Severe Security Advisory on AMD Processors - <AUTHOR> https://www.amdflaws.com/ <comment> TD-Linux Previous (flagged) discussion: [https://news.ycombinator.com/item?id=16576516](https://news.ycombinator.com/item?id=16576516)

</comment><comment><USER2> No-name security company from Israel (Intel-backed?) strikes back with propaganda. Masterkey requires getting malicious code into bios. Ryzenfall Fallout and Chimera require admin-elevated malicious code. TL;DR Nothing to worry about if you're not already fucked.</comment>


Show HN: I wrote an introduction to Random Forest using Tesla stock prices - <AUTHOR> https://medium.com/uncanny-recursions/an-introduction-to-random-forest-using-tesla-stock-prices-7a2e25778c7c <comment><AUTHOR> I learned a lot while writing this post and I am definitely grateful for Jeremy Howard's fastai videos. Had always been curious on how things actually work under the hood so fiddled around with the concepts and ended up writing this blog post. Hope you guys like it!</comment>


Bitcoin Laws Imminent - <AUTHOR> http://nerdr.com/bitcoin-laws-imminent-bit-coin-soon-to-be-illegal-in-us/

<comment><USER2> Submitted yesterday, flagged dead, same response there as here:

<http://news.ycombinator.com/item?id=2705077>

With regards items being resubmitted and repeatedly flagged dead, I offer the following quotation:

       "Those who cannot remember the past
        are condemned to repeat it."

        George Santayana,
        The Life of Reason (1905-1906)
        Vol. I, Reason in Common Sense

(Copied from <http://en.wikiquote.org/wiki/George_Santayana>)

Last time I pointed out that an item had been submitted earlier and flagged dead I got downvoted, so I then provided a further explanation. I reproduce it here - it will be slightly disjointed as I don't have time to go through and re-edit it for a single comment.

</comment><comment>==

Firstly, this item is a repeat submission. It was submitted earlier, and so there is some earier "discussion" to reference. I thought it would be of value to point that out.

I especially thought it would be of value since it that discussion seems to highlight some concerns about the item in question. Rather than simply repeat them here, I thought it better to point to it over there.

The quotation was intended to point out a problem with items like this getting flagged. Several times in the past I've seen items get flagged dead, only to be submitted repeatedly, then flagged dead each time. Deleting the items by having them flagged dead just means that the same thing is submitted over and over again, and hence came to mind the given quotation. Paraphrased:

If you delete things, you can't learn from them, leading to the potential for repeating the same errors over and over.

I thought people would find that interesting, relevant, and potentially a useful tidbit.

Spam certainly should be flagged - no question.

The problem is that there are stories that people think will be interesting, but which then get thoroughly discredited. Initially, no doubt, they should be flagged, and therefore deleted. Fine.

But if they are submitted again then they should not be flagged. It's likely that they will be submitted again and again and again. Instead, the original should be pointed out, the fact that it's discredited recorded, and the submission left so the dupe-detector prevents any further submissions. In that way we learn from history.

<comment><AUTHOR> Sorry, I had not seen it submitted previously and your link says deleted, but not by whom.

It's not blatant spam selling counterfeit footwear or similar and I'm inclined to think it was the submitter who deleted it fearing downvotes from the bitcoin mob rather than a good old flagging (it has 4 upvotes right this minute and is worth a read).

</comment></comment><comment><USER3> Bunk article.

\- no sources \- since when do the courts make legislation? \- courts are doing research and the courts are "laws from the top"? \- search for bitcoin on the uscourts.gov website brings up zilch.

Totally made up and false article if you ask me.

[http://www.uscourts.gov/SearchResults.aspx?IndexCatalogue=Al...](http://www.uscourts.gov/SearchResults.aspx?IndexCatalogue=AllIndexedContent&SearchQuery=bitcoin)

<comment><AUTHOR> He mentions sources in the comments section and clears his intention with:

"This article highlights US laws are imminent based upon an increase in research activity into Bitcoin by the US courts service."

We've been discussing this article on the Bitcoin forums and I think we all know it's coming whether we agree with it or not. We can see any law passed against Bitcoin will affect it's market value.

Point 5 at the bottom of the article (Further Work) is worth a look.

<comment><USER3> It is a pure speculation that any law is imminent. There is still no source that says the US courts are "doing more research". Lastly, "we all know" is his own opinion, not the opinion of any group, let alone the bitcoin forum.

<comment><AUTHOR> You really think the US will sit idly by as Bitcoin use increases?</comment></comment></comment></comment>


Hyper – Hypervisor-agnostic Docker engine - <AUTHOR> https://hyper.sh/ <comment><USER2> I like this idea. It's a stripped down VM capable of only running containers. There are a couple of downsides, compared to straight docker though - you have to go through the VM layer for disk io. So, if you have a shared volume, there will be a performance hit.

However, you get a big boost for security.

This type of tech could make it possible to use (Docker) containers in a true multi-tenant system.

One question though - is it possible to specify the vmem and vcpus for the qemu VM? (Either from the command line or pod file?)

<comment><USER3> Containers have been used in multi-tenant systems for years in both Solaris and FreeBSD via zones and jails

<comment><USER4> Not sure how secure they are. But sounds a bit scary to run my app in a shared-kernel environment.

<comment><USER3> Docker also uses a shared kernel...

edit: and why is it different than a shared hypervisor? Hypervisors have exploits, too...

<comment><USER4> Yes, but the nature of lxc makes it much easier to exploits.

</comment></comment></comment></comment></comment><comment><USER5> Would be nice to have this on Macs too no more crappy VirtualBox ;-)

<comment><USER6> You can do Docker with VMWare using Docker Machine:

docker-machine create -d vmwarefusion --vmwarefusion-boot2docker-url [https://github.com/cloudnativeapps/boot2docker/releases/down...](https://github.com/cloudnativeapps/boot2docker/releases/download/v1.6.0-vmw/boot2docker-1.6.0-vmw.iso) my-docker-machine --vmwarefusion-memory 4096 --vmwarefusion-disk-size 30000

</comment></comment><comment><USER7> it seems very similar to clearcontainer that was announced a few days ago, i.e. interesting since both are much nicer than "traditional container" solutions.

Now for the interesting stuff.. init process (C): [https://github.com/hyperhq/hyperstart](https://github.com/hyperhq/hyperstart)

Daemon (Go): [https://github.com/hyperhq/hyper/tree/master/hyperdaemon](https://github.com/hyperhq/hyper/tree/master/hyperdaemon)

Stuff to replace with overlayfs ;) [https://github.com/hyperhq/hyper/tree/master/storage/aufs](https://github.com/hyperhq/hyper/tree/master/storage/aufs)

<comment><USER8> yes, we do not support overlayfs yet, but will. overlayfs is the future of unionfs, and aufs is the current. :)

</comment></comment><comment><USER9> Looks interesting. How is this different from Clear Container several days ago?

<comment><AUTHOR> Hi there,

Thanks for your interest in Hyper!

We also noticed the release announcement of Clear Containers a few days ago. There are 2 main differences, the first being on the technology used, CC using RKT, while Hyper is based on Docker images. There is also a difference in term of philosophy, where Hyper aims to be a technology-neutral open source solution.

Hyper also have more features, such as running a Pod rather than one image on a hypervisor as a schedule unit.

For more details, please check our FAQ ([https://hyper.sh/faq.html](https://hyper.sh/faq.html))

<comment><USER10> I don't feel this is correct. rkt can run docker images[1] and once the clear containers patches[2] land you will be able to run a docker image or an appc image inside of a VM under rkt.

[1] [https://github.com/coreos/rkt/blob/master/Documentation/comm...](https://github.com/coreos/rkt/blob/master/Documentation/commands.md#fetch- from-a-docker-registry)

[2] [https://github.com/coreos/rkt/pull/946](https://github.com/coreos/rkt/pull/946)

<comment><USER11> I think the question was specifically in the context of CC.

</comment></comment></comment></comment><comment><USER12> Have we reached Peak Container yet?

<comment><AUTHOR> Hi there, I am not sure what do you mean by "Peak Container"?

<comment><USER12> Sorry, it's a pun on "Peak Oil" (the idea that at some point we're going to pump and all the oil in the earth will be gone).

Not a dig at Hyper in particular (which looks cool), just that the "containers as service configuration management" market is extremely saturated right now.

<comment><AUTHOR> The idea behind hyper is to propose something slightly different, answering the security issues you can have with containers.

</comment></comment></comment></comment><comment><USER13> Are there good management and orchestration tools for Xen (or other hypervisor)? One of the things about Docker is that I'm having trouble finding good tools for managing an infrastructure of Docker containers. I know this is being worked on, yes, but it's early days and I need something that is mature.

If anyone can suggest Xen admin stuff, I'd really appreciate it.

<comment><USER14> There's xenserver (tools) which was opensourced a little while ago.

Most configuration management systems also have modules for managing xen. At the moment I'm writing some CFM code using saltstack with the xapi and virt for my own stuff, as I'm not a huge fan of the xenserver and xen cloud platform abstractions.

</comment></comment><comment><USER15> Is this just a cross platform boot2docker?

<comment><AUTHOR> Hi,

Hyper and Boot2docker are two really distinct products.

The difference is, one (boot2docker) let you run containers on not compatible OSes, while the other one (Hyper) let you run each container, distinctly, in a dedicated VM.

Hope that helps :)

<comment><USER16> Sorry, but I don't quite get it. What's the advantage over having a dedicated VM per container?

<comment><AUTHOR> Isolation, and security. As @mbreese perfectly said, "This type of tech could make it possible to use (Docker) containers in a true multi-tenant system." With Hyper, all your containers will run their own kernel, instead of sharing the host's one.

<comment><USER17> It sounds like the shit Microsoft was gibbering about a little while ago, about how they would integrate their HyperV technology into their docker runtime

<comment><USER18> Hmm, I happen to know some details of that. It is actually a quite powerful technology with some out-of-box ideas.

</comment></comment></comment></comment></comment></comment><comment><USER19> Hmm, something seems strangely familiar about this code.

[https://github.com/hyperhq/hyper/blob/master/storage/aufs/au...](https://github.com/hyperhq/hyper/blob/master/storage/aufs/aufs.go#L118) [https://github.com/docker/docker/blob/master/daemon/graphdri...](https://github.com/docker/docker/blob/master/daemon/graphdriver/aufs/aufs.go#L420)

<comment><USER20> Luckily, the Apache Public License is compatible with itself.

</comment></comment><comment><USER21> That looks very interesting, I'm wondering how "container management" will be handled and how scalable is it?

<comment><AUTHOR> Hi there, Thanks for your interest :) Container management is handled the same way it is in Docker (Hyper directly uses the Docker hub, and you can directly `hyper pull` Docker images). About scalability, it is, again, very similar to Docker's scalability. Hyper isn't compatible with some Docker components such as Compose or Swarm yet, but it is on the roadmap. You can try Hyper following the installation procedure: [https://docs.hyper.sh/get_started/install.html](https://docs.hyper.sh/get_started/install.html)

</comment></comment><comment><USER22> Is this just a stripped down type-2 hypervisor guest kernel, or is there something else going on?

<comment><USER8> Hi,

It does not run a full guest OS on the hypervisor, instead, initrd itself launches a group of docker images, aka Pod on it.

<comment><USER23> So you're running all the containers on the initrd kernel?

<comment><USER24> I had the same question, and had to dig a little into the Google Pod documentation for this handy explanation: "In terms of Docker constructs, a pod consists of a colocated group of Docker containers with shared volumes."[1]

Based on the above tidbit, each Pod contains a few containers, thus a Pod (and hence all of the containers in the Pod) will indeed be running on the initrd kernel from the HyperVM instance.

The key point is that this applies for _each_ HyperVM (i.e. one HyperVM launched per Pod). It seems the idea is that wherever you'd normally launch a container, you can now instead launch a lighweight VM that behaves like a container (i.e. fast to launch & small footprint) with default virtualization benefits.

Basically, if you replace all instances of the term "HyperVM" with "ContainerVM", it may help to parse their explanations more easily.

[1] [https://github.com/GoogleCloudPlatform/kubernetes/blob/maste...](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/pods.md)

</comment></comment></comment></comment><comment><USER25> The first you see when you load that page is a website telling you to curl to bash.

The next thing you see is a gif that didn't seem to tell me what it actually is.

I notice that it uses Kernel 4.0.1 - which is great that they're using something modern, however 4.0.1 has a critical EXT4 bug that causes major data corruption. This has been fixed in 4.1 RC5.

A lot of typos throughout the site too:

\- "Subscribe to the lastest Hyper news." \- " Pod is the first class in Hyper"

I won't even mention the use of comic sans on their diagrams...

<comment><USER26> > I won't even mention the use of comic sans on their diagrams...

Actually, you just did.

</comment></comment><comment><USER27> >curl -sSL [https://hyper.sh/install](https://hyper.sh/install) | bash

Seriously? Developers need to stop sprouting this crap as an install method. Nobody in their sane mine should curl a script into bash to install a product.

<comment><USER28> There is no difference to running an executable. In fact, this is the BEST way to offer installation to users. He is literally showing you the source code so you can decide whether you actually want to run it or not. This stupid meme of not wanting to run scripts is just that: a meme.

<comment><USER29> How many production servers have you been responsible for in your lifetime?

"There is no difference to running an executable. "

... There are these following differences.

1\. That url, assuming no malicious 3rd-party/nation-state is spoofing the response, could return any different version of the installer resource at any given time.

2\. That url might not always be available, for any number of reasons, and how is someone who wants to "discover" this software when they are looking through their available package list?

3\. Who knows what that url is "suppose to do" ... there is no signing process, peer review process, nothing, you get whatever the apache server on the other side of that HTTP request wants to give you, and your gonna send that right into your root shell...

4\. Unlike a package, sitting in my personal safe, self host, audited, self- verified debian package repository mirror ... this URL might not work tomorrow, it might not work at 3:35am when my primary server took a shit and i need to rebuild the whole stack... who knows what this URL will do in between subsequent runs... it could return 2 different things when I am trying to build a cluster of this product.

<comment><USER20> 0\. Thousands. Tens of thousands, probably.

1\. True of any download link as well.

2\. See 1.

3\. See 1, unspoken comparison to trusted package archives excepted.

4\. Yes, getting your software into an official publishing channel is preferable, but not automatic, not immediate, and not without update latency.

I'm 110% with you on hating pipe to shell, however. Your arguments don't really address the issue.

And note also that you can just clone from github if you don't like piping to shell. And nothing prevents you from packaging it yourself in your own trusted repository. If you run serious infrastructure, you already do this.

</comment></comment></comment></comment><comment><USER30> Wake me up when there's a Docker-independent hypervisor engine.

<comment><AUTHOR> Hi there, not sure what you mean by Docker-independent hypervisor engine? Hyper uses Docker images format in order to ship containers, but is totally independent from Docker engine.

</comment></comment><comment><USER31> I like how the animation in the header of the website requires two of my CPU cores at full speed.

Also offering piping to bash as first alternative for installing something.

<comment><USER20> I _agree_ with you on both counts, but still find your comment gratuitously negative.

This looks like a very cool thing, and an important missing piece.

<comment><USER32> It's "gratuitously negative" to ask me to pipe a script I download from the Internet into bash directly.

They _really_ should, for security reasons, spend the 5 seconds it'd take to separate those into two commands, or come up with a better way to do things (which would probably take more than 5 or 30 seconds).

Reminds me of pip (python packaging manager), who will, almost narcissistically, remind you about how important it is to use secure connections for python repos, and in fact will refuse to run without a bevy of flags set explicitly allowing any kind of insecure or unverified package, but first ask you to download and run a python script with an embedded binary, because that's the only way they could think of to get bootstrapping working.

<comment><USER33> "Separate those into two commands"? That's it? Really?

This just screams "cargo cult".

<comment><USER34> Not really. By separating the two commands and using && between the two, you ensure the script will download successfully before executing, instead of potentially leaving you with the software half-installed.

</comment></comment></comment></comment></comment><comment><USER7> "When VMs take tens of seconds to boot, Hyper is able to launch instances in sub-second"

tens of a second would be +- same as sub second ;)

<comment><USER35> Tenths, maybe; tens—not so much.</comment></comment>


Show HN: Takehome.io – Time-limited coding challenges for interviews via Git - <AUTHOR> https://takehome.io/ <comment><USER2> I don't like the timeboxing aspect. It's putting pressure on the candidate. I don't know why the website says there is less pressure when it's time limited. Do you have a study or other evidence to support this claim?

For code exercises I set when recruiting I send a pdf out and then expect a zip file or link to GitHub or bitbucket with the solution. I might give an advisory along the lines of this shouldn't take more than half a day. But if the candidate screws up and starts again that's ok. Mistakes and wrong turns are taken all the time in the real world. It works very well. Simple. No complications. And free.

<comment><AUTHOR> Hey, thanks for the feedback.

The idea is that the candidate knows they can do the best they can within the time limit, and then it's done. No agonizing over whether it's good enough or they should spend another few hours. No imagining how many hours and days other candidates for the same role might be putting in, wondering if they're going to stack up.

I've used this approach with around 100 candidates hiring for various roles in my own business and for clients. The response I've gotten from candidates has been overwhelmingly positive.

The problem I have with the traditional "don't spend more than about X time" approach is that it's not a level playing field. The responses to a challenge exist in relative terms, not absolute. It doesn't matter whether your response was great or not. It matters whether your response was in the top 5 of all the other candidates responding. It follows that you probably need to spend at least as much time, if not more, than all the other applicants for the role. How much time the other candidates _might_ be spending is basically unbounded, leading candidates to spend vastly too much time working on a challenge and then lying about it.

If the candidate screws up a timed challenge that's also totally okay. It'll be a great conversation to have in the follow-up interview. "I started down this road, but if I was doing it again I'd do X, Y and Z because of A, B and C."

Incidentally, I'd suggest that half a day is way too long. Especially if that half a day isn't actually enforced. When I'm hiring I usually set challenges of about 40 minutes, an hour and a half max. I'm not looking for a product that's ready to ship to production. I'm after a sense of whether the candidate can actually interpret a problem then string some code together, and something meaningful we can discuss in the next interview.

<comment><USER3> How often in their day job will someone be under artificial time pressure to solve a task and get it to a point where it's "good enough"?

You're actively removing the possibility of finding out who would think "meh thats good enough I guess" is the effort needed for production code and people who would go the extra step of spending time analysing and fully solving the problem.

2 people with equally average solutions...would one have done more given the chance? Both? Neither? How can we find out? You've added uncertainty to the process rather than solved any problem.

<comment><USER4> Often enough someone will be under real time pressure to solve a task, right?

<comment><USER5> That's more indicative of poor management and planning on the company's side than reflecting on the performance of the candidate if the time pressure is a regular occurrence.

Few people perform well under pressure. Do you want to test what is their mediocre performance under time limits like on a school test or what they are really capable of?

With this approach you will hire people able to churn out crappy but "good enough" code in the limited time. Not people who actually can do quality work.

<comment><USER6> No real company has perfect management and a lot of them have poor planning.

> Few people perform well under pressure.

Yes, but majority of jobs have some level of time pressure. That being said, there is such a thing as reasonable deadline.

> With this approach you will hire people able to churn out crappy but "good > enough" code in the limited time. Not people who actually can do quality > work.

Inability to perform under pressure does not imply high skill without pressure.

<comment><USER5> > Inability to perform under pressure does not imply high skill without > pressure.

Ability to churn out crap in a time limit doesn't imply competence neither.

<comment><USER7> Well, it implies competence at churning out crap within a time limit, which for a lot of managers out there is precisely what they're looking for.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> My rule of thumb was to decline any interview with "challenges" \- works perfectly as a filter of perverted corporate climate.

<comment><USER9> I wonder how would you do hiring for your fictional company? (Assuming you get 100s of shitty dev resumes when you post a job opening)

<comment><USER8> I am actually hiring for my contracting projects - I just have a general talk and ask for a piece of any recent code. And even this is just a ritual: only real project in your (not other company) real work environment shows.

<comment><USER10> > any recent code

which is unlikely to be available if they aren't the owners of the IP.

So either you have to guess real lucky, or have a probation period of a week or two with any new hire. Wouldn't you say that's worse than a short take-home project (for the employee)?

<comment><USER8> I am not saying I don't have problems with finding people, I am saying here that companies are creating even worse problems by their naive automated HR assumptions.

</comment></comment></comment></comment></comment><comment><USER11> I thought I would chip in on the pro-time limit side as we seem to be underrepresented so far. I certainly have been given challenges that supposedly take 6 hours but clearly take much longer than that. An entire weekend at least. I don't have that time and I declined but if it really was a 6 hour test they would have gotten an attempt from me. A time limit makes it fair for those with other commitments.

</comment><comment><USER12> I like it! We may quibble over what the time limit should be, but I think that doing coding challenges this way is the most inclusive and fair way to do a coding interview. All candidates do the work in their own environment, so one doesn't have to make an exception for, as one example, a blind person who can't write on a whiteboard. It's also more inclusive for potential interviewers; consider the challenges involved in a blind or visually impaired interviewer watching a candidate code in real-time. This way, the interviewer doesn't have to watch in real time, just as coworkers usually don't watch each other in real time on the job. Unless the team does pair programming, of course.

To take it all the way, I think the follow-up discussion should be done strictly in text, using some combination of IM and a web-based code review tool. So the interviewer would call out parts of the PR and comment on them through the code review tool, and the two could have more free-flowing discussion over IM. Again, this would be just like the way it's actually done on the job, at least in my dream all-remote environment.

</comment><comment><USER13> I like the gist of this (I think take-homes are the best way to evaluate a candidate), but making it time limited seems weird. You're basically taking a test that you haven't studied for -- that doesn't seem fair (or fun).

<comment><AUTHOR> What is an interview if not a test? The code challenge portion of an interview process is a test that you've been studying for your entire career.

As for fairness, I'd argue that timing it is the only way to ensure it. This way you know that the playing field is level between you and the other candidates applying for the role.

To fun, I'd say that the least fun thing I can think of in this context is spending days wondering whether I had "done enough yet" in order to make my submission stand out ahead of the other applicants. Much more fun to know that as soon as that clock ticks over, what's done is done and I can get on with my life for better or worse.

<comment><USER14> How does your approach differ from the sites being already used by companies for online coding test? They do the same thing, you login during some fixed duration(24-48hr) in the weekend, and you do the coding challenges(they have a web interface to compile your code) within the alloted time.

<comment><AUTHOR> I think the main difference is that those sites are geared towards outputting a ranking or score of some time. Takehome is geared at giving you a way to qualitatively assess the skills of each candidate and give you something meaningful to discuss with them in a follow-up interview.

Also, all of the existing sites I've seen have one or more of the following problems:

* Make you use their editor * Make you install their software on your computer * Make you use some specific language * Make you use their set of challenges

Takehome uses nothing but git. Whatever you put in the repository and how you get it there is up to you.

That holds true both for the candidate and the challenger. Takehome encourages challengers to create their own task matching the kind of work/language/framework/etc that's relevant to their team.

</comment></comment></comment></comment><comment><USER15> Don't see the value of the service. It just sounds like a simple CRUD app where people can create "challenges" and send them out to potential candidates.

And for so little done by the service, I find the cost to be completely perverse.

<comment><USER16> Yep, all it does is wait for the first `git push`, display the challenge text, then allow further pushes before the time limit and denies them after the time limit. A per candidate price quickly gets expensive.

<comment><AUTHOR> The price is per-candidate to discourage companies from sending out more challenges than they have time to thoughtfully review. The expected use case is that you interview the candidate, then if you are both still interested you issue a takehome challenge, then you have another interview to discuss the challenge submission.

If you're issuing more than 5 challenges per role you fill something somewhere has probably gone awry. $100 per role hired is no more than a rounding error.

Also, the timer starts from the first `git clone` rather than the first push.

<comment><USER17> IMHO trying to educate companies about their process is a sure way to failure.

Also doing interviews before technical challenge is a sure suicide for companies. In my experience to minimise the waste of time you send out quick and easy technical challenge (no more than 30 minutes!) and you filter out 90% of applicants. With remaining 10% you have a phone call and if you have more than X (magic number of 3 in my experience) of qualified applicants you send out more thorough tech challenge (no more than 2h long!).

Rinse and repeat until you get to X applicants which you will invite for face to face interview.

Truth is that almost no-one in tech is qualified to do face-to-face interviews. Either they are not on the level technically or dont have the communication and HR skills. Interview in person is mostly to see if you are not dealing with a weirdo and if that person will be a good fit for the team.

A side note, I tend to issue valuable response to every candidate. If you do that, they are very likely to re-apply, step up when someone drops out or recommend to friends. People tend to do/say the same dumm stuff so you can prepare those replies as well.

</comment></comment></comment></comment><comment><USER18> I use Codility for code screening: [https://www.codility.com/](https://www.codility.com/)

In most of the Europe take home exams are common during the interview process, but your online test should be 1h (at most 2h). If you make it longer, very few ppl will invest that much time in competitive job market such as software engineering.

Take home tests are way harder in the hottest market such as San Francisco Bay Area. A lot of candidates will simply drop out of your pipeline if you send them. IMO there are good for fresh grads, junior candidates or candidates that would you otherwise reject in resume screening. There are hidden gems, often in underrepresented minority that simple don't have anything impressive on their resume yet. Being able to identify them can be your competitive advantage.

<comment><USER19> I've used TestDome in the past, [http://www.testdome.com](http://www.testdome.com).

The tests are tidy and the in-browser IDE is not bad.

</comment></comment><comment><USER20> I just completed the task in under 10 minutes for the example socialite one. It would be neat if the candidate could mark the repo as finished, so that you don't have to wait the whole time before it is over. Cool idea overall!

<comment><AUTHOR> Thanks, that's a great idea. I'll add it to my burndown.

</comment></comment><comment><USER21> We send much smaller coding tests using [https://remoteinterview.io/](https://remoteinterview.io/). Take-homes require way too much time commitment from the candidate side. We have tried them but the candidates would never finish.

With coding tests, we isolate a smaller problem and send that as a fizzbuzz screener. This scales well as solutions are checked automatically.

</comment><comment><USER22> I like the trend towards tools like this helping with the software engineering hiring process. I know that these things can be points of contention in the community, but in general the problem of reducing the time commitment from the hiring team while still providing the candidate with a low-friction experience that produces a meaningful expression of capability isn't going away any time soon.

</comment><comment><USER23> Probably should offer a review service and coding challenges too! A company that is capable of reviewing and making code challenges surely has the competence to set up a git server, but there's plenty of companies that can't or don't have time, so I definitely think there's a market.

</comment><comment><USER24> A service where I can `git clone` a repo and _that_ is what starts the timer for the coding challenge is a great idea.

When I was recently job hunting, I had a bad experience with a company that wanted me to take a timed coding challenge where I would clone a repo and then submit a pull request with my solution. What started the timer then was them opening the repo to me, not me accessing it. This required us to agree on a time for me to take the challenge. Long story short, the recruiter proved incapable of opening the repo at the times we agreed on.

Avoiding that need for coordination and chance for the recruiter to mess things up is a nice benefit of your service.

</comment><comment><USER25> This seems useful, and I get the value. I'm wondering how you balance exactly how much time to allot? Do you try to come up with an average estimate of time needed and then like 2x that to reduce time anxiety?

<comment><AUTHOR> Thankyou! Any person using the site to hire candidates can set whatever time limit they like.

When I'm choosing a time I'm actually less worried about the complexity of the exercise than how much of a candidate's time it's reasonable to ask for. If the challenge is too complex to be done in 40 minutes or so, I make it less complex.

I also put language in the intro text like 'If you don't end up with a complete solution in that time, that's fine, just submit it anyway. We don't expect this to be enough time to write "The Most Perfect Thing".'

If you're curious, sign up and take a look at the "Socialite" sample challenge.

</comment></comment><comment><USER26> This is too expensive and it doesn't even let me take the challenges myself without paying $20AUD, even though is says "Free Trial".

Also, it's basically just 2 forms and some scripts.

<comment><AUTHOR> It definitely _should_ allow you to challenge your own email address without any charge. If you're still having trouble and you'd like to test it out, please drop me a line on email@example.com and we'll figure it out. The trial has worked great for everyone else so it sounds like a juicy bug I'd love to hunt if it's not working for you.

</comment></comment><comment><USER27> I think this looks really cool. I like the ability to send multiple challenges to a candidate. I also like that as a side effect, it tests a candidates proficiency with Git.

I would choose a large time window- 4-8 hours or so. That way it ensures there is plenty of time to complete the challenge but also that it gets done in one day, like a normal workday.

<comment><USER17> By proficiency you mean clone and push?

<comment><USER27> Clone, add, commit messages, push, ignoring dependencies, writing an instructive README.md, etc. All basic skills you'd expect a developer to have.

<comment><USER28> >All basic skills you'd expect a developer to have.

Yeah, if they've used git before. Otherwise they'll need at least a solid 30 minutes to figure out the most basic git usage pattern.

Do you really care about what source control system a person has experience in? Why? Any competent developer can pick it up quickly enough.

</comment></comment></comment></comment><comment><USER29> this looks very cool - the single biggest thing that makes or breaks this space is the strength of the integrated applicant tracking system (ATS).

Do I need to use another ATS ? then my team will just give up on this. If you have a limited ATS in there (with stuff like emailing from the dashboard, reading replies from the dashboard), then this is killer

<comment><AUTHOR> Currently no ATS at all. I've specifically kept it focused on doing a single thing well. I appreciate the feedback, though. I'll consider incorporating something along those lines.

</comment></comment><comment><USER30> This is a great idea. I could see becoming a customer of yours if you added: \- payment in USD \- Ability to provide a post-receive hook to run validation / tests / benchmarks, and see results with the notification of submission. I appreciate that doing this in secure fashion is a nontrivial effort.

<comment><USER31> > payment in USD

Honest question: why? Can't your card / bank / PayPal do the conversion for you? (I say this as a Canadian who often pays USD with my Canadian card / bank account).

<comment><USER32> The bigger issue for me is pricing in USD, and less about the currency in which payment is collected. I'm in the UK, and while I can generally work out a rough exchange rate for GBP to USD and EUR in my head, I've no idea what the current AUD rate is. Making me check is a small but real barrier.

</comment></comment></comment><comment><USER33> The idea of "take home tests" for an interview is utterly bizarre to me. Thankfully I've never heard of it my parts, seems to be a mainly US thing?

<comment><USER34> I think most jobs I applied to out of college had them. It is a good way to vet if someone can code before bringing them in for an interview and wasting a bunch of peoples' time. At my company we're currently struggling with not doing timed tests but not wasting too much of a candidate's time.

We hire a lot straight out of college, which I think is probably where this type of test is more common.

</comment></comment><comment><USER35> Integrate the payment mechanism.

</comment><comment><USER36> i will say that I like your pricing model. Free to try it out yourself and only $20 (or whatever the currency rate is in AUS) for each time you use it with no monthly fee.

Personally this is how most online services should be, pay per use.</comment>


This Is Why Business Executives Don't Talk About Current Events - <AUTHOR> http://www.vocativ.com/tech/internet/paul-graham-twitter/

<comment><USER2> In general, everyone needs to chill out and not have knee jerk reactions over random links. Twitter is especially bad when it comes to conveying viewpoints on any topic.</comment>


Nine Charged in Insider Trading Case Tied to Hackers - <AUTHOR> http://www.nytimes.com/2015/08/12/business/dealbook/insider-trading-sec-hacking-case.html <comment><USER2> Two more great links:

The, like, inimitable Matt Levine (I know, right?):

[http://www.bloombergview.com/articles/2015-08-11/why-not- ins...](http://www.bloombergview.com/articles/2015-08-11/why-not-insider- trade-on-every-company-)

The SEC complaint, which is chock full o' details:

[http://www.nytimes.com/interactive/2015/08/11/business/dealb...](http://www.nytimes.com/interactive/2015/08/11/business/dealbook/document- complaint-from-sec-in-hacker-insider-trading-case.html)

<comment><USER3> Is this really insider trading, if none of the alleged perpetrators were insiders, nor was there anyone breaching a duty to protect the information. It seems like they'll have a pretty strong defense on this point.

<comment><USER4> Well, I'm not a lawyer but sounds kind of illegal to hack companies to acquire non-public material information and profit from it.

If it's legal, sounds like a promising startup for YC, smart hackers changing the world, they should apply to the next cycle!

<comment><USER5> Of course the hacks are illegal, he was asking whether using the data should be classified as insider trading.

<comment><USER4> 'Of course hacks are illegal', but paying someone to hack and profit from the inside information is OK?

[http://www.bloomberg.com/news/articles/2015-08-11/hackers-10...](http://www.bloomberg.com/news/articles/2015-08-11/hackers-100-million- insider-trading-shop-sold-data-on-demand)

'Insider trading' is trading on material nonpublic information that was inappropriately acquired from an 'insider'.

There are situations that are gray areas but this does not appear to be one of them.

</comment></comment></comment></comment></comment><comment><USER6> The worst part about this is that I've heard they wouldn't have been captured if they didn't get greedy and increase the size of their trades and continue to reuse the same trading accounts.

Allegedly they were hacking into news services and reading news before it was publicly released, which means their investing time frame was measured in hours and minutes.

This makes it much easier for the SEC to find this type of behavior as these types of trades, especially in the options markets stand out, when done at large sizes.

The SEC takes alot of grief, some well earned, but you should assume that when a stock moves, they'll run an automated scan of every trade that profited from that in the days/hours leading up to that move and over time they'll cross reference those trades to watch for accounts that continue to do this over time when they have reason to suspect illegal activity.

Think of it like athletes blood samples being held for years after competition. They won't test all the samples held but they have the data there to look back on if they find a reason to.

<comment><USER7> If these trades were being done by DB or Citadel, there'd be a slap on the wrist. But if you're a rogue trader, or god forbid a lone 30 year old in your parents basement, off to the big house for you.

If anything this just shows that the SEC has all the tools in the world to stop illegal activity, yet it does nothing, so long as you're part of the Wall street establishment.

<comment><USER8> really? so Steve Cohen isn't part of the Wall Street establishment? How about Raj Rajaratnam and Rajat Gupta -- the last a board member at Goldman. Just started his two year stretch in the federal pen.

<comment><USER9> I agree with you in general. There have been successful prosecutions which have resulted in significant jail time. Although the Supremes have yet to weigh in on the latest batch[1], and right now it's not looking good for the Feds.

But I disagree with you about Stevie Cohen. Quite a few of his underlings took a fall, but he personally emerged scot free. He simply wrote a very big check and made his problems go away. He's busy managing his remaining billions in a "family office".

[1] [http://www.nytimes.com/2015/07/31/business/dealbook/us- asks-...](http://www.nytimes.com/2015/07/31/business/dealbook/us-asks-supreme- court-to-review-insider-trading-ruling.html)

</comment></comment></comment></comment><comment><USER10> You can theoretically succeed at this as long as you stay within a statistical random probability and can maintain absolute secrecy.

This is essentially what Alan Turing realized he had to do with the information decrypted from Enigma... He had to let enough bad things happen so that German analysts wouldn't see a statistical red flag, signifying an information leak, but he had to divulge enough to steer the war to victory for the Allies.

</comment><comment><USER11> Might not be the same group, but never heard whatever happened to the "faster than light speed" trade (OP article didn't mention this incident): [http://www.washingtonpost.com/news/wonkblog/wp/2013/09/24/tr...](http://www.washingtonpost.com/news/wonkblog/wp/2013/09/24/traders- may-have-gotten-last-weeks-fed-news-7-milliseconds-early/)

</comment><comment><USER12> I still don't understand the difference between insider trading and HFT firms that get data before other firms.

<comment><USER2> Which particular instance of HFT firms getting early data are you referring to? Different people might be talking about wildly different things when they say that.

The general answer is going to be: the HFT's early access doesn't implicate a principal/agent problem. The people generating the data HFTs act on don't have a fiduciary duty to the shareholders of the companies they report on.

<comment><USER12> Ah okay this makes sense. I didn't think about the problem as a principal/agent problem, which is how insider trading is framed. Got it. Thank you.

</comment></comment></comment><comment><USER13> I wonder, how many cases of insider trading by NSA employees and their extended families have been prosecuted much less investigated?

<comment><USER14> Why would the NSA monitor everyone in the world but not its employees' activities on their internal databases? Security within the NSA would have to be pretty terrible if employees were running their own hedge funds on the NSA's data without the NSA noticing. That said if it did somehow happen they might be prosecuted against intelligence laws rather than financial law so they wouldn't have to reveal aspects of their internal data into public evidence in an insider trading trial.

<comment><USER15> > _Security within the NSA would have to be pretty terrible if employees were > running their own hedge funds on the NSA 's data without the NSA noticing._

I believe this is one of the points that Edward Snowden was trying to make. He himself could have had a hedge fund, and he could have used private information he gained in his NSA contracting before that information became public knowledge.

Hell, his coworkers were getting in minor trouble for stalking their exes.

<comment><USER16> Be real, Top Secret clearance checks routinely look at finances, and employees are told to report colleagues purchases that seem out of place. Not necessarily because they are running a hedge fund, but more likely are receiving money from the "KGB" to steal secrets.</comment></comment></comment></comment>


Insurance Company Pays People to Stay Fit - <AUTHOR> http://www.wired.com/2014/12/oscar-misfit/?hn=1

<comment><USER2> I'm really curious to see what people think of this. I think this combined with bitcoin can open up some cool possibilities.

Meaning I would love to come up with an algorithm that works while you workout. Then the hash rate is timed to number of steps or kilometers taken to release a block of bitcoin. Which I think could open up even more fitness incentives.

You could even have "races" to see who can find a hash before the others in your group.

Of course people could try and cheat, but that would be where the secret sauce is... kinda like reCAPTCHA but for bio-metrics.</comment>


Feeds addiction - <AUTHOR> https://email@example.com/why-are-you-reading-this-7f8d12fb6e2f#.7ha7sujbt <comment><USER2> There are virtual piles of bad curated lists. And I have a deep dislike for the promoted "news" stories. But I like suggestions at times, especially in some of my weirder topics. "People also read"... or links to other related articles, or sometimes just random interesting links. It isn't always that I'm looking for something specific, just wanting something little to read.

This isn't a new behavior: People buy newspapers and magazines with a variety of content. Even if they bought it for one article, they tend to read other bits. My grandmother kept readers digests in the bathroom when I was a child... a captive audience will read about anything.

The bigger difference is that instead of making money selling the articles and traditional ads, places are making money if you click on the article via ads and other means. Some of the stuff out there is absolute poppycock - but we had tabloids well before the internet. And people believed them. Seems that people should just be advised to use some discernment when they click and read those articles, because of the poppycock that now easily proliferates.

<comment><AUTHOR> There are plenty of articles, books and videos from which you can gather the needed information. I also like suggestions, but you can not focus on your personal interests if you always get distracted with news from other fileds.

<comment><USER2> See, that's the thing I'm trying to get at. If you are getting distracted by links while trying to focus on personal interests, that isn't a problem with the internet nor internet culture. The simple answer is that if you find you are clicking through links instead of being productive - and you have a problem with that - then simply stop doing it, limit your time, etc. The internet and the links simply replaced some of the distractions of old, and it is really no different than reading a bit too long on the toilet instead of doing your daily grind already.

There can be a problem with people not handling distractions well. ADD can do that, as well as anxiety, depression, and simple poorly trained concentration skills. All of which are solvable to an extent.</comment></comment></comment>


Just Published My Webpage - <AUTHOR> http://niteshsarode.github.io <comment><AUTHOR> niteshsarode.github.io Please let me know any suggestions, feedback. Want to keep it simple</comment>


Ask HN: Will Kubernetes Replace Docker Swarm? - <AUTHOR> <comment><USER2> Probably not in the short term because the products are targeted at different market segments. Kubernetes, as one would expect for a Google product is targeted at operations staff. Docker Swarm, like Docker, is targeted bottom up from individual developers. Swarm extends Docker. Kubernetes extends servers.

</comment><comment><USER3> Take a look at [https://www.cncf.io/blog/2017/12/06/cloud-native- technologie...](https://www.cncf.io/blog/2017/12/06/cloud-native-technologies- scaling-production-applications/). It already has, more or less.</comment>


What do you think about our Growth Hacking tool iogrow.com - <AUTHOR>

what do you think about our stratup iogrow.com who let you get new Customers, be Organized and Grow your Business. <comment><USER2> It looks like you haven't figured out what ioGrow is yet, and that, in turn, makes it difficult for anyone else to figure out.

Here you're calling it a "growth hacking tool" (using that term just turns people off), on the site I'm getting mixed messaging about "social discovery," CRM, project management, and collaboration? So... what exactly is it?Or is it all of those things at once? In which case, why start with "social discovery," something that's available in any marketing SaaS?

<comment><AUTHOR> So yes as you said is a mixed tool between CRM and Social discovery tool, using Social discovery tool you will get new leads, people who talking about your products in twitter and manage them in CRM. so i really appreciate your feedback after testing to firstname.lastname@example.com, thank you</comment></comment>


Steve Jobs' Business card from 1979 - <AUTHOR> http://people.mozilla.org/~pfinette/tmp/steven_jobs.jpg Woz' for reference: http://www.networkworld.com/community/blog/steve-jobs-business-card-1979 <comment><USER2> In case anyone is wondering (but not enough to actually call...) The number is now a generic Apple phone number (Press 1 for sales, Press 2 for tech support)</comment>


Massive 2.0: A Postgres-Centric Data Access Tool - <AUTHOR> https://github.com/robconery/massive-js

<comment><USER2> Does this handle connection pooling? I notice that in the README, the example establishes a connection to the database, and then the Express app runs. Is this a single connection for the entire time the node app is running in a process (yikes!), or is there some sort of connection pooling going on in the background with this?

<comment><USER3> Yes there's connection pooling. But it's handled by the underlying PG library [https://github.com/brianc/node-postgres](https://github.com/brianc/node- postgres) that Massive is based on.

</comment></comment><comment><USER4> A .NET library with the name "Massive" already exists with similar functionality: [https://github.com/FransBouma/Massive](https://github.com/FransBouma/Massive)

Is there any inspiration/connection between the two?

<comment><USER5> They're both created by the same author, Rob Conery. Frans has taken over maintenance of Massive 1.0.

</comment></comment><comment><USER6> Can be tweaked to quickly used as the REST API on top of Postgres

</comment><comment><USER7> Me likes it :)</comment>


Lean Prototyping Techniques for Hardware - <AUTHOR> http://www.graehamdouglas.com/lean-prototyping-for-hardware/

<comment><USER2> I have been amassing stuff for a long time. My friends call me a hoarder, but I shrug it off. Every time I move I have boxes and boxes of stuff to bring with me. It's a pain.

But, I am getting ever so close to the day when I wake up in the morning with a good idea, and before I go to bed at night I have a functional prototype. Talk about momentum, if you can go from nothing to functional (for something somewhat complicated) in a single day. It's easy to do with software, all the parts are there, there are zero expenses to getting a prototype working, but oh so much harder with all the things you could need in the real world.

There's nothing that puts out creative fire like waiting for parts. When you first think of something, your mind is most easily changed. I like thinking of thoughts as crystallizing idea space. The more you think about something, the more real that idea becomes. When you need to wait a week, and you have only your thoughts to throw at your project, you'll start to put the fire out. Your mind will be less able to change because it's creating a thought structure based on only your first ideas and how you will implement the parts that are on the way. Experience fuels the fire, thoughts put it out.

<comment><AUTHOR> I mostly agree with you, including the pains of moving my hoards of parts (or junk, as my friends call it). Ideas need time to ferment, but they spoil if they are left in the mind for too long without manifestation.

This is exactly why I advocate early prototyping at the dollar store (or hardware or electronics stores). Often a lot of that stuff can be sourced quickly and locally, or something close to it. Let the hoard stay in someone else's place. Beyond that, McMaster-Carr, EBay, and Amazon have delivery times under a week to Canada, I expect its only a day or two to the USA.

This is also why I advocate CAD prototyping. You don't need any parts around, but once you are happy with your design, it is quite quick to order or make parts, unless something particular is required.

<comment><USER2> I'm working on making a 3D printer to speed it up (and to force me to learn CAD). But most of the stuff I do is electronic, so if I don't have a specific part that a) I don't have, and b) the surplus store doesn't have, then I need to wait a while and pay $7 in shipping for a $0.35 part.

If I had more money where the $7 convenience fee of storing the junk at someone else's house wasn't a big deal, I would totally keep it all there. It's kind of like Amazon Glacier, it takes a while to get it, and it's expensive, but you can put everything there. If it's on disk drives in your garage you can store a bunch, but it takes a little bit to find. If it's on SSD storage on your desk, it's the quickest to iterate, but then everything is right there.

</comment></comment></comment><comment><USER3> I'm sure this isn't what Graeham had in mind with this post, but I'll comment anyway: Steven Spear identifies rapid experimentation as one of Toyota's strengths, not necessarily in product development, but developing how they build the product. An example given in his book was checking to see if adjusting the height of a source of parts. Rather than welding it a new position, bolting it, or even using duct tape, the fastest way to check is to just hold it there. It's cheaper and faster. When you lower the costs (both money and time) of experimentation, learning happens more quickly. Or as this post puts it: "the more you can build quickly, the faster you can find what you don't know"

Rapid prototyping/experimentation leads to rapid feedback, which in turn can lead to rapid learning.

<comment><AUTHOR> Well put. Toyota's lean manufacturing was in fact what I had in mind when referring to the origins of the term. I wasn't familiar with that particular example, but was referring in general to Toyota's reputation for trying to reduce various forms of "waste" in their production.

</comment></comment><comment><USER4> There is a huge benefit from 'getting your hands' on something. For folks who are visually challenged (verbal thinkers) having a prototype or a way to provide a sense of scale and design is really really important.

Steve Roberts clued me into a really useful way to prototype an enclosure, basically corrugated cardboard and fiberglass. Make your "thing" out of corregated cardboard (some sturdy boxes) and then cover it with fiberglass dipped in resin. (be sure and where a respirator mask though, the fumes are nasty).

<comment><USER5> That's how I build the base part for most of my little robots. Be aware that fiberglass can cause allergic reactions in your skin. Wear long sleeved shirts and gloves. You may also prototype with cardboard, wooden sticks (like those used in popsicles), duct tape, and a hot glue gun. If you want to mess with plastics, you can go to the junkyard and buy some inner fender covers from wrecked cars. Then just use a heat gun to mold or melt the plastic to whatever shape you need. If you make a mold with fiberglass, you can easily fill it with this plastic. It is quite durable and can be drilled/tapped. Bondo is another great thing to use, but be aware that it is very dusty and messy.</comment></comment>


Vim-netranger - <AUTHOR> https://github.com/ipod825/vim-netranger <comment><USER2> Haven't really looked at the source, but is the neovim dependence just for starting ranger async? In that case vim 8 support might come soon?

I have a neovim build, but I tried out SpaceVim on it and just went back to a very lightly patched vim since SpaceVim felt too bloated and I've been too lazy to clean it all up.

<comment><AUTHOR> No. It's more like to implement ranger's functionality using neovim's rplugin framework. Vim8 support would require other framework such as nvim-yarp.

</comment></comment><comment><AUTHOR> This is a "neovim" storage explorer plugin to bring together the best of Vim, ranger, and rclone. It's called vim-netranger just because I might port it to vim8 in the future. It's still under development, but is already very useful.</comment>


Ask HN: Review My Library, Tempest - <AUTHOR> http://code.google.com/p/image-tempest/ I wrote Tempest to reliably generate image heatmaps/clickmaps in multiple languages with the same or similar API.
I also hate compiling dependencies, so each implementation is done purely in its targeted language instead of the common practice of implementing in C with language-specific bindings.  Clearly, this has its own pros and cons.
I know it's far from perfect (it's still in beta), but I'd welcome any suggestions or constructive criticism from the HN community. <comment><USER2> Is there a way to change the colormap? Rainbow colormap is considered 'harmful': <http://www.research.ibm.com/people/l/lloydt/color/color.HTM>

<comment><AUTHOR> Yes, the API (which I will add a link to in the google code site wiki) specifies getters and setters for the image file used as a colormap and the image file used for point-plotting

</comment></comment><comment><USER3> Very cool looking! I am going to consider using this for an upcoming project.

One of my most significant criteria for using a library is its API and documentation. Maybe I'm not looking in the right places, but I had trouble finding API.txt in your repo; consider including a link to that from your project page. Also, it would be helpful if you provided an example script in each language on your website as well.

<comment><USER4> Agreed - I'm a little confused about how to use it because I couldn't find the documentation.

I'm wondering how much of an impact on site load something like this would have. Thoughts?

</comment></comment><comment><USER5> Looks interesting, quick comment on the demo

<http://projects.digitalflophouse.com/tempest/example>

Maybe move the Coordinates box right under the image and put some text like "Please Click Above To Generate Coordinates"

First thing I did was quickly scan the page and click "Render Heat-Map" button which threw up a php error.

I know it should be obvious that you should click image, but that text was hidden one of the paragraphs.

<comment><AUTHOR> Thanks, I've done that. I always overlook that kind of thing.

</comment></comment><comment><USER6> It seems quite slow. I am using Python 2.6.4 on Linux, slow processor (~2GHz). I out-commented the testOpacityFrequency and _compare defs in the test/pil.py. Now I added about 10000 points and it is calculating for half an hour already. With 1000 points it tool 5 minutes.

Is that normal performance or did I do something wrong?

edit: after 36 minutes it threw "AttributeError: 'LoadTest' object has no attribute '_compare'", oops that was my fault. Trying again with less points.

edit2: It is swapping... I have 2GB RAM. Using an 8192x8192 image and 20 points. :-(

<comment><USER6> Ok, so with a 2048x2048 image it works alright. Still quite slow though.

But I am rather sure it is tailored for click heatmapping.

<comment><USER6> 1000 points on 2048²: 4 minutes 10000 points on 2048²: 34 minutes

Sadly that is too slow to be of use for me. Or maybe I simply did not use it right.

</comment></comment></comment><comment><USER7> Interesting library. Thanks for sharing!

One question though: where does the screenshot of the item which has been clicked on come from? As far as I understand your lib does not provide any means to create a screenshot? Is this correct? Would it be possible to add this? If not could you explain how you would make sure the coordinates and the screenshot at any given time match?

Just curious and interested in using your library :)

<comment><USER6> Coordinate <-> image matching seems to be the job of the coder. I have not looked at the code yet but I am sure it does not do screenshots. What it probably does is this:

-You provide an image.

-You provide x,y coordinates.

-The tool/library calculates a heatmap from the relationship between coordinates

-The tool overlays the heatmap 1:1 to the image

The Google screenshot and clicking demo is just an example of a possible implementation. You can use heatmaps for many many other things so this surely does not limit itself (nor prefer) to website click tracking. ;-)

<comment><AUTHOR> Exactly, it expects you to provide the image. The coordinates are currently expected to be absolute and pixel-specific, where 55,11 is 55 pixels inward and 11 downward.

If there was sufficient interest, I could implement relative positioning as well, where they resolve to a percentage of the source image.

</comment></comment></comment><comment><USER8> I like it, although I'm having a hard time thinking of a serious case where I can use it other than for example making another CrazyEgg, which I don't think I have the time for.

TINY request - add a reset button to the example. I guess it's saved per session or something, but I spammed a bunch of clicks in one spot which dominates the page a bit.

Great work.

</comment><comment><USER9> Awesome! I had an idea yesterday of making a Burrito Quality Heatmap of San Francisco. Maybe I'll actually do it and use your library.

</comment><comment><USER10> Very cool! This will be awesome for usability testing.

I like the name too, in fact I liked it enough to create a jQuery templating plugin with the same name a few months ago ;)<http://github.com/fitzgen/tempest/>

</comment><comment><USER11> By the way, for people looking for free, open source solution for clickmaps, have a look here - <http://www.labsmedia.com/clickheat/index.html>

</comment><comment><USER6> This comes 3 weeks to late for me but I will definitely rewrite something to use this instead of my half-assed workaround. Will message you with hopefully tasty screenshots once I am done.

</comment><comment><USER12> patio11 --- are you going to roll your own CrazyEgg now?

<comment><USER13> Please do. Last time I checked CE, they had some annoying bugs with no timeframe for fixing. So I had to get a refund.

<comment><USER11> Bugs like? I'll be very interested to learn as I was considering rolling out something of this sort.

<comment><USER13> In fact, it was only one bug (checked on the email I send them): it didn't track clicks on images. So any sort of "Sign Up" button weren't tracked, manking the service worthless to me.

<comment><USER11> Thanks. Wonder why didn't they track clicks on images, cannot imagine a plausible reason.

<comment><USER13> They said it was a bug. So I think that it was a planned feature but wasn't working properly at that time.</comment></comment></comment></comment></comment></comment>


Cybersecurity, VPN and Cellular Data - <AUTHOR> http://roqos.com <comment><AUTHOR> We have built an enterprise grade, open-source, transparent, self-updating cybersecurity, VPN and cellular data company for homes, small businesses, and teleworkers. Please check it out and let us now your questions and suggestions. Thanks.</comment>


Venter's Newest Synthetic Bacteria Has Secret Messages Coded in its DNA - <AUTHOR> http://singularityhub.com/2010/05/24/venters-newest-synthetic-bacteria-has-secret-messages-coded-in-its-dna/

<comment><USER2> This strikes me as the biotech equivalent of map makers introducing fake streets or phone book makers including fake people.

</comment><comment><USER3> So how long before DNA has DRM?

</comment><comment><USER4> It would surprise some to find "JEHOVA" in our DNA.

</comment><comment><USER5> This is the next industrial revolution.

</comment><comment><USER6> "The underlying concept is that the software of life (DNA) will build its own hardware (the cell)." (from the earlier article [http://singularityhub.com/2010/05/20/venter-creates-first- sy...](http://singularityhub.com/2010/05/20/venter-creates-first-synthetic- self-replicating-bacteria-from-scratch/))

Does this go as far as saying human individual is software + hardware? Or more complex data center?</comment>


The Canonical Horrible Restaurant Website - <AUTHOR> http://www.lacasita.ca/home.html <comment><AUTHOR> \- Flash \- Splash screen

\- The menu link doesn't work

\- Background music

\- Contact details that you cannot select & copy

Can you find more?</comment>


Google New: One place to find everything new from Google - <AUTHOR> http://www.google.com/newproducts/

<comment><USER2> Looks _pretty_ , but honestly I'd rather have all text to be able to scan quickly. Is there anything like that around?

<comment><USER3> Also, you cant middle click and open up a bunch of headlines in new pages. Hard to read, awkwardly arranged... I hope Google makes this better, even if its just in a standard blog format.

Edit: right clicking on text auto opens the page - this is weird.

<comment><USER4> Aren't the things Google's listing here services, rather than products? Or am I using a narrow definition of a product?

</comment></comment></comment><comment><USER5> First time I came across a Google page that simply does not work without JS.

<comment><USER6> Yeah, that's worrisome after their long track record of competent diligence in web dev. "If you hire all A people, he said, they'll also hire A people. But if you hire B people, they'll hire the C people and then it's all over."

<comment><USER7> could just mean that Javascript is finally considered ubiquitous in browsers. I like this page a lot, it's an efficient way to see what Google is pushing.

</comment></comment></comment><comment><USER8> I have long had a good source for that: <http://googlesystem.blogspot.com/>

PS: I am not going to gain a thing by promoting it. I genuinely appreciate the quality, focus, tone and the information the author provides.

</comment><comment><USER9> I am disappointed that Google New isn't listed today on Google New. :(

<comment><USER8> Listing Google New on Google New, would be the new thing today.

</comment></comment><comment><USER10> And here is the blog post explaining why they did it: [http://googleblog.blogspot.com/2010/09/one-place-to-find- eve...](http://googleblog.blogspot.com/2010/09/one-place-to-find-everything- new-from.html)

</comment><comment><USER11> Without rss/atom feed it's not very practical...

<comment><USER12> reader added it for me, lets see if it can track changes

<comment><USER13> im trying too lol

</comment></comment></comment><comment><USER14> where is app engine updates? Can't seem to find one from the drop down.

</comment><comment><USER15> Orkut still exists? Huh.

</comment><comment><USER16> This exists to demonstrate to the shareholders and other interested parties that they are innovating or creating new products.

Google must be perceived as growing roughly 25% per year in order to maintain their current stock price.

RSS/Atom feed may not seem practical to some of you but I highly doubt you're the intended audience for this page.

<comment><USER17> Uh... for users to discover new, cool shit.

</comment></comment><comment><USER18> Why does it ask me for 1MB of disk space? It behaviour resembles yesterday's "impossible to eradicate" cookies (<http://samy.pl/evercookie/>).

(full disclosure: MacOSX 10.6.4 and Safari 5.0.2)</comment>


"There is no Yelp for education" says IAVA chief. Well, HN, is there? - <AUTHOR>

Full clip: relevant part starts at 8:10.
http://video.msnbc.msn.com/the-rachel-maddow-show/48603715#48603715
IAVA = Iraq and Afganistan Veterans for America
As a veteran and an entrepreneur this struck a cord with me and thought I'd share it. Seems like a ripe market. I'm not sure if there is, in fact, a 'Yelp' for education if there is they should reach out to veterans. <comment><USER2> RateMyProfessors is the first thing that comes to mind.

Unfortunately, I don't think a 1-to-1 Yelp model for education would work, as RateMyProf would seem to show. A good restaurant is easy to determine: the food is good or it isn't. Universities and students, unfortunately, aren't that simple. Students usually give good reviews to easy teachers, which multiplied across the system, results in lowered standards for everyone.

<comment><USER3> A particular problem is that the reviews don't have much hindsight, because they're mostly filed by students currently in a course, or those who just completed one.

I believe I could now say with reasonable confidence who my better undergraduate professors were, and who the worse ones were. But if you had asked me to rate each professor during or immediately after the course, I would have made different choices, which in retrospect were probably not the right ones. It's very hard to evaluate introductory courses, in particular, until you get a few more courses in, and realize that some laid a good foundation while others didn't.</comment></comment>


NSA's Puzzle Periodical - <AUTHOR> https://www.nsa.gov/news-features/puzzles-activities/ <comment><USER2> Ava always guesses the same color as Bobs forehead. Bob always guesses the opposite color as Ava's forehead.

<comment><USER3> For the four people puzzle. Assign every suit a number 0-3. All four people guess differently what the sum of all the cards is modulo 4, meaning exactly one person will get it right. Using the sum and the view of the other cards the one who guessed right can work out their own card.

<comment><USER4> It seems that we could expand this for n people with n choices.

So in the first case where there are only 2 people and 2 colours, they assign, say 0 to black and 1 to red. Then they each sum up the other choices they can see (which happens to be only one other choice in this case) plus their own assigned number (0 or 1) and answer that modulo 2.

Er..I think...?

<comment><USER5> Yeah, that sounds right. Through that lens, the first problem is a special case of the second problem.

</comment></comment></comment></comment><comment><USER6> Can you crack puzzles devised by the brilliant cryptological minds at the NSA? Find out by logging in to our totally legit, completely innocuous, not in any way a honeypot that collects extensive info on you, puzzle site!

<comment><USER7> GCHQ has been known to do this for recruiting purposes.[1]

[1] [https://web.archive.org/web/20130912120456/https://canyoufin...](https://web.archive.org/web/20130912120456/https://canyoufindit.co.uk/)

<comment><USER8> The german BND too:

[https://www.bnd.bund.de/DE/Karriere/Reversing_Challenge/Reve...](https://www.bnd.bund.de/DE/Karriere/Reversing_Challenge/Reversing_Challenge_node.html)

German video resolving the first of three challenges: [https://www.youtube.com/watch?v=mZH094d0M6A](https://www.youtube.com/watch?v=mZH094d0M6A)

</comment></comment></comment><comment><USER9> August 2016: [https://en.m.wikipedia.org/wiki/Hat_puzzle](https://en.m.wikipedia.org/wiki/Hat_puzzle)

<comment><USER10> "The players may not communicate in any way" \- It seems to me that all the answers are a form of communication. In fact the dictionary defines communicate as, "share or exchange information."

<comment><USER11> What a joke: "find a strategy for the players to determine the colours of their hats based on the hats they see and what the other players do"

I interpreted it in the same way as you did - communication on any level is not allowed. If there is no sharing of information then I think it is impossible to solve the puzzle.

<comment><USER12> It is possible without communication (also without seeing what the other players do).

<comment><USER10> How so?

<comment><USER12> Some answers have been posted already.

</comment></comment></comment></comment></comment></comment><comment><USER13> The solution to the 4 person problem is actually pretty simple. Let's assume that we know the answer to the 2 person problem. We have 4 persons; A, B, C and D. At first the persons guess their colour (without revealing it of course) based on their direct neighbor. So for instance:

        A <-----> B

        C <-----> D

A and B being neighbors, they guess their colours based on the solution of the 2 persons problem. Same goes for C and D. Without loss of generality, let's assume C guesses correctly his card colour. Since he can see the cards of A and B, he knows who will guess their colour correctly. For instance, if they have the same colour, A will guess correctly, if not, then B will guess correctly. Without loss of generality, let's assume A guesses correctly his card colour. He then sees that C will guess correctly.

The participants agreed beforehand that clubs and hearts are associated with 0 while diamonds and spades are associated with 1. A and C now apply the solution to the 2 person problem to guess their shape group (either (diamonds or spades) or (clubs or hearts)):

        A       B
        |
        |
        C       D

It is guaranteed that at least one has guessed the shape group correctly. Since they both guessed correctly the color, it is guaranteed that one of them will guess the shape correctly.

</comment><comment><USER14> I'm more of a Car Talk "Puzzler" type of guy.

<comment><USER15> "If you think you know the answer, write it on the back of your classified one time pad key and send it to: NSA, Box 35 Fort Meade (our fair city) Maryland".

</comment></comment><comment><USER16> Use this one weird trick to win the guess what card is on my forehead game. Casinos hate it!

</comment><comment><USER17> Are there any puzzles that help you master "plausible deniability" much better ?

</comment><comment><USER18> Some of these are poorly worded. Why does the answer to the May one keep talking about 30 seconds passing when the only time mentioned in the problem is 30 minutes? 30 seconds gives Nick at least 10 seconds per possible solution, he should have tried them all by then.

It should talk about the number of tries so far (one each), the length of time it took is irrelevant. But why are they even taking turns when they have separate padlocks and could easily brute-force it? I get the concept they're going for but the premise doesn't fit and just confuses things.

<comment><USER19> Yeah. I didn't get what the big deal was about it until I read the 30 second and turns he mentioned in his explanation.

</comment></comment><comment><USER20> The NSA also has (had?) an internal puzzle in there cryptolog internal magazine. Some have been declassfied at [https://www.nsa.gov/news- features/declassified-documents/cry...](https://www.nsa.gov/news- features/declassified-documents/cryptologs/). An example of their puzzles: [https://david.newgas.net/nsa-puzzle/](https://david.newgas.net/nsa-puzzle/)

</comment><comment><USER21> It said no communication during but you could devise a strategy before play. What I would do on the first challenge is say I would write down the opposite color of what I see and tell the other person the write down the same color they see so you will definitely at least win $50 "or 100$ if you have the same color". For the suite challenge do the same strategy but split 2 people write down the same suite and have a plan for the other 2 to pick what they don't see.

<comment><USER22> Coincidentally enough, this was a submitted puzzler to the NPR syndicated show "Car Talk," except there were 10 men in a line wearing black or white hats. The goal was to determine the optimal strategy for guessing hat colors.

</comment></comment><comment><USER23> Orienting the cards vertically or horizontally would count as communication, wouldn't it? Otherwise this would be trivial.

<comment><USER16> I'm not sure how orienting the card that is on your own head would help. You don't know what it is.

That being said the method of "Bob always tells the truth, Alice lies" is sort of a card orientation way for two people. Alice puts her card up sideways and Bob knows that to mean he should tell the truth. Likewise Bob doesn't rotate his and Alice knows to lie.

However that only works with two people and they have opposite spins.

Maybe it can work with more than two and you have two rounds of guessing. Also you need to know that you have differing spins.

<comment><USER23> You orient the card based on the other player's card, for their benefit. That's why I think it would be against the rules - it's the same as if you held up fingers or made a face, it's communication.

Bruce and Ava decide to put the card horizontally if they see a red card, or vertically if it's black. If Bruce sees a vertical card, he knows Ava sees a red card on his head.

In the game of four, the players decide one of them will guess, and two others will communicate information in binary:

horizontal, horizontal: hearts

horizontal, vertical: diamonds

vertical, horizontal: spades

vertical, vertical: clubs

However this latter method only requires three players, not four. But it is similar to how professional bridge players cheat, by communicating their hand (which is hidden from their partner) with secret signals: [http://www.newyorker.com/magazine/2016/03/07/the-cheating- pr...](http://www.newyorker.com/magazine/2016/03/07/the-cheating-problem-in- professional-bridge)

<comment><USER16> Wow, thanks for that link about cheating in bridge. Spent hours going over that and stories on [http://bridgewinners.com/](http://bridgewinners.com/)

</comment></comment></comment></comment><comment><USER24> The answer is pretty simple.

1\. The strategy is that they should agree to write down the same colour(either red or black), irrespective of what they see on the opposite persons forehead

2\. Same as above. This time all of them should agree to write any single suit.

By probability, at least one of them will get it right.

[Edit]: Didn't put it correctly before

<comment><USER25> 1 They should write their own color, so this is not a winning strategy. [Spoiler] As stated by other the winning strategy is that one says always the other person's color and the other say the opposite. That's because or the color are the same or are different.

<comment><USER24> You're right

</comment></comment></comment><comment><USER26> Reminds me of "ponder this" from IBM research: [https://researchweb.watson.ibm.com/haifa/ponderthis/index.sh...](https://researchweb.watson.ibm.com/haifa/ponderthis/index.shtml)

</comment><comment><USER27> The April one was.. disappointing.

<comment><USER28> The June one too. A simple three if then statements can solve the problem easily even increasing the 1000 coins to a number physically possible by the ship to hold.

</comment></comment><comment><USER29> Come back tomorrow as in Sep 1, 2017 for the answer I suppose.

There I cracked that one :)

</comment><comment><USER30> Make Bruce guess opposite of what he sees on Ava and Ava guess same color as what she sees on Bruce. This covers atleast one correct guess for all for Cases BB, RR, BR, RB.

</comment><comment><USER31> [https://github.com/zazaalaza/napp](https://github.com/zazaalaza/napp)

see my solution here

</comment><comment><USER32> For the July one:

Always go first.

Assuming the table is symmetrical around only one point, the centre of the table, place the first coin on that point.

Every move after that place your coin in the location directly opposite the last coin played, the mirrored location around the point of symmetry.

Since you are always playing a symmetrical position, you know that there will always be a space available for you after the previous coin was played.

[edit] looks like the answer on the site is almost the exact wording as mine :)

<comment><USER33> This is actually very similar to a question I was asked when interviewing to read Maths at Oxford. In the Oxford version, your brother and you are also playing a game. You have a 2-dimensional block of chocolate with a poison piece somewhere in the block. The poison piece is bright green to the eye. You each take it in turn to break off some chocolate (you have to follow the rows and columns of the chocolate, and the break must be a single break). To win you must avoid eating the poison piece and end the game by handing it to your brother. You have the choice of going first or second? When should you choose either?

<comment><USER3> Nim in disguise

</comment></comment></comment><comment><USER34> _Come back tomorrow to see the answer!_

But where?</comment>