CNNIC's response to Google - <AUTHOR> http://www1.cnnic.cn/AU/MediaC/Announcement/201504/t20150402_52049.htm <comment><USER2> This is going to be interesting.

My gut feel is that "rogue root CAs" need to have the fear of having their entire business shut down if they're caught out acting badly, and that CNNIC is the ideal opportunity for US-centric technology companies to take a stand without treading on too many profitable toes. If Microsoft and Apple joined in solidarity and announce they're taking CNNIC out of trusted roots (and, to a lesser extent, Mozilla), then it will be clear that the threats to CA's business/profit have some teeth.

If they let this slide - it'll pretty much be open season for root trusted MITM certs to anyone with a few kilo or mega bucks to spare. It won't stop state-level actors from doing state-level bad-stuff(tm), but it might at least stop them from selling that ability to random big-corps as well.

(And surely the opportunity to stand up to the Chinese Government with broad internet-community backing, especially in the face of the recent Github DDOS - the timing is about as perfect as it's ever likely to get, right?)

<comment><USER3> How far away are we from being able to kill this ridiculous system? I'm sick of trusting a bunch of certs that are deemed acceptable. Forget security concerns, I'm just appalled that to acceptably do encryption today I need to pay some company! That's wrong.

Okay, so the question isn't actually "how we're going to kill it". It's going to die when there's a better alternative. So the question is really, "What can we do to build a strong web-of-trust system while continuing to use the broken one?"

I see no reason we can't make some browser plugins, get some activism going in the tech community, and start building it. Just report back what cert was served to you.

With that being said, there needs to be a selling point other than building a better internet, otherwise no one will use this plugin. I think there is one, though, and that's security. When your browser comes across a cert that differs, alert the user. You might not get grandma to use it, but it's something.

There are issues with this. I want to anonymously report what cert a website serves me, rather than giving anyone curious my entire browsing history. And also poisoning. But the latter is fixed by using this both the existing CA model and the WoT.

So yes, there are some problems. But c'mon, it's 2015, let's fix this already.

<comment><USER4> > Forget security concerns, I'm just appalled that to acceptably do encryption > today I need to pay some company! That's wrong.

Well, you don't need to pay anyone to do encryption. You do need to do pay people to do _identity verification_. That's a more-than-pedantic difference, even though encryption without identity verification is generally meaningless.

First off, you're _already_ paying someone to have a domain name. I sorta understand the distaste on principle, but I've never really understood, as a practical matter, why paying $10+/year for a domain name is totally fine, but paying $5/year on top of that for SSL isn't. (And yes, the race-to-the-bottom has hit $5, see ssls.com. This isn't even counting StartCom and the future Let's Encrypt.)

Second, and related to that, what you're paying them for is the human element in key continuity. If you ever lose your key, you're going to want to be able to regain a key for the same website that you've already published everywhere, that everyone already has localStorage for, etc. And be careful about saying that you don't care: Crypto.cat (which, at this point, definitely knows what they're doing) managed to lock themselves out from SSL by requesting a hardcoded public-key pin and then losing all the public keys they'd pinned. This isn't really a risk that you think is realistic until disaster strikes, and the last thing you want in the middle of a disaster is to have to rename your website and convince everyone that they should use the new site.

And the process of maintaining infrastructure to re-provision certificates to people costs money. It's possible that it could be funded in different ways (just like, e.g., all of the work that goes into the browsers themselves is funded in ways that don't involve charging website owners or users). But there is a thing there that involves humans, there are advantages to it involving humans, and humans need to be paid.

<comment><USER5> > And yes, the race-to-the-bottom has hit $5, see ssls.com

What's the race to the bottom for wildcard certs though? Looks like $80+/year, which is frankly completely ridiculous seeing as it's exactly the same amount of work for the CA.

The whole thing's a racket, we would honestly be better off using self-signed certs and certificate pinning (perhaps with a global list of cert pins stored in the browser/a server the browser implicitly trusts)

I mean, we have to trust the browser anyway, might as well make it handle all the security

<comment><USER6> Startssl has wildcard certs if you buy their service at 50$/yr, plus many other stuff.

<comment><USER7> The $59.90 account only buys you identity verification so that you can get a cert for your own personal domains. When you want to get certs for a company's domains, you also have to pay for organisation verification for another $59.50. In neither case are you allowed to request certificates for domains owned by other entities, even if you are authorized to do so by the owner (e.g. as a service provider). See here: [https://www.startssl.com/policy.pdf](https://www.startssl.com/policy.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER8> >"...meanwhile CNNIC sincerely urge that Google would take users' rights and interests into full consideration"

And that, ladies and gentlemen, is exactly what they're doing.

<comment><USER9> CNNICs users' rights and interests are not being taken into consideration. Make no mistake, they are looking to protect their customers, not you and I.

<comment><USER10> Right, their users are the ones who purchase certs, not browsers.

<comment><USER2> I think the argument here goes "CNNIC is a government department in China. Government departments 'customers' are rarely the people from whom they take money or provide services - their actual 'customers' are other more-powerful government departments, or the current political powerholders."

</comment></comment></comment></comment><comment><USER11> With great power comes great responsibility. It's not because there were no misuse of the certificates this time that it didn't happen or would have not happen.

I personally have removed their certificates from my system. This is the responsible move to do if you care about your security or don't want your computers to be used as part of the DDoS like we've seen against GitHub.

<comment><USER2> Does anyone know if there's a way yet to do this on unjailbroken iOS devices?

This suggests no: [http://apple.stackexchange.com/questions/23720/how-do-i- un-t...](http://apple.stackexchange.com/questions/23720/how-do-i-un-trust-or- remove-blacklisted-root-cas-from-mobile-safari-on-my-iphone)

<comment><USER12> It looks like not, but here's a list if it helps [http://karl.kornel.us/2014/09/an-analysis-of-the-cas- trusted...](http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted-by- ios-8-0/)

</comment></comment></comment><comment><USER13> Quite the contrast to Google's response:

        We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place.

</comment><comment><USER14> Not really much of a response from CNNIC here. Notice how they spin this situation as Google taking away the rights of others? Google isn't the bad guy here, they're doing the reasonable thing and CNNIC have a lot of explaining to do...

<comment><USER15> Very true said. Gaining security is always in favor of public and organizations. Google is a authority, and many people take its statement seriously rather than others. And this approach may really take internet to safe side at some point. Nowadays ssl can be found at no price. Letsencrypt is going to provide at free of cost and vendors (like ssl.com and cheapsslshop.com ) selling such certs from nominal fee of $4 - $5 per year. Infact Government organization should shake hand with Google and motivate people to adopt such security asap.

</comment></comment><comment><USER16> China's response is kind of funny. But if they have no bad intentions, they can just implement CT and not have to worry about it. Of course, if you read between the lines in the last paragraph, you realize that they do have bad intentions. That last line is quite 1984-ish.

<comment><USER17> This will head towards a tit for tat thing. Much like the cold war except this time its cyber in nature.

</comment></comment><comment><USER18> >2\. For the users that CNNIC has already issued the certificates to, we guarantee that your lawful rights and interests will not be affected.

...

Does that mean anything?

<comment><USER19> It probably means that the CNNIC certs will still be valid in China, as Google doesn't directly distribute any software there directly and the Chinese government can tell the Chinese software vendors to trust its cert regardless of what google thinks.

</comment></comment><comment><USER20> Interestingly, I cannot get round of CNNIC, as I am likely to operate some services for my employer on Windows Azure in China.

[http://www.cnnic.cn/jczyfw/fwqzs/fwqzsdtgg/201403/t20140312_...](http://www.cnnic.cn/jczyfw/fwqzs/fwqzsdtgg/201403/t20140312_46330.htm)

Microsoft is using CNNIC certs for their Windows Azure services in China (, which of course is independent from Azure services in other regions, and is jointly operated with Chinese partners).

If I marked CNNIC CA as untrustworthy, I would be expecting some alert in my Dashboard page, I guess.

</comment><comment><USER21> Who are the people and companies that use CNNIC-issued certificates?

CNNIC is a relatively recent addition to most browsers' lists of trusted CAs. Moreover, given the popularity of pirated & never-updated Windows XP in China, it would have been foolish for any serious Chinese business to use an SSL certificate from any vendor other than globally recognized ones like Comodo and Verisign.

<comment><USER22> Did you know most Chinese browser vendors will explicitly disable SSL certificate validity check?

<comment><USER23> Proof please

<comment><USER24> 360 browser accepts all certs, incl self signed. no warnings.

also lol: 'high usage numbers are in large part due to the software being very difficult to uninstall. Furthermore, whenever a user attempts to install another browser, a warning pop-up claims that the new browser is unsafe and should not be run'

</comment></comment></comment></comment><comment><USER25> I find it interesting that visiting the https version of cnnic.cn in Chrome neither displays a lock icon nor a warning, but the certificate is displayed as valid: [http://i.imgur.com/fTzxpBh.png](http://i.imgur.com/fTzxpBh.png)

<comment><USER26> Related to their use of SHA1 on the certificate: [http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...](http://googleonlinesecurity.blogspot.com/2014/09/gradually- sunsetting-sha-1.html)

<comment><USER4> Yup, this is it. The cnnic.cn end-entity certificate is SHA-1, which would do it. (I believe there's some sadness involved like Windows XP being excessively prevalent in China, or something... I vaguely recall a discussion of this on the cabforum public list, but I can't find it now.)

If you click on the white page icon and go to the "Connection" tab, it'll say "This site is using outdated security settings," which generally (always, in current Chrome versions?) means SHA-1.

</comment></comment></comment><comment><USER27> I know a user who runs her own root CA.

She only has one "customer": herself.

Using the OpenSSL binary the cost is free.

She decides which hosts she wants to trust, obtains their certs and signs them.

She believes she can trust her own CA more than any commercial, third party CA.

<comment><USER28> How does she verify the certs she's getting?

<comment><USER27> How do the commercial CA's verify customers before issuing certs?

Perhaps she does what they do.

I imagine for example she knows her banker, her lawyer, etc. and can contact them by phone or meet with them in person.

Maybe she also uses her friends to help her decide who to trust.

She only has to verify a relatively small number of hosts compared to a commercial CA.

<comment><USER29> Who could you possibly call at say Capital One to verify that a change in their certificate was intended instead of malicious?

<comment><USER27> Your point is understood.

For something like that, I have always thought they should be disseminating their cert via some other means besides an untrusted computer network (i.e., the internet). Or at least give customers another option.

Perhaps making their cert available at branches (e.g., printed on business cards), mailing it to customers with an expository cover letter, or even publishing it in a newspaper or some publicly available printed source.

Maybe these printed copies would be OCR-friendly, maybe not. I think two blobs of text can be compared to each other for differences without using a computer, and I can think of a few ways to make that easier. In any event, this does not seem an insurmoutable problem by any stretch of the imagination, at least for me, and in my mind the benefit outweighs the cost.

Not sure about others, but I still get plenty of "official" notifications via postal mail. And with increasing frequency they relate to computer issues.

This makes me wonder why certs "must" to be obtained and verified using (a) an untrusted computer network (the internet) and (b) why we need the aid of untrusted third parties often with obvious conflicts of interest to decide for us who else we can trust.

Are these not the two things that that "SSL" authentication and encryption is designed to protect against?

</comment></comment></comment></comment></comment><comment><USER30> CNNIC,you deserve it!</comment>


Did formation of European Union lessen severity of 2003 heatwave - <AUTHOR> https://physicsworld.com/a/did-formation-of-european-union-lessen-severity-of-2003-heatwave/ <comment><USER2> Counterfactuals are fun. But Historians disagree about their role in the discipline. Climate modelling with what-if feels like its in the same place. Having a good parallel economy of comparable size, and distribution of coal nuclear and wind, and similar de- and re- industrialization is almost impossible.

On balance, I want to believe. Because it suggests that the organising principle is a higher goal, worthy because it achieves something. But thats politics not science.</comment>


Ask HN: new dating site, where do the initial members come from? - <AUTHOR>

<comment><USER2> Some sites seed their userbase with fake profiles. Today you're probably better off trying to convince people to fill out profiles as part of a pre- launch viral campaign. People seem willing to provide pretty detailed info as part of the "securing your username" come-on these days.

Now, when you do actually launch, you're sure to lose a large percentage of those that signed up. Please make sure to provide a mechanism for easy account cancellation, and I wouldn't recommend activating every sign-up without another click of approval from those that did sign-up during the pre-launch phase. The last thing a happily married person wants is for their profile to pop up on a dating site because they didn't know they were signing up for a dating site. But I'm sure you'll get some level of users that convert to active users of the site once you're live if for no other reason than the fact that their info is already in there ... they're single ... and they're curious.

There's really a lot of ways you can go about it though. Maybe a Mechanical Turk task. Or maybe rewards for referrals that actually convert. Just be creative and think of what might convince you to sign up for your own site.

</comment><comment><USER3> Fake profiles, essentially sock puppets of the founders.

</comment><comment><USER4> what is your site

<comment><AUTHOR> I don't have a dating site, it just seems like they are cropping up left and right and it vexed me as to how their database is initially populated.</comment></comment>


SnapChat now takes $0.99 for 3 Replays - <AUTHOR> http://blog.snapchat.com/post/129151515055/a-whole-new-way-to-see-yourselfie <comment><USER2> Amazing. It's the horrible "buy gold to unlock this artificial constraint!" gimmick from terrible F2P mobile games, except now they're sellign the another chance to peek at naughty bits.

They're going to make a _buttload_ of money with this.

<comment><USER3> A _breastload_ even.

The artificially limited media of snapchat has never enticed me. If I want to exchange naughty bits I'll use a secure messenger and own up to my pictures. I mean, if you don't want people to see them then it's best not to take them, right? These days it's WAY too easy for your private pictures to become public.

</comment></comment><comment><USER4> For pics/vids which are a max of 10 seconds this works out to $120hr!

From the site: They're a little pricey — but time is money! ;)

clearly they are.</comment>


Retirement on Hold: American Workers $6 Trillion Short - <AUTHOR> http://finance.yahoo.com/news/Retirement-on-Hold-American-cnbc-2085207793.html

<comment><USER2> This study starts with the assumption that Americans should retire at age 65, which is to say that despite massive changes in health, life expectancy, productivity, and the fundamental nature of work as we shift from the physically demanding manufacture of real goods to a service economy, we should be using the same definition of "retirement age" as our grandparents used.

<comment><USER3> Exactly, when Social Security was started it was expected that you would live into your early 60's, nowadays the average is about 75 and it's common to live past 80. Yet the retirement age has change very little in the last 70 years.

Anecdotally I know quite a few people who are still working well into their seventies, all of them working construction in some form. (I spent several summers working for a remodeling firm so my sample is somewhat biased) But these guys are working in a physically demanding job, and doing it by choice. Sure they cannot do as much as they used to be able to but they are certainly doing enough to be productive. They all work part time, regularly go away for weekends, vacations, etc. and working just enough to make money and enjoy their life.

It's very possible to have the relaxed lifestyle that people look forward to in retirement without having to completely stop working, regardless of your job, but especially these days where, as you noted, most people work in a service economy.

</comment></comment><comment><USER4> Meh. People should not feel entitled to sit around and do nothing for the last third of their life.

<comment><USER5> Sitting around and doing nothing (or driving around the country in an RV, etc.) is the most depressing thing I can think of doing. I hope when I'm >65 I am still working, if not in an operational role, in some kind of investor or advisory role.

Retirement from a physically demanding job makes sense when you can't do that job any more, but enduring a job/life you hate, just to reach (hopefully) retirement and finally enjoy life, really seems like the wrong model.

</comment></comment><comment><USER6> So social security is going to go bust and the markets are losing people money, how is a 20-something techie to build funds for retirement? Go back to stashing hard earned cash in a fireproof safe? Never plan on retiring?

<comment><USER7> Dollar cost averaging into an index fund. If that doesn't produce a positive return over several decades, then we're completely screwed anyway.

<comment><USER8> Just be glad you weren't "yen cost averaging" in the Nikkei 225 which is currently 70% down from its 1989 peak: <http://en.wikipedia.org/wiki/Nikkei_225>

</comment></comment></comment><comment><USER9> Your retirement: courtesy of China.

<comment><USER10> Yeah, it must be somebody else's fault.

<comment><USER9> Heh, totally not what I meant.

I was referring to the main purchaser of our country's debt: China. I wasn't BLAMING them.</comment></comment></comment>


Ask HN: Did Chrome change how it displays hyperlinks? - <AUTHOR> Did Chrome change how it displays hyperlinks?  It seems like the underline has been moved up, and now breaks for characters with descenders.  Any info from the Chrome team explaining the reason for change?  My hypothesis is that it saves vertical real estate, at the cost (at least personally) of some added visual complexity.<p>Example: https://imgur.com/a/hwTE5 <comment><USER2> I believe this answers your question: [https://superuser.com/questions/1293529/when-did-chrome- star...](https://superuser.com/questions/1293529/when-did-chrome-start- underlining-links-differently)

<comment><AUTHOR> Thanks!</comment></comment>


Visualise the shift to blockchain by big companies - <AUTHOR> https://www.producthunt.com/posts/shiftblock <comment><USER2> Shift or experiment or say something in the media?

This seems like a website / article aggregator for big co + blockchain</comment>


SpiderOak warrant canary to be replaced by 'transparency report' - <AUTHOR> https://boingboing.net/2018/08/06/spideroak-warrant-canary-to-be.html/amp <comment><USER2> The canary is still there, as linked by a person claiming to be an employee in the comments.

<comment><USER3> But the canary was removed and put back after backlash. The proverbial canary is dead, even though a new one has taken it's place. If you really believe and follow warrant canaries then it means the service can no longer be trusted. No matter what the service says after. You can't bring back the dead.

</comment></comment><comment><USER4> TLDR:

Don't be mad at the company! The canary worked exactly as it was supposed to.</comment>


Deeplearning.ai: Announcing New Deep Learning Courses on Coursera - <AUTHOR> https://medium.com/@andrewng/deeplearning-ai-announcing-new-deep-learning-courses-on-coursera-43af0a368116 <comment><USER2> For those who are unfamiliar with coursera or interested in just the videos (and NO certificate) you can enroll in "AUDIT" mode:

AUDIT MODE: [http://image.ibb.co/iwm0xF/ng.png](http://image.ibb.co/iwm0xF/ng.png)

The deep-learning course consist of 5 subcourses:

[https://www.coursera.org/learn/neural-networks-deep- learning](https://www.coursera.org/learn/neural-networks-deep-learning)

[https://www.coursera.org/learn/deep-neural- network](https://www.coursera.org/learn/deep-neural-network)

[https://www.coursera.org/learn/machine-learning- projects](https://www.coursera.org/learn/machine-learning-projects)

[https://www.coursera.org/learn/convolutional-neural- networks](https://www.coursera.org/learn/convolutional-neural-networks)

[https://www.coursera.org/learn/nlp-sequence- models](https://www.coursera.org/learn/nlp-sequence-models)

The deep-learning course is a different course than the prerequisite machine- learning course:

[https://www.coursera.org/learn/machine- learning](https://www.coursera.org/learn/machine-learning)

<comment><USER3> BTW, if you want to audit, you need to search for each course individually (or click seycombi's links above) and click the Enroll button there, there's no Audit option if you click Enroll on the full Specialization.

<comment><USER4> Thank you for pointing this out! Was looking for the way to just audit it and could not figure it out.

</comment></comment></comment><comment><USER5> I like this pricing model compared to udacity's new nanodegrees. This works better for people who want to rush through the course as quickly as possible. It essentially encourages faster completion.

You pay $49 per month and finish at your own pace. On Udacity you pay a fixed price of approximately $800 per semester with a trial period of 7 days. Since you are paying for the entire course upfront, you might realize after a few weeks that you don't like it. On Coursera, you can stop anytime and you've only paid $49 x number of months you tried.

<comment><USER6> Udacity has a 50% tuition back policy if you finish < 12 month (very reasonable). I've finished a ND, and asked for my money back (still waiting tough, its a 8 wks standard period )

<comment><USER7> That unfortunately doesn't apply to all their NDs. Some of their newer ones (like the self driving car ND) doesn't offer any sort of tuition back.

</comment></comment></comment><comment><USER8> Georgia Tech is also starting a few MOOCs on edX.org, starting 8/21/17, if anyone is interested.

[https://www.edx.org/course/machine-learning-gtx- cs7641x](https://www.edx.org/course/machine-learning-gtx-cs7641x)

[https://www.edx.org/course/statistical-modeling- regression-a...](https://www.edx.org/course/statistical-modeling-regression- analysis-gtx-isye6414x#)!

[https://www.edx.org/course/big-data-analytics-healthcare- gtx...](https://www.edx.org/course/big-data-analytics-healthcare-gtx- cse6250x#)!

[https://www.edx.org/course/database-systems-concepts- design-...](https://www.edx.org/course/database-systems-concepts-design-gtx- cs6400x#)!

</comment><comment><USER9> If you take a Coursera course, be prepared for it being exactly like a university class. About 45 minute of monologue per section, the odd quiz, then 2-3 exams.

From the 4 Coursera courses I've taken, I've gotten some good info, but I learned nothing practical. Udacity on the other hand, has ~5-10 min videos, frequent quizzes and practical projects.

<comment><USER10> I dislike Udacity, they interrupt every minute to ask stupid non-useful questions and some of their courses have very low quality.

<comment><USER11> Except is Peter Norvig:)

<comment><USER10> I wasn't referring to any particular course.

</comment></comment></comment></comment><comment><USER12> Any idea on how this compares to the deep learning course here: [http://course.fast.ai/](http://course.fast.ai/)?

Very interested in taking a course, but there are so many offerings available. I have high level ML understanding from classes I took in college, but wanted to dive deeper into it.

<comment><USER13> Ya it seems like just another deep learning course.

I can vouch for fast.ai though. They're the best if you're just starting.

<comment><USER14> +1

fast.ai is probably the best MOOC I've ever followed. As its name says, it is "for coders" and 100% applied. It is perfect for getting started, quickly.

Please read this blog post, in particular regarding the comment on _" Hacker News contributors regularly give such awful advice on machine learning"_.

[http://www.fast.ai/2017/03/17/not-commoditized-no- phd/](http://www.fast.ai/2017/03/17/not-commoditized-no-phd/)

and:

[http://www.fast.ai/2017/03/23/focus-on- coding/](http://www.fast.ai/2017/03/23/focus-on-coding/)

</comment></comment></comment><comment><USER15> I'm glad these courses use python. I had a lot of trouble with Ng's machine learning course because I was trying to learn MATLAB language, remember long disused linear algebra, and trying understand the substance of the lessons all at the same time.

<comment><USER16> Yeah I have nothing against algebra or math, I like math, and I know some algebra, but he was constantly using mathematical notation instead of algorithms. It was not accessible.

I got into many arguments about how computer science is math and so on, but machine learning is a set of techniques, there is no need for it to use math when it's not really needed.

So I gave up. I did not even manage to properly understand his explanation of linear regression, as I would have liked to implement my own. When I look online it's a myriad of equations, and no pseudo code.

I love mathematics, but when I'm programming I really prefer to use data, and not math.

<comment><USER17> ML is a set of techniques derived from math.

Instead of giving up you should push through that. Use what you know to get familiar with what you don't, rather than asking for things to be made accessible to you. Math is much older and bigger than computer science and refusing to learn it is over-specialization.

<comment><USER16> Well if it's derived from math, give the techniques, not the math.

I don't care if it's accessible for me or not, it seems the guy is saying ML is the new electricity, lowering the bar won't only benefit me, but many other people who know programming and don't benefit from knowing the math.

Just my opinion. Many people and hackers learn by practice, not by theory.

<comment><USER17> We need both electrical engineers and licensed electricians. If you want to be an electrician, don't sign up for an engineering class taught by a pioneer in the field of electricity and then complain that there is too much theory. Coding bootcamps and vocational schools already exist to meet the needs of those who only want to be practitioners.

Everyone learns by practice, but that applies to math just as well as programming. If you don't practice it, you won't learn it.

<comment><USER16> > Everyone learns by practice, but that applies to math just as well as > programming. If you don't practice it, you won't learn it.

I don't see machine learning as a theoretical field of math, I see machine learning as a set of tools.

To me computers are the tool you use to practice math, and you don't really need to use mathematical notation anymore, unless you really dive into a very abstract subject. ML consists of applied methods. I don't think people want to learn the theory of machine learning, they just want to know the methods that works now, and maybe dive into more complex stuff later.

</comment></comment></comment></comment></comment></comment><comment><USER18> So awesome. I just completed Andrew's excellent 2011 Machine Learning coursera course, and was looking where to go next. I am trying to go through the courses on fast.ai, but I don't enjoy them nearly as much compared to Andrew's teaching style and structure. Will be signing up for this!

</comment><comment><USER19> The courses are not yet live. Meanwhile, here is a list of 23 Deep Learning online courses aggregated (aggregated by my company): [https://www.class- central.com/report/deep-learning-online-co...](https://www.class- central.com/report/deep-learning-online-courses/)

Also, link to Andrew Ng's original ML class: [https://www.coursera.org/learn/machine- learning](https://www.coursera.org/learn/machine-learning)

<comment><USER20> For the first three courses the first week is already accessible.

</comment></comment><comment><USER21> After having taken Udacity's ND, the only way I would consider taking this course is if they go in-depth with the theory so that I can clear interviews and work on projects from scratch. There's just too many resources for DL now. It's getting ridiculous. Had Udacity gone in better details with their ND I would glady have paid double for them.

Coursera does not having proper support systems like good quality forums/any mentorship/project reviews. Although, been a while since I took a Coursera specialization, would rate Udacity higher on that front even though their ND was too basic (I can't even talk about what I did in a project clearly because of so much lack of stuff).

Let's see how this specialization holds up.

</comment><comment><USER22> Wonderful! Thank you Andrew!

Now alongside Udacity, another set of classes with certificates - does anyone know if they hold any value to prospective employers? Last I've heard was that a recent PhD in ML was a must.

<comment><USER23> > does anyone know if they hold any value to prospective employers?

Sure they do. It's not a free pass but it is very very very helpful to have a strong foundation in classic ML and statistics.

> Last I've heard was that a recent PhD in ML was a must.

Not really unless you are looking to jump into a pure research lab. Generally you need publications in the field.

<comment><USER24> "Sure they do. It's not a free pass but it is very very very helpful to have a strong foundation in classic ML and statistics."

I think the poster was asking specifically about the credentials of the course, not taking the course itself. And I'd argue that it's probably _not_ that interesting to most prospective employers, since they'll care more about things you've actually accomplished (example projects, etc).

</comment></comment></comment><comment><USER25> Latently (SUS17) also provides a more self-directed path to learning deep learning focused exclusively on implementing research papers and conducting original research: [https://github.com/Latently/DeepLearningCertificate](https://github.com/Latently/DeepLearningCertificate)

<comment><USER26> The wording in the linked GitHub page makes it sound like you are looking for people that are already ML practitioners. Are you able to support developers with no ML background that are interested in making a career change?

<comment><USER25> Definitely, we help folks pick papers that are appropriate for their skill level.

</comment></comment></comment><comment><USER27> I hope that AI scientists will one day solve the problems with message forums. Message forums aren't designed to engage this many people. A popular MOOC gets tens of thousands of daily posts from students.

Maybe Andrew will make a practical class project out of trying to improve mass-collaboration using his MOOC as the test subject?

</comment><comment><USER28> Will the content for the courses be released all at once? I'd like to complete the 5 courses in approx 1 month.

<comment><USER20> Seems like the first three courses are opening on August 15th (but you can already preview the first week), the other two do not seem to have a start date available yet.

</comment></comment><comment><USER29> So it appears, that you can still take this course for free, and you only get a "digital certificate" of dubious value if you purchase the course. Am I missing something here?

<comment><USER30> Is it not $49 / mo ?

[http://i.imgur.com/UNOvVMU.png](http://i.imgur.com/UNOvVMU.png)

<comment><USER31> You can audit the classes for free, which lets you watch the videos, and take the quizzes but not submit them (which is annoying).

</comment></comment></comment><comment><USER32> What would be a good prerequisite for these courses?

<comment><USER29> From the FAQ on the course's page:

"Programming (expected): intermediate Python programming skills: work effectively with loops, control flows, data structures, files, functions and OO programming. Prior experience with PyData libraries is also recommended (e.g. Numpy, Pandas, Matplotlib)Mathematics (recommended): Matrix vector operations and notation.

Machine Learning (recommended): understand how to frame a machine learning problem including how data is represented, how models are evaluated on the task and against each other, and how to optimize model performance for the best evaluation."

</comment></comment><comment><USER33> Many weeks end with an interview that might be interesting independent of the course -- the first is a long one with Hinton.

[https://www.coursera.org/learn/neural-networks-deep- learning...](https://www.coursera.org/learn/neural-networks-deep- learning/lecture/dcm5r/geoffrey-hinton-interview)

</comment><comment><USER34> Transition to python is a great improvement! Took his previous course but the MATLAB part of it was no fun and virtually guaranteed that my work would be hard to implement in any real job setting. His advocacy of Octave probably predated quite a few of the python libraries that have since arrived.

</comment><comment><USER35> Is Andrew Ng still with Baidu? Thought it was curious that it uses tensorflow.

<comment><USER5> He left Baidu to start deeplearning.ai.

<comment><USER36> He also started Coursera, which brings us full circle :)

</comment></comment></comment><comment><USER37> This is really exciting to hear. Andrew is absolutely a fantastic teacher!

</comment><comment><USER38> This specialization contains 5 courses. Does this mean one has to pay 245 dollars(49 * 5) + 49 dollars for the first month.

</comment><comment><USER39> I took his course up until the back propagation lesson and then lost interest. Credit to him as a teacher though because the basic of ML are still with me. I just didn't have any interest in going very deep with it.

</comment><comment><USER40> Feels like marketing, not really a news story. Anyone else feel the same?

<comment><USER38> Exactly what is being marketed ?

<comment><USER40> Coursera</comment></comment></comment>


Why is Google's AdSense doing the bidding of Scientology? - <AUTHOR> http://blogs.computerworld.com/why_is_googles_adsense_doing_the_bidding_of_scientology

<comment><USER2> We've had a hell of a time getting Scientology ads out of our backfill adsense. They show on feeds, in content, on forums, etc. The competitive ad filters don't seem to be working either (or we're total morons who can't figure out ad domains).

<comment><USER3> do you also block ads that pertain to other religions? Or are you a sectarian opposer of Scientology? :)

<comment><USER4> Scientology is not a religion, it's a scam. Do you delete 411 scams from your email? Same thing.

<comment><USER3> Do you differentiate between Scientology and other mainstream religions like Mormonism, Catholocism, Judaism, etc.?

I don't. You say Zenu I say tomato.

<comment><USER4> Personally, I think all religion is silly. But, mainstream Christianity is rather harmless compared to Scientology. It doesn't require its members to sink money into its lawsuit fund, for example. (But sure, there are crazy Christian groups too.)

<comment><USER3> The Catholic church, for example, has had quite a head start, during which time it's done things that make Scientology's worst alleged misdeeds look quite harmless.

I don't think anyone is required to donate, though there are varying amounts of pressure in various religions -- Catholicism focuses mostly on estates and wills to amass its billions.

<comment><USER5> What does that have to do with adsense at all?

<comment><USER3> read the parent(s)...

<comment><USER5> So... absolutely nothing to do with adsense then. Gotcha.

<comment><USER3> uh, yeah... the story was about adsense and scientology, and the point of nested comments is to zoom in...

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I must confess that, after a week seeing those horribly distracting ads, I started clicking just to make sure they were at least paying for the annoyance.

</comment><comment><USER7> The title is a bit misleading. Clearly Scientology have spent a lot of money to make it to the top of the pile; Google have nothing to do with it.

<comment><USER8> But wouldn't he be seeing a change in his CPM rates?

</comment></comment><comment><USER9> pretty much since the start google adsense has offered a 'competitive ad filter' which you can use to block unwanted ads.

Incidentally, this is also a great way to get your CPM up quite a bit if you use it smartly.

<comment><USER10> I thought of that as well when I read the article. Surely the author must have tried that?

</comment></comment><comment><USER11> Why isn't everyone using AdBlock? Isn't this pretty standard these days? I haven't seen a web ad for a long while and since I don't have TV the only ads I see are in Hulu and on the street.

<comment><USER12> because I don't care and hardly even notice them. I've gone banner blind in the 90's during the animated gif pandemic.

</comment></comment><comment><USER13> I'm having a hard time mustering a whole lot of sympathy. If you want the ability to individually approve each ad then Google is definitely the wrong tool for the job.

</comment><comment><USER3> Most of the anti-Scientology crusade is motivated by other sects who simply don't like competition. It's pretty ironic that they make fun of Zenu, etc., when their own beliefs do no better in the absurdity department!

<comment><USER4> Atheism is a "sect" now?

<comment><USER3> You seem to have taken the bait of my comment -- you assume that anti- Scientologists are atheists! I'd argue that they are Christians.

<comment><USER14> Atheism is the largest religion.

<comment><USER4> Atheism is not a religion.

<comment><USER14> As an Agnostic, I disagree. Atheism makes strong clames about "God(s)" without any evedence.

<comment><USER3> Not at all, Atheists don't grant beliefs associated with religion special status.

To an atheist, the statement "a small pink elephant named wilson created the universe with a squeeky sneeze" and "God created the universe in 7 days" are equally likely to be true...

An atheist may not assign a probability of 1 to the truth of each of his/her beliefs, but he/she considers all absurd beliefs equally unlikely, and grants that science has allowed humanity to make educated estimates about many such probabilities.

<comment><USER14> If you beleave there is a 99/100 or a 1 in 100 billion chance there is a god of some sort you are an Agnostic. If you beleve there is zero chance there is a god you are an Atheist.

Ok, an agnostic is more likely to say I have no idea what the odds of a god are nor is there anyway to determine them.

PS: Let's say our universe was created by Ted. And you ask him, who created your universe and he says "I have no idea".

<comment><USER3> Well, if you're rational then you believe that there is some chance that any belief you consider "true" will turn out not to be.

I think of agnosticism as saying "I am not capable of knowing", whereas atheists say "Sure none of my beliefs have a 100% probability of being true, but as a human I need to use what provisional knowledge I have in a meaningful way."

In other words, evidence is worth more to atheists than it is to agnostics, who (in spite of evidence) still focus on their inability to know for sure.

I think we're having the "strong/weak atheism/agnosticism" debate... I happen to consider myself an atheist b/c I act as though I believe there is no god just as I act like my laptop is not on fire when I type this.... and it works.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: Open source web based solution to create movie catalog/inventory? - <AUTHOR> I started working in an organization that use  spreadsheets to catalog and organize their movie inventory. Their inventory also includes movies that they don't have anymore (because they need to know that the movie exist) and it's basically local stuff (not even in IMDB). For every new movie, they manually give an unique ID. But, after a few years doing this, the spreadsheets have a lot of repeated IDs and relies on one person that attributes the IDs.
I started looking for open source solutions in Github, but there are a lot of (dead) projects and they focus more on your files and your local library or how to import IMDB metadata.
They asked for a web based centralized system that give them unique sequential IDs and relate with the movie title, director and year of production. I was thinking to import the CSV (current ID, title, production year, director) and use Trac tickets[1] to control it. Any tips in this direction? Or should I try a whole catalog system?
[1] https://trac.edgewall.org/ <comment><USER2> I'm building something similar but its not public.

You will have an easier time building it yourself rather than adapting someone's project. That will allow you the flexibility to make changes (and there will be changes when it gets used).

<comment><AUTHOR> Hey, thanks for replying. I asked around and everybody pointed that I should build it by myself. I'll ask to my organization more time for this project. Again, thanks!

</comment></comment><comment><USER3> You could just roll your own, a simple CRUD app would do all that for you.</comment>


CSSToucan – Automatically Colors Web Page Texts with Context - <AUTHOR> https://huu.la/ai/csstoucan <comment><AUTHOR> Wednesday Special!</comment>


Open source e-commerce front end in Angular - <AUTHOR> https://github.com/aviabird/angularspree <comment><USER2> This is nice. Curious, have you checked SEO which is crucial for many e-commerce sites given the JavaScript dependency? [https://moz.com/blog/javascript-seo](https://moz.com/blog/javascript-seo)

<comment><AUTHOR> Right now we are working on the SEO support with angular universal more updates soon.

</comment></comment><comment><USER3> Search floats oddly on page. Would not expect the top nav to be a category picker. Sorting doesn't seem to work. My whole screen flashes when I move from "Save" to price. I don't really care for the spinning triangle on every page view.

<comment><AUTHOR> Thanks for the feedback, we'll be working on the mobile version soon!

</comment></comment><comment><USER4> Why would you use both redux and angular ?

<comment><USER5> Why not? Redux is a very good, framework-agnostic state management solution. There is no reason you can't use it with Angular.

Edit: Contrary to what the readme says, it looks like the project actually uses ngrx, not Redux (unless I'm missing something).

<comment><USER6> I like also how the README disagrees with itself several times on what tech it's using :D

> Angular(4.2) E-Commerce front-end framework for spreecommerce

> built with  using Angular2, Redux

> built with  using Angular 5, Redux/ngrx-store 4

> Current version of Angular is latest release 4.0.0.

I don't mean to sandbag the project at all, it looks good (I haven't really dug into it yet)! But would be nice if the README could decide on what it actually is. :)

<comment><AUTHOR> Yes, I agree over time the README needs some maintenance I'll update it! Thanks for pointing it out.

</comment></comment></comment></comment><comment><USER7> Mobile support?

<comment><AUTHOR> Very soon, by mid of December, we should have it ready.</comment></comment>


Fight digital distractions, browse with intent - <AUTHOR> http://browsewithintent.com/ <comment><USER2> Looks great, but the privacy 'setup' is killing it for me.

Anyone know exactly same, best open source without phoning home those data ?

[1] [http://browsewithintent.com/privacy](http://browsewithintent.com/privacy)

> We let you nuke data from our servers. If you're feeling uncomfortable, you > can delete all the data associated with your account. Push a button and it's > gone from our servers forever.

> We log only domains, not full URLs.

> Any information about your browsing history is tied to a random identifier > that's generated when you install Intent for the first time. _When we ask > your phone number for our mobile product, we throw it away immediately after > we send you a text message._

<comment><USER3> Hey, one of the developers here. I just changed the wording around the phone number piece to clarify it. You do NOT need to provide your phone number to use Intent. It's just optional if you want to also track mobile usage...we text you a setup link, then throw the number away.

</comment></comment><comment><USER4> Hey, my friends and I made that! Happy to answer any questions :)</comment>


Show HN: Filesystem for Telegram attachments - <AUTHOR> https://github.com/Firemoon777/tgfs <comment><USER2> This looks great! I'll be using it today.</comment>


Testing in Puppet world - <AUTHOR> http://www.cakesolutions.net/teamblogs/testing-puppet <comment><AUTHOR> Deep dive into integration/behavior driven testing in Puppet world with the end to end example of writing and running automating Puppet integration tests.</comment>


Setting up a Hadoop cluster - Part 1: Manual Installation - <AUTHOR> http://gbif.blogspot.com/2011/01/setting-up-hadoop-cluster-part-1-manual.html <comment><USER2> Wish I had found this a couple of days ago. I was trying to set up a quick test hadoop cluster on EC2 and it was a config nightmare. After many hours of dead ends I finally got Apache Whirr to set me up a cluster, but I never did manage to connect to it. Seems like the documentation for nearly everything Hadoop related is 2 or 3 versions out of date or missing key details.

</comment><comment><USER3> Very elaborate description, definitely has upside over any other installation documentation that I've come across up till now. Esp. the elaboration as to all difference configuration options.

<comment><USER4> Thank you very much. I'm the author and if you have any questions or suggestions on how to improve it let me know.

We'll also update our cluster to the latest CDH version in the coming weeks or months and I'll update the post and follow up.</comment></comment>


Dumping Unit Tests - <AUTHOR> 'm considering dumping most unit tests from our app, because they almost never make a difference, they take a lot of work, our team is super tiny, and that work could be invested in features instead.
What I'd like to do instead is integration tests, since these would be much less work to maintain.
Can you convince me to not do this?
I realize that what I'm proposing is against the common wisdom, on the order of using tables for layout or spacer gifs. <comment><USER2> I've seen many places where unit tests are almost useless because they test the obvious stuff, so the developers think it's good enough ("we have 550 tests!"), but the most difficult bits are untested.

If you want to get rid of them you could go with the following strategy:

      1. Have code coverage (you need this regardless). Realistically you want to see branch coverage in addition to line coverage.
      2. Implement an alternative test suite along the lines you suggested (integration tests)
      3. Compare the coverage between the two test suites

You should quickly approach the coverage of the original test suite with your integration tests. At that point, you can decide to either refine the integration tests to cover more, or write unit tests to cover the missing bits.

Generally you'll know already which parts of your code really need high branch coverage. Typically, the core data structures and algorithms. It's wise to focus on unit-testing those ones.

By the way I don't think you're doing anything wrong. Quite the opposite. Very few projects have comprehensive tests, so you have to find a tradeoff anyway. Many people choose the easiest path of cargo culting some unit tests for the sake of having many green bubbles in some CI panel. But if you can't have comprehensive tests, due to constraints, you might as well focus on trying to be effective, as you're trying to do. Godspeed.

edit: if you don't do it already, have assertions in your code. I find them essential, and they help decouple the tests from the code under test a lot.

</comment><comment><USER3> I've seen unit tests that create a bunch of mocks and stubs and test that the stubs are getting called a certain number of times given the initial assumptions. At this point, the tests were like a copy of the original method, such that if you wanted to make a change, you would change the original method and then make updates to the test so that they'd sync up. Yes, this is how most testing _is_ , but it felt different in that you weren't just updating expected output, you were updating multiple calls.

This was stupid. It looked and felt like nonsense and gave me no confidence that the tests would catch an error beforehand, they seemed to just catch that the code changed. (I'm curious if there's a name for this pattern of testing.) Bugs still made it to production, past these tests. This was a form of technical debt.

So if you have tests like these, if this habit of "unit" "testing" has somehow proliferated your code, I think you should kill that with fire and replace those tests with something sane.

Of course, there are certain central functions that I think need to get unit tested ten times over for every single possible edge case. I can't describe how you know what these functions are, but I'm sure some smart person out there can. Any 'utility' function that isn't strictly tied to an object or model or business logic (e.g. you made your own string concat method for some reason) needs to get tested outside of the context of integration tests.

Anyway, good luck. I've seen the internal debate of unit vs. integration tests more than once. When this has come up, it's because the org has allowed shitty testing habits to exist (in the form of technical debt, maybe like what I described above, or something else) in the first place, and instead of fixing the habits, "throwing the baby out with the bathwater" is the solution.

You're not paying down technical debt by getting rid of the tests, you're just creating a different kind by having integration tests that will not catch edge-cases, which will eventually come up later in time.

</comment><comment><USER4> You mention removing "most" unit tests from the app, not all of them. Does that mean that you find some of them valuable and some not? This might suggest that perhaps you feel like you are maintaining too many unit tests, a little different perspective than dumping them all. Adapting to a more effective/useful/manageable amount of unit testing seems like a reasonable goal.

</comment><comment><USER5> Can you describe the tests you have in more detail? What do they test (e.g., is view code being tested), and how do they deal with difficult cases (e.g., situations in which one might be tempted to reach for a mock or stub)? Things like take make a big difference.</comment>


Stalin's Scheherazade: An opportunistic literary caper became a lifelong con - <AUTHOR> https://longreads.com/2019/02/06/stalins-scheherazade/ <comment><USER2> I know its unfashionable but I liked what Sholokhov wrote. It was very influential on me as a younger man. And, if you read around he did some stuff which had high risks for an accolyte of Stalin: he did actually stand up for others at some potential risk. So, literary theft happens everywhere, in oppressive and non-oppressive societies.

But.. I get why people are "down" on Sholokhov. But I do like the books. _And quiet flows the don /The Don Flows home to the sea_ in translation, are very thoughtful books. I don't think he entirely stole all of these words.

<comment><USER3> Indeed. The linked article actually explains that he put it together from an unfinished novel and adding his own bits. While obviously not all his own work, it is more complicated than the traditional story that he just found a completed novel and put his name on it.</comment></comment>


Growth in Ethereum - <AUTHOR> https://medium.com/@codetractio/hockey-sticks-in-ethereum-9c01adff3925 <comment><USER2> tl;dr: Meh growth, but "exponential growth" on the current small scale for March. Spike of interest based on some PR news without any substance. An Ethereum agency selling snakeoil and big-gov-money just wanting innovation- news-credits for "taking advantage" of the latest hype around blockchains without really understanding anything about it.

If you don't take into account a big part of March, I don't see any exponential growth. I think it's just piggy-backing on Bitcoin's danger of a hard-fork and recent drama. In general the numbers are so low that any kind of spike looks huge.

Another factor is the latest PR on a Ethereum-related consultancy getting a governmental contract on Dubai for smart-cities etc. However, I have talked a person that is involved in that and everything was just a google doc, there is no substance behind it, plus the Dubai-side just want something related to the blockchain-hype without knowing a lot about it.

<comment><USER3> I quit my job because I loved what I was doing with ethereum. You can say you dislike something without saying everything behind it is without merit, to put your words kindly. There are interesting ideas coming from regular people who care about different things while you're focusing on one element.

<comment><USER4> I'm unconvinced by Ethereum, but that wasn't really what OP was saying. He was saying there's no real growth.</comment></comment></comment>


Bit Counts in Python, Erlang and Clojure - <AUTHOR> http://metaljoe.wordpress.com/2010/08/12/bit-counts-in-python-erlang-and-clojure/

<comment><USER2> Rather than running down the int (or long) one bit at a time, checking to see if that bit is on and counting those that are, here's a routine that counts the number of bits in an int or long by folding it up half-length at a time. If you assume that operations on the longs are unit time (which if they're long enough they aren't, but it'll do) this runs in logarithmic time (in number of bits) rather than linear time.

Your job, should you decide to accept it, is to figure out how it works.

      #!/usr/bin/python

      from sys import argv

      x = long(argv[1])

      def count_bits(x)
        n_bits = 1
        limit = 1 << n_bits
        mask = 1

        while limit <= x:
          n_bits *= 2
          limit = 1L << n_bits
          mask = mask*(1+limit)

        d,shift = x,1
        div,mul = 5,3

        while n_bits > 1:

          d = ((d>>shift) & mask) + (d & mask)
          shift *= 2
          mask = mask/div * mul
          mul, div = div, (div-1)**2 + 1
          n_bits /= 2

        return d

      print x, count_bits(x)

Here's a simpler version for just 8 bit bytes:

      def count_bits(x):
        x = ((x>>1) & 0x55) + (x & 0x55)
        x = ((x>>2) & 0x33) + (x & 0x33)
        return ((x>>4) & 0x0f) + (x & 0x0f)

That's easy to extend for 16, 32 or 64 bits.</comment>


A set of best practices for JavaScript projects - <AUTHOR> https://github.com/wearehive/project-guidelines <comment><USER2> > Always use //todo: comments to remind yourself and others about an > unfinished job

No please don't do this, no one will ever do the todo. The code base I'm currently working on has more than 2000 todos.

Instead of this, create a ticket in Jira, Asana or whatever issue tracker you prefer. This way it can be easily taken in account when doing a sprint planning and even if no one opens the problematic file ever again, the issue will still be visible.

<comment><USER3> A variant I've seen is //TODO(#7362) where the number is a ticket and is enforced by a lint rule.

<comment><USER4> This is what I have found to be a great compromise for my team. Some like todos, others want tickets, so we enforce/support both.

<comment> jon-wood If it works then great, but that sounds like a way to piss everyone off by forcing them all to do both.

<comment><USER4> Yeah I find our "TODOs" don't live very long in the code base.

</comment></comment></comment></comment></comment><comment><USER5> "Tools, not policies".

I must say, this page reminds me of how lightyears ahead Perl was/is in terms of tooling.

For example: are you coding a package? Before even starting brainstorming, just boostrap your package with ExtUtils::MakeMaker. Long story short, that package will boostrap a mostly blank (but customizable via various command- line switches) Perl package with most things you will need for development and distribution: a directory structure, a Makefile (for building and installing), some pre-set comments, mostly blank test files etc etc.

This is something that, for example, the Go programming language team has rightfully picked up in terms of directory structure conventions and tooling (gofmt).

<comment><USER6> > I must say, this page reminds me of how lightyears ahead Perl was/is in > terms of tooling.

When Perl has such a mess of a syntax that its meaning is ambiguous to any static parser, I find it difficult to believe Perl has such amazing tooling - JetBrains for one refuse to implement any official support for it (see [https://youtrack.jetbrains.com/issueMobile/IDEA-87976#](https://youtrack.jetbrains.com/issueMobile/IDEA-87976#)).

<comment><USER7> This seems like an unrelated dig on Perl. There are many things that Perl did better than any contemporaneous language, all while having an ambiguous static parser.

</comment></comment></comment><comment><USER8> This is a mishmash of coding standards (at ABC CO we use tabs!) randomly sprinkled with best practices. It's important to standardize on things without one way necessarily being better than another. The organization also seems a bit rushed. For example, not exposing the DB schema in a URL shouldn't really go into the section on encoding. Moreover, SQL injection is almost never fixed by using an escaping function, as by far the most common problem with SQL injection is letting the client specify field and column names, or things that aren't quoted (e.g. numerical id's) and so don't benefit from escaping.

I don't want to discourage any company from setting and documenting coding standards, but this particular document feels a bit rushed and could use adherence to best practices of its own. For example,

1\. If making an opinionated mandate, provide a link to an explanation

2\. Consistently provide links to examples

3\. Maybe do some spell-checking: "Hallo"?

4\. Try to maintain a uniform level of specificity

E.g. in the section on URL security, there is this vague comment: "Attackers can tamper with any part of an HTTP request, including the URL, query string,"

Which, while a true, doesn't describe what the programmer should or shouldn't do. It's just hanging there. Compare with the weird specificity of listing git commands in section 1.

That tells me the author knew a lot about checking stuff into git, but was a bit out of his/her league when it came to Security, so they just made generic security statements while giving precise instructions for using git.

<comment><USER9> A lot of companies these days create "Best practices" guidelines just to boost their online recognition. Very often I find these guidelines useless or even harming.

<comment><USER10> What in this document do you find useless or harming?

<comment><USER11> > What in this document do you find useless or harming?

The use of TC39 proposals IN PRODUCTION. The authors of that document aren't serious.

<comment><USER10> Presumably they use a tool like Babel to compile down to present day ES in production??

</comment></comment></comment></comment></comment><comment><USER12> "Use stage-1 and higher JavaScript (modern) syntax for new projects. For old project stay consistent with existing syntax unless you intend to modernise the project."

That seems doesn't seem like a good idea. I can understand recommending Stage-2 and/or Stage-3, but stage-1 seems premature. Stage-1 in the TC39 process is still proposal stage that is flagged for expecting "Major" changes in the spec and possibly the syntax of the feature. Being stage-1 also is a poor guarantee that it will progress to future stages or become part of the spec. Stage-2 at least signals that the committee think its likely to eventually become part of the spec with only minor revisions.

<comment><USER13> You're actually right. I will change that to stage-2. Thanks for feedback.

</comment></comment><comment><USER14> > Organize your files around product features / pages / components, not Roles:

Oh really? Can someone explain why is this a good thing and what's the benefit?

[1] : [https://github.com/wearehive/project- guidelines#6-structure-...](https://github.com/wearehive/project- guidelines#6-structure-and-naming-)

<comment><USER3> I'm not so sure that's a good idea. A component is one possible interface to the business logic, but there isn't necessarily a 1:1 mapping.

Colocating data logic together makes it easier to build a data model that is logical and consistent, rather than one that is coupled to UI decisions.

<comment><USER15> It's not a black and white thing, you can have a feature structure for your UI and services, and one folder with just the data models.

Sometimes your frameworks kinda force it on you too.

</comment></comment></comment><comment><USER13> Hi guys, I published this document. Here at [http://www.wearehive.co.uk](http://www.wearehive.co.uk) we work with different developers with various levels of experience. We had to come up with a set of rules to bring some consistency to what we produce and make it easier for others to pick up and maintain it. It does look random and it's not perfect, that's why we decided to make it public and receive some feedback. I've already made notes from some of these comments. If you think something is wrong and shouldn't be there, make a pull request, or just let me know if you're too busy to do that.

</comment><comment><USER16> Can someone please explain to me the rational for shoving your tests in the same place as your code? I have seen this before, and every time i have tried it on anything beyond a simple project it has ended up becoming a nightmare.

Often times you have numerous test specific helper functions, and tons of other test oriented cruft, where do all these things go? The root of the project? Also where do tests that encapsulate logic between multiple components go?

<comment><USER17> That's a problem I always have with these kinds of things - when someone says "Place your test files next to the implementation" I always find myself thinking what the reasoning is behind the rule.

For that particular recommendation I can see arguments both ways - mind you I keep tests separate myself but I'd be interested in reasons for keeping them together.

<comment><USER18> I suspect it's an audit trail. You see the set of tests there. One issue is that I think this conflicts with the recommended Component/index.js or Component.js not Component/Component.js

I find you do want to find components through your editor (e.g. <cmd>+p in vs code) Finding lots of index.js doesn't help. You will in effect create a Component/Component.js but also use Component/index.js to export the Component.js

Also if you use Jest this sort of falls apart.

</comment></comment></comment><comment><USER19> One issue that is sort of addressed in this that I've been trying to find a solid answer on is how do you strongly ensure a given NPM package and its dependencies are safe to use?

So far the only real solution I've come up with is to do a signals review (github? issues? downloads/day/ etc...) and then review the code block by block carefully examining any complex or potentially dangerous code.

It works, and you learn a lot about the packages and why they depend on each other, but at the same time this process is exhausting.

What would be a godsend is some major security brand who can vouch (even at cost) for a given version of major packages including their dependency tree.

<comment><USER20> Are you looking for something like [https://snyk.io](https://snyk.io) ?

<comment><USER19> That does seem pretty solid, thanks!

I'll have to start testing dependencies there.

</comment></comment></comment><comment><USER21> Well this is definitely one way to do things... The reality of it is if you're making a project, and everyone is on board with the standards of how to do things and it's not making it unnecessarily confusing, you're practicing good coding. For example, if you have your tests isolated to a testing folder vs in a product/feature folder and everyone is on board, then it doesn't make any difference. I'll just look in the test folder for the tests rather than the feature folder.

Honestly, I don't get the obsession and combativeness around "best practices". Best practices are whatever your team uses effectively to get shit done.

</comment><comment><USER22> A set of best practices? It rather looks like a set of random thoughts.

</comment><comment><USER23> I can't say if these are the BEST practices for JS, or if even such practices could exist. But I do think that every company should have a standard set of written out practices/guidelines and publish them. They should probably even include them in their job listings. I hope people will comment on the potential pitfalls of doing so, but a benefit would be that new and prospective engineers would have a clearer idea of what writing code for the company would be like.

</comment><comment><USER24> > _" Only use nouns in your resource URLs, avoid endpoints like /addNewUser or > /updateUser . Also avoid sending resource operations as a parameter. Instead > explain the functionalities using HTTP methods:

GET Used to retrieve a representation of a resource. POST Used to create new new resources and sub-resources PUT Used to update existing resources PATCH Used to update existing resources. PATCH only updates the fields that were supplied, leaving the others alone DELETE Used to delete existing resources"_

This used to be hip and cool and "look ma, i'm modern, i'm doing it REST- style!", but i don't think the fad holds anymore.

In real life, you are going to do much more "operations" to a "resource" than just "retrieve", "create", "update", or "delete", and thus you need to use operation names. It makes more sense to always send the operation name and to standarize on operation names. Also operation names can be more explicit and unambiguous.

It is, for me, a very bad idea to mix up your business model semantics (actions performed on the business model) with the semantics that belong to the OSI-model application layer (HTTP methods: GET, POST, PUT, PATCH...).

<comment><USER25> Do both together.

Use GET/POST/PATCH/DELETE for the simple CRUD on the resource.

Then, put your actions under POST /resource/{id}/actions/{action}, e.g. `/repositories/1/actions/archive`, `/users/1/actions/ban`, `/customers/1/actions/credit-score-with-bank-of-xyz`, etc

<comment><USER26> I find the "/actions" slug a bit goofy and unnecessary. Why not just put it at e.g. "/repositories/1/archive"? Additionally, why not maintain restful semantics by using PUT (or more likely, PATCH) instead of POST (which implies creating a new resource)? And "/customers/1/actions/credit-score-with-bank-of- xyz" sounds a lot like a GET request.

<comment><USER25> Because there could be related resources, e.g. "/repositories/1/users", or "/users/1/comments".

I agree it's not necessary, but having /actions just makes it more clear. For example:

"/repositories/1/bans" shows me all bans

"/repositories/1/ban" ban action

I know it's a bad example, but you could end up with other similar related resource and action names that could increase chances of silly mistakes.

</comment></comment></comment></comment><comment><USER27> How do you collaborate on a branch using this workflow? The constant rebasing means you can't have multiple devs pushing to the same branch.

<comment><USER28> The ironic thing about this is that the link they post as a justification for rebasing feature branches onto develop is actually a very explicit reason _not_ to be rebasing in this situation.

The section reads like the author thinks that the problem with rebasing public branches is merge conflicts (it isn't; it's rewritten/diverging histories) and that interactively rebasing somehow resolves this problem (it doesn't).

This smacks of something that I come across all the time: strong opinions on how to use Git held by people who don't actually understand Git.

</comment></comment><comment><USER29> "Keep README.md updated as project evolves"

Sure man.

</comment><comment><USER30> And this is why I like opinionated frameworks like Ember.js so much. Most of the best practices are baked in. Plus you usually do not encounter a random subset of 'best practices' with added personal preferences/exceptions in other peoples projects, making collaboration much easier.

</comment><comment><USER31> > Place your test files next to the implementation.

Java background is probably biasing me, but I don't like this. It interferes with my ability to find code because the file list in every directory is twice as large.

What are the benefits of putting it together?

<comment><USER32> If you are creating a separate directory for each "module" then it would just be one more file in each directory.

Component

\- index.js

\- Component.js

\- component.scss

\- Component.spec.js

This structure has worked really well for me, you have everything you need in a single directory so you don't have to jump around to another directory to find the test or styling or whatever.

</comment></comment><comment><USER33> "While developing a new project is like rolling on a green field for you, maintaining it is a potential dark twisted nightmare for someone else."

There is nothing about this list of best practices that makes any applicable project more maintainable without understanding the practices being followed.

As long as these practices are well-known within the company and enforced over the lifecycle of code/product/project/etc., it will succeed. Without that understanding, this list eventually becomes untrusted.

Good on the folks at hive for following what appears to be solid practices in their JS projects.

<comment><USER13> Thanks, for your comment. I do agree that "best practices" isn't the best word. I probably should have said, "Hive common practices". Most developers have understanding of the process but just have a different taste and styles, we just tried to make things more consistent. We thought having such a document is better than not having it, and even if a developer doesn't understand the practices being followed this document brings an opportunity to learn them. I know it's not perfect and looks abit random, that's why we made it public to get some feedback.

<comment><USER33> Yep and understood -- it's what works best for your team. And yes, consistency is where the value lies.

I've found these efforts to be successful as long as those guidelines are socialized among the team and it's treated in a consistent manner.

Looks like a great list thus far!

</comment></comment></comment><comment><USER34> I hadn't noticed before but... Please do not recommend that people use "stage-1 features". Maybe if it is your own money, but not if you do it with other people's money.

</comment><comment><USER35> _facepalm_ ugh! Gitflow again! Get on board with Github Flow people - it's going to save you so much pain

<comment><USER36> Assuming you have a CD pipeline, sure, but many of us are still stuck with companies following a traditional structured release model, in which case Gitflow still makes a lot more sense.

</comment></comment><comment><USER37> These practices aren't even good.

</comment><comment><USER38> If you want a single best practice for working on maintainable JavaScript projects, here it is:

Use TypeScript.

<comment><USER39> I don't think the author would disagree. Using a compile-to-JS language with stronger correctness guarantees is valuable for large projects.

</comment></comment><comment><USER22> > 9.2 Operating on resources

Sure, let's pretend that GraphQL is not a thing. Yep.

<comment><USER40> Other than for a proverbial handful of people in the world, it isn't

<comment><USER22> I am a little bit more optimistic about it..I mean GitHub has recently introduced the GraphQL API..I guess that other SaaS's will follow - twitter, reddit, HN(or probably not) and so on.

</comment></comment></comment><comment><USER41> The very idea of rebasing in git, it just gives me the creeps

<comment><USER42> Well that's fine, cause I think merging without rebasing is gross. I want to commit when component x technically works, when I've improved it, when I've renamed crap, all the time. I only need those to be 1 commit and after that I can write a nice message that covers what it did.

My process for developing the code should be separate from the organization used to store it historically for others to see.

<comment><USER39> It seems like you're talking about squashing, not rebasing.

</comment></comment></comment><comment><USER11> > Place your test files next to the implementation.

ok.

> A resource always should be plural in the URL. Keeping verbs out of your > resource URLs.

What does it have to do with Javascript projects?

> Avoid js alerts in production

alert is a DOM API, it doesn't have anything to do with Javascript.

-

Barely anybody pointed out the fact that this "guide" mixes up things that have nothing to do with each others.

How is file organisation related to how one name "subresources" in a rest API or browser alerts ? it isn't.

This isn't a serious document. It was hastly put together with no real considerations whatsoever and named "best practices" without any sources or links to give weight to these opinions.

Finally, as I said multiple times, coding style guides, "best practices" that cannot be validated automatically on a CI server are worthless and a waste of time in an business environment.</comment>


Steve Jobs Tells Germans to Blame Their Government for iPad Price Difference - <AUTHOR> http://www.macrumors.com/2010/05/08/steve-jobs-weighs-in-on-ipad-international-pricing-and-taxes/ <comment><USER2> The headline makes it sound like Steve Jobs is being rude to Apple customers, but actually from the article, it seems like he's just curtly informing them of why the iPad price is 15 euros higher in Germany than in other european countries.

<comment><USER3> Jobs is quoted as saying:

 _Please educate yourself._

That seems rude to me. He might be responding to an equally rude complaint that was sent to him, but it still seems like bad PR to me.

<comment><USER4> I am loving his curt responses. Too many people on the internet are quick to complain without prior thought or research; nice to see them being put in their place.

<comment><USER5> It is the programmer still remains in him reminding people to "RTFM."

<comment><USER6> It's something I can get behind completely. People shouldn't be coddled like they're children, but if they act like one then being treated like one in return is the least one can do. =)

</comment></comment></comment></comment></comment><comment><USER7> People in Europe usually have the VAT included in the advertised price, so I can see how people would be getting their hopes up when seeing the american prices.

<comment><USER8> this absolutely freaks us out in US - that we never see actual prices we're supposed to pay, only share of what seller is supposed to get (before paying her taxes).

<comment><USER9> As annoying as it can be I actually think its a good thing that the amount you're paying in taxes is listed separately because then you are forced to see what you're paying in taxes.

I live outside Chicago and in some areas around me the sales tax is >10% (10.25 in the city I believe). The fact that you see what your paying in taxes every time you buy something makes it harder for the politicians to raise it too high.

Edit: Fixed Typo

<comment><USER10> VAT _is_ always listed separately in Europe as well (on the receipt) - it just has to be included in the advertised price.

<comment><USER9> How often do people actually read their receipt?

It's good that they do have the charge listed but I still feel like most people are not aware how much of their bill went to the VAT whereas in general around here you can't possibly miss it.

<comment><USER10> I can only talk about Germany, and any change in VAT, be it the raise from 16 to 19% in 2007, or a recent cut to 7% for restaurants and hotels, generally gets _a lot_ of publicity.

People may not be reminded about it constantly, but they are definitely aware of it.

</comment></comment></comment></comment></comment></comment><comment><USER11> EU governments sure do love their taxes.

<comment><USER8> US states sure do love theirs! down to every damn municipality.

I hope Volcker will prevail and US will get VAT finally.

<comment><USER12> Sales tax in my municipality is less than half of UK's VAT, and food and clothing are exempt from it. You're right, I sure do love it.

<comment><USER13> Food and childrens clothing are also exempt from UK VAT.

<comment><USER14> To be pedantic, food (except for, roughly, `luxury' and catered foods), children's clothing, and books, amongst other things, are _zero-rated_ , rather than _exempt_ (a separate category which includes medical treatment and education).

<comment><USER15> Some plain foods have zzero vat. More luxurous food is taxed. This is important when you think of jaffa cakes, are they a biscuit or a cake? If they are a buscuit, then they don't have vat, if cake, then the price goes up

</comment></comment></comment></comment></comment></comment><comment><USER15> Apple always charges more for EU customers, usually replacing the $ for a €. When €1 = $1.50, I don't believe it's the tax, and instead feel like I'm getting screwed.

<comment><USER16> Why the downvotes?

Rmc is right. Go to Apple store, take a look at any Apple product and see for yourself.

For example, the 13" 2.4 GHz MBP is 1200 USD in US. In Europe, it is cca 1050 EUR _without_ VAT (cca 1250 EUR with VAT), which makes it around 1350 USD (and 1600 USD with VAT!). Nice 10% pre-tax price increase.</comment></comment>


Twilio adds numbers in 20 new countries - <AUTHOR> http://thenextweb.com/mobile/2012/10/17/twilio-expands-to-6-continents-20-countries/?utm_source=dlvr.it&utm_medium=twitter

<comment><USER2> Was very excited to try this since they now support Brazil.

Unfortunately, they can't verify my phone number because... It's in Brazil. Is it supposed to be that way, or am I overlooking something?

<comment><AUTHOR> * facepalm *. You should be able to verify a Brazilian number on the signup page now, can you try it again?

<comment><USER2> Holy crap, that was a fast response! :) Also, thanks for contacting me on twitter.

Unfortunately, I'm still unable to verify my (mobile) phone number. :/

<comment><USER2> Update: We got in touch via email and Kevin and the others sorted out what was wrong. Brazilians can now officially activate their numbers and use Twilio.

Props on the great work, guys!

</comment></comment></comment></comment><comment><USER3> I find Twilio very useful for setting up fake 'people'. Which I use for Social Engineering Tests and such. The fact that they just added more countries should makes this even easier and much more believable. I'm not totally clear on the commerical value add for Twilio but I know for a fact it is used by plenty of people writing malicious software and this update should make it much more effective.

Twilio + VoiceBunny + ((RSS + Reddit Comments) + Twitter + Facebook) yields nearly 100% believeable fake people. I've also used actors from craigslist in the past. I've used these methods to social engineer access to bank accounts, servers and all sorts of things.

<comment> mike-cardwell How is Twilio different to any other VOIP provider for this?

</comment></comment><comment><USER4> The cloud is where voice is going.....before traditional voice telecom dies. Nice to see this!</comment>


Show HN: Anwendo – the simplest way to get UI tests work for you - <AUTHOR> https://anwendo.com <comment><AUTHOR> Hello Hacker News Community!

I'm the author of Anwendo tool, your feedback is much appreciated. Especially negative one, because friends willing to support share only positive feedback.

<comment><USER2> Hi Anwendo's author, off the top of my head what are the real benefits of your tool in comparison to Selenium and similar ones??

<comment><AUTHOR> Hi!

Comparing to Selenium Grid - no programming needed, just use this extension to record them. Comparing to Selenium IDE - test maintenance is simpler and semi- automated, we have heuristics that adjusts to the page structure changes and avoids hard-coding UI element locations as Selenium IDE does.

It's a cloud service, we manage and update test environments.

It also saves your time when troubleshooting test failures - it's much easier and faster to understand why tests fail with the help of highlights and screenshots.</comment></comment></comment>


The Page Load Paradox - <AUTHOR> http://blog.scoutapp.com/articles/2010/06/17/the-page-load-paradox

<comment><USER2> Yes, speed matters. This is just anecdotal evidence, so feel free to dismiss it:

We recently switched hosting companies and our site load speed went from an average of 10 seconds to the new server speed of just under 1 second.

Our monthly revenue instantly doubled. People stayed on our site longer, they learned more about our products, and thus were more willing to shell over their hard earned cash.

<comment><USER3> Speaking as a consumer, if I went to a site that took 10 seconds per page load, I wouldn't feel like I was dealing with a professional organization. I'm not going to expect high-quality products if you have low-quality web hosting.

<comment><USER2> Exactly. The hosting didn't start off that slow. When we first purchased the server slice the average page load time was about 1.5 seconds. But as time went on, the hosting company overstocked their servers and load times inflated horribly.

By the way, this crap hosting company is MediaTemple.

<comment><USER4> As a MediaTemple customer since January 2007 I can vouch for this. Their hosting service isn't what it was when the Web was courting them during the Web 2.0 hype era. I still pay them to host my blog (on hiatus), but now I use WebFaction for current projects and could not be happier with their hosting or customer service. I strongly recommend them.

</comment></comment></comment></comment><comment><USER5> I think this is very important for web applications as well, not just for a page load time. Broadband may help with bandwidth, but latency remains the same.

</comment><comment><USER6> I think it depends on what the site is being used for. If there is information on the site that I can't get anywhere else, I'd wait. However, if it's an online webapp with many similar competitors, speed is more likely to factor into my decision making.

</comment><comment><USER7> Google is a champion speed and consider it a core-competency. I know that when building EveryMentor.com I did my best to keep it fast and lightweight and I am really proud of how responsive it feels. HTML requests are 260ms and after the initial jQuery/CSS caching, there are really few images to deal with either.

It feels blazing fast with Chrome and that is really important to me.

</comment><comment><USER8> A lot of us have worked tabbed browsing into our workflow to a degree that the difference between 1 millisecond load time and a 5 second load time is negligible, since I'll spend enough time on the first tab to let the rest I've queued load up.

It's also worth noting that on mobile, the bottleneck is still the connection, not client or server side rendering.

</comment><comment><USER9> I'll happily wait 20 seconds for gmail to load, since I'm not going to close it again until I reboot.

If I'm revisiting a site I know, I'll cut it some slack, and be pretty patient.

But.. if I'm picking off results from a search, the sites have mear moments before I hit that back button

</comment><comment><USER10> Note that there is also an optimistic view on that issue. For instance, the same effect ensures that mobile phones aren't accepted to take too long to boot (compare their boot times to the 2-5 minutes which computers usually need). So I agree, it's all about what latency people are used to.

<comment><USER11> >compare their boot times to the 2-5 minutes which computers usually need

I thought my old Athlon 1.1GHz was slow but it boots in under 2 minutes (just), I consider that very slow.

I can't really understand why phones would take long to boot, restoring state from flash memory can't be that slow surely? Quick test for me, new phone Sony T715 is 12s and old phone Sony Z610i is 6s (rough numbers, to usable interface not including signal acquisition); seems longer than it should be.

<comment><USER10> _> [...] boots in under 2 minutes_

Well, I thought about the usual end-consumer computers.

You can indeed shorten it to 1-2 minutes if you use a slick operating system (my servers usually have that boot time), and I've been told that you can tune most BSD and Linux systems to boot in 20-30 seconds.

However, this is still worse than even the worst mobile phones.

<comment><USER11> >You can indeed shorten it to 1-2 minutes if you use a slick operating system

Which OS are you using that takes 5 minutes to boot (and what hardware)? I'm just using Kubuntu 10.04 with a pretty standard install (though I've stripped most unneeded apps). It did boot marginally quicker (as did my other comp) with 9.10; though shutdown now is very quick.</comment></comment></comment></comment>


Ask HN: Advice for getting connected with startups looking for experience? - <AUTHOR> tl;dr: -Any advice for someone looking to switch from their own lifestyle business to working on someone else's project? -Any advice for someone on the wrong side of 40 with C level experience trying to find startups or fun projects that might value my experience?
I've had a successful lifestyle business for the last 15 years where I've held the role of CTO or COO. Recently for a variety of reasons I've been thinking about selling to my partner and leaving to try something new. But I don't feel like I fit well into many job descriptions. I haven't written a line of production code in ten years, but I've put together and managed teams that have made successful FinTech products with tens of millions of dollars in transactions going through them. I think that the most valuable skill I possess is that I can put together teams where people like to work for me and we get things done. I don't need to be a C level executive, but I feel like I have a lot of experience that could help a lot of startups be successful, but I don't really know how to market myself. My network is very small and specific to the industry where I've been for the last 15 years. My CV is fairly bland, because the last 15 years has been spent on my own businesses, which did very well, but you've never heard of them.
Does HN have any advice for getting myself out there in a way that I might find someone I can help? <comment><USER2> Hi, I'd actually love to get in touch to learn more about your situation. I'm building an enterprise tech startup and could use someone with decent experience while I focus on the commercial aspects of things.

</comment><comment><USER3> I see a lot of _" Engineering Manager"_ positions out there. Try applying to a few of them and see if there is a fit. If not, talk to some recruiters and try to find why.

The best recruiters to talk are the ones employed by big companies themselves (not from recruiting agencies) and that explicitly say they are hiring on their LinkedIn profiles. Often they have a premium account and leave their private messages open.

</comment><comment><USER4> One option is to offer to be a mentor for a startup accelerator like MassChallenge.

</comment><comment><USER5> Look for director and VP level roles at small to mid sized startups?</comment>