How can I teach a  bright person with no programming experience how to program? - <AUTHOR> http://programmers.stackexchange.com/questions/96504/how-can-i-teach-a-bright-person-with-no-programming-experience-how-to-program/96506#96506 <comment><USER2> The top comment is bullshit.

I could not get through those three books but I get paid to program. My code is repetitive and shitty but I can produce a working web app as long as it doesn't have to support too many users, and it's fine.

My husband never read any books about formal programming and taught himself from those random "learn Java" or "learn python" books. He's a mathematician and programs to write simulations/solve equations, and he gets paid for it too.

If you can't get through those three books maybe you can't hope to be a computer scientist, fine. But you can certainly _program,_ in the same way you don't have to be an English major to read or write.

<comment><USER3> Most programmers write code that other people have to read, maintain, or extend at some point. If you write repetitive, shitty code, you may be qualified to write some useful programs for yourself, or write a web app that doesn't have to support too many users -- which are valuable skills -- but it is not fine for the majority of programming jobs. Incidentally, given that you can do what you described, I'm also pretty sure you could get through those three books if you tried; they are not rocket surgery.

<comment><USER2> My point is that programming is useful in a variety of contexts and you don't have to be that great at it to accomplish something.

You're right, I probably wouldn't work out at most programming jobs. I do contract work; the web app I'm writing now I had about 3 weeks to knock out, will be used by 2,000 people, and will only be used for about a month. But I'm still a "programmer," because I program.

We're not all writing mongodb or working at Google or whatnot.

<comment><USER3> Well, I agree with that, so I suppose I won't argue any further about it.

<comment><USER4> Cool!

</comment></comment></comment></comment></comment><comment><USER5> K&R is awesome but... C would not be my first choice for a beginning language.

Things like pointer arithmetic, memory allocation, etc. distract from the basics and high-level concepts.

I would start with Python or Ruby these days. If Python is good enough for intros at places like MIT, it's good enough for me.

C is a masterpiece of elegance and simplicity and gives you a mental model of how a real computer works, and it gives you a foundation for understanding Unix, but I just think it overloads a beginner with stuff that gets in the way.

came to comments expecting a lot of reasons why Scheme or Lisp was a better choice LOL

<comment><USER6> It's tempting for us, as programmers, to consider Python an easier language to learn than C. I'm not so sure. Python is simple for programmers to learn because it uses a large number of common programmery things: lists, hash tables, classes, modules, etc. Things that beginners won't have a clue about. C doesn't _have_ any of these.

Sure, it takes a while for you to wrap your head around pointers. But it also takes a while for you to wrap your head around inheritance. By virtue of being a smaller language, C has less of these things to wrap your head around.

If you need a dynamic array, you have to build it yourself from what you already know. Instead of having to learn yet another opaque concept, you're _reinforcing_ your knowledge of pointers and dynamic memory allocation. Double benefit!

And once you know C, it can give you a boost towards learning other languages - most of them are implemented using C! If I don't understand something, I can always look at the source to see how it works. Since they're implemented in C, many languages tend to map easily to C concepts.

The same cannot be said about going the other way. A Ruby programmer learning C has to unlearn all the assumptions and niceties Ruby has spoiled them with. How much of Ruby is going to be applicable to C?

<comment><USER7> > A Ruby programmer learning C has to unlearn all the assumptions and niceties > Ruby has spoiled them with.

Only if he wants to learn C.

But why bother? For the overwhelming absolute majority of programmers it's a complete waste of time.

<comment><USER8> There's so much existing C code in the world powering almost everything we do that you just have to know C in order to get a thorough understanding of computing.

C is to computer science as latin is to medicine. All medical doctors need to know a little bit of latin

</comment></comment></comment></comment><comment><USER3> I suppose most of us would give a similar answer as what Joel gave, but I found this nice pair of comments:

 _Is this really the only way to be a good programmer? I'm someone that wants to study programming in my spare time and that's a bit of a daunting list for someone new to the industry..._ – toleero Jul 28 at 14:54

 _No, it is not the only way to be a good programmer. But if three books is a "daunting list" than you might be underestimating what it is that programmers do. – Joel Spolsky_ Jul 28 at 15:05

Seriously.

<comment><USER2> Not all "programmers" are Joel. Not all programmers do something hard. For instance, writing an online survey is not hard. It is programming, but it is relatively easy, but boring and repetitive. It's also something that is commonly done by "programmers."

Not all programming is cutting edge computer science.

<comment><USER9> Most easy programming being done nowadays probably have pre-built solutions available that you'd just have to configure. Online surveys are a great example.

</comment></comment></comment><comment><USER10> I am firmly convinced that if you don't enjoy programming you'll never actually become a programmer.

It does not matter how smart you are.

It does not matter how much you WANT to become a programmer.

So the first thing I do when introducing someone to programming is point them at tools that will allow them to be productive quickly to see if they "get a kick" out of creating things with code.

I think Joel's advice to start with C is GREAT. But only if the question is "I think I love to program. But I'm a noob. I want to become a great programmer. How do I start to become one?"

<comment><USER11> I believe this is largely incorrect.

You can learn to love something, largely because you find yourself successful at it. On other threads you can hear from people who hated math until they learned logic and they were off to the races. I am sure that programming has the same thing; in fact, I know programming has the same dynamic. I know this because there is a steady stream of "how Python/Ruby/mobile apps/ditching my boss made me fall in love with programming again" which suggests strongly that one can change affect. Too strongly for it not to be true.

<comment><USER12> >You can learn to love something

True. Nothing is fun until you're good at it.

<comment><USER10> I agree you can learn to love something, but to say that nothing is fun until you are good at it is simply Not True.

When I got my Apple ][ in 1980 I was not good at programming. But I had a freaking BLAST writing AppleSoft BASIC code till the cows came home. Weeks previously I probably couldn't have even SPELLED programmer.

<comment><USER13> Agreed. I've done plenty of things that I was bad at, but enjoyed anyhow.

Programming is first on the list, though you might say I had a natural aptitude for it. Despite the long road of learning (mostly) on my own, I enjoyed it all the way. (I say 'mostly' because there was a short programming class in 4th grade that introduced me to it.)

Bowling is another. I'm really not good at it. With practice I might be, but I don't practice enough. I enjoy it anyhow.

</comment></comment></comment></comment></comment><comment><USER14> Maybe Joel is right, maybe not. It might depend on the person. At 13 years old I tried learning C++, at 14 Java, at 16 C.

None of them stuck. Part of it was that the concepts were too difficult to understand. In which case Joel's list might help, as it is more about concepts than teaching programming. I think a bigger part of the problem was that it was too difficult to write anything useful in those languages. After a semester of C (Intro to Programming) I don't think I could write a single useful program. If it was a semester of Python I'm damn sure I could write useful code after it.

I wish a book like "Learn Python The Hard Way" existed back then. It would have been great to understand the basic concepts of programming, and see the code actually work. I remember a C class where the instructor was teaching about arrays. I don't think a single person in the class really understood what he was talking about. Compare that to Python lists and dictionaries, you can see them work, you understand what they do and how to use them immediately.

I'll take Joel's advice and read those books. But I'm not sure they are best way for people to start.

</comment><comment><USER15> Why not make them start in machine language, I mean since they need to learn how everything works before they can program in the language they choose right? I find it somewhat funny that C and C++ are the default "starting point" languages to learn programming when there are still lower-level languages than these. I see no problem with starting out at a higher level language and going from there, part of programming is having enthusiasm and being able to play around. By starting with easier languages, a person's interest may better be captured and can lead to more self-learning, the way I see it, the natural progression is to want to learn the harder, lower-level stuff as you move along in a development career anyways.

<comment><USER16> _Code_ is pretty much explaining machine code.

</comment></comment><comment><USER17> I'm a bright person, and I learned to program in 6 months with only "programming" experience being Excel VBA scripts.

Joel's method would have made me drop out and convinced me that programming was terribly boring-- much like a how a kid who wants to play the piano would feel after starting out on 6-months of only scales.

I learned so quickly because I loved it, and I loved it because I could be instantly productive making apps with Ruby on Rails. There was still a lot to learn, but those things could be learned later "in the field" as they were relevant.

<comment><USER18> I completely agree. My initial foray into programming was writing sites in PHP, and I learned a lot about logic, functions, classes, and structuring projects because of it— and my transition into other languages. Had I said I wanted to learn to program and someone tossed K&R at me and told me to "work through it by sheer force", I doubt I would have found the subject to be so interesting.

Certainly K&R is a must-read, but Joel's advice...

 _"If you can't get through this sequence, you're not going to be able to program, so you might as well give up now."_

...is terrible. There is more than one way to introduce someone to programming.

</comment></comment><comment><USER19> The first programs I wrote were complex BASH scripts that solved specific problems I needed solving. I had a friend that was there to help me a long the way. But the main reasons I continued learning were because I had the immediate benefit of having my problems solved and also because I had tangible evidence of my progress. The rest snowballed from there.

I understand where Joel is coming from with his advice, but I don't think I agree with it. I had read quite a few programming books in the past (C & Java), muddled through the exercises, and thought I understood the concepts, but until I dived into solving real problems, I didn't "get it".

<comment><USER20> Exactly - that's how I learned programming, too. It didn't matter so much about the syntax, but what problem you could solve. For me it was a Perl CGI script for letter writing and earlier a Hypercard registration system that got me into programming, despite my father and teachers repeatedly trying to teach me BASIC. Today it might be adding javascript to a page, or customizing/coding a game using tools like Scratch or Gamemaker.

And there is decades worth of research backing this up (problem-based learning, situated cognition), but CS education has been slow to adapt.

</comment></comment><comment><USER21> I did this. It's not for everyone, but for a highly motivated person it's not that hard either.

A friend who's in Med School wanted better working conditions than working at crappy call centers. I gave him a high-level overview of what programming is about and threw him the Django tutorial and made myself available for questions. As I gave him practical requests for useful web code, I delved into the details of Python and web programming in general, while slowly introducing him to tools of the trade like the shell, debuggers, and data structures, trying to make every step of the way easier for him.

Six months later he got a job at a biomedical NGO. He began by documenting and testing existing code, but now does quite a bit of coding by himself.

I've found that teaching theory along with the tools that utilize it to be a very good strategy.

</comment><comment><USER22> I'm surprised no one made any mention of what this bright person knows in the first place.

One of the best ways to teach is to map known concepts to new concepts. For instance, I might introduce methods to people who already know what functions are, but talk about messages to those who don't.

</comment><comment><USER23> Yeah, Joel is dead on for how to learn to program. Unfortunately, I think we need to question that question more.

What folks are often asking when they ask "how do I program?" is something entirely different.

How do I learn how to make a website? Use wordpress or yola or squarespace.

How do I learn how to make that website look better? Read design blogs, some starter tutorials on html and css and start diving into the CSS. It's not that hard a standalone thing to learn.

How do I learn how to make that website do something fancy like fade things out? Start diving into the javascript in the same way.

How do I learn how to make that website do something functional like send an email, or save a session? Pick a modern framework (Ruby on Rails, Node on Express), read/watch the starter tutorials on it, and dive in.

How do I learn how to make that website do something functional and NOT have it be a horrendous hack job? Time to start reading those programming books :D

Just sayin' it's not always step 1. Depends on what you need to get done, and what you really want to learn how to do. Yeah?

</comment><comment><USER20> To get some of the concepts of computer science and most basic features of programming, see:

<http://csunplugged.org/>

<http://scratch.mit.edu/>

For application development, I'd start with an environment that actually tried to make things simpler for the programmer and showed how you can use programming to tweak a design first before programming from scratch - an IDE (see Microsoft's beginner resources <http://msdn.microsoft.com/en- us/beginner/default.aspx> ) or game development environment (like gamemaker or XNA).

See also actual curricula for high school or non-computer science students (CS0 courses), like

<http://csta.acm.org/>

<http://coweb.cc.gatech.edu/mediaComp-teach>

I would not throw SICP at someone who didn't already know how to program.

</comment><comment><USER24> Joel likes the sink or swim approach apparently.

The first book, Code - Charles Petzold, is only ten bucks on the Kindle right now (SOLD) and I own the other two.

I remember SICP being like 90 bucks for my hardcover copy and I'm pretty sure I bought it after reading the Joel on Software article "The Perils of Java Schools" while I was loving life as a bank IT guy so this is workable advice. It only took five years to become a "real" programmer after that. Also I sure don't remember K&R being $68[1]. (Yes I know SICP and K&R are both online for free)

[1] [http://www.amazon.com/Programming-Language-2nd-Brian- Kernigh...](http://www.amazon.com/Programming-Language-2nd-Brian- Kernighan/dp/0131103628)

[2] [http://www.joelonsoftware.com/articles/ThePerilsofJavaSchool...](http://www.joelonsoftware.com/articles/ThePerilsofJavaSchools.html)

<comment><USER25> Could you link to a free (and legal) version of K&R?

For anyone interested, I found SICP at <http://mitpress.mit.edu/sicp/>

<comment><USER26> For completeness, SICP in .mobi format for Kindle: <https://github.com/twcamper/sicp-kindle>

</comment></comment></comment><comment><USER27> I think in addition to studying these books, the student should be put right to work coding simple tasks. The best way to learn is by doing, not by theory.

The student should get in and start hacking away at some non critical part of the code base. Perhaps the UI, or some reporting or tests. Something it's OK to break for a day or two.

Pair them up with a more experienced developer and make sure they do code reviews. Discus the code and talk about what went right and what went wrong.

<comment><USER28> Agreed. I wish more books would adopt this strategy: "Ok, stop. To move forward with the application we will need code that does X, Y, and Z. Here is the spec that I want you to code for the next step. Work on it for a bit. If you're having trouble check out our forum for other people's attempts at a response and you can see 10 ways to solve the problem. On the next page you will see the code answer and the book will continue with an explanation of the code."

Even as a beginner you can tackle small snippets of code using the basic control structures.

<comment><USER29> >Even as a beginner you can tackle small snippets of code using the basic control structures.

Sadly, this is how programming books used to be written. Case in point: about a decade ago in high school we learned programming from a book called C by example. It had a handful of well thought out programming exercises after every section. A few years later I went looking for the book to give to a friend who was starting out. Lo and behold, in an updated version the exercises were all removed! It's mind-boggling that somehow the publisher thought _removing_ the exercises was adding value to the book. Perhaps your average reader feels exercises makes a book seem too technical, so they skip it for the Learn X in Y hours style books? Nowadays you can't find good programming exercises outside of a dry textbook.

</comment></comment></comment><comment><USER30> What the fuck?

Here is how I read this thread: Q: How do I quickly get a complete coder newbie up to speed to support .NET apps? A: Teach him Lisp and C

What a silly, dogmatic, and unpractical answer. No one even bothered to ask about what kind of work this person is going to be doing, what sort of apps he'll be writing, what industry he's working in, etc.

Obviously, the company where this guy works is giving him a shot at a super- entry-level programming job. If he has any hope of succeeding (which means being productive ASAP) in this job, learning C and Lisp is not going to help him.

</comment><comment><USER31> The only well-known language worse than C to start with would be C++. We used this in high school AP Computer Science before they switched to Java. Spent about 80% of our time learning pass by reference, templates, and about segfaults. The other 20% was on algorithms. Made programming seem horribly complex.

<comment><USER32> Don't knows about you, but I wouldn't consider someone a "programmer" unless the had a solid grounding in pass by value vs. reference, generic programming, and hardware memory protection mechanisms. Yeah, and algorithms are important too.

<comment><USER31> Yes, but not C++

<comment><USER32> I actually don't disagree with your opinion: I wouldn't pick C++ as an environment to introduce programming either. But your reasoning was frankly awful. If _those_ are the reasons you think C++ is "too complicated", then you _really_ need to spend some more time learning C++.

<comment><USER31> You're right, those aren't good reasons for why C++ is awful. I think ERR i give up. You're right my whole rationale is pretty confusing. The class wasn't so bad in reality. We didn't really look deeply into the horrible "features" of C++.

</comment></comment></comment></comment></comment><comment><USER33> I am helping a friend learn to program. He was doing "Learn Python The Hard Way" but was loosing steam. I created a project for him to do, a simple ASCII game: <https://github.com/antoinehersen/ASCII-Dungeon-of-DOOM>. Having a project with visual and interactive elements is far more motivating. Also it push you to learn the real skills needed for programing, not only knowing what a loop is or how to open a file, but figuring what to use when, and how to organize and connect it all. This experience will create a reference frame for everything he might subsequently read in a book.

I strongly believe that accomplishing a small scale project that as some value is the best way to learn.

</comment><comment><USER31> wow, i disagree! i can't even imagine starting with C. that's like saying the only way to learn to build with legos is to learn how to mold plastic first. sure it's possible, but desirable?

<comment><USER34> What's the most important thing when learning to program?

My answer: Exacting logic.

C is a great language at teaching exacting logic. "Wax on, Wax off" kinds of things.....

</comment></comment><comment><USER35> Learning how to write code is actually fairly easy. Kids can do it. The hard part is to write code that doesn't make your co-workers hate your guts because they have to maintain it. I'd recommend getting a copy of McConnell's "Code Complete".

</comment><comment><USER36> I found a simple method that works really well: ask the student to invent their own language syntax on paper. We start with a simple language that can draw on screen, and proceed from there.

I'm noticing that Students naturally discover many of the issues and tricks that they would otherwise have to "study" (such as flow of execution, nesting, variables)

I occasionally teach at schools in NY, and this semester my students "invented" the smalltalk syntax. It was heartwarming to witness.

</comment><comment><USER37> Weird to recommend not starting on the most relevant language (C#) but instead with C and Scheme...

Sounds more like "old-hats" regurgitating their learning process.

Why the line is always drawn with C as well, is interesting. Not assembly, not Java, or Python... but C.

An analogy: Go and learn to use a mouse and keyboard, before you get an iPhone, otherwise things like the "On-Screen Keyboard" and the idea of "Touching (Clicking)" things is too difficult to grasp.

<comment><USER38> If you want to get someone hireable as quickly as possible, tell them to learn C# or Java by all means.

But if you want them to "achieve enlightenment", you've got to get them on scheme. And if you want them to see through all the smoke and mirrors, and gaze upon the simplicity that is the machine, you've got to teach them C. Assembly will work too, _with the proper arch_ (and x86 is not it).

<comment><USER39> I completely agree with you. I think Joel was answering the 'how do I achieve enlightenment' question. Maybe he only considers someone a programmer if they are enlightened; seems kind of narrow-minded to me.

</comment></comment></comment><comment><USER40> No one wants to learn to program.

The question is fundamentally flawed.

People want to build _something_ , not learn to program.

To teach someone to build something, teach them how to use the tools of the trade. No carpenter ever learned the physics behind wood in order to build their first table.

The answers to this question all come from people with a perspective that this is what they would do if they wanted to take a bright person and put them into a developer role at their company. And, they all have the defeatist attitude that unless you read these three theory books, and spend four months of intense study, you cannot be a programmer. What hogwash.

Most people cannot take four months off from work and intensely study programming. But, anyone can learn to tinker on something they care about with the right mentorship and using the right tools. Anyone can learn to use jQuery, Ruby on Rails or HTML if-and-only-if the point of doing so is not to learn jQuery, RoR or HTML but is to build something that inspires them. All you need is a path with baby steps and inspiration.

</comment><comment><USER41> Inspire them, forget the details. Show them how to get a computer to leap into life with their creation, and they will take it from there.

Showed my middle son how to animate a java graphic on a website. He never stopped. Now is a CS graduate student at CM designing/implementing the next internet routing protocols (and writing Kinect games).

</comment><comment><USER42> Give them progressively harder programming problems to solve. Each new problem should be just _baaaarely_ within their capability to solve, so they are forced to learn something new with each new problem. Each new problem should also 1) build on the foundations of the previous problem, and 2) introduce new fundamental concepts.

I know of no other way. You learn programming by programming. This, by the way, is exactly what a good CS curriculum will do.

</comment><comment><USER43> I could not agree more with Joel. To be a good/proper programmer you need to know C inside out. I would never, ever hire anyone who doesn't understand pointers.

</comment><comment><USER44> tl;dr: If a book were going to teach somebody how to program then you wouldn't be asking this question. A book requires a self-motivated person to pick it up and read it. Assuming you're trying to teach somebody who didn't have the desire to learn on their own, then you're going to have to relate to them and explain it in a way that they'll understand. Getting them interested and excited about it usually seems to be the best kick-starter.

You know what? I've actually unintentionally taught several people the basics of programming. I work at a small company with other bright people who are not programmers by study, but have learned how to communicate programming with me. I truly believe that teaching somebody to program is as easy as figuring out how to best explain something sequential to them. Usually, I begin my stealth teachings under the guise of me just trying to help them communicate their program requirements or ideas to me. I quickly jump into the lower level explanations of things and somehow I manage to get them excited or interested enough that they actually feel like talking "programming" with me will be cool. I try to explain to them that programming is like giving the computer an ordered list of things to do, and it'll do them exactly in that order. As simple as 1, 2, 3. I then explain loops. I don't get into functions and classes because that's not necessarily important to them understanding the flow of logic. Most people seem to easily grasp the concepts of if-then, and loops ... this is all really simple stuff for most people to understand at a basic level. I don't even necessarily mean code, but more so logically what an if-else means. I find that most people generally give you the "yea yea I got it" type of response while explaining this. Once I get them to this point, they're where I wanted them to be. I then try to include them in scenarios where I'm debugging something. I don't deliberately ask them to help me do my job, but I more so start talking out loud and usually they'll come over to help brainstorm. I show them my code, and explain the logic flow (if-else, loops, etc). You'll be surprised at how easy it is for people to actually help out here. Sometimes it's the non-programmers who can give the most obvious advice. At this point in time, it's up to them. If they're interested enough they'll progress from them, otherwise it may just no be their thing. I work with 8 people, and I have actually had one guy learn Python and he now writes Python tools for us - he knew zero programming. I also got our accountant into programming because he would always ask me the status of projects, and slowly over time I got him speaking "programmer-speak" with me, and now he basically understands all my programming yammer. I realize that these guys are not writing the next Redis or Twitter, but they were non-technical guys who are now on their way to being on their way to writing those things. :)

<comment><USER45> Great posting! You actually have an idea of how to self-motivate people in order to learn something. The suggestion "come back after reading three books" looks to me as one of the best ways to make sure that they will never ever become interested in coding again. It is like telling a person interested in learning a language that they should come back after learning the dictionary. Just completely inable to relate to non-coding people.

</comment></comment><comment><USER46> On a generic level, the best way to make a smart non-programmer write programs is to describe how to do it but not tell them it's programming.

</comment><comment><USER47> I'm pretty sure this is the only way: <http://abstrusegoose.com/249>

</comment><comment><USER48> I would think that the Stanford open class CS106a with Prof. Sahami would be an excellent start.

<comment><USER49> Playlist: <http://www.youtube.com/playlist?list=PL84A56BC7F4A1F852>

Course resources: <http://www.stanford.edu/class/cs106a/cgi-bin/>

</comment></comment><comment><USER50> [http://www.avc.com/a_vc/2011/10/program-or-be- programmed.htm...](http://www.avc.com/a_vc/2011/10/program-or-be- programmed.html#comment-351671965)

"To get 'skills' and expertise in the technical parts of computing, especially for Web 2.0, here is an outline in 8 steps:"

Also it happens that that post, like the OP, is aimed at .NET.

Also the post emphasizes just one book which has introductions to HTML, CSS, Visual Basic .NET, ASP.NET, and ADO.NET, including relational database normal forms, and contains nothing on 'algorithms' such as in Knuth's TACP or subsequent, similar books. Also the post has nothing on C, C++, Java, Python, PHP, Ruby, or Linux.</comment>


WSJ: Microsoft Targets Phones - <AUTHOR> http://www.google.com/search?hl=en&as_q=&as_epq=Microsoft+targets+phones&as_oq=&as_eq=&num=10&lr=&as_filetype=&ft=i&as_sitesearch=&as_qdr=all&as_rights=&as_occt=any&cr=&as_nlo=&as_nhi=&safe=images

<comment><AUTHOR> Note the form of this submission.

The article is behind the WSJ paywall.

Rather than submitting a direct link to the WSJ article, I submitted the google search for the article. This link will inevitably appear in a comment for the submission, in response to "I hit a paywall." Let's just go there in the first place.

I prepended "WSJ" to the article title, hinting what to look for when following the google link, and adding back information that is obscured by HN (properly) labeling the link as to google.</comment>


Steve Jobs praises a retiring Bill Gates - <AUTHOR> http://www.news.com/8301-13860_3-9851790-56.html?tag=nefd.top

<comment><USER2> A praise bit late I guess ;)

"Being the richest man in the cemetery doesn't matter to me... Going to bed at night saying we've done something wonderful... that's what matters to me." \- Steve Jobs, On Gates and Microsoft, Wall Street Journal, Summer 1993

ref: <http://en.wikiquote.org/wiki/Steve_Jobs></comment>


ASK HN: Why json strings only accepts double quotation mark(")? - <AUTHOR>

Today, I am parsing a document, which I coincidentally wrote as {'status':'ok'}. I spent lot of time checking browser requests and setting proper header and content-type to application/json.
Then, I remembered that somewhere I read that it accepts only double quotation mark. so I changed that to {"status":"ok"} and it worked like charm. Later I confirmed that from json.org also.
So, my question why only one quotation mark (i.e. " ) was supported by json? what were historical reasons for that. <comment><USER2> Traditionally single quotes are used to represent a single character and double quotes represent strings, so that's presumably where it came from. As for why, I'm unsure. One of the great things about JSON is that its syntax is very close to the syntax that many languages use for representing arrays and the like, so perhaps it was to stay in keeping with languages like C where strings cannot use single quotes. That's just a guess though and I personally don't think it's a good enough reason - I'm always caught out by single quotes in JSON.</comment>


A Proposal to Switch Fedora 33 on the Desktop to Using Btrfs - <AUTHOR> https://www.phoronix.com/scan.php?page=news_item&px=Fedora33-Desktop-Btrfs-Proposal <comment><USER2> The actual proposal. [https://fedoraproject.org/wiki/Changes/BtrfsByDefault](https://fedoraproject.org/wiki/Changes/BtrfsByDefault)</comment>


Show HN: PHP For Affiliate Marketers Free Today at Amazon.com - <AUTHOR> http://www.amazon.com/PHP-Programming-Affiliate-Marketers-ebook/dp/B00A2TTNR0

<comment><USER2> This should lay the groundwork for plenty of poorly built sites that are easily hacked...

<comment><AUTHOR> because teaching people the basics like variables and if/else statements will lead to poorly built sites?? Everyone has to start somewhere.

</comment></comment><comment><USER3> spam spam spam spam spam spam spam spam

<comment><AUTHOR> how so?</comment></comment>


Ask HN: Moving Flash games to HTML5 - <AUTHOR>

Hey folks,
I made a very simple Flash game a few years back for a college class. It was quite fun.  I had been thinking about recreating it with HTML and JS (and probably leveraging some HTML5 features like canvas).  I figured it could be a cool game for iPhone/Android/WebOS phones, as well.
My biggest concern with doing this is cheating.  This simple game had a scoreboard (Flash submitting a POST request to a PHP script, with some authentication/validation).  The biggest drive to playing the game over and over was the scoreboard.  I'm afraid that moving it HTML+JS would make it easy to cheat. (Example: Using Firebug to change the JavaScript to stop the countdown timer from working.)  With Flash, the users don't know what's going on.  The best they could do was intercept the POST traffic and see what's being sent.
I suppose I could use things like the YUI Compressor to keep the JS harder to modify. (http://developer.yahoo.com/yui/compressor/)
I'm more curious on ideas for Flash game developers moving to HTML5.  I probably haven't touched Flash since I made this game in college, so I don't know how Flash is these days.  Any advice on how to handle potential cheaters would be great.  Any other advice on moving Flash games to HTML5 for other developers could be helpful too.
Thanks! <comment><USER3> 1\. You're overthinking the nature of cheating. Flash games have been put through the wringer using memory-editing tools like Cheat Engine. The only truly secure strategy is an expensive one - record, upload, and replay the game on-server. The cheaper alternative is hand-moderated scoreboards. In any case, high scores are not central to the success of most games - they're a payoff that comes at the end of a session and many users will back out before finishing even one session. (Yes your game may differ, but you haven't presented data to back up the assertion.)

2\. It's just too early to move to HTML5 for commercial games - no developer ecosystem, monetization methods are entirely DIY, limited user benefit, etc. That will all change, but I would treat a port like this as a demo project.

<comment><AUTHOR> You're right about overthinking the cheating thing already. I should focus more on how to make the game and its logic, and worry about cheating when it happens. Moderating the scoreboards will probably be good enough.

Thanks for the tips!

</comment></comment><comment><USER4> It definitely early for a big leap if you have solid Flash skills and existing content. If you don't have massive investment in existing tech, then new development should definitely be done in HTML 5.

However, Canvas is years behind Flash in terms of ease of development. At the moment using Canvas is a completely manual process. You have to manually manage every single element, there are no events, no layers, no objects - <USER2> roll all of this yourself. That said, looks like longer-term Adobe will be targeting Canvas.

I am currently building a game using SVG via the RaphaelJS library. Overcomes a lot of the problems with canvas (I get events and a real-life DOM), and my use-case is not performance intensive so seems to be working fine so far.

Cheating is a problem in all games, Flash is arguably a little harder to cheat, but it is still not particularly difficult. The best thing to do is setup server-side controls for cheating - there are a range of different options that can be pursued her.

</comment><comment><USER5> <http://scripty2.com/demos/cards/> You may find this library interesting if you end up choosing to port to html5</comment>


Ask HN: Best Backpack for a Commuting Software Dev? - <AUTHOR> Bonus points if there's water/snow resistance. <comment><USER2> I have a cheap $25 Walmart backpack I got from another HN thread and it's worked surprisingly well - no signs of wear after ~2 years of daily use.

Found a link: [https://www.walmart.com/ip/Outdoor-Products-Quest- Backpack-D...](https://www.walmart.com/ip/Outdoor-Products-Quest-Backpack- Daypack-Green/51036937)

</comment><comment><USER3> I used to recommend LLBean, but now I highly recommend TimBuk2.

I purchased my first TimBuk2 backpack last year and was ecstatic about it: [https://www.timbuk2.com/](https://www.timbuk2.com/)

<comment><USER4> Which one? They have quite a big choice.

</comment></comment><comment><USER5> I work remote now, but before I switched to my current job, when I still had a commute (and by Bart in bay area too, no less -- a notoriously uncomfortable commute if you're not familiar), the last backpack I used was this "Slim Laptop Backpack". [https://www.amazon.com/gp/product/B00RRHNLXC/](https://www.amazon.com/gp/product/B00RRHNLXC/)

Basically, I realized that pretty much the only thing I needed to carry to and from work was my laptop (13" MBP at the time). I had a few other things like earphones, ibuprofen, etc. but they all fit inside small compartments in that slim backpack.

That was my favorite commute backpack by far. On the train, it lets you not take off your backpack, and still not be a bother to others. It satisfies your bonus points for water/snow resistance if it's raining or snowing, because you can just wear it underneath your bigger jacket.

</comment><comment><USER6> I backed this one on Kickstarter: [https://www.kickstarter.com/projects/threadinternational/a-b...](https://www.kickstarter.com/projects/threadinternational/a-better- backpack) \- it arrived a couple of weeks ago and is great so far.

</comment><comment><USER7> Ctrl+f, typed "Ogio", no hits, therefore I shake my head in disapproval while doing "tsk tsk".

Got an Ogio backpack from Rackspace back in 2012 and I've been using it at 3 different companies. Each time I'm asked about why I use a Rackspace backpack at Company X I challenge them to give me a better backpack for free. No one has matched it yet.

This little guy has so much room in it that I can pack laptop+accesories+clothes for 3-4 days. It is also waterproof (I used to cycle to/from work in British weather for 2 years) and durable as f*ck.

I like it so much that I bought a second Ogio backpack so both me and my wife can pack stuff when traveling with the certainty that we won't have to buy a new backpack every year or two.

</comment><comment><USER8> [https://www.booqbags.com/products/cobra-squeeze-15-inch- lapt...](https://www.booqbags.com/products/cobra-squeeze-15-inch-laptop- backpack)

</comment><comment><USER9> a lot of backpacks from the outdoors companies have 15" sleeves, and will be very sturdy and durable.

i bought a north face borealis in 2014 and it looks as good as new, not a stitch out of place.

osprey i hear is good as well.

</comment><comment><USER10> Thule Crossover 32L Backpack, been using this for past 6 years now. Has held up really well, only finding an excuse to buy a new one, can't find one though

It has held up great for daily commutes as well as 2 day official trips, enough space to carry all.

[https://www.amazon.com/Thule- Crossover-32L-Backpack/dp/B004X...](https://www.amazon.com/Thule- Crossover-32L-Backpack/dp/B004XANKVO/)

</comment><comment><USER11> The Crumpler Considerable Embarrassment. Seems very water resistance, and hasn't sustained much damage in the year i've had it. Pricey, but sturdy construction. A coworker has had his for a decade and it's fine, minus some fading.

</comment><comment><USER12> Depends on what you need to carry.

Don't carry a laptop unless you are working during the commute or have some other restriction. It is better to be able to access all of your systems remotely, so you can pull anything you need from them.

</comment><comment> 70122-_6 blue osprey 80litres.</comment>


Inception - <AUTHOR> https://github.com/google/inception <comment><USER2> I'm sorry, but what is the 'actually' about?

<comment><USER3> I think this? :

[http://googleresearch.blogspot.com/2015/06/inceptionism- goin...](http://googleresearch.blogspot.com/2015/06/inceptionism-going-deeper- into-neural.html)

<comment><USER4> Not very closely. The "inception" in the title of this piece refers to the so called "inception" layers in Google's convoluted neural network architecture. These layers are unique to Google - no one else really uses them.

In that blog piece it was more a reference to the recursive nature that produces that "deepdream"-style artwork. The code for that is available here: [https://github.com/google/deepdream/](https://github.com/google/deepdream/)

</comment></comment></comment><comment><USER5> I thought I'd get to this repository: [https://github.com/karthick18/inception](https://github.com/karthick18/inception)

</comment><comment><USER6> Is Google Brain group primarily using Caffe2, Torch7 or something else? It's great to see deep learning innovation happening in Python. I'd previously heard they were focused on Torch7 like Facebook.

<comment><USER4> I think Caffe2 is Yangqing Jia's private work.

I have noticed that they seem to ship a lot of their NN experiments using Caffe (and now Caffe2?). However to some extent this might be because iPython gives you such a nice environment for demo systems.

</comment></comment><comment><USER7> Duplicate post of [https://news.ycombinator.com/item?id=10210520](https://news.ycombinator.com/item?id=10210520)

</comment><comment><USER4> Has anyone managed to get Caffe2 installed? I can compile, but its unclear how to get it installed.

<comment><USER8> I made a dockerfile that installs caffe2 for deep dream. You could adopt it for just caffe2

[https://github.com/mjibson/ddd/blob/master/Dockerfile](https://github.com/mjibson/ddd/blob/master/Dockerfile)

<comment><USER4> _I made a dockerfile that installs caffe2 for deep dream_

DeepDream is Caffe. This uses Caffe2[2]

I actually worked it out: you just set the path to Caffe2 in the python code. It works really (really!) well.

[2] [https://github.com/Yangqing/caffe2/](https://github.com/Yangqing/caffe2/)</comment></comment></comment>


Ask HN: One thing you wish they teach in your undergraduate CS course? - <AUTHOR>

After some 10 yrs in IT, I still dun see much value in my CS degree, why dun they just teach me these instead;
Step 1 - Find a(another) problem. Step 2 - Build an awesome product to solve the problem in Step 1. Step 3- Tag a price to your product. Now go back to step 1.
It make so much more sense. <comment><USER2> Been out of school for a while, but based on the new hires coming through the door I wish they would spend some time on software process: how to use source code control (including branching and merging), how to approach designs in the context of a system with cooperating programs so that compatibility is maintained without big-bang releases of multiple programs, proper use of bug/feature request tracking systems, why it is important to have consistent coding styles, how to read and modify code that was written by others (and how to write your code to make it easy to modify), how to work with other programmers on a team. These are nuts and bolts issues of the practice of writing software, but everybody seems doomed to come out of school and make the same mistakes unless they start in an environment with a good remedial training program to fix these deficiencies.

<comment><AUTHOR> @bd_at_rivenhill agree with you totally on the whole source control issue. They should teach graduate what is merging, branching, tagging, etc. even better if they know how to do continuous integration.

</comment></comment><comment><USER3> Testing! Unlike other necessary skills like using source control and writing documentation, testing can't really be mastered on the fly. I think the myopic scope of class projects doesn't let students grasp the long-term benefits of having well written unit and integration tests.

Here's a shot at such a course that covers testing through RSpec and Cucumber: <http://tinyurl.com/ucb-cs169>

<comment><AUTHOR> @bdon yes! effective testing and writing good technical documentation are often missed out too. There are so much to testing; automated, security, regression, etc. All of it caters to different phase/part of a proj/app, I guess partly most people think that testing is not necessary.

Name one good technical documentation you see recently? Not easy really, there's a few threads on HN on it. I guess that's why most used a wiki for their technical doc, so that anyone can just come in and help correct any error documentation.

</comment></comment><comment><USER4> This is why good internships are so important while your an undergraduate in CS (or many other majors for that matter).

Depending on the university you go to, CS != Software Engineering. You don't encounter, and may not be even aware, of concepts like code reviews, build systems, or version control. By participating in an internship you are forced to address these gaps in your knowledge.

That being said, I don't think I would take away a single CS course I took as an undergrad and replace it with a course on software engineering practices. There is just too much strictly CS knowledge that is necessary for an undergraduate to learn.

</comment><comment><USER5> I think a two (or more) semester course where you write some libraries/functionality during the first semester from a blank page, and then use/refactor/enhance that code in the second semester would be very valuable. "Eat your own dog food" is something everyone should learn in school. Perhaps the third semester could be based on getting some other students code to enhance as well as being a resource for someone using your code from the previous classes.

</comment><comment><USER6> I'm not arguing in favor of CS degrees -- surely, there is more pragmatic material to be covered -- but what you've stated is overly simplified.

What I _would_ argue is that CS programs give you the background knowledge required to pick up whatever is needed for a certain task. For many, that task is _not_ entrepreneurship.

Would a Software Entrepreneurship degree be cool? Of course, but it doesn't negate the worth of another degree.

</comment><comment><USER7> I wish my degree had more emphasis on working with an existing codebase instead of a constant stream of greenfield applications. I wrote plenty of programs in the n-thousand lines of code range, but never had to worry about interoperability or maintenance at all. In my life after formal education, those have been FAR more problematic than the things I learned.

</comment><comment><USER8> Most colleges do have an entrepreneurship course in their business college, and many colleges allow you to take electives outside your degree program. I did, and entrepreneurship was one of them.</comment>


Twitter has automatically opted you into more email notifications - <AUTHOR> https://twitter.com/settings/notifications

<comment><USER2> Before I do the whole "I forgot my Twitter password" dance, would you care to summarise what these e-mail notifications are about?

<comment><AUTHOR> I forgot which ones I unchecked but here are the email notification boxes now.

News about Twitter product and feature updates Tips on getting more out of Twitter Things I missed since I last logged into Twitter News about Twitter on partner products and other third party services Participation in Twitter research surveys Suggestions about people I may know on Twitter

Pretty sure "Tips, Things, News, Participation" points are all new.

</comment></comment><comment><USER3> What would bother you more? A sponsored tweet or spam in your e-mailbox? Why don't they just use their own channel to send me spam?</comment>


Elements of JavaScript Style - <AUTHOR> https://medium.com/javascript-scene/elements-of-javascript-style-caa8821cb99f <comment><USER2> i find the longer versions of the first two examples in "2\. Omit needless code" more readable

i think my mental parsing at a glance of the short version of the first example trips over how there are no parentheses around the "msg" parameter and it looks like an ordinary variable until i reach the "=>" after it

and in the second example, parentheses (expression body) are used instead of braces (block body) but with indentation that's typical for block bodies so you can't easily tell it's an expression body at a glance (also depends on how well your font differentiates "{" and "(")

> Sometimes we're tempted to assign names to things that don't really need to > be named. The problem is that the human brain has a limited number of > resources [...]

i don't think intermediate variables are all that bad, especially for things that'd make an expression too long to comfortably fit on a line

or is it something only functional programmers care about

i'm not a fan of the currying and point-free and other things and find them pretty unreadable but i never did that kind of functional programming (to my knowledge) so i am not legally allowed to have an opinion on them

<comment><AUTHOR> See "Familiarity Bias is Holding You Back: It's Time to Embrace Arrow Functions" [https://medium.com/javascript-scene/familiarity-bias-is- hold...](https://medium.com/javascript-scene/familiarity-bias-is-holding-you- back-its-time-to-embrace-arrow-functions-3d37e1a9bb75)

</comment></comment><comment><USER3> cargo-culting haskell

<comment><AUTHOR> Cargo-cult programming is the act of copying something without understanding how it works or even whether or not it's required.

Typically it involves the ritual inclusion of code which does not need to exist because the author is copying something else they saw (or literally copying and pasting from Stack Overflow). The essence of the original article is the systematic _exclusion_ of code which does not need to exist -- that is the opposite of cargo-culting.

All of the guidelines exist for reasons which are well explained in the article. It's basically a guide that teaches you how to avoid cargo-culting.

If you're complaining that the guide encourages functional programming approaches, it's useful to admit that functional programming is an important capability of JavaScript (evidenced by the fact that functional utilities are built-in to the language).</comment></comment>


Ask HN: Which pricing would you recommend? One-time payment or subscription? - <AUTHOR> Hi there! We are not sure about pricing model for our startup https://www.kickresume.com. Problem is, that Kickresume is a simple resume builder and people usually use it once maybe twice. We implemented one-time payment but our users don't understand which package to buy. At the other hand, 90% of our competitors are using a subscription model. It's also much more simple to explain subscription to users. (basically we will be selling two packages - free or premium). Any other ideas? <comment><USER3> I vote for 1 time per usage based on the following variables / experience.

Reason 1: Theres roughly 2 different reasons your looking for a job - a: your unemployed or or b: your looking for something new / different / better paying

If your unemployed, money might be tight - no one unemployed wants to take on another subscription

Reason 2: This is a specific use case type system. Unless your a business / recruiter / blogger - when do you use LinkedIN? When you need a job. When do you stop using LinkedIN? When you found a job (generally speaking - <USER2> including their whole "were a news outlet, but not") - same for a resume builder. We may update our resumes when we have stuff to add to it, but for the most part, I think most people keep their resume somewhere safe and forget about it until that time comes again

Reason 3: People sometimes stay at jobs a long time. I had a job that I was at for almost 8 years (and I'm 35) - I may have used a service like this before I got hired to help build my resume, but would have forgotten about it shortly after - and sure as hell not 8 years later.

</comment><comment><USER4> I think your prices seem simple enough. $2 for a template or $9 for ten.

Personally, I'd split off the "Resume Checker" into a separate $20 item.

One thing I noticed - most of your templates include a photo. That's really unusual in my country (UK). Fields like DOB should not be included in order to comply with age discrimination legislation.

That said - I do like the look of some of the templates.</comment>


You Only Need 50% of Job "Requirements" - <AUTHOR> https://talent.works/blog/2018/11/27/the-science-of-the-job-search-part-vii-you-only-need-50-of-job-requirements/ <comment><USER2> I've only once ticked of roughly 95% of job requirements. I didn't get the job. They actually cited the 1/20 requirements I didn't fulfill and said they can't hire anybody who doesn't have that.

They wanted a 100% candidate. Looking through the list of the things they listed as must haves and that they wanted an internal candidate I showed them it is statistically very unlikely they would even find a better candidate for this position.

The position had been open for almost a year. I think there's a reason. These are probably the same people that go to the press and whine about a shortage of engineers.

EDIT: Made a small mistake there. Anyway I only mentioned it after the interview was over. Not during.

<comment><USER3> It's one thing for engineers to "be the HR department" at small companies. They are willing to let things slide because they know the candidate, especially after interviewing them, that they can fill in the knowledge gaps (well I don't know about the willing to move to china bit).

Contrast that with a large company with a specific HR department that is in charge of taking a job requirement sheet and finding and filtering candidates. These people have no idea what any of these technologies are, so for them it's a liability on their ass if they let people through that don't satisfy the "requirements". Managers, when you write up "requirements" and that is being sent to an HR department, keep in mind you might want to move some of those to a "nice to have" category.

That being said, there ARE competent, non-technical HR departments that do understand technical hiring.

Edit: Ohh... I wanted to add too, it's nice being in a startup where you really don't just "leave it up for a year". In a startup each and every candidate is literally needed when it's posted. It's kinda crazy and shows just how much larger companies hire just to hire if they can just sit on positions for a long time. Are they really "needed" if the position can go unfilled for an entire year?

<comment><USER4> If I see a position that has been open for longer than a month, I assume they are not serious about filling it. Either they aren't really hiring or they don't want to pay the market rate.

<comment><USER5> That isn't right. We did hire, several times. More please!

I've been posting this for ages: [https://news.ycombinator.com/item?id=18358038](https://news.ycombinator.com/item?id=18358038)

We have well over a hundred people doing that sort of stuff.

This idea of "filling" a "position" is wrong. There is a need for competent technical staff who can contribute to the team. We hire them as we find them. There isn't a fixed number of slots to fill with warm bodies.

<comment><USER4> Your ad is a "looking for people" type ad. The ads I skip are the ones with fairly specific skills that haven't been filled after a month.

</comment></comment></comment></comment></comment><comment><USER6> From the "methodology" section of this post:

 _First, we randomly sampled 6,348 applications for 668 different users from TalentWorks. Then we extracted the qualifications from the original job postings and the users' submitted resumes using proprietary algorithms. Finally, we grouped the results based on qualification match and regressed the interview rate using a Bagging ensemble of Random Forest regressors._

This is... not plausible. Effectively, they're trying to infer causality here, not merely do prediction. That has to be the case, because this is presented as useful advice---to go ahead and apply even if you don't meet all the listed qualifications. But when you're trying to infer causality you're doing social science, not data science, and that means you need to worry about omitted variables.

Here's an example: what if less qualified people who nonetheless apply are more confident. And what if that confidence is associated with other good things that show up on resumes, like attending prestigious schools, having had prestigious prior jobs, having a record of success in some other fashion, or even just doing things like paying careful attention to formatting?

This is why social scientists use tried and true techniques like old fashioned OLS regression with control variables rather than throw everything into a random forest and see if the hypothesized association standing on its own predicts things.

(Insert remark about how companies should be hiring data science people with science backgrounds rather than just pure cs backgrounds here)

<comment><USER7> Very well put, I agree completely. The absence of controls in their model for school, education, experience etc. means we cannot draw definitive conclusions from their analysis.

Another commenter also pointed out the fit curve. Note the wide prediction intervals starting at ~40% and frequency of points across all charts. It's hard to draw conclusions above that cutoff, since outcomes vary significantly and high-matchers are scarce. This may also be a failure of the "proprietary" qualification-extracting algorithms.

Most applicants also seemingly interview at a <10% rate, and the data in general looks fishy. I know they sampled from ~6,300 applications, but the joint distribution of matches & interviews seems bimodal: either you barely match and barely interview, or you greatly match and interview far more often.

Weird, weird post. It should be titled "we rarely see > 50% match in job requirements, which either says something about applicants _or_ our proprietary algorithms."

</comment></comment><comment><USER8> I think many people write their job description's requirements, as if it were the opening stage of a negotiation. You list everything you want as if it were a requirement, and you will only get about half of that. But the problem is, it isn't a negotiation, it's a minimum spec (especially if you put the word "required" next to that line), and so many quite good candidates won't apply.

However, typically, I see 20-30 requirements, many of which (e.g. "passionate about software development", "good communicator") aren't specific enough to tell the candidate whether they are a good match or not (do poor communicators know they are poor communicators?). Of the rest, really only 2 or 3 are actual requirements, and the candidate has to guess which those are.

<comment><USER9> _so many quite good candidates won 't apply._

Shame on someone for writing unrealistic or unnecessary "requirements", but also shame on the engineer who doesn't even _apply_ because of them.

I wonder how truly good a candidate is if they get discouraged so easily. Maybe a hidden requirement 1 is showing a willingness to try to punch above one's weight or displaying some self confidence during the application process. After all, what's really the difference between 4 years of development experience in X language vs 5?

<comment><USER10> I don't want to waste my own time on an activity I actively despise.

I am perfectly willing to apply to a posting with missing requirements, right up until I have to create an account to apply, chop up my resume into pieces, and paste the bits into form boxes. That's when I say, "screw this, it wasn't a close match anyway".

If the application process is "attach resume document to an email" then I might even spend some extra time on the cover email, explaining why am applying without being a 100% match for the requirements.

The difference is the expectation of a payoff. That application management system is going to automatically filter out mismatches, and making me do all the work to disqualify myself as a candidate. The email _might_ get read by an actual person with an interest in the outcome.

</comment></comment></comment><comment><USER11> [https://dilbert.com/strip/2008-03-01](https://dilbert.com/strip/2008-03-01)

I'm not a fan of HR in general and it's frustrating that they are often the clueless gatekeepers.

<comment><USER12> Sometimes it isn't even an HR person. A computer will scan your resume and if you don't match enough keywords a person won't even read it.

<comment><USER13> This is bad too (in its current state of sophistication) but I still think it's better than having some HR generalist with 6 months on the job and no technical knowledge scanning resumes before anyone who knows what they're doing gets to them.

At least if you know your resume will be scanned by a computer before-hand you can optimize for that. It's hard to optimize for a person with no skill-set.

The place I've worked with the best HR department realized that they didn't have any legitimate role in determining whether someone was fit for a _job_ , only whether or not they were fit for the _company_. So they'd handle the background checks, the reference checks, etc, usually after the phone screen and before the on-site interview. But they didn't have any say in who got the job other than vetoing candidates with company-wide disqualifying features.

<comment><USER14> HR has one other job that you might not realize: make sure that your hiring/interview process is legally fair. You better not interview in such a way to make it impossible for some types of otherwise qualified people to pass (female, black...) while others find it easy (males, white...).

<comment><USER11> Ha! Often times they do that poorly as well.

My boss at a company I worked for recently wanted to hire a guy that is living in Poland but is self-employed in the UK. The HR said to him, literally, "we can't hire him because we don't know the implications of working with someone incorporated out-of-country". Yeah, not like it was their job to find out. That would be hard, could cut into their water cooler gossip time, no way!

<comment><USER14> I don't know the legal system in the UK, but my guess is that what you describe is not illegal. I would agree HR is lazy for not to find out, but they have still done their job with respect to my post since nothing illegal happened.

</comment></comment></comment></comment></comment></comment><comment><USER15> Perhaps companies over-list requirements because everyone knows requirements are not ANDed together. There is a scoring scheme that combines all of these, and the quality of the requirement.

And let's be honest having spent "5 years of Python" at a Google is a different story from having spent "5 years of Python" at an Infosys.

To be honest, I've never seen a job description that exactly lays out what you're going to be doing. And the reason for that is that hiring software engineers, you don't actually know. You want them to also come up with what the future looks like.

<comment><USER16> > And let's be honest "5 years of Python" at a Google is a different story > from "5 years of Python" at an Infosys.

I don't think I've ever seen an ad from Google that spells out years of experience in any given technology. Their requirements are incredibly terse, usually along the lines of 'BS/BA in Computer Science or equivalent, experience in some programming language'.

<comment><USER17> I read that a different way. I understood it as an ad from Company X which lists '5 years of Python' as the requirement. Candidate 1 has 5 years of Python at Google, and Candidate 2 has 5 years Python at InfoSys.

<comment><USER18> Does the Google experience really teach one that much better? Or is it just perception?

I mean, at the end you are just a little cogwheel in some big corporation anyway. The python tasks you need to solve there are probably just as mundane as everywhere else.

<comment><USER19> It's the perception, I've personally been passed on for jobs I would have been amazing at because I don't have any FAANG experience.

Startup founders looking for VC money want to be able to add "Team of ex- Google, ..." to their pitch.

</comment></comment></comment></comment></comment><comment><USER20> re-post of my earlier post:

> _I 'm not sure why companies over-list [job requirements]_.

It's not companies, it's the individuals.

Consider this: in a corporate environment, a person that is responsible for hiring but that is _not_ a stakeholder in the success of any particular project, is incentivized to prove that:

      - she or he made an effort ("I've posted N ads on top ten websites")
      - she or he didn't cause any particularly bad hires

The first incentive favors cookie-cutter hiring requirement lists and ads, in the "nobody ever gets fired for buying IBM" sense. Copy-paste an ad from a different project, adjust a few minor points, file it away.

The second incentive favors over-specifying requirements, in the hopes that no particularly bad hire will be made and then blamed on the requirements / ad author.

Suppose for a second a hiring manager or HR specialist were told by project stakeholders "certification X and skill Y are requirements", but figured out they aren't actually key to success - perhaps learning on the job would work out just fine in this case. So our brave hiring manager or HR specialist puts the certification and the skill in the "nice to have" section instead. Now suppose a candidate hired without the certification or skill ended up disappointing and underachieving. The manager or HR specialist would shoulder the blame for not filtering the hires well enough. Thus they play it safe and over-specify.

It doesn't help that there's a persistent, lingering narrative[1] in the press that pretty much all the skilled specialists are in high demand and in very short supply on the job market. This provides a cover for anybody who failed to attract candidates due to over-specified requirements - "the specialists are in short supply anyway".

Source: having been doing guerilla-style hiring with carefully redacted ads for a long while, with repeatably good results.

\--

[1] the narrative seems mostly created by the prospective employers in hopes of driving the worker supply up, and thus prevailing wages down

<comment><USER21> Really well put from the corporate perspective

I'll give a perspective from a small company: boss is doing hiring, asks what tech we use, try to explain that I don't care if they know React, if they've used Vue/Angular/FooBar4Ui2038, good enough. Then some explanation that we should put specific tech to attract people with that specifically, & we can select for people who have tangent experience. In the end we hired some guy with experience with Ruby on Rails (we don't use any Ruby, PHP/C#/Nodejs)

<comment><USER20> Thanks for the anecdote, your company sounds like a pretty cool place to live given its openness to learn at work.

> _from the corporate perspective_

Aside of a brief stint at 15k-large corporation years ago, my customers tend to be small & medium sized businesses (10...100 employees). They seem to suffer from the "corporate-like" cookie-cutter hiring practices just as well.

</comment></comment></comment><comment><USER22> Heh, I think most autodidacts have discovered this independently. I'm a Physics-Major dropout, and have managed to find jobs in big brand-name companies that have "strict requirements" for a degree. Now, it's led to a level of imposter syndrome (I've posted about it on HN before), but at the same time, it demonstrates that these "requirements" are more "strong preferences".

Sadly, it does seem like the research-oriented jobs aren't BSing about their requirements; when I've tried to apply to MS Research and the like, they've always declined me due to lack of credentials, since the postings usually require at least a masters, preferably a PhD.

<comment><USER23> > Now, it's led to a level of imposter syndrome

I challenge that what you're feeling is imposter syndrome in this case. I posit it's the realization that at the next economic downturn, should you find yourself out of work and the landscape for being hired is more competitive, you are at a strategic disadvantage.

Upward mobility into Director/VP roles is also quite limited without a degree, even though a degree in CompSci has little to do with running a business.

<comment><USER22> I don't particularly worry about that stuff, honestly. It's more of a feeling of "I don't feel like I deserve this level of success when I didn't go through the proper steps".

I also don't have much interest in management/directing, though your statement probably applies to individual contributor roles.

<comment><USER23> > I also don't have much interest in management/directing, though your > statement probably applies to individual contributor roles.

Interest aside, being qualified for those types of roles would raise the bar for salaries for individual contributors because both types of positions are competing for the same finite labor pool.

> It's more of a feeling of "I don't feel like I deserve this level of success > when I didn't go through the proper steps".

The question, IMO, is whether or not an employer will feel the same way about you at some point in the future.

I think this applies to those who have a degree as well. Ivy league school vs state school. #1 ranked school vs #2. It's all relative, I suppose.

</comment></comment></comment></comment><comment><USER24> It's interesting how women seem to get interviews when matching fewer of the job requirements than men. Might be worth looking into whether this is due to gender discrimination in recruiting, or if women just apply to jobs that are a better fit, regardless of job requirements.

<comment><USER25> We are trying to hire at the moment and most of the resume we've received have been from men.... we'd like to interview some women....one of the good resume from a female is missing their email address.... in my book that would have been an automatic no but...since we need female candidates we tried calling them for an interview...

<comment><USER26> > since we need female candidates

May I ask why? Why does it matter if the candidate is male or female? Why not just hire the most fit candidates regardless of their gender and be done with it?

<comment><USER27>
       Why not just hire the most fit candidates regardless of their gender and be done with it?

Short answer, because you aren't actually capable of identifying them.

Longer: mostly because there is real value in team diversity, and it's almost impossible to remove your decision biases without actively addressing them. So if you identify a potential bias, it's not crazy to try and do something about it and see how that works for you.

<comment> 52-6F-62 There is a very real and pragmatic application for this very thing, specifically in AI work as identified by Fei-Fei Li:

[https://www.wired.com/story/fei-fei-li-artificial- intelligen...](https://www.wired.com/story/fei-fei-li-artificial-intelligence- humanity/)

edit: my phrasing wasn't very clear. I mean for having a team from a diverse makeup.

</comment></comment></comment></comment></comment><comment><USER28> I recently was involved in drafting a job posting that was extremely flexible. For example it didn't specify a particular programming language, just listed a few and said "or other similar languages".

However the essence of the posting was clearly for a programmer. Significantly more than half the people that applied were not programmers. We saw some resumes from seemingly quite accomplished statisticians but we were not looking for a statistician (or "data scientist").

So I think _which_ 50% matters. If someone is a self starter and has great communication skills but can't program she isn't going to be hired as a programmer.

</comment><comment> GuB-42 A recruiter once told me "we ask for God in person, hoping for a prophet, we are happy when we get the followers".

<comment><USER29> That's a good way to get the worse part of developers divided by their Dunnin- Kruger score.

<comment><USER30> I think that Dunning-Kruger effect in interviews is a very real problem going the other way too.

I worry that the questions that I only ask questions of candidates that I think are important and that I already know the answer too.

If you're looking for good hires you're going to want people who know stuff you don't and finding that out is tricky because of the Dunning-Kruger effect.

</comment></comment></comment><comment><USER31> Unfortunately in Bay Area and specially at FAANG you need 0% of job "Requirements" on your resume as they will leetcode the shit out of you in the interview without asking one relevant question pertaining to your resume or even to the actual job. One of the reason given for this is that the stack used at these companies is completely homegrown so your experience using framework $X for $Y years has no relevance

</comment><comment><USER32> Someone I know applied for a designer AND front end dev position at a startup. He went through multiple rounds plus a project. This describes my friend:

\- super passionate (paying customer for while) about the product

\- great designer with a few years of experience

\- degree in CS from a reputed school

\- picked up react recently

\- few years of work experience doing design and coding

He got turned down by the startup with the excuse that they would like someone more senior who has worked on a product like Facebook. I could just smh because from everything I know, if you are senior and worked at fb, you are unlikely to be (or want to be!) an AMAZING designer AND front-end dev.

</comment><comment><USER33> Recently I've seen a lot more job ads with minimal technical requirements and rather a focus on more generic skills.

That's good but please, if you aren't Google or Facebook, don't take it to the other extreme. If I have _no idea_ about your tech stack I'm not going to apply, and the same probably holds true for a lot of experienced developers.

</comment><comment><USER34> I've noticed that smaller companies tend to fill their job requirements section with tons of stuff, larger companies do it less, or at least separate things into must-have and nice-to-have sections. Yet there are others who still have words like Flash Development, Macromedia and Dreamweaver in their list of requirements.

If you're looking for a job, just keep applying and don't stop till you actually have an offer letter in hand. Don't wait for the employer or recruiter to send you feedback after a promising interview. There are SO MANY reasons a company might decide to go for someone else. For example, culture fit, which sometimes means "will this person stop everything and play foosball with us in the middle of the day?"

</comment><comment><USER35> This data is weirdly bucketed and the fit curve looks sketchy. I don't think it's a robust finding and I don't trust it.

Doesn't seem to have stopped a lot of people confirming their anecdotes though.

</comment><comment><USER36> I find that very frustrating. When a person is looking for a job he or she is stressed out already, and when reading all those huge qualification criteria you sometimes really feel like a total loser, not knowing anything at all. It's really important to still try and send a CV and go to an interview with a positive attitude, willing to learn that is. But I'd really like to see some reasonable hiring criteria, so you can know for sure that you have what they're looking for.

</comment><comment><USER37> That does match up with my job search I just completed. I sent out 5 resumes, got an interview on every one where I had a majority of the qualifications, did not get called on the 2 that were more off-target.

But I'm not sure that the sales pitch this article is trying to make is valid. They claim at the end that they'll get you 5.8x more interviews. But is that good? In my 3 interview processes, they each brought to light reasons why it was not a match in one or both directions. The article even touched on that, as candidates will self-screen out of jobs that aren't quite right. It would have been a huge waste of time to expand that to 10-12 interview processes that were not matches. Especially when I didn't end up taking a job even from the ones that went well, and re-joined an old team instead.

The screening that happens in the hiring process can feel frustrating when you really need a job, but I appreciate being screened out when it would not have worked anyway. It saves everyone time, and hopefully puts me in a healthy long-term role that will last for years.

<comment><USER38> On the other hand, you keep doing what you're already doing.

I have a really high ratio of interview / job offers, but that's because I choose to apply for jobs where I had nearly 100% of the requirements.

I think this was a mistake. I should have taken more risks, try to apply for more challenging jobs that aren't completely in my comfort zone.

<comment><USER23> My strategy has been to take a new position that is a good fit for my current skill set and allows me to grow in the direction I'd like to move. Coming from the linux side of the house, I wanted to move more into software engineering. Each job hop moved me into more and more software development-centric roles.

Fortunately for me, it's usually meant an increase in pay as well, though I didn't maximize pay at each hop. I could have been paid more at different firms I declined during each move, the position responsibilities were always key for me.

</comment></comment></comment><comment><USER39> Wondering if there is a corpus of "stop-phrases" like stop-words which will include gems like "passionate about software development", "good communicator", "truth-seeker" and the likes.

It might be interesting to do a basic pre-processing of the JD to remove all such stop-phrases before evaluating the role being offered.

</comment><comment><USER40> In my experience, unless you meet all of the requirements in the req, and substantially exceed a few of them, you will probably be passed over for a candidate with "more experience in technology X".

Not that I apply for jobs to get jobs, not to get interviews. Getting called in to interview means next to nothing.

</comment><comment><USER41> "They're more what you'd call 'guidelines.'"

</comment><comment><USER42> As someone who hires for technical roles, I tend to profile the roles into a 5 X 5 grid. 5 core areas of proficiency, 5 levels of proficiency. a proficiency of 4 across the board is uncommon.

If I can find a 5, 4, 4, 3, 2 of combination of that, I'm happy. That's about 70%. That sort of profile should also provide learning opportunities for the candidate and typical that is intrinsically motivating for technical types.

</comment><comment><USER43> Unless HR prescreens all the applicants before they make it to staff, then you need 200%, or 0%. Sometimes it's rather frustrating working for bigcorp.

</comment><comment><USER44> The most interesting thing was 12% interview rate - is that normal? I was discouraged when getting 20% rates, maybe I need to apply to more stuff.

<comment><USER45> I think it's pretty dependent on your application strategy. Some people are fairly R-selected in their strategy. Large number of applications, but little customization of resumes for each job and no cover letter. Others are more k selected, they'll write good cover letters and change up their resume to better highlight relevant experience.

</comment></comment><comment><USER46> Most important job requirement - get a warm introduction to the HR / Hiring Manager via an existing employee of the company!

</comment><comment><USER47> A lot of job descriptions are written overly precise to specifically include or exclude internal candidates.

</comment><comment><USER48> Could be, but what if the requirements you're missing are supposedly essential for the job? Some jobs say you need to know X programming language. What if you're a good programmer but haven't worked with that particular language? Should you bother to apply?

<comment><USER49> I did, and it worked out fine for me. However the languages are a bit similar. I went from C# to Java. I was upfront with it, and showed my eagerness to learn and develop.

They did only give me a 1-year contract, and a stipulation to get some Oracle cert but did support me throughout. Now that I've shown them that I can adapt (be productive/billable, and got the certs done) they offered me a permanent contract (indefinite period of time).

So yes, bother to apply. But put the work in to show them you can adapt.

</comment></comment><comment><USER50> My last job hunt resulted in a 12% success rate of getting an interview, which matches well with this data.

</comment><comment><USER51> You can eliminate all kinds of selective bias and incompetence by first filtering candidates based upon a battery of personality tests. You don't have to know anything about the candidates until this pass through the initial filter.

<comment><USER52> Aside from personal experience, can you point to any data on this, and maybe go into some more detail?

When I think of personality tests, I think of quack science. "Do you get angry a lot?", "Is it easy for you to get angry?", "Would you say it is difficult to make you angry?, and four other similar questions in a 200 question quiz. They ask the same thing multiple ways to try to know if you are an person categorizable as x, y, and/or z, and anyone sensible will put the socially desired response.

An interesting take on this is CultureAmp's surveys, where they determine your working style and can rate how well you might work with different colleagues. I work great with someone I scored a 98 with. Turns out I also work great with a person I scored a 4 with. So, while fun, it seems all bunk.

<comment><USER53> By the 5th time you see the question, you're fuming so you shout, "YES! I ANGER EASILY!!!!"

Ahem... Sorry.

I worked at a place that was bought out and the new team immediately made everyone take a battery of these style tests. A few days later they did a mass firing based on the results. I survived long enough to find work elsewhere.

<comment><USER54> Firing based on test results sounds illegal. Same reason why employers can't give iq tests to candidates anymore IIRC.

<comment><USER55> I assume that you're in USA as you don't say, what law prohibits it? Any insight on the rationale?

Presumably it is not illegal to require a particular educational level or particular certificate pass which are likely to be close proxies for an "IQ" test result?

<comment><USER54> Not in the US myself, but this is a US discussion: [https://news.ycombinator.com/item?id=3772897](https://news.ycombinator.com/item?id=3772897)

While technically not always illegal, giving an IQ test is a minefield for HR and that's why almost everyone avoids it. It all boils down to whether it is required for the job or not, and whether it would discriminate against someone who could otherwise do the job but fail the test.</comment></comment></comment></comment></comment></comment>


X Minus One Archive - <AUTHOR> https://archive.org/details/OTRR_X_Minus_One_Singles/XMinusOne56-05-15051HallucinationOrbit.mp3 <comment><AUTHOR> I grew up in the early 90s listening to the old time radio broadcast on the weekends coming out of University of Florida. Some great stories from big names in here; you'll definitely find the inspiration for man modern films and stories in the SciFi genre here.

P.S. Most audio isn't loading in Chrome for some reason; use Safari, Edge, etc.</comment>


The Story of a 6-CPU Server from 1997 - <AUTHOR> http://www.cpushack.com/2019/01/12/mini-mainframe-at-home-the-story-of-a-6-cpu-server-from-1997/ <comment><USER2> I have an unexplainable fascination with that CPU too. A couple years ago I picked up an old workstation with two PPro 200 (256k). The 168pin EDO RAM is very hard to come by these days, especially as the manual says my machine accepts unbuffered RAM only, and most EDORAM listings on ebay back then didn't even bother say whether they are or not.

I've read elsewhere that Pentium Pros have been bought up left and right during the last decade or so since they have a lot of gold content, which is kind of sad from a nerd's perspective. I'd like to have a matching pair of the 1MB model, but they're super rare and crazy expensive if they pop up at all. The 512k ones are still available, but most sellers nowadays advertise these CPUs for their gold content, so they don't bother to list details like the stepping, which you'd want to know if you're building an SMP system.

Regarding the article, it was a great read, although I couldn't really understand why they were going for Win2003 instead of Win2000. Getting it to work seemed to take several months; finding older versions of the software you'd want to run sounds like a much simpler solution, just like they mentioned for WinRAR. I guess it was one of these "because I can" decisions. :-)

</comment><comment><USER3> I remember my great excitement of receiving a pair of matched pentium pro processors (200mhz!) as a gift from a group at intel (I worked tirelessly for one of the vendors that group was using at the time). I purchased a dual p-pro motherboard and fired it up.

it was pretty impressive for the time, especially as a home machine, but it wasn't until virtualization became mainstream that something like that really became useful for me. it ended up running my web servers, mail, and mailing lists for quite a while, but was eventually retired for an e250.

</comment><comment><USER4> Related discussion [1]

        Mini-Mainframe at Home: A 6-CPU Server from 1997 (cpushack.com)
        20 points by protomyth 16 hours ago | 9 comments

[1] [https://news.ycombinator.com/item?id=18893415](https://news.ycombinator.com/item?id=18893415)

</comment><comment><USER5> The general architecture for dual socket Pentium Pro CPUs was also reused with minor upgrades/modifications for the first generation of slot mounted Xeons (actually just relabeled Pentium 2 CPUs sold at a higher price).

If I recall correctly the Intel 440FX northbridge chipset on the motherboards supported either dual P-Pro or dual P2.

[https://en.wikipedia.org/wiki/Intel_440FX](https://en.wikipedia.org/wiki/Intel_440FX)

[https://en.wikipedia.org/wiki/Pentium_II#Klamath](https://en.wikipedia.org/wiki/Pentium_II#Klamath)

<comment><USER6> PII Xeons were not relabeled PII's. They had a full speed cache bus while the PII had a half speed one.

</comment></comment><comment><USER7> Kind of tangential, but the title and premise reminded me of an earlier x86 SMP platform: [https://en.wikipedia.org/wiki/Sequent_Computer_Systems#Symme...](https://en.wikipedia.org/wiki/Sequent_Computer_Systems#Symmetry)

<comment><USER3> Sequent was awesome, but damn if I didn't hate their OS's, they reminded me too much of Domain/OS. They were acquired by IBM a while back, and their HQ is now Nike. The OSDL was based in one of the old Sequent data centers for a while, and it managed to bring on a few Sequent kernel developers to help remove kernel locks throughout linux.</comment></comment>


Exploit broker Zerodium ups the ante with $500k to target Signal and WhatsApp - <AUTHOR> https://arstechnica.com/information-technology/2017/08/wanted-weaponized-exploits-that-hack-phones-will-pay-top-dollar/ <comment><USER2> Not just Signal & WhatsApp,

$500,000 - Messaging Apps RCE + LPE (SMS/MMS, iMessage, Telegram, WhatsApp, Signal, Facebook, Viber, WeChat) .

Which I guess chat apps with > 250M MAU (except Telegram, which probably is because of it's high usage rate in Arab countries). Looking at their programme, they might probably approach the original vendor; but we all know who would pay hard cash for 0 days ;)

Original Source : [https://zerodium.com/program.html](https://zerodium.com/program.html)

<comment><USER3> Strange that they would pay the same money for an iMessage or Viber exploit. Those have very little market penetration compared to WhatsApp it's 90%+ (!)

<comment><USER4> It's the countries that they are big in that probably make them think this way.

For example, Viber is very popular in the Middle East, Russia, Africa, India, parts of Asia, Ukraine, Balkans, some of the 'Stans.

</comment></comment></comment><comment><USER5> Say a company buys and sells insider trading information... Would it be legal?

So why is buying/selling 0 days OK?

Both are selling information that _will_ be used wrongly in the wrong hands, the kind of information you don't want a "broker" to know about, the kind of information you don't want a broker to find clients for.

And if there's only one potential buyer (the target), they're basically black mailing 0 days targets: "become a client or... who knows what will happen... maybe the NSA or hackers will buy it?"

<comment><USER6> You are confusing two things. Buying/selling "insider info" (i.e. material non public info) is not illegal. Acting on such info CAN be illegal under certain circumstances, but even that is super difficult to prove. Why would buying/selling 0days be any different? It's the usage that determines legality. Why should buying an exploit to permit jailbreaking be illegal? Or to permit unlocking a device (presuming local laws allow).

<comment><USER7> _> Buying/selling "insider info" (i.e. material non public info) is not illegal._

I doubt that. If I had non-public information that could materially impact the price of a company's stock, I would not expect to get away with selling that information to anonymous buyers via some shady broker.

<comment><USER6> You should look at some of the recent failed insider trading prosecutions. If you sell the info and expect someone to trade on it, and thus you are benefiting from ill-gotten gains, then they MIGHT be able to prove conspiracy. My point is that if you have MNPI and I pay you for it, and that's the end of it, well that's not illegal. It may be a civil violation due to NDA or something, but that's different.

<comment><USER7> I can imagine that what you're saying is true if there was no danger to the public.

But if someone were to trade on the knowledge that a supplier had delivered faulty airbags to an auto manufacturer without telling that manufacturer, I doubt this would be looked at kindly by the courts.

But I agree that the metaphor is not ideal. Selling 0day exploits to that broker is much worse. Any seller would have to have a reasonable expectation of aiding organised crime or terrorism.

</comment></comment></comment></comment></comment><comment><USER8> I wonder if there's a way to use civil legal proceedings to punish these exploit-trading firms. Maybe class action lawsuit representing victims of these exploits.

<comment><USER9> The government is gonna shutdown its own favorite means of acquiring 0days?

<comment><USER10> Well, be that as it may, but the judiciary is generally independent. Inferring political meddling in courts is a rather speculative territory.

</comment></comment></comment><comment><USER11> Firefox/TOR LCE+SBX on Linux: 100k

Chrome LCE+SBX on Linux: 80k

Interesting.

<comment><USER12> Yeah... I recently uncovered a way to bypass the tor browser bundle proxy on some linux flavors [0]. Unfortunately, The bounty from the tor project isn't nearly as much[1], but at least I can sleep at night.

[0] [https://blog.torproject.org/blog/tor- browser-703-released](https://blog.torproject.org/blog/tor- browser-703-released)

[1] [https://hackerone.com/torproject](https://hackerone.com/torproject)

<comment><USER13> Good job!

If it's not a secret, how much did they pay to you? Seems like this could be considered, at least, a medium severity, and the top bounty they gave so far is only $500. If you don't wanna disclose that, that's perfectly understandable. I'm just curious.

<comment><USER12> I haven't received a payment yet actually -- it is still pending.

</comment></comment></comment></comment><comment><USER14> I expect two factor authentication over cellular networks (SMS and voice callbacks) to be commonly exploited in a year. Orgs really need to force OATH (HOTP, TOTP) and FIDO (U2F, UAF) and begin transitioning away from cellular two factor.

<comment><USER15> The problem that I haven't seen a good answer to, is what happens when (not if) the customer loses their 2nd factor device? If someone loses their phone, they can still keep their same number and receive an SMS verification on their new phone. With OATH/FIDO, that won't happen.

</comment></comment><comment><USER16> If I was WhatsApp I would offer a larger bounty. If they get the 0 day they could fix it before it gets into the wrong hands. I would think 500k is a drop in a bucket for them, and give them good press that they are actively keeping up with privacy/security of their users

<comment><USER7> If I was WhatsApp, I would offer to compensate those who have found the exploit for their work. If someone else buys the exploit I would sue the broker for extortion.

<comment><USER17> _If I was WhatsApp, I would offer to compensate those who have found the exploit for their work._

Sure, their rate is $1 million an hour :).

I could see the government jump in and pressing charges but the worst thing Whats-app can do is piss them off.

</comment></comment></comment><comment><USER18> Interestingly, I don't see a payout linked to Zerodium directly. What happens if someone they do business with decides they can just grab the keys to the castle directly? I wonder if they'd bargain, or just set another bounty on the individual or group in question.

</comment><comment><USER19> Wish someone will offer a bounty to target Zerodium.

</comment><comment><USER20> What a world we live in. I wish humanity made this turn out differently, where digital privacy was a human right, not something worth $100k.

<comment><USER21> I'm not sure this isn't a "good thing", to some degree. Companies like Apple and Google offer rewards for people who find exploits in their software, but they have little incentive to raise the reward even as the exploits become more and more rare, and demand more time to find. This may give them the false impression that there are no more exploits, while in reality they just haven't incentivized people sufficiently. This company operates on the other side (of which I don't approve), but by pricing exploits more accurately (via supply and demand), it forces companies to raise their prices as well to compete.

In other words, this can be seen as part of the free market incentivizing people and companies to find and patch exploits, or for programmers to just write safer code in general.

<comment><USER22> Couldn't the same argument be made about a thriving market in ways to break into your house at night and kill you?

<comment><USER23> If your home has 250 mill people using it a month, probably.

<comment><USER24> More like... 250m people use a given brand of lock.

<comment><USER25> I wouldn't trust a lock that doesn't have a $500K bounty offered for exploits.

<comment><USER26> So what do you use at your house? Watching the lock pick village videos from defcon made me realize that there are no perfect locks.

<comment><USER25> I use a cheap lock and don't expect it to hold up against any but the most lazy attacks. I don't _trust_ it.</comment></comment></comment></comment></comment></comment></comment></comment>