Python web micro-framework battle - <AUTHOR> http://www.slideshare.net/r1chardj0n3s/web-microframework-battle <comment><USER2> Line count is a silly way to score when all are around the same anyway (fewer than 100 lines). And the framework line count is another metric that shouldn't matter.

That said, really the only valid point here against Flask is Python 3 support. Other than that Bottle and Flask are pretty much on par with each other.

<comment><USER3> Flask has the advantages of fast templates, strong WSGI features, serious unit testability at the app and library level, complete documentation...

<comment><USER4> but didn't you read the presentation ? templates are _out_ man. Write your HTML as string concatenations "<html>" + helloworld + "</html>" right inside your __init__.py or YOU'RE NOT COOL.

<comment><USER5> The presentation stated that templates were not part of the assessment criteria - since with most microframeworks template systems are either not bundled or easily replacable.

<comment><USER4> hey you're right, this wasn't very apparent from the slides.

</comment></comment></comment></comment></comment><comment><USER6> This seems like an illogical conclusion. I didn't see API Design mentioned once in any of these slides.

Aside from Python3 Support (which is a bit irrelevant at this point), what does Bottle actually offer that Flask does not?

Nothing, that I can see. Flask has a thriving community, first-class extensions, _extremely_ high quality documentation, and an elegant API. It even lets you dip down into the lower-level werkzeug when you want.

Is Bottle being chosen because of LOC? Again, completely irrelevant.

<comment><USER7> You have to consider his primary use case (which he explains in the video). He's not writing web apps per se, but wrapping up existing python code in a simple http frontend. From that point of view I agree with him that bottle is quicker and easier to use than flask. That being said, flask is easily my go to framework for getting serious web app work done in python.

<comment><USER6> Great point. Interesting.

</comment></comment></comment><comment><USER8> I don't think counting Python 3 support is really important for Web frameworks. All of the major server distros are still on Python 2.x anyway (last I checked, Arch is the only one where "pacman -S python" will get you Python 3 instead of 2), and the question of WSGI is still up in the air if you want to handle encoding properly instead of just fudge it.

</comment><comment><USER9> Discounting pyramid as a microframework doesn't seem valid, given that it can be scaled up or down arbitrarily. <https://docs.pylonsproject.org/projects/pyramid/1.2/> has an extremely concise pyramid web app above the fold.

<comment><USER10> Compare it with Bottle's version though and it doesn't look quite so concise any more: <http://bottlepy.org/docs/dev/>

<comment><USER11> Seems appropriate to link this here: [https://docs.pylonsproject.org/projects/pyramid/1.2/designde...](https://docs.pylonsproject.org/projects/pyramid/1.2/designdefense.html#microframeworks- have-smaller-hello-world-programs)

<comment><USER10> Seems pretty defensive to me. How does, say, separating out the route and the view declarations help your application? Code like this:

       config = Configurator()
       config.add_route('hello', '/hello/{name}')
       config.add_view(hello_world, route_name='hello')

is really just boilerplate, which is better done as a decorator. Count how many times the word 'hello' appears in that snippet above. And this is just for a hello world program. Once you start on a real app, that's only going to multiply.

<comment><USER12> The ordering of your patterns matters, so that is done at config time. However it's very common to want to have unrelated code executed depending on the type of request to a URL. Pyramid will do this lookup for you, rather than polluting a gigantic view function with multiple code-paths for distinct functionality.

        @view_config(route_name='hello', request_method='GET')
        def get_hello(request):
            return Response('a GET request for %s' % request.matchdict['name'])

        @view_config(route_name='hello', request_method='POST')
        def post_hello(request):
            return Response('stored info')

        config = Configurator()
        config.add_route('hello', '/hello/{name}')
        config.scan()
        app = config.make_wsgi_app()

<comment><USER11> Bottle and Flask actually allow for this too. Bottle's variant:

       @route('/hello/:name', method='GET')
       def hello_get(name):
           return 'Hello %s' % name

       @route('/hello/:name', method='POST')
       def hello_post(name):
           return 'Hello %s' % name

Pyramid permits a larger variety of predicates (including custom ones), however: [https://docs.pylonsproject.org/projects/pyramid/1.2/narr/vie...](https://docs.pylonsproject.org/projects/pyramid/1.2/narr/viewconfig.html#predicate- arguments)

<comment><USER12> Yes but while implicit route ordering works a lot of the time, I'll gladly keep Pyramid's concept of explicit ordering, which is the main source of verbosity in the Pyramid setup which separates routes from views.

<comment><USER11> The order the decorators are run at import time is explicit. Everybody loves module-scope programming and import-time side-effects! What's wrong with you man? ;-)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I used web.py for a few years before switching over to mostly coding in Rails for the last few months.

Is this for real? Do people find the difference between the style of these micro-frameworks substantial? Maybe I've been out of Python-land for too long, but 70% of these look almost identical (raising exceptions for redirects, a combination of lists and naming conventions or decorators for routes/methods, etc.) and the other 30% look awful.

Furthermore, when all of the frameworks are basically the same, isn't a much more important question what scenario they were designed for, or what extra features they have, or performance, or how big a community they have? (Even where the author seems to have reasonable criteria, like WSGI, he doesn't seem able to look up that web.py is WSGI-based.) And seriously, does _anyone_ care about Python 3 and/or PyPy support in 2011?

Another way of putting this: do the criteria that the author lists match anyone's criteria who is currently writing Python web applications in the real world?

</comment><comment><USER14> I have no idea how the LOC numbers of Flask come together though. Flask itself is 1.4KLOC, Jinja2 is 6.5KLOC and Werkzeug is 10KLOC (all measured without tests). Even if you add them up you don't end up with 32KLOC.

<comment><USER15> The author probably did something like this:

        sudo pip install -u flask
        cd /usr/local/lib/python2.6/dist-packages
        find flask/ werkzeug/ jinja2/ -name '*.py' | xargs wc
        ...
          34936  127298 1658380 total

Werkzeug alone has 18KLOC and does not ship with tests.

<comment><USER14> Those are not lines of code. That includes docstrings which all of Pocoo code is full of. If you _want_ to measure lines of code you at least have to skip comments, docstrings and empty lines. And for that there is sloccount. This also includes the testsuites btw.

With this little script (<http://paste.pocoo.org/show/465885/>) I get the following results:

        Flask      1467 LOC
        Jinja2     6560 LOC
        Werkzeug   9923 LOC
        Bottle     1910 LOC

(FWIW)

<comment><USER15> There are better ways to count LOC, I agree. But the idea is the same: Bottle does what it does with 1/10 of the code that runs flask.

<comment><USER16> Flask also has more features and unless you find a way to accurately rate features for their usefulness and compare all those somehow the LOC metric has practically no meaning.

It would be much more interesting for potential users if people started comparing lines of documentation(LOD) and showed the quotient lines of tests/lines of code.

<comment><USER15> LOC and LOD suffer from the same problem: You can write (or generate) lots of code or documentation that does not help the user. You can even write docs that confuse the user, repeat a lot, to not get to the point and so on. In that case, more is even worse than less. There is no number to measure the usefulness of a framework or the quality of code. And there is no point in comparing frameworks just by numbers.

<comment><USER16> You will notice bad documentation almost immediately which makes the disadvantage of using LOD as a metric practically irrelevant.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> The author's examples for cherrypy were way more complicated than they needed to be, and they didn't take performance into account. I also find some of the conclusions about its documentation and wsgi questionable. The author also drops some frameworks immediately due to maturity, but then fails to rank the remainder based on that. What about ipv6 and proper Unicode support? What about http/wsgi compliance? And of course, at the end they show all the extras the frameworks have but don't take those into account.

</comment><comment><USER18> To count out sessions and templating means truly "micro." I can't think of many useful web applications that do not require these to some extent.

With those criteria, I'm sort of switching between Flask and Tornado right now.

Speed is a major consideration with any python framework, too. You've got serious threading concerns. Even with Tornado, advertised as non-blocking, the default solution is nginx running against a whole bunch of tornado threads. ...

</comment><comment><USER19> I also like the way bottle handles static files and apps compared to flask. I lost flask when it went into blueprints. Bottle seems more intuitive, though there is not much difference.

<comment><USER16> You can write Flask applications without ever having heard of the term blueprint. I don't see how they could complicate things.

<comment><USER19> If you are planning to have a lot of functionality, i.e. routings, you need some way to modularise. Bottle does seem to have a more pythonic way. Flask creates new concepts that seem counter intuitive to me at the first look.

<comment><USER16> Bottle has no concept at all for this, besides sticking independent applications together.

You can do that with Flask as well, in fact the documentation there is an entire document describing various approaches[1].

Blueprints are a "new" concept but the approach is basically the same, however they are able to interact with the application at a Flask-level, they can modify the application and share information like the configuration.

This is something Bottle doesn't support at a framework level, forcing you to abuse the functionality it provides from a semantical standpoint.

This concept is more difficult to understand but than again it is very trivial compared to other concepts any web developer should grasp.

[1]: <http://flask.pocoo.org/docs/patterns/appdispatch/>

</comment></comment></comment></comment><comment><USER20> I did something similar a while back, in case any-one's still interested ..

<https://github.com/agiliq/so-starving>

</comment><comment><USER21> Flask is clearly a better framework than bottle. I started with bottle and hit a bug. (<https://github.com/defnull/bottle/issues/192>). I had to switch to flask to avoid it.

</comment><comment><USER22> The video is also available at <http://www.youtube.com/PyconAU#p/u/7/AYjPIMe0BhA>

Interesting if somewhat very biased.

</comment><comment><USER23> Where does one draw the distinction between micro- and megaframeworks? Or, for that reference, just a "framework"?

<comment><USER24> Things a company will ask you to know is a megaframeworks. Else, it's a micro or simply framework.

Obviously, I'm not serious here; but there's some truth in it. I.e. You'll see some companies ask for django or rails developers; not for flask python hacker right ;-)

<comment><USER15> Your point is interesting, but I would look at it from a different angle: If you need a highly paid specialist with many years of experience to fully master a framework, call it mega-framework. If it fits your brain and can be learned over the weekend, its a micro framework. Everything in between is just a framework :)

</comment></comment></comment><comment><USER25> Pesto wins if you count the extra features at the end.

</comment><comment><USER26> tl;dr: Bottle wins.

<comment><USER27> I think the scoring part (being very particular to the tester and not weighted at all) is the least interesting part of the presentation, the code and the comments for each framework are actually quite interesting. I just wish that Twisted / Tornade would've been in the fray.

</comment></comment><comment><USER28> God, this is ridiculous. I can't advance slides, when I do, it skips multiple slides at a time and I have to register to download a copy that I might actually be able to view.</comment>


Ask HN: How Did You Get Your First Developer Job? - <AUTHOR> <comment><USER2> I had two first developer jobs. I was always interested in computers. Played on Windows 3.1. In high school, I liked Photoshop. My first year at university, a friend outside school said I should take a programming class. After I did, he hired me at his start up (around 2001). A php site that was a b2b and c2b business directory to start. I made approximately minimum wage, but cut my teeth on running a web server. After the company folded, I kept up some small projects and did a few small gigs while I did a slew of other "real" jobs: insurance agent, financial services advisor, construction, and high school math teacher. After losing the teaching position, I had a minor resume of small (mostly web) projects I had done over time. I put that out and a recruiter picked me up. Sent me to a few places. Did ok on a couple interviewers, bombed a couple. Thought I did poorly at the last one, but I continued their interview track and got hired at nearly 2x my teacher pay. I've continued doing well there and it has worked out great. I'm now a principal developer and have lived going to work every day for the last 8 or so years. So, yeah, two first jobs: minimum wage code monkey followed years later by being hired as a real software developer due to hobby and a couple paid side projects.

</comment><comment><USER3> I had an office job that involved a lot of spreadsheets and some Access databases, and I taught myself how to script a good chunk of my day-to-day responsibilities. I used the resulting spare time to learn more, automated additional tasks, and eventually found myself spending the majority of the day writing and maintaining code. When it was time to look for a new job, I was able to get a position as a software engineer based on the skills I had acquired and the programming projects I had completed and deployed.

</comment><comment><USER4> Started a company doing development. Did that for 3 years until someone wanted to pay me more to do the same stuff.

<comment><USER5> same here, but for almost 2 years. Kept the registered company though, to be able to do freelance in spare time.</comment></comment>


Coinsetter raises $500k to bring leverage, shorting to Bitcoins - <AUTHOR> http://techcrunch.com/2013/04/09/coinsetter-lands-500k-from-secondmarket-founder-others-to-help-bring-leverage-shorting-to-bitcoin-trade/

<comment><USER2> An unregulated leveraged options platform with essentially no assets and what will undoubtedly be super senior debt deals with their prime broker writing naked contracts on something that moves 30% based on one website lagging out for a hour or two?

what could go wrong

<comment><USER3> bitcoins was babby's first forex trading platform. I guess it's time for nerds everywhere to get a crash course in options (emphasis on the word crash.)

<comment><USER4> god this is going to be good

Edit: Is anyone actually recording the market movements? It'd be really neat to see minute-by-minute how this goes down.

<comment><USER5> Bitcoin Charts [1] keeps history for dozens of exchanges (which all float at slightly different values) and has a free API to let you request any period of interest. Beyond just market price, I think you can get records of every individual trade. If nothing else, this whole bitcoin thing is a fascinating experiment!

[1] <http://bitcoincharts.com/charts/>

</comment></comment></comment></comment><comment><USER6> The people here talking about shorting bitcoin to moderate the bubble have no idea what they're talking about. Shorting a bubble is about the stupidest thing you can do. Here's how that math works:

1) You open a margin account with $10,000.

2) You borrow 25 BTC from your broker and sell them on the market at $200. You hope that the price crashes to $0 and your net profit will be $5,000.

3) What actually happens is that the price doubles to $400. It would now cost you $10,000 to close your position (buy the 25 BTC back at market prices).

4) Your broker realizes this and decides -- without asking -- that it doesn't like this state of affairs and closes the position for you, wiping out your margin.

5) You are now $10,000 poorer.

<comment><USER7> I talked about shorting bitcoin to moderate the bubble, and I have some idea what I'm talking about. Don't confuse "shorting will stabilize the price" with "it's a good idea to short bitcoin".

A shorting mechanism makes it possible for people who are not bullish to participate in the price discovery process. Without a way to short, there are only two participants in the price discovery mechanism -- those who previously acquired bitcoin and now think that they're overvalued and those who think they will continue to appreciate and want to buy more. There is no way for someone who bought at $20 and got out at $100 to express an opinion that $200 is an unsustainable bubble.

Kid Dynamite wrote a good post about how an inability to borrow can keep a market irrational for a long time here: [http://kiddynamitesworld.com/on- misinterpreting-pslvs-premiu...](http://kiddynamitesworld.com/on- misinterpreting-pslvs-premium/)

It's irrelevant whether shorting bitcoin is going to make anyone money, or when shorting will make people money vs. when it will wipe you out on a margin call. I'm only talking about how the ability to short will make the market more efficient.

<comment><USER8> The implicit assumption that there is a bitcoin bubble, is not a fact.

Was the .com speculation the last two decades a bubble? Is Facebook stock circa 2007 a bubble? etc

Rational arguments can be both ways and I'd be wary of anyone selling certitude on either side the fence.

</comment></comment></comment><comment><USER9> As a former trader (FI arb), I absolutely love this... for all the wrong reasons. I always wanted to DDOS my way to higher profits.

</comment><comment><USER10> And who says there isn't any innovation in online gambling?

</comment><comment><USER11> Are there some 0s missing? $500K doesn't sound like any amount of money to open a "mature" trading platform.

<comment><USER12> On the Bitcoin Software Maturity Scale, where hundreds of thousands of dollars routinely gets entrusted to 17 year olds coding bucket shops in Ruby on Rails and 80% of the global transaction volume is run through a company in Tokyo set up to trade Magic: The Gathering cards, a guy with financial industry and experience and enough money to pay for a single professional security audit is practically IBM.

<comment><USER13> > and 80% of the global transaction volume is run through a company in Tokyo > set up to trade Magic: The Gathering cards

 _Gasp_! You're right! What other companies have I foolishly entrusted parts of my life to?

/looks at his video game console, run by a company in Kyoto set up to sell handmade hanafuda cards

Not you too, Nintendo! ;_;

I don't know _what_ to believe in now.

<comment><USER14> Video game console != currency exchange company.

<comment><USER13> That was not my point at all. My point was that patio11 is, shamefully, engaged in well-poisoning by bringing up the distant origins of MtGox, which have zero relevance to any consideration of MtGox's current professionalism, security, regulatory compliance, risks to users etc. (A point that you would think would be obvious to anyone on Hacker News, who is aware of how companies 'pivot' all the time.) It has changed too much, isn't even owned or run by the same people, and has a long enough and spotty enough track record to judge on its own.

I illustrate the irrelevance and fallacy by applying the same well-poisoning to a pleasingly symmetrical example: another Japanese company which was also set up to deal with playing cards - Nintendo. No one would dream of judging Nintendo by its playing cards origin, because that was a long time ago, different people are involved now, and it has ample room to judge it since. Just like MtGox.

<comment><USER13> For example, MtGox shutting down trading is a great argument against its competence! But it shutting down trading has _nothing to do with its origins as a card trading site_. Bringing that up is pure rhetoric.

</comment></comment></comment></comment></comment></comment><comment><USER15> Long overdue. I've done some research on trying to short Bitcoins and could not come up with anything better than a naked short position or something with tremendous counterparty risk. I'm more interested in Bitcoins as a legitimate means of exchange rather than as an investment, and a service like this would enable me to protect against volatility, the same way similar services in existing ForEx markets protect borrowers and lenders in foreign markets.

<comment><USER16> How does the ability to short protect you? Genuinely curious, I don't know anything about markets beyond traditional buy and sell.

<comment><USER15> Say I sell you a house and allow you to finance it with a mortgage denominated in Bitcoins. The house would normally sell for $250,000, so as of yesterday, I would have accepted 1,000 bitcoins for it. Let's then say that over the course of the next year the price tumbles to $5 per bitcoin. You can now go out and spend $5,000 to pay off the mortgage entirely. However, if I shorted bitcoins by buying put options(the right to sell them at a certain price at some point in the future) which enabled me to sell 1,000 bitcoins at $230, I would effectively insure that I will only ever lose a maximum amount of $20,000 because of the volatility as opposed to the $245,000 I would lose if I was not able to hedge my position. Similarly, if I had a price for something i wanted to sell truly denominated in bitcoins, (i.e. not dynamically changing to always reflect a constant price in USD or some other currency), there would be a similar risk, particularly if I'm keeping my earnings in the form of bitcoins instead of immediately selling them. You can start to see why options are a very important step in something becoming a true currency. It allows you to safely deal with it somewhat more independently of volatility.

<comment><USER16> Yes that acts just like purchasing an insurance policy! I guess I was imagining the case where you short and then the price doubles when you need to buy, and not considering that you could buy an option and only use it if the price falls. Thank you for taking the time to explain it.

</comment></comment></comment></comment><comment><USER17> This is a big deal. With leverage and shorting, the only people who will have use for BitCoins (as opposed to a long position in a margin account) will be the small set who need the specific type of liquidity that BitCoin offers... and that will prove to be a small set. (People who need regular anonymous liquidity have other means.)

I will also remark that, even when a bubble is underway, shorting is dangerous. If you don't know what margin calls are (and how much it sucks to get hit by one) then stay out.

<comment><USER18> You miss the big picture. Digital currencies will exist as an instrument to hedge against currency fluctuations, commodity manipulation, and to let you deploy liquid money into assets with calculable appreciation/depreciation rates.

It won't take much more than a large industry coalition to settle the price fluctuation around bitcoins, which will follow the basic organic market coalition... i.e. vendors accepting bitcoins.

In the future, we may not be using bitcoins, but you can bet we're going to be using coins made of bits. I don't know if my bitcoins will be worth anything eventually, but they will be an artifact of great change at least.

<comment><USER17> _Digital currencies will exist as an instrument to hedge against currency fluctuations, commodity manipulation, and to let you deploy liquid money into assets with calculable appreciation/depreciation rates._

National currencies are much less volatile than Bitcoins have shown themselves to be.

 _In the future, we may not be using bitcoins, but you can bet we're going to be using coins made of bits._

I think we can agree there. "Bits" have nothing to do with it. It's this:

Money pre-1800: metal (usually gold or silver) that can be used to pay taxes and hire killers to defend land.

Money 1800-2075[?]: debt of large institutions, with equity a small player.

Money post-2075: access to talent (the _new_ limiting factor on getting ideas into implementation). We're starting to see that. I put that at 2075 because people are very conservative when it comes to money, so even though that will be the definition of wealth decades before that, I think it will take a long time before we can come up with a reasonable talent-based currency. What would the proof-of-work model be? It's hard to say.

<comment><USER19> > National currencies are much less volatile than Bitcoins have shown > themselves to be.

I think Zimbabweans, Argentinians, Russians, Mexicans, Romanians and a handful of other nationalities would disagree with you.

</comment></comment></comment></comment><comment><USER7> This is great news if it works out. The ability to short is an important part of moderating a bubble.

<comment><USER20> You can short now: icbit.se is a well-run exchange and derivatives market.

</comment></comment><comment><USER21> Congrats to Coinsetter! Hopefully this should lead to longer term price stability of bitcoins.

<comment><USER10> Under what scenario would this increase stability in bitcoins?

</comment></comment><comment><USER22> With the price soaring to new heights, how do you pay for things in bitcoins when a single bitcoin is worth so much? Can you pay in fractions of a bitcoin?

<comment><USER23> Yes, just like you can pay in fractions of a dollar or Euro.

<comment><USER22> Thanks - should have checked wikipedia first - "In trade, one bitcoin is subdivided into 100 million smaller units called satoshis, defined by eight decimal places."

</comment></comment></comment><comment><USER24> Wouldn't this, ironically, stabilize Bitcoin, if others try to take advantage of its growth and try to bring it down again?

<comment><USER25> It would indeed stabilize Bitcoin, but I don't see what's so ironic about it. Short-selling and other derivatives substantially stabilize a lot of markets, popular delusion to the contrary notwithstanding.

<comment><USER26> But now there is double the incentive to artificially drop the value of BitCoin as much as possible, no?

I don't know how trading bitcoins work, but won't this increase volatility both ways in addition to overal stability (taken as an average).

<comment><USER27> Yes--basically, short-selling just creates the same kind of "flight to quality" gravity that kills markets when people start to feel pessimistic about them, but pulls in the opposite direction: so now, on average, everything will "draw a straight[er] line", but moment-to-moment you'll just have price spikes that kill the short positions in the same way price-plummets kill the long positions.

What Bitcoin really needs to smooth out its volatility, as far as I can tell, is HFT market-makers trading tiny amounts of BTC by the millisecond. Which should theoretically be _easier_ with an all-digital currency--but, if done in "real" BTC, requires probably at least a million times the block-chain growth velocity Bitcoin currently has. It could still probably be done with "BTC liabilities" on a private exchange, though.

</comment></comment></comment></comment><comment><USER28> I just found out that IG Markets have added Bitcoin binaries to their trading platform. You can bet on the Bitcoin price being above / below $100, $150, $200 etc on MtGox at some point in the future.</comment>


Why You Shouldn't Use Bright, Saturated Colors for Backgrounds - <AUTHOR> http://uxmovement.com/content/why-you-shouldnt-use-bright-saturated-colors-for-backgrounds/ <comment><USER2> Same goes for black and white: never use either #FFFFFF or #000000 in large visual areas.

<comment><USER3> It comes in the next article that they linked:

[http://uxmovement.com/content/why-you-should-never-use- pure-...](http://uxmovement.com/content/why-you-should-never-use-pure-black- for-text-or-backgrounds/)</comment></comment>


Craigslist Starts Cease and Desist to 3Taps and Mashery - <AUTHOR> http://allthingsd.com/20121001/mashery-is-the-latest-to-be-snared-by-craigslists-copyright-crusade/?mod=tweet

<comment><AUTHOR> The chilling effect of going after service providers is really beyond the pale. ISPs are protected for good reason - the API layer shouldn't be different.</comment>


Ask HN: Password best practices? - <AUTHOR> My password practices are an unsystematic mess. I keep different passwords of varying strength across all of my accounts.
I'm ready for a total overhaul with best practices in mind.
How should I go about this? <comment><USER3> Use a password archive (e.g. KeePassX) encrypted with one really, REALLY good password you'll memorize (plus a keyfile, should you feel paranoid).

Each password for a service is then randomly generated and stored in the archive; you don't need to remember them, you just need to access the archive.

For default, I have chosen 60-character password length, upper-lower-numbers- spaces-special characters mix (as a rule of thumb, a longer password is preferable to a more complex password).

For whatever reasons, some services refuse this combination - and that's a huge red flag: if the service at least hashes the password, it should get a uniform, eminently storable string out. If they care what characters go in ... well I ain't saying they're storing the plaintext, but it's close enough to arouse suspicion. One of the worst offenders seems to be Skype, with its "maximum password length: 20 characters, no weird characters allowed." If that happens, well, you can override the default and generate a weaker password for that one service, or vote with your feet and not provide your account details to such a suspicious contraption.

<comment> T-hawk What do you folks using password managers/archives do for access from other machines that don't have the password tool and database? Cloud-based password storage (either in a Dropbox-like service or built in with the password manager) doesn't feel kosher. This is what's stopped me from adopting a password manager so far - I want to always have access to things like my webmail and forum accounts from any internet client without a dependency on a stored database.

<comment><USER4> Ain't nothing wrong with using KeePassX + Dropbox. In any case, if the attacker can crack KeePassX's encryption, he can probably crack your forum accounts directly.

</comment></comment></comment><comment><USER5> Just use LastPass [1], 1Password [2], Keepass [3] or whatever password manager software you like and forget it. I prefer LastPass for seamless syncing and multi-platformity. It can also check existing password if you use them multiple times!

1\. [https://lastpass.com/](https://lastpass.com/) 2\. [https://agilebits.com/onepassword](https://agilebits.com/onepassword) 3\. [http://keepass.info/](http://keepass.info/)

<comment><USER6> I completely agree. I used to have systems upon systems for remembering passwords, but I inevitably had accounts with the same password, and remembering them was impossible after a while.

I started to use 1Password (for my Mac) about two years ago, and it probably sat, unused, for the first six months. I knew that I was doing the wrong thing by not using 1Password, but I was also frustrated by the thought that _every_ time I went to a Web site, I would need to click a few more times, instead of letting my browser fill things in.

At a certain point, I realized that the only way to use good passwords was to embrace the 1Password way of doing things. I slowly but surely changed all of my passwords, and I feel much, much more secure nowadays. Each site has a different, long, impossible-to-remember password -- but that's OK, because the whole point is that the password shouldn't be possible to remember.

It takes time to use such systems, but they're incredibly worthwhile. And after a while, their use becomes quite painless and natural.

<comment><USER5> You can set up LastPass even to log in you automatically, so you don't even have to click submit or login buttons if you want!

<comment><USER7> You can but you shouldn't, since there might be the chance of someone listening in. [0]

[0]= [https://news.ycombinator.com/item?id=6944929](https://news.ycombinator.com/item?id=6944929)

</comment></comment></comment></comment><comment><USER8> Personally, I use a self devised algorithm for each service. In comes the service's name, out comes a password.

An example of an algorithm could be the first two letters, the last two letters and place those around the name of the person who created the service. This is a poor and somewhat weak algorithm, but the main idea is given the service's name you are not only able to derive the password, but each service has a unique one.

<comment><USER9> I tried that once, but it is hard to determine what the name is actually. Especially after you forget it and have to reconstruct it.

Is it? = "Hacker News", "HackerNews", "Hacker news", "ycombinator", "news.ycombinator.com"... you get the idea.

Even if you have a 100% way to determine the name. Then the main problem why this doesn't work, is that the name might get changed slightly and ruin your scheme. And you can't remember the password because you didn't visit the site for 4 months.

Example: Hacker News -> News for Hackers, or the domain you used for name gets slightly changed.

Then what?

<comment><USER8> I've yet to encounter a scenario where the name of the service changes. I guess in that case you could always use something like internet archives to see what the name was previously? The approach's success is in following a set of rules unquestionably and for all services. So for example for all multi- word services, you use camel case.

</comment></comment></comment><comment><USER10> While I like the idea of using LastPass, I think the danger lies at wherever your weakest link is, and the moment you choose to index your passwords somewhere other than your brain, you are creating the potential for a weakness.

Specifically, if someone gains access to your physical computer and they figure out your LastPass password, what happens next?

If you choose to use LastPass, make sure you do it with a fantastically long, entirely random password.

Example: "3BA^h<VQgj+nL%KP$ (this was completely randomly generated at [http://passwordsgenerator.net/](http://passwordsgenerator.net/))

For a little reasoning, look into how passwords are generally hacked. Usually, hackable passwords consist of words or l33t words (l!k3 th!5) that are somewhat related to the person. A massive number of people use the same words or patterns for these things, so a brute force attack informed by a l33t-smart dictionary (minus the definitions) often is the cause for a hack like this. Furthermore, in different languages, there are more frequently used letters and spelling conventions, which can inform the dictionary's ordering or choice of words. (Think: colour vs color)

However, if the person does indeed use a random sequence of characters, the average person doesn't usually go outside the alphanumeric range. If the password is only lowercase, that's 32 characters. If it contains uppercase, that's 62 characters.

So then, we can take that information and use it to understand the complexity of a brute force algorithm based on possible permutations and other info.

Take a look at this: [http://www.passwordmeter.com/](http://www.passwordmeter.com/)

(Disclaimer: I do not hold any type of CS degree or formal training in cryptography. I've listened to a few classes online though.)

<comment><USER3> Solid advice - except for three issues: 18 characters, in 2014, is not "fantastically long" at all. The choice of lcase/lcase+ucase only gets you a single bit per character typed - password length matters most, everything else is just icing on the cake: nice, but non-essential. Also, password meters are mostly harmful - the author takes some arbitrary rules and turns them into a measurement - that's okay for weeding out horribly weak passwords, though.

<comment><USER11> If the password is truly random (and uses the entire keyspace - upper/lower/number/symbol) then 18 characters is fantastically long. At 1 trillion guesses per second it takes ~1.3 Trillion _Centuries_ to exhaustively search the 18 character key space that uses all four things (upper/lower/number/symbol)

</comment></comment></comment><comment><USER12> I used to use 1Password, but I've switched to pass[0]. I prefer it because it's written for the command line and works really well. Your passwords are encrypted with your GPG key. Check out the man page for usage and examples[1]. (It's available on Fedora via yum and on OS X via brew and there's also an iOS app).

[0]: [http://www.zx2c4.com/projects/password- store/](http://www.zx2c4.com/projects/password-store/)

[1]: [http://git.zx2c4.com/password- store/about/](http://git.zx2c4.com/password-store/about/)

<comment><USER13> I'm quite stumped why there aren't more good password tools. Pass, vim-gnupg, and SublimeGPG are all I've found. The application managers are atrocious -- not only the UIs but data format interoperability as well. Browser managers are insane.

On another note, the pass documentation recommends a filesystem layout that doesn't remember usernames. I used this scheme before going back to vim:

      www-website-com/id/username
      www-website-com/id/password
      www-website-com/id/other_field

<comment><USER12> I generally organize stuff like I did in 1Password. So I have stuff like this:

        /logins/<domain>/<username>
        /servers/<hostname>/<username>
        /databases/<type>/<host>/<username>

Then I can do stuff like

        pass /logins/<domain>/<username> | pbcopy

and the password gets copied to my clipboard.

</comment></comment></comment><comment><USER14> I store the random passwords generated by tools like pwgen in a encrypted text file (Vim ":X" feature configured for blowfish) which is encrypted with a long complex password. The file is then kept in Truecrypt volume in cloud. I still worry about plain password in clipboard when do copy/paste from the file.

I tried using tools keepass and dashlane. They are good, and work most of the time, but irritant with few sites, enough for me to not use them.

</comment><comment><USER15> I use Keepass, KeepassX, KeepassDroid and Dropbox to sync them all together. I usually generate my passwords with `pwgen` rather than the purely-random strings that come out of Keepass, as sometimes I'll want to type the password by hand -- pwgen`s passwords are much easier to copy as they avoid ambiguous characters.

I recently went looking for a passphrase generator that supports the [http://xkcd.com/936/](http://xkcd.com/936/) scheme, and failed to find one I thought I could trust. So I created [1], which is about as simple as it can get, is loaded (from my own server) over SSL and doesn't rely on anything server-side or use any frameworks, so you can easily verify it by hand. It does rely on Firefox at the moment as Chrome doesn't have the crypto functions it needs yet. I intend to clean it up and publish it properly, but I'm all out of tuits, let alone round ones.

[1]: [http://ares.aylett.co.uk/pw/](http://ares.aylett.co.uk/pw/)

<comment><USER16> Just as a note, the [http://xkcd.com/936/](http://xkcd.com/936/) password scheme has issues. See the discussion in the comments here: [https://www.schneier.com/blog/archives/2012/09/recent_develo...](https://www.schneier.com/blog/archives/2012/09/recent_developm_1.html)

<comment><USER17> I don't see any valid issues raised in that discussion beyond the question if 44ish bits of entropy is enough. And it is quite easy to bump the complexity if necessary. Wordlist of 10000 words (instead of 2000) and 5 (instead of 4) words and you get 66 bits of entropy (log2(10000^5)), which should be enough for most uses.

edit: some numbers for scale: oclHashCat claims 2500M tries per second for plain SHA1 with single HD7970 GPU. That would mean that 4 of 2000 word passphrase would be cracked in 1.5 hours and 5 of 10000 word passphrase would take 1268 years.

</comment></comment></comment><comment><USER17> Most important stuff is already mentioned, but I'll add one important detail:

Consider which are most important accounts (email would be prime candidate) and have the login details for them written up on a physical paper stored in a secure place. This is to prevent catastrophic data loss in the situation where your primary way of managing passwords fails for one reason or the another.

<comment><USER18> I do a few things with this type of mindset.

I copy my 1Password keychain onto a USB drive, space is cheap so a 16gig USB drive contains backups going back like 6 months. This drive also includes other bits of data, like tax returns.

There are now two of these drives. Once every two weeks, or after significant changes are made, I rotate them in and out of a safe deposit box.

At home I have the other in a fire safe.

One of my notes in my keychain is also instructions on what to do in case of my inevitable demise :) What credit cards I have, what services I use, all of that type of information.

The master password is stored in a safe location that only immediate family know about. Along with location they know how to handle my affairs if something were to happen to me.

It's a great backup system, but also helps handle taking care of things when I'm gone as 1Password stores data about whatever you want and keeps it secure.

Hope that helps with some more ideas for how to use your password manager to make your life easier.

Kyle Swank

AgileBits

</comment></comment><comment><USER19> For several online accounts, I am using a cryptographic hash of [the site name] + [a secret phrase] to generate the password.

<comment><USER20> What do you do when the site requires that you change your password? Do you use a different secret phrase? And if so how do you keep track of those?

<comment><USER19> Heh heh--uh, fortunately I have not encountered a site that ordered me to change my password and forbade me to use an old one. If I had to deal with that scenario... I guess I would create a file that had, on separate lines, "[site name] [number of resets]", and would change the main script to take a hash of [site name] + [secret phrase] + [output of "grep '^'$SITE_NAME' ' [that file]"].

Also, if I wanted this to work with multiple accounts on a single website, I would have to include [account name] in the input to the hash function.

<comment><USER20> The forced password change seems to be popular with enterprise software managed by a corporate IT department. A favorite policy they enforce is something like the following..."You must change your password every 30 days. Your new password must be different than your last 8. It must contain at least one number and a mix of upper and lower case letters. It cannot be more than N characters in length." It's kind of ridiculous and counter productive in that it destroys an otherwise sensible strategy like the one you proposed (referring to your first comment) and in its place you get employees doing silly things like making their passwords Password1, Password2, Password3, etc with each successive forced reset.

<comment><USER19> Gah, that's unfortunate, and perverse. My scheme has indeed been defeated by the DMV's website capping the length of the password at 20, and there are a couple I know it wouldn't work for because they require at least one non- alphanumeric character.

On the plus side, all this brain-damage does seem fairly easy to incorporate into an automatic scheme. Have another file that has a list of cutoff lengths for each site that has them, and another file with special characters to insert. Then the scheme becomes: hash [domain] + [secret] + [resets (if any)], add special characters to the start (if any), and cut off the end of the string (if necessary).

<comment><USER17> The primary (or even only) advantage of hash-based password management is it's stateless nature. Once you begin to introduce files (ie extra state) to support the system you might as well use fully randomized passwords stored in file.

<comment><USER19> You have a point. Another advantage is, all that state other than the secret phrase is insufficient to derive the password, and could be passed around insecurely, while the secret phrase could be memorized. But I suppose one might achieve the same thing with a GPG-encrypted file of randomly generated passwords. Still, if you lose all relevant files, you should be able to reconstruct the hashing scheme and recreate all passwords that didn't require state. Whether this matters is up to the reader.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> I use the combo of OnePassword for password management + Leemail to have a unique email address for every service/website I use. Leemail also makes it easy to block any emails which gets leaked to spammers or companies that ignore unsubscribe requests. i.e. one unique email and one unique password for every service I use.

<comment><USER20> How many devices do you use 1Password on? I tend work on two macs, a windows PC, an Android phone, an iPhone and an iPad. Maybe that's a bit excessive but it's certainly common to have at least a few devices. I keep getting turned off by 1Password's licensing model which requires separate software purchases for each device. It's not the total cost that bothers me but rather that the model suggests to me that using 1Password across a lot of devices is going to be a hassle. I'm curious if that is your experience.

<comment><USER22> I'm using mine on one Mac, one PC, iPhone / iPad and I'm not really having issues with the licensing. I'm actually having issues with syncing the data...

<comment><USER18> Hi there!

Please contact us at support @ agilebits . com, no spaces. We'll be happy to help get things working. You're free to mention my name and someone will pass it along to me personally.

Include each device (like above) along with what syncing method you are using (Dropbox, wifi, iCloud).

This goes for anyone who has trouble. You're welcome to contact us for support, we do everything we can to help support our users if they run into trouble. Please don't hesitate to contact us.

Kyle Swank

AgileBits

</comment></comment></comment></comment><comment><USER23> The easy answer is a god quality password manager. You use that to generate passwords that are as long and complex as the sites / services you use will allow.

You then generate a Diceware passphrase. It's easy enough to learn a 6 word passphrase.

You can combine a passphrase with a Yubikey for 2FA.

There are risks and problems.

We don't know how secure password safes actuLly are.

It's hard to maintain these across multiple platforms.

It's hard to integrate them with existing software flows - Chrome remembering passwords or OSX keychain for example.

Yubikey is almost brilliant, but the small miss means it's actually very crustratig to use.

Edit: this also doesn't cover what happens if you suffer a brain injury or die. You need some mechanism so people can admin your affairs in those situations.

Edit2: you might want to use a spycoin if you travel across international borders.

</comment><comment><USER24> Use very complex, unique passwords for everything. Generate these passwords with a tool like pwgen, the OS X keychain, etc. This contains a password leak to only the systems that share the same password.

Use a encrypted storage for your password, protected by a master password. This can be as simple as text files on encrypted volume, or a more complicate password manager.

When you can avoid using passwords, do so. For example, key based SSH auth prevents you from having to re-enter passwords all the time, and is generally more secure.

When given the option of 2-factor authentication, take it. 2FA + a weak password is usually better for security than a strong password without 2FA.

</comment><comment><USER25> Have 2 kinds of passwords. A small set for passwords that could retrieve others (mail, password manager that you must have, computer/phone, offline/offcomputer ones) that must be easy to remember/rebuild for you, but very hard to break in practice (if you want, generate them using your variation of the xkcd approach). And the rest to be basically random, long, with a big charset, all different for each site and generated and kept in a password manager (that should have an offline storage, like KeePassX, even if you sync them on your devices using dropbox/google drive/etc)

</comment><comment><USER26> I've always been attracted to use a password archive service, but there is one use case that I encounter very often, maybe you can help me by answering how you deal with this.

What do you do when you need to connect in a PC that is now yours? This happens to be very often in parties when people want me to use my spotify.

Also do you keep your rsa passphrase in the archive?

As for what I do now: I integrate the service name in my password in different ways depending on the name. The combination is long enough and has enough entropy that I feel comfortable against bruteforce attacks, but is quite a mind juggle to find my password sometimes.

</comment><comment><USER27> It's less complicated than what I'm reading here.

* Use a passphrase of at least five random words.[1]

* Keep that passphrases secret.[2]

* Use a password manager like 1Password or Keepass to generate and manage all other passwords.[3]

[1]: Good passwords have high entropy and are easy to remember. For that reason, passphrases are preferred to passwords.

[2]: It's ok to write down your passphrase, but keep it somewhere safe -- like your wallet.

[3]: Password managers prevent password reuse and make life easier. Sync passwords across devices.

for more: [http://bdd.io/security](http://bdd.io/security) , with linked justifications.

</comment><comment> data-cat I like to take a long phrase (usually some lyrics from a song) and convert it in to a mnemonic. By combining the first letter of each word in the phrase, and converting some of them in to numbers or symbols, I am left with a relatively secure password that it easy to remember.

For instance...

"Cause I know that time has numbered my days And I'll go along with everything you say"

Becomes...

ciktthnmdaigaweys

Becomes...

c1k77hnmd41g4w3y5

I use this system for all of my passwords. I try to use a different password as often as possible and never have to write them down. Frequently used passwords have gotten to the point where inputing them is an exercise in muscle memory.

<comment><USER28> ugh that looks horrendous. I tried this out at one point with a song lyric that was around 7 words. Took me about 20 seconds each time to type the password (had to sing the song in my head every single time).

Now I just use the xkcd method. e.g. forest monkey jump truck

I have a different password for everything, which is something like 50 different passwords. I know around ~15 of them by heart - the rest I almost never use (I store them on google drive behind 2FA for when I need them)

<comment> data-cat Lol yea passwords that are not frequently used can take a while to input. I do sing the song in my head almost every time.

What I would really like to do is program a simple command line application that would generate and store all of my passwords. I started on one a while ago but never finished it; its on my to do list.

</comment></comment></comment><comment><USER29> I use lastpass with yubikey.

Password to lastpass is long and completely unique - not used anywhere else.

lastpass generates and maintains passwords for all sites - they are all 16 characters long (long passwords are key for preventing bruteforce typically), unique, and they all contain numbers, upper and lower case characters, and symbols.

The thought process is - if one of the passwords is compromised (hacked site, brute force, etc.), the same password will not be usable on other sites. I had this happen in my WoW days.

Edit: I have the lastpass app trusted on my phone so I have access on the go.

</comment><comment><USER30> To be different from the other comments, here are different examples:

You could use a password card[1]. Just print an keept it on a safe place (your wallet :-D).

or

Get a long and complex Password you can remember (there are lots of techniques to create and remember a passwort). After that add a site-specific phrase to your password. For example: [YourLongAndComplexPasswort]H4ck3rn3w$ As you can see, H4ck3rn3w$ is the site-specific phrase for the hacknews-website.

[1] [http://www.passwordcard.org](http://www.passwordcard.org)

<comment><USER11> "[YourLongAndComplexPasswort]H4ck3rn3w$"

This is not a good approach. The problem arises when some thrid aprty stores your password in clear text or some easily reverisible format that allows hackers to easily get this "[YourLongAndComplexPasswort]" part thus reducing your password to the easily predictable suffix.

If your unique Hack News suffix is H4ck3rn3w$ it's a fairly safe bet that $l4shd0t, R3dd!+, Gm4i! will also be easily predictable

</comment></comment><comment><USER31> You should use KeePass, with automatically generated passwords and expiration dates. 60 characters is far too much, 16 is good with numbers, letters and special characters.

I don't use any american solutions due to Snowden's revelations. I don't want NSA on my passwords. Prefer an open source program.

If you want a cloud system, with keepass on your smartphone automatically updated, I think you should create your owncloud server.

<comment><USER3> Why does it matter to the user how many characters are in the password? Xe never interacts with that string directly anyway; and password _length_ strongly correlates with password _strength_. 16 is way, way too low - <USER2> rainbow tables for this size are already widely available, and most sites still go for the lowest security possible (single password hash, unsalted).

<comment><USER32> I go for 64 as a default length, but it's surprising how many sites respond with "No! You can't havee more than 8/10/12 characters or I'll sulk!" Makes me extremely suspicious re: just how they're storing them.

</comment></comment></comment><comment><USER33> Good timing on this post, recently decided to shape up my own practices.

I'm currently storing everything in a separate OSX keychain with a strong 20+ character password but there seems to be very little out there describing how OSX encrypts the notes. I can only find articles from a few years ago staging it's 3DES but I would like to think its been upgraded since then.

</comment><comment><USER34> There has been a lot of research done at CMU recently regarding how to pick passwords. This paper is a good starting point: [http://www.cs.cmu.edu/~agrao/paper/Effect_of_Grammar_on_Secu...](http://www.cs.cmu.edu/~agrao/paper/Effect_of_Grammar_on_Security_of_Long_Passwords.pdf)

</comment><comment><USER35> I use a password that I keep in my head for my bank and creditcard. Another for Amazon, GMail, Apple ID and my Linux server.

And for the rest of the bunch, I switched to 1Password. It doesn't support Linux, but that's okay for me. I do most of my browsing on iPad and MacBook.

<comment><USER36> I would strongly recommend having your GMail password be different than all of your other passwords, plus with 2-factor authentication. Getting access to your GMail means that someone could easily get access to any service you use that account on.

Yes, this means your GMail password security is likely more important than your bank's.

</comment></comment><comment><USER7> I switched to Lastpass a few years back and never want to go back. Recently I upgraded it with a yubikey ([http://yubikey.com/](http://yubikey.com/))</comment>


Firefox doesn't hoist function declarations in blocks - <AUTHOR> http://statichtml.com/2011/spidermonkey-function-hoisting.html

<comment><USER2> As the article says, what Firefox is doing is the correct behavior. I am surprised though that all other browsers are doing it wrong, I would have expected some variation.

Worth checking btw if JS strict mode fixes this. I know it fixes related issues.

<comment><USER3> It isn't, it just has different incorrect behavior. As stated in the article, function declarations shouldn't be supported as statements at all -- but FireFox DOES support them, it just doesn't go as far as to hoist them. This seems like a bad compromise: because it half supports the feature but surprises you in that it works subtly differently. It probably wasn't a conscious decision but rather the result of fixing some random compatibility issue with a site that expected to be able to use functions declarations as statements but didn't rely on hoisting.

<comment><USER2> The article states that Firefox's behavior is according to the spec. I didn't read the spec myself, did you do so and see that the article is wrong?

<comment><USER4> Please read again. I said:

"Firefox doesn't actually issue a warning, which would have made my job tracking this issue down much easier. Moreover, functions declared within a block before being called work just fine, so it's not that function declarations can't by used as statements so much as SpiderMonkey won't bother to hoist them before executing any other code in that block."

As I said, the grammar in the ECMA-262 spec only allows Statements within Blocks, and a FunctionDeclaration isn't a Statement.

None of the browsers adhere to the spec, but I suspect they're just trying to play nicely with legacy content. Firefox just happens to play differently to all the other browsers.

<comment><USER2> I see, thanks for the clarification!

</comment></comment></comment></comment></comment><comment><USER5> >The grammar reference section states that the only constructs allowed within a Block are Statement constructs, and that a FunctionDeclaration isn't a Statement.

Huh! Never knew that. I wonder what their reasoning was when they decided that. Behavior in this case is all over the map in other languages: C and Python both consider function declarations and definitions as statements, but C allows you to provide a forward declaration of a function that you define later, after invoking the function, while Python doesn't. Perl allows forward references to subroutines without a preemptive declaration; Java considers method declarations as separate grammatical entities from statements but doesn't care what order you put them in within a class; Ruby behaves similarly to Perl.

PHP (as always) is a total odd-man-out: it considers a function declaration to be a statement, doesn't allow forward references to functions, and it exposes nested function definitions to the current namespace as soon as the parent function has been executed once. That is, if you define a function foo() and inside its body define bar(), you can access bar() from outside of foo(), but only once you have invoked foo().</comment>


What's new in Play 2.4 - <AUTHOR> https://www.playframework.com/documentation/2.4.x/Highlights24 <comment><USER2> This submission's title is horribly misleading because Play is not a Scala web framework. It's a web framework for Java and Scala.

As someone who's used Play heavily for the past couple of years, I'm very excited by this release, which is Play's best yet.

<comment><USER3> Do you use Play with Java?

I always thought Play looked incredible, but the focus on Scala puts me off. Every time I tried it, Java seemed like a second-class citizen in the Play world. I don't have anything against Scala, I'm just not really interested in learning it, especially if I all I want to do is use a web framework.

<comment><USER4> I've used Play with Java, helped a customer (a big insurance company) move all their developments to Play Java.

It works fine. The only annoying thing is the asynchrone nature forces you to have abstract classes everywhere, but with Java 8 it's no longer a problem.

<comment><USER5> > the asynchrone nature forces you to have abstract classes everywhere

Could you elaborate?

<comment><USER6> I think he/she meant anonymous classes, not abstract.

Akka uses callbacks to handle asynchronous behaviours, which means you need closures, and in Java <8, that means anonymous classes littering your code, which is a real PITA.

<comment><USER5> Oh yeah, that makes more sense.

</comment></comment></comment></comment></comment></comment><comment><USER7> I've been using Play for about 2+ years with Scala. I think it's a cool framework and has removed most of complexity that you see with other JVM-Web frameworks. There are few things that are still missing, like up-to-date docs. and bundled ORM. The plugin community needs to be better organized so it has potential to become a gem like community.

<comment><USER8> > up-to-date docs

Which parts are out-of-date?

> and bundled ORM

Didn't they just go the other way, de-bundling all persistence APIs/libs?

What's wrong with just picking the one that's right for your use-case and using just that?

</comment></comment><comment><USER9> I still miss the simplicity of Play 1.x... also does Play 2 have a admin CRUD module yet?

<comment><USER2> Play 1's code generation / scaffolding for CRUD apps was nice. It would be a cool feature to add to Play 2.

I really find Play 2 to be an enormous improvement over Play 1 though. As just one example, deploying your app is so much easier in Play 2. Play 1 expected you to install the framework on your production machines. Play 2 has built-in support for building deb/rpm packages, docker containers, zip archives, etc. which makes deploying so much easier.

<comment><USER10> Yes, such a big improvement. With SBT's 'sbt docker:stage' command it's pretty much trivial to get a Play app running on a cloud provider that supports docker.

</comment></comment></comment><comment><USER11> Glad to see they are requiring Java 8. Should make writing play applications in Java a lot nicer.

</comment><comment><USER12> Interesting that Java 8 is a strict requirement. I'm curious what version of Java is most common in enterprise these days?

</comment><comment><USER13> Can someone compare this framework to Django or Rails? Java was my first language and I sorely miss a lot of aspects in it. Would be interested to know about the learning curve, performance, and ORM.

<comment><USER14> And how does it compare to DropWizard? I'm porting a plugin from Atlassian Confluence to make it a standalone app, and I'm leaning for DropWizard because I can reuse and share the common code made of Jersey REST resouces and synchronous calls.

Both Play and DropWizard seem to have the same goal, Play being more integrated and scalable, DropWizard more respectful of existing Java frameworks.

</comment></comment><comment><USER15> I've recently tried to use play with scala on a new project after having had a very pleasant first experience with play/java, but found the overall experience much much less convincing. IDEs often don't work well with the language, and some key parts of the framework such as ORM seem still a work in progress.

Anyone else had the same feeling here ? I came to the conclusion that play should advocate the use of java as the preferred language if they want to grow their user base even more.

</comment><comment><USER16> Great release, I especially like the built in reverse router for subprojects and the better dependency injection aproach.

</comment><comment><USER17> Page layout doesnt look right on my android 5.1 tablet chrome even after I requested the desktop version.

</comment><comment><USER18> Great release, kudos to the team.

</comment><comment><USER19> Dependency injection was one of the barrier of entry for me. This is a huge milestone.

</comment><comment><USER20> FYI, this URL is anchored towards the bottom of the page. Scroll up to see everything.

</comment><comment><USER21> Standardized dependency injection is great news! The Play application I work on has a home-grown dependency injection system that leaves a lot to be desired. It will be great to see a more standard way of doing this.

<comment><USER22> I have seen many projects use scala-guice [1][2]. If all I have to do is build a module [3] and @Inject[4] in to the top of my controller, I struggle to see the benefits of Play supporting it directly.

1 - [https://github.com/codingwell/scala- guice](https://github.com/codingwell/scala-guice) 2 - [https://github.com/mohiva/play-silhouette- seed](https://github.com/mohiva/play-silhouette-seed) 3 - [https://github.com/mohiva/play-silhouette- seed/blob/master/a...](https://github.com/mohiva/play-silhouette- seed/blob/master/app/modules/SilhouetteModule.scala) 4 - [https://github.com/mohiva/play-silhouette- seed/blob/master/a...](https://github.com/mohiva/play-silhouette- seed/blob/master/app/controllers/ApplicationController.scala)

<comment><USER2> The big difference with 2.4 is that Play now uses DI internally. So if you want to replace some Play component with your own version of that component, you can do that. With 2.3 you could use DI with your own app, but couldn't with any Play-provided components.</comment></comment></comment>


Microsoft quietly shuts down Office Genuine Advantage program - <AUTHOR> http://www.zdnet.com/blog/bott/microsoft-quietly-shuts-down-office-genuine-advantage-program/2798

<comment><USER2> Microsoft relies on Office piracy as a strange means of price discrimination. The product requires network effects to maintain its near-monopoly position in the corporate world, and having a significant portion of people in "document sharing" networks say, "I don't have Office" is a threat. So, what Microsoft's quietly made decision says to me is that they are worried that a sufficiently large enough portion of computer users were both unwilling to pay for Office and unwilling to bother pirating it.

On Black Friday, many online retailers were running specials on a Home/Student Office "Family Pack" -- three legal installs for $100. This is a midpoint between the corporate price point and free. Perhaps an attempt to introduce another segment? I recall the availability of home/student editions in the past, but the price points were always much higher.

<comment><USER3> I think Microsoft is attempting to target students more aggressively, perhaps because of the appearance of other cheap/free options on the market in recent years. Just last year Office 2007 was on sale to students at $60.

<comment><USER4> The university my wife attends (in the USA) has some kind of weird site license where students get it for free from the IT department if they are willing to drop off their laptop with the university. (This isn't a bad deal, since probably the average freshman also buys their laptop from the university anyway). They can pay $10 to get the DVD themselves. (This is a very large state supported school.)

My school (even larger and state supported) charges like $92 for the same thing.

I've not figured out why two almost identical schools about 20 miles apart have such a different pricing scheme for their students.

I do know that in our relationship, my wife buys all the software. :)

<comment><USER5> The difference in pricing is likely due to the schools participating in different programs. Feel free to reach out to me if you're interested in seeing your school have a similar program as the one your wife attends. I would be happy to put you in touch with someone who'll know more about that topic than I do.

</comment></comment></comment></comment><comment><USER6> I'm a fan of MS Word, I really am. These days though, I find that, as an amateur writer, I prefer simpler tools - markdown or google docs. I _think_ this is a slow trend they are (or should be) worried about.

For home users, gmail thoroughly beats Outlook.

Excel is a different beast. I don't have much experience with it, but I've seen it used widely at various places of work (medical and financial). I'd say Excel is now their strongest product when it comes to maintaining a stranglehold.

When you consider the price, advances in google docs, gmail and and OpenOffice, I'm not sure Office is really a good value for most folk. They _think_ they need it - that's a dangerous position to be in - selling a product because people _think_ they need it, rather than actually needing it.

<comment><USER7> Agreed.

In my opinion, Word is the best app ever to come from Microsoft.

<comment><USER8> I disagree, Excel is the best app ever to come out of Microsoft! :-)

I've done entire engineering courses (200 and 300-level) with nothing but Excel. And there are certainly more powerful applications to do maths in but once you get past the simple interface it real is quite powerful.

<comment><USER9> Agreed, Excel is an amazing app. It's also Microsoft's strongest hold on businesses. I doubt there is more than a couple percent of businesses that don't depend on Excel in some fashion for their accounting.

Every company I've been in has Excel spreadsheets for things like budgets and expense tracking. They were all written long ago and no one is really quite sure how they work.

</comment></comment></comment></comment><comment><USER10> A lot of commenters seem confused about this: you still have to validate Office to get it to work, or pirate it to circumvent the check. The change is that Microsoft will let you download Office add-ons without verifying that said validation occurred, so pirate versions can now access the downloads.

</comment><comment><USER11> If you run a print/copy shop or need Office for precise in-company document compatibility (or addins), you will want MS Office and you will easily afford a license or two.

As for everyone else, OpenOffice has 99% of the features, so it's not even worth the trouble of pirating it.

<comment><USER12> _As for everyone else, OpenOffice has 99% of the features, so it's not even worth the trouble of pirating it._

But pirating it just got a little bit easier, so Microsoft have shifted the balance a little away from OpenOffice.

</comment></comment><comment><USER13> Excel is the tool of choice for non techies who need "database like" functionality but the word database scares the crap out of them. Large companies wrap multi million dollar businesses around Excel, and I think there will always be a market for an app like this.

I only recently began using Office 2010 at my office and feel like this is what office 2003(or if Im feeling generous, 2007) should have been. Outlook is an anachronism as far as Im concerned- even connected to exchange. There are so many modal features about it still that are infuriating, but its getting to an almost gmail usability level. If gmail integrated calendaring as well as outlook I would forward all my work email to a gmail address and never touch outlook.

MsWord stil is hands down much better than any free equivalent I have tried, but I only need this app ~5 - 10 times per year.

I wish they had an "Office for people who really dont need office that much" version that was on some sort of azure/pay for need basis(where the cost was minimal and paying wasn't) because that is what I need. I dont want to have a few GB of hardly used real estate on my hard disk for when I need to update a resume.

<comment><USER14> >>Excel is the tool of choice for non techies who need "database like" functionality but the word database scares the crap out of them.

In fact I use Excel only as client for MS Analysis Services. It's my tool of choice. Not flawless, but I can't find something better.

</comment></comment><comment><USER15> Microsoft releasing actual legitimate open source code (<http://www.microsoft.com/opensource/>) , and relaxing restrictions on "piracy." Next thing you know, Windows 9 will be based on Linux.

<comment><USER3> _Next thing you know, Windows 9 will be based on Linux._

I don't think I'd stop partying & celebrating for at _least_ a week. Non-stop.

That is my personal private dream- that one day, Windows will have a true Unix core like OSX.

<comment><USER16> I think Microsoft would just run chmod 777 and chown root:wheel to the entire filesystem (and any attached disks) and then proceed to run everything as root with a special sandbox for users based on ACLs.

And they would probably use ext2 and add journals to it.

<comment><USER17> I'm not sure if that's supposed to be funny, but Microsoft's own NTFS bests _all_ of the last generation of filesystems in both features, stability, and performance.

Only recently have unix filesysetms matched and surpassed NTFS (which was built back in the very early 90s!). reisrfs, btrfs, xfs, jfs, zfs, etc. are better than NTFS in some ways, but all the "traditional" unix filesystems do not even come close (ext2/3, hfs, ufs).

<comment><USER18> > NTFS bests all of the last generation of filesystems in both features,

Definitely no.

> stability,

So close to 100% it's hard to measure any difference. Well... Perhaps it beats BtrFS and other experimental/unfinished products. But, again, it doesn't beat it in features.

> and performance

One thing is sure - NTFS is the fastest OS on Windows.

<comment><USER17> Please re-read my post. I said "last generation" and not "this/next generation"

I clearly specify that btrfs is a better FS than NTFS. But btrfs is NOT from last generation.

<comment><USER18> Well... I agree that 2010 NTFS beats a lot of filesystems that were released in 2002 or so. That was kind of expected.

It's also notable NTFS is now catching up to some features that were part of Unix-heritage filesystems since the 90's. Like symlinks and mountpoints.

<comment><USER19> Eh, "2010 NTFS"? NTFS is more than decade old and it's 2002 version was also better than a lot of filesystem "released in 2002".

And NTFS had mountpoints since Windows 2000.

<comment><USER18> Correct - mount points are part of 2000 (NTFS 3). I have no doubt NTFS 3 was better than some filesystems released in 2002, provided enough people released filesystems in 2002. It was also probably better than many filesystems still in use on 2002.

Still, NTFS is catching up to other modern features like symlinks...

AFAIK, which is somewhat limited because I am not a Windows user and don't work in a Microsoft shop, NTFS has some cool features, like transactions, I don't think ext3 had. It also has compression (something that makes a lot of sense if you have more processor than disk bandwidth or space) and folder encryption. Oh.. And transactions. Did I miss something?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> I'm kind of surprised by this. If they had just shut down the bit that forces you to validate, but left a way for you to validate your copy, that would make more sense to me.

I mean, some people might genuinely want to know for sure.

Of course, it's possible that they shut this down while they put up something even more bothersome.

<comment><USER21> > I mean, some people might genuinely want to know for sure.

Are these the same people that want to go through TSA screenings just to make sure they aren't dangerous?

<comment><USER22> I have known people who bought used computers or Office software, and had no idea that their software was pirated until they attempted to reinstall it. While it is sometimes obvious when software is pirated, it often is not.

</comment></comment></comment><comment><USER23> Arr, my mateys, the battle is ours!</comment>


Apple Store: A Lesson on Self-Service And How To Take People's Money - <AUTHOR> http://iamvictorio.us/post/8342103448/apple-store-self-service-lessons

<comment><USER2> I've had different experiences. My Apple store retail experience has _usually_ impressed me. That said, I have felt that some stores provide consistently better experiences than others. (e.g. IMHO the Apple Store in Palo Alto is usually decent. The one at the mall near Stanford (Stanford mall?) sucks.)

Apple's purchase experience is an incredibly personal one. I grab a blue- shirted employee and tell him/her what I want. They either bring it. Alternatively, they hand you off to someone. The fact that they can charge you using a handheld (without a checkout line or counter) startled me the first time I experienced it. I was also surprised that they could email receipts. This contrasts with my experience in Duane Reade or Sears where buying gum forces you to deal with 3 feet of paper. These are the positives.

Sometimes their experience sucks. It is still better than other places. 1) Employees are chatty even when there are other people waiting. 2) When employees "go up" to get your stuff, it takes a long time. A couple of times, I've wondered if they ran out of the Kool-Aid that makes them smile so much and are getting their refill :-p

Your post said you liked gas stations and Ikea. I agree that gas stations give you a quick self-service experience. Ikea, on the other hand, is on my hate- list. It is damn near impossible to find an employee in the stores I've visited. Self-service in retail is an interesting idea. It works great for simple transactions. I've seen it fail miserably at airports and grocery stores.

<comment><USER3> Yeah, IKEA hasn't been great at answering questions while you are shopping but I actually like the checkout process. They do self-serve well there. IKEA also epitomizes DIY in general.

I'd say my experiences at Apple Retail Stores have generally been positive but have been inconsistent and certainly has room for improvement. I don't like how the checkout location sometimes varies (back, front, handheld) but I admit overall, Apple does it better still than most retailers.

</comment></comment><comment><USER4> I've heard quite a few similar complaints about Apple Stores. "I've got the product in my hands and I want to give you my money so I can leave." Confusion about where to go and long waits once that's figured out. I've seen a person put items back on the shelf and leave.

Obviously it's not killing them (!), but I do think they need to clean up this part of what's an otherwise really good experience.</comment>


You Have To Get Good Before You Get Better - <AUTHOR> http://danshipper.com/you-have-to-get-good-before-you-get-better

<comment><USER2> It took me a bit to digest what you were saying, but I think I agree.

To my mind, though, the thing that separates successful learners from unsuccessful is _persistent constructive dissatisfaction_. If you have some difficulty finding contentment—and are never happy to rest on your laurels for too long—then you will be determined to achieve more and more, and learning will happen as a by-product. The longer a plateau becomes, the more likely it is to stay a plateau; and the shorter you can make a plateau, the better for your progress.

Perhaps, as you say, this comes from not keeping track of learning progress. However, I think there is an important other side of it: you _do_ want to keep track of progress toward some other goal, such as making a game. Then it becomes a matter of "I need to learn about networking _in order to_ add multiplayer to my awesome game". When learning stands between you and your dreams, you quickly learn to learn quickly.

<comment><AUTHOR> Thanks for the feedback Evin! I like your point about persistent constructive dissatisfaction. I think the distinction that I'm making is that when people get to wrapped up in their progress they get persistent _destructive_ dissatisfaction. That produces frustration, which leads people to stop trying.

<comment><USER2> Yeah, that's a nice succinct way of putting it. Unfortunately, nice succinct ways of putting things don't seem to make for very compelling writing. So we blog.

If another person calls me "Evin", I may have to stop using the name "evincar of autumn". The reference is so easily lost.

<comment><AUTHOR> Sorry about that Jon!

</comment></comment></comment></comment><comment><USER3> This reminds me of one of my favorite articles that I always forward to people who want to become better, maybe even quite good...but are just starting out

[http://www.unlikelysalsero.com/2007/08/magic-of-time-last- on...](http://www.unlikelysalsero.com/2007/08/magic-of-time-last-one- standing.html)

</comment><comment><USER4> Thanks for this. I'm teaching myself to program and I've been trying to always focus on the long term. Always trying to focus on the thought that, as long as I keep at it, I'll get better, even if I feel useless right now.

Thanks for the encouragement and validation.

<comment><USER5> <http://www.norvig.com/21-days.html>

I stumbled across this incredible article reading Jeff Atwood's now- apparently-controversial post on that subject I'm avoiding like the plague.

Back to the point, it basically summarizes what I tell all of my friends who gain an interest and want to learn fast. I've been learning for over a decade out of interest now since I was 12 and I will never refer to myself as anything other than marginally competent. I akin programming to math in the sense that the ceiling is not really there because there is always more to learn and thats what the majority of your (programming) life is spent doing.

</comment></comment><comment><USER6> A fantastic essay - and very true!

"If your goal is to get a little bit better every day, you're constantly monitoring your progress. But your barometer for progress is so screwed up that it becomes extremely discouraging very quickly. This is the point where most people give up."

This second sentence is my favorite in the entire post.

When I started coding 15 years ago, all I cared about was having fun, learning and building something great. All you need is a fun project, emotional ignorance to the peaks and valleys in your perception, and a lot of practice.

This is very different from the current academic approach to teaching people how to code. The projects are usually boring and dull, you start by learning theoretical constructs and what not - instead of experiencing the joy of hacking.

Btw your post reminded me of a few books: \- The Talent Code \- Talent is Overrated \- Outliers

All fantastic books in the field of deliberate practice. Once you learn and internalize the process of deliberate practice, you become free of the emotional burden that comes with learning new stuff.

Like most things, awareness of the pain alleviates it substantially. Your post does a great job at creating awareness.

</comment><comment><USER7> In the book called "Dip" by Seth Godin - he talks about the plateau where most people quit when learning something new. Initially, the excitement of trying something new get people started. Once that wears off, you hit the plateau. To really become good at something, you need to fight these plateaus.</comment>


How to Not Suck at Facebook Apps, Part I: Why It Matters - <AUTHOR> http://startupism.com/2007/07/31/how-to-not-suck-at-facebook-apps-part-i-why-it-matters/ I'm collecting my thoughts on the Facebook platform as a series of three articles on a guest blog.
<comment><USER2> The first thing I was asked by a non-YC incubator.

"How do you plan to acquire users?" "I dunno, spamming" I reply. "You should try facebook apps."

Second angel non-technie guy I was talking to... "now something like facebook apps, that's what we could get behind."

Ok, fine. You're gonna get your stupid facebook apps. The point I want to make is that facebook apps now are like penny loafers in the 30's.

Wear the heck out of them now and have a couple to show off to your friends, but eventually they are going to be Sunday only dress. Popular, but only 1/7th of your wardrobe.

best.analogy.ever</comment>


Ask HN: How to get a development job without a college degree? - <AUTHOR>

I'm currently a student at a top-10 computer science school who is on leave of absence because of poor academic performance. Right now I'm taking a few classes at my local community college and I'm thinking about getting a job soon. The problem is currently I have no college degree, and if I mention my current school they will probably ask for my transcript, and I don't want to give that out because my GPA is under a 1.5.
I'd like to get a development job of some sorts, or maybe some entry-level IT position, but unsure where to start because I have no previous work experience. I have several years of experience in Web development with PHP and MySQL and a bit of knowledge in C++ and Python. And I have some projects (mostly web apps) that I made which could probably serve as a portfolio and be put on my personal website, but I'm not sure if that's enough to get my foot in the door, let alone count as work experience.
Also because my GPA is so low and my school is quite expensive, I'm thinking of withdrawing and just starting over at a local 2-year CC then transferring to a school with a good CS/eng program (there are a few in my area). I honestly don't think I'm going to graduate and get my BS in CS at this school, even though I'd like to have the prestigious degree on my resume.
What should I do? <comment><USER2> I am currently 19 years old and in my second job in the industry, I was completely self taught and didn't even finish what you would consider high school (since in the UK we leave when we are 16.) Your degree is a piece of paper which tells your employer you are capable of learning and remembering large quantities of data and theory, your practical experience on the other hand, is what tells your employer you are genuinely capable of doing the job.

Get yourself an internship or go work for a small company for 6 months or a year, you will learn soon enough that your degree is mostly irrelevant and that university is more-so for building character and connections than actual practical experience.

</comment><comment><USER3> The most obvious to me are: Apply to internships in your zone and start github-ing to let others watch your work</comment>


Japanese Man Creates Amazing Art Using Excel - <AUTHOR> http://kotaku.com/old-japanese-man-creates-amazing-art-using-excel-wait-499616608

<comment><USER2> Huh? I want to believe, really, but I'd need to see more than those images to buy that. Pretty stuff indeed though.</comment>


The validity of grades - <AUTHOR> http://jseliger.com/2010/02/17/the-validity-of-grades/ <comment><USER2> Wow you quoted me :) (I kind of feel embarrassed, its an essay I through together and then basically retracted because it was so thrown together, and Iv'e been to lazy to fix it...)

Some thoughts on what you said:

      "Smeder misses the main point, which isn't identifying
      the problem; a gazillion people in the Chronicle of Higher
      Education have said virtually the same thing at various
      times. The real problem is solving the problem, which
      requires changing the incentives that drive professors. "

Your argument is that we need to put the carrot in front of the teachers. Give them incentives to be better teachers. I think this is true. But it only solves part of the problem.

Your solution is analogous to a magazine company giving its sales team commissions in a world where sales teams don't earn commission. Which I agree is smart. In fact I hate it that teachers don't have incentives to be good teachers.

... continuing the magazine company analogy: Yes, I agree sales reps should be paid on commission. However, if the magazine sucks and the company is poorly run fixing the issue with the sales team isn't going to fix the company.

-

The point of my essay was to say that the problems with college are out of the hands of teachers. It is an organizational problem. In a magazine company a organization problems would be: The magazine has a bad art department or the main editor sucks at his job. These are issues that correcting the mistake made with the sales team wont fix. Giving the sales team the commission they deserve wont put a high quality magazine in the hands of the public. Sure it will help. The sales team will put pressure on the Art Department to step up their game. But in the end you cant fix the magazine by fixing the how the sales team is paid. My argument is you can't fix college by fixing how we treat teachers. Giving teachers is only part of the solution.

-

Giving teachers incentives is needed, but it won't fix college. The organizational level issues with college I stated in my essay are:

\- Super Star teachers are not utilized to their full potential.

\- Designing a good lesson plan is difficult. Creating fair tests is difficult. (And people act like its not!) It's so difficult I think a team of people using the most recent research on education methods should be doing this not a teacher by himself with microsoft word and power point open. This guy [http://bentilly.blogspot.com/2009/09/teaching-linear- algebra...](http://bentilly.blogspot.com/2009/09/teaching-linear-algebra.html) should be helping teachers teach. It is ridiculous that most teachers don't use the education techniques this guy used. And I am sure there are many other education techniques that teachers could be using but don't.

\- Students are not given adequate resources to study and collaborate (24 hour study areas, rooms with white boards).

\- Peer tutoring programs and study groups are greatly lacking.

\- Way to many students don't have the basics down: Writing, Spelling, hand writing, study skills and basic math. The lack of these skills cause many brilliant and creative students to needlessly to do poor in school or worse kicked out. For example I got B's and A's in my Special Relativity and Intro To Quantum Physics class but did poorly in my lab grades because I had bad hand writing, couldn't spell well or use grammar correctly.

<comment><USER2> Actually in my analogy changing "Sales Team" to "Writing Team" would be a better analogy. What I said still holds. Giving the writing team incentives will increase the quality of some of the articles, but if the editor and art department still suck the magazine is going to suck.

</comment></comment><comment><USER3> I decided grades were bullshit and rebelled in college because I failed a programming module while people who copied my lab work passed. Even worse was when people who copied my answers for a quiz got higher marks than me even though our answers were _exactly the same_ (seriously, wtf? was it my handwriting? ok, so I have really bad handwriting).

Towards the end, though, I realized that spending extra time in college redoing modules wasn't making any statements other than that I like incurring debt and am possibly retarded. So I gritted my teeth and finished it. Despite knowing that grades are mostly bogus, I found to my surprise that I actually enjoyed that last year in college. If I bothered to learn the course material, it was good for me. If my teammates in the lab hacked the system by letting me do all the work, it was good for me because I learned more. And if they got better grades, it didn't matter, because they're bogus anyway, and I _knew_ I could leave them in the dust when it came to doing real work.

What I'm trying to say is that grades are bogus, but you should try to learn the course material in any case because it's good for _you_.

</comment><comment><USER4> In the vast majority of college classes that I've had, I've seen a pretty high correlation between the amount I've learned and the grades I've gotten. I've never felt like I did badly on a test even though I knew the material really well.

And there are some silver linings to grade inflation. I've never shied away from a really tough class for fear of getting a really bad grade, because it's hard to get a really bad grade when you're making an effort. That doesn't mean it's fair when my GPA is compared to less inflated GPAs, but at least it means I won't graduate feeling like I skipped out on really cool classes for the sake of my GPA.

Also, my perception is that grades appear to be inflated because the vast majority of people here are really smart, work really hard, and learn lots of stuff.

</comment><comment><USER5> Complaining about the validity of grades is an easy path to deciding "I could do better than them if I actually tried" for me. I've regretted not trying, but I've never regretted working hard, regardless of the grade.

<comment><USER6> The problem is that grades in the American system are a mix of work and teacher opinion. Whilst this can have its advantages, it also makes the system wholly unfair.

In the UK my eventual grades were decided by an impartial third party who didn't even know my name or sex, simply a number. Sure in this system I still could have done better if I'd tried harder, however I didn't try harder and I don't today, so really it is an apt measurement of my skills. Someone who is working their ass off at 15 is still going to be working it off at 50, I beat them without effort at 15 and logic dictates I'll likely still be beating them at 50 without effort.

<comment><USER7> We have standardized testing in addition to grades in the United States. They tend to have their own problems. Foremost among them is that most tests are designed to be efficiently and objectively graded, which limits the scope of the test. But, standardized testing really is an entirely separate subject. The only further point I'll add on it is an anecdote.

One of my friends told me that the college he went to decided at some point that they think the SAT is stupid and they should stop using it as a basis for admissions. In order to get an idea of students' math performance, they would instead submit one (1) graded math test that they had taken in high school. Obviously, most students submitted the highest score they had achieved, which was usually the easiest test they had taken. Some students actually had the integrity to submit tests with mediocre scores but which nonetheless demonstrated significant understanding of the concepts. One poor professor had to review these tests, and decided admission based on them. He, quite properly, gave stronger recommendations for students in the second category, who submitted harder tests with lower scores. Politics ensued, and there was no happy ending.</comment></comment></comment>