Stanford dumps java as intro language - <AUTHOR> https://www.neowin.net/news/stanford-university-dumps-java-as-an-introductory-programming-language <comment><USER2> I've TA'd all of Stanford's intro programming classes, including the first course in programming CS 106A, so a few things:

\- unlike a lot of other schools, CS 106A is mostly taken by non-majors (90-something percent of undergrads take at least one CS course before graduation, and for non-majors that means 106A)

\- the follow up course, 106B, is in C++ and focuses on OOP, pointers, memory, data structures, etc.

\- 106J was crafted as a replacement for 106A by in JS. It had limited enrollment, and word on the street is 106J's first offering this past spring was an experiment and it didn't go all that well, so who's to say if it'll still be around next year.

Maybe they should switch from Java to something hipster and trendy, but there's about 10+ years worth of assignments that will need to be rewritten, including autograding infrastructure for the 600-800 people who take it every quarter.

I personally feel like JS is an awful language with few opinions or guard rails, and thus a bad language to teach people who are looking for programming principles. It works for the web but I think for a course almost entirely consisting of non-majors it's not a good first language.

<comment><USER3> Thanks for the insight. With your experience, what would be a good language for non-majors so that they can make use of their experience later? Python, Go, C?

<comment><USER4> I would definitely say Haskell. Second is python, but i feel Haskell teaches concepts better and more efficiently. Everybody has used spreadsheets before, and I think most people can draw a m mental link to spreadsheets with Haskell.

<comment><USER5> That's completely out of the question at the moment. True, it could potentially be most useful to know haskell for a lot of programmers, but at the moment, the opportunities to use haskell in the work place are actually rare and not to a small part because an understanding of haskell is barely achievable in an introductory semester, while the steep learning-curve of the language is kind of intended as it's usefulness only really plays out at a higher complexity. Whereas, python has a focus on scripts, shortness and quickness are even symbolized in it's name. Script languages with introspection and reflection are best suited for REPL, especially with good integrated documentation.

Javascript in the browser suffers at that because it's _opinionated_ towards web, but OP sees that as a plus and web programming certainly is an applicable skill with a future. Not everyone would have to use facebook as homepage, for example

<comment><USER6> Haskell used to be the introductory language at UT Austin a few years ago IIRC. So it's been done before.

The point of an introductory programming class is not to teach a language for vocational purposes, but to teach the basics of computation. Someone who understands computation can reasonably be expected to pick up most languages.

</comment></comment></comment></comment></comment><comment><USER7> I'd say Python would've been the 'safe' and 'sane' choice, but maybe it's just my bias against Java and JavaScript talking.

Just curious, has anyone ever heard off choosing to teach something like bash / PowerShell? It might seem less intimidating than downloading a lot of stuff and students can play around with stuff already in their computer. Hell, maybe even something like VBA (as much we might dislike it) since non-majors will likely encounter it in MS Office anyway.

<comment><USER3> In the department I work, 5 people recently started using Python who never wrote a line of code before (except some limited VBA).

While the coding itself was relatively smooth, we spent a majority of our time consolidation which Python version works with which packages and how to create code that can be executed by computers that use Python 2 vs Python 3. Some people had to use packages that only worked with P2, others only worked with P3.

There's still not really a solution for this. We'll probably just switch to Julia once it gets enough support in areas we need..

So I disagree, Python is actually not a good language for beginners. The language is great but the ecosystem can be extremely frustrating.

<comment><USER8> The mistake here is not just making a choice but instead having people pick at random. Hardly pythons fault, every programming language has multiple incompatible versions.

</comment></comment></comment><comment><USER9> I went to a completely unranked school, not even a CS major. But took Programming I anyway. It was for freshmen, and was in C++.

IMO, for an intro language, you need either something close to the metal, so that students can work their way up the abstraction chain, or something very high-level with flexible constructs if it's desired to teach things from the algorithmic level.

I also think that any dynamically typed language is a bad choice for a first language. We're all used to holding the types in our heads, but beginning programmers don't even know what they are, and it's a really core construct.

<comment><USER10> Disagree, I think it is the exact opposite. I say that as someone who did their CS education in the early 90s when that _was_ the case. We used C for everything unless the class material implied something else. We got into the down and dirty details quite fast.

IMO that's the wrong way to do it. Using myself as an example it took me far longer to learn things like data structures than it should have. Why? Because I still hadn't wrapped my head around pointers. The fact that the two are coupled is an implementation detail IMO. It turned out that I never had a problem understanding the structures, I had trouble writing code which didn't segfault.

I'd prefer to see CS education start with the more theoretical constructs and then start diving towards the metal as the basic concepts are known. In other words, treat it more like computer science and less like computer engineering.

<comment><USER11> I keep hearing that people have (or had) trouble understanding pointers. As someone who has never had that problem or met such a person, I am struggling to understand why...

<comment><USER12> It's not so much as trouble with pointers as trouble with visualizing algorithms and data structures. Try implementing some moderately complex one in C. It reads like a monster. A dynamic language like Python would have a simpler implementation but at the cost of performance (Why do beginners need performance).

<comment><USER10> This is more or less what I was getting at. Do these things in a simplified language first and then drop down

</comment></comment></comment></comment></comment><comment><USER13> I am really curious if this actually makes things better..Maybe I am just getting old..

But this seems like everything else. Let's dumb it down so people can get it. But if you really want to be a programmer, you will get it. You will spend hours debugging and feeling like you know nothing. That is what makes you grow.

On the other hand....I ran into some Senior CS students who were incapable of programming in javascript...so...maybe it is not so bad.

<comment><USER9> I read this more as a nod to the fact that Stanford is the feeder school for SV. And pretty much all SV churns out these days is webapps.

Javascript is just a very mediocre language in virtually every way. There is only one thing it's good at, webapps, and it's only good at that by virtue of the fact that it's the only game in town for complicated front-end stuff.

The only thing that could be said in Javascript's favor as a teaching language is that it has basically no standard library, so teaching the entirety of the language can be done quickly.

</comment></comment><comment><USER14> I'm sure I'm biased, but I'm a huge fan of how they taught our first two semesters where I went to school. Semester 1 freshman year was imperative programming in C (learning pointers, bits, the stack and heap, memory, ...). Semester 2 was functional programming in SML (learning recursion, types, function composition, formal reasoning, ...).

When it comes to other programming language features, there are few that can't be understood as some combination of imperative and functional features. Introducing them freshman year, students take these lessons with them to every subsequent language they learn.

</comment><comment><USER15> I teach at Stanford though not in CS. I think this headline is a bit off. There is a CS 106J class that follows the CS 106A curriculum using JS instead of Java, but as far as I know, the CS 106A Java curriculum has not been tossed out for the academic calendar of 2017-2018 (syllabuses aren't up yet, so I can't confirm).

As the article states, CS 106J was spearheaded by Professor Roberts this past year. I would imagine it'd take some more time for it to become a curriculum that all of the profs teach, though JS is being used in several other CS classes. For example, CS 142: Web Applications, used to be taught with Rails:

[https://web.stanford.edu/~ouster/cgi- bin/cs142-winter14/inde...](https://web.stanford.edu/~ouster/cgi- bin/cs142-winter14/index.php)

Now it's taught with MEAN (Mongo, Express, Angular, and Node): [http://web.stanford.edu/class/cs142/info.html](http://web.stanford.edu/class/cs142/info.html)

</comment><comment> charlie-r Students who start by learning Java will learn solid principals which may be applied to Javascript (or any other language).

Students who start by learning Javascript won't learn solid principals.

<comment><USER16> "Principles" not "principals".

Everything depends how the course is taught, not on the language used.

<comment><USER17> > Everything depends how the course is taught, not on the language used.

Usually this statements holds true, but not in this case. I mean, after all we are talking about language where `'0' == false` is `true`.

<comment><USER16> Every language with loose typing has some edge cases.

Once students know that JS has type coercion, and how to avoid this entire class of problems, they never need to know or think about what "0" == false evaluates to.

</comment></comment></comment></comment><comment><USER18> They could have chosen a thousand better languages for starters like Python or Ruby to mention some useful ones or Scheme for example which has literally no syntax. They chose an abomination instead. Now we'll have even more influx of javascript-only coder hussars who have never seen an ecosystem which is not rotten to the core. Congratulations.

</comment><comment><USER19> It's funnny how, when java first came out, everyone was writing applets and not doing a good job of it (incl myself). This was due to it being way easier to code and deploy as opposed to C/C++ at the time. This gave ppl the impression that java was slow, when in fact the code was terrible (and ms was constantly submarining sun).

Now I'm sitting here with 16GB of really terrible Javascript code running in my browser using 5% constantly of the fastest intel chip you can buy today. No one says it's slow probably because no one knows it's running.

If chrome and ff put a task in the process list with all the Javascript CPU usage I'm guessing things would be way different.

I really do think K&R C should be taught to university level students. It's important to understand pointers and mallocs, even if you don't use it often.

</comment><comment><USER20> Javascript, really? Why not Python?

<comment><USER21> How could you pass up an opportunity to use npm, browersify and webpack?

<comment><USER22> Compared to pip/pip3/conda/virtualenv, npm is very straightforward

<comment><USER21> Never heard of conda, and Python has been stable enough that I haven't (yet) ever uses virtualenv.

</comment></comment></comment></comment><comment><USER23> Honestly dropping Java or C++ as intro languages is fine imo... But why not something like Lisp, SML, or even Ruby...?

<comment><USER12> Or Haskell if you want to go the FP route while CL or Clojure for the Lisp. Or python for dynamic (atleast more popular than Ruby which is more concentrated on Rails ecosystem).

<comment><USER24> I don't like Python, but I have to admit that it ticks most of the boxes of an ideal starter programming language, unlike CL, Clojure, other Lisps, Ruby, or C/C++.</comment></comment></comment>


A Strategic Approach to Using Twitter - <AUTHOR> http://www.flickr.com/photos/27132029@N06/3022781883/sizes/o/ <comment><USER2> This mirrors a growing trend in social networks: they have become methods of publicity and popularity rather than places to just talk with friends.</comment>


Chanakya - <AUTHOR> https://en.wikipedia.org/wiki/Chanakya <comment><USER2> Many thousands of undiscovered manuscripts, invaluable to India's literary legacy, are rotting away as we speak. There is very little financial support for archeology or manuscriptology in India. So much has been lost already. And, of the estimated known 40 million manuscripts, no one is being trained to read and translate them! Opportunity for philanthropy?

[https://www.dailyo.in/arts/ancient-manuscripts-india- sanskri...](https://www.dailyo.in/arts/ancient-manuscripts-india-sanskrit- namami/story/1/17406.html)

[https://www.newindianexpress.com/thinkedu2020/2020/jan/08/hi...](https://www.newindianexpress.com/thinkedu2020/2020/jan/08/hidden- treasure-95-of-indias-ancient-manuscripts-yet-to-be-translated-says-bibek- debroy-2086890.html)

[https://namami.gov.in/manuscriptology- polygraphy](https://namami.gov.in/manuscriptology-polygraphy)

<comment><USER3> In recent decades, Hindutva forces have gained more and more political influence in India, and their rhetoric continually emphasizes that India is home to ancient Vedic wisdom unparalled in the world, and that Sanskrit is some kind of super-language handed down by the gods millions of years ago (instead of a codified form for sacramental use of an ordinary language spoken just a few thousand years ago). And yet, while many Indians are swelling with patriotic pride at their country's inheritance, actual classical philology is dying and largely done by interested foreigners. Not only are the manuscripts not being adequately studied within India, but deep practical knowledge of Sanskrit is dying out, too. Yes, of course you'll hear urban myths about whole villages speaking Sanskrit or whatever, but this is always huge exaggeration that gets perpetuated for decades.

<comment><USER2> > actual classical philology is dying. Not only are the manuscripts not being > adequately studied, but deep practical knowledge of Sanskrit is dying out, > too.

I've also heard that there is anger when non-Indian scholars study Sanskrit. Cambridge shut down their Sanskrit program, after 150 years. [https://www.insidehighered.com/news/2016/04/12/scholars- who-...](https://www.insidehighered.com/news/2016/04/12/scholars-who-study- hinduism-and-india-face-hostile-climate)

<comment><USER4> The reason for this anger is the fear of losing control of the narrative. By keeping the Sanskrit scriptures arcane, they can build their own narratives around it. But when scholars start studying those text, the cat will be out of the bag.

They may feel that it is harmful to the Hindutva interests when scholars write about the procedure for cow sacrifice mentioned in Yajur Veda or the racism and misogyny perpetuated by Manu Smriti or the Soma drinking revelry in Rigveda.

These efforts to stop others knowing these scriptures are happening since pre- historic times and even codified in Hindu Law.

Dharmasutra says "If he (Sudra) listens in on a vedic recitation, his ears shall be filled with molten tin or lac; if he repeats it, his tongue should be cut off; if he commits it to memory, his body should be split."[1]

Dharmasutra, written circa 600 BCE, is a book on Hindu Law and Sudra is the lowest class in the Varna system.

The ban on Wendy Doniger's book in India is a case in point.

References:

[1] [https://books.google.com/books?id=gnVxqvPg9a0C&q=lead#v=snip...](https://books.google.com/books?id=gnVxqvPg9a0C&q=lead#v=snippet&q=molten%20tin%20or%20lac&f=false)

[2] [https://www.sacred-texts.com/hin/manu/manu05.htm](https://www.sacred- texts.com/hin/manu/manu05.htm)

[3] [https://www.tribuneindia.com/news/archive/features/a-few- rea...](https://www.tribuneindia.com/news/archive/features/a-few-reasons-why- manu-smriti-was-burned-down-399546)

[4] [https://en.wikipedia.org/wiki/Wendy_Doniger](https://en.wikipedia.org/wiki/Wendy_Doniger)

<comment><USER5> Scholars studying Hindu texts is not offensive to Hindus. What is though, is the racist perversion that some of them like Doniger make.

Doniger's book is not "banned". It was withdrawn by the publisher - because it was offensive. Details in same wiki link.

Another such "scholar" wrote extremely offensive passage on Lord Ganesha and got away with it.[1] Hindus have tolerated abuse for so long and they continue to do so. Try letting cats out of the bag on Abrahmic religions.

[1] [https://hwpi.harvard.edu/pluralismarchive/news/hindu- student...](https://hwpi.harvard.edu/pluralismarchive/news/hindu-students- call-emory-professors-book-hate-crime)

</comment></comment></comment></comment></comment><comment><USER6> Other than his works, he was the prime minister in Maurya empire, credited with its rise. Maurya empire is considered to be one of the greatest Indian empires along with Guptas(known for progress in science, medicine) and Cholas(mercantile empire crossing oceans). It spread west upto present day Afghanistan at its peak. Maurya king Ashoka is quite famous because of this: [https://en.wikipedia.org/wiki/Ashoka#Kalinga_war_and_convers...](https://en.wikipedia.org/wiki/Ashoka#Kalinga_war_and_conversion_to_Buddhism)

<comment><AUTHOR> Interestingly enough he became politically active after India's defeat at the hands of Alexander the Great, and aided in creating an empire that unified the whole of India, which was unprecedented until then.

<comment><USER6> Is there any recommended reading you have on this? In general, all the foreign conquests that succeeded in India even later were when it was fragmented into smaller kingdoms.

<comment><USER7> Probably doesn't exist, since "India's defeat at the hands of Alexander" never happened.

He barely made it to the border of the largest empire in contemporary India, by geography. Even the parts of current Pakistan he conquered were nowhere near major powers in the subcontinent.

That was as far as he got before his army rebelled and forced him to abandon further conquest.

<comment><USER8> This is broadly true, though he did have an impressive victory at the Hydaspes and establish a series of vassal states in the Indian northwest (modern Pakistan). The historical consensus is that it's unlikely he would have succeeded in a Persian-esque conquest of the subcontinent.

</comment></comment></comment></comment></comment><comment><USER9> It's nice to see some Asian history for a change. In the west, it seems as we only have an interest in the historical narratives of Egypt, Greece, Rome, and Europe. Dense civilizations existed in South and East Asian stretching back thousands of years and our history classes and popular culture barely touch on them.

I'd love to see more pop culture(games, movies, etc) explore the history of what is now India, Thailand, Vietnam, etc.

<comment><USER6> I am assuming for games at least, the market in say India is not big enough that it can cover the cost of making something high budget. Once the market becomes bigger in terms of ability to spend, there might be more content. For example Japan, China have big enough markets and both have dedicated games in Total War series on parts of their history.

<comment><USER10> I would say things are starting to look good even for India. Check out Raji the game ,which imo is high quality and looks interesting. The gaming movement in India got a big boost after PUBG, COD, etc. but ofcourse it's still in a very nascent stage.

<comment><USER11> [https://themakoreactor.com/features/raji-an-ancient-epic- rel...](https://themakoreactor.com/features/raji-an-ancient-epic-release-date- made-in-india-nintendo-switch-game-development-pc-ps4-xbox-one-nodding-heads- interview/13628)

Interesting story!

</comment></comment></comment></comment><comment><USER2> Socrates reportedly met an Indian philosopher in Athens, according to Aristoxenus, student of Aristotle [1].

Some of Ashoka's pillars had Greek inscriptions [2]

Greece and India used to share borders. A Greek king became Buddhist. [2]

[1] [https://www.researchgate.net/publication/249942188_Some_Rema...](https://www.researchgate.net/publication/249942188_Some_Remarks_about_a_Meeting_between_Socrates_and_an_Indian_Aristoxenus'_fragment_53)

[2] [https://en.m.wikipedia.org/wiki/Greco- Buddhism](https://en.m.wikipedia.org/wiki/Greco-Buddhism)

<comment><USER12> There were lots of Greek speakers in India at the time. There was an Indo- Bactrian Greek kingdom in modern day Afghanistan and Pakistan long after the Greeks were conquered by the Romans (around 300 CE). A lot of early Buddhists were Greek. Lots of Indian statues have Greek style columns. I'm still mind blown by how connected the ancient world was.

</comment></comment><comment><USER13> For people interested in actually _studying_ Chanakya's writings (their sweep is magisterial), the following are recommended;

* The First Great Political Realist: Kautilya and His Arthashastra by Roger Boesche - A very good (and short) overview of the Arthashastra.

* King, Governance, and Law in Ancient India: Kautilya's Arthashastra translated by Patrick Olivelle - A good modern translation of the complete Arthashastra.

* Kautilya's Arthashastra: An Intellectual Portrait: The Classical Roots of Modern Politics in India by Subrata K. Mitra and Michael Liebic - A scholarly and challenging work on the relevance and applications of the Arthashastra.

<comment><USER14> Interesting to see sock puppets already in use.

</comment></comment><comment><USER15> The arthashastra is brilliant. Much older and far more Machiavellian than Machiavelli.

Highly recommended if you are interested in ancient thought

<comment><USER6> Is the english translation good enough or reading it in Sanskrit is recommended? If yes, any translation that you recommend?

<comment><USER13> You might find my comment in this thread listing some book recommendations, useful.

</comment></comment></comment><comment><USER16> TIL: That Chanakya's work was lost to history and was rediscovered in 1909. And the manuscripts that contained the treatise was donated to the scholars by a pandit from my home town (Tanjore or the modern Thanjavur). That drastically alters my sense of my own history. We knew of the big temple[1] circa 1000AD and all the scholarly thinking that went on around that time and the town has several UNESCO World Heritage sites from that period. But to house a script from circa 200 BCE, that is new to me.

[1] [https://en.wikipedia.org/wiki/Brihadisvara_Temple,_Thanjavur](https://en.wikipedia.org/wiki/Brihadisvara_Temple,_Thanjavur)

<comment><USER2> That's amazing. Just imagine what other manuscripts might be found in temples around India...

</comment></comment><comment><USER17> Casteism is an Organized mafia operating in South Asia since 700 BC [https://en.wikipedia.org/wiki/Rigveda](https://en.wikipedia.org/wiki/Rigveda) which is evident from the fact that 50% Ministers in Modi Cabinet are Brahmin while they are just 3% in India;

[https://www.quora.com/Which-caste-is-looting- India/answers/2...](https://www.quora.com/Which-caste-is-looting- India/answers/220938900)

</comment><comment><USER18> Neat, thanks for sharing. I'm currently in Chanakyapuri near Chandragupta Marg. I now understand the significance of those names a bit more.

<comment><USER19> Yes, we named the diplomatic enclave after Chanakya, following his advice of giving foreign missions palatial estates in exchange for tiny apartments.</comment></comment>


Regretting the Golden Handcuffs: Beware the Costs of Burnout - <AUTHOR> http://lyonheart.us/articles/regretting-the-golden-handcuffs/ <comment><USER3> This deserves every ounce of attention that it can get and I definitely know the feeling. I worked about as hard as I could for a little over a year to save a 15 year old company from going under. I was the only developer/infrastructure person because we couldn't hire anybody else since it looked like a sinking ship.

I worked 24/7 (with a wife and 2 kids) on this beastly mix of 10 year old Perl and very inexperienced Rails code. Despite the hours, I was excited because I thought this was THE big opportunity.

At my one year review, the owners told me I wasn't working hard enough. I went from a high point to a low point overnight. Wrestled with it for about a month. Then while I was riding in the car with my wife I got a snarky hipchat message from the owner of the company and showed it to my wife.

She looked right at me and said, "Quit. Don't worry about the money, we will figure it out. I don't want you working for people like that and it's obvious what it's doing to you."

So I resigned. Told them I'd stay on for 30 days for transition but that it just wasn't the right place for me. The weight off my shoulders from resigning was ENORMOUS.

For about 2 months I struggled with what to do. All the experience I'd gained at that job had virtually made my resume and after the experience, just like you I wanted to find something MEANINGFUL to do. Something I could wake up every morning and know that what I was doing made a difference for the right reasons.

And the opportunity came 2 months later. I ended up turning down a job for twice the pay for what I knew was best in the long run. So far it has been and my wife and I have never been happier. This company treats employees better than any I've ever even heard of. Not silly perks but actual, life balance, we value you as a human being, feel free to move about the company if you want a different challenge...perks.

The only downside is that I'm pretty sure my wife will kill me if I ever lose this job. :-)

<comment><USER4> So what happened to the company you left?

<comment><USER3> I stabilized them over the course of that year and helped them transition to new developers. Company is doing fine as far as I know and should be for a while.

They've got a massive network effect which is why they were able to survive months of chaos from a bad rebuild. That's the only reason I came on in the first place. The network effect bought a lot of time to fix things and there was no clear "Facebook" to their "MySpace."

Really the only thing working against the company is that their target market is aging a lot.

<comment><USER5> Sounds like the owners played you like a violin.

<comment><USER3> Nah, it worked out. They had to replace me with 3 people. :-)

Besides, I didn't want the company to go under. I'd spent the last year making sure they didn't and didn't want all of that work to be for nothing. Plus, I didn't want the other people who worked there to be out of the job.

Eventually, everybody who worked there with me left on their own.

</comment></comment></comment></comment></comment><comment><USER6> What are people's thoughts/experiences with burnout happening without overtime? Over the past few years I've grown more and more bored at work. Even switching jobs from different ends of the spectrum didn't fix this. I can get myself into flow but it seems to take more and more will power as time goes on. Different tech challenges help, but it's nothing like my halcyon days of straight out of college. Of coming into work and just doing the job and enjoying it with no use of will power. I go home and then fight to do the "bare minimum", read, exercise, eat healthy, minimal home chores and decent sleep. I've wondered if having a home hobby would help but I have none. I feel like "burnout" describes where I'm at, but I have a hard time stating it as fact because I rarely work over 40hrs a week on the job. So, thoughts? Could I actually be in a burnout phase or is this something completely different?

<comment><USER7> Would you describe your problem as a lack of _fulfillment_?

Personally, I find my day job technically challenging, fun, and often rewarding, but I don't really find it fulfilling in some deep meaningful sense. I feel useful but not meaningful.

It took me a while to realize that this was the problem I was having -- and that just switching from software engineering job to software engineering job wasn't going to change it -- and I am still at a crossroads as to what to do about it. I'm not sure if I should seek fulfillment from outside my career -- family, community, a craft, a cause -- or if I should change my career to one I (think I might) find more fulfilling.

<comment><USER8> There are a lot of kind of people in the world. With regard to life fulfillment (in the sense of "doing good things"), I think there are two broad categories: people who require their work to be personally fulfilling or who require life outside of work to be so.

From personal experience, if you're the kind of person who tends to be more invested at work (seeks out challenges, takes pride in your work, feels pleasure at a job well done), I'd hazard you might not be happy doing work you don't find at least somewhat fulfilling.

My thought process being that personal_investment_in_work + fulfillment_only_outside_of_work = eventually resenting time spent at work as unfulfilling.

Everyone can't work on cancer-curing, economy-stabilizing, poverty- eliminating, food-scarcity-solving, gender-equalizing, minority-protecting, free-speech-supporting things.

But we can at least move a little closer to working on something about which we can honestly say "Yeah, that does make the world a slightly better place."

<comment><USER7> In my case, my job isn't a drain -- it's useful, good work, not evil, good coworkers, fat paycheck, good hours, lots of flexibility. From a practical standpoint, I'm willing to wager that most people don't find fulfillment in their day job, and my job puts me in a pretty good place to find fulfillment outside of work.

On the other hand, at the moment I'm still young enough to start a second career -- it wouldn't be completely crazy for me to go back to school, learn a completely new skill set, grind up through the ranks, and try to have an impact in some other field.

On the gripping hand, I'm not so young as to be in an impatient rush about everything. I don't need to completely upset my entire life just yet. So I'm carefully researching alternate careers to decide if I'd actually find them fulfilling and have an aptitude for them (it'd be a shame to spend ten years and realize I'm not fulfilled by my second career either). And I'm trying to expand myself a little bit more outside my day job, so that my happiness doesn't rest on a one-legged stool.

</comment></comment></comment></comment><comment><USER9> I worked extremely hard at my last start-up to the point of being completely burnt out. I'm happy because it made me stronger, but I'll never forget being over and for about 4-5 months after, never looking at a computer. I didn't want anything to do with them for awhile, and pursued a vicious "I'm gonna go pro in golf" campaign (can't take the idealism/ambition out of a true entrepreneur).

I'm really happy now, but I understand burn-out at a much deeper level than I had before. There was a time when I would think "just get over it," but now I understand it has very real effects. When you don't want to think, it's not always a simple case of laziness. It takes work to switch into your "system 2" (as called by "Thinking Fast and Slow") -- your focused mindset. Then once you're in this mindset, it's no picnic.

What's fascinating is that if you stay in system 2 for too long, you begin to show signs of paranoia and depression. You become withdrawn and isolate yourself further from society. You might hypothesize this is a natural reaction of an _injured_ animal, but it's hard for you to understand that your brain is exhausted and needs to rest. Instead, you say "go faster!" and it begins to try to come up with more & more schemes to prevent you from going into system 2. Fantasies that would have meant nothing to you well-rested are now of utmost importance because you're actually procrastinating because you're actually fatigued.

Burn-out is a real thing. I love work and I work very hard, but there's times when you have to say "You know what, this weekend is all mine." Those are the weekends I sleep anywhere from 10-14 hours each night, and not because I'm indulging, but just like muscles, my brain is resting and hopefully "growing".

<comment><USER10> Do you have any tips for combating burnout that worked well for you? I'm starting to feel the signs of burnout (which probably means I'm actually in deeper than I think), and I'd like to try to head this off before it gets worse.

I know setting hard boundaries for work/non work and taking chunks of time for yourself is a good start, but would love to hear if you had any more advice? Thanks!

<comment><USER9> While this might not be the right thing to say, I feel compelled to say it nevertheless: nothing can hurt you unless you give it power to do so.

When I was in the heat of it and naturally did not want to work, I eventually reached a place of working zen -- I will try to do what I can, and forget about my imagined needs of this or that. I simply stared at the screen if I didn't know the buttons to press. This is the experience that I am proud of and that makes me say "I'm happy I went through that."

Too often, we mistake our own fears for limitations, and limitations we do have, we treat as if they were unmalleable. While I always want people to look out for their mental health, I also want people to know what it means to give it their all because I know that teaches you how to break through your self- imposed limitations and grow into an even stronger wo/man.

My advice is to always keep one day for yourself. For me, it's Sunday. Sunday, if I want to work, I work (and when it's that way, work doesn't always feel like work). If I don't want to work, no one can say anything. This gives you time to not think at all about work, which should give you time to stay in system 1 and heal.

What's a real killer is all that unnecessary anxiety and general negative emotions coming from _thinking_ about your work that is hurting you. When you're away from work, stop thinking about work. It's not prudent or responsible of you to be stressing out about something that isn't even going on right now. When it's time to rest, you rest. When it's time to work, you work. It seems simple, but it's the blurred gray area in between the two that affects people the most. When I worked very hard and hit my "work zen mode", it was here that I began to let go of things like what does my boss think or what does my coworker think or some other-nonsense-BS-anxious-thing that has nothing to do with actual work.

I hope it helps. I'm really no huge expert myself, but I am usually the hardest person in the room.

<comment><USER10> Thanks, I appreciate the perspective! I definitely agree with the real killer being thinking about working while not working. The concept is simple like you said, but actually sticking to it...quite hard. Also, keeping one day a week for yourself seems like a good place to start as well.

</comment></comment></comment></comment><comment><USER11> _> The sad thing about the metrics-driven performance culture the Times describes at Amazon is studies show overworked people perform worse._

I'm glad the author made this point and backed it up with a reference. It reaffirms something I already believed (whether on the basis of personal experience, something I'd read before, or mere wishful thinking, I couldn't tell you so the reference helps). It is a sensible constraint that came to mind in reading all the tech workplace horror stories that the Times's Amazon piece inspired.

While reading that Times article I checked out the link to their 14 sacred principles. The funny thing was that I agreed with most of them. They were all ideas that occurred to me over the course of my career working independently, with small companies, and especially now in corp.

The one thing that was missing, I felt, was a Rule #15: Never work more than 8 hours a day.

Without it, it's no surprise you end up burnt out or living in the sort of dystopian workplace documented in the Times' Amazon article.

But then I suppose, as has been pointed before, long work hours are more about cultural signaling and penny-wise-pound-foolish accounting than really improving productivity.

<comment><USER12> But what if "8 hours a day" isn't the magic number for everyone?

What if for some people, the magic number to avoid burnout is 4 hours a day? Or the other end of the spectrum...12?

<comment><USER13> I'll not lie, I'm a 14, 14, 6, 4 kinda guy. Then Friday through Sunday is for playing, thinking, and reading, but mostly meeting up with people to exchange ideas, potentially with beer.

<comment><USER14> And for a job that isn't customer facing, we should allow if possible.

I can understand why the cashier at the store needs to work 8s.. how would I schedule people based on how many hours they feel like working?

For programming with delivery at the week or month level.. people should be able to slice the work how it works for them.

(I think my ideal work is like 12 - 7 - 7- 6- 6- 3 or something)

</comment></comment></comment></comment><comment><USER15> It seems to be a common sentiment that burnout is largely driven by how many hours a day you work. Why is that?

From what I've been taught burnout is the result of continuous stress. Where stress is more or less defined as a continuous sensation of being threatened.

I've seen people with perfectly normal workours become burnt out. I've even seen people working ten hours a week getting burnt out. The common factor thus not being the objectively measurable amount of work.

My own formula for diagnosing a work environment is more like Risk of Burnout = perception of expectations / perceptions of means to deliver

But a more useful model might be the SCARF-model presented in this tech talk [http://www.youtube.com/watch?v=XeJSXfXep4M](http://www.youtube.com/watch?v=XeJSXfXep4M)

It seems to me that hours worked relates to issue of burnout more like lack of sleep to the risk of catching a cold. Potentially a big factor, but only incidentally.

<comment><USER16> Such a great comment.

My happiest times were from a startup where we worked 80 hours a week.

Another startup we were in the process of selling, was such a hostile place it literally gave me work related PTSD and I was only working 40 hours per week.

</comment></comment><comment><USER17> Random thoughts:

It's nice to hear about a situation closer to most startup outcomes. When Matthew notes that someone sent him the acquisition terms and the founders made out well while line level / low level managers basically got nice severances, it's something everyone here should keep in mind. It's great if founders make out well as long as everyone else does too; it's when those outcomes diverge that it rankles.

If a potential employer tries to put nonsense like a 2-year noncompete -- during which of course they don't pay you -- plus ownership of side projects into your contract, it's a sign you're dealing with assholes. If you can, you should just walk away. Many of us live in CA, so some of this can't happen, but a startup here tried something similar: their 16 page (!!!) employment contract specified that if I used my personal media device or laptop for any business purpose, they had the unlimited right to inspect/search them on demand. By my reading, even something as tenuously related as two factor auth on work gmail being sent to my personal cell, or taking a business call on my cell would have counted. The founder tried to blame it on boilerplate their lawyers inserted; he couldn't even take responsibility for what was, after all, the contract he was asking me to sign. I walked away. Read those contracts.

<comment><USER18> These are the kinds of things you would hope would get reported on a site like glassdoor. (I have no affiliation.) I realize they often don't, but if they did, it would generate more pressure to clean up their act.

<comment><USER17> I thought about that, but frankly, I don't want to get sued. And the founder certainly remembers the candidate who told him "lawyers work for the company, not the other way around, so stop your bullshit".

</comment></comment></comment><comment><USER19> I have never said to myself "I wish I had stuck around that company longer." I have often said "I should have left much sooner."

I'm sure there are some examples of someone leaving when lightning was about to strike and make all the insiders rich. Those instances are even more rare than start-up successes making employees rich.

<comment><USER20> I left a company to go back to school (took on massive loans). A few months later, the company closed up and people got extremely generous severances. Would have probably covered half my tuition costs. I definitely wish I had stuck around THAT company longer!

<comment><USER21> Which illustrates the original point: that scenario -- generous severances when the company is going out of business -- is incredibly rare. A much more likely scenario is your options become worthless and you're laid off. If you can leave a bad environment, I recommend leaving ASAP instead of letting the golden handcuffs keep you -- unless the golden handcuffs promise a huge return, and there's little or no doubt about getting that return.

</comment></comment></comment><comment><USER22> Passion _causes_ burnout. Have you ever noticed that the people who just punch a clock and go home never experience burn out? Even if they end up working overtime? It's always the people who identify with their work that get burned.

<comment><USER23> YES. And to an extent, just punching the clock is a defense mechanism in work environments where low autonomy + high demands are creating an environment for burnout. But I've seen bright-eyed 23-year-old engineers suffer vicious burnout by trying to tackle the low autonomy part ("Hey boss, what if we did X? Hey boss, I put together this slidedeck for this feature that would be so cool! Hey boss, check out this mockup I did of a site redesign!") and then after hitting a brick wall enough times they become embittered and disconnected.

I think it's because equity creates a belief in young workers that the company is "theirs" \-- but after you've realized that startups are like any other job where you trade time for money while implementing the Highest Paid Person's Opinion, you lose that passion quickly.

<comment><USER24> I checked out about halfway through my run at my current job. I think after the third time I suggested a tool or process change and the reply from the lead was "we've never done it that way" at a startup it dawned on me that this company will never accomplish anything technically interesting.

Incidentally, there's a bonus coming up for a major milestone and I'm seriously considering handing in my two weeks notice after the direct deposit clears. The CEO tried to sell the whole equity angle, but I honestly don't see any resume improvement potential here and that's all I really care about.

I've worked at companies that gave a shit and I just don't think this is one of them.

</comment></comment></comment><comment><USER25> >The vendor abandoned their technology, and our generous free services attracted people who proved hard to convert to paying customers.

This line rings very true. At my company our first product was offered for free. We had thousands of users, but after months and months of work we realized only a small fraction of our user base was going to be converted into paying customers. (Like OP, I began to feel burnt out at this point)

When we launched our second product, we realized we needed to answer the question: "Will people pay for what we build?" as fast as possible. We charged users to pre-order our alpha and when we realized people were willing to pay for it, we poured ourselves into the product.

I think many founders are scared to ask for money (We were). But if you're building a product that you would eventually like to charge people for, you really have to force yourself to ask those hard questions as soon as possible.

<comment><USER26> >The vendor abandoned their technology

Don't forget the other half of this statement: I've always been concerned with basing a product on a locked-in technology from an unproven vendor.

And vendors _do_ shut down. I've seen it happen many times. Sometimes they get eaten up by a "bigger fish" that wants to use their technology internally, and they then shut down the external service you were so fond of.

<comment><USER27> Author here: In our case the vendor was very proven, but the tech and their approach to it was not. What actually happened is a bit more complicated than _abandoned_, but those words got the point across without delving into the irrelevant.

Needless to say, I am _very_ leery now of the motives of open-source products that aren't run like open-source projects.

</comment></comment></comment><comment><USER28> I'd be curious to hear from employees who have worked for Elon Musk either at Tesla or SpaceX. I'm currently reading Ashlee Vance's book on Elon and the descriptions of the working conditions for Tesla and SpaceX employees sounds both exhilarating and completely exhausting.

Does working on something as truly world-changing as space travel or electric vehicles make up for the 80+ hour work weeks? Is it easier to work so hard when there's no doubt that what you're doing matters?

<comment><USER29> as truly world-changing as [...] electric vehicles

EVs have been around for a long long time, commercially, and conversions. I'm glad tesla is doing what they are, but world-changing seems like a stretch to me.

Anecdotally, I've heard from employees that Tesla is having attrition issues, so apparently not. They've recently added a few minor perks to try and keep engineers.

<comment><USER30> The world changing part might be getting them to the mainstream. Which is a combination or funding infrastructure, lowering prices and spurring competition from the other car makers.

</comment></comment></comment><comment><USER31> I worked two jobs - one full time during day and part-time during evenings and weekends. Both were dev jobs. I lasted only 10 months. The last months were really ugly - I was abusive, harsh to others, really unpleasant person to be around. I quit both jobs and moved city. It took me 4 months of doing absolutely nothing to recover.

</comment><comment><USER32> The author speaks of passion a few times. I think that's the key here; he forced himself to feel passionate about the end goal when in reality he didn't care. You can't do that. If you're not passionate, faking it will kill you.

There is a middle ground between signing and not signing here: set boundaries up front. Let them know "Hey, I'll sign this and help with the integration, but just know my heart won't be in it. I don't know that I can promise you more than a solid 45 hours a week. But I can't deliver that passion I had building the product because I'm really not passionate about this."

And yeah, those employment contracts are bullshit. Before you sign a contract, you are under no obligation to do anything. A good tactic is to just redline anything you want thrown out and send it back to the lawyers without comment. Also realize that many companies throw these bullshit clauses in just so they can negotiate them away later (as opposed to having to offer you more money).

If it's important enough to the founders, they will find the money to make it worth your while. An extra hundred grand out of a big payday to ensure a critical employee is present to handle the sale is just a cost of doing business. Unless you would go out for drinks with someone after you stop working with them, it's not going to hurt your relationship (they may even respect you more for it).

</comment><comment><USER33> One of the things I always encourage people to do as part of an acquisition is to handle the transition gracefully (1 year-ish), and then start looking around for what else you might want to do inside the acquirer. Often there won't be anything, and you can just bide your time or flee the scene - <USER2> other times there might be a perfectly interesting job elsewhere in the organization that you can use to build your skills, beef up your resume, and live out your golden handcuffs.

But too many people that I see just sit there, quietly miserable, while their product dies around them.

</comment><comment><USER34> I remember trying to describe burnout to my step-mom who is French. I kept trying to figure out how to say it in French and she joked that they don't have much of a phrase for it; the just say "le burnout" which I find rather telling. It seems like such an american problem that so many articles like these have to be written.

<comment><USER35> It is true that we (French) say "le burnout" but it does not mean we are not affected too, contrary to popular belief ;-) A few years ago, it seems that workers of ex-publicly held companies (France Telecom for instance) were the most affected with a few suicide cases that made the news. Recent studies said 2 workers out of 10 felt affected. IMHO, the white collars of big companies feel affected because they have to do more than before to stay in the international race in less time since they usually have 6-10 weeks of holidays per/year (no sick days). Having so many holidays is really challenging for an organization, especially in the summer, period of the year when people are off for 2-4 weeks. It means also long work days for workers. Personally i'd prefer to have less holidays and come back home earlier.

Having said that, on a yearly basis, white collars work much less than their American counterparts on average.

</comment></comment><comment><USER36> > Be careful with passion and those who would use it against you.

The problem is he let someone else define his passion. Nobody can use your own passion against you. Passion is just a word and anyone can say it. But you alone are the one who decides what you believe in, how much you are willing to work for, etc.

</comment><comment><USER37> _> because tech is a small town and I shouldn't burn any bridges_

to anyone out there listening - it's not. technology is a huge, huge, huge, huge established industry. think about it - what does "tech" even mean? it's an umbrella term for 4 or 5 classifications that all kind of bleed into each other - including finance. in addition, every non-tech company has a shitload of tech in it. gee whiz. it's almost as if technology is critical to the functioning of the modern business enterprise!

this is fear-based thinking at its worst. this is the kind of silly thing scared, gutless engineers say to each other by the watercooler while the business guys laugh out loud and backslap each other in the proverbial smoke- filled room.

the most powerful thing you can do in technology (and all business, really) is not give a fuck what the other guy thinks (the "guy" being your negotiating counter-party). stick to your guns or just take the money and run. if you waffle, you're sunk by your own torpedo.

<comment> norea-armozel I think it's more that the startup scene in SV is much smaller than say working from some random company throughout the United States or the world at large. I can see that reputation and being known by name could be a reality in startups for sure. Outside of that? I would be completely floored if anyone knew me just from the random jobs I've had across multiple industries that write software for internal/external use.

<comment><USER38> Even the startup scene in SV/SF is so huge, this is not a problem unless you do something notorious / egregious (like crash and burn your Ferrari into the CEO's office) and even then, people will forget in a few months. Totally agree that is such bullshit advice.

</comment></comment></comment><comment><USER38> Some psychologists consider burnout to be depression, not just depression- like. In my own experience, I'd have to agree. Luckily it's generally brought on by stress and most people recover within weeks or months if they are able to rest or be removed from the cause.</comment>


Show HN: Clubman – a booking platform for ski clubs - <AUTHOR> https://clubman.app <comment><AUTHOR> I volunteer on the board of my ski club. We have three lodges across two resorts and have used a couple of different booking systems over the years. They've all been pretty bad, usually falling over under load and then making financial errors.

Clubman is well tested (TDDish) software written in Go and hosted on Kubernetes (GKE) with payments through Stripe. It's done 6 bookings per second in real world usage and been synthetically load tested to 10x that.

Ski clubs are a small niche but they have very specific needs. There are _lots_ of booking systems for hotels but they're all geared towards filling as many beds as possible with people willing to pay (of course!) Ski clubs usually have rules to ensure all members get equitable use of the facilities while also trying to maximise utilisation. These rules can get very complicated with multiple classes of membership, multiple rounds of booking with different entitlements and limits on beds and guests, different rules for high and low season, etc.

Clubman implements a system of Rules based on Triggers and Actions. It allows clubs to reflect arbitrary sets of rules without needing to commission custom modules from the developer as with other systems.

Notbad Software is a one person operation. I've built Clubman over the last 12 months alongside consulting work and my other products. I'm very proud to launch it to all clubs today.

</comment><comment><USER2> There is another important aspect to this where it could be valuable to have an identity provider for people who have ski, golf/clublink, family sports, tennis, and business club memberships. Most private clubs have fewer than 2k members, but there is a great deal of affinity between them for services, and a digital channel to the ~1m people in the world who pay for private club memberships could be a play.

Quintessentially, Velocity Black, and Vertu, among others, have tried to crack this market, but I don't know how much traction they managed. When Uber first launched they reached out with a promotion through one of the old business clubs I was a member of. What's different about skiing is it's mainly whole families. I think this is a sleeper exciting play.</comment>


Show HN: Labor Day Project, fire-map for Texas based on user input. - <AUTHOR> http://txfiremap.com/

<comment><AUTHOR> Thank you for taking the time to checkout my project! It was ~5 hours of work and I am not fully comfortable with my web development skills. Any suggestions/tips are fully welcomed.

I am still working on gathering more data and spreading awareness, please feel free to share with those who are interested! Also, if you can, consider donating to a charity for those whom have lost their homes in this tragedy.

Regards,

Benjamin</comment>


OAuth 2.0 Hack Exposes 1B Mobile Apps to Account Hijacking - <AUTHOR> https://threatpost.com/oauth-2-0-hack-exposes-1-billion-mobile-apps-to-account-hijacking/121889/ <comment><USER2> These are implementation flaws, not flaws of the OAuth or OpenID Connect protocols themselves.

But the prevalence of implementation flaws indicates a bigger problem. We need better tools and libraries for app developers. Too many people are rolling their own ad hoc implementations, and they shouldn't have to do that.

Some think the spec is partially to blame. The core spec is deceptively approachable, and implementers don't know how to respect it properly. And it's only a primitive building block. On its own it's often not enough to be useful. Even if you implement the core successfully, the glue around it might be bad. That's why I believe we need a bigger ecosystem of vetted utilities for every niche.

<comment><USER3> This isn't an "implimentation flaw". Its a fundamental flaw in the core logic.

->the attacker would then sign in, via OAuth 2.0, with their own credentials. The proxy would capture the outbound exchange and the attacker could then substitute their user ID with a victim's (this would be obtained from public information).

<comment><USER2> No, it is not a flaw in the OAuth core logic. From the paper's intro:

> _" the OAuth2.0 standard does not cover or define the critical security > requirements and protocol details to govern the interactions between the > 3rd-party (client-side) mobile app and its corresponding backend server > during the SSO process. As a result, various IdPs have developed different > home-brewed extensions..."_

<comment><USER3> How does not defining the security protocols of your authentication protocol not count as a flaw in the core logic?

An entry security product that doesnt define any security on entering...

Pure Genius.

<comment><USER4> I believe that is one of the finer items the paper points out: OAuth2 is NOT an authentication protocol, its an authorization protocol.

<comment><USER3> [https://m.youtube.com/watch?v=zKuFu19LgZA](https://m.youtube.com/watch?v=zKuFu19LgZA)

</comment></comment></comment></comment></comment></comment><comment><USER5> Unfortunately, I've come across these kinds of issues first-hand in a number of existing projects. It usually comes down to the fact that a surprising number of back end implementations trust data from the client without verification.

Who's to blame? Well, the app / back end developers obviously, but I think it goes beyond that. As we all know, client-side frameworks are all the rage these days (receiving more attention than back end technologies, it seems), and with the popularity of BaaS providers (Firebase, Parse Server, etc), front end developers often feel over-confident in handling these things without really understanding what's going on underneath (and the security implications) because hey, "using a BaaS means I don't have to worry about that kind of stuff."

Add to that the fact that so many of the popular OAuth providers support "implicit grants" \- where the access token is sent directly to the client - without adequate warning as to the security implications involved. Personally, I've yet to come across a case where the implicit flow is justified, and in my opinion, it should be disabled for any security-conscious OAuth provider (really, your fancy JS or mobile app can't communicate securely with a trusted server _somewhere_?).

Finally, some OAuth providers (ahem, _Instagram_ ) issue access tokens which _should_ be opaque to the client, but obviously contain user data (e.g., user IDs) that tempt developers to take shortcuts. In one case, I saw an app that only looks at the access token itself (never using it to verify anything), parses it for a user ID (undocumented of course, but "it seems to work"), and simply exchanges that ID for a session token! A forged response allows anyone to impersonate any other user - simply with the Instagram ID of the target user. The horror...

So yes, it does come down to developer incompetence, but my point is, the popular OAuth providers certainly aren't helping the situation by encouraging (or at least not discouraging) implicit OAuth grants, along with issuing not- so-opaque tokens that encourage bad developer behavior.

<comment><USER6> > Add to that the fact that so many of the popular OAuth providers support > "implicit grants" \- where the access token is sent directly to the client - > without adequate warning as to the security implications involved. > Personally, I've yet to come across a case where the implicit flow is > justified, and in my opinion, it should be disabled for any security- > conscious OAuth provider (really, your fancy JS or mobile app can't > communicate securely with a trusted server somewhere?).

If you can't trust the client _just enough_ to let it have a bearer token, what can you trust it with to allow requests to any backend (yours or facebook's)? Cookies or a token for your backend will be just as comprimisable, with the sole advantage that the attacker now can only work via your API on behalf of that user.

Furthermore, the devs taking shortcuts, if you take away implicit grants - guess what they'll do? They'll "encrypt" the client secret into their app, and pray that it's "good enough", then just emulate the code flow in the app. You're now less secure, because the OAuth provider is going to assume that the lack of implicit grant means "everyone is using a back end server", instead of being able to put tokens and clients into the "confidential" and "non- confidential" buckets.

Non-opaque tokens I agree are probably bad. However, opaque tokens doesn't keep developers from taking shortcuts. Only well-written SDKs and libraries, either generalized (for all OAuth) or specialized (facebook SDK) can do that. I've spent enough time in reddit.com/r/redditdev to realize that a large majority of devs won't take the time to do it right - many barely understand how HTTP works, when they're first learning this stuff. There's so much to learn and understand that no one is going to get it right without significant help in the form of SDKs and libraries that just do the right thing by default.

<comment><USER5> Implicit grants are more dangerous for two reasons: (1) the process wherein the token is sent to the client can have serious security implications (especially for web apps) and (2) if your app communicates with any app- specific back end, the transfer of auth tokens between the app and back end is an additional temptation that is prone to have even more security issues.

I do agree - if you have an app that is 100% client-side, and you're either using an official SDK or know what you're doing, implicit grants can be done securely (just as secure as any other bearer or session token, as you mention). The problem is that many app developers choose the implicit flow initially (because it's easier to implement), but then end up using it in ways that would be much better suited to the authorization grant flow.

</comment></comment></comment><comment><USER7> Source (linked in post): [https://www.blackhat.com/docs/eu-16/materials/eu-16-Yang- Sig...](https://www.blackhat.com/docs/eu-16/materials/eu-16-Yang-Signing-Into- Billion-Mobile-Apps-Effortlessly-With-OAuth20-wp.pdf)

Only 15-20% of apps tested for Facebook/Google OAuth were vulnerable, perhaps because platform-specific login code might be available for those providers (so you don't have to roll-your-own OAuth client as an app developer).

Also, the requirement for performing an MITM with SSL certificate bypass again raises the complexity of the attack. But it's true that your information is only as secure as the browser/client you use to access it, and the security of the API endpoints such clients talk to (and how they validate OAuth credentials passed by the client).

<comment><USER8> Does MITM on the attacker's device really increase the complexity? Setting up one of the http debugging proxies isn't that hard, all you need to do is modify a response body from a http request. ive done this plenty with charles to hack the loaded save state from games with no server side validation

<comment><USER7> Sure. Let's put it this way: an app that doesn't validate SSL in such a way that your login service can be impersonated is... in some ways asking for attack, right? In addition to exploiting lax OpenID Connect validation to impersonate others, you could also steal credentials at this point, I would think. So while they're illustrating a weakness in Oauth client implementations, it relies on impersonating an SSL server that should already be mitigated by operating system or app-based certificate pinning, CRLs, etc. and as such isn't the root cause of the issue. This indirection/complication is what I meant by complexity.

<comment><USER9> Not only the authentication of an app should be TLS/SSL. The rest of the communication as well. Certificate pinning and such should be done anyway for all services the app uses.

A consistent view and specified view on how to securely communicate over the network would clearly help.

But maybe they should should issue another version of OAuth2 and require TLS for all communication; and leave the legacy of the non-encrypted traffic behind.

</comment></comment></comment></comment><comment><USER10> I'm having trouble understanding the paper. Can someone break down which part people are getting wrong? Is it that the `state` challenge isn't correctly being matched server-side?

Separately - is there an app someone can run to "hack themselves" and see if their OAuth2 implementation is safe?

<comment><USER11> Nearest I can tell... the client app is trusting the user ID sent back to it so you can login with your own (the hacker) user name and password and then replace the userid in the returned value with your victims and many mobile apps will let you continue assuming you are the victim.

</comment></comment><comment><USER12> OAuth 1.0 is often implemented somewhat wrong too. I've only worked with OAuth 1.0 so I can't speak for 2.0, but the I think main problem is that social networks don't 100% stick to the specification, so you first have to figure out what exactly is different (at which point the guy who originally coded the thing that I had inherited had already given up), and then you either have to figure out how to get the library you're using to work anyway, or just implement it yourself. All of these tasks have pitfalls.

</comment><comment><USER13> So ... some third-party services implicitly trust the auth data their own apps send them, without verifying the auth data with Facebook/Google/etc. servers from their server-side code.

TL;DR: Some services forgot the "never trust client-sent data!" rule.

<comment><USER3> I dont think they forgot it.

Just never something they considered.

"My app is to small and insignificant and not doing anything of much importance to be targeted by a nation state so I don't need to care about security"

That pervades the developer scene.

Blended with a spice of nothing to hide nothing to fear.

</comment></comment><comment><USER14> This seems relevant...[1] I've implemented OAuth once or twice, but it's painful, and I've been hesitant to recommend it as a login or security method both because it's a pain, and because of this article's concerns.

[1] [https://hueniverse.com/2012/07/26/oauth-2-0-and-the-road- to-...](https://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/)

<comment><USER9> Actually oauth2 is straight forward to implement. The different flows all have a purpose.

Obviously, when confronted with a protocol and implement it without library; you have to read and understand the spec.

I think the flows are fairly stripped down and only do the minimum amount and in order to fulfill their respective use case.

Obviously the authentication-code flow is the most complex one. However, I don't see how to make it simpler than it already is and still keep it secure.

A well tested and reviewed library and usage guidelines should help to remove possible security flaws.

I think that the major area where the ecosystems of the different platform can improve. But that's not an issue of OAuth2 but an issue of the communities providing OAuth2 implementations.

The article you are referring to has quiet strong expectations from the OAuth2 specification; which it cannot fulfill. Until there is a better specification, I would stick to OAuth2.

I believe it is quiet workable and I believe the de-facto standard for authentication at this moment.

</comment></comment><comment><USER15> Misleading title of the post. The hacks are possible because of insecure implementations not because of the protocol itself.

All 3 insecure implementations which paper talks about are known from long. Developers concerned about security are cautious about such pitfalls.

</comment><comment><USER16> I believe it. All too often I've seen implementations of methods with names like CheckAccess(), ValidateCert(), which the developer must implement, with an implementation of

        return true; //TODO

</comment><comment><USER17> That's why I wrote [https://github.com/ory-am/hydra](https://github.com/ory- am/hydra)

<comment><USER18> Then consider implementing this oauth, with security bugs fixed by default [http://sakurity.com/oauth](http://sakurity.com/oauth)

</comment></comment><comment><USER19> My first thought is that it sounds like apps aren't verifying SSL certificates? Is there more to it or is that the underlying issue?

<comment><USER20> There is more to it. The paper linked from the article is enlightening.

</comment></comment><comment><USER18> Billion of apps, omg :O

<comment><USER21> They're talking about accounts, but yes; There is a _lot_ of shovelware.</comment></comment>


How a law firm tested "phantom" AT&T smartphone data use - <AUTHOR> http://arstechnica.com/apple/news/2011/05/lawsuit-alleges-att-overcharging-smartphone-users-for-data-use.ars <comment><USER2> Their testing methods were very imprecise.

To really confirm this they would need to monitor the network driver(s) on the phone and record the exact data amounts that are passed and then compare that to what AT&T reported.

Another option would be to emulate a cell tower, connect the device to it, and monitor traffic that way.

The thing I did find interesting was that they said some carriers round up transfer sizes. That could account for some big differences when you consider that this rounding could happen per transfer or session. To me that sounds like highway robbery akin to shaving pennies off interest.

<comment> _-af-_ You can't easily 'emulate a cell tower'.

To verify that the device isn't indeed transferring any data as part of any background Apple process they should put it on WiFi and monitor traffic through the router. It should be zero.

I'm logically assuming that any background process that would transfer data over 3G would also do it when on WiFi network.

They could also get a data modem from AT&T and test it by connecting to the tower but not transferring any data. If AT&T is overestimating data transfers or has phantom data then it would be across the board and would also show up on transfers through their data modems not just their iPhone plans.

<comment><USER3> Actually, it is doable. I met a guy that had a whole SDR plus GSM stack. I was able to pair my blackberry with it. He runs a cell network at Burning Man, apparently.

<comment><USER4> Was going to mention the system at Burning Man, then I realized that you already mentioned. So here's the link:

[http://www.networkworld.com/news/2010/083010-open-source- voi...](http://www.networkworld.com/news/2010/083010-open-source-voip-cell- phones-at-burning-man.html)

</comment></comment></comment></comment><comment><USER5> So AT&T relies on nightly checkins from the device reporting how much data it uses? They don't do the accounting in the network? That seems _crazy_. So on a jailbroken device you could just tell it to report 10% less and it would all be even.

<comment><USER6> I don't think that's how it works. I think what the speaker meant is that the accounting data is forwarded from the local access point to the billing system at the end of the day.

<comment><USER5> From the article, "the time stamp reflects the time that your device established a connection to the [billing system], not the time that you sent or received data." Note the "your device".

</comment></comment></comment><comment><USER7> Clearly this guy's test was incomplete and guaranteed to give the result they sought...

However, I have worked in capacity planning at a mobile telecom, and it's scary how confused that alleged experts are about "bytes" and "bytes per second."

Given that experience, I'm not surprised that AT&T would get "bytes transferred" wrong, but I think it's more likely due to incompetence and not malice. I wouldn't be surprised if they underbilled people also.

</comment><comment><USER8> Why didn't this researcher run tcpdump on all of the iPhone's network interfaces or use sysctl to measure actual data usage?

<comment><USER9> Presumably because he was connected to the 3G (or other data) network. Unless he can run tcpdump on the iPhone itself or become a man in the middle between the iPhone and the data network, he couldn't capture traffic.

An interesting test would be to connect the iPhone to a regular wireless router, measure the activity, then compare that to billing activity. Although my Android Galaxy S, for example, connects to the data network to look for updates _even though it is connected to a wireless network_ \-- so this test could be moot.

<comment><USER8> With a jailbroken iPhone or a Nokia N900, tcpdump works just fine.

</comment></comment></comment><comment><USER10> I've compared the network usage as reported on the iphone with the one AT&T measures, and it's not the same. I've paid over-usage fees at times when according to the iphone reading I had 20 MB left. Now it all makes sense...

<comment><USER11> Where did it say you had 20MB left? Were you using ATT's evaluation? Or a third-part app? Or, the iPhone's operating system, itself.

If you're using the iPhone's operating system, ATT may be calculating space, and rounding up in a different way from Apple. (Examples of this exist in other child-comments of the OP)</comment></comment>


Ask HN: What are you looking to achieve in 2014? - <AUTHOR>

All the smart people on HN, just wondering what your goals/ambitions/ideas for the new year ? It does not have to be related to startups or tech necessarily. Anything is worth hearing. Some of mine:

    - Get better at swimming

    - Paint my kid's room

    - Get something started on my startup idea

    - Get in shape and Build muscles. (currently 15 lbs overweight). Already working on this btw.

    - Buy a Raspberry Pi and play around

    - Contribute to a major open source library (fork it at least and submit a pull request)
 <comment><USER2>
        * Love and support my wife as she becomes a Mom for the 1st time
        * Strive to be a great Dad to my child (due mid Jan)
        * Achieve my skydiving C license
        * Complete the wingsuit first jump course
        * Get good enough flying a wingsuit to do some flocking
        * Continue getting into good shape
        * Juggle more than I did in 2013
        * Keep motivated in my system admin day job

<comment><USER3> Congrats and best wishes :)

</comment></comment><comment><USER4> Funny, I had a pretty good year and didn't even realize it.

In 2013 I got married, bought a house, lost a bunch of weight, built my dream workshop, added a bunch of new recipes to the list of things i'm good at cooking, and got a promotion at work.

My goal in 2014 is to not loose it :D

</comment><comment><USER5> 1\. Be a fucking good open source developer. I already do maintain some awesome projects, but I want to go crazy about it.

2\. Develop cool stuff in clojure

3\. Get a high score in TOEFL/TOEIC

4\. Start learning french

5\. Get a raise

6\. Marry my GF.

7\. Move to a bigger place

8\. Have some degree of success with my current stock investments

9\. Get shredded(almost 2 years in the gym for now)

10\. By the end of the year plan to move abroad or start running my own company.

</comment><comment><USER6> * begin remote working

* begin traveling more often

* live in 13 cities over the span of 12 months

* start a blog

* take up photography

* learn at least one other language (spoken, not coding)

* get better at javascript

</comment><comment><USER7> I don't care about 2014. My long term plan is to continue caring and loving my family and go IPO with my startup. One of the things gonna be tough but who wants an easy life?

</comment><comment><USER8>
        * Get my startup out to at least one school and impact at least one student's life.
        * Make a significant contribution to Go.
        * Continue my GitHub streak: https://github.com/zachlatta
        * Above all, be happy and satisfied with my life and work.

</comment><comment><USER9> Learn to play Erik Satie - Gymnopédie No.1 on piano. [http://www.youtube.com/watch?v=S-Xm7s9eGxU](http://www.youtube.com/watch?v=S-Xm7s9eGxU)

</comment><comment><USER10> Sleep regularly. Slow down. Enjoy life.

</comment><comment><USER11> Be happy. Enjoy life. Be closer to the people I care about.

</comment><comment><USER12> Launch SettleIt.org</comment>


Refugees arriving in Italian town given notes to be used as local currency - <AUTHOR> http://www.bbc.com/news/world-europe-36769145 <comment><USER2> That's actually quite crafty. Instead of government assistance being dispersed directly where it can be sent abroad and siphoned off through services like Western Union it's pumped directly into the local economy.

This probably can't scale. Once enough money is involved organized crime will find a way to siphon that money out of the community. For example, WIC debit cards can be exchanged 50 cents on the dollar for cash.

<comment><USER3> That's nice for the local economy. Not as nice for the non-local people who would have received money but didn't. I bet some of them really could have used the cash.

Whether or not this is a good thing overall depends on your priorities, but remember that the consequences of a decision include not only the things that happen because of it but also the things that _don 't_ happen because of it -- and the former are much more visible, so it's easy to accidentally forget about the latter.

<comment><USER4> But it's the government giving it to them, not foreign aid or remittances. It's not like they are taking money away from them. If I were Italian. I'd like this aspect of helping your people while helping others at the same time. Win-win.

<comment><USER3> If you think I was making a point about what they should do, or what they have a right to do, then... I didn't make myself clear, and I apologize. I'm talking about concrete physical consequences. Who eats and who doesn't; that sort of thing.

</comment></comment></comment></comment><comment><USER5> Historically there have been many countries / communities that have used local currencies and private issues of money to enable spending.

[https://en.m.wikipedia.org/wiki/Local_currency](https://en.m.wikipedia.org/wiki/Local_currency)

This was especially common during times of economic hardships: wars and famines. Ex. Russian revolution, the pogroms. Things used were food vouchers, lottery tickets, checks and obligations all sorts of things.

<comment><USER5> To add to that there's a large interest from currency collectors.

Some interesting issues were money in Jewish ghettos / concentration camps during wwii

<comment><USER6> Do you have some links I could read up on, or was this just the set up to a poor joke?

<comment><USER5> Absolutely not a joke... [http://www.jewishvirtuallibrary.org/jsource/Holocaust/money....](http://www.jewishvirtuallibrary.org/jsource/Holocaust/money.html)

If you are interested/live in NYC there is a library with a ton of research materials on currencies/ history from all over the world at the American Numismatic Society's library: [http://numismatics.org/Library/Library](http://numismatics.org/Library/Library)

</comment></comment></comment></comment><comment><USER7> This reminds me of the Hawaii Overprint Note of US currency during WW2. Perfectly legal---but marked so that were Hawaii to fall it would not enrich Japan.

[https://en.wikipedia.org/wiki/Hawaii_overprint_note](https://en.wikipedia.org/wiki/Hawaii_overprint_note)

</comment><comment><USER8> Is this definitely a good thing?

It seems like Rome has provided a cash stipend to immigrants, but the local government has intervened and restricted the immigrant's purchasing choices. For example, this could be bad for the recipients if local shopkeepers had significantly higher prices than online retailers or if they charged a premium for extending this credit.

I see the benefits as well, which seem to be well represented in the other comments so far. I'd be interested to see whether this actually helps everyone in practice.

<comment><USER9> From what I understood they are not providing a cash stipend:

> €35 (£29; $39) per asylum seeker per day from the central government in > Rome. This has to cover everything, from accommodation, food and medical > care to Italian language lessons, work placements and assistance with asylum > bureaucracy. _It also includes a couple of euros for pocket money._

What is not clear is: do they give a migrant 35 "fake" euros and tell him to do everything himself, or do they just do this on the food part, but still provide housing etc.

An exploit I could think of is if a local Italian goes and buys the migrants "food stamps" for let's say 80% of their price. The migrants would be free to buy anything with real € but he would pay an unnecessary 20% tax to the Italian. And the Italian would be able to buy 20% discounted food. That's not a huge amount of money at stake: Only whatever the Italian consumes in food over the year. And the migrant would need to be stupid/greedy to trade all of his fake € as he also need them for food.

<comment><USER10> as an italian student living on 12€/day which covers rent and bills (6€), food (4€) coffe to study after dinner (0.5€) and unexpected expenses i wonder how those 35€ and for the first time i understand why people are angry at immigration.. (we didn't get scholarships for 2 years because of the lack of money)

<comment><USER11> Logistically it makes more sense to build shelter-in-place in Africa and the Middle East. They are easier to police and supply.

Then the applications for refugee status can be fairly processed. This way people won't be converted into organs, thrown off boats, enslaved or otherwise taken advantage of. It should also serve to distinguish between genuine refugees (for non-permanent visa) from warzones and the holidaymakers/opportunists.

The current scenario is the worst possible route. Talk of migrants obtaining work is a shibboleth that discerns whether you have your head screwed on properly.

Are we really supposed to believe that millions of migrants are supposed to integrate without understanding the language, law, culture and without the schooling of so much as a secondary school student?

It is preposterous. Inexplicably stupid.

Even with successful integration it can take up to a 100 years for it to work. Look at how long the Italians and Irish were outsiders in the United States. And they were whites in a country historically unusually open to migration. And they trickled in instead of millions per year. That's the easy route and it is not that easy.

<comment><USER12> >And they trickled in instead of millions per year.

In 1847 New York had a population of ~375,000 and had 52,000 Irish and 53,000 German immigrants in one year.

Same year Boston with a population of ~115,000 had almost 40,000 irish immigrants.

During that time there was Irish immigration alone equal to about 3% of the US population(650,000 immigrants vs 17m). The current EU situation is equal to about 0.2% of the population(1m vs 500m)

</comment></comment></comment></comment></comment><comment><USER9> It's like Growth hacking for this city. They subsidize the immigrants, in exchange the immigrants are _forced_ to grow the local economy. These migrants could get this money anyways, but 1) the town hides the latency for them. and 2) they actually give more freedom to the migrants on how to spend that money.

As long as the migrants don't get robbed and are fine with living there, they're better off with this system.

</comment><comment><USER13> I think the key to success here is the credit being drawn from the local government not the immigrants. It's brilliant, frankly.

</comment><comment><USER14> Google the Worgl Experiment about a town in Austria that did this for their own residents to try to get out of the Great Depression.

</comment><comment><USER15> Local currencies are an interesting thing, but I think that calling these notes "euro" is a big blunder. Even if they are intended to be exchanged at parity, they are definitely not euros. The ECB could not like this.

</comment><comment><USER16> This just sounds crazy.

What are the credit notes backed by? I assume the shopkeeper can change them to euros. But does the city have enough euros cover all issued notes? Or are they effectively running a ponzi taking the real 35 euros a day from the government and covering the refugee obligation with a credit note.

This should not be legal (and probably is not).

<comment><USER17> Legalities aside, there is a long tradition of giving out "fake" money to foreigners that can only be used in exchange for certain goods and services. In turn, local shopkeepers can use the certificates to exchange at some fixed rate for currency. The first time I ever heard about such a scheme was "occupation money." I have some of the German bills around here somewhere from my family members when they were issued them, here's a wikipedia page: [https://en.wikipedia.org/wiki/Allied_Military_Currency](https://en.wikipedia.org/wiki/Allied_Military_Currency). I think the best thing about these schemes is that they keep the currency local vs. enabling refugees from (understandably) sending the money back to relatives (who perhaps need it more).

<comment><USER16> I don't have high thoughts about schemes like this.

First off: Why plot pictures of communist leaders on the notes?

My guess is that they know what they are doing and want to put the "fog of politics" over it.

Don't accept our "patriot dollars"? I guess you hate our freedom, damn french person.

Think our "refugee euros" are a ponzi scheme? Nasty racist bigot.

Making sure that any discussion of the soundness of the scheme degenerates into a discussion of divisive politics.

Secondly: The 35 euros pr. person the state gives the city to cover all expenses of taking in refugees is probably not a windfall. It is probably too little as it needs to cover everything from hospitals, schools, food, housing, processing cost and so on. (And not enough to give cash handouts for the refugees to wire back home.)

But if you are a manipulative politician you can use the cash you get from the state to run a ponzi scheme and claim the temporary surge in activity is due to the benifits of multiculturalism, your forward-looking leadership or whatever.

</comment></comment></comment><comment><USER18> Nice and nifty, good for them.

Alas, the story illustrates a not-so-nice point some are making: a big incentive for indefinite protraction of the European refugee crisis is the concomitant wealth transfer from tax payers (almost everybody), savers (many), and indigenous workers (many) to businesses (few).

</comment><comment><USER19> It isn't 'fake money' at all. It's every bit as 'money' as Euros, the only difference is the size & scope of the respective issuers.

</comment><comment> Digit-Al I'm curious as to how they prevent fraud.

</comment><comment><USER20> Calling it "fake money" is highly misleading (to me at least). This "fake money" system sounds a lot more similar to food stamps or vouchers.

<comment><USER21> objectively speaking, all fiat money is fake. the only "real" money would be considered notes backed by hard assets that can be produced on demand, like gold, silver, or other hard assets.

<comment><USER22> Why is shiny rock more real than pretty paper? It's all a collective hallucination

<comment><USER23> "hard assets" means "things that people would want even if the bank that gave them out collapsed". People wanting shiny things is seen as a more reliable collective hallucination than any specific economy.</comment></comment></comment></comment>


Duktape is an embeddable JavaScript engine, with a focus on portability - <AUTHOR> https://duktape.org/ <comment><USER2> I was taking a Game Engines class at my uni last semester and we had to add scripting to our C++ engines using Duktape (or it's C++ counterpart, Dukglue.) It was surprisingly easy to use Duktape once you figured out the initial boilerplate, and it was especially exciting and fun to be able to write a demo game using the engine in two languages (especially with one which didn't require recompilation!)

</comment><comment><USER3> Just keep in mind that performance is abysmal (order of magnitude of 1% vs what you are used to in a browser for the same amount of cpu time spent), which might be ok for your use case, just keep in mind that many libraries assume a somewhat performant runtime. Another down point is that you are stuck with ES5.

<comment><USER4> For anyone who needs a performant "JavaScript for embedded" runtime that also fully supports ECMAScript 2018, Moddable's XS is a great choice.[1]

Moddable is the only embedded engine provider in the Ecma TC39 JavaScript language committee, so they tend to be really aggressive in supporting new JavaScript features.

[1] [https://www.moddable.com/faq.php#comparison](https://www.moddable.com/faq.php#comparison)

<comment><USER5> How difficult would it be to port Firefox's javascript engine to embedded platforms?

<comment><USER6> I've never tried, but Mozilla's example doesn't look that hard.

[https://github.com/mozilla-spidermonkey/spidermonkey- embeddi...](https://github.com/mozilla-spidermonkey/spidermonkey-embedding- examples)

The big issue (like with v8) is binary size. Double-digit megabytes before you even start running code is unacceptable in a lot of environments.

<comment> X-Istence It's a giant pain in the behind, if you can even get it to compile correctly.

</comment></comment></comment></comment></comment><comment><USER7> I tried it on embedded. Wasn't happening for me. Eventually moved to mJS a similar JS engine for C. Eventually dumped that and moved to Lua.

Part of the issue is I needed a scripting engine, but I didn't NEED JS. It was also a pain that the code/script was in ASCII which had to go to base64 and none of this was as good as compiled for efficiency.

I wasn't going to let users run their own code, so that's probably a big reason people use this.

<comment><USER8> TCL would have been another choice. Still used by quite a few commercial entities as an embedded scripting language.

<comment><USER7> I need FFI (foreign function interface) to fall C functions from the scripting language. My glance into TCL did not turn up a native FFI.

<comment><USER9> Ffidl ([https://prs-de.github.io/ffidl/](https://prs-de.github.io/ffidl/)) is the standard library extension for Tcl to make use of FFI.

Tcl's philosophy is to keep the core lean and extend functionality via loadable libraries.

<comment><USER7> I'll take a look, thanks.

EDIT: Not too bad actually. I'll take a look and compare to Lua. I'm not ::crazy::about:TCL's syntax, but it's not that bad.

</comment></comment></comment></comment></comment><comment><USER10> moddablexs and quickjs are probably better at this point, with current spec compatibility and whatnot. still a lot of respect for duktape though, it is not that bad to embed.

<comment><USER11> QuickJS has a relevant comparison/benchmark: [https://bellard.org/quickjs/bench.html](https://bellard.org/quickjs/bench.html)

<comment><USER6> 600kb or 1.2mb are way larger than 330kb and makes them much less suitable for smaller embedded applications which Duktape seems to target (it can get way smaller than 330kb).

I'm surprised with v8 though. I assumed they'd have a separate binary available so you could run jitless without having to carry all the binary bloat.

<comment><USER12> Another thing to consider (and probably part of the size difference) is QuickJS carries with it about 5 years newer JS standards support than Duktape.

<comment><USER6> I suspect these two things are related. ES2015 more than doubled the size of the spec and each spec since then has continued adding loads of things that take precious kb to implement.

That said, it seems like there are serious code savings to be had with some things like destructuring, template strings, and arrow functions. Generators are probably complex to add, but also don't transpile well (that is, debugging the resulting code is a horrible experience).

</comment></comment></comment></comment></comment><comment><USER13> I have used this to steal JS libraries I wanted into other high-level languages that had Duktape wrappings

</comment><comment><USER14> the legendary option has always been Lua: small, fast, light-weight, easy to embed and get the job done.

</comment><comment><USER15> Can also recommend QuickJS which has 2020 features. Duktape is ES5.

</comment><comment><USER16> i feel compelled to share Figma's experience trying out Duktape to build a plugin system: [https://www.figma.com/blog/how-we-built-the-figma-plugin- sys...](https://www.figma.com/blog/how-we-built-the-figma-plugin-system/) they picked somehting else in the end but its a great use case</comment>


Efficiency of regular expressions - <AUTHOR> http://www.johndcook.com/blog/2011/01/20/efficiency-of-regular-expressions/ <comment><USER2> The single worst thing that people do wrong when writing regular expressions is to use .* x when really they should use [^x]* x (i.e. the common case of looking for some kind of terminator 'x')

The worst case I ever saw had many .* running over some c++ source which would take several minutes per file. Presumably trying all combinations of backtracking. With the negated character class [^x] it was < .1 of a second.

Edit: I see his twitter feed has .* as the icon. Ha!

Edit2: My * are getting eaten by the formatter. There should be no space after them

<comment><USER3> This would be highly dependent on the implementation of the regex engine itself, would it not?

<comment><USER4> Right. The size of the difference will depend on the implementation details (e.g. if it uses backtracking or not), but the form the GP proposes will never be slower. And arguably it better captures the intent of the RE.

</comment></comment></comment><comment><USER5> Another problem with regular expressions is using them inappropriately. If you have elaborate, convoluted regular expressions, it's usually a sign that you should try using a parser as well. Regular expressions cannot maintain context (though some extensions have ad hoc extensions for doing this inefficiently and in a limited fashion; apparently the problem is NP-complete), so doing things like balancing parenthesis or HTML tags in a recursive expression is impossible.

Using regular expressions to break the input text into tokens ("tokenizing" or "lexing") and then matching the sequence of tokens according to a grammar ("parsing") is usually much simpler. The two-phase approach often factors out some complexity - only the lexer needs to care about things like whitespace, for example.

While most compiler textbooks cover lexing and parsing, I particularly recommend Andrew Appel's _Modern Compiler Implementation in ML_ and Niklaus Wirth's _Compiler Construction_ (free online, <http://www- old.oberon.ethz.ch/WirthPubl/CBEAll.pdf>).

More recommendations on learning parsing here: <http://news.ycombinator.com/item?id=1820858>

<comment><USER6> There are exactly two reasons that regular expression parsing "needs" to be slow. First, we have the "ad hoc extensions for doing this inefficiently and in a limited fashion", and second, we have subexpression capture. Backreferences (the former) are generally only useful in situations where you really ought to be using some other construct. The backreferences are the part that's NP-complete.

Subexpression capture is great, and at least that can be done in (low-order) polynomial time with a nondeterministic automaton approach. So really, the only problem is the backreferences.

</comment></comment><comment><USER7> The only useful part of this article is the article it refers to. To save readers some time, here it is:

<http://swtch.com/~rsc/regexp/regexp1.html>

<comment><USER8> I hate when people submit a rambling blog post that contributes no content to the actual item the post links to.

</comment></comment><comment><USER9> I recently used a regexp library in Scheme for lexing. The result was O(n^2) on the number of tokens in the input stream. I searched for ages to find where I had gone wrong and finally realised it was the regexp library itself. I switched to Common Lisp, which has a greater choice of regexp libraries. The same library exists there too, with the same problems, but switching to the cl-ppcre library made the problem disappear instantly.

One problem with Scheme itself appears to be that there is no way to examine a portion of a string. The substring function actually makes a whole new copy of the part you want to examine (which may be the remainder of the input string after the token you just lexed, as it was in my case).

Most of the string functions in Common Lisp are set up so that you can specify a starting index in a string so that it is possible to examine portions of a string without making a whole new copy.

</comment><comment><USER10> I wish we had a term that meant "things like regular expressions, that may not actually define regular languages". A real regular expression can always be translated to a DFA, and be executed in O(len(input)) time. Perl regexpen are not regular.</comment>