Try Objective-C - <AUTHOR> http://tryobjectivec.codeschool.com/ <comment><USER2> Very nice presentation, but it seems like this could benefit from an Emscriptened browser-based Objective-C compiler.

Fabrice Bellard's browser-based Linux boots in less time than this prints out "Hello, world!"

<comment><USER3> We're reusing the stuff we built for the Try iOS course we came out with late last year. I've looked into Emscripten for this and from what I saw it really wouldn't work with this course, although maybe I missed something?

<comment><USER4> You could always boot the VM with an image that contains the compiler and run there. If it truly does boot faster than the results take otherwise then you could move it all into javascript that way, and not have to worry as much about the infrastructure around it.

</comment></comment></comment><comment><USER5> Very cute. I did the first 9 challenges. I am rather worried though that you're teaching people that `NSLog(var)` is acceptable, because it's a horribly dangerous thing to do if var contains untrusted input.

<comment><USER6> Huh? How so?

<comment><USER5> If the variable's value contains any format args, e.g. %s, then NSLog (or printf, or whatever string formatting function you're using) will look for another argument, which you didn't actually pass, so it starts looking at garbage stack values.

Besides causing incorrect output, this may crash your program, or potentially be a vector for an exploit.

<comment><USER7> Is there any reason NSLog doesn't filter input to escape these format args?

<comment><USER8> It can't. <http://en.wikipedia.org/wiki/Uncontrolled_format_string>:

 _"In particular, the varargs mechanism allows functions to accept any number of arguments (e.g. printf) by "popping" as many arguments off the call stack as they wish, trusting the early arguments to indicate how many additional arguments are to be popped, and of what types."_

NSLog is similar; it has to trust its first argument to be consistent with the number and types of arguments actually passed to it.

If you call NSLog(x), but do not have complete control over the value of x, you cannot guarantee that.

</comment></comment></comment></comment></comment><comment><USER3> Sorry for the slow response times on the challenge submissions everyone. We only have so many Mac Minis running these things . We are looking into ways to speed it up

<comment><USER9> Looks like those Mac Minis are getting smoked right now, poor little guys. I can't load the page unfortunately to see myself, but could you use GNUStep to compile the examples on any flavour of box?

<comment><USER3> I know I feel so bad for them. We are working on some temporary fixes (including caching which as we all know is really easy to do) and changing the way we isolate the code submissions so we can get more throughput. GNUStep might be an interesting long term fix.

</comment></comment></comment><comment><USER10> I have to work on porting an iPad app to Java from a guy that didn't bother to use comments or any documentation and his idea of versioning system are a bunch of folders 1,2,3 for different components whose numbers dont always match up.

I'm afraid I've been scared off Obj-C for life now.

<comment><USER11> "a guy that didn't bother to use comments or any documentation and his idea of versioning system are a bunch of folders"

What does this have to do with the Objective-C language itself?

<comment><USER10> nothing at all. but it scared me off. like in highschool i had this german teacher who scared me off german because she was a massive bitch. not the language's fault, but i hate german now.

<comment><USER12> You hate X because of a completely-unrelated-thing-Y? Try acting like an adult.

<comment><USER10> Why don't you try acting like a human.

</comment></comment></comment></comment></comment><comment><USER13> I really like this, but I'll have to give it another try in a few hours after work when the HN rush subsides and gives the server some time to breathe/compile the challenges.

<comment><USER3> Good idea, and our minis thank you ;)

</comment></comment><comment><USER3> I repurposed the content in the course to produce a simple HTML version of the course here:

<http://rubymaverick.com/try-objectivec-book/>

The content is up on my Github and any pull requests would be welcome!

<https://github.com/rubymaverick/try-objectivec-book>

</comment><comment><USER14> Yow, that backend compilation step taking 20 seconds makes this way less fun than it looks like it should be :-/

</comment><comment><USER3> We've gotten the course back up and responding to submissions in a reasonable amount of time (2.5~ seconds as compared to 30~ seconds earlier).

Please form a single file line behind mietek ;)

</comment><comment><USER15> Is there anywhere I can read about the mac mini backend for this? Sounds interesting.

</comment><comment><USER16> Only one complaint from me: error messages. I realize this is probably a complicated problem, but on the other hand, can alienate beginners.

For example, on the first exercise, you're asked to write NSLog(@"Name"); When I did it, I first missed the semicolon, and got an error "expected ';' after expression". Okay, fine and good, that makes sense. I added the semicolon and got "'extern' variable has an initializer" because I called NSLOG instead of NSLog. Even for a programmer, that's not a helpful error message...

<comment><USER3> Thanks for the examples, and I agree that error messages are super-important for beginners. We have written a bunch of code trying to "massage" error messages to be more helpful. I'll be adding these to the list, thanks!

</comment></comment><comment><USER17> Only getting 504s at the moment. Will try again later..

</comment><comment><USER18> The Super Mario World theme is cool, although super ironic since Objective-C/iPhone is helping to displace the Nintendo Empire.

</comment><comment><USER19> Very interesting. I started with Try iOS but getting an actual app together in Xcode proved more difficult than I thought, partly because Obj-C still felt so weird after only learning Java/C# during university.

I ended up buying the Big Nerd Ranch book (it's great!) on iOS programming, which also covered Objective C in more detail.

</comment><comment><USER20> Is it just me or do I really have to answer to Moby-Dick trivia while coding Objective C?

On the 1st level, I couldn't progress unless I used 'Ishmael' as firstName and 'Moby-Dick' as lastName.

</comment><comment><USER21> I wish I had this 7 years ago when I was first learning the language.

</comment><comment><USER22> I clicked "Start Course" and was greeted with a 404 that took way too long to load on my 50 megabit connection.

/shrug

Oh well, I'm sure there are other sites out there.

<comment><USER9> It's running on Mac Minis dude, and they're getting hammered. Bookmark it and visit again later. That's what I'm doing. :)

</comment></comment><comment><USER23> I like the new Git course, but I still can't take the first one... maybe fix that first?

<comment><USER24> We see green across the board for all 3 git courses, if you're personally having problems with one of them you should head on over to <http://codeschool.com/support> and drop them a ticket. :)

</comment></comment><comment><USER25> the site is very slow loading next page after clicking submit... Also, no option to skip the stupidly easy levels.

<comment><USER3> I'm actually working on extracting all the content for just a plain HTML version so people who don't want to do all the challenges will have something to read (it's almost a books length of content)

</comment></comment><comment><USER26> it seems a nice place to start.

</comment><comment><USER27> This seems fun. Unfortunately it is stuck at challenge 2 and takes about 2 minutes per compile.

</comment><comment><USER28> Good stuff... I guess?

I still fail to see the appeal of learning a language with such extremely limited value (only works, has tools and adaptation on a certain lawsuit-happy gadget-vendor's OS).

Anyone? And what about principles? What about giving back to the community? Shouldn't hackers hacking away on the next big thing be using open technologies as open technologies was what enabled them to get hacking in the first place?

<comment><USER29> Politically I agree, but Objective-C is a better language than C++ or Java, and Cocoa is a better framework than the STL or the Java core libraries. That's before we get to the GUI experience. Learning it will make you a better programmer.

<comment><USER30> Since I became a convert to the "put your own VM in the frameworks and add a cute language for your core logic" kind of school of thought, I seriously cannot see the value in Obj-C and the Android/Java thing. I've been writing code in these environments for decades: I'm now seriously addicted to Lua.

2 years of Lua work, and I absolutely cringe with the idea of having to go back to Java/Obj-C/C++, in any context other than to push a bridge across the VM gap to some framework.

Its a smaller language, its lighter. It performs quite well, and can be put almost anywhere there is a lib.so file (so: everywhere). Choose what you want to link with, extend the external API's with Lua, and leave the whole problem of obscure languages for the young 'uns..

So, its not so much about my desire to pimp Lua, but my point is this: You can choose whatever language you want, actually, to develop a core host environment with, but use a very simple, sweet language for the majority of the work.</comment></comment></comment>


China's bike-sharing bubble is producing graveyards of bikes - <AUTHOR> https://www.fastcompany.com/40571302/chinas-bike-sharing-bubble-is-producing-graveyards-of-bikes <comment><USER2> That's totally crazy. What are the economics here, it would seem some of these companies are losing money in a big way?

That's paperclip maximizer insanity level. There is a bit in thhgttg where there is a planet that ends up experiencing a shoe event horizon. That was fun because it was fiction, this is roughly the same on a city scale but with bicycles and it is real.

</comment><comment> dis-sys it is a cancer.

those rubbish bikes are probably not cleaned for 12-18 months, half of them are broken due to the lack of maintenance, most of them are now full of illegal advertisement stickers with hookers cell phone numbers.

just disgusting</comment>


Georgia election server wiped after suit filed - <AUTHOR> https://www.apnews.com/877ee1015f1c43f1965f63538b035d3f <comment><AUTHOR> And from the middle of the article: _two backup servers were also wiped clean on Aug. 9, just as the lawsuit moved to federal court_.</comment>


My Experience Using .NET Core in the Real World - <AUTHOR> http://savorylane.com/blog/post/my_experience_on_clrcore <comment><USER2> I'm pretty new to the web side of things so I decided to check out .net core to see if I could reuse my small asp.net knowledge but sadly I ran into the wall of missing libraries.

In the end I moved to node.js simply because of the huge library of libraries but I'm definitely going back to .net core when it will actually be released</comment>


How Ethereum can be stolen through DNS rebinding - <AUTHOR> https://ret2got.wordpress.com/2018/01/19/how-your-ethereum-can-be-stolen-using-dns-rebinding/ <comment><USER2> > PS: This has been reported to the ethereum foundation but they don't > consider it a valid vulnerability.

This is ludicrous. If a _torrent client_ considers this class of bug to be a vulnerability[1], I don't see why folks who are trying to revolutionise money (something that is far more important than a few small RCEs) don't. While it is true you need to run it with the --rpc option, I'm confused why the RPC is unauthenticated by default, and whether there is any front-end that will start up the RPC server in the background (similar to electrum).

[1]: [https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2018-5702](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2018-5702)

<comment><USER3> This type of mentality is very pervasive in ethereum culture. They built their scripting language with this mentality. They chose to have multiple clients with this mentality. They designed their 12 second blocks with this mentality.

That's why a lot of the more technical people really dislike ethereum. It's not one or two problems. The entire system all the way through want made with the mentality of compromising stability in favor of getting features sooner.

<comment><USER4> The downsides of Ethereum is discouraging me a bit from developing on their platform. Then again they are the biggest smart contract crypto currency, but maybe it could be worth to build things with another one even so. Could you recommend some with good technical foundations that are ready for use today and with enough documentation that it's possible to understand? I know Ark plan to but as far as I am aware they have not yet implemented smart contracts. NEO on the other hand I know supports smart contracts today and some different languages. Don't know what actually building something with NEO is like though. Any one have experience with NEO? Any other crypto currencies with smart contracts?

<comment><USER5> People don't like to hear this, but blockchain tech isn't ready for a general app platform. Bitcoin could easily be extended to have an EVM if it was a good idea, but there are lots of unsolved problems, gotchas, and overheads that make it a poor choice. I don't think that's the perpetual state of things, but I do think that every 'dapp' platform out there today is bad foundation, and largely that's because it's too early to be making general platforms.

The approach that a couple of currencies have taken (including the one I lead) is to make a separate blockchain entirely dedicated to their app. And I think that's a far better choice than anything out there, though it comes with the glaring downside of needing to build and run your own blockchain, which is a very difficult thing to do.

Most of the apps we are seeing today don't make any sense anyway. Very much smacks of the dotcom bubble, where people who suspected that the Internet would change the world were absolutely correct, but then the companies and ideas they put their money behind were missing the mark by miles.

We've got the same issue today. Most successful ICOs are going to fail very hard, due to known impossibilities, known poor uses of the technology, etc. It's just a general fever that has a lot of new entrants in the space innovating in the wrong direction.

It will get better. Dapp platforms will appear that make sense, have good foundations, and are easy to setup and use. But it's not around the corner, it's probably 3-5 years away.

<comment><USER6> > Most of the apps we are seeing today don't make any sense anyway. Very much > smacks of the dotcom bubble, where people who suspected that the Internet > would change the world were absolutely correct, but then the companies and > ideas they put their money behind were missing the mark by miles.

This is the crux of the problem. The cryptocurrencies with the highest valuations right now are ones with serious technical and social flaws--people are investing in cryptocurrencies based on hype rather than merit.

Ethereum is the most egregious example: the idea that _a JavaScript-like language_ is what you'd want to write your security-intensive code in is mind- boggling-ly stupid, and after the community showed themselves to be willing to perform a 51% attack on their own blockchain to fix a problem with the DAO, it's not even decentralized any more. So technically you have all the downsides of writing secure software _in JavaScript_ , and socially you have all the problems of centralization AND all the problems of decentralization. The security flaw this thread is about would be a critical vulnerability to any competent security developer, but it's really minor compared to the more fundamental flaws.

But even in competently-developed cryptocurrencies, the problems are still there because people don't understand or value decentralization, which is literally the entire reason Blockchain is worthwhile. The number of people who buy cryptocurrencies and then leave their coins sitting on an exchange is incredible. You're literally donating money to the world's biggest bug bounties when you do that.

<comment><USER7> In my opinion, decentralization is not the point of crypto-tech. Maybe it's some minor feature, but not the selling proposition. The major feature is the formalisation of the concept of consensus. Forks are a manifestation of this feature. "a 51% attack on their own blockchain" is a major feature of crypto- tech. In the last century we would call this a revolution. In this century issues like this can be resolved enterily in software. It's an opt-in economy and in some years an opt-in society.

The only reason you think the cash in your portemonai is worth something is that everybody else things the same. As soon as everybody stops believing it, the paper in your wallet can still be used to make fire. Same goes for authorities. Judges, policemen, presidents are what they are because everybody believes it. We have already an informal consensus of who is a policeman and who is not. Most of the time it resolves to whether somebody wears the uniform. Crypto tech promises to make this verifiably. No need for uniforms.

<comment><USER6> > The major feature is the formalisation of the concept of consensus. Forks > are a manifestation of this feature. "a 51% attack on their own blockchain" > is a major feature of crypto-tech. In the last century we would call this a > revolution. In this century issues like this can be resolved enterily in > software. It's an opt-in economy and in some years an opt-in society.

Huh? No. Distributed consensus was formalized in 1978 by Leslie Lamport and the first version of Paxos was introduced in 1989. If you're okay with centralization, Paxos or it's successor, Raft, are much faster and more scalable algorithms than blockchain, and have a wide variety of mature implementations.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I once lost bitcoins in my Mt Gox account when I clicked on a dodgy popup while logged into my account.

This specific problem is easily mitigated. However, for most people who dabble in cryptocurrencies, they don't realize relying on security and setting defaults is just asking for trouble.

</comment><comment><USER9> On Reddit ret2got quoted the EF on why they don't consider this a geth vulnerability:

      DNS rebinding to bypass SOP is an old and known issue. There is nothing
      particular about geth being vulnerable to this.
      * The RPC api is not the primary protection against theft of ether, users are
        encouraged to have a long and difficult password, presumably difficult to
        bruteforce.
      * Although I cannot find the ticket right now, we're already considering
        being even more strict on Origin, so that geth would not accept
        POST-requests from non-whitelisted Origin:s (by default).

[https://www.reddit.com/r/netsec/comments/7s7cz9/dns_rebindin...](https://www.reddit.com/r/netsec/comments/7s7cz9/dns_rebinding_of_ethereum_clients/dt2ps6l/)

I'm not sure about the first bullet point. You have to unlock your accounts before calling any balance-changing methods but I don't know if there is a default time after which the accounts get locked again.

Even if there is, isn't there a time period while your accounts would be vulnerable?

As this seems easily mitigated by a simple security token, I don't see why they shouldn't implement this.

<comment><USER10> Sounds more like they are admitting its a vulnerability but downplaying its impact

</comment></comment><comment><USER11> >PS: This has been reported to the ethereum foundation but they don't consider it a valid vulnerability.

How are DNS rebinding attacks not a valid vulnerability?

<comment><USER12> The user chose to run an unauthenticated service on localhost. Anything on localhost (eg a browser) can access it without authentication.

The vulnerability is allowing the service to run without authentication.

<comment><USER13> This is not how I understood OP - victim just happens to visit attacker.com, everything else is up to attacker. Or am I missing something?

<comment><USER14> The victim needs to be running a local geth node(with his wallet unlocked for hacker to actually steal funds) which will give the attacker the wallet addresses atleast.

</comment></comment></comment></comment><comment><USER15> This is why, when I've written an app that runs on localhost, I generate a random token to authenticate access to it, then launch a web browser pointing to the localhost URL with that token. It prevents this type of attack entirely, it's sort of like XSRF prevention.

<comment><USER16> The Parity cli (Parity is a Proof-of-Authority Ethereum testnet) does exactly this:

[https://github.com/paritytech/parity](https://github.com/paritytech/parity)

<comment><USER17> This is not quite right - Parity is an EVM implementation, and supports the PoW Foundation chain, amongst other configurations like PoA.

</comment></comment></comment><comment><USER18> If you are utilizing json-rpc anywhere in your stack, you should be authenticating every request via your transport(s), or the payload itself with JWT (or the like). To not do this, is to trust the world.

This is true over http and browsers, as well as internal servers, sockets, and cross frame communication. There are no such things as trusted internal services, just services that have not yet been breached (looking at you hardware vendors).

<comment><USER19> And how would one do this?

<comment><USER18> See the details in my comment. The same way you would require authentication and/or signing on any request, on any modern platform. Not doing this is poor form.

</comment></comment></comment><comment><USER20> I don't understand why DNS rebinding isn't being fixed by browser vendors. If I make an application that listens only on localhost I shouldn't have to take special steps to ensure random 3rd party remote hosts don't have access to it. The browser's DNS client could see if any recently accessed public IP now resolves to a private IP range and force a fresh CORS check.

<comment><USER21> From the previous discussion linked above: [https://news.ycombinator.com/item?id=16563135](https://news.ycombinator.com/item?id=16563135)

> I regularly encounter users who don't accept that websites can access > services on localhost or their intranet. These users understand that > services bound to localhost are only accessible to software running on the > local machine, and that their browser is running on the local machine – but > somehow believe that accessing a website "transfers" execution somewhere > else. It doesn't work like that, but this is a common source of confusion.

</comment></comment><comment><USER22> If you run your own resolver those can be trivially filtered out.

For example in unbound there's

        private-address: <IP address or subnet>
                  Give  IPv4  of  IPv6  addresses  or classless subnets. These are
                  addresses on your private network, and are  not  allowed  to  be
                  returned  for  public  internet  names.   Any occurrence of such
                  addresses are removed from DNS answers. Additionally, the DNSSEC
                  validator  may  mark  the  answers  bogus. This protects against
                  so-called DNS Rebinding

<comment><USER23> Filtering out 127.0.0.1, which is likely what these rebinding attacks utilizes, may cause problems if you run spam filters or ad blockers that use these addresses in their replies. Just something to be aware of, especially of your resolver services other clients than your personal localhost.

<comment><USER22> Adblockers shouldn't be affected since those usually are operated locally, either as part of the resolver itself or downstream by a user which can always overrule the DNS results.

And for dns blacklists you can exempt their domains from these rules.

</comment></comment></comment><comment><USER24> People may be interested in a discussion we had about the trust-dns-resolver and some preventative measures in this area: [https://github.com/bluejekyll/trust- dns/issues/347](https://github.com/bluejekyll/trust-dns/issues/347)

The thing I'm most disappointed with is that because we've been so lax about 127.0.0.1 and it's usage, it's become a means of different applications to blackhole requests suchas ad-blocking networks.

Better than that though, are the applications that are using localhost resolution from public names to communicate with local versions of their applications from the browser.

The sad thing, is that because of these we can't just make a simple resolution policy. The one I would like to be true is that only localhost names can resolve to localhost (this doesn't require any remote resolution), and that you must whitelist private domains for private address spaces (e.g. 10/8). For localhost it's a very simple area in resolution code to drop RData with 127.0.0.1, private address spaces would need a little more but still easy to identify when to apply it.

For now it seems that we have to rely on applications to do a better job of using things like TLS to validate the endpoints to which they are connecting and verifying that the IP is in the expected scope.

</comment><comment><USER25> This is just one of many vulnerabilities in Geth and other Ethereum clients due to unauthenticated JSON-RPC on localhost. You might recall this even hit Redis years ago.

There are many simple solutions (force auth, xsrf token) and it is mind- boggling that these mitigations are not considered standard-issue in the space.

</comment><comment><USER26> I remember checking this issue. Parity has origin whitelisting to prevent exact. No idea why geth is so stupid.

</comment><comment><USER27> TL;DR Geth 1.8.0 shipped with [DSN rebind protection]([https://github.com/ethereum/go- ethereum/pull/15962](https://github.com/ethereum/go-ethereum/pull/15962)), so as far as we know, it's not vulnerable.

\---

We originally rejected the bounty report because:

* We always recommend people communicate with Geth via IPC, not HTTP. The APIs are too powerful for public access: even if noone can steal your Ether, they can exhaust all your local resources via eth_call for example. Our suggestion is to always run a custom proxy that properly rate limits and authenticates outside users vs. running an HTTP server inside Geth. CORS is a protection that always depends on browsers correctly enforcing it, which have been circumvented multiple times, so it's not a good enough security measure. * For a very long time now, we considered unlocking an account a dangerous operation recommended only to power users who can properly protect their setup. Mist and other applications transact via API endpoints that __do not __unlock accounts, so unless a user explicitly manually unlocks their account, they should be fine.

That being said... even though we consider the attack vector fairly convoluted and would require a lot of bad user practices to pull off; we agreed that if we can do anything meaningful to prevent it, then we should most definitely do that. For that reason we introduced the `--rpcvhosts` flag which is similar to CORS, but checks the requests origin via different means, and rejects DNS rebound HTTP actions server side.

As for the original report, although we rejected the bounty request initially, we agreed that it should be rewarded with a low-impact value since we did make a software modification based on the report. Unfortunately this bounty decision is waiting for approval since the 5th of February. Not sure why it got stuck in the pipeline, we apologize for the delay.

</comment><comment><USER28> DNS rebind attacks can be prevented with dnsmasq. It also has an option for domain-based whitelisting if necessary.

</comment><comment><USER29> >Since the DNS cache has expired, the browser resolves the DNS again. This time, my server responds with an IP of 127.0.0.1.

Sounds like a normal DNS rebind, nothing that is strictly a problem of ethereum.

Routers have had the same exact problem for years and it's been partially solved by filtering DNS answers on their side.

The easiest solution, of course, would be that browsers consider the origin of any domain pointing to 127.0.0.1 different to localhost itself. Or something in that postcode/general direction.

</comment><comment><USER30> The proof of concept site is unavailable because its DNS setup is broken. It has no SOA record.

</comment><comment><USER31> Can we all come together and encourage browser developers to fix their shit instead of blaming every service that makes reasonable assumptions about localhost.

I do think that Ethereum ought to authenticate it's JSON-RPC service, but not because of DNS rebinding.

<comment><USER32> Isn't it a pretty reasonable assumption that code running on your local computer will be able to access local unauthenticated resources?

<comment><USER31> Isn't it a reasonable assumption that you won't run untrusted code on your computer without sandboxing it properly?

<comment><USER33> Are we not doing multiuser systems anymore?

<comment><USER31> Sure we are. What does that have to do with DNS rebinding?

<comment><USER33> I don't think it has anything to do with DNS rebinding, but it seems like it would have a lot to do with having unauthenticated RPC services bound to localhost.

<comment><USER31> Well...

> I do think that Ethereum ought to authenticate it's JSON-RPC service, but > not because of DNS rebinding.

<comment><USER33> I'm a bit lost, because right before that you described it as "reasonable assumptions about localhost" when they don't seem at all reasonable to me.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER34> In OpenWrt, DNS Rebinding is disallowed by default.

Not so with many other firmwares.</comment>


Show HN: LensAI as a marketing tool that grabs every customer's attention - <AUTHOR> Hi, Y Combinator Community!
I am Pavel, a co-founder of LensAI. I want to introduce you to a new affiliate marketing platform I am currently building with my team of engineers that turns image and video content into an interactive shopping experience.
We are building the LensAI product to give Advertisers an innovative way to turn around the current tendency of their ads being ignored.
LensAI Technology's prime focus is to oppose causes that minimize the chances of the advertisement being viewed. We aim to boost any advertising strategy as we fight ad blindness and ad irrelevance and provide Advertisers with a tool that helps them to sell their products in the times of the world's overproduction.
Studies show that desire to shop often comes from the visual content we explore, that is why we created a new ad format that is hyper-relevant to the content and being delivered in that perfect moment of the content inspiration.
We taught AI to perform both content and context analysis. We also enabled it with a function to automatically deliver our AI-powered ads, and they are embedded straight into the detected product from image or video content in real-time!
Here is the project link https://lens-ai.com Please, make sure you stop at Slide #2 at lens-ai.com to see how my technology works on the famous "Diana" movie trailer.
We are on ProductHunt: https://www.producthunt.com/upcoming/lensai
Let me know your thoughts! <comment><USER2> I would pay monthly fee for your technology if works for me by actually removing ads.

<comment><AUTHOR> LensAI Technology is for Advertisers to advertise; it is not an Ad Blocker. Digital ads are how Publishers get paid for their efforts. I am here to help both.</comment></comment>


Ask HN: Unpaid internship followed by unpaid work with equity. I'm a student - <AUTHOR> preface:
- I still have 1 year to go in my CS degree from a Top 5 university in Canada that is not Waterloo or Toronto.
- Canadian citizen
- Living in Canada in a big city
current situation:
- The only opportunities I got from any place for the summer are unpaid ones in start-ups that have no founding. 3 weeks of 'seeing how things work out' time and then no payment 'until they get funding' but an offer of ~1% equity. I got three offers like these and went with one of them.
- Let's not kid ourselves here, my GPA is super low, going from 3.5x to an atrocious GPA after a break up.
- I am no rock star developer but I am diligent in what I do. And frankly, I can code at least a little, had OK grades before messing up my life, and I answered the simple interview questions that they gave me.
my ideas (options):
- Suck it up for 3 weeks, learn tons and be 100% honest that I won't be staying, even as a part-time person because it makes not much sense to do so.
- Suck it up for this summer, improve my code, make personal projects and actually show that I could be hired by a bigger corporation.
- Still be honest and stay even after the 3 week trial, if they let me
more details:
-I have lived very comfortably for around ~8k per year for the past two years, including rent, as a student.
-I live at home now. I have no student debt, and 20k in the bank from inheritance.
therefore:
Minimum wage is fine, but I didn't interview with any big company or anything because I really feel inadequately bad compared to other developers out there. I would also not mind ending up cleaning or anything like that, but I just really like coding and stuff.
bottom line:
what's your advice for someone in my position? <comment><USER3> You're being massively exploited. You'd be better off spending your time working on some visible Open Source project that you can later hold up as an example of your work, which will have a far higher expected value than equity in a startup that's not even bothering to pay their developers.

Make a significant contribution to an existing project, which carries a lot more weight than starting a new one unless you create something earth- shattering. Talk with some of your professors, who will likely have some experience and connections there, and who might be willing to suggest a project; also seek out prominent projects with TODO lists.

And in your remaining year, do whatever it takes to get your focus back and improve your grades. Remember, there _is_ a grade above A+; it's "hey, I have this project you might find interesting". Half of the value of your education will occur outside of your classes. Depending on just what you mean by "atrocious", you might also want to retake some critical courses, both for the grade and in case you missed something foundational.

Also, don't sweat the "rockstar" thing, and don't undervalue yourself; diligence is a critical skill that people often undervalue, and well-applied diligence plus experience makes for an exceptional engineer. I'll take diligence over half of the "rockstars" out there any day.

When you go to build your résumé, highlight the project or projects you worked on and the impact it had.

<comment><AUTHOR> Well, now that I think about it I also undervalued myself and almost didn't apply to university thinking that I would not get accepted.

I think that you are right in that I should work on a visible Open Source project, even if only contributing in small bugs and documentation. Eventually, and with at least some projects under my belt I hope I can land a small position somewhere.

Yet, I don't feel exploited at all because the money issue was discussed with me in an upfront manner and I have not done any amount of work yet. And besides, it is a position that offers experience that I can put later on my CV and potentially eventually it will lead to a paying job.

So in a sense, isn't it riskier to not accept this offer?

I dunno, I still have some doubts...

<comment><USER3> > Well, now that I think about it I also undervalued myself and almost didn't > apply to university thinking that I would not get accepted.

Between that sentence and the rest of your comment, I think you're _still_ seriously undervaluing yourself.

> I think that you are right in that I should work on a visible Open Source > project, even if only contributing in small bugs and documentation. > Eventually, and with at least some projects under my belt I hope I can land > a small position somewhere.

Small bugs and documentation are a good start. You should also consider working on a more substantial feature, the kind of thing that will take you weeks or more to complete. Something of the size that you can point to that project and that feature and say "I did that".

Pick a project you regularly use, that has a friendly and welcoming community around it. Learn how to build it from source, try a couple of very small patches at first (much easier for a project that has a very new-developer- friendly community), and then seek out a substantial project to work on. Most projects have a wishlist of items that they'd work on if they had more time.

> Yet, I don't feel exploited at all because the money issue was discussed > with me in an upfront manner and I have not done any amount of work yet. And > besides, it is a position that offers experience that I can put later on my > CV and potentially eventually it will lead to a paying job.

They're not being underhanded in the sense of bait-and-switch; they've certainly told you up front. However, what they're _not_ telling you is how the rest of the market would value your skills. Internships in CS, as a general rule, are paid, and reasonably well at that; certainly _far_ above minimum wage. Go look up intern salaries at major companies. Ask around and find out what other students have done. (And I don't just mean at your own university, or even in your own country.)

(Depending on the nature of the arrangement, I'd also be surprised that they're not in some way violating labor laws by having you work for free, but that's not an avenue you want to pursue.)

> So in a sense, isn't it riskier to not accept this offer?

> I dunno, I still have some doubts...

You have a year left in school, and you have your whole life ahead of you. Don't set the precedent of being willing to work for free. And after you _do_ graduate, do some reading about negotiation before you accept your first job offer. If you go into either an internship or your first job with the stance you're taking now, you're going to spend your whole career being underpaid.

</comment></comment></comment><comment><USER4> Don't do it. Working for free is unacceptable (especially in today's market for developers). Working for equity is usually a bad idea (the main thing to understand that equity only converts to cash on sale or acquisition, which are extremely rare events and even if that does happen, don't count on it happening for several years).

What to do instead? Either start your own open source project (if you have ideas for something useful) or contribute to one of many existing projects (pick something with decent name recognition).

If you're into low-level coding, contribute to Rust. If you're into front-end, JavaScript, contribute to atom.io (those are just random examples, the point is that for anything that you might be interested in, there is an open source project in that area that is desperate for more developers).

A meaningful contribution to a well-known open-source project will be much more interesting to your future potential employer than random unpaid work for a random company.

At the same time pick the project carefully. There are many projects that are not good at onboarding new developers so submit small fixes (Pull Requests in GitHub speak) to a few that interest you and pick those that are quick providing feedback (even if it's to reject a PR as long as they do it in a nice way and explain why) and drop those that are unresponsive.

<comment><AUTHOR> I see. Well, atom.io interests me a lot, since I know a little bit of JavaScript and contributed to a relatively medium-sized game framework (melonJS). I will try just starting with small bugs and work my way up the ladder.

I was asked to meet the CEO tomorrow to sign an IP assignment agreement, and I have not signed anything yet, so I assume I am ok legally speaking.

By the way, the CEOs of these small start-ups were 100% honest with the pay considerations and I feel kind of bad now that I have to go and say that I will not be joining their start-up.

<comment><USER5> One other thing to think about would be intangibles the startups can offer vs open source:

* how good are you at self-motivating * what chance is there of being mentored at the start up? * will the CEO provide a good reference later one: a human reference likely beats pointing out the open source contributions in many jobs in the future

If you are going to work for free anyway on open source then make sure you have the dedication to actually do it.

Being more directly accountable to someone may be a benefit.

Good luck ... it's a tough call!

</comment></comment></comment><comment><USER6> Companies look for people that love code work for it's own sake, they do it for many hours for fun. Have you ever done any of that type of obsessive work- of-love type of thing? Companies are built on people who build up things on small boards like Arduino and create programming problems and solve them - <USER2> as part of getting better at the skill of it. It is a form of self learning or self studying. After the three weeks, if they see none of that you = history

</comment><comment><USER7> Frankly, the mere 1% equity and no cash they're offering if you stay is more insulting than the initial internship.

Working for free can be a valuable lesson, but working for free for a team whose offer suggests they have no regard whatsoever for your ability (or are completely clueless) is unlikely to teach you things you want to learn.

</comment><comment><USER8> I'm going to be the voice of dissent here and say if you like the team and the project do it. It sounds like you need to strengthen your resume and this could be an good opportunity.</comment>


Open-sourcing MonkeyType – Let your Python code type-hint itself - <AUTHOR> https://engineering.instagram.com/let-your-code-type-hint-itself-introducing-open-source-monkeytype-a855c7284881 <comment><USER2> Fantastic contribution back to the community; I look forward to trying it out.

I must say this is the first time I've been disappointed with the quality of discussion on HN. For a community that promotes using the right tool for the job _at the time_ , I would have thought people would be more open to the choices the early engineers made. I'm sure that Instagram are using a variety of tech across their stack.

<comment><USER3> Most people would expect software to crash, hang, be slow or somehow leak their personal information. That's normal behaviour for the products of the software industry.

For a long time there have been efforts to ensure at least a degree of quality and robustness through processes, practices and verification tools. One such tool is a type system which allows encoding requirements and expectations that will be automatically verified with the help of a checker. This is exactly what Instagram is attempting in an effort to increase quality and ease maintenance.

It seems many are wondering why they haven't done this from the beginning. A typical (and probably correct) answer is development speed and flexibility: early stage companies need to be nimble and compromise on quality if they want to survive. Fair enough, I understand that. We can applaud Instagram's success on the markets, but that doesn't have to mean that they're a role model of technical excellence for building a million line Python code base.

This tool is the proof that Python has significant problems at scale, which is something the Python community has denied for a long time. They're still doing it in this thread, but the lesson looks pretty clear to me: if you plan on building large scale, don't use Python. Or PHP while we're at it (see Facebook). Definitely not JavaScript (see FirefoxOS).

The founders of a start-up can continue to do whatever they want in the name of success. Instagram at their beginnings was basically a different company from today's Instagram, no one would have used them as a technical role-model. Now they're at best a role model for large Python code bases, but many here seem to be drawing the wrong conclusion, namely that it's a good idea to do large-scale Python in the first place.

<comment><USER4> > This tool is the proof that Python has significant problems at scale, which > is something the Python community has denied for a long time. They're still > doing it in this thread, but the lesson looks pretty clear to me: if you > plan on building large scale, don't use Python. Or PHP while we're at it > (see Facebook).

Yeah, absolutely, don't do this! These are two examples of successful companies that did it and look at them now! </s>

Being able to move fast and produce a winning product _on time_ is much more important for startups. What does it matter if you used <your_cool_scalable_thingie> for a project, when it never went past 10 users because you were concentrating on wrong side aspect of your business? PHP is fine. Python is great. Use the tools that fit your problem and you know how to use, not the latest toy.

<comment><USER3> There are two things that are critically incorrect about your argument:

1) That market success implies having quality software. Average seems to be enough in my experience.

2) That start-ups are a good example to follow if one wants to achieve good quality. In fact they should be ignored, because they will absolutely murder quality in order to stay alive. Sometimes the product doesn't even work and is held together with duct tape in order to get past that important demo... It's quite pointless to discuss quality and start-ups.

The lesson I mentioned should be heeded by mature companies that are able to do some project planning, complexity estimation, etc.

</comment></comment></comment></comment><comment><USER5> This sounds similar to Dropbox's PyAnnotate -- Guido van Rossum writes about it here: [http://mypy-lang.blogspot.co.uk/2017/11/dropbox-releases- pya...](http://mypy-lang.blogspot.co.uk/2017/11/dropbox-releases-pyannotate- auto.html)

Would be interesting to see how MonkeyType and PyAnnotate compare.

<comment><USER6> I'd also like to hear more about this -- both the feature set and the development process. It's interesting that two large engineering organizations responsible for some of the most popular applications on the planet spent hundreds of engineering hours building almost the same exact tool at around the exact same time.

I'd also like to know how much quicker or better it could have been completed if it had been done out in the open.

<comment><AUTHOR> The idea to gather types at runtime is as old as PEP 484. The Dropbox and Facebook teams working on Python type checking know each other. We both worked on our implementations independently since we wanted to first test internally whether the idea holds water. For example, I personally thought it wouldn't be as useful in practice as it turned out to be!

We knew we're going to open-source each others' implementations, esp. that Instagram's is focusing solely on Python 3 which isn't useful for Dropbox at the moment. It just took a while to get through the process of open sourcing what we had (cleaning up the early implementation with limited documentation, decoupling from internal data stores, etc.).

Would it be cheaper if this started out in the open? Probably, but I don't think by quite the margin as you expect.

<comment><USER7> Even though MonkeyType is focused on Python 3, can the .pyi files be used with Python 2?

</comment></comment></comment></comment><comment><USER8> Interestingly, I made a similar tool for php some time ago. It was recently revived and is now in active development to bring it up to speed with recent developments in the language.

[https://github.com/troelskn/phpweaver](https://github.com/troelskn/phpweaver)

<comment><USER9> That is fascinating. I'm the author of a static analysis tool for PHP that can generate types, but clearly not at the same level as runtime analysis. I'll use it on my company's codebase and report back.

<comment><USER8> It would be great if you can give any feedback. There are quite a few rough edges currently.

</comment></comment></comment><comment><USER10> Its interesting, this is a similar learning Clojure came around with, that the types weren't really useful unless everything is typed. Though Typed Racket's solution was to promote types to runtime validation at those borders between things with types and things without.

I do find it intriguing though, that adding back types manually is so hard and slow. Is it slower when done retroactively? Or is it just as slow when done at the same time, but we don't realize its overhead?

<comment><USER11> It's a lot slower to do retroactively. You basically have to tell the computer why you believe something is correct - e.g. if you're moving to having a distinct type for non-empty lists because some functions are only valid for non-empty lists, you have to explain why you believe a list you're passing to such a function is non-empty. That's a lot easier to do at the same time you're doing it (even in Python you'd probably still ask yourself whether you knew the list was non-empty as you were writing it) than to come back months or years later and remember why.

</comment></comment><comment><USER12> Given that people have asked why not use a statically typed language, seems appropriate to mention that it's possible to write pythonic-looking C++:

[http://preshing.com/20141202/cpp-has-become-more- pythonic/](http://preshing.com/20141202/cpp-has-become-more-pythonic/)

I have been using C++ a lot lately but really wish there were more tools for reflection at compile time, e.g., ability to iterate over all the members of a class. Other than that, I'm really loving C++17's auto template parameters and type deduction capabilities, plus code that's 200x faster at runtime than most interpreted languages. I've found autocompletion in CLion to be slightly better than autocompletion PyCharm, but not quite as good as IPython or IntelliJ with Java.

<comment><USER13> Please show me C++ equivalent of

        sorted([(k.weight, k.name) for k in somelist], reverse=True)

<comment><USER14> Note: my C++ is extremely rusty.

Right now, I think that's approximately,

        vector<tuple<int, string>> output;
        transform(
            somelist.begin(), somelist.end(),
            back_inserter(output),
            [](const auto &f) { return make_tuple(f.weight, f.name); }
        );
        sort(output.rbegin(), output.rend());

Ranges, I believe, would reduce this _a lot_ , possibly even to a single line. _If_ I am reading the docs on it correctly, something like,

        vector<auto>(somelist | view::transform([](const auto &f) { return make_tuple(f.weight, f.name); })) | action::sort;

I _think_.

Two notes, however:

1\. I feel like most of the desire for a static language is to know what type something is. Is C++ exactly as brief as Python? No, as I think you've demonstrated. But I think you're a lot more likely to know the _type_ of something. Rarely do I think I find that Python has annotations, and annotations can be _wrong_.

2\. C++ is, in general, I feel, much more explicit about where copies occur. I elided one of the copies in your example, opting instead for an in-place sort (but this is trivial to fix in the Python).

<comment><USER15> > vector<auto>

Really? O.o How could this possibly work?

<comment><USER14> Oh, that was probably a typo (it was late); replace that with a concrete type.

</comment></comment></comment></comment></comment><comment><USER16> I come from a statically typed background (C++), but have been doing a lot of analytics in python in the past two years. It is frustrating not to have compile time guarantees when dealing with mathematical programs, because some things have to be a particular type (i.e. matrices of compatible dimensions). The result is a copious use of asserts, but it feels bad when you know that if you did this in a functional language,let's say, you could prove implementations are correct by the nature of the type system. In short, I'd love to see more strong type support in python.

<comment><USER17> >(i.e. matrices of compatible dimensions)

What language do you use where you can get these kinds of guarantees? As far as I know very few languages provide those kinds of dependent types statically.

<comment><USER18> C++ makes this possible via templates. Generally the size is moved to a template argument, which allows the compiler to check this at compile time (of course, this restricts you to statically sized matrices).

<comment><USER17> Good to know. I was apparently unaware how powerful templates were.

<comment><USER19> [https://stackoverflow.com/a/22645853](https://stackoverflow.com/a/22645853)

<comment><USER17> I think I knew that templates were Turing complete, but so are java generics, it's just that to get dependent types in generics you have to reinvent the integers within the generic system. Not so for templates, which I didn't realize. That's pretty nifty!

</comment></comment></comment></comment></comment></comment><comment><USER20> FYI, it requires Python 3.6+. It mentions it in the article towards the end, but if you're like me and prefer to jump straight into trying something out you may not have seen it. I wasted a bit of time trying to figure out what the ContextManager is in the Python typing module and why it couldn't find it.

</comment><comment><USER21> This looks wonderful :) I'd love to try it out at some point.

One thing that I think could really improve the documentation is a few examples! One of my favorite things about the Python docs and the community is the wealth of examples. From looking at the docs, I couldn't find the main thing I wanted to see - what would MoneyType's annotations look like if I used it?

</comment><comment><USER22> Reading all of the comments from engineers who seem to either posess a time machine to send current tech back in time, or are criticising the technical choices that made the founders $squillions, is making me a bit mad. As a diversion perhaps some of them could list a few billion dollar startups that made perfect choices at the start and never had any cause to refactor or reimplement code as they grew?

<comment><USER23> It's not obvious (and IMO somewhat doubtful) that it was the technical choices of the founders that made them successful. Their choices could well have been bad, just not bad enough to make their business fail.

</comment></comment><comment><USER24> > At Instagram we have hundreds of engineers working on well over a million > lines of Python 3.

Man, that's crazy. At the time they were acquired by Facebook, they had 13 employees.

<comment><USER25> This was the part that stood out to me also. They must have a ton of new stuff in the pipeline, or their "display photos, insert some ads in between" loop is way more complex than it seems.

Or that's total number of engineers and way fewer actually twiddle the Python...

</comment></comment><comment><USER26> Is their goal to annotate everything or just the non-obvious things? Also how would a tool like this handle cases where the "correct" type is a generic base class but at runtime it only sees a certain subclass? To be pythonic, a function that accepts a tuple should usually also accept a list for example, but at runtime that may never happen.

<comment><AUTHOR> Since this is how gradual typing works, the goal is to annotate every last function.

Good question about abstract base classes! Paraphrasing a well known cliché: types in functions should be forgiving in arguments (what the function accepts) and strict in return values (what the function emits). In our case, the human reviewer needs to decide if the argument types collected by MonkeyType should be generalized. In fact, the collected types might not even work in all cases and the type checker might complain. It's because annotations describe "what should be" whereas MonkeyType finds "what is". This is why a system like MonkeyType shouldn't even attempt to use abstract base classes in place of concrete types that it collected.

</comment></comment><comment><USER27> I wonder how this compares to PyAnnotate: [http://mypy- lang.blogspot.ca/2017/11/dropbox-releases-pyanno...](http://mypy- lang.blogspot.ca/2017/11/dropbox-releases-pyannotate-auto.html)

</comment><comment><USER28> Reading this as someone who writes mostly in statically typed languages, the whole exercise seems odd.

Having so much dynamically typed code to maintain that you need to run production code using a separate tool just to figure out the types sounds just wrong. Why not use a statically typed language for such a large code-base? Is this done by purpose, or did they end up with a million lines of Python code and are looking for ways to make the maintenance easier?

And before I get down-voted to hell - I completely understand using Python for many things. It a good technical choice for many different problems, but navigating a million lines of Python seems just daunting to me (although maybe I'm just not experienced enough with Python).

<comment><USER29> >Is this done by purpose, or did they end up with a million lines of Python code and are looking for ways to make the maintenance easier?

Definitely the latter. I've seen this discussion a few times before, and it's always the same. Your initial developers are not looking down the road to the million lines of code milestone, they're just trying to make a product that might actually make some money here and now.

I'm sure Instagram was exactly that. They needed to handle images and some guy knew how to do it in Python. They wrote Python code, and then people liked Instagram. They eventually became a billion dollar company with millions of lines of code and no where along the road was there time to say "hey we need to refactor this whole thing". Or if that was said, management laughed and said "we need this feature".

So here is where you end up. The developers need to clean things up but they don't have time to clean it up by using a language, realistically, they probably don't know as well as the Python they wrote the millions of lines of code in.

Re: your last comment, navigating a million lines of any codebase is daunting, and especially more so if you aren't a developer in that language. I'm not sure what exactly "Python" has to do with that, besides that you're not a Python dev.

<comment><USER30> To add to this, note that type hinting is quite a new feature in Python (introduced in v3.5, released in 2015), and this functionality simply wasn't available before. So any company heavily invested in Python today obviously wants to improve their runtime reliability, without having to rewrite parts of their stack.

Stricter typing goes a long way to achieve this, and gradual typing allows you to upgrade the code base at your own pace, which is great.

Consider this study[0] about TypeScript and Flow, which use the same approach for JavaScript, which found both able to detect ~15% of runtime bugs. So no wonder companies with large Python code bases would be the first to invest in this space.

Personally I feel this is a great addition to the language, and hope type checking becomes a first class citizen too, instead of being delegated to external tools like mypy[1] or pytype[2].

[0]: [http://ttendency.cs.ucl.ac.uk/projects/type_study/](http://ttendency.cs.ucl.ac.uk/projects/type_study/)

[1]: [http://mypy-lang.org/](http://mypy-lang.org/)

[2]: [https://github.com/google/pytype](https://github.com/google/pytype)

<comment><USER31> Dropbox is very heavily invested in Python. I am under impression they hired Guido van Rossum to do exactly this, among other things. First 100% statically type the old codebase, then port it to Python 3.

You can statically type Python 2 codebases, but the language does not offer native support for it. Thus, all needs to go to docstrings or comments.

</comment></comment></comment></comment><comment><USER32> Similarly, I'm amazed by Pycharm (IDE), which supports pretty good inferred type hints from debugging and static code anlysis, btw. Makes writing code a lot easier. Looking forward to trying MonkeyType, it seems awesome for lager projects.

<comment><USER33> Pycharm relies on pre-generated annotations as well, they're just built-in - it's not as magically trace-y and infer-y as it might seem at a casual glance.

</comment></comment><comment><USER34> Why not use cython? It has types

</comment><comment><USER35> How is this different from Dropbox's PyAnnotate[1] which was released a few weeks ago?

[1] [https://github.com/dropbox/pyannotate](https://github.com/dropbox/pyannotate)

</comment><comment><USER36> Why didn't you make the Python 3 type checking advisory instead? Like what Facebook did with Flow and Hack, why not make write a product that lets you statically analyze the types and will never itself cause runtime errors, and transition to types that way? What advantage does building this tool have? I understand that the thing I'm describing involves modifying the way Python 3 handles type annotations, but it doesn't seem like more work than building out all of the instrumentation you've done here.

<comment><AUTHOR> I'm not quite sure what you mean. Python has an external static checker for types, it's called mypy.

Python's type annotations are in fact very similar to Flow and Hack in the sense that they provide gradual typing. The specification (see: PEP 484) describes that only annotated functions are type checked. Calls to non- annotated code are treated as accepting any type in arguments and returning the Any type (a special type which effectively silences the type checker).

This generates a chicken and egg problem: if you don't have enough functions annotated, the type checker won't be able to provide meaningful output to you. So convincing people to annotate their code is harder: they don't see the benefit right away. Worse yet, you already have tens of thousands of functions in your code that you know work in production but were written before type annotations were introduced. It's not really feasible to come back and fill this information manually.

MonkeyType is a tool that gathers types at runtime and enables putting them back in your code as annotations. The goal is for mypy to have more information to work with, making it way more useful.

<comment><USER36> Sorry, I guess I jumped to the conclusion that you profiled in production because you had a mandatory type checker which would cause runtime errors if invalid types were passed. Let me try another question. Do you think that a project like MonkeyType would substantially aid adding flow annotations to a JavaScript project? If so, why is the value to the Python ecosystem higher than the value to the Flow/JavaScript ecosystem (i.e. why doesn't it exist for JS)?

<comment> jw- It's already been flirted with in JS I believe [1], though not specifically for Flow. The problem is that it falls down in the higher order case, which happens quite alot in JS. Also, I don't think JS has a mechanism like sys.setprofile that deals with alot of the pain points.

[1] [https://medium.com/fhinkel/runtime-type-information-for- java...](https://medium.com/fhinkel/runtime-type-information-for- javascript-b134faac3c0a)

</comment></comment></comment></comment><comment><USER37> As both a dynamic and static type enthusiast, back typing dynamic code is extremely problematic. Fluent use of a dynamic language will use and create constructs that are nearly un-typeable. If you want to make typed code, start typed. If you code with implicit types, use a good type inferred language (ML, F#, etc). If you want to use type checking in Python, use the annotations and MyPy from the beginning.

That said, I am not saying this tool is bad. It could very well help a lot of codebases, but I would warn against using it as part of the operational workflow.

<comment><USER38> > Fluent use of a dynamic language will use and create constructs that are > nearly un-typeable.

Do you mean cases where you accept "anything iterable", an issue with callbacks / template types, or something else?

</comment></comment><comment><USER39> > With MonkeyType's help, we've already annotated over a third of the > functions in our codebase, and we're already seeing type-checking catch many > bugs that would have otherwise likely shipped to production

Are most of their code not yet in production ? Or why do they produce more bugs now with static types, then before with dynamic types !? This sounds a lot like homeopathy, that can both detect and cure diseases with placebo.

</comment><comment><USER40> _" At Instagram we have hundreds of engineers working on well over a million lines of Python 3."_

It always amazes me that some of the most popular products around are built with the worst technology choices. And now they had to build their own static type checker, which slows down random samples of real users, just to shore up the language's weaknesses? Outstanding.

<comment><USER41> If lots of successful projects use what you consider the "worst" technology, perhaps the problem is with your perception rather than the technology?

<comment><USER42> Those people believe that the right choice is assembly unless you can write directly in hex /s

<comment><USER43> I was taught assembly at the job by an old assembly guru. His first statement to me was something along the lines of: "we'll use an assembler to start with, but it doesn't generate very good code; so, once you're comfortable, we'll hand assemble our machine code".

<comment><USER44> Was he just messing with you? What's a case where assembly is not isomorphic to machine code?</comment></comment></comment></comment></comment>


Zika: Brazil admits it's not the virus - <AUTHOR> http://bients.com/zika-brazil-admits-not-virus/ <comment><USER2> The only reference for the "admission" is a link to [http://www.nature.com/news/brazil-asks-whether-zika-acts- alo...](http://www.nature.com/news/brazil-asks-whether-zika-acts-alone-to- cause-birth-defects-1.20309) which is titled "Brazil asks whether Zika acts alone to cause birth defects".

Nothing in the article justifies the title that it's not the virus.

The article says: "NECSI also suggested, "An alternative cause of microcephaly in Brazil could be the pesticide pyriproxyfen, which is cross-reactive with retinoic acid, which causes microcephaly, and is being used in drinking water.""

The Wikipedia page for Zika points out at [https://en.wikipedia.org/wiki/Zika_fever#Microcephaly_and_ot...](https://en.wikipedia.org/wiki/Zika_fever#Microcephaly_and_other_infant_disorders) : "In February 2016, rumors that microcephaly is caused by the use of the larvicide pyriproxyfen in drinking water were refuted by scientists.[120][121][122] "It's important to state that some localities that do not use pyriproxyfen also had reported cases of microcephaly", read a Brazilian government statement."

It says "12,000 Zika Cases Confirmed in Pregnant Colombian Women — Zero Microcephaly Cases" but [http://www.nature.com/news/first-zika-linked-birth- defects-d...](http://www.nature.com/news/first-zika-linked-birth-defects- detected-in-colombia-1.19502) says "Researchers have diagnosed one newborn with microcephaly ... All three tested positive for the presence of Zika virus."

I do not trust the quality of this article.</comment>


Money can't make me happy, says millionaire giving his riches away - <AUTHOR> http://www.ottawacitizen.com/business/story.html?id=2537790 <comment><USER2> I wonder how he got so rich by being so misguided.

If everyone feels fake to you, you can resolve that by putting yourself in situations where you will meet real, genuine people. There are many places where you can do that in the world. Hint: five star hotels in Hawai aren't it.

Go do some charity work. Go spend time helping people who are poorer than you. Go around the world without checking into five star hotels. Go and do what everyone else does. There's no need to give your money away to live a genuine life. Having the money available also makes things possible that wouldn't have been possible otherwise. When you see an opportunity to make a difference, having $5m in the bank allows you to make things happen that would be simply impossible otherwise.

This is probably a controversial view, but I don't think this guy is brave. I think he's just stupid. He's greatly limited his own freedom, and that after having worked like a donkey his whole life to expand it. What a pointless thing to do.

<comment><USER3> On the other hand, he's greatly limiting his freedom while providing the means for others to increase their freedom:

 _All the money will go into his microcredit charity, which offers small loans and advice to self-employed people in El Salvador, Honduras, Bolivia, Peru, Argentina and Chile._

He sounds like a guy who has figured out what he wants, after a lifetime of saving for an indeterminate future need.

<comment><USER2> That's not gonna make him all that happy.

Studies have found that money can make you happy - so long as you spend it on creating great memories that are valuable for you.

If you said he went around a poor part of India and gave all the money away to people that he met there, I would see some merit to that. At least, he'll get the experience of having met all these people and changed their lives. Those memories would stay with him his whole life. Setting up $5m's worth of anonymous micro-loans might make you feel good for a few months, maybe a year or two, but the memory will soon fade. It's too distant.

Even if you decide that your calling in life is to give all your stuff away, there are much more personally fulfilling ways to do it.

<comment><USER4> I agree. He doesn't even seem to have a good idea of what he's going to do next. If he were retiring to a cabin in the Alps or a shack on the beach I could envy him a little, but living in a tiny studio apartment in Innsbruck? With a bed in the living room so he can't even experience the pleasure of having a friend around to dinner?

And I, too, would like to know what his wife has to say about this. Setting up a charity is fine, but moving from a villa to a bedsit? I'm starting to think there may be some divorce-related spite involved here.

</comment></comment></comment></comment><comment><USER5> He isn't exactly giving everything away; he'll be "surviving on $1,341 a month". Which is very wise; using money to buy things rarely leads to happiness, but using it to provide financial security eliminates many potential sources of unhappiness.

<comment><USER4> Indeed, in order to make $1341 a month without working you'll need to invest about $321,000 at 5% interest. If you want to keep it inflation-adjusted then you probably wouldn't want to take more than 2% of the principal each year, so you'd need more like $700K in the bank.

</comment></comment><comment><USER6> Listen, you give me $10M, and I will sing songs and make merry while I give $9M away. It is just a case of diminishing returns, when you live in your in- laws trailer with your 3 kids, a $30k trailer can make you a lot happier. When you live in a $500k house, a $1M house has much less effect on your happiness then that trailer did.

Millions of dollars more probably isn't really noticeable day to day. Going from a boat to a bigger boat, a house to a bigger house, an X to a better-X doesn't do much for you.

That first 50k in the bank does _everything_. When you have a year of living expenses in the bank, you don't _fear_ losing your job. When you have 10 years of reasonable expenses in the bank, you have _freedom_. It's the points that you have something you didn't have before that make you more happy.

If this guy gives away his money to the point that he starts giving things up, not just having to downsize, then it is a story. A story about an idiot (prophet?), but otherwise it doesn't mean anything.

</comment><comment><USER7> I guess he's never owned a waverunner.

His quote: "Money is counterproductive - it prevents happiness." Is incorrect. Money is amoral and depends on the subject.

Money is not the root of all evil. The _love_ of money is the root of all _kinds_ of evil. So yes, it's subjective.

</comment><comment><USER8> I'm sure many unhappy broke people would prefer to be unhappy rich people.

<comment><USER9> For some unhappy broke people (although certainly not all) they unhappy and broke for the same reason, either because they are not making sufficient contributions to society and the economy or they are not being compensated/recognized appropriately for the contributions that they are making.

Speaking for myself, part of the reward of a successful career is the joy of seeing my work and talents used and enjoyed by others.

</comment></comment><comment><USER4> I might find his asceticism more admirable if he hadn't apparently sent out a press release about it.

<comment><USER10> Well that's contradictory, because how would you admire it if you hadn't come to know of it, without his press release :) !

</comment></comment><comment><USER11> My ambition is to get rich just so I can go into space, pay people to invent robots for me, and live forever.

<comment><USER12> You are already in space.

</comment></comment><comment><USER13> > "It was the biggest shock in my life, when I realized how horrible, soulless > and without feeling the five star lifestyle is," Mr Rabeder said.

You can use money to go to exclusive resorts and hobnob with similar folks.

Or you can use money to go backpack the Appalachian trail, take guitar lessons, and do other interesting things.

I agree that more is not always better ... but money means having options, and just because there are some lame options doesn't mean all options are lame.

</comment><comment><USER14> [http://en.wikipedia.org/wiki/K_Foundation_Burn_a_Million_Qui...](http://en.wikipedia.org/wiki/K_Foundation_Burn_a_Million_Quid)

</comment><comment><USER15> Not super rich. In the U.S he would be in the top 1%.

[http://blogs.wsj.com/wealth/2007/02/01/rich-o- meter-20/tab/a...](http://blogs.wsj.com/wealth/2007/02/01/rich-o- meter-20/tab/article/)

So that means there around ~750,000 households at that level or more edit: Screwed the calculation. Assuming 300M and 4 people per household. Thanks<USER4>
<comment><USER4> 7500? I think you mean ~1.2 million.

Still, this is what I was curious about -- is it possible the journalist screwed up the numbers? Five million bucks doesn't make you especially wealthy nowadays; it's more a "comfortable middle class retirement" sort of sum. And yet this guy supposedly had a net wealth of five million bucks, of which $2.34 million was in his primary house, $1 million in his secondary house and $600K was in his glider collection. Add in some cars and furniture and he would have less than $1 million left over for sensible income-producing investments.

Seems like an unwise proportion of his money was plunged into useless toys; he was trying to live like a super-rich man without the super riches to back it up. No wonder he was unhappy.

</comment></comment><comment><USER16> The problem is that only a millionaire can say/realize this. So, ironically one ought to become a millionaire to really realize money can't buy happiness.

</comment><comment><USER17> Very interesting article. A little too tidy, though. For example, I wonder how his wife felt about this?

<comment><USER13> I wondered the exact same thing.

</comment></comment><comment><USER18> An extremist response, but if it makes him happy, I'd say it's probably the right choice for him. In that case, congratulations on finding and doing what makes you happy; more people need to pay attention to that part of the message.

</comment><comment><USER19> That's a profound change of behaviour in a short time. I wonder if he has been checked out for a brain tumour or something else affecting his neurology.

</comment><comment><USER20> well duh, money in of itself doesn't make someone wealthier. Wealth is a reflection of education and social capital. People who are really poor, even if they have high clash flow don't have the social networks built to leverage it. Once you have those connections formed and the insight on how to use it, you can give away all your money because at that point it's trivial to rebuild it.

</comment><comment><USER21> That guy has way more courage than most people.

I never understood the sheltered life of the ultra-rich. Don't they realize how fake it all is?

<comment><USER22> By any objective standard you (and me and everyone else reading this) are ultra-rich.

I find this fact to be singularly depressing.

<comment><USER21> And what do the middle class do with their wealth? Move into the faux community of a suburb.

<comment><USER23> > And what do the middle class do with their wealth? Move into the faux > community of a suburb.

What's "faux" about it?

They clearly prefer it. How do you know that they're wrong? (Hint: they're not you.)

<comment><USER24> I grew up in a suburb, and as a _community_ it seemed pretty faux; it made an effort to keep up trappings of a community, but was pretty clearly just a bunch of houses.

I do agree people may well prefer it. It had no community, but the houses were quite nice.

</comment></comment></comment></comment></comment><comment><USER25> Money is not an end. Money is a means.

</comment><comment><USER12> I would just like to say that should anyone of you here feel this way I am more than willing to take this burden out of your hands. For 1 million dollars I could live for the rest of my life not working a single day by surviving only on money generated by interest, as well as spending my time more productively.

<comment><USER26> Would it feel as good being given it vs having earned it though?

<comment><USER27> Not for me, but it _would_ feel just as good if I was given $1M and then worked hard to turn it into say $10M.

<comment><USER26> Surely turning $1M into $10M is fairly trivial compared to making that first $1M. Maybe turning $1M into $100M :/</comment></comment></comment></comment>


Leo Web: Leveraging the Web and Address Book - <AUTHOR> http://www.jisiguo.com/blog/introducing-leo-web <comment><USER2> Wow, the picture at the top is actually a completely working demo. Very well done for HTML/CSS/JS.</comment>


Show HN: Receive Job Offers Before Interviewing - <AUTHOR> http://www.primsly.com

<comment><AUTHOR> Hi Folks,

We built Primsly after realizing a couple of problems with the way hiring works in the tech industry:

         - It's difficult to find a job when you already work 9-5 (you don't have time to interview)

         - The best talent doesn't get paid proportionally to how much work they output

         - There are sly tactics that companies use to force you to make an uninformed decision => resulting in an unhappy workforce.

Primsly's a solution to these problems and more. Anyhow, check it out and feel free to comment on this thread or email me directly at nima at primsly dot com. Thanks!

Best,

Nima R.

Co-founder at Primsly

</comment><comment><USER2> I love the concept, I have been following Primsly since they opened. I think a good thing for them would be to show stats of how many hires are happening in the system, and/or other figures to show some network action.

<comment><AUTHOR> Interesting idea. We'll make a blog post soon about the progress we've made.

Also, if you invite 25 friends you will have access to premium features like analytics which shows you how many companies have visited your page and what search terms the companies are using to reach you.

</comment></comment><comment><USER3> Signed up maybe a month back, but still awaiting any "offers" to review. I'm excited to see if this works, only because I hate the archaic process in place. Good luck!</comment>


100% social search - <AUTHOR>

Does anyone know if a search engine is being developed that relies 100% to curate content. And if not 100%, then largely relying on user-curation. Google is doing this, but they don't seem to be leaning that heavily on users. There approach is more like suggestions and total curation. Any thoughts on this? <comment><USER2> Aardvark is a good example of this - <http://vark.com/>

<comment><AUTHOR> I'm picturing something where the engine produces regular search results but then users vote the results up, down, or out. Every vote would be incorporated into the search algorithm. I'm also picturing something at a higher level since Google gives you the microscopic word on a page level.

</comment></comment><comment><USER3> I'm currently working on something like this. It's non-functional / not launched...

<comment><AUTHOR> I've got some ideas if you even want to chat.</comment></comment>