than 20 years of farting around with PHP.

We don't apply this criteria to other endeavors. I've been playing piano since I was 5 and I'm still not good at it. You're either good or your're not. Sometimes experience helps, sometimes it is a hindrance. Bad habits form early, too.

It's also curious that programmers claim that programming since they were a kid makes them a better programmer, but they also complain whenever a job advertisement requires years of experience.

<comment><USER6> "4 years of a serious, programming intensive CS degree is better training than 20 years of farting around with PHP."

That's really funny and true.

Yeah, agreed, I know plenty of CS degree holders that are top notch coders as well. But I have to say, I don't think a single one of them hadn't learned a language or two prior to college and I doubt they ever thought for a second 'I'm not sure how to program'.

<comment><USER8> I thought C was totally terrifying and confusing for the longest time. I started in Visual Basic because it had WSYWIG forms, and I just couldn't imagine how someone would programmatically construct an interface. Feeling like you have no idea where to start is completely legitimate. I eventually faced it, though, and got through it. Of course, I was 11 or 12 at the time, but still.

<comment><USER9> You were unlucky, I went the other way. I did start on basic on my Z80 machine, but since you could only really write adventure games with basic, I moved onto Z80 assembly language. Then, I moved onto x86 assembly language.

Every from that point has been easier, in most ways.

I was lucky, everyone of my friends had a C64, and they were swapping games. We couldn't afford a C64 at AU$399 at the time, so they got me the VZ300 for $99. I had to write my own games. This is how I got into development.

I was one of the few that could program, before I went to Uni. It was around the time that CS was becoming very popular, but hadn't start to differentiate between different sorts of IT, so they offered everything. The classes I found best were hardware, OS, and the half year class were we had to write the same program in 4 different languages.

<comment><USER10> Hah, that makes two of us! Except iI didn't have the luxury of a Z80, I started on an 8080 that didn't even run CP/M... Ahhh the Compulcolor II, what a fine machine you were. At least you made me learn how a computer works.

I still remember how good it felt when my brother started loading up the games that I wrote rather than the few 'commercial' games that we had for the system.

PS: VZ300??? I thought I knew _everything_ about the Australian 8-bit computer scene, but I managed to miss that one.

<comment><USER9> The VZ300 was made by Dick Smith, a successor to the VZ200. It had a huge hacker user community, their were program listings and hardware mods in APC magazine. After the VZ line, Dick smith bought out there CAT computer line, which were much more powerful, and more expensive.

Great little machine for $100. Funny thing, the VZ200 had a chiklet keyboard, which are becomming popular again. One of the big selling points of the VZ300 was that it had a proper keyboard.

[http://www.old-computers.com/museum/computer.asp?st=1&c=...](http://www.old- computers.com/museum/computer.asp?st=1&c=980)

To do Assembly language programming I had to get the 16KB upgrade kit, which was this huge piece of hardware that stuck in the back.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Well, what did you except out of a CS (== computer _science_ ) degree?

If you want to be a great software developer, then you should (1) major in CS and (2) learn how to program. These are usually two separate but mutually beneficial things.

<comment><USER12> It's funny, because the situation we're in right now (at least in the US) does neither really well.

On the one hand, hardcore theoretical courses at the average CS school don't exist as weed-out at all. If you're lucky, you've got a good faculty member teaching a compilers or operating systems course that'll make it challenging, but only sometimes. Teaching things like Haskell, The Lambda Calculus, Prolog, Complexity Theory and C are "impractical" for someone doing a CS degree, because, you know, everyone uses "OO" (whatever that means) nowadays so that's the theory we should teach. Plus, if we teach a hard course about the theory of computation, lots of kids will flunk, and we can't have that, now can we?

On the other hand, any attempt to make the curriculum practical (since most schools border on vocational training anyway) is met with the response of "Well, a CS degree shouldn't prepare you to be an industry programmer!"

So really, most universities are left in a luke-warm middle-ground, where theory is being neglected but no one is willing to be the administrator who "flips the switch" and turns CS students into non-stop code monkeys.

Really, grounding yourself in a lot of CS theory, while occasionally forcing yourself to break out and hack up a project, is probably the best route to becoming a well-rounded programmer. Whether most people are capable of realizing how bad current CS education is and doing so, however, is another matter.

<comment><USER13> _On the one hand, hardcore theoretical courses at the average CS school don't exist as weed-out at all. If you're lucky, you've got a good faculty member teaching a compilers or operating systems course that'll make it challenging, but only sometimes. Teaching things like Haskell, The Lambda Calculus, Prolog, Complexity Theory and C are "impractical" for someone doing a CS degree, because, you know, everyone uses "OO" (whatever that means) nowadays so that's the theory we should teach. Plus, if we teach a hard course about the theory of computation, lots of kids will flunk, and we can't have that, now can we?_

Agreed for most schools but I will say that there are good schools that still teach at that level. The Intro to Programming Languages class at Northwestern has you implement an interpreter for a variety of different languages, including a variant of Scheme called Typed PLAI. Haskell was used as an example sometimes and we implemented a number of similar features (basic type checking, currying, etc.). I know that the operating system and compilers courses here are very difficult and have heard similar things about the corresponding classes at CMU.

<comment><USER14> Agree. I'm about to graduate from CMU, and their OS class was an _extremely_ rewarding experience. I've heard similar things about their compilers class.

The required intro classes are also pretty rigorous, although I didn't take them personally. I'd bet that any CMU CS (note that engineering is a very separate program at CMU) grad would at least somewhat know how to program, and will have programmed in assembly and ML, along with the usual Java and C. Obviously you have to check whether they got C's in the big rigorous classes or not, but it's basically a good bar. It would be impossible to graduate and then fail FizzBuzz, for example, which to my understanding is not true of most CS programs.

The one main complaint I had with it was that the required freshman theory course (251), which is supposed to be this great legendary weed-out thing, was just a hodgepodge of badly specified discrete math, and still is, to my knowledge. It was hard, but in my opinion not in a good way. Maybe it works as a weed-out but not as an educational tool. The later required algorithms course, 451, was much better.

</comment></comment></comment></comment><comment><USER15> Here is a major trick to life that most engineers don't realize.

MOST college degrees are essentially useless. There are hundreds of jobs out there that don't require programming or a specific college degree. There is no reason to let your degree pigeon-hole you into a career path.

If you're asking for my advice, I honestly don't feel like you're going to cut it as a programmer. Sorry kid. A true hacker is going to run circles around you and you'll most likely not be able to compete if you aren't competitive after college.

With that being said, LIFE IS NOT OVER. Find a job that you like. Most people respect those that are able to complete a computer science degree and will hire you into a huge array of jobs (financial analysts, consulting, i-banking, technical sales, etc.)

</comment><comment><USER16> CS isn't a degree that teaches you how to program. For me it was much more like a discrete mathematics degree. I learned probably hundreds of algorithms (compression, cryptography, 3D rendering, AI), how to analyze and create new algorithms, but not how to program (except in the typical CS101 courses).

It was always assumed that any student could learn the language of their choice from an off-the-shelf book. I myself knew about half a dozen languages and mastered a couple before I graduated, but that was all extra-curricular work. In many ways I'd probably be a better developer if I obtained a Software Engineering degree instead, but CS gave me the foundation to tackle the interesting computational problems.

The professors knew they would be much more valuable explaining how RSA worked than how to debug a syntax error or learn the language of the month.

<comment><USER17> Programming requires a lot more than learning the syntax and semantics of a programming language.

Most CS profs don't teach programming because they don't have anything interesting to say and would rather teach something else. They are not programmers.

<comment><USER13> _Most CS profs don't teach programming because they don't have anything interesting to say and would rather teach something else. They are not programmers._

I feel this is slightly hyperbolic. CS often isn't a productless field, even in academia. While many fields in CS can get away with simply publishing algorithms and other codeless papers there are many subsections where implementation is a vital part of the project. For example, the Xen project was originally an open source academic project.

I think the biggest problem in academia is the tight schedule. Unfortunately, many of the problems you encounter in industry take too long to be properly implemented in the structure of a semester course. For example, long-term maintenance and technical documentation are at the core of any significant software project but by the time most of that stuff would come up the semester is already over.

</comment></comment></comment><comment><USER18> The first step in becoming an excellent programmer is realizing that you aren't one already.

Your question shows that you're probably one step ahead of your classmates.

You will always be learning and always be working hard (hopefully). It doesn't really get that much easier, but it does become a lot more fun and rewarding.

You'll be fine. Thanks for the post.

<comment><USER19> That's excellent advice.

Being weak in algorithms means that the author wouldn't be able to get in the door at amazon (which loves its juniors), but IMO that's a good thing, because I'd never want to work with someone who learned how to develop "production" software at amazon. (It was some of the worst code I'd ever seen -- and I went to amazon after over six years of government contractor work.)

<comment><USER20> I'm sure I can one up you with the kind of code that goes into a trading system.

I think production code in any realtime environment, whether it be at Amazon or a trading desk at a bank, tends to converge towards crap just because of the time pressure on the developers.

<comment><USER19> You're probably right. So far in my experience, that's pretty prevalent -- and the industry really does go out of its way to reward failure by rewarding heroics.

I read a bank security audit report once... it made me very concerned about banking in general. It was astonishing how many glaring security blunders these banks were making -- and this was pervasive, neither isolated nor limited to small banks...

</comment></comment></comment></comment><comment><USER21> You don't. No worries there, you're just starting. Find something that inspires you and write code around that (do it in your favorite language or use it as an excuse to learn a language). Do a small project, do many small projects, do projects with friends. Read code - grok some of those libraries you're gluing together. Read about coding (O'Reilly's 'Beautiful...' series is great). If you enjoy programming, it'll come together. Keep the beginners' mind forever.

<comment><USER22> I think getting your hands dirty with _something you are interested in_ is the key here. Too many classes in "software engineering" deal with contrived examples built around concepts you are "supposed to be learning." More freeform projects allow you to become invested in what you are doing and accelerate your learning.

</comment></comment><comment><USER23> That's the difference between education and training. Computer science is supposed to teach you the science of computing - it's not supposed to be a training course teaching you job skills. Once you graduate that's only the beginning, not the end, of learning about programming languages.

</comment><comment><USER24> Honestly, it seems the dude could figure out how to write 75% of a hacker news type site. Honestly I'd say the markup and scaling aren't really needed for basic anything. He might not understand cookies, etc, yet, but still he'd get most of it out there.

</comment><comment><USER25> Just about everything I've learned since graduating college is summed up in this web page (which I did not write -- but found recently). Enjoy!

<http://samizdat.mines.edu/howto/HowToBeAProgrammer.html>

<comment><USER26> I also like this page for evaluating where you might stack up against other candidates.

[http://www.indiangeek.net/wp- content/uploads/Programmer%20co...](http://www.indiangeek.net/wp- content/uploads/Programmer%20competency%20matrix.htm)

<comment><USER27> I rated myself "2" on each category on average... Will I be able to find a job?

</comment></comment></comment><comment><USER28> I do have a problem which goes into this direction. Although I can code some simple programs, I have no clue how and where to start something bigger, like a social media platform. I don't know what part would be backend and frontend and where I should start first.

<comment><USER29> This is a good description of my position as well. Unfortunately it seems like this is something that does not get taught at schools much, and I will admit to having been trying to learn everything from school when I should be doing more independent work. Does anyone know any useful resources on how to proceed from this point? Or does it require just working on a larger-scale project and figuring things out along the way?

<comment><USER27> To understand it all.. Just try starting a project yourself, and learn to google. :) Start with something simple like writing a blog where people can log in and post comments.

</comment></comment></comment><comment><USER30> You need to get your hands _dirty_ asap. Start with something small and grow big as fast as you can.

</comment><comment><USER31> You have no idea how common the reality of CS graduates who just don't know how to program is...

<comment><USER32> I see people coming in with 2 year degrees from community colleges, who can outgun 4-year CS graduates. The ones who can pull this off tend to be genuine hackers, who have a passion for what they are doing.

<comment><USER22> A little perspective from a junior in EECS at MIT who is also concerned about leaving college as a competent software engineer.

In most software jobs, practical experience outweighs theoretical knowledge. I would guess that the people from 2 year degrees spend a lot of their time actually programming, whereas those with the 4 year CS spend a lot of their time learning about computer science.

At MIT and there is really only one software design class you need to take for a CS degree. It is expected that to learn to program you need to do it by hacking around on your own or working at software companies during the summer.

I've found that there is a significant group of CS majors at MIT (myself included) that are more interested in the cool things that can come out of theory (and eventually programming those things) than in programming itself.

I would be bored out of my mind gluing libraries together to write a chat program, for example. While I find the process of designing/building/tinkering with _anything_ exciting and fun, I am simply not that interested in chat programs. I'm not even that interested in computers! To me, the freedom to explore my interests related to computing and computer science, without being pigeonholed into a "standard" computer science curriculum is fantastic.

Hence, I've spent more of my time learning about interesting topics in computer science and math than I've actually spent coding. And I've spent even less time designing software (as opposed to just coding on various simulations/algorithms/mini-projects).

To echo what someone else said, yes, genuine hackers my age will probably code circles around me when it comes to programming. But we're probably not even interested in the same kinds of jobs.

I am not saying software engineering is not important -- it's simply taking me longer to become competent at it (or at least "employable") because I'm trying to combine it with other interests.</comment></comment></comment>


Show HN: Doc42 – Simple documentation tool - <AUTHOR> http://doc42.io/ <comment><USER2> Thanks for sharing. However, this looks like a theme template for Jekyll more than a standalone tool. Perhaps I'm missing something?

What are the benefits of using this over MkDocs or Sphinx? MkDocs ([http://mkdocs.org](http://mkdocs.org)) definitely appears to be lightyears ahead in simplicity with a YAML TOC and much simpler creation of page content.

<comment><AUTHOR> Yes and no. It's not exactly a template for that. Actually, I have added a UI framework + some built in components and pages. E.g. the sidebar the generates the page of content.

Actually, I have customized Jekyll to use as a documentation tool.

</comment></comment><comment><USER3> Echoing another comment- this is strikingly close to a jekyll theme; I see there's some custom work in there.

That said, really beautiful work. It's funny, I was working out whether I could use Jekyll collections for a documentation project today, and now here is this project. Fantastic!</comment>


Ask HN: How do you manage multiple project commitments? - <AUTHOR> What methods have you developed to manage your commitments when they span multiple projects over several years? For instance, do you have any tool that helps you to see upcoming milestones or releases across 6 different products/efforts? I need to better manage my commitment level and am looking for help. The best I have done so far is put together a very self-oriented Gantt chart and maintain it, but it is not very ergonomic. Thanks HN! <comment><USER2> Story of my life. At the moment I have 10+ projects (due the nature of my role). I make it work with a pen and a pad of paper.

Every couple of days I go through and clean everything up, it helps to keep everything top of mind. So in that way the lack of ergonomics is a feature, not a bug.</comment>


Programming Notes for Professionals books - <AUTHOR> http://goalkicker.com/ <comment><USER2> Very well done. I think the production pipeline is fully automated, including the cover. This is a very nice use of the CC BY licensed Stack Overflow content.

</comment><comment><USER3> Very cool — at first glance these docs are great. How are they generated?

<comment><USER4> If you go to the bottom of the page for any book (well, I only sampled a few so "any" may be exaggerated), it says:

"The [LANGUAGE] Notes for Professionals book is compiled from Stack Overflow Documentation, the content is written by the beautiful people at Stack Overflow."

<comment><USER3> Ah that makes sense. I glossed over "Documentation" originally, so I thought it was somehow cleaned up from vanilla Stack Overflow answers. Was wondering how that cleanup got done

</comment></comment></comment><comment><USER5> I found some of these pretty handy, as someone still-kinda-learning the language I'm writing a project in.

</comment><comment><USER6> Python book covers pygame but not NumPy ?</comment>


Show HN: Custom beauty bars, made just for your skin - <AUTHOR> https://bysaras.com/ <comment><AUTHOR> Please provide us any feedback that you have on the UI or experience so we can improve =)</comment>


Coffee Joulies - <AUTHOR> http://www.joulies.com/

<comment><USER2> Noted iOS developer and general coffee freak Marco Arment thoroughly (1200+ words) reviewed these once on his blog. Conclusion: they don't work.

<http://www.marco.org/2011/08/10/coffee-joulies-review>

</comment><comment><USER3> This feels like spam, but anyway I actually have these. They don't work as advertised sadly. I put a temp sensor on the cup and the temperature curve didn't look any different than without the joulies.

</comment><comment><USER4> I'm one of the original kickstarter contributor of coffee joulies. For me, it does work. Coffee came out of my keurig brewer are at drinkable temperate immediately. But I'm not sure if it can hold temperature longer. I guess I'm just using it a ice cubes without diluting the coffee and also not accidentally making it too cold</comment>


Why Telling a Story is the Most Powerful Way to Activate Our Brains - <AUTHOR> http://lifehacker.com/5965703/the-science-of-storytelling-why-telling-a-story-is-the-most-powerful-way-to-activate-our-brains

<comment><USER2> I've been trying to learn a lot about investment finance in the last 18 months. I find that I probably learn more from light, non fiction texts like Barbarians at the Gate and Liar's Poker. Why? Because all the strange abstractions of finance are easier to grasp when you have a sense for why they needed to be created. You get the story behind them.

</comment><comment><USER3> Sometime I'm going to write a piece "Why you should not follow links that include the word 'brain'".

<comment><USER4> That'd really block away the potential cognitive interest, wouldn't it? At least you could name it like "Why this is the last link you will follow that contains the word 'brain'."

</comment></comment><comment><USER5> Wired for Story: The Writer's Guide to Using Brain Science to Hook Readers from the Very First Sentence:

[http://www.amazon.com/Wired-Story-Writers-Science- Sentence/d...](http://www.amazon.com/Wired-Story-Writers-Science- Sentence/dp/1607742454)

<comment><USER6> Ugh. I got into a spirited disagreement on HN a few months back sparked by how much I hate when magazines like _Wired_ feel the need to entice me to read something mildly analytic by interweaving it with a human story. The author can't just talk about a law and its potential for unintended consequences, or even just the law and specific examples of people it hurt. He had to tell me a full narrative about Bob Jones and his green bicycle that means so much to him and the overcast clouds on the fateful day he had his front tire stolen when he was already late for work! I find myself skipping from paragraph to paragraph looking for actual analysis.

</comment></comment><comment><USER7> If you're selling a product, is it best to tell a story of why it's useful or just to show what it does and let the product do the talking?

Personally, if I go to a site and I have to sign in/up to get to the application, then I'm less likely to do it than if I was immediately logged into a guest account, perhaps with some pointer bubbles explaining what to do/what you can do.

</comment><comment><USER4> I'm pretty sure that there are harmful and undesired things that activate the brain too, so I'm not sure that activating the brain is the ultimate goal.

Why not concentrate on why stories are powerful? E.g. exploring their strength of making connections and emotions...

</comment><comment><USER8> Google does this quite frequently with their commercials for products like Google Hangout, search, e-mail, calendar, and more.

They seem to show ways on how to use the service rather then telling you all the stats about it.

</comment><comment><USER9> Anybody got a good "storytelling for dummies" reference? Thanks!</comment>


David Salomon: Biographies in Data Compression [pdf] - <AUTHOR> http://www.davidsalomon.name/DCBiog/BiogDComp.pdf

<comment><AUTHOR> From the book web page:

<http://www.davidsalomon.name/DCBiog/DCbiog.html>

This is the website of the "Biographies in Data Compression" project. The idea is to have a free Ebook with biographies of people active in the vast, fascinating field of data compression. Anyone even remotely associated with data compression may have heard the names Huffman, Ziv, Lempel, Elias, Shannon, Fano, Rice, and others. Who are (were?) those people? What backgrounds did they come from? What were their principal achievements? What did they look like? If you have ever asked such questions, why not join this project? All it takes is for you to download the current edition of the book, browse it, and then submit your biography to the address below and wait for it to be included in the next edition of the book.</comment>


Hacking the Twitter API: Bet Your Followers  - <AUTHOR> http://betyourfollowers.com/

<comment><USER2> Call me stupid but after 5 minutes on their website I still didn't really 'get' it.

<comment><USER3> Followers are currency on twitter for a lot of people - you don't have any real relationship with them, just having many of them increases your swagger. So, play a silly game using your followers as play money - if we play and I win, they end up following me instead of you. If you played carefully and diligently enough, I suppose you could end up having more followers than (someone famous), all of whom are following you with no real idea why.

It's silly, and it pretty much says to your followers that you consider them disposable minions, fit for nothing more than to be wagered away in games of chance, because you are such a badass. Inexplicably, many people find this exciting and admirable, at least as long as you keep winning.

As you can probably gues, I like it...in fact this strikes me as a good reason to spend more time on Twitter. I guess it appeals to the unfulfilled megalomaniac in me :)

<comment><USER4> I don't get how it works technically. How can they make people follow and unfollow other people?

<comment><USER5> The website requests that you connect them to your Twitter account using OAuth.

<comment><USER4> Yes, but that would only enable them to make YOU follow and unfollow other people. How can they make people who might never have heard of the app follow and unfollow?

</comment></comment></comment></comment></comment><comment><USER6> Has anybody tried it? How does it work?</comment>


ICANN't approve the sale of .org to private equity - <AUTHOR> https://www.theregister.co.uk/2020/01/31/icann_dot_org_sale/ <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=22205001](https://news.ycombinator.com/item?id=22205001)

</comment><comment><USER3> This whole saga unfolding makes me think of a smaller scale drama thing that illustrates some of what feels so surreal about it to me.

Recently, the subreddit r/pokemonswordandshield had a meltdown where, allegedly, the "owner" of the sub and related discord server was seeking to sell them in secret. I don't know all the ins and outs of how or why that would work, but the idea failed in any case because the mods rebelled and took the community with them.

I can't help but wonder though - if the sale actually did go through, isn't it now worthless? And isn't the .org situation very similar in that the only value it ever had was the community believing in the integrity of the product? Like in the small case, if the sale itself alienates the community enough it makes the thing sold toxic. Browser companies could, for example, choose to replace ICANN's role as authority for .org domains and make that $1.1B purchase worthless. In light of that risk, is $1.1B a sane price now after the uproar?

</comment><comment><USER4> This is a poor and confusing title imo.

<comment><USER5> What is confusing about it? It's clever and punny

<comment><USER6> Immediately obvious it's probably a pun but as a native English speaker, I can't tell if it's: \- a blog author saying they personally can't support the sale, calling out icann who presumably sold it \- icann just approved it ('t typo) \- icann can't approve it (legally or something) \- icann won't approve it

<comment><USER7> Ambiguity

Is the death of your software

And the soul of humor</comment></comment></comment></comment>


Going to be releasing our first app soon – what don't I know? - <AUTHOR>

We're releasing our first iOS/ Android app in around two weeks and I'm fretting about all the stuff we may not yet know.
Any suggestions on the kinds of things we need to bear in mind that are NOT obvious? Things like app store submission gotchas, failing to add analytics until it's too late or claiming that Kashmir definitively belongs to Pakistan when shipping in India (http://www.cnet.com/news/how-eight-pixels-cost-microsoft-millions/)
I'd love to hear any stories you may have. <comment><USER2> If you use an API or some backend for the app, be sure that you covered all bottlenecks and that you can scale.</comment>


Signing .jars is not worth the effort - <AUTHOR> https://quanttype.net/posts/2020-07-26-signing-jars-is-worthless.html <comment><USER2> A solution I am working on for these sorts of software supply chain attacks uses transparency logs. Take a look here (warning, __alpha __):[https://github.com/transparencylog/btget](https://github.com/transparencylog/btget)

Essentially the binary transparency log acts like a notary service. It appends the cryptographic digest of a URL to an append only log. The append only log cannot be rewound without detection by clients. And clients verify the contents they receive against the entry in the log.

Two nice properties for the issues outlined in this post:

1\. Hosting providers (or third parties) can add this sort of log without needing developers to do things like manage key material or 2FA tokens 2\. It is complementary to good upload authentication or signing systems

In fact, Go is using transparency logs for source libraries. I think similar systems should be used for binaries in all other language ecosystems as well.

I would love to see a world where major source code distributions start running transparency log servers as part of their own file host integrity protections. Imagine maven, github, npm, etc all running these sorts of services for all uploads and using them by default in their clients. Users would have additional confidence that the v0.4.3 package they downloaded to their system two weeks ago is the same one their colleague got or the CI/CD system got.

<comment><USER3> Some time ago I made a fun hack where I abuse the Go transparency log to store immutable url->fingerprint mappings of arbitrary urls:

[https://github.com/mkmik/getsum](https://github.com/mkmik/getsum)

Example:

        $ getsum https://github.com/bazelbuild/bazel/releases/download/3.4.1/bazel-3.4.1-installer-linux-x86_64.sh
        9808adad931ac652e8ff5022a74507c532250c2091d21d6aebc7064573669cc5

now, if somebody ever replaces that file on github, getsum will fail with an error.

(I was too lazy to make getsum actually download the file if the checksum matches, but that should be trivial; for now just do "getsum $url && wget $url").

This works by creating synthetic Go modules that embed "facts" about URLs inside generated Go code, which gets then downloaded by getsum and parsed using the stdlib "go/parser" package. Since all Go modules are recorded in the Go "sumdb" public transparency log, once this module has been generated it cannot ever change. (Getsum uses a constant "version" for the synthetic packages, thus facts are immutable).

I'm confident this works because it piggy-backs on the stable production transparent logs infrastructure of a high-profile project managed by a high- profile company. On the other hand the Go transparency logs admins could ban my "getsum.pub" domain if the generated traffic bothers them. This was for me just a quick way to show to some colleagues the potentials of transparency logs etc, and of course to have fun.

<comment><USER4> > (I was too lazy to make getsum actually download the file if the checksum > matches, but that should be trivial; for now just do "getsum $url && wget > $url").

Please don't. Instead check the hash of the local file. A malicious server could serve a different file for getsum and for wget (bonus point: you won't have to download it twice)

<comment><USER3> yes that's indeed a problem that needs to be dealt with.

That said, technically the getsum client doesn't download the file; it only fetches "$url.sha256" if present or a "SHA256SUMS" in the same directory and compares that with the one stored in the transparency log.

It follows a common pattern on release sites (such as major projects on github).

In other words getsum only ensures that the checksum file itself is immutable, and the checksum file then is used to ensure that bigger file also hasn't changed. The reason for that lies in the fact that getsum has a server side component (hosted on getsum.pub) that serves the Go modules fetched by the Go sumdb.

Thus, the correct instructions are:

        $ (echo -n $(getsum https://github.com/bazelbuild/bazel/releases/download/3.4.1/bazel-3.4.1-installer-linux-x86_64.sh); echo " bazel-3.4.1-installer-linux-x86_64.sh") > bazel-3.4.1-installer-linux-x86_64.sh.sha256 && wget https://github.com/bazelbuild/bazel/releases/download/3.4.1/bazel-3.4.1-installer-linux-x86_64.sh && sha256sum -c bazel-3.4.1-installer-linux-x86_64.sh.sha256

Big file downloaders tend to be more complicated than expected; progress bars, resuming downloads etc etc. Perhaps getsum instead of downloading the file it could verify the file? E.g.:

        $ wget https://github.com/bazelbuild/bazel/releases/download/3.4.1/bazel-3.4.1-installer-linux-x86_64.sh && getsum -c bazel-3.4.1-installer-linux-x86_64.sh https://github.com/bazelbuild/bazel/releases/download/3.4.1/bazel-3.4.1-installer-linux-x86_64.sh

EDIT: just implemented the "-c" flag described above

</comment></comment></comment></comment><comment><USER5> Here's an aside / funny thing about jar signing on blurays. The Blu-Ray spec only really enforces jar certificate verification for encrypted blurays (i.e. AACS). non AACS blurays (i.e. decrypted), ignore the certificate chain. i.e. a self signed certificate that uses its own key to sign the jars works fine per the spec.

The only reason people can take blurays (with java menus) and make them reliably playable when decrypted (in real players, ignoring things like VLC which can easily ignore the cert chain) is because the bluray spec tells them to explicitly ignore the certificate chain. This enables decryption programs to rewrite the java bytecode (and resign the jar's with a self signed certificate) removing any protection mechanisms (think screenpass) that are in the java code itself.

While I sort of understand the reason for it (you want to be able to test discs before mastering without encryption and without the need for signing), it really killed what could have been an effective security model. Basically the standard strong security vs convenience dilemma.

<comment><USER6> I half suspect they do things like that on purpose, because the alternative is to create demand for players that disregard the restrictions, and by that point they're also going to disregard all of the other ones and let the user fast forward through commercials etc.

So if they let the thing they don't want people to do be hard but not too hard, it satisfies demand from the people determined to do it instead of creating a market to solve the problem which would make it _more_ convenient.

<comment><USER5> I don't know. perhaps, but they've shown a large willingness to force the hardware players to enforce security mechanisms that can't really be avoided nicely (ex: cinavia, there are ways to avoid it, but very few on disc based players)

</comment></comment></comment><comment><USER7> I've thought this about Maven Central before (not familiar with Leiningen, but it seems it's trying to do a similar thing).

Maven Central has PGP signatures for all uploaded artifacts - but they are in fact useless, because anyone can create a PGP key that claims to be (say) firstname.lastname@example.com and upload that to a keyserver. There appears to be no mechanism by which a consumer can know whether the signing key should be trusted, so an attacker uploading a malicious artifact can easily upload a malicious signature with it.

I'm not going to argue with any of the criticisms of PGP in the linked article, but they don't seem hugely relevant to the problem here; the fundamental trust problem is much deeper than "GPG has janky code" (and it's not like there aren't any other options at all).

<comment><USER8> Maven central will let you sign artifacts with any published key you like, but one thing you can do in theory, is verify that new releases are signed by the same key as a known good release. I am not aware of anyone actually doing this though.

<comment><USER9> That approach is still vulnerable to what amounts to a MITM attach: a bad actor can simply provide the legitimate versions for whatever period he deems required to build trust.

</comment></comment></comment><comment><USER10> > As far as I know, nobody ever verifies the signatures in a systematic way.

If you'll forgive a semi-relevant ramble about SSH:

The situation seems similar with SSH. As far as I can tell, just about everyone goes with the approach of trust-blindly-on-first-use. I've made a habit of manually checking the public-key when I SSH into a new EC2 instance using PuTTY. It is not obvious how to do this. Existing tooling just isn't set up with it in mind.

The fingerprint reported on the EC2 system-log uses a different hash function than PuTTY uses. (This is PuTTY's fault. It's behind OpenSSH.) I was able to get an answer on ServerFault, but I was surprised no-one had asked the question before. [0]

With some lesser-known distros it seems to be outright impossible, as the fingerprint is not written to the system-log at all. Presumably the distro maintainers never check SSH fingerprints.

Still less relevantly: the trust-blindly-on-first-use antipattern is known euphemistically as _TOFU_ , for _trust on first use_. This term can also refer to where the public key is manually verified by the user on first use. [1] Very unhelpful for a term-of-art to be so ambiguous.

[0] [https://serverfault.com/q/996828/](https://serverfault.com/q/996828/)

[1] [https://en.wikipedia.org/wiki/Trust_on_first_use](https://en.wikipedia.org/wiki/Trust_on_first_use)

<comment><USER11> SSH certificates avoid this issue and are used in real life. We make them with hashicorp vault, it works well and is really convenient.

<comment><USER12> Huh, I had no idea there was even such a thing as SSH certificates!

Presuming you mean X.509 certificates, is this part of the standard spec (e.g. should work with OpenSSH etc)? Do you know if it works with PuTTY?

<comment><USER13> Here is a guide I've found useful in the subject, [https://engineering.fb.com/security/scalable-and-secure- acce...](https://engineering.fb.com/security/scalable-and-secure-access-with- ssh/).

</comment></comment></comment></comment><comment><USER14> Java applets are largely dead at this point but they do still exist in small corners of the IE world. Signing those jars is paramount and the signature is validated by the browser.

<comment><USER15> "Java Web Start" still exists and there are at least two programs I use from time to time based on that technology. One being a custom thing, the other openstreetmap editor jOSM.

<comment><USER16> > "Java Web Start" still exists

I'm afraid it's been dead for a while now.

> Java Web Start (JWS) was deprecated in Java 9, and starting with Java 11, > Oracle removed JWS from their JDK distributions.

[https://openwebstart.com/](https://openwebstart.com/)

<comment><USER17> Just because its depricated doesn't mean it is unused.

People still use Python 2.7.

<comment><USER16> It's not deprecated - it _was_ deprecated and now it's completely gone.

Like Python 2.7, you can now only get support for JWS if you pay or if you go through a third-party.

If you're still using it I recommend you get off fast.

<comment><USER18> > now it's completely gone.

...From newer versions. Old JDK versions have been kept the same, and Java 7 & 8 are still in heavy use.

> you can now only get support for JWS if you pay or if you go through a > third-party.

Not everyone needs enterprise support.

<comment><USER16> > Old JDK versions have been kept the same, and Java 7 & 8 are still in heavy > use.

But they aren't getting free security updates.

> Not everyone needs enterprise support.

Run it without security patches? That's _suicidal_ for a system like JWS.

Or do you think there's some option that is still support but not specifically _enterprise_ and doesn't cost anything? I would take a look at who historically contributes security patches to OpenJDK and think about if you free vendor really has the expertise you think they do to keep up with security attacks.

<comment><USER18> > Or do you think there's some option that is still support but not > specifically enterprise and doesn't cost anything?

Yes, Amazon backports security updates to Amazon Corretto (fork of OpenJDK 8 and 11)

<comment><USER16> > Amazon backports security updates to Amazon Corretto

There's a flaw in your logic there...

JWS is gone in new versions, so there aren't any security updates for it in the newer versions either.

You can't backport a patch which hasn't been written.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> > As far as I know, nobody ever verifies the signatures in a systematic way.

I systematically check the signatures on the jars of my dependencies. See e.g. [https://github.com/m50d/tierney/blob/master/free/keys.proper...](https://github.com/m50d/tierney/blob/master/free/keys.properties) . If these artifacts were signed with different keys, I would notice (my CI builds would fail). There are still points of failure (e.g. if you could subvert the maven-pgpverify-plugin itself), but security is about increasing the cost of attacks.

> It's hard to find the public keys for the library maintainers. Sometimes > they upload them on the keyservers, sometimes not.

> There's no established way of communicating that which public keys should be > trusted. If there's a new release and it has been made with a new key, your > best bet is to e-mail the maintainer and ask what is up.

> It's hard to get any security benefits from the signatures in practice.

This is making perfect the enemy of good. Any solution to this problem would have to start with a signature mechanism. The signatures that currently exist make it a little bit harder to fake a library. If you want to make it harder, check signatures on jars you depend on, ask maintainers to publish their keys to keyservers and communicate which keys should be trusted, demand explanations when keys change.

Better to light a candle than curse the darkness. "x is incomplete, therefore it should be replaced by a completely new thing" is a total fallacy - and, strangely, seems to be used only when attacking PGP.

</comment><comment><USER20> This is why you should use a well-designed system such as The Update Framework (TUF) that aims to make security as usable as possible:

[1] [https://www.python.org/dev/peps/pep-0458/](https://www.python.org/dev/peps/pep-0458/) [2] [https://theupdateframework.io/](https://theupdateframework.io/)

</comment><comment><USER21> When I work on embedded Linux stuff I sign my packages.

Shipping hardware as opposed to software allows secure deployment of pre- shared keys which can be trusted.

Even if someone hacks our automatic updates server (not too unlikely, it's some shared hosting), devices we have sold won't trust the modified packages because 512-bit ECDSA signature won't match the public key they have pre- deployed.

<comment><USER22> Out of curiosity:

1\. Why ECDSA?

2\. Why a 512-bit prime for the curve?

<comment><USER21> 1\. Only two asymmetric algorithms are widely supported and almost universlly recommended, RSA and ECDSA. Compared to RSA, ECC needs smaller keys for same security.

2\. I did that couple years ago already, I think it actually was 521 bits, the best one recommanded by FIPS at that time. The hardware has no relations to FIPS, it's not even _that_ expensive and should contain no secret data. I just saw no reasons not to implement the best security available: development time is not affacted by the count of these bits.

</comment></comment></comment><comment><USER23> [https://stackoverflow.com/questions/3307146/verification- of-...](https://stackoverflow.com/questions/3307146/verification-of- dependency-authenticy-in-maven-pom-based-automated-build-systems)

[https://issues.apache.org/jira/browse/MNG-6026](https://issues.apache.org/jira/browse/MNG-6026) Extend the Project Object Model (POM) with trust information (OpenPGP, hash values)

[https://issues.apache.org/jira/browse/MNG-5814](https://issues.apache.org/jira/browse/MNG-5814) Be able to verify the pgp signature of downloaded plugins against a trust configuration

</comment><comment><USER24> What's with the random shot at PGP at the end? PGP is perfectly fine for this particular application. None of the stuff that the article talks about has nothing to do with the particular tool used to sign the releases.

</comment><comment><USER23> [https://en.wikipedia.org/wiki/Key_server_(cryptographic)](https://en.wikipedia.org/wiki/Key_server_\(cryptographic\))

</comment><comment><USER25> > PGP is bad and needs to go away

how should we sign git commits?

<comment><USER26> There's nothing special about PGP that makes it good for signing git commits, and plenty of alternatives exist. Signify is a simple tool to do signing, used by OpenBSD: [https://news.ycombinator.com/item?id=9708120](https://news.ycombinator.com/item?id=9708120). Minisign is also an alternative, though it doesn't seem as popular: [https://jedisct1.github.io/minisign/](https://jedisct1.github.io/minisign/). These may not be well integrated into git, but aside from 'everyone already uses and integrates with PGP,' there's no real reason stopping the usage of these other tools.

The two things that PGP does are pretty simple/straighforward. What makes PGP bad is that PGP itself it is really complicated, and the way it is integrated into email etc. is also complicated and carries a _lot_ of historical baggage. But if you just want to make a public/private keypair and then use it to sign & encrypt data, that's pretty easy (or as easy as writing any crypto code can get). Signify, Minisign, and Age are clean, simple implementations.

Age does encryption: [https://news.ycombinator.com/item?id=21895671](https://news.ycombinator.com/item?id=21895671)

Of course this is sort of a [https://xkcd.com/927/](https://xkcd.com/927/) situation. PGP is already used by everyone so why switch?

<comment><USER27> The perfect is the enemy of the good.

\-- Voltaire

OK, if you're going to downvote this, please tell me how you plan to convince git and Github to replace PGP with signify? Github in particular has invested significant time building up their PGP support.

Personally, I would be fine with signify, I've used it in the past and I like it, and I think people are right when they say we should move toward more focused, Unix-style cryptographic tools - _for greenfield projects_.

But that doesn't we should abandon all current uses of PGP, particularly when it's working as well as it is with git and Github. There's absolutely nothing wrong with it. It does what it's supposed to.

It took a long time to get PGP supported by Github, and now you're going to want them to change it?

Edit: If people want to _add_ support to Git for signify, and lobby Github to support it, I'd be in favor. But strongly, strongly opposed to removing PGP support.

<comment><USER28> You might want to check out a couple blog posts

[https://latacora.micro.blog/2019/07/16/the-pgp- problem.html](https://latacora.micro.blog/2019/07/16/the-pgp-problem.html)

[https://blog.cryptographyengineering.com/2014/08/13/whats- ma...](https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with- pgp/)

And don't complain about downvoting.

<comment><USER27> I'm fine if you think I'm an idiot (I definitely can be), if you disagree with my stand on PGP, or my remark about downvoting. I'm often even willing to edit/change/correct my comments.

But don't order me around. I'm not your employee, kid, or whoever it is you feel you have a right to speak to like that.

</comment></comment></comment></comment></comment><comment><USER29> The author made a fundamental mistake of judgement.

So far, what he says amount to an advocacy against digital signing of code as such.

Miikka Koskinen says "digital signing doesn't work, so, lets decide to use something even more broken." Just that alone makes me think he has no say on this.

<comment><USER30> Nah. He said that the current infrastructure for signing JARs _is_ broken, making _supplying_ signed JARs pointless. He didn't say that this is the way things _should_ be.

He advised, at the end, fixing the system; but it is implicit in his tone that he doesn't expect anyone to try—it's been broken this long with nobody caring, so why would that change now?

And yes, he advised relying on other mechanisms for verification, for the time being. Because those mechanisms provide nonzero (if small) security, while the current infrastructure for JAR signing provides zero security.

(Compare: "if calling the police does nothing, at least carry pepper spray." This advice does not imply that pepper spray is better than _effective_ police response; only better than an _ineffective_ one. It also does not imply that one should not seek police reform. It only suggests what one should do _while_ the condition of "ineffective police response" still holds.)

At the end, he says:

> I've written this post in part to be proven wrong. I'm eagerly waiting for > posts from y'all about how you do, in fact, systematically verify the > signatures.

One would presume that, if he _were_ proven wrong, and the digital signatures Of JAR files actually did anything, he would retract this post and post one giving the opposite advice.</comment></comment>


Food Discovery with Uber Eats: Building a Query Understanding Engine - <AUTHOR> https://ubere.ng/2JgqOvt <comment><USER2> While it's good information retrieval work, I'm super skeptical that it actually adds meaningful value for customers.

Having worked on several different search engines at several companies, my consensus on this stuff is that customers usually just want more simple boolean filters or multi-choice filters that they can use to precisely control thevresult set for their preferences, and they want you to clean up the data backing the filters so they are highly accurate.

Spending huge money on a fancy system to try to understand their intent is overwrought. Did you ask them? Did you try just empowering them to communicate their own intent with more filtering or ranking options they can tune or manipulate on their own?

This stuff annoys me sometimes because it's dripping with so much marketing hype. Look at a sexy new embedding-based recommender, or a reinforcement learning agent that learns how to rank to gamify placed orders.

Maybe you could have better served your users by not spending big salaries + compute costs on this crazy query understanding model and instead just cleaned up your data so that you stop getting the opening hours of restaurants wrong, or you stop giving back BBQ places when somebody checks "vegetarian."

In so many cases, just some simple filters + data cleaning is worth way more to the customer than all this.

<comment><USER3> > Having worked on several different search engines at several companies, my > consensus on this stuff is that customers usually just want more simple > boolean filters or multi-choice filters that they can use to precisely > control thevresult set for their preferences, and they want you to clean up > the data backing the filters so they are highly accurate.

Were these customers very computer-literate?

<comment><USER2> It varied depending on the domain. In one company it was a high traffic online merchant, and customers were basically a random sample of the middle-class population at large, no better-than-average-person computer literacy.

In another case it was a multimedia company and the search users were producers, artists and technical directors, with much more of a power user mentality to searching for what they wanted, and jobs that required basic computer literacy and maybe familiarity with special GUI programs.

But I'm telling you, in every focus group or A/B test or user session we ever looked at, at any of these companies regardless of the user characteristics, the absolute number one thing every time was user requests for more and more categorical filters to allow them to efficiently exclude huge classes of results they _know_ are not relevant to them.

Amazon (I did not work there) actually gets this right, with lots of brand, size, color, Prime-eligible, etc. filters for everything. That stuff requires no machine learning, is simple to implement and A/B test and measure usage efficacy for, and people _really_ want it.

</comment></comment></comment><comment><USER4> Search and recommendation is so interesting to me. The goal of it is fuzzy. If I search "pho" then after the highly reviewed pho places, how might you decide between really poorly reviewed pho places and really highly reviewed ramen places?

If you just return the pho, it's doing what I asked for, but not showing me things I might be interested in. If the other pho places are really bad, maybe you aren't showing me things I'd actually rather eat.

If you return the ramen too, then you're kinda not doing what I asked, which is frustrating, but you might be showing me things I'd rather eat, given the shitty alternatives. When there's no mechanism for me to say "but really, I just want pho" it can be even more frustrating.

In this case there's a clear line between bad and matching vs good and related, but in many real queries there's not such a clear line. The smarter the algorithms get, paradoxically, the more frustrated I get by real world examples of this dilemma. I guess I don't have much to add, but it fascinates the hell out of me.

<comment><USER5> I think the solution is providing results with more structure than just a list of options. Being able to return something like "here's the list of pho places, but they aren't very good. We also have some ramen places here that are pretty good if you are interested." I think just having some sort of explanation why I've gotten a bunch of ramen places in my results would go a long way. At least giving some sort of explanation of the results could help a lot with that frustration. You could go even further and add some level of interactivity, allow the user to respond with "sure, show me the ramen results," or "no, show me the pho results anyway" would be the ideal.

The difficulty is that a lot of these sorts of queries, especially when machine learning is involved, are pretty opaque. You can find some set of results that meet the maximization of some metric in your feature space, but it's hard to explain why a particular result shows up there without resorting to a bunch of equations.

<comment><USER6> What do we want?

Context-aware natural language processing!

When do we want it?

When do we want what?

</comment></comment></comment><comment><USER6> One thing I've been annoyed at Google maps for is the inability to search delis, restaurants, takeout places, etc. all in one query. I want literally everything within 2 or 3 blocks of me. I usually search "food", "restaurant", and maybe "takeout" and different stuff pops up for each.

<comment><USER7> It used to show all food places when searching for restaurants. Maybe they've discovered that, for most folks, those are different searches.

<comment><USER8> It use to let you filter by price and cuisine but that seems to be gone.

</comment></comment></comment><comment><USER9> 20 years ago, the best we could do was boolean filters. Then Google came along and we've been charging forth down the fuzzy road ever since. At the first WSDM conference, intent was all anyone was interested in figuring out.

Now the population at large is far more computer literate than ever. I wonder if we still really need fuzzy search for everything in the same way we did 20 years ago. It seems like many geo-related problems would be better served by better boolean search.

<comment><USER10> Agreed, the loss of "programmer-friendly" features like wildcard and boolean matching is one downside of the progress made in the last couple of decades.

This isn't such a massive problem with Google as it is on specialized search engines like eBay's. A fuzzy search is worse than useless when you're looking for items with very specific names.

</comment></comment><comment><USER11> Reminds me a lot of the show Silicon Valley, where one of the characters has something like a Phd in artificial intelligence but ends up writing code for an app which dynamically turns your face into a smiley face (i.e. snapchat)..

<comment><USER12> If I remember correctly, the product in that episode was applying "snapchat filters" (deformation/modification/accessories) to animal faces. It was portrayed like this stupid job, but as an ML researcher myself my first thought was: "that's a pretty cool/challenging problem!"

It's funny how things that can seem hard can be so simple, and vice versa! I guess it depends on the person whether they're looking for an interesting challenge, or to make an impact - - because the two are often perpendicular.

<comment><USER11> I'm sure it is an interesting problem, but what happens when the majority of our technical talent goes towards solving useless but "interesting" problems?

Look at the engineers credited at the bottom of the article: "graduate of Carnegie Mellon University with a degree in Computer Science", "Ph.D. in Electrical Engineering and Computer Science from UC Berkeley", "Ph.D. in statistical machine learning from Duke University" these are some extremely intelligent and educated people but they are using their skills to help you choose between Chinese food and Indian?

We've already seen this situation described as the "Internet of Stuff Your Mom Won't Do for You Anymore" and stuff like this doesn't really help. I really think that innovation is dead in silicon valley, its more about catering to needs of nerdy man-boys with lots of money to blow.

<comment><USER13> > _I really think that innovation is dead in silicon valley, its more about > catering to needs of nerdy man-boys with lots of money to blow._

I disagree. I think it's about catering to the needs of _normals_ with lots of money to blow. The only nerdy aspect here is this post. The product itself? Totally for smartphone-using normies.

<comment><USER11> Its 2018, normal people do not have money to blow. The "normals" are the ones delivering your food, driving you around, doing your laundry, walking your dog, cleaning your house etc.

<comment><USER13> The "normals" are also people working in management, marketing, and other high-paying professions. SV might have extremely high density of tech people, but programmers are not the only (or even the majority of) high-earners in the West.

</comment></comment></comment></comment></comment></comment><comment><USER14> All this bullshit and you still can't make an app that doesn't recommend me burgers in the "Mexican" category, or Indian in the "sushi" category.

[https://imgur.com/a/l0BE27Z](https://imgur.com/a/l0BE27Z)

And yeah I get it, McDonald's probably paid you a lot of money. But you can stop shoving the suggestion down my throat.

Uber Eats, at least in Japan, is a joke and this is nothing but AI/ML wankery.

</comment><comment><USER15> I wonder if/how they treat the 0 results cases, there isnt much discussion of this. I know some of the delivery companies are setting up commercial kitchens for outposts of popular restaurants or even entirely virtual restaurants. UberEats has a great visibility into this, ie if a lot of people are looking for pho and not finding results, encouraging a popular pho restaurant to setup in that delivery area makes sense.

</comment><comment><USER16> In Singapore we have Uber Eats, Food Panda, and Deliveroo.

They all suck. Not a single one allows you to search menus.

Developers need to stop trying to make complicated search features and go back to a good old full text search that works.

While the argument may be valid for Udon and Soba... Making correlations between Japanese and Chinese food is not. Living in Singapore, if I want to order Chinese food, I do not want Japanese food, they are not similar at all.

<comment><USER17> > In Singapore we have Uber Eats, Food Panda, and Deliveroo.

Less of a problem in America, where all restaurants of a given type have very similar menus. For example, most Thai restaurants are going to have the same dishes, with (maybe!) a few unique ones at each location.

Chinese is one that has started to differ, more and more unique Chinese places are opening, but there are still few enough of them that anyone interested in those specialty dishes probably knows which restaurant to order from.

(I'm in Seattle for what it is worth. New York City might be a very different story!)

</comment></comment><comment><USER18> I don't want to detract from the message of the article, but:

> For example, an eater might search for udon, but end up ordering soba. In > this case, the eater may have been looking for something similar to udon, > such as soba and ramen, instead of only being interested in udon. As humans, > it might seem obvious; Udon and soba are somewhat similar, Chinese and > Japanese are both Asian cuisines.

Aren't udon and soba both Japanese?

<comment><USER19> Yeah, that's the point!

<comment><USER7> The author seems to be drawing a parallel between udon and soba, but instead of saying they're both Japanese, says that China and Japan are both in Asia. It's somewhat of a non-sequitur that only makes sense if (1) the author thought that udon is Chinese and soba is Japanese, or (2) the author didn't realize that the second phrase would not be read as a separate example but still in the context of "In this case ..." which set up the udon example.

Edit: Looking at the authors' names -- Ferras Hamad, Isaac Liu and Xian Xing Zhang -- I'm guessing the 2nd is what happened. Somehow I get the sense that Xian Xing Zhang and Isaac Liu know where udon comes from.

</comment></comment></comment><comment><USER20> Hierarchies or simple category memberships are very simplistic: this is 1970s level natural language semantic processing, but I'm not sure it's appropriate. For example, Yoshihiro Murata is the 3 Michelin Star chef of Kyoto restaurant _Kikunoi_. In a June 2015 interview[0] in _Mad Feed_ magazine he stated:

 _I think 50 years from now, the borders will be gone. We won 't be talking about Nordic cuisine or Japanese cuisine anymore. It will be about what is delicious, without any sense of nationality. That will be the new cooking tradition._

The point being, perhaps rigid categories are the wrong approach and tastes are blending across traditional heirarchies. Last week at F&A Next[1] in Holland I met people are working on scientific flavor combination based recommendation engines already. Their market was chefs, but why not sell this feature directly to consumers?

There's another issue which is Halal in practice can mean anything from "doesn't include pork products" to "must be a certified Halal restaurant with certified Halal ingredients". They fail to differentiate this in the text. Basically it boils down to obtaining detailed personal preference and restriction information, which is good practice anyway in food service, in case of deadly allergies.

On the other hand, if you trust Michelin chefs, delivery is perhaps the wrong approach going forward. In March another three Michelin Star chef, Alvin Leung of HK's _Bo Innovation_ was interviewed[1] by _Salt Magazine_ and stated:

 _Maybe robots making fried rice is the future._

That's basically what we're working on at [http://infinite- food.com/](http://infinite-food.com/) .. we figure 3 minutes prep times mean 10-20x speed improvement vs. delivery plus full personalization ... raising Series A now to launch in three markets next year!

[0] [https://www.madfeed.co/2015/a-japanese-master-on- innovation-...](https://www.madfeed.co/2015/a-japanese-master-on-innovation- through-tradition/)

[1] [http://fanext.com/](http://fanext.com/)

[2] [https://saltmagazine.asia/food/demon-chef-alvin-leung- collab...](https://saltmagazine.asia/food/demon-chef-alvin-leung-collaborate- chef-liu-ching-hai-summer-palace/)</comment>


Technical Debt: A Taxonomy - <AUTHOR> http://blogs.construx.com/blogs/stevemcc/archive/2007/11/01/technical-debt-2.aspx

<comment><AUTHOR> In addition to containing an interesting categorization of technical debt, this article explains the entire concept of such debt in a very clear manner. Much appreciated, as I know of some managers that could benefit from reading this.</comment>


Internet of Living Things – DNA sequencing on your toothbrush? - <AUTHOR> https://www.youtube.com/watch?t=492&v=V3nmhfvaVYQ

<comment><AUTHOR> Clive Brown is the CEO of Oxford Nanopore. He is making a case for small devices sampling DNA data where it occurs, such as in food and waste processing, and even in a toothbrush (he may be kidding on that).

Currently, his company is producing a USB stick sized DNA sequencer in a broader Beta testing program. In the talk he also considers going direct-to- consumer for quantified self rather than getting regulatory approval for medical applications.</comment>


Ask HN: Starting on a new project, what programming language to use? - <AUTHOR>

Hey Guys,<p>I have good experience with Java, Javascript, HTML and actionscript. I have dabbled in ruby,nodejs, scala, clojure, lisp and lots of other languages. I am going to start building out a new web application. I was thinking about building out the web application with a new language, so that I can get a deeper understanding of it. So what is the best language and framework for a java guy? <comment><USER2> I was in the exact situation two days ago. "Okay, time to start a new project. Okay let's see what options I have.. Maybe about 32 is a good approximation" I love learning new languages, studying different construct, different concepts. I get so much from studying or overviewing a language I might never use to actually write code with. I also like my side project being spaces where I can affort to try different 'exotic' things. So I started surfing, got to CoffeeScript, NodeJs or CoffeeScript and ruby (my last project was in AngularJS (javascript, no coffee) on top of Sinatra (Ruby). Loved it. Most recommand it.) Then it started being more Esoteric : Nemerle, Dart, factor (really interesting!! most recommand to at least check it out : [http://factorcode.org/littledan/dls.pdf](http://factorcode.org/littledan/dls.pdf)), etc. But at one point (I was in a bus), it became clear. Clojure is the solution. Didn't know much about it, couple of really interesting article had made me keep a mental note on it. So I started digging into. Found love. \- Efficient Macros (way cleaner than Common Lisp) \- Incredible data-structures (Not just an other Lisp) \- Active and growing Community \- Can be purely functional \- Walk-in documentation (Rich Hickey is made to explain how great things he does are. I mean reading is doc is like an all-around course on developper's best practices) \- Full application in one language (Clojure and ClojureScript count as one. Heh.) \- It's made by Rich Hickey. (Just joking.. Ha.) \- Supports Concurrency out of the box.

It won over CoffeeScript and NodeJS.. mostly because I already knew Javascript too well. Didn't felt I would get that "deeper understanding", as you mention, I was searching for. It won over CoffeeScript and Ruby (I didn't do that much ruby at all, though I love every line I've written in it).. Because.. well it's a Lisp! Deeper understanding of Lisp is a no-choice toward skills I'm seeking to acquire (Out-lined, partially, in On-Lisp, pg).

So there I am, studying Clojure and sharing my exciting discoveries. Hope the list you've given wasn't the exclusive list of language you want to use. I would vote Clojure anyway.

</comment><comment><USER3> Well, I'll just be the one to say it: PHP

EDIT: Framework... maybe F3 or Codeigniter, whatever floats your boat.

</comment><comment><USER4> I develop web apps with Python + Django, and I enjoy every minute of it.</comment>


The P-TECH program reboots vocational education - <AUTHOR> https://www.politico.com/magazine/story/2019/09/12/vocational-tech-school-training-policy-228049 <comment> barry-cotter So how are they achieving these great results in school leaving exams? Very high dropout rates? If the programme is as good as the article paints it you should see the middle classes taking advantage soon. High school plus an Associate's degree and job training is a pretty great deal. You can go straight to work or go to university after.

<comment><USER2> And middle schools, lol the parents well say lovely idea but not for my "Justin" or "Stephanie"

Interesting when I started work via this route a few years ago Advanced Apprentices required higher educational qualifications than joining a bank from school.

For example one of Sky at night presenters started at the same rough level as me (ASO in the civil service) but when she joined she had a Degree I had 6 O levels.

</comment></comment><comment><USER3> With so many forms of native advertising out there, I now can't tell whether this is actual news or just P-TECH purchasing ad space in the form of a news report.</comment>


Outsourcing Customer Service to AI:  Are the Robots Coming? - <AUTHOR> http://www.peopledelight.com/blog/outsourcing-customer-service-ai/ <comment><USER2> This is a huge deal and I think he has totally underestimated how quickly this will happen. And customer service agents are going to be among the first to get displaced by AI. Right after all the truck drivers. We aren't doing anywhere nearly enough to prepare for this change. It's going to make the election look like ripples in a kiddy pool compared to a hurricane.

<comment><AUTHOR> I get that it will have a big effect, but I think that human interaction is so nuanced that that effect will play out slowly. Again, I think single digit years is possible, but not less than five.

</comment></comment><comment><USER3> Even if he's right and this happens in five years, that's still not far away. Definitely close enough for governments to start making plans, and almost close enough for established businesses to start making plans.

</comment><comment><USER4> People ALWAYS worry about technology way more than they should. Jobs are always replaced by new technology but new problems are created along the way and we start dealing with higher order problems..

<comment><USER5> > Jobs are always replaced by new technology

In the meantime government can help rehiring people by investing in public works and some industries. Also, we can extend the unemployment benefits to compensate, and raise taxes.

<comment><AUTHOR> I definitely hope that the new administration will drive some infrastructure spending, regardless of ideology.</comment></comment></comment>


Joel Stein on Immigration, New Jersey's Indian Influx - <AUTHOR> http://www.time.com/time/magazine/article/0,9171,1999416,00.html

<comment><USER2> So Time publishes random rants now?! The article started well but really deteriorated towards the end. There didn't seem to be a conclusion.

He didn't really describe apart from the Indian restaurants and food how has the town changed apart from "there are a lot of Indians here". What have been the impact on employment, education, crime etc.</comment>


Whose xterm is it anyway? - <AUTHOR> http://www.tedunangst.com/flak/post/whose-xterm-is-it-anyway <comment><USER2> I was 'shocked' to discover a few months back that, when I made the horrible mistake of starting a job that wasn't easily Ctrl+C killable and dumped a lot of output to the screen, I was better off paging to antoher desktop and waiting for it to go away, because the limiting factor to the data-dump wasn't the bandwidth between my machine and the remote, nor the buffer size of the terminal, socket, or whatever else in between, but the _speed at which my terminal rendered text_ , which was rendered moot by being on another desktop where the text didn't need to be rendered and the xterm (or also iterm) session could page-past that text without disturbing my desktop display.

It makes a lot of sense. Much goes into your text rendering beyond what was necessary in your VT100. Every screen I see is anti-aliased, horizontally and vertically aligned, with 'lines' of text that can wrap or be colored or myriad other things according to the byzantine and arcane standards of the escape codes and ones that have come after. Re-drawing even a fairly large amount of text is fairly non-trivial cpu and gpu time. I found I got way better performance and less lag from my machine if I disabled the alpha transparency on my terminal windows. Processing power is very high, but still far from unlimited.

<comment><USER3> If you're using Linux, I'd advise you to use a fast terminal like Terminology; it even has GPU acceleration, but I doubt you'd need that. The only one that comes close on CPU-rendering speed is urxvt.

<comment><USER4> Pulling _all_ Enlightenment[1] dependencies just for a terminal emulator is a waste of time and space.

Why would I use that instead of rxvt ?

1: [https://www.enlightenment.org/?p=about/terminology](https://www.enlightenment.org/?p=about/terminology)

<comment><USER5> Tell that to the guy above who uses a Linux VM just to get a speedy terminal. :)

<comment><USER6> Well, fwiw my local Debian Jessie claimed terminology along with dependencies (that weren't already installed) would claim 24MB. Pretty steep for a terminal. I tried opening one each of Terminology and Sakura[s] -- and as far as I can tell, running:

      i=0;while true; do echo $i;i=$((i+1));done

is, if anything, slower in Terminology. Big caveat: I've just installed kernel 4.1.6 and while I've recompiled/installed the proprietary fglrx AMD driver, I'm not entirely convinced most OpenGL apps work as they should.

[s] [http://www.pleyades.net/david/projects/sakura](http://www.pleyades.net/david/projects/sakura)

</comment></comment></comment></comment></comment><comment><USER7> Educational article. Is luajit becoming a tool of choice for this kind of hacking, rather than C or perl? Seems like a library of helper functions or some sugar could be added to make it more suitable, note the need for a readptr function and use of tonumber()

<comment><USER8> Arguably, the FFI gives easier access to stuff (TM) than Perl would allow. C would be easier if the aim was clear and you can just write the code down (well, string handling is probably easier in Lua, and there's the memory handling with GC). When the way there is what drives you instead, Lua(JIT) is nice. Sprinkle in some print here and there, try this and that without compiling stuff (though that is the smallest gain, I think)...

tonumber() is LuaJITs cast for pointers to integers. There are some arguments for it to stay.

<comment><USER7> Make sense, dynamic languages have a lot of conveniences. If having a REPL helps, there are REPLs for interpreted C

I meant to refer to "tonumber(oldsize[0])" used to cast from a ctype size_t to a lua number (doubles) (I missed that's it's also used for casting pointers). Now I realise that this is needed because implicit casting from 64 bit ints to a double would reduce precision. It's just a very minor thing that "for" loop bounds must be lua numbers.

</comment></comment></comment><comment><USER9> It's interesting, but wasn't `ps aux --forest` just enough?

<comment><USER8> Platform is a BSD, with no fancy-pants "ps", I guess.

<comment><USER10> tedu is talking about OpenBSD, which doesn't have GNU ps; but OpenBSD does have a pstree package (which should output something like [http://s0.cyberciti.org/uploads/faq/2014/02/pstree- outputs.j...](http://s0.cyberciti.org/uploads/faq/2014/02/pstree- outputs.jpg)). Of course, that's less educational.

</comment></comment></comment><comment><USER11> How about the following approach: echo "It's meeee!" > /proc/9960/fd/0, and see on which xterm it appears?

(For those who, like me few years ago, don't know what above does - it's writing directly into STDOUT of a process, which is available as a file descriptor 0 in /proc/[PID]/fd).

<comment><USER12> xterm's STDOUT isn't hooked up to the terminal window it shows. For a demonstration, start one xterm, then start another from the first. Send something to STDOUT of the second xterm and it'll appear on the first.

</comment></comment><comment><USER13> On my linux machine I run 8-10 dedicated xterm windows, each runs a tmux session [1]. So the way I would solve this problem for me would be to grep the process' /proc/$pid/env for its unique identifier.

[1] [https://github.com/holygeek/wmgr/blob/master/xterms.conf.pl....](https://github.com/holygeek/wmgr/blob/master/xterms.conf.pl.sample#L101)

</comment><comment><USER14> I love this kind of things. It turns software [a]synchrony in a very physical idea. I see it as similar to engine braking. The slowest part of the system in a context will drive the 'performance'.

</comment><comment><USER15> I found this article confusion. in the xterm, just type echo $$ and reverse- walk the pid tree to find the parent of that shell.</comment>


The Worst Chart In The World - <AUTHOR> http://www.businessinsider.com/pie-charts-are-the-worst-2013-6

<comment><USER2> I fully agree about pie charts, and generally love Tufte's work, but that tweet of his at the end just made me sympathise with pie chart users. A better analogy would be all caps, and/or unreadable fonts as they needlessly impede understanding without being easy mistakes to make.</comment>


Stack Overflow Gives Back - <AUTHOR> http://blog.stackoverflow.com/2009/12/stack-overflow-gives-back/

<comment><USER2> Very admirable. Let's hope these funds get used better than Jeff's last donation to an open source project.</comment>


The Myth Of Work Life Balance - <AUTHOR> http://www.twistimage.com/blog/archives/the-myth-of-work-life-balance/ <comment><USER2> There are three types of work:

Grind - i.e. something you don't want to do, but you have bills to pay

Career - i.e. something you want to do, but you have to grind through a bunch of shit to get to do it.

Calling - i.e. something you must do, and you will not stop until you do it. Most entrepreneurs fall here.

If your work is a calling, then you are right; there is no balance.

If you have a career, then you have to find balance.

If you are grinding, then you just want to get home and work will always lose to life.</comment>


PHP Fat Free Framework aka F3 - <AUTHOR> http://fatfree.sourceforge.net/

<comment><USER2> Even with intense concentration, I wasn't able to read the text on the page. It's the lowest-contrast thing there; the YELLOW logo and "1.0" thing (and the social bookmark links) try very hard to pull your eyes away from the text... and they succeed. I am going to have nightmares about this site tonight, I swear.

Also, PHP really needs something like Plack/PSGI/Rack so that you don't have to manually reconfigure the web server for every library you want to use.

<comment><USER3> _Also, PHP really needs something like Plack/PSGI/Rack so that you don't have to manually reconfigure the web server for every library you want to use._

The Apache configuration mentioned in this article is pretty generic.

PHP has a standard HTTP interface, unlike the other languages before WSGI/Rack/JSGI/PSGI came around. Of course, PHP's interface isn't function- based, so you don't have the advantages of stackable middleware.

A spec closer to the *SGI's would indeed be nice.

<comment><USER4> Actually, it's funny you should mention that. I wrote a little web server in PHP that's basically a port of Ruby's Rack:

<http://github.com/dhotson/kelpie>

It actually works pretty well, no apache required! It's pretty fast too.. all the init stuff you normally have to do every single request can be done once on server startup.

I also wrote a little sinatra style framework to go on top of it: <http://github.com/dhotson/kelpie/blob/master/demoapp.php>

Anyway, it's turning out to be a pretty fun little project. :-)

<comment><USER5> That's quite cool. That's some of the cleanest PHP I've seen.

When I've tried to write long-running applications in PHP I always get memory leaks. How do you handle this in Kelpie?

<comment><USER4> Thanks Josh! :-D

Yeah, it's probably going to have memory leak issues. It's pretty much inevitable unfortunately. I've thought about having the server monitor the memory usage and periodically respawn processes. I believe apache uses a similar technique.

I'm open to ideas on this issue though. :-)

</comment></comment></comment></comment></comment><comment><USER6> I've done something similar, inspired by sinatra: <http://github.com/soska/microbus> but I'm a poor self-promoter.

This is an interesting idea, but I like better my syntax though. But again, I'm not even a real programmer.

<comment><USER7>
       I'm a poor self-promoter.
       <snip>
       But again, I'm not even a real programmer.

Modesty isn't very useful when promoting. Tell us why your framework is better!

<comment><USER6> I don't actually think it _is_ better, just different and works for me. Some other attempts try to make PHP act like ruby or python with ugly results. What I've tried to do here is embrace PHP 'classic' style.

      if (get('hello')){
        // do stuff
      }

</comment></comment></comment><comment><USER8> This is exactly what I intended for my "personal framework" when I began writing it's first version about three years ago: unintrusive (all main functions as static methods of a single class to keep the global namespace clean; no enforced directory structure) and lightweight (few files, few bytes).

Too bad mine grew to become a monster, pretty much like all other popular PHP frameworks out there. I guess simplicity really is one of the hardest features to implement.

</comment><comment><USER9> the license gpl v3 for base framework is pretty limiting ... it could be a show stopper... something like MIT or BSD would encourage people to try out...

<comment><USER10> Really? I honestly didn't think it was a problem for web apps. What's the issue here?

<comment><USER9> gpl v3 requires code (even hosted) to be shared upon request by users

with gpl v2, it was a requirement. hence gpl v2 licensed applications such as wordpress and drupal don't need to be shared with site users

code built upon the framework is derivation and thus, has to be licensed accordingly

<comment><USER10> I can't see the requirement to share code with users on request anywhere in the GPLv3. It explicitly excludes interaction over a network in section 0:

        "To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying."

Are you sure you're not thinking of the Affero GPL?

</comment></comment></comment></comment><comment><USER11> Another framework based on MVC. But MVC is just not possible in PHP. Maybe with Ajax it is, but mostly it is a hype people don't understand. Let Apache (or any webserver) be the controller and you have the most lightweight framework there is.

<comment><USER12> In what way is it not possible? You can send all requests through a single handler with .htaccess can't you?

<comment><USER11> You can, but it will not update the view directly as MVC does. You always need to refresh the page for that. In Java or Flex (or with Ajax) the view is updated by the model. That is MVC. In PHP this is just not possible. So imho it is a hype word people don't understand. Most (PHP) frameworks that use 'MVC' are just more bloated than Apache + PHP (a single handler with .htaccess could be nice!).

<comment><USER13> MVC ≠ What your pet framework does

MVC is a _descriptive point of view_ , not a prescriptive implementation plan. It's one of the only software idioms that's actually an Alexanderian Pattern, unlike the vast majority of the GoF that's just reflective of language warts/features.

There are tons of completely different ways you could describe the web as MVC:

      Model         View        Controller
      URL           Response    Request
      DB            Response    Request
      Response      Hypermedia  Sub-Requests
      LocalStorage  DOM         Javascript
      data://       JavaScript  DOM Events
      ...

<comment><USER11> I agree. But that's not the case with this PHP framework (as far as I can tell). They use 'MVC' as structure for there code (or as you call it: prescriptive). And then suddenly a lightweight framework is not that lightweight anymore. So again I agree with your descriptions of the web as MVC, but MVC in a PHP framework only... I still believe that's just a hype word.

BTW I don't want to start a flame war about MVC. I just got some question marks about using a PHP 'MVC' framework.

<comment><USER14> Am I right in saying you think it's bloated because it's superfluous? If that is the case, may I draw your attention to one of the most important reasons for doing request handling within PHP: testability.

Were it not for that I would be in complete agreement with you; I have absolutely no time for any framework that does not allow you to construct a mock request object, throw it into the controller, and verify correctness of the response object produced.

</comment></comment></comment></comment></comment></comment><comment><USER15> Reading through the 'Getting started', it's quite an interesting approach actually. I might give it a go some time.

<comment><USER14> What's interesting about it?

</comment></comment><comment><USER16> It looks like Sinatra for PHP.</comment>


The Case For An Older Woman - <AUTHOR> http://blog.okcupid.com/index.php/the-case-for-an-older-woman/

<comment><USER2> Please note these are statistics for one online dating site. I don't use online dating sites and if this is typical, it is all the more reason I shouldn't bother. I happen to be a 46 year old female who began divorce proceedings in my late 30's. My actual experiences don't seem to fit with the data they present. I've been chatted up/hit on by men from lots older to lots younger and everything in between. Granted, people routinely misread me as a good deal younger than I am. So I'm not saying I am "typical" for a woman my age. I am mostly trying to say that statistical norms don't dictate specific individual outcomes. And statistical norms for a single dating site don't necessarily generalize either.

<comment><USER3> > _And statistical norms for a single dating site don't necessarily generalize > either._

Right, these statistics go very well with the thesis the author is trying to put forward (what a lovely job he does, too). But they do not necessarily generalize to the population at large.</comment></comment>


The Best Java Books for All Skill Levels - <AUTHOR> https://stackabuse.com/the-best-java-books-for-all-skill-levels/ <comment><USER2> All book links to Amazon are _affiliate links_</comment>


Everything Apple Needs to Introduce at WWDC to Appease the Internet - <AUTHOR> http://carpeaqua.com/2013/05/16/everything-apple-needs-to-introduce-at-wwdc-to-appease-the-internet/

<comment><USER2> He forgot one: make multiple monitors finally useful on OSX, especially with the advent of full screen apps (current behavior is just display a gray texture on other monitors instead).

Seriously, if 10.9 is announced with that feature alone and nothing else, I will buy 10.9 if it fixes this.

<comment><USER3> The behavior actually depends on the app. If the application can't figure out a good way to use both screens, then you get the gray texture on one screen.

<comment><USER2> Yes, but I want to display a full screen app on each monitor, which is the only sane way to use that behavior.

</comment></comment></comment><comment><USER3> Discussed here: <https://news.ycombinator.com/item?id=5722532></comment>