Dear customers of Cloudflare: an appeal regarding Tor - <AUTHOR> https://gitlab.com/iblech/tor-appeal/blob/master/README.md <comment><USER2> I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate".

A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a blog entry? Don't need to test. Writing a comment? CAPTCHA them to the break of dawn.

<comment><USER3> What I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.

<comment><USER4> I run dedicated onion addresses for my sites and check the CF-IPCountry headers and just redirect Tor users to the Onion site.

<comment><USER5> That is indeed the most constructive approach. I mean, Facebook has an .onion site :)

</comment></comment></comment></comment><comment><USER6> This shouldn't be necessary. We changed our handling of Tor so long ago that I've forgotten how long go it was.

If you are using the Tor Browser Bundle you should not see a CAPTCHA. If you do please report it to us.

<comment><USER4> I'm seeing the CAPTCHA a lot with the Brave Browser Tor Tab. You might want to reach out to the developers to make their Tor Tab be treated the same as the Tor Browser Bundle.

<comment><USER6> OK. I don't like that. I messaged the team about this.

</comment></comment></comment><comment><USER7> I get the appeal, and I get it's a PITA. But, if the referenced CloudFlare support document is to be believed, then you'll be putting yourself at additional risk by whitelisting, or otherwise "turning down" the security related settings for Tor users.

Let's pretend for the minute the support article is accurate, and let's pretend CloudFlare's security checks are useful. (I don't have any opinions/knowledge myself if there are true/false, so let's assume they are true - as most CF customers will).

Why should I turn off the security CloudFlare is providing me? The appeal doesn't give me anything I can use to justify turning this off. Given the percentage of tor users vs not-tor users, I can't really call the "it bothers Tor users" statement justification for turning this off.

I know it shouldn't be needed, I know anonymous browsing should be taken for granted, however - reality is - it's not. For an appeal like this to succeed, or even make a measurable dent, you'll need more.

I do hope you find more, anonymous browsing should be the norm, not the exception - but I don't believe this appeal will make a dent.

</comment><comment><USER8> Those Google captchas are horrible. Often they do not let one of through despite giving seemingly correct answers. One is prompted with captcha after captcha after captcha. They not only require cookies, but JavaScript turned on and are a real affront to the whole idea of a usable, open web. On tor, I just give up. There is nothing I want to see on the internet badly enough that I'm willing to spend ten to fifteen minutes (this is not an exaggeration) trying to guess what I'm supposed to click on. I do blame cloud flare, ignorant website creators, but most of all Google. Out of the many atrocious products they have created, nothing is more infuriating and frustrating than these stupid captchas. They are not logical and quite often simply unsolvable. I support the creation of bots that can guess (because that's what the process is, there's no solving these) these even if it comes with all the downsides of having such bots roam freely on the internet. I hope the ai of the future is able to deal with such nonsense to the point where Google gives up on this atrocious technology. I'd rather have spam and ddos attacks than this.

<comment><USER9> At some point, Google started doing really aggressive increases in their captcha difficulty based on IP trust or even outright refusing to let people try and solve them at all. Since there's going to be a large overlap between IPs that Cloudflare force through the captcha and IPs that Google distrust, this means that anyone trying to access the internet through a network that Cloudflare has put on their evil list will probably find the whole web completely unusable. Of course, any employees testing the captcha feature will go though the easy path and not see the problem...

</comment></comment><comment><USER10> Background on tor problems: [https://blog.cloudflare.com/the-trouble-with- tor/](https://blog.cloudflare.com/the-trouble-with-tor/)

<comment><USER11> and The Tor Projects response to that: [https://blog.torproject.org/trouble- cloudflare](https://blog.torproject.org/trouble-cloudflare)

They have been in this dispute with each other for a long time.

<comment><USER12> _blog.torproject.org uses an invalid security certificate._

 _This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate._

<comment><USER13> You may be behind a corporate firewall that is blocking access to the site.

<comment><USER5> More like a corporate MitM exploit, which HSTS is detecting.

<comment><USER14> Even a corporate proxy will work with HSTS.

</comment></comment></comment></comment></comment></comment><comment><USER15> I'm not a Tor user but from IP blocks of ISP with low reputation, the Cloudflare Captcha irritated me too much. Now I'll close the website if I see one and looking for Google cache or archive.

</comment><comment> ainar-g The Tor Project is invaluable in countries like Russia, where the gov. can block literally millions of IPs just to get rid of one pesky messaging app.

Now that I think about it, people using it should probably donate more to the project. Although this very same gov. can always see it as "supporting the terrorists".

<comment><USER16> This seems less like a dialogue revolving around the post and more like a promotion of TOR

<comment><USER17> It's an argument for "why you should care", which is relevant to the post.

<comment><USER18> Furthermore, as an expat living in Russia at the moment, it is quite surprising to one day be in an EU country and able to access any wide variety of sites, and the next day get a friendly message from Роскомнадзор telling me this website has been blocked for my protection or some other non-sense.

I'm not involved in politics enough for it to be something very dangerous for me -- it's just non-sense things I want to see that I cannot because of silly regulators wanting to look important. But at the same time, trying to browse around via Tor to bypass these restrictions make it impossible at times to access information that Роскомнадзор has decided Russians shouldn't be allowed to access.

<comment> ainar-g For those wondering, "Роскомнадзор" is Russia's "Censorship Agency", Roskomnadzor[1]. If you are wondering, why is there a Censorship Agency in a country whose Constitution explicitly bans censorship[2], well... Let's just say it's not the first time in our history. Probably not the last.

[1] [https://en.wikipedia.org/wiki/Federal_Service_for_Supervisio...](https://en.wikipedia.org/wiki/Federal_Service_for_Supervision_of_Communications,_Information_Technology_and_Mass_Media).

[2] [https://en.wikisource.org/wiki/Constitution_of_Russia#Articl...](https://en.wikisource.org/wiki/Constitution_of_Russia#Article_29).

<comment><USER18> To be fair, a lot of times I feel that it's more Hanlon's Razor than active censorship. There still is a lot of Old World Russia running the show in Russia, and stuff you could pull off when the entire populous was farmers just doesn't really work now, and Russians are not afraid to call their leaders out on it. The problem is that there still is an overwhelming sense of apathy in the population, though this is steadily changing as more and more people become active politically, even if for now there isn't an immediate effect.

But a lot of things that agencies like Роскомнадзор do are simply because it made someone a quick buck somewhere down the line. Many of my friends/colleagues work for businesses run by old men who are more interested in 10,000 rubles now than 100,000 rubles in a week. The decisions that Роскомнадзор and other government entities makes rarely have much more of a thought process beyond a simple "well, we wanted X". When the Telegram ban came into effect and folks outside of Russia were flabbergasted by Russia's choice to just block major parts of AWS, people came up with the most outrageous of theories as to what was happening. The simple and more accurate truth was probably that whoever made the decision at Роскомнадзор to do the blocks neither thought about the implications of such a decision nor had the technical knowledge to really understand it, and those underneath this person likely didn't have the will or inspiration to care, hence why the block is so trivial to bypass (like all the other blocks)

Like with many countries, a lot of old political methodology has to die off before Russia can really step forward, and while that is happening, it's why projects like Tor are essential for providing unmitigated access, whether it is a malicious block (Telegram) or a senseless one. That so many US companies just have a straight up IP block on all things Russia doesn't help to advance the situation past this stage at all.

</comment></comment></comment></comment></comment></comment><comment><USER19> I've got enough problems on my sites from Tor that I simply block T1 (Cloudflare's "country" code for Tor users) on their settings. Blocking whole countries used to be a Enterprise only feature, but now it's available to Pro users.

<comment><USER20> What problems do you have?

<comment><USER21> Not GP, but my guess is ban evasion.

Someone gets banned from bad behavior, they create a new account. So you IP ban them. Then they switch over to Tor and keep making new accounts from anonymized IPs and start disrupting the forum by spamming it with slurs. The only solution is to ban Tor.

<comment><USER22> Or, you know, limit the ability of newly created user to spam forums. Or put them on "must be reviewed" lists. Or...

The easiest solution is to ban Tor, but it's far from the _only_ solution.

<comment><USER23> All of those may entail much, much more work than banning Tor.

I can think of plenty of cool, robust systems I can build as well, but I do not have unlimited resources.

</comment></comment></comment></comment></comment><comment><USER24> Criminals will just hire a botnet, as we can see from all incoming spam email and forum bots, etc. For the rest of us who desire to be anonymous online, there is Tor. Whatever people can do over Tor, they can also do without Tor. You're probably never going to find them anyway, even if you would sue in the first place.

This whole tor vs clearnet distinction is way overblown. Sure people will do more crap if they're anonymous, but if you block Tor criminals will just use something else.

<comment><USER25> >Criminals will just hire a botnet

... if Tor proves ineffective. If not, then they'll definitely use Tor.

<comment><USER26> Botnets are too unreliable. They're only any good for coordinating DoS attacks and spamming, the sorts of attacks that don't require persistence of infrastructure.

Tor is a common CnC and exfiltration vector. Nothing good will ever originate from a pseudoanonymous network developed for spycraft. We have enough problems with it that we shoot it on sight.

The bigger problem is becoming abuse of cheap VPS and seedbox services (and anon VPNs) to launch attacks. $5 gets you a non-attributable box managed by an overseas entity with a gigabit link and an IP strategically located near your target to thwart geoip-based blocking. With that price point and features, why fuck around with botnets or Tor?

<comment><USER27> >>> The bigger problem is becoming abuse of cheap VPS and seedbox services (and anon VPNs)

Cloudflare have the solution for that. You can ban by AS number and by country code.

</comment></comment></comment></comment><comment><USER28> All the author had to do with this "appeal" was present the text to be read. Instead they put it on gitlab behind javascript. Literally nothing renders without JS enabled, and even with it enabled in browsers more than a year or two old it's just spins forever: no text.

Text is easy guys. Here's my appeal: stop hiding all content behind javascript. It's not required and because if it I am unable to read the author's appeal.

<comment><USER29> For any markdown file on Gitlab, you can look at the raw version: [https://gitlab.com/iblech/tor- appeal/raw/master/README.md](https://gitlab.com/iblech/tor- appeal/raw/master/README.md)

That's also not a trick you need to memorize or something - if you load a markdown page on Gitlab without Javascript, it won't render, but you can still click on the button to view it raw, and that button is clearly labeled with semantic HTML that will be accessible to any web browser that can handle a link tag. You do need to be able to handle HTTPS encryption, but that's another debate - most raw text documents are also going to be served over HTTPS anyway.

And of course, from the Javascript side of things, the vast majority of Gitlab's front-end is open source and all of their Javascript is served from their own servers without any third-party trackers or ads. So no worries on that front.

I get that people get annoyed about aggressive and unnecessary useage of Javascript and some choose for ethical reasons not to run proprietary code. I am all for accommodating you. But Gitlab _does_ accommodate you. There has to be at least a little bit of effort put in on both sides here. Otherwise sites are just going to throw up their hands and say, "well nothing pleases these people, why should we bother?"

Gitlab does a great job of accommodating people who want access to raw text while also accommodating people who want to be able to do basic layout. And the approach of sites like this have significantly encouraged devs to use markdown more - if this was a static site, or something exported out from Org- mode, or even just a rendered Markdown file, you wouldn't have access to the original raw text version.

The only reason you have access to the raw text is because the uploader chose to serve the raw text and then handle rendering clientside instead of serverside. If you want to be able to read more content in Markdown form, Gitlab is your friend, not your enemy.

</comment></comment><comment><USER30> Have you operated a website that gets lots of scammers? I've been responsible for the security on several major e-commerce web applications. Often, you have to make compromising choices, we found that the vast majority of requests over Tor were not converting, in fact I don't think a single visitor via Tor had bought a product (iirc, but I'd have to check to be certain). That combined with the number of fuzzing/strange requests from users via Tor was just too high to consider them to be meaningful traffic. We blocked Tor users outright and it resulted in no change in revenue and a more straight forward security landscape.

</comment><comment><USER31> i've often had more luck passing these captchas randomly selecting 4 boxes from the grid than trying to answer it intelligently. for example it often asks to select a sign -- does the signpost count? only 50% of the time... similarly, it might ask to select cars. does a bus count? there is no consistency, presumably because the training data is ambiguous. does it deter spam? yes, of course. so would a 404.

<comment><USER31> of course the real consequence of the above is that tor/incognito users are essentially being excluded from increasing parts of the web. it's hard to think it isn't intentional either (ie privacy is becoming illegal)

</comment></comment><comment><USER32> The reality of systems like Tor is that they're going to be heavily abused by bad actors. Part of the whole point of using Cloudflare is to reduce your vulnerability to attacks from those bad actors, so I don't see how it's a good idea to whitelist that traffic indiscriminately.

I feel for the legitimate users of Tor who are annoyed by captchas all day, but unless someone has a foolproof way to filter out good Tor users from malicious Tor users, I think that's just the price you pay.

Also found this interesting for more context: [https://support.cloudflare.com/hc/en- us/articles/203306930-D...](https://support.cloudflare.com/hc/en- us/articles/203306930-Does-Cloudflare-block-Tor-)

</comment><comment><USER33> I've been trying to use the Tor browser lately and so far it's been a mostly futile endeavor. Between these captchas (which take 1-2 minutes to solve) and other automated "bot" detection, most of the web is unusable. You _might_ be able view it, but good luck interacting with it in any way. That's when you run into the "Sorry, something about your activity seems fishy" messages.

</comment><comment><USER34> This also blocks me from scraping which in my case means you're not going to get traffic from my aggregator. I could work around it but honestly there is enough great stuff out there _not_ behind cloudflare so it's not a priority.

</comment><comment><USER35> If I had a dollar for every time someone behind Tor tried to screw with my saas app...

</comment><comment><USER36> Please turn JavaScript on and reload the page. DDoS protection by Cloudflare

this pisses me off even more than writing captcha

</comment><comment><USER37> From a network abuse perspective, any individual ipv4 /32 that is a TOR exit point is an immense source of abuse, spam, shit, automated password attempts, etc.

</comment><comment><USER38> Walk into a bank with a face mask on, and see how they react. Same principle here.

<comment><USER39> You should be able to walk up to a vending machine with a face mask on. That's a more apt analogy.

<comment><USER38> The analogy still works: Let's say the vending machine companies became fed up with being robbed all the time by people using face masks and as soon as somebody walked up wearing a face mask the vending machine would recognize this and turn into a locked down candy safe.

Maybe to get around this the vending machine could ask for an identity card to confirm this person was safe.

In the same way, could Cloudflare (or anybody else) cookie people who were deemed safe? Sure. But then that sort of defeats the purpose of Tor.

From the perspective of somebody operating these systems: they are either damned if they do, damned if they don't. Given the relatively small number of people using Tor, I think what has been done here is perfectly reasonable.

</comment></comment></comment><comment><USER40> For people who are unaware, there is a cryptographic solution to this. Cloudflare worked with crypto researchers to create a way for Tor users to anonymously verify that they're not a bot. It's called Privacy Pass and it solves this problem: [https://blog.cloudflare.com/cloudflare-supports-privacy- pass...](https://blog.cloudflare.com/cloudflare-supports-privacy-pass/)

</comment><comment><USER41> The main problem with whitelisting Tor is that you open the door to abuse.

Cloudflare is working on a new solution to this problem that allows us to differentiate between abusive visitors and legitimate users without de- anonymizing them.

If you're a Cloudflare user and want to sign up for this feature, email onion- firstname.lastname@example.com for details.

</comment><comment><USER42> Or.... you could stop using Tor?

</comment><comment><USER43> Why would a company that values their users' privacy have Cloudflare man-in- the-middle their traffic in the first place?

Cloudflare decrypts the traffic, which in many cases includes personally identifiable information like names, email addresses, transactions, etc. It's hard to imagine something more anti-privacy than allowing a third-party access to all of your users' data.

Tor users should take those CAPTCHAs as a sign that they're visiting a web site that they can't use while maintaining their privacy.

<comment><USER44> What hosting is acceptable for your privacy wishes? Given that "a contracted party sees plaintext" is apparently the issue, the following clearly are not ok:

a) any SaaS

b) any of the cloud providers when their load-balancing offerings are used in HTTP mode (e.g. Amazon ELB)

c) any traditional "shared" hosting company

Are VPSes trustworthy enough, or does it have to be dedicated hardware? Dedicated hardware under direct control of the company only? And how many companies run those, vs setups falling under a-c) above?

I see people make comments like this all the time when it is about Cloudflare, but somehow very seldom if it's about Amazon AWS, Shopify, ..., despite the same caveats applying to those, and it being widely accepted that third-party processing is fine if for a clear purpose and under proper contracts.

<comment><USER43> Yes, options A, B, and C are technologies that shouldn't be used where user privacy is highly valued. They violate the fundamental concept of end-to-end encryption.

In practice, a rented VPS or dedicated server that terminates its own TLS connections can be considered very private. It's not impossible for the hosting company to acquire the private key but it would require real effort, business risk, and potential liability.

Even if you're not worried about rogue employees, you have to worry about mistakes like the infamous "Cloudbleed" bug that leaked private user traffic.

<comment><USER45> So avoid using more than 75% of the web? You may be right in that these websites value your privacy less than other things but it certainly doesn't seem like a viable solution for most users. What's the day to day usage look like when you take your privacy this seriously? I'm not well versed with what tools you would use currently to achieve privacy.

</comment></comment></comment></comment><comment><USER46> There is a disconnect here: I've read so many technical articles from cloudflare about neat problems they solve while at the same time they just boldly say fuck you to net neutrality and aggressively try to get people on board with the tracking internet that their corporate partners desire so strongly. I get the sense these aren't the same groups of people at the company itself.

I've been browsing anonymously with tor and other services for about five years now and the web just gets more and more hostile every day. So many pages, apps, services, etc just flat out don't work anymore even if you solely have a VPN running.

Not to throw cloudflare under the bus, Google and Apple have have created way more issues for me with their hostility to anyone who evades tracking.

<comment><USER32> Eh, I really doubt that it's designed to punish people who aren't tracking. Tracking makes users much more valuable, but the average legitimate user who isn't being tracked is still probably net positive value, so it wouldn't make sense to just block them outright.

I think the problem is that a very high percentage of malicious behavior online comes from Tor, certain IP ranges, VPNs, scrapers that don't run Javascript, etc, etc. You can't get rid of all of those malicious actors, but you can probably block the vast majority of them by taking the actions you're complaining about here, and I suspect that it doesn't actually cost you that much. You get some cranky nerds and some legit users who are using Tor and VPNs who won't be able to use your site, but they're a tiny minority.

<comment><USER17> Cranky nerd here. I've tried to use Tor to access websites for legitimate purposes and found much of the web has become unusable recently.

But perhaps you need a motivating example, since you don't think there's any value in supporting Tor! I'll give you some.

\- Security researcher wishes to contact an organization about a security hole in their site or product, but doesn't know if they'll be sued, so they want to protect their identity. (source: this is me; have met other people doing this)

\- Pedophile (who doesn't _want_ to be one) seeking therapy options that don't involve a high risk of being incarcerated or killed. (source: read an article about this)

\- Teenager in a repressive environment trying to access LGBTQ resources; parents have a netfilter on, or maybe have snoopware on the router. (source: several acquaintances)

\- Chinese citizen trying to find a different view of history (source: pretty freaking common, although Great Firewall makes it tricky)

These are people who don't have other, good options. And you'll need to be able to withstand the sizeable quantities of malicious traffic that _don 't_ come through Tor, so it's not like you really win anything. It's worth not blocking Tor.

<comment><USER45> You need to provide fiscal value or convince the operations team of legitimate companies to not treat Tor as a bad apple. It may not be right but money is the only motivating example that matters to companies.

<comment><USER17> The plea also goes out to people who have their blogs running through Cloudflare. (For some reason.)

<comment><USER47> A zero-configuration free CDN is a pretty good reason in my opinion.

<comment><USER17> I guess I don't get the need for a CDN for a blog. I can run a blog off a raspberry pi. It's text, a bit of markup, a couple images.</comment></comment></comment></comment></comment></comment></comment>


JavaScript most used, Python most studied, Go most promising - <AUTHOR> https://www.zdnet.com/article/programming-languages-javascript-most-used-python-most-studied-go-most-promising/ <comment><USER2> I'd like to hear some viewpoint about Go from Golang user.</comment>


Neo Technology Raise $2.4M To Commercialize neo4j Graph Database - <AUTHOR> http://www.techcrunchit.com/2009/10/27/neo-technology-commercializes-next-generation-graph-based-database/

<comment><USER2> I've recently looking around at possible back ends for a recommendation engine for my social news site. I've been interested in using neo4j for a while, but I was concerned about dual licensing and the costs. I'm bootstrapping, and my budget is pretty limited. So, I emailed neo and asked for a quote.

To make a long story short, Peter Neubauer from Neo called me, and we had a really great conversation for about 20-30 minutes. He took the time to forward some papers to me about using graphs in recommendations engines.

Their subscription prices were crazy reasonable. I was expecting Oracle pricing. I was actually suprised their prices were so low. Up to a million primitives are free. Up to 10million primitives is $49 a month.

I'm really glad to hear they got funding. So far, I've been really impressed by them. I'm looking forward to checking out their database.

</comment><comment><USER3> I looked in to neo4j the other day, but was put off by the combination of the AGPL license (which, as I understand it, makes it impossible to use for any commercial purpose since you are required to GPL any software that so much as talks to the database) and a lack of any indication of how much a commercial license would cost on the web site. I know this is how "enterprise" stuff works, but personally I have a strong aversion to evaluating software when I have no idea how much it would cost should I chose to use it - that's one of the reasons I like open source.

<comment><USER4> You may like to have a look at 4store: <http://4store.org/> \-- it's GPL3.

</comment></comment><comment><USER5> I'm trying to see how a graph database would be significantly faster than a key-value database. The only thing that comes to mind is that with graph databases a node's edges contain direct pointers or offsets to the other nodes, instead of containing the "public" string key of every other node, which has to be looked up via the B-tree index. This conclusion is supported by [http://blog.directededge.com/2009/02/27/on-building-a- stupid...](http://blog.directededge.com/2009/02/27/on-building-a-stupidly- fast-graph-database/)

So if key-value stores gave us access to their internal record IDs or offsets, both to read and search by, we would see a considerable improvement. The trade off would be sticking to an append-only data structure without compaction, or doing some extra work to update the offsets on every compaction.

</comment><comment><USER6> Rickard Öberg speaks highly of it, which generally speaking is a pretty good endorsement.

</comment><comment><USER7> Great news for Neo. Most of the comments I see about neo4j are along the lines of "great technology, but doesn't quite cut it from a performance perspective".

<comment><USER8> I've seen some of the same comments, but I tend to take them with a grain of salt...in part because none of the commenters seem to have asked Neo or the community for help/advice when they've experienced performance issues. (The fact that the Neo demos I've seen have been pretty decent performance-wise leads me to believe _at least some_ of the performance issues could have been solved if the people trying Neo out would have simply asked for help. It's usually difficult to wring the best performance out of a database of any kind without some hard-earned experience. The fact that many of the experimenters probably have little graphDB experience in general couldn't have helped the situation any.)

<comment><USER9> Definitely true. There are of course patterns that can slow certain graph traversals down, like having millions of relationships on one single node. Otherwise Neo4j handles up to a couple of billions of nodes/relationships/primitives out of the box, which is a good starting point for most of the cases.

Disclaimer: I am part of the Neo4j team.

<comment><USER7> And it's that former situation where I've seen the performance issues mentioned.

</comment></comment></comment></comment><comment><USER10> Does anybody know how this compares to Allegro Graph (in price and/or performance)?</comment>


Ask HN: What is deliberate practice for programmers? - <AUTHOR> This has been asked before. Many people say "work on projects" or "read lots of code." But that's not what deliberate practice is.
According to Eriksson and Pool (2016, "Peak"), deliberate practice is different from what they call "purposeful practice" (trying very hard to push yourself past your limits and improve). In contrast, deliberate practice is both purposeful and /informed/. "In particular, deliberate practice is informed and guided by the best performers' accomplishments and by an understanding of what these expert performers do to excel." (p. 98)
Is there anything that satisfies these criteria? (from p. 99-100):
1. Deliberate practice develop skills that other people have already figured out how to do and for which effective training techniques have been established.
2. Deliberate practice requires a student to constantly try things that are just beyond his or her current abilities. It demands near maximal effort, which is generally /not enjoyable/.
3. Deliberate practice involves well-defined, specific goals and often involves improving some aspect of the target performance; it is not aimed at some vague overall improvement.
4. Deliberate practice involves immediate feedback and modification of efforts in response to that feedback.
5. Deliberate practice nearly always involves building or modifying previously acquired skills by focusing on particular aspects of those skills and working to improve some /specifically/. Because of the way the new skills are built on top of existing skills, it is important for teachers to provide beginners with the correct fundamental skills in order to minimize the chances that the student will have to relearn those fundamental skills later when at a more advanced level.
The best violinists spend 3-6 hours in deliberate practice per day. They are guided by teachers---teachers who know what the best violinists need to know, and the steps to get there.
What is deliberate practice for programmers? <comment><USER2> I don't think there is such a thing for programming because by its very nature, programming is against repetition. You'll repeat a piano concert over and over until its perfect. Even a painter will train on classical painting, trying to reproduce the skill of masters to make it their own.

Programming on the other hand relies on reuse, of your own code as well as the "master's". By the time you learn how to do something perfectly by head with no mistakes whatsoever, it means you missed an opportunity to automate something. Say your job is to create restaurant websites. if you create 10 of them from scratch (improving yourself in that skill), you're probably missing the opportunity to reuse some of your work. I think that is quite unique as far as arts / jobs go though.

<comment><AUTHOR> That's a really interesting way of looking at it, thank you!

Is there some kind of underlying base that you /can/ apply deliberate practice to?

I'm trying to think of what 10x programmers know or can do that is practicable...

<comment><USER3> Yes, this is an interesting point. I think there should be ways to do "deliberate practice" for finding better abstractions (reusable components). I would love find those methods.

</comment></comment></comment><comment><USER4> My little contribution to deliberate practice: When I write something to learn a specific function or macro in Lisp, I find several ways to program the same thing, and then compile and rank them against each other.

For example, the Fibonacci sequence or factorial using simple iteration, recursion, etc in a few different styles. Then after compiling the function, I look at speed, binary size, execution memory usage, readability of the initial code, etc.

The side effect is that I end up learning what techniques work better for a given metric, in the hopes it eventually becomes an instinct.

</comment><comment><USER5> At least one aspect that seems to fit the definition of deliberate practice that you defined is programming challenges. It's about a specific part of programming, namely algorithms, you are constantly pushing yourself based on the difficulty, and you can get feedback from other people who are doing the challenges. One good example is r/dailyprogrammer: [https://www.reddit.com/r/dailyprogrammer/](https://www.reddit.com/r/dailyprogrammer/)

<comment><AUTHOR> Or interview prep sites, like leetcode, hackerrank, etc. Or competitive programming sites, like topcoder.

Is that basically the best we can do?

The problem with those is that a lot of HN commenters believe that practicing for competitive programming (or algorithmic interview problems) has little to no relationship with actual day-to-day programming.

Personally, I think there has to be some relationship... But the HN community strongly disagrees (see any of the interview question threads)...</comment></comment>


Revolting Mind: Jonathan Swift – The Reluctant Rebel - <AUTHOR> https://literaryreview.co.uk/revolting-mind <comment><USER2> So he was cold, frugal, petulant and severe? What did they expect? A genius that was easy to get on with? Was there ever such a one?

There's such a relish nowadays for pointing out how bad people were in private who created marvellous stuff which produced and produces unlimited benefits to society.

Especially unsocial geniuses. They are described as cold or inhuman despite perhaps being _more_ human than the rest of us. After all it is only their _integrity_ that allows their inner worlds to flourish.

(I suspect that sociable people are secretly afraid of other humans. Which is why they designate a subset of other humans as 'friends' and are nice to them on condition that they are nice back. They then project their personal issues onto humans outside that set.)

<comment><USER3> >A genius that was easy to get on with? Was there ever such a one?

Yes, almost definitely. For instance, Benjamin Franklin was quite the socialite. Richard Feynman was also considered very sociable, and while many people also think he was an asshole, that may just be the effect of meeting tons and tons of people in your life.

>I suspect that sociable people are secretly afraid of other humans. Which is why they designate a subset of other humans as 'friends' and are nice to them on condition that they are nice back.

That's a really creepy thing to say. I'm not even particularly good with people, but I'm nice to my friends, family, etc because I actually like them.

<comment><USER2> Franklin and Feynman were smart but spread themselves too thinly and so didn't develop their genius, in part due to their social escapades. They didn't create as much as they should have. The test of 'getting on' with somebody would have to be something like roommates i.e. spending a significant amount of time together.

Yes it's creepy but ask yourself why. Perhaps it reveals something evil? It's not enough to like one's friends to refute this idea, which goes deep; it's about _why_ you like them. Note that a truly good person loves his enemies while the highly sociable person will toady to some of his 'friends' and exploit others.

<comment><USER3> >Franklin and Feynman were smart but spread themselves too thinly and so didn't develop their genius,

Oh, no, they're only some of the most celebrated and accomplished men in our whole culture. It's not like they did anything with their lives /s.

>Note that a truly good person loves his enemies while the highly sociable person will toady to some of his 'friends' and exploit others.

Now you sound like you're just redefining "sociable".

<comment><USER2> There's a difference between celebrity and accomplishment. I'm claiming that to an extent they squandered their gifts and could have accomplished more of depth and value. John von Neumann is another example (too social; spread too thin).

It's understood that social people are people who enjoy socialising and have lots of friends. But I would say that appearances are deceptive and they're actually not close to any of them. This isn't an accident because what they're really seeking is to allay their secret fear by gaining fame and/or power. Which is just a mistake.

It's not wrong to have friends and to like them, even if only to honour the past, or because business demands it. But progress lies in a different (inner) direction.</comment></comment></comment></comment></comment>


Boxer vs Twitter troll. Boxer wins. - <AUTHOR> http://blogs.telegraph.co.uk/news/jakewallissimons/100206764/boxer-vs-twitter-troll-boxer-wins-an-example-to-us-all/

<comment><AUTHOR> I know its the telegraph, which is a vaguely reactionary right wing UK paper, but the whole tone of the piece, which I suspect will appeal to many of its readership, misses the point of so much of the online world.

1\. The boxer was going to respond to verbal taunts with violence

2\. A really serious case of anti-semitic harrassment got treated like the boy had kicked a ball into the wrong garden

3\. trolling - all we need to do is take away anonymity and confront these people. That is not the experience of the world to date.</comment>


Dual N-Back Meta-analysis - <AUTHOR> http://www.gwern.net/DNB%20meta-analysis <comment><USER2> For those who haven't yet taken notice, Gwern's blog is a treasure trove of thorough, intelligent, compelling analysis and meta-analysis on this and many other topics. It's one of my favorite weekly reads.

It's not always the easiest reading in the world, and the formatting and structure often require a dive down a fairly deep rabbit hole of terminology, methodology, and sourcing. But it's fascinating stuff.

<comment><USER3> I was actually coming here to comment on the sheer wonderfulness of this blog. I would personally rate this as better than many psychology papers I've read, and over the course of a PhD, that's a large sample of psychology papers.

Additionally, the exposition is clear, the graphs are simple but effective, and its just wonderful in most respects.

The only (minor) criticism I would have is that I would have liked to have seen more of the input code (I didn't spot a link to it anywhere).

<comment><AUTHOR> > The only (minor) criticism I would have is that I would have liked to have > seen more of the input code (I didn't spot a link to it anywhere).

What do you mean by input code? If you mean the original R code, the entire analysis is provided in [http://www.gwern.net/DNB%20meta- analysis#source](http://www.gwern.net/DNB%20meta-analysis#source) \- when I add new studies, all I do is add an entry to the table of data, re-run the R code, and then copy-paste the relevant output. (I could probably automate it even more with Knittr but it doesn't seem worth the work of integrating Knittr with Hakyll.)

<comment><USER3> Ah, I see. I personally thought that it was LaTeX converted to HTML with Sweave et al, in which case I would have enjoyed seeing all the code. Nonetheless, thank you for the link (and some of the other articles too, which I readily enjoyed).

</comment></comment></comment></comment><comment><USER4> I know you say in the comments that this is still in progress, but it would be really helpful if you had a conclusions section that ties the results together. From your HN headline, I see that you conclude that the evidence points to DNB being ineffective for improving general intelligence, but that was not the sense I got from actually reading the analysis; rather, I had the sense that evidence supports an improvement in intelligence, but that this evidence is much weaker than it appears to be at first glance.

So it would be helpful if you had some explanation of your final conclusion.

<comment><AUTHOR> My own basic conclusion is included in the first section, the bits starting with "The confidence interval excludes zero, so one might conclude that n-back does increase IQ scores. From a Bayesian standpoint, it's worth pointing out that this is not nearly as conclusive as it seems, for two reasons:..."

As it happens, the active-control-group studies seem to be converging on zero, so I don't even have to appeal to priors. But if the result had been to find, say, d=0.4, I still wouldn't believe it: it would be more likely that the IQ tests are being corrupted, or publication bias had caused this, or fraud was involved, than we would have found a simple WM exercise which genuinely increased IQ after countless failures.

I do, of course, want to finish up the details (correct the Clouter data, and include the Seidler et al 2010 and Colom et al 2013 data) before I write up any kind of definitive conclusion & do a post-mortem of dual n-back.

</comment></comment><comment><USER5> Does DNB increase working memory? It need not increase IQ for it to be effective.

</comment><comment><USER6> Apropos of this article following Gwern's discussion of spaced repetition:

I wonder if a Dual N-Back task that was based on material-to-be-memorized, rather than just positions/letters, would have interesting effects on working or long-term memory. (You'd be stressing two related/entangled recall systems at once.)

Anyone done that test?

<comment><AUTHOR> I've never heard of that. You could probably script up something. Brain Workshop lets you specify a set of images to use, so I could imagine writing a script to extract the images of the next 30 flashcards and dump them into the folder each time you start up BW, and you would n-back with that...

I would be fascinated to hear how it went.

</comment></comment><comment><USER7> [http://brainworkshop.sourceforge.net/](http://brainworkshop.sourceforge.net/)

 _" Brain Workshop is a free open-source version of the dual n-back brain training exercise."_

</comment><comment><USER8> What exactly does "near WM" mean? Does this improve working memory on a long term basis or does near mean near in time? I feel like that might make it worth doing for me as a programmer as WM feels like a useful thing to improve even if it doesn't directly translate to IQ.

<comment><AUTHOR> There's a bunch of WM tasks floating around, all slightly different: forward digit span, backward digit span, verbal spans, complex spans using arithmetic, game-like WM tasks designed for children, suites of WM tasks like Cogmed, tests included in quantified-mind.com or Lumosity or Cambridge Brainsciences, etc. These are what I mean by n-back may 'near' transfer to other WM tasks which are not themselves n-back.

As to how valuable WM is, I'm not sure. There were a bunch of positive papers from people like Klingberg, but these tend to use subjective measures or WM- related measures, and there seems to be an absence of studies tying the WM training to concrete useful changes like improved grades or standardized exam scores.

<comment><USER9> This is completely unsupported intuition, but I won't be surprised if programming especially benefits from working memory more than other aspects of intelligence. That is, it seems possible improved working memory improves programming, without improving grades or exam scores.

<comment><AUTHOR> I think that's possible too, but I have no idea how one would study that. The empirical study of programming languages is still in its infancy - we can't even say with high confidence whether dynamic or static languages are better to work in, much less show that WM increases cause programming improvements.</comment></comment></comment></comment>


Flag – Print ads on the back of people's free photos - <AUTHOR> https://fl.ag/advertising

<comment><USER2> Great idea; it's a bit unclear to me how to become a user (rather than advertiser), there's reference to an app but I couldn't find anything. I wouldn't mind getting photos printed for free with ads on the back. Still in beta?

I'm also curious to see what the auction prices end up being - they may start at $0.01, but I doubt you'll stay in business long printing+shipping at that price.

I also wonder - if an advertiser bids for 1000 ads, are those spread among 1000 different people, or 50 people x 20 photos (or whatever)? As a user, would I upload all the photos I want printed and then sit back and wait for a bundle to come in the mail?

<comment><USER3> The service hasn't actually launched yet, per their Kickstarter updates and comments. It makes sense, you have to line up advertisers before you start letting people print, but I think that could have been made vastly more clear on the site.

</comment></comment><comment><USER4> For all those that say it's a joke, I have 169,000 reasons otherwise...

[https://www.kickstarter.com/projects/1306413684/flag-the- app...](https://www.kickstarter.com/projects/1306413684/flag-the-app-that- prints-and-mails-your-photos-for/description)

<comment><USER5> It is crazy what people will throw money at. I can see how people might try this, but can't see wanting to use it more after novelty wears off.

</comment></comment><comment><USER6> For years, I've been expecting someone to come out with free printers. Every once in a while, they print an ad. Nobody seems to have done this. Instead, there are plenty of free printer deals; all you have to pay for is the overpriced ink.

<comment><USER7> They're called fax machines. Virtually free, and everyday you'll get a couple random ads faxed to you whether you want 'em or not.

<comment><USER8> Spax?

</comment></comment></comment><comment><USER9> A fantastic idea with lots of opportunities to upsell. For consumers:

      * Pay an extra $n to receive the prints without ads.
      * Pay an extra $n to add an invitation/birthday greeting/etc. to the back of the photos.
      * Pay an extra $n to upload the mailing addresses of m contacts and we'll mail the photos to them.
      * Pay an extra $n and we'll send you a framed copy of the photo.

etc.

For advertisers, price can go up as:

      * the customer targeting gets more specific.
      * the size/quality of ad improves

etc.

Now they just need to get everybody using it...

(edit: formatting)

(edit: Killer quote about another business, Sincerely, that did something similar and then was bought by Provide Commerce: "The Sincerely suite of applications was approaching 3.5 million registered users at the time of the acquisition, and had seen 6.5 million app downloads. It had also shipped products to over 1% of American households (1.5 million unique households. [http://techcrunch.com/2013/11/07/provide-commerce- acquires-m...](http://techcrunch.com/2013/11/07/provide-commerce-acquires- mobile-gifting-startup-sincerely-will-expand-into-new-categories-apps- in-2014/) My point is that there is a market there.)

</comment><comment><USER10> This has to be a joke. You cannot tell me a single person is actually interested in allowing a business to print their advertising on their keep- for-life pictures. If I opened my photo album from my childhood and found advertising on the back of each photo... what a joke.

Photo printing is already cheap. If you can't afford to print photos, you probably also can't afford to buy the camera or the memory card (or the film and development for you old-schoolers).

This is a sad world we live in. Advertising in every place imaginable. You want to know where I'd be okay with your visual spam? On toilet paper. Print your advertising on my free toilet paper so I can wipe my ass with it.

</comment><comment><USER11> I can't believe this insane idea has made Hacker News most popular. I heard the pitch in person a couple months ago and thought they were fantasizing.

So now it's trending. Either I'm the stupid one, or the upvoters are. Most probably it's me. LOL.

Good for the founders.

<comment><USER12> Care to elaborate what is stupid about it?

<comment><USER13> The idea relies on magazine like ad rates. Yet these ads have neither the tracking appeal of online ads nor the demographic targeting of print ads.

The hard part of this entire business model is getting advertisers, yet they've left that as the last step to test.

<comment><USER14> Pictures don't lack demographic targeting. You can make a lot of demographic assumptions from the content inside of a picture.

Example: facial recognition says that this blob with eyes in the photo is a child. Flag may have signed up Babies R Us as an advertiser. Based on the notion that it's a baby on the front of the photo the back as should be for formula, college funds, or diapers.

The tricky part is building up the tooling to automate that process. But hey, most of that exists in the wild already.

</comment></comment></comment></comment><comment><USER7> "Unfortunately printing is so expensive, complicated and time consuming most of us can't be bothered to do it even though we know we should."

Not sure about anywhere else on the planet, but prints are pretty cheap at my local 1 hour photo place.

</comment><comment><USER15> It's either a joke or a joke, made me laugh though :)

</comment><comment><USER16> I'm disappointed the Sandwich Video isn't there. It's a much better quick introduction.

You can see it on the Kickstarter page: [https://www.kickstarter.com/projects/1306413684/flag-the- app...](https://www.kickstarter.com/projects/1306413684/flag-the-app-that- prints-and-mails-your-photos-for)

(I'm not affiliated with fl.ag at all.)

</comment><comment><USER17> "On July 1st 1885, the day the service was introduced, sending a first-class letter cost 2¢. 129 years later Flag can print and deliver your ads by first class mail, for just 1¢. That's progress."

Progress in what? Advertising or postal delivery?

</comment><comment><USER18> Total vaporware.. consumers vastly overestimate the value of their own attention and assume it can fund expensive things like this. If it can be ad supported why do you need to pay $10 for the "app" via kickstarter?

</comment><comment><USER19> Will the users ability to print be limited by the demand for advertising? In other words, can I print 1,000 photos as an individual? If you can only fill 100 of those ad slots, do I pay for the rest out of pocket?

<comment><USER20> Per their Kickstarter it says "Select 20 photos" so I guess there will be some sort of limit

[https://www.kickstarter.com/projects/1306413684/flag-the- app...](https://www.kickstarter.com/projects/1306413684/flag-the-app-that- prints-and-mails-your-photos-for/description)

</comment></comment><comment><USER21> I don't really see a difference between this and [http://www.freeprintsapp.co.uk/](http://www.freeprintsapp.co.uk/) (which is ad free)

</comment><comment><USER22> A user can stick the picture on a wall or on a scrapebook or even add it to his album and never look at the advertisement ever.

</comment><comment><USER23> Is this a joke?

</comment><comment><USER24> Hi all.

I'm the founder of Flag - Samuel Agboola.

There are tons of questions here. I'll do my best to provide some answers.

1\. No - Flag is not a joke.

2\. The visibility of the ad should be compared to a web ad or a piece of junk mail. There's metadata on the back of each print. A caption you write, a secondary photo and some Exif data. That's a reason to look at the back of each photo. I have hundreds of photos taken by my parents during my childhood which I know nothing about. Where were we? When was it? Who's in this photo? Flag wants to make archiving images robust and simple. You'll be able to look at your prints in a few decades and know something about them.

We also make it simple to send your free prints to family and friends. That information allows you to explain each image to the person you're sharing it with.

If you look at the metadata once it's already once more than you view the majority of junk mail. If it's a picture you cherish and show to a friend when they see the ad beside your caption we've already out-performed junk mail by 100%. The most effective pieces of print advertising, catalogues, last in people's homes a year at best. People keep photos forever.

3\. You get a pack of 20 photos per month free with ads. More than 20 prints in a month and you pay for them. This is both for reasons of cost but also for convenience. Most people would be daunted by having to find 100 photos to print. 20 keeps it simple and means advertisers know the prints people order are things they actually care about. If we printed an unlimited number of images free many people would simply dump their entire photo archive to paper but never look at the prints, or ads, when they received them.

4\. Freeprintsapp.co.uk has never shipped a free print "Postage and packing starts at £1.49, never more than £3.99!". Flag ships for free. No credit card, no subscription, no shipping or handling.

5\. The Sandwich video is pretty awesome. So awesome in fact it's something we should probably update...

6\. The reason for the Kickstarter was to fund development and to prove to advertisers there's a demand for a free print product. Surprisingly you can't just say "Of course people want free stuff" and expect advertisers and investors to take your word for it. People paying for early access and special service from a free product was fantastic proof of the concept.

7\. Beyond being free Flag's prints are laser-cut. That means we can deliver WYSIWYG prints for the first time at no additional charge. Print an iPhone photo with any other company–including Apple–and you have to crop it to 3:2, 5:7, 5:4 or 1:1. Flag can deliver 4:3 prints, 1:1, 16:9 and any other aspect ratio in one pack with no additional fee. On top of that we can offer border treatments and finishes which simply aren't available. We provide the same flexibility for finishing that other apps offer for image manipulation.

8\. I'm not sure who "joedevon" is although I do remember one rough conversation which could qualify for this "pitch".

There's nothing vague about our numbers but some people with little established interest want to have complete and detailed conversations without an NDA. We've spoken to many people outside an NDA but a decision always has to be made about seriousness of intent. All the advantage lies with the person receiving information and it's entirely possible they want details to share with our competitors or to enable them to do something other than help us.

We know how we scale and we know our product cost to fractions of a penny. Unlike many startups we deal in paper and postage. Out fixed costs per customer are higher than Instagram or Facebook. That said our revenue per customer blows them away too.

If joedevon wants to discuss things again I'd welcome a chance to correct the record.

9\. We're not reliant on ads. We will also make revenue for regular print services. The ad-free prints will be sold. Ad supported prints are something entirely new and for the first time will be truly free.

10\. The ads on our prints are optional. If you want to pay for your prints and have them ad free you can. Flag's prints are better than anything currently in the market at any price. We use better printing technology which offers more dynamic range and color depth than silver-halide lab prints. We can print any aspect ratio or shape and deliver those prints in a single package (normally printing squares means ordering a complete pack of square prints, with Flag you can order a single square print, three panoramas and a round one for no additional charge). We're using the best German photo paper and using Korean UV laminates which give our prints much longer life than the 15-19 years of traditional prints.

11\. The difference between cheap and free is effectively infinite.

12\. Describing the ad purchase system is a challenge we're still working on. It's not that complicated but we've as yet failed at expressing it as simply as we need to.

The ad prices at auction will vary. Depending on whom you want to target they could stay low or rise significantly. The average cost per bid for Google Adwords is now $1.50. Flag works very well and generates significant profit at less than half of that.

Unlike web advertising properties Flag has genuinely limited inventory. Google can always put up another page. We can only deliver as many ads as we do prints. Buying 1,000 ads means reaching 1,000 people unless you were to specify otherwise. We wouldn't send duplicate ads to a single person, it serves little purpose.

The app is launching very soon as an alpha (feature incomplete and running on 80% of our final infrastructure).

Thanks for the kind and insightful comments. Feel free to email me for more information. firstname.lastname@example.com

Respectfully,

Sam.</comment>


Nerdiness turns women off from Computer Science - <AUTHOR> http://news.discovery.com/human/nerds-women-computer-science.html

<comment><USER2> Bring on the computer science barbie (barf)

I'd be more interested to see how cultural encouragement of women to be anti- intellectual is tied to their disinterest in computer science. Not to mention that this stereotypical work environment description is NOT what I've encountered (for the most part) as a woman who is surrounded by "nerds" all the time (married to one, startup employee)

</comment><comment><AUTHOR> I don't know.. Maybe we should just bioengineer more nerdy women :-/ Evolution seems to be taking a long time</comment>


Ask HN: What is your preferred IDE apart from Atom and VSCode? - <AUTHOR> I am looking for an alternative IDE, having been using Atom for a while now and had been a Jetbrains customer for few years. Time to switch IDE again and would like to know which is your favorite open source IDE ? <comment><USER2> I know you're looking for open source in particular but I'm a PyCharm convert from Atom / Nuclide / Atom IDE and couldn't be happier. Atom didn't come close in terms of functionality, even with a million plugins. There was also a lot more fiddling to get it to work the way I wanted whereas PyCharm generally just does the right thing (though it's very customizable).

</comment><comment><USER3> Emacs.

Keybinders dream. Custom functions easy to whip up and assign to a key. It has a few arcane keybind ideas like hydra, that aren't even on the radar of other IDEs. The hydra takes vim, spanks it, and sends it to bed.

The place Emacs traditionally falls short as an IDE is intelligent code completion. But with LSP this will get better.

</comment><comment><USER4> My preferred IDE is IntelliJ IDEA. For less complex tasks or projects I also use Sublime Text.

</comment><comment><USER5> Jetbrains IDEs are all fantastic. I've considered switching to VS Code because I like its declarative configuration, but I'm too used to Jetbrains products to switch right now. Plus their database browser is excellent.

VS Code is _very_ different from Atom, though, so I wouldn't lump them together.

Edit: sorry, I missed the open-source requirement. But I stand by my recommendations. There just aren't that many great IDEs out there.

<comment><USER6> > VS Code is very different from Atom, though, so I wouldn't lump them > together.

Indeed. Atom is very much a stripped down, get-a-plugin-if-you-want-more kind of editor whereas VS Code has a ton of functionality built in.

</comment></comment><comment><USER7> it depends on which platform and language you develop, but for a java IDE, IntelliJ fly circles around Eclipse or Netbeans, in matters of performance and usability. Even the dumbed down IntelliJ-CE is a better alternative, until you stumble on the lack of Spring integrations. ( _IntelliJ IDEA Community Edition is the open source version of IntelliJ IDEA_ from [http://www.jetbrains.org/pages/viewpage.action?pageId=983211](http://www.jetbrains.org/pages/viewpage.action?pageId=983211) )

for everything else, Emacs ( spacemacs ) will suffice.

( if the open source requirement is removed, i used visual slickedit for many years, for many projects, before IntelliJ ).

</comment><comment><USER8> Visial Studio

</comment><comment><USER9> What language/stack/field are you in?

Any particular reason you prefer open source (considering Jetbrains' tools aren't)?

What's your preferred platform?

</comment><comment><USER6> Eclipse, but I'm only recommending that because you didn't give any indication of what language/stack you use. :-)</comment>


Show HN: IPFS-Deploy – Zero-Config CLI to Deploy Static Websites to IPFS - <AUTHOR> https://github.com/agentofuser/ipfs-deploy <comment><AUTHOR> Hi! Author here. This is my first npm package, so I'd love to hear feedback on how I can improve it, what tools I can use for that, etc. Thank you for checking it out :)

<comment><USER2> Is it possible to update a website hosted on IPFS and push those changes to all IPFS users?

The equivalent on AWS Cloudfront would be breaking the cache, so all users would see the most recent version.

I'm not sure if this would work on IPFS because it seems more like a P2P network and there might be many different (and old) versions of the site at different locations in the system, with no way of controlling who sees what.

<comment><USER3> Not an expert, but:

IPFS is p2p, but all the content is accessed only by a hash, so the same address always refers to the same version; when you update the site, you're actually creating a new address, leaving the old untouched.

Using Cloudflare, you can tie a regular domain to one of these addresses, but that "tie" is only stored there, so when you push a new version, you can update the Cloudflare settings, and everyone connecting to the domain will see the new version "immediately", even if the old version still exists in the p2p network.

<comment><USER4> ipfs has its own mutable content adressing named IPNS

</comment></comment></comment></comment><comment> dane-pgp Does it make sense to add support for Signed HTTP Exchanges (SXG) to this?

[https://github.com/ipfs/in-web- browsers/issues/121](https://github.com/ipfs/in-web-browsers/issues/121)

<comment><AUTHOR> Good idea! I've been following Web Packaging from a distance, so would need to do some research, but from the looks of it, ipfs-deploy could automate packaging up a directory into an SXG before uploading it to pinners. Gotta figure out how to the signing part though. I'll look into it!

</comment></comment><comment><USER5> Great job, simple and easy, as a tool should be. I'm definitely gonna use it.

<comment><AUTHOR> Thank you! It makes me very happy to hear that. Feel free to ping me if you run into any trouble (even if it's just a non-showstopper like some unnecessary friction or papercut.) Also keen on hearing what services I should add next. I don't use AWS Route 53 but I think it would be a good option to support for instance.

<comment><USER5> We're working on a small browser extension for static ipfs websites where this comes in handy. I'll ping to let you know how it goes.

</comment></comment></comment><comment><USER6> With IPFS what are the costs to keep your site live?

<comment><USER7> It is like torrent, so you need to have a seeder node all the time - it is called "pinning" in IPFS.

There is a number of services, the price seems to be around $0.3/(gb*month)

<comment><USER8> How does that compare with AWS? Is IPFS worth using for a CDN? _(apologies for the acronyms...)_

<comment><AUTHOR> If you pin to IPFS and then use a public http gateway like [https://cloudflare-ipfs.com](https://cloudflare-ipfs.com), which caches and distributes via their CDN, you'll have a good CDN alternative.

If you just use IPFS directly with a non-CDN'd, non-cached http gateway, the latency will probably be prohibitive for regular web stuff.

<comment><USER8> But isn't it like a torrent? where if more people are viewing the item, it can be served faster from more places, like torrent seeders?

<comment><AUTHOR> Yes, definitely. I mean, you certainly get better bandwidth and latency depending on popularity and geographic diversity of seeders, and there are even youtube-alternative websites that host videos on IPFS. But for something like browsing from one page to the next, where the payload is small and you want <200ms latency, I think just the DHT lookup might already put you above that budget. I'm guessing though, haven't made any measurements.

<comment><USER9> Who gets <200ms latency anymore when Google analytics and FB pixel tracking scripts take more than that each and most websites have them?

<comment><USER3> Those scripts are loaded asynchronously; you can start seeing content before they are ready.</comment></comment></comment></comment></comment></comment></comment></comment>


Mars Ice Deposit Holds as Much Water as Lake Superior - <AUTHOR> http://www.jpl.nasa.gov/news/news.php?feature=6680 <comment><USER2> Lake Superior has enough water to flood all of North and South America to almost one foot.

<comment><USER3> Was intrigued by this comment so I looked it up.

North and South America have a surface area of about 42.55 million sq km or 4.58x10^14 sq ft (1 foot deep water is obviously 4.58x10^14 cubic feet).

Lake Superior has a volume of 12,100 cubic km or 4.2x10^14 cubic feet.

That's unbelievable!

<comment><USER4> now do the calculations on lake baikal.

<comment><USER5> What about Guarani Aquifer?

<comment><USER6> A little over 3 feet.

[http://www.wolframalpha.com/input/?i=(40,000+cubic+kilometre...](http://www.wolframalpha.com/input/?i=\(40,000+cubic+kilometres+%2F+42.55+million+sq+km\)+in+feet)

To skip ahead, the Great Artesian Basin, the largest artesian basin in the world, would be just over 5 feet.

[http://www.wolframalpha.com/input/?i=(64,900+cubic+kilometre...](http://www.wolframalpha.com/input/?i=\(64,900+cubic+kilometres+%2F+\(area+of+north+america+%2B+area+of+south+america\)\)+in+feet)

[https://en.wikipedia.org/wiki/Great_Artesian_Basin](https://en.wikipedia.org/wiki/Great_Artesian_Basin)

<comment><USER7> How much fracking liquid could we pump in there and remain profitable?

<comment><USER6> You're pumping in what's (loosely) soapy water to extract water. And in places where there's mostly positive pressure anyway.

None?

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Water behaves very strangely on Mars. [http://www2.cnrs.fr/en/2753.htm](http://www2.cnrs.fr/en/2753.htm) \-- Note the videos.

</comment><comment><USER9> Interesting that this is in the "Utopia Planitia." That is starting to look like a probable location to set up a colony.

</comment><comment><USER10> Mars is still less habitable than the Earth would be post nuclear war.

</comment><comment><USER11> If we could just pack up some of this extra CO2 & get it over there, maybe we'd have a new planet! I wonder how many PPM you'd need?

<comment><USER12> Yeah, but how are we going to reheat and spin up the core?

<comment><USER13> Why do we need that?

<comment><USER14> Because a magnetic shield will prevent the solar winds from wiping your atmosphere.

Without a spinning core, Earth would be like Mars.

Of course you can live in caves instead of trying to terraform Mars, but doesn't sound so fun.

<comment><USER15> If we had the ability to terraform Mars wouldn't we just terraform Earth?

<comment><USER16> ...because we don't need to? Earth is already full of plant life. Mars isn't.

Sorry for the overly blunt answer, because I know this isn't the question you're asking, but IMHO the question you're asking is based on a ridiculous premise.

We are polluting the Earth. Yeah, this is really bad for the Earth, and for us, but it isn't going to kill all life here. The thing that a "backup planet" is here to protect against is something like being struck by a meteor, or a plague, or nuclear war. Something where _everybody_ dies very quickly, not something where life changes radically.

</comment></comment></comment></comment></comment></comment><comment><USER17> Good spot to land the Spacex's ITV.

</comment><comment><USER18> There are places on Mars where water ice is available year-round, and carbon dioxide ice seasonally, at high latitudes. Therefore, I'd say this discovery, at low latitudes, has few implications for colonization unless there's a fair bit of carbon dioxide ice mixed in. So I'm waiting for word on that before getting too excited.

</comment><comment><USER19> The entire core of Mars is made out of ice. The reactor melts it, and it makes air.

<comment><USER20> Why this excellent movie reference is down voted, I know not.

<comment><USER21> God, I hope one day the act of regurgitating the script from a vaguely relevant, fictional work is no longer celebrated.

<comment><USER22> Total Recall kicks ass

</comment></comment></comment></comment><comment><USER23> King of Mars. Called it.

</comment><comment><USER24> Or mud, as this stuff otherwise known.

<comment><USER25> Given the temperature and pressure of Mars' atmosphere, "permafrost" might be a better comparison.

<comment><USER26> There is a sentence that seems to imply that the frozen status implies there is no life. I'm not so sure we can be sure of that. There are microbes on Earth that basically live in virtually frozen environments. (All you need are moments when the water is liquid.)

<comment><USER27> _All you need are moments when the water is liquid._

But you don't get those at such low atmospheric pressure. Mars atmospheric pressure is around 600pa. Below 611pa, the boiling point of water drops to the freezing point; you can have ice or steam, but not liquid water.

<comment><USER26> _But you don 't get those at such low atmospheric pressure. Mars atmospheric pressure is around 600pa._

A mental exercise: Any place on Mars with higher than 600pa pressure?

<comment><USER28> [https://en.wikipedia.org/wiki/Hellas_Planitia](https://en.wikipedia.org/wiki/Hellas_Planitia)

<comment><USER26> How about underground? How about the bottom of a glacier? No need to be "surfacist." ;)

<comment><USER28> An unsealed hole underground would have to be dug to the same depths as that crater. If you're pressurizing it, you'll probably target 1 bar to live in it, instead of 600 KPa.

A glacier that has the pressure to melt ice, would have more than enough pressure to keep it from sublimating. A rough estimate says that a foot or so of ice could provide over 600KPa of pressure, but that doesn't account for any means of keeping the water liquid or the ice solid. However, I wouldn't expect to actually find that on Mars. You might be able to keep water that way for a while until it froze again.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Which is about a millionth of the total water on Earth.

<comment><USER30> This should be enough for a colony though. With a recycling program it would probably last indefinitely. Much better than bringing the water from Earth.

<comment><USER31> Just bring the right kind of people and God will flood it.

<comment><USER30> You actually made me laugh. I immediately thought of Trump. With global warming and his disbelief in it I think we are heading unto our own flood.</comment></comment></comment></comment>


Ask HN: How to Maintain Motivation? - <AUTHOR> I am working on a side project in my free time after work that I hope to turn into a business. I have noticed that my motivation to work on this project is cyclical with bouts and weeks of energy and steadily making progress, but also (as I am experiencing right now) a big lack in the willingness to "do stuff" during the troughs.
I have a list of things I know I need to do before launch, so it's not like I'm lacking inspiration, but when I go home I sorta just fallback on doing nothing and wasting time.
Are there any particular strategies to combat this lethargicness? <comment><USER2> Seek medication from a medical pro, Wellbutrin is helping me out, but I wanted Adderall. I actually told my prescriber pretty much what you say in your post. I'm trying to generate a business idea, probably web involved. What is your business idea your growing? patchkientz@gmail if you need to PM.

</comment><comment><USER3> Similar to "Ask HN: How do you stay disciplined in the long run?" 173 comments from last month [https://news.ycombinator.com/item?id=19777976](https://news.ycombinator.com/item?id=19777976)</comment>


Calculate calories with Wolfram Alpha - <AUTHOR> http://belifesavvy.com/2009/07/27/calculate-calories-with-wolfram-alpha/ <comment><USER2> This appears to be ongoing improvement; Wolfram Alpha was very poor on nutrition information at introduction, but seems much better now (although still with a long ways to go).</comment>


To Hell with Backups - <AUTHOR> http://ksp_me.svbtle.com/to-hell-with-backups

<comment><USER2> Again and again he tried after the tempting morsel, but at last had to give it up, and walked away with his nose in the air, saying: "I am sure they are sour."

</comment><comment><USER3> I have a hard time believing the magnet story, but that is tangential to the story.

I've used SugarSync for a couple years, and Mozy before that. I literally never think about my backups, except when I get a new computer and download from the cloud. Total cost: under $80/year.

I'm not sure what's so hard about that, but apparently backups need to be "easier".</comment>


Show HN: Quill - Interactive Writing Activities - <AUTHOR> http://www.quill.org

<comment><USER2> I'm curious about the unusual in-sentence double-spaces in the example paragraph. Is there a technical reason for them?

EDIT:

I see now that they are not double-spaces, but that I was being confused by the editing unit of a word and its following space. I'm impressed with how well the tool localizes where a change has been made, but I wish more common editing facilities --- especially navigation across word boundaries with the arrow keys --- could have been preserved.

<comment><AUTHOR> Hi Jason,

Thanks for this feedback! We are an open source community, and this sounds like a great project for a hacker to pick up. I'm making a GitHub issue for it now. Thanks!

</comment></comment><comment><USER3> On Opera (23.0.1522.43) there is a rather painful redirect loop rending the site entirely unusable.

Technical issues aside, this is really well done.

<comment><USER4> Same thing on Chrome 35.0.1916.153 on Windows 8.1. Shame, it looks really interesting but that totally put me off.

</comment></comment><comment><USER5> This looks great. I was definitely engaged by the home page and found it fun to read -- maybe a number-of-edits tracker on the side so you don't have to keep re-counting how many errors you've corrected?</comment>


List of the top smart contract vulnerabilities - <AUTHOR> Https://dasp.co <comment><USER2> I'll never forget this pull request. Just having these two `internal` keywords there would have saved $150 million dollars.

[https://github.com/paritytech/parity/pull/6102/files#diff-8e...](https://github.com/paritytech/parity/pull/6102/files#diff-8ea4aa7c2ba715c683bc764337f51585)

A lot of people think "smart contracts" are inherently insecure. I personally believe that most of the "hacks" were very preventable, if those who had written the code slowed down to think about what they were doing.

<comment><USER3> This reminds me of 'Poya-Yoke', which is (as I understand it) about making accidents less likely by design. Functions should be carefully chosen to be externally visible, so why not make internal the default. When designing contracts, the language should be making every possible effort to be safe by design.

<comment><USER4> Related to this is the maxim to "make it easy to do the right thing, and difficult to do the wrong thing".

When applied to programming, a first step towards that could be as simple as using a safer language, where it's more difficult to shoot oneself in the foot, and where all sorts of errors are prevented by default.

</comment></comment></comment><comment><USER5> The new version of securify, which will soon be available at [https://securify.ch](https://securify.ch), catches 7 our of the 9 mentioned issues automatically and is free.

I am one of the tool's authors. We went on to found ChainSecurity ([https://chainsecurity.com](https://chainsecurity.com)) in order to deepen our research and understanding of smart contract security. Feel free to ask any questions about securify or ChainSecurity.

<comment><USER6> Do you have any views on Solidity as a contract language and how suitable it is for being formally verified? Does it make any properties you want to check difficult or impossible to verify?

My experience with formal verification is that the further a language is away from being a pure functional language with easy to check termination, the more difficult you make life for yourself. You really want a smart contract language that was specifically created to be easy to formally verify rather than trying to tack on formal verification later.

<comment><USER7> Note that tools like Securify work directly on the EVM, and are therefore agnostic to the high-level language the contract is written in. The EVM itself is not as amenable to formal analysis (no types, explicit function calls, etc.).

</comment></comment></comment><comment><USER8> Please correct me if I'm wrong, but isn't it the nature of a turing machine (decentralized or not) to produce an endless series of "unforeseen" exploits?

<comment><USER9> Yes, but even if your language is total you have an analogue of the halting problem, where instead of analysis being undecidable it just takes an unrealistic amount of effort.

<comment><USER8> My understanding is more hand-wavy than formal, but would the combination of a total language and some limitation on the total number of instructions produce a provably predictable language?

<comment><USER10> Likely not. It takes only a very small number of instructions to implement an interpreter for a Turning-complete language, and then you can create arbitrary behavior by passing different input. The number of necessary instructions is shockingly small, if using something like Binary Lambda Calculus or Subtract- And-Branch-If-Negative.

</comment></comment></comment></comment><comment><USER6> What ever happened with the frozen funds caused by the Parity multi-sig wallet bug? Is there a plan to unfreeze them somehow?

<comment><USER2> Original recovery proposal: [https://github.com/Musiconomi/EIPs/blob/78abec4751c877e7a12a...](https://github.com/Musiconomi/EIPs/blob/78abec4751c877e7a12a879787b2576cf5349b2b/EIPS/eip-867.md)

<comment><USER6> What progress is being made though? This was a huge amount of money that was frozen. I would have thought something would have been done by now.

<comment><USER11> At the moment there are no plans. There were some attempts to design an "upgrade" that would make the funds recoverable while benefiting the platform, but they had dangerous side effects. A lot of people opposed a targeted recovery fork, for reasons including:

\- It's not such a large amount that it's a systemic risk.

\- The hack was arguably enabled by negligence; the contract was changed after its last security audit, hacked, changed again and still didn't get a new security audit, and only after that the funds were frozen. Strong incentives to be more careful are probably good. Forking every time somebody's negligent could get messy.

\- The DAO hack involve an attack that was new to most people in the community, and even the tutorial code on ethereum.org was vulnerable to similar hacks. These hacks were more in the nature of simple oversights, enabled by overly complicated code. Good auditors would probably have found them.

\- The largest loss of funds was to the entity that made the contract (or a related entity anyway). That entity also said they had plenty of other money for their project.

\- Most of the remaining losses were to ICOs, who should have gotten competent advice to avoid this contract (given the first hack and lack of audit), and who've demonstrated fundraising ability so could conceivably get bailed out by their own investors.

\- Despite heavy criticism from certain quarters about Ethereum's supposed lack of immutability (after the DAO hack), immutability actually is a strong community value. Some people supported the DAO fix on the grounds that it was early days, but feel that the network is more mature now.

</comment></comment></comment></comment><comment><USER12> I heard someone say that smart contracts don't eliminate the need for a trusted party, they just make that trusted party a program, since most people don't fully understand what these contracts are saying. At least when you get a lawyer to write-up a contract the lawyer is usually familiar with the law, and how similar contracts are interpreted by the court system.

</comment><comment><USER13> The timeline for the first one is just sad.

</comment><comment><USER14> 1\. front running has nothing to do with TOCTOU/race conditions. the real race condition example would be reentry attack actually.

2\. #9 has nothing to do with "off-chain issues". Off chain has very clear context and refers to layer 2 solutions for scaling. No need to call a website bug "off chain issue".</comment>


Learn to Code: It's a LOT Harder Than You Think - <AUTHOR> http://blog.debugme.eu/learn-to-code/ <comment><USER2> This is a fascinating article for me. I was a self-taught web developer, but I had studied engineering (not software/computer) in my undergrad so I was very fluent in algebra - which seems to be what programming is mostly about. I struggled to convince anyone that I was qualified, eventually got a crappy job at a fairly high-traffic website and bootstrapped my way up from there. However, along the way I met several programmers, some in high managerial positions, who actually sucked at programming. They could regurgitate bits of code and patterns if they had to, but as far as solving novel problems or teaching themselves new frameworks etc. they were totally lost.

One thing I noticed in undergrad is that it was hard to tell if some people just couldn't "do math" or if they weren't trying hard enough. No one understands complex math concepts the first time they see them and I certainly had to grind really hard in some classes to learn the concepts. But maybe they would have to grind 100X harder than me to learn them? Who knows. I like to think anyone can learn math if they work hard enough but I'm optimistic.

<comment><USER3> I think most people could probably perform math to a degree that is necessary to be a programmer or any other "close-to-math" profession at a sufficient level to remain employed using widely available tools. I doubt that all people can synthesize University math even if they spent an unlimited amount of time studying.

</comment></comment><comment><USER4> Well, what is "learning to code"? I'd say you start to learn how to code once you actually start to apply some of the theoretical classroom knowledge obtained.

I think "learning to code" is marketed as going to some intro course website, learning the basics of some language and boom, now you can code. If you don't apply this to a real world application or hobby project, you never really get to wrap your head around the problem solving and debugging that start to occur when you are on your own, which I find crucial once you are thrown to the lions.

If I didn't have the classroom theory, I would have been thrown out of every interview I can recall. And sure, from time to time I've had to pretend to know some terminology whilst secretly studying up on it right after, but having the foundation taught by professors have surely been a building block in "learning to code".

</comment><comment><USER5> I find the difference between "self-taught" and not almost laughable. Even if you have a post graduate degree in computer science to stay current and succeed in the field you will have to be particularly good at self teaching concepts, tools, frameworks, and everything revolves around being able to learn things on your own. Sure being taught more traditionally is very helpful for understanding underlying and foundational concepts but just saying someone is or is not self taught because they have a degree seems to not make a lot of sense. This probably relates back to why even a large part of those in degree programs struggle in the field if they don't have the self-teaching ability then even after earning a degree they won't succeed.</comment>


Long term future still bright for online advertising - <AUTHOR> http://lsvp.wordpress.com/2009/03/08/long-term-future-still-bright-for-online-advertising/ <comment><USER2> From the article:

"online advertising share of all advertising could reach as high as 23% if a scalable advertising solution for social media could be found."

Adpinion.com (y-combinator startup) may have an answer for that. Among other things, they're trying to optimize ad-campaigns based on in-ad user feedback.

Great idea, but is it possible that some "effective" ads might result in a knee-jerk reaction to click a down-mod button?

E.G. the picture of the frightened pointing guy on a certain colorful candy homepage:)</comment>


The Log: Real-time data's unifying abstraction (2013) - <AUTHOR> https://engineering.linkedin.com/distributed-systems/log-what-every-software-engineer-should-know-about-real-time-datas-unifying <comment><USER2> hands down one of the best software engineering articles I've read in a long time.</comment>


OCaml Briefly - <AUTHOR> http://mads379.github.io/ocaml/2014/11/13/ocaml-briefly.html <comment><USER2> After seeing that Facebook's Flow tool was written with an OCaml parser, I was quite impressed by the beauty of its syntax. It makes functional programming feel much less intimidating, compared to Haskell or a Lisp in my opinion, and I can see the parallels to F#. Thanks for sharing this introduction, it was very apropos for me!

<comment> pseudonom- Care to elaborate on what you like about its syntax? I can imagine preferring it to Haskell or Lisp, but not thinking it's beautiful.

<comment><USER2> Looking at a random file in the Flow source [0]

          (* The entry point *)
          let rec go content =
            let env = { file = None; modified = []; line = 0; result = [] } in
            let lines = split_lines content in
            start env lines;
            match List.rev env.result with
            | [] -> []
            | _ :: results -> results

          (* Skip the text before the first +++ (to make things work with git show) *)
          and start env = function
            | [] -> ()
            | line :: lines
              when String.length line > 4 && String.sub line 0 3 = "+++" ->
                header env line;
                modified env 0 lines
            | _ :: lines -> start env lines

Its beautiful to me because its very concise looking, while still using a fair bit of real English, meaningful symbols, and idioms like [] makes an empty array or whatever. I have to admit, much of this is lost on me, but it does feel more accessible than other FP languages. It almost has a Python feel.

[0] [https://github.com/facebook/flow/blob/master/hack/parsing/fo...](https://github.com/facebook/flow/blob/master/hack/parsing/format_diff.ml#L67-L83)

<comment><USER3> I'm not sure it is that concise. Just look at the code that you've given. _What is it actually doing?_ How much of it is the juicy part and how much is the language clutter? To me, it feels like in terms of the actual functionality this code does not do that much. Skips the text before first "+++". In more concise languages that whole piece would look like a single line:

        env.lines = [line for line in env.lines if not line.startswith("+++")]

And just look at this:

        when String.length line > 4 && String.sub line 0 3 = "+++"

Really? Specifying numbers like that in the code? And are we really going to alloc an object here? Wow. Wouldn't anyone prefer to use something like:

        line.startswith("+++") ?

_edit_ : my code doesn't implement the exact same functionality. I've only attempted to give a feel/look of the code, not rewrite it. it looks like the original code returns the lines after the '+++' lines, but I can not tell for sure, as the header/modified function implementations are not given.

<comment><USER4> I'm pretty sure the Ocaml code is doing more than the Python code you posted. Hopefully someone who knows Ocaml can explain it to us and then we can write the actual python equivalent.

<comment><USER5> Well, for starters,

        start env = function
          | [] -> ()
          | line :: lines
            when String.length line > 4 && String.sub line 0 3 = "+++" ->
              header env line;
              modified env 0 lines
          | _ :: lines -> start env lines

is a bit elitist way to write a 2 argument function as a combination of 1 argument function and a lambda function. So let me rewrite:

        start (env) (list) = match list with
          | [] -> ()
          | line :: lines
              when String.length line > 4 && String.sub line 0 3 = "+++" ->
              header env line;
              modified env 0 lines
          | _ :: lines -> start env lines

So the function `start` takes some kind of state `env` as a first argument, and then it takes a list as a second argument, here named `list`.

If the list is empty, [], it does nothing.

If the first list element, which is a string, starts with "+++", it calls two other functions: first header(env,line) where `line` is now the first list element, and then modified(env,0,lines) where `lines` is the rest of the list, not containing the first element.

If the first list element does not start with +++, it recurses to the rest of the list.

So this is not a filter: After first encounter of "+++" it calls those two other functions and stops.

<comment><USER6> Sounds a bit silly to write something like that by hand, when you could use BatList.drop_while (from batteries) like so:

        let line_is_not_header line =
            String.length line < 4 || String.sub line 0 3 != "+++"
        match (BatList.drop_while line_is_not_header lines) with
        | header_line :: following_lines ->
            header env header_line;
            modified env 0 following_lines
        | _ -> ()

In practice, I find that it's rarely useful to write recursive functions by hand, unless you're willing to limit yourself to the default stdlib.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Having a quick look at ocaml again, I find I'm hoping someone will take the time to write a "How I start"-article[1] for it, detailing things like installing (something like wget raw.githug...opam_installer.sh && ./opam_installer.sh bin - that gets you the latest opam locally), setting up janestreet core and utop, and finally bootstrapping some kind of not-entirely- trivial hello-world app and/or library for use with "opam install ...".

I did for instance find a couple of interesting (to me) libraries: [https://github.com/esperco/ocaml-imap](https://github.com/esperco/ocaml-imap) and [https://github.com/nojb/ocaml-maildir](https://github.com/nojb/ocaml- maildir) . But only the first can i "opam install" \-- as a newcomer to ocaml (or returnee of sorts) -- I my intuition tells me that being able to set up a chroot/image with just stuff via opam would _probably_ be what I want.

But that's exactly why it'd be nice if someone that actually does this (and uses ocaml in anger) wrote up a proper "How I start"-article.

[1] [https://howistart.org/](https://howistart.org/)

</comment><comment><USER4> How does Ocaml do on having predictable memory usage? This is still a weak spot in Haskell, though I absolutely love the language and it hasn't mattered yet for my use cases.

Doesn't it hurt having a GIL?

How awesome is having the ML module system?

<comment><USER8> OCaml has an extremely predictable memory usage. Part III of Real World OCaml covers this is great detail[1]

GC pauses haven't hurt us really. We usually just spawn a ton of processes so if one process pauses a bit to GC we won't notice.

The module system is awesome. It's something i plan to cover next time I find the time to extend the article.

[1] [https://realworldocaml.org/v1/en/html/pt03.html](https://realworldocaml.org/v1/en/html/pt03.html)

</comment></comment><comment><USER9> This was written by an issuu engineer. Does anyone know if issuu uses OCaml?

<comment><USER8> Yeah, most of the services that I work on in my team at issuu are written in OCaml :)

<comment><USER9> Great to know people using such an interesting language (and also being based in Europe)!

</comment></comment></comment><comment><USER10> I have been interested in OCaml for a while, and this is a nice piece. One question, though - some of the examples start like this:

\- :

Is that the prompt from the OCaml REPL (does OCaml have a REPL)?

EDIT: I think I misread things - it's the output from the examples that has the "\- :" prefix, so I'm guessing it is REPL output.

<comment><USER11> That's what the prompt answers back.

       # 3;;
       - : int = 3
       # fun x -> x*x;;
       - : int -> int = <fun>

</comment></comment><comment><USER12> Is there a tutorial out there showing off the OCaml tooling from a working coder perspective? I mean setting up a project, managing dependencies, debugging, testing, etc. I really think that average joe programmers like me could benefit from features offered by strongly typed FPL, but lack of good tooling is a show stopper. Elixir does an amazing job at this, but it's not as safe and general purpose as OCaml or Haskell.

<comment><USER13> Something like this? [https://realworldocaml.org/](https://realworldocaml.org/)

</comment></comment><comment><USER14> I'm very surprised articles about OCaml (and more generally functional programming) are popular on Hacker News. FP isn't exactly a new thing. I would assume most CS graduates have experience with functional programming (I learned "Caml Light" as an undergraduate in 1996).

<comment><USER15> As you learned Caml Light, chances are you went to a French university. As far as I understand, outside of France, OCaml/Caml Light are seldom taught at university. WRT FP, many universities will use Java or C++ to teach programming fundamentals (a terrible thing imo). Some teach or used to teach Scheme or Python.

<comment><USER16> We did a little bit of OCaml in our undergrad PL class at UCLA. If I remember correctly, it was only a couple weeks, and you're probably right in that it was a bit unusual. The less exotic classes I took mostly used C++.</comment></comment></comment>