Show HN: ParcelKit integrates Core Data with Dropbox Datastore API - <AUTHOR> https://github.com/overcommitted/ParcelKit

<comment><USER2> I never felt it was a good idea to integrate context/memory, persistent store and networking into a single library. I've gotten burned with that.

The whole concept of integrating business objects with some RESTful API that is supposedly going to be soooo perfect that everything just works is funny, you're always going to run into trouble and wish things were separated so it would be easier to work with the API.

<comment><USER3> Completely agree. However I'd like to hear what solutions out there you have used that do a good job of fully encapsulating each of those roles (context/memory, persistent store and networking) and work together well out of the box or with simple adapters?

</comment></comment><comment><USER4> Very cool!

Is this in active use in an app yet? Would you describe it as "production ready" or more "experimental" or "beta"?

Will definitely be looking at this for an upcoming project.

</comment><comment><USER5> It's not possible to seamlessly/transparently/asynchronously synchronize data; conflict resolution must be done.

If this was possible, iCloud+CoreData would have worked, and Oracle/PostgreSQL/etc would be shipping transparent, ACID, horizontally scalable RDMS.

<comment><USER6> From what I have seen this project uses the Dropbox Datastore API. The Dropbox Datastore API has very limited support for conflict resolution:

\- DBResolutionRemote: The remote value will be chosen. This is the default behavior for all fields.

\- DBResolutionLocal: The local value of the field will be chosen.

\- DBResolutionMax: The greater of the two changes will be chosen.

\- DBResolutionMin: The lesser of the two changes will be chosen.

\- DBResolutionSum: Additions and subtractions to the value will be preserved and combined.

So with these limited conflict resolution options conflicts might occur but they can be resolved automatically. I am not saying this is good or bad but beside setting one of those resolution modes there is nothing else to do - except explaining to users what happened to their data in the case of a conflict that should have been resolved with a more sophisticated mechanism.

iCloud+Core Data on the other hand allows custom conflict resolution on the clients.

<comment><USER7> We're definitely looking at adding more options for custom conflict resolution once we get out of beta.</comment></comment></comment>


AngularDart: The best Angular for you? - <AUTHOR> http://news.dartlang.org/2016/11/angulardart-best-angular-for-you.html <comment><USER2> Looks interesting. But I thought that Dart was given up for dead by Google.</comment>


How to hurricane-proof a web server for Harvey - <AUTHOR> https://arstechnica.com/information-technology/2017/09/how-to-hurricane-proof-a-web-server/ <comment><USER2> I was hoping to see data center that was barricading itself physically against the flooding with sandbox and preparing with diesel generators and disaster recovery. I think web traffic would've been the last thing on my mind.

</comment><comment><USER3> TLDR; Install caching plugins to wordpress, run on a server that is oversized about 100x for steady state load.

Which I guess works, but is not that interesting of a technical read? If you were not on wordpress, I bet you could have served that load from a single VM on a cloud provider, with the ability to scale as needed.

<comment><USER4> Here's the actual TLDR from the article:

      * Dedicated hardware server—no shared hosting
      * Gigabit uplink to handle burst traffic
      * Varnish cache with lots of RAM
      * Plugin-light WordPress installation
      * Off-box stats via WordPress/Jetpack
      * Cloudflare as a CDN
      * No heavy dependencies (i.e., ad networks)

<comment><USER5> And really "Cloudflare as a CDN" was the most important. It absorbed almost all of the traffic:

 _Between August 22 and August 30, Cloudflare served over five terabytes of cached Space City Weather content via Cloudflare's CDN. Only about 145GB worth of requests had to be served by the Space City Weather Web server itself. [...] Looking at raw requests instead of bytes, Cloudflare handled about 88 percent of those, too, with only about 12 percent of requests passed back up the chain to the origin server._

The origin server ended up seeing peaks of 50 RPS, most of that was absorbed by Varnish. I guess 50 RPS is a lot for WordPress, though I'm surprised given the origin server is a decent box:

 _The server has a quad-core Xeon E3-1230 CPU, 16GB of RAM, and mirrored R1 SSDs._

</comment></comment></comment><comment><USER6> Good write-up. And it kept him off the streets.

Many moons ago when a US Robotics Courier modem on a leased analogue line was still bleeding edge live IP provision in the UK, one of our pages got featured in "Mirsky's Worst of the Web" and our line was just maxed out for days. Divide all the CPU and line speeds by a few orders of magnitude and it all felt much the same getting what would become known as /.-ed... B^>

</comment><comment><USER7> I'd be curious to see whether any additional performance could be eeked out by ditching HAProxy & Varnish. Nginx can terminate TLS and handle caching, which would reduce the overhead of multiple separate processes & connections.

</comment><comment><USER8> Warning: Autoplaying video ad. No audio, so that is a plus.</comment>


Chinese tech firms are throwing out applicants over the age of 30 - <AUTHOR> https://www.technologyreview.com/the-download/611067/chinese-tech-firms-are-throwing-out-applicants-over-the-age-of-30/ <comment><USER3> This article is both shallow and basically blogspam of [https://www.bloomberg.com/news/features/2018-05-02/china- s-t...](https://www.bloomberg.com/news/features/2018-05-02/china-s-tech- industry-wants-youth-not-experience).

Note that the site guidelines include: " _Please submit the original source. If a post reports on something found on another site, submit the latter._ "

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment><comment><USER4> Well, as ways to ensure that China never really becomes competitive technically go, this seems to be one of the faster ones.

I mean, the idea that people get _better_ with _experience_... ludicrous! Beyond ludicrous! Unpatriotic!

Not entirely sure I buy it as a industry-wide phenomenon, though. I'd guess this is a particular subset of the industry or something, just as it is in the West.

<comment><USER5> There is some karma here at least, as those 20 year olds who establish a culture of age discrimination will themselves become old and be discriminated against.

<comment><USER4> My go-to argument against age discrimination on those occasions when I see a ~20-25-year-old in my area spout the idea that the old fogies just can't keep up with those hot young whippersnappers is to ask them point blank, "do you honestly see yourself not getting any better and learning anything in the next ten or twenty years? You seriously believe that you are, right now, as good as you will ever be?" It occurs to me as I write this out right now that I should also add "If so, please put me in contact with your manager as I'm sure they will be overjoyed to hear that you do not ever expect to deserve a raise, and, indeed, expect to be paid progressively less over the next few years as your skills rot away and you become steadily less effective."

It doesn't help that as near as I can tell, the undergraduate computer science education has barely changed in the 20-25 years since I took it. This is generally a good thing, not a criticism; it _shouldn 't_ be chasing every fresh hot trend, that's not its job. But if the fresh young whippersnappers are supposed to be picking up the hot skillz that will put this 20+-year veteran to shame, it's not clear to me exactly _where_ they are supposed to be getting these hot skillz from. It certainly isn't from their undergraduate education.

</comment></comment></comment><comment><USER6> Why are the standards of evidence so much lower for trends in Chinese and Japanese culture?

First of all, the title of the article isn't supported by the content.

Secondly, the evidence of the title appears to be a single unnamed recruiter.

Third, of course a vast majority of people in tech in China are going to be young. Do people not remember the economic situation of China 20-30 years ago?

</comment><comment><USER7> What could possibly go wrong when your hiring processes preclude most people with in-depth real-world experience? Learning lessons the hard way is expensive.

<comment><USER8> People who think this way are missing the forest for the trees.

The trees: fire anyone above 30.

The forest: Many development processes that required experience are being outsourced to companies like Amazon, Google, via their cloud computing platforms.

It is now possible to read some docs, follow some tuts and have a service that scales. If the inside is ugly, no one cares. That's the forest.

The problem is that this is how management thinks all over the world because it is short-term profitable.

Find another industry, seriously.

<comment><USER9> "If the inside is ugly, no one cares."

Yeah, so now your inexperienced developer just deployed something that takes 10 or 100x more resources than it should, and now you have a massive AWS or GCP bill to pay.

(Which brings up an interesting question, at what point does your cloud computing bill reach a point where it's worth it to pay the slight premium for a more senior engineer to come in and clean up the obvious inefficiencies?)

"The problem is that this is how management thinks all over the world because it is short-term profitable."

Not really, as so many early stage software companies are not interested in being profitable, short-term or otherwise. So cost management and profits are irrelevant, just resume padding for the next opportunity.

<comment><USER8> I worked on a project that was a clusterfuck of SalesForce, AWS AND Azure.

The company was making hand over fist. They didn't care about the quality so long as the payments were made and they weren't losing customers to competition due to tech choices.

</comment></comment></comment></comment><comment><USER10> It's all symptoms of the same problem: a vast oversupply of educated talent. To some degree we have it here to in the US, but it's much greater in China. With an oversupply of labor/talent, companies can be arbitrarily selective.

In China, seasonal workers coming into the city actually earn more than college degree holders because there's just so many people with degrees. We something similar starting to happen in the US, as more and more people get bachelors degrees, those people get compensated less and less.

<comment><USER11> >We something similar starting to happen in the US, as more and more people get bachelors degrees, those people get compensated less and less.

Maybe 10 years ago you could say this. But today the statement needs to solidly be:

>This is what the state of affairs has been in the US for years now. More people got bachelor's and were compensated less and less. More positions that previously required a high school degree now arbitrarily require a bachelor's. Students are flocking to trade schools in record numbers, and colleges/universities are almost all in a downward spiral right now.

<comment><USER12> I don't think that's accurate:

"The proportion of high school students who earned three or more credits in occupational education — typically an indication that they're interested in careers in the skilled trades — has fallen from 1 in 4 in 1990 to 1 in 5 now, according to the U.S. Department of Education."

[https://www.npr.org/sections/ed/2018/04/25/605092520/high- pa...](https://www.npr.org/sections/ed/2018/04/25/605092520/high-paying-trade- jobs-sit-empty-while-high-school-grads-line-up-for-university)

<comment><USER11> That source is from 2009. In 2009, there absolutely were more students interested in 4-year schools. In 2009 people were unemployed in nearly record numbers, and institutions of higher education were bursting at the seams.

This is now 2019.

Working on the cutting edge of higher education AND career/tech programs, the data isn't updated yet just because of the lag for completion rates, but students are HEAVILY moving toward skilled trades.

At my institution we have seen a 14% decrease in 'traditional' programs (think transfer to bachelors programs) and a 9% increase in skilled trades programs.

And a fun fact that those two numbers aren't the same. Fewer skilled trades require formal schooling than 'traditional' fields. Many students are not enrolling at all and are just finishing apprenticeships.

We're in a traditionally strong institution, and our enrollment is flat to 1% up at best. Many institutions in our local system are down in enrollment in the double digits in the last 3-5 years.

<comment><USER12> Oh good point, I took it on good faith that 'now' meant recently in the original article. Original source definitely wasn't now. Fair enough.

</comment></comment></comment></comment></comment><comment><USER13> Younger workers are less likely to take moral positions on company activities. I worked at a mortgage lead generation site in the 2000's and bought everything management sold. I can't see myself doing anything like that at this stage in my life.

<comment><USER14> > Younger workers are less likely to take moral positions on company > activities.

Is that actually the case? When I think of protests, I don't think of the elderly.

<comment><USER15> Not sure. It might be younger people are more likely to take stronger positions so that they go out and protest? If you use voter participation as a proxy for moral engagement, kids as a whole dont seem to care as much as older people. [https://www.census.gov/content/dam/Census/newsroom/press- kit...](https://www.census.gov/content/dam/Census/newsroom/press- kits/2017/voting-and-registration/figure04.png)

</comment></comment></comment><comment><USER16> "They're not able to focus on the high-intensity work" That is true. most 30 and over people with work experience know devoting 9-12 hours a day to a company is not worth it. While, a young engineer right out of college doesn't know any better. Burn them out after 2-3 years. rinse and repeat.

The main problem is employees are "at-will." Meaning they can be fired at anytime without reason. companies have no incentive to not overwork employees. Laws regarding "at-will" need to be changed

</comment><comment><USER17> Interestingly enough,I'm having the opposite problem here in the US... I've been applying to multiple tech firms for hardware roles and keep on getting rejected since they are almost all trying to hire senior positions rather than mid-level at this time.

<comment><USER18> when you have been around for a while you learn that senior people know something worth paying extra for. Then you start to demand only that until you discover all the senior people retire close to the same time and you don't have any organization depth coming up behind them.

Which is why when my department asked to hire a senior person to replace someone who transferred on leadership made us hire an entry level person to train up (then the next person left and we were allowed to hire a senior person).

</comment></comment><comment><USER19> It's funny how executive leadership never consider themselves too old for the job.

</comment><comment><USER20> Considering what big tech firms do in China mostly is copying other people's ideas using their own guys then drive them out of business, cheaper is better.

</comment><comment><USER21> All firms? Some firms? Most firms? The biggest firms? China is pretty big place.

Not that I don't believe it because things like that appear to happen informally in the US as well, but article would have been better with some supporting numbers.

</comment><comment><USER22> More punitive OT laws help discourage this kind of behavior. You'd seek out more experienced workers if it meant avoiding the huge salaries you'd otherwise be paying younger workers working large swaths of OT.

</comment><comment><USER23> That kinda sucks. I was recently approached by two Google employees, one of them said he likes my projects on GitHub, that I'm Google material and if I would like for him to refer me to a job there. I was very excited, of course. Did all they asked, applied for 3 positions as the usual on their process and managed to not even pass to the first interview. I'm 34 and going to college for 2nd time, graduating this year. Maybe this isn't my case, but I can't help to wonder.

<comment><USER24> They are just trying to get a referral bonus.

<comment><USER23> Is that a thing?

<comment><USER24> Oh yes: [https://resources.workable.com/tutorial/employee-referral- bo...](https://resources.workable.com/tutorial/employee-referral-bonus)

<comment><USER23> Dude...

</comment></comment></comment></comment></comment><comment><USER25> This would make a good study in Economics:

1\. Given Large supply of Developers as compared to Demand.

1.1 What causes Poor Software Quality Control and Poor hiring practices(resume padding or tech hiring offloaded to non techies)?

Are things like Long/Odd Working hours, Poor wages(race to the bottom), Talent flight and High attrition rate, Poor productivity etc just enforcing a vicious cycle till things hit some sort of equilibrium(software that just works and is barely maintainable and business margin is based on things like PPP between countries)?

1.2 How do good things come about; Like Decent/Good Software Quality Control, Good Hiring practices? Perhaps these cases have just okayish wages but poor working hours/balance? And there is an implicit bias towards a Younger talent pool because of focus on productivity.

2\. Given short supply of workers as compared to Demand I have seen similarities to 1.1 and 1.2, the only difference is that people have options and always gravitates towards better employers and work conditions; the wages are overall much better than case 1 period. There are still many interesting economic questions to be answered here, but likely different, more specialized ones as compared to (1).

</comment><comment><USER26> Basically there are no senior developers in those tech firms. They are going to be running around in circles. I couldn't think of a worst idea.

</comment><comment><USER27> Unfortunately, the current US immigration policy has made it unlikely that US tech firms would be able to take advantage of any prejudicial ageism bias in China.

It'd be nice to entice them to resettle in cities other than those on the west coast, too, but that might be a local culture problem, less amenable to remediation by legislation.

<comment><USER28> Majority of large tech firms have dev. offices in EU and India so they sure can take advantage of this.

</comment></comment><comment><USER29> "If it moves, tax it. If it keeps moving, regulate it. And if it stops moving, subsidize it." \--Reagan

</comment><comment><USER30> In the future, the majority of the world's population will be either hackers or mafia members. It will be a complete breakdown of human values. World governments will probably be forced to legalize crime. If we remove meritocracy, we'll end up with anarchy.

<comment><USER31> I think oldsters will become that old guy from the dystopian movie Brazil (1985), who did the work he loved illegally and for free, because of insane bureaucracy.

<comment><USER23> I need to watch that

</comment></comment></comment><comment><USER32> You can always work in the military industrial complex. Lot's of gray hair, including myself. Most under 35 don't know WTF they are doing anyway; sometimes amusing to watch them flop, then $$$ for me to fix their mess.

</comment><comment><USER33> A little bit like the US maybe?

I was already in a technical field, was laid off after a company buyout, I changed careers and took a coding bootcamp.

A few like minded classmates and I would compare notes after we did interviews.

The other two older guys and I got a lot of "culture" related questions. One dude was actually told by the recruiter that they were worried he was too old, he was surprised they'd actually say it to him so he asked ... and the recruiter repeated herself happily.

Meanwhile the younger classmates reported hearing nothing about "company culture" in any of their interviews...

The description of culture was often pretty benign ("we like to have fun" and so forth) but I couldn't help but wonder if it wasn't just a placeholder for some bias. On one occasion I got a description of "we're a young office".

<comment><USER34> In a weird way, it may have been for the best. It is incredibly frustrating to work with arrogant 20 somethings who don't know squat. Youth doesn't just mean inexperience, it can also come with a lot of ego with nothing to back it up.

<comment><USER35> I can confirm this. I was 20-something once. I have the blog posts to prove how arrogant I was.

<comment><USER36> I'm months away from leaving the 20-something club, and looking back at what I wrote to myself in my journal, it's amazing how much my own views and temperament have changed in even five years. Looking at fresh college grads now, I have moments of realizing "this is how I looked to the senior members of my team."

It's humbling. It's also encouraging to extrapolate that into how much more room there is to grow.

<comment><USER37> Don't be humbled. 20yos interpret humility as weakness. :)

</comment></comment></comment></comment></comment><comment><USER38> the same reason why everybody drafts/conscripts youngsters into the army - <USER2> youngsters dont ask questions, dont hold theirs superiors responsible and with great enthusiasm do what they told to do. A very powerful sledgehammer style tool. Obviously been there myself - not the army, that i dodged by the way of ROTC (USSR/Russia), i mean i've been to that place of stupid(well, looking back it looks that way even though it is in significant part a result of inexperience) unquestioning enthusiasm.

</comment><comment><USER39> So experience doesn't matter anymore? Why even bother?

</comment><comment><USER40> I don't like what we're doing to people over 30/40 at all. How long will this last? Is it a global fad of some kind?

</comment><comment><USER41> Maybe for programmers, but for DBAs, Sys and Network Admins, most companies want older candidates in my experience.

</comment><comment><USER42> The rest of the developed world is aging, I guess each society has to leverage their strengths.

<comment><USER43> As I understand it, China is aging more than the developed world rather than less. The one child policy has led to a massive disparity between generation sizes with proportionally fewer young people.

</comment></comment><comment><USER44> Workers forget they're basically underpaid chattel.

</comment><comment><USER45> confirm -- recent first-person account by an American living in Vietnam capital city .. tech dev ads explicitly ask for under-30

</comment><comment><USER46> I recently was talking to a libertarian friend about this kind of thing (specifically the gender wage gap). He argued that if there were a group of people getting paid less for the same work, then any good business would only hire people like that, because it's cheaper.

Obviously this isn't the case, but I do find it curious that the market doesn't seem to prove a strong enough incentive for the people making hiring decisions to overcome their biases.

<comment><USER47> > Obviously this isn't the case, but I do find it curious that the market > doesn't seem to prove a strong enough incentive for the people making hiring > decisions to overcome their biases.

Or the biases just aren't there in the way somebody from the outside perceives them, or the market would very much take care of it. This kind of reasoning ("the fundamental market mechanics totally don't apply" vs "my perception is probably flawed and things aren't as easy as they seem") reminds me of most people's early reactions when they encounter bugs: "this must be a bug in the OS/compiler/interpreter" vs "I must've made a mistake/misunderstood something". With more experience, they usually find out that it's somewhat unlikely to be the first person to encounter a super weird bug, and very likely to make mistakes.

<comment><USER9> ""this must be a bug in the OS/compiler/interpreter" vs "I must've made a mistake/misunderstood something""

At a certain point, you start fervently hoping it's "I must've made a mistake/misunderstood something", because then you can fix it. But good luck waiting for the OS/compiler/interpreter to be fixed, or digging into an unfamiliar open source code base to fix it yourself.

</comment></comment></comment><comment><USER48> Looks like SV is exporting techbro ageism to China, this will surely help with the trade deficit!</comment>


Some Datasets Available on the Web - <AUTHOR> http://www.datawrangling.com/some-datasets-available-on-the-web

<comment><USER2> Thanks to whoever submitted this. It is an old post, but I just updated it this week with 230 new dataset links I collected in the last year. The page has about 400 datasets listed now. It also includes a tagged json version for groups like infochimps who are working to categorize open data or scrape it from the web.

<comment><USER3> Peter, any chance you could organize them, or tag them in some way? Otherwise, there is no way to know what any data set is until you click the link.

<comment><USER2> Yes, I'll take a pass at sorting these into groups this afternoon or at least add more descriptive information. Some of the original link titles are a bit mysterious, like this one: "Voter registration data; or, HERE IS YOUR HOPE, YOU FOOLS! « The Edge of the American West"

I'm going to toss the ball into infochimps court for any deeper organization of the data, since they are already set up to handle it.

</comment></comment></comment><comment><USER3> Here are some other dataset aggregators:

        http://theinfo.org/
        http://infochimps.org/datasets
        http://ckan.org [Comprehensive Knowledge Archive Network]
        http://www.trustlet.org/wiki/Repositories_of_datasets
        http://www.daniel-lemire.com/blog/data-for-data-mining/
        http://www.quantlet.org/mdbase/
        http://datamob.org/
        http://freebase.com/
        http://infochimp.info/ics/data/ripd/www-personal.umich.edu/~mejn/netdata/
        http://infochimp.info/ics/data/fixd/
        http://infochimp.info/ics/data/pkgd/
        http://infochimp.info/ics/data/rawd/
        http://www.archive-it.org/public/all_collections</comment>


Could a Bank Deny Your Loan Based on Your Facebook Friends? - <AUTHOR> http://www.theatlantic.com/technology/archive/2015/09/facebooks-new-patent-and-digital-redlining/407287/?single_page=true <comment><USER2> There are MANY legal questions like the ones raised here. [http://www.dbms2.com/2010/07/04/fair-data- use/](http://www.dbms2.com/2010/07/04/fair-data-use/) catalogs some of them.</comment>


White House crafting legislation to give DHS more control over the internet. - <AUTHOR> http://federalnewsradio.com/index.php?nid=35&sid=2345684

<comment><USER2> The article seems to say that the only extra control is over governmental "cybersecurity", whatever that is.

Still, this seems like a mistake, given DHS' love of rules and procedures, coupled with its inability to perform any process more elaborate than closing a door. Perhaps DHS own "Blogger Bob" could explain this move in a way that won't draw any reports of simple logical errors.

<comment><AUTHOR> I think Blogger Bob is the TSA? But the DHS is the ones that were behind the seizure of "torrent" domains, without any kind of court ruling or trial.

I wish we had access to the proposed legislation.

I find the idea of the white house writing secret legislation to be very troubling.</comment></comment>


A Cheap Spying Tool With a High Creepy Factor - <AUTHOR> http://bits.blogs.nytimes.com/2013/08/02/a-cheap-spying-tool-with-a-high-creepy-factor/?ref=technology

<comment><USER2> The fact that your targets need to be connected on the same wifi makes this tool itself not as 'powerful' as this article makes it (it's not much different than Wifi Pineapple). You can probably build an even cheaper one with an old Android phone off ebay for $20.</comment>


Fast vector graphics word art with HTML canvas - <AUTHOR> http://www.paulsawaya.com/js/jsfont/

<comment><USER2> It works in Opera. Very nicely. A bit of stuttering but overall a great presentation.

I think really what you have here Paul is an illustration of why javascript is the future, more than flash, more than silverlight. As browsers get faster and engines get faster, the web will move more toward js than anything else. It's a standard technology.

Very nice work.

<comment><AUTHOR> Thanks!

I agree with you. Even though I'm also a flash developer, I'm looking forward to the day when I can get that level of performance out of javascript, and abandon proprietary plugins entirely.

</comment></comment><comment><USER3> So that's what you've been working on? Nice work! 面白い。

<comment><AUTHOR> Thanks Josh! =)

</comment></comment><comment><USER4> Looks awesome! I had no idea canvas had progressed so far already. You should come by on friday!

</comment><comment><USER5> I guess it doesn't work in the latest nightly of WebKit?

<comment><AUTHOR> Huh, sorry. It's something I threw together in a night, and only was tested in Firefox.</comment></comment>


New Tools for OCF Discovery and Device Onboarding - <AUTHOR> https://www.neustar.biz/blog/neustar-iot-releases-new-tools-for-ocf-discovery-and-device-onboarding <comment><AUTHOR> OCF is Interesting, I was at CES and there were so many stupid one off consumer IoT platforms there and then the OCF had a huge area and some cool demos showing some cool interoperability with a wide range of devices using a unified data model and api.

[https://openconnectivity.org/resources/specifications](https://openconnectivity.org/resources/specifications)

</comment><comment><USER2> OCF is meeting this week in Las Vegas to hammer out some more security ambiguities. But it's looking better and better.</comment>


Does Fiction Need to Become Less Fictional? - <AUTHOR> http://www.newsweek.com/does-fiction-need-become-less-fictional-301766 <comment><USER2> I'd like the movies (and tv) become less fictional. I'm actually a fan of sci fi, BUT:

I can't stand vampires, ghosts and family. I don't like hyperspace drivers, wormholes, drive-by time travels, light sabers, spells, fate architectures, prophecies, ones, ancient and powerful beings, much more complex DNAs, 10% brain usage overflow, sound in space and losing the orbit just because the engine doesn't work.

I don't like superheros that don't obbey basic physics laws and which powers come from some ridiculous explanation.

So yes, it seems I'm a "hard" sci fi fan and would love to se a movie or, better, a series that try to simply show 2065 as we really think it will be. Of course we'll be wrong anyway, but alas.

Space minery, first colonies, gravitational dimorphism, migration politics, robots... there are plenty of current tech that will be veeery interesting in 50 years.

Instead studios keep on showing year 3000 with societies almost identical to present or, much worse, past.

</comment><comment><USER3> > Did another bookstore just close? Did you read the latest report on > Americans' reading habits? To the laptops!

followed immediately by this inline ad:

> Try Newsweek for only $1.25 per week

… deliberate or accidental irony?

</comment><comment><USER4> Do literary critics feel like they have nothing to do...?

That's the only sane conclusion I seem able to come to from the article.

</comment><comment><USER5> Betteridge's Law of Headlines holds up once again. The answer is emphatically "no".

</comment><comment><USER6> Bah.</comment>


Gnome 3 bug - <AUTHOR>

Do you have Gnome 3 ? Open a terminal and type: (Do it only if you really want to) 1) su - //enter pass// 2) gedit Now hit the "supper" button, or move the pointer on the top left corner "Activities"<p>Did it crashed? NOTE: This crash takes place not only with gedit but also with nautilus etc. <comment><USER2> Consider filing Gnome bugs at <https://bugzilla.gnome.org/>, not on HN.</comment>


Modified human crania provide evidence for a new form of Neolithic skull cult - <AUTHOR> http://advances.sciencemag.org/content/3/6/e1700564.full <comment><USER2> Very interesting subject, similar to how researchers say the Egyptians elongated their skulls. Also, Neolithic Skull Cult sounds like a great band name

<comment><USER3> Not really. They just drilled holes (presumably after death) to hang them, like Christmas ornaments. Or maybe they were percussion instruments.

</comment></comment><comment><USER4> Oh no ... here come the ancient-astronaut conspiracy theorists.

</comment><comment><AUTHOR> In case the linked article is behind a paywall for some, there's a shorter write up in the Guardian:

[https://www.theguardian.com/science/2017/jun/28/turkish- site...](https://www.theguardian.com/science/2017/jun/28/turkish-site- evidence-of-neolithic-skull-cult-gobekli-tepe)

<comment><USER5> This is HN, link to the actual paper [http://advances.sciencemag.org/content/3/6/e1700564.full](http://advances.sciencemag.org/content/3/6/e1700564.full) and to the researchers own site [https://tepetelegrams.wordpress.com/](https://tepetelegrams.wordpress.com/) There is ZERO reason to link to some site regurgitating a press release, even if it is the Guardian.

</comment></comment><comment><USER6> If we create a modern skull cult involving Elon Musk's neural lace, how will future archaeologists refer to it? An Anthropocenic skull cult?

<comment><USER7> These are posthumously modified ornamental skulls, carved and painted after death maybe for funerary purposes, not skulls re-shaped during infancy, for weirdo flattened head shapes among the living.

<comment><USER6> Thanks for clarifying!

My question still stands, even though people consider it offtopic.</comment></comment></comment>


WordPress The Latest Tech Company To Come Out Strongly Against SOPA/PIPA - <AUTHOR> http://www.techdirt.com/articles/20120110/17470317370/wordpress-latest-tech-company-to-come-out-strongly-against-sopapipa.shtml <comment><USER2> Why haven't tech companies started lobbying? Don't companies such as Google, Facebook, Apple, Microsoft,Amazon generate cumulatively more profit than any other industry in the US?

Why not just overpower, the SOPA lobbyist in Washington? Couldn't they also just buy one of these movie studios and take them out. Allot of these companies are sitting on a ton of cash.

I am generally curious as to why tech companies have not done this.

<comment><USER3> The SOPA supporters are just bigger

<http://venturebeat.com/2011/12/19/sopa-lobbying/>

<comment><USER2> For once it would be awesome if a few tech companies pulled their funds and bought a company like comcast. Or even tried to make a bid for viacom. You don't need to buy them all but, it would wake up allot of other companies.

However,I feel the homegrown voice your opinion to the SOPA companies and politicians is great too. Allot of SOPA supporters have abandoned their support because of it.

But,I feel tech companies should really flex their muscle for once.

</comment></comment></comment><comment> mkr-hn Is this the position of the WordPress community, the WordPress Foundation, or Automattic?

<comment><USER4> It is quite confusing since the .org devs are employees of Automattic, the Anti SOPA blog post is on wordpress.org ( by Jane Wells) YET the main register/referrer for wordpress.com is godaddy.

So you have .org with an anti-godaddy link and .com with a pro godaddy link...

ps. I understand godaddy eventually caved into a press release..but comon.

<comment><USER5> Some core developers, including me, as well as the vast majority of core contributors, are not employees of Automattic.

To reply to your PS: Something tells me that if WordPress.com uses GoDaddy, they have a bit of leverage there.

</comment></comment></comment><comment><USER6> I feel that whoever is going to present this list of companies coming out against SOPA, should also talk a little about what each of them represents. Just saying something like "Wordpress" or "Reddit" at the Congressional hearing, probably means nothing to most politicians there.

<comment><USER7> That's very true. It makes you wonder what internet entity (other than designated supervillain/punching bag Google) these politicians are aware of?

"It says here that Wordpress hosts 70 million blogs worldwide, which I find hard to believe. If Wordpress is this big, I'd have heard of it. And this Reddit? It's what... some sort of alien game thing?"

So quick to legislate something they profoundly (and proudly) misunderstand.

</comment></comment><comment><USER8> s/Tech Company/Open Source Project/

</comment><comment><USER9> I'm surprised it took Wordpress so long, as I imagine they would/will suffer dearly under SOPA</comment>


The Scientist - bringing scientific news on the go to your iPhone - <AUTHOR> https://itunes.apple.com/us/app/the-scientist/id657192313?l=en&mt=8 Hi guys,
We developed an app for the iPhone (we named it "The Scientist"). Our aim was to create a crowdsourced scientific news reader, a daily reference of the science world, providing the best reading experience possible. The app continuously presents to users the most shared articles in a simple and accessible way to anyone that wants to be informed about the latest discoveries in the science world.
It's free to download on the app store - https://itunes.apple.com/us/app/the-scientist/id657192313?l=en&mt=8
We would love some feedback from you please, that would allow us to improve the app further in future releases. <comment><AUTHOR> Hi guys,

We developed an app for the iPhone (we named it "The Scientist"). Our aim was to create a crowdsourced scientific news reader, a daily reference of the science world, providing the best reading experience possible. The app continuously presents to users the most shared articles in a simple and accessible way to anyone that wants to be informed about the latest discoveries in the science world.

It's free to download on the app store - [https://itunes.apple.com/us/app/the- scientist/id657192313?l=...](https://itunes.apple.com/us/app/the- scientist/id657192313?l=en&mt=8)

We would love some feedback from you please, that would allow us to improve the app further in future releases.

Thanks!</comment>


If you care about user privacy, don't use Facebook JavaScript SDK - <AUTHOR> https://simplelogin.io/blog/do-not-use-facebook-sdk/ <comment><USER2> I thought this was more commonly known... In terms of understanding browser history, The Facebook like button and Google's ad pixels and Chrome web browser are perhaps the biggest offenders. I'd argue that they were specifically created for the express purpose of collecting more user information - for better ad targeting and whatever else

</comment><comment><USER3> Original article from Dev.to: [https://dev.to/simplelogin/if-you-care-about- user-privacy-do...](https://dev.to/simplelogin/if-you-care-about-user-privacy- do-not-use-facebook-js-sdk-1j3e)

I've recently implemented authentication for my project and I would just like to say to all the relatively amateur programmers out there: for web based authentication just stick with HTTPOnly SECURE cookies with DB backed sessions that you can revoke.

The reason I'm saying this is that there's way too many posts talking about JWT (which isn't suitable for newbies), Oauth (which is more useful if you have separate authentication and resource servers) and other token based mechanisms which are what cookies are except more suitable for non web based clients.

<comment><USER4> I don't think that storing creds is suitable for newbies either. All authentication is complex and just using HTTPOnly and DB backend is not a solution at all.

<comment><USER3> Depends on what the project is and also doesn't change the fact that this doesn't happen.

Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. When they do become somewhat popular though (very small minority of course), I suspect most founders bring experts on board, as they absolutely should.

> just using HTTPOnly and DB backend is not a solution at all

My comment was not meant to be exhaustive and does not list all vulnerabilities. Just in context of some of the suggestions in the article. Using a mature framework like Django can protect you from other vulnerabilities CSRF, XSS, SQL Injection to some extent.

<comment><USER5> >Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them.

Strong contender for Most Horrifying Thing I've Read This Morning.

<comment><USER6> It's good practice to consider the likelihood of attack in your threat model if you care about the expected payoff associated with your security efforts.

<comment><USER7> When that threat model necessarily includes bored script kiddies and automated APTs?

</comment></comment></comment></comment></comment></comment><comment><USER8> > If you care about user privacy, don't use Facebook.

Fixed that for you...

<comment><USER9> I was going to say the same thing, only in the form of "Duh". Also in the news today, the sky is blue, grass is green, and fire is hot. How in 2019 would any developer believe that any social platform cares about privacy is beyond me. If a social platform is offering anything (the platform itself, SDKs, APIs, etc) for free, then they are going to make money from you some other way. What ever they are offering cost them money to develop, but they did not do that as a charity. This maybe a bit preaching to the choir, but that's how you get the choir to sing. Plus, maybe someone new reads this.

<comment><USER10> Indeed obvious to some but necessary to hammer until everyone gets it — especially the business types who make decisions, as new devs themselves would quickly grow to learn this.

> What ever they are offering cost them money to develop, but they did not do > that as a charity.

True! Yet... I keep thinking about `http` (the protocol), or Apache, IRC, and countless other software techs that were just 'given' to (and are maintained by) the world, courtesy of their makers, and/or bodies like IETF work groups, etc.

Case in point: "social" is basic at an elementary level (it's just CRUD, over- the-network), but at scale becomes insanely costly. The limitation/exclusivity factor thus doesn't seem to be software magic but rather infrastructure, piles of money, before sustainability or profitability come into play. This is what the monopolies stem from, only compounded by some Meltcafe/"network" effect (friction to switch, passive positive peer pressure inwards, passive negative outwards).

So in thinking of an alternative future path for social tools (SDK) and meta- tools (platforms, interop, work groups, etc), I think it's worth considering the infrastructure problem first. My money is on distributed and (partially but 'enough') decentralized systems (think bittorrent, tor, even DNS fundamentally), but regardless it belongs to the wider category of mutualization of resources (cloud vs on-prems debate, E2E crypt, etc). The solution _must_ be preferable in terms of cost otherwise it's just not gonna happen.

<comment><USER9> > True! Yet... I keep thinking about `http` (the protocol), or Apache, IRC, > and countless other software techs that were just 'given' to (and are > maintained by) the world, courtesy of their makers, and/or bodies like IETF > work groups, etc.

The difference here is that the social platforms have been developed as a for profit company. Granted, FB has improved some of their underlying technologies, and released them back to the public in the way open source is meant. I do give them credit for that. However, the SDKs and APIs etc are direct work made by the platform. These tools are made specifically for interacting with that platform. They have every right to monetize that work. While some of us (at least I do) believe their method of making that money is super shady/unethical/etc, it is their business model. Other companies like Apache, Redhat, etc also offer us free things to use/play with while monetizing their enterprise/support services. A much more ethical method in my opinion.

<comment><USER10> You're totally right. I agree, and wasn't disputing these facts indeed. Just thinking out loud I guess...

> Other companies like Apache, Redhat, etc also offer us free things to > use/play with while monetizing their enterprise/support services. A much > more ethical method in my opinion.

Totally, this general business model can get as close as it gets to _sustainable_ open-source. It seems hard to pull off though, lots of dead startups and projects out there, despite a few resounding successes.

</comment></comment></comment></comment></comment><comment><USER11> The last two words of the title seem rather superfluous.

<comment><AUTHOR> Sometimes you don't really have a choice if all your friends and family use Facebook...

<comment><USER12> No. Really. You _do_ have a choice. Exercising unpopular choices frequently requires a spine.

<comment><USER13> Individually, you have a choice. But not using e.g. WhatsApp needs to be a collective decision or it won't work because everybody else is still stuck in there.

<comment><USER12> There is no such thing as a "collective decision". There is only the decision of each person. Any movement to quit these sickness-inducing manipulators has to start somewhere otherwise you end up like those Buddhists who won't enter Nirvana until all other creatures are also ready to enter Nirvana, so they all end up hanging about outside the gates (as it were...), forever waiting.

The decision to be the first,... to lead,... to tread without trepidation where others fear to go,... that's what I called _growing a spine_. "Won't work because everybody else is still stuck in there" is simply an expression of that fear.

<comment><USER13> Let's say you run your own mail server. How much privacy do you really gain if 99% of the mail that comes in and goes out passes through Google servers? It doesn't matter what you do by yourself. You just can't expect everybody to run their own mail server. I run my own mail server, and while I'm happy to be self-reliant, it's hardly a win for my privacy (also, mail server administration is a pita).

Same goes for every other communication tech. Just because your endpoint is not spied upon, if every other endpoint is spied upon you gain nothing. If you don't use WhatsApp, but all your friends use WhatsApp to talk about you then you gained nothing.

If you really believe there is no such thing as collective decision-making then imho you already gave up in the fight for privacy.

But even if we boycot Google and Facebook, they are not the main problem. Their business model is the main problem. Spying on your users, training predictive models, and using those models to exploit people is simply too profitable, and therefore too attractive for any profit-seeking company to ignore.

Until we solve that problem by deciding as a society that these business models are not ok, this 1984-like world we currently live in will be our reality.

</comment></comment></comment></comment></comment></comment><comment><USER14> Why would any developer or engineer who has even an iota of consideration for privacy, web standards, and, indeed, humanity want to work for such a repugnant company as Facebook?

<comment><USER15> Because a lot of people aren't privileged enough to be able to quit their job on the spot.

<comment><USER16> OP never said anything about quitting on the spot. The question was why would one go to work for such a company knowing, as one must these days, how vile that company is. Another facet to the question is why wouldn't one look for and take another job after they realize how disgusting a company like Facebook is?

<comment><USER15> Probably makes them more money I gues.

I wouldn't personally – I'm about as anti-Facebook as it gets, but a lot of people (especially people not coming from a "tech" background) don't really appreciate the kind of shit Facebook pulls.

</comment></comment></comment></comment><comment><USER17> That brings up the question : does Facebook get any less information because you used a 3rd party OAuth library to authenticate from FB, instead of using FB's own SDK which injects an iframe?

<comment><USER18> The point of the article was that Facebook gets information on not only those who are using Facebook to login, but those who aren't, because the "Login with Facebook" button is an iframe when using the SDK.

OAuth does not have this issue.

If you choose to login with Facebook, it is implicit that Facebook receives information.

</comment></comment><comment><USER19> Article author and SimpleLogin creator here. Surprised and happy that my small rant at Facebook got so much attention from HN!

I wanted to give a bit of context on this article, the story is a bit long though and there was no TLDR.

Here it goes: I wanted to protect my online privacy and having worked in advertising before, I know that user email, in addition to the cookie, is usually the common denominator to cross-reference user data. I tried, therefore, to generate a random email whenever I signed up on a new website via temporary email services like temp-mail but there are 3 issues: a. I can't remember which email I used. This problem is alleviated with password manager though. b. No way to reset password later as the email is already expired. This is also not fair if the website happens to be a good (aka not spammy) one and just want to contact me. c. The flow is unbearable: I need to go to temp- mail, generate a random email, go back to the website, check temp-mail for the activation email, etc.

I dreamt to have a universal login button, like the "Login with Facebook/Google" one but without all the tracking and that can generate a random email at runtime. So SimpleLogin was born.

When creating SimpleLogin SDK, I tried to reverse-engineer popular SDKs like Facebook and Google to learn from them and discovered their not-very-ethical approaches. I haven't found any article talking about these practices so I decided to write one up.

Voilà.

I want to be as transparent as possible about the technology I'm using so if anyone has any questions, please feel free!

</comment><comment><USER20> Tangentially related: is there any reason to be suspicious of/careful with react/redux? We've been using it internally for front end stuff, would be nice to know if there's any weird default tracking going on, however unlikely...

<comment><USER21> I don't think so. If you serve the library yourself (don't use an external CDN to load it) there shouldn't be any connections to 3rd parties, at least I've never seen one in the 'network' tab of my browser's dev tools.

Also, I want to believe that, being open source, people would already discovered something fishy.

</comment></comment><comment><USER22> The moral of the story is that any time your page requests resources or javascript from a third-party source, you are handing over some information about your users to that third-party.

Did you get your user's consent to do that? Probably not.

</comment><comment><USER23> I've always tried to get rid of it in the native apps I built in favor of the web based login. It's absurdly big in terms of added download size for a login screen and usually used once. Even with the native SDK it's still a jarring experience in most apps and if you pre-cache the screen it's about as instant as the native implementation. And you app starts don't get tracked every time.

</comment><comment><USER24> Heise offers a privacy friendly alternative (German) called socialshareprivacy :

[https://www.heise.de/extras/socialshareprivacy/](https://www.heise.de/extras/socialshareprivacy/)

</comment><comment><USER25> Never used it. As much as i don't like user account as a concept, and don't like implementing it either, implementation of any Oauth, Facebook login or any other is just nightmare. No users no problem i guess :)

</comment><comment><USER26> Alternatively, only use SDK in login page, and keep the login page separate, or use a click even to load it. And after login is done, you no longer need to load the SDK ever again.

</comment><comment><USER27> If you care about user privacy, don't use <any> Facebook SDK.

</comment><comment><USER28> Who cares what _I_ care about, the real question is what do my users care about.

It all depends on what users will tolerate in the name of convenience.

<comment><USER29> As pointed out in the article, not using the SDK does not preclude authenticating with a Facebook account. It just requires a bit more work on your end to protect your non-Facebook users.

So it _does_ come down to what you care about.

<comment><USER28> "Don't use" and "only use for people who actively opt-in" are two separate things, so _no it doesn 't_ come down to what you care about.

I'm saying give people choice, let _them_ figure out what they care about. Making the choice for them is bad business and bad ethics. You don't know better than your users.

<comment><USER29> Non-Facebook users are unable to opt out of Facebook tracking if you use the Facebook sdk. That's the point of using the oauth standard, it allows those users a choice not available with the sdk.

<comment><USER28> You can choose to load the SDK or not, e.g. only when the "Log In With Facebook" button is pushed.

<comment><USER29> A little bit of research indicates that this is still a non-trivial amount of work from the developer; that the developer has to _make the choice_ to protect the privacy of their non-Facebook users by dynamically loading the Facebook SDK.</comment></comment></comment></comment></comment></comment>


Best 404 ever (warning! Sound) - <AUTHOR> http://fruit.gs/404.html

<comment><USER2> It may be the best 404 but the 503 isn't so nice :). I'll check back later.

<comment><USER3> A poster child for irony. The 404 is so popular, you get a 503.

</comment></comment><comment><USER4> I've always been partial to <http://www.plinko.net/board>

"Quoth the server, 404".

<comment><USER5> Not sure if it's where they got it from, but I have seen it as part of a larger poem on bash.org.

</comment></comment><comment><USER6> I like this one by Nosh: <http://www.nosh.com/404>

</comment><comment><USER7> Because it's not enough that you can't give the user the page they asked for, you have to disturb the quiet in the office without warning as well.

(Please, add to the title that there's sound.)

<comment><USER6> "disturb the quiet in the office"

Oh you mean you were secretly browsing at the office? ;-) You know, in almost all cases the 404 page fits the website you're browsing.

<comment><USER7> <http://xkcd.com/303/>

</comment></comment></comment><comment><USER8> THCNET's is still my favorite:

<http://thcnet.net/error/index.php>

</comment><comment><USER9> Dropbox is still my favourite: <http://dropbox.com/404.html>

</comment><comment><USER10> i like this one <http://www.mindomo.com/404></comment>


Developer only event at SXSW (code puzzle gets harder with more tweets) - <AUTHOR> http://hackerunderground.com

<comment><USER2>
       $data = "http://hackerunderground.com/solution/blank;
       $ch = curl_init($data);
       curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
       $base = curl_exec($ch);

       for($i=0;$i<10000;$i++)
       {
       $data = "http://hackerunderground.com/solution/$i;
       $ch = curl_init($data);
       curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
       $response = curl_exec($ch);
       if($response != $base)
       {
       echo $i;
       }
       }

I like my solution best. Everyone should try it!

<comment><USER3> I like how it keeps going even after it finds the solution.

<comment><USER2> Haha my bad.

</comment></comment></comment><comment><USER4> I'm also throwing a hacker only event.

It's called stay home and get shit done.

<comment><USER5> Two years ago such a comment would have -2 votes and would be hidden just because of its tone.

Sorry for the meta, but I am missing the old HN.

I doubt we would be able to have the whole front page dedicated just to Erlang news if the need appeared.

It seems that the problem of maintaining quality of discussion in an open forum remains unsolved.

Maybe limits to entry (like the problem in the link) or ability to provide negative feedback to posters would help.

<comment><USER6> How would a comment pining for the days of yore have fared two years ago?

<comment><USER5> Even worse.

</comment></comment></comment></comment><comment><USER7> So just to summarize:

Elite 'hacker' group claims to hate marketing guru/bullshit tactics, then proceeds to ply the hell out of everyone to spread their concept in a viral Twitter hashtag manner.

Granted, I totally just did it because that puzzle was way too easy, but c'mon now.

<comment><USER8> In that sense, at least, the event is being held by people who understand the hack mindset. I noticed that the puzzle was very easy, and that the "elite hackers" are in fact a recruitment agency, and therefore that the main purpose of the event is probably for a recruitment agency to put their recruiters in the middle of a bunch of hackers while eliminating competing recruiters who have the same goal.

... but I still did the puzzle.

[edit] And everyone else is doing it too, and posting their solutions here! "Blazing guitarpocalypse"[1] indeed.

I might attend the event, but that's mostly because I'm in Austin and feeling curious, and not because the website convinces me the event will have a high quality.

[1][http://www.codinghorror.com/blog/2007/02/fizzbuzz-the- progra...](http://www.codinghorror.com/blog/2007/02/fizzbuzz-the-programmers- stairway-to-heaven.html)

</comment></comment><comment><USER9> I wonder if having to manually launch the puzzles show() method is part of the puzzle itself or just a bug. (Checked with Chrome 9 and Firefox 3).

<comment><USER10> Looks like pressing ESC invokes the puzzle.

<comment><USER11> It has a keypress event tied to it, but it didn't trigger for me. I had to manually invoke $('the_puzzle').show().

</comment></comment></comment><comment><USER12> The ways everyone solves the puzzle are much more interesting than the puzzle itself. I made a mysql table with one column set as the primary key and did an insert.

This reminds me of this awesome thread on Sitepoint (5 pages of different ways to output the numbers 0-9): [http://www.sitepoint.com/forums/php-34/write- loop-php-prints...](http://www.sitepoint.com/forums/php-34/write-loop-php- prints-numbers-0-9-page-580793.html)

</comment><comment><USER13> Well now they are asking for Prime duplicates, and if they keep it going fo the next week, you could end up with some complex puzzles.

</comment><comment><USER14> Not going to SXSW, but...

         tr ',' '\n' | sort -n | uniq -d

<comment><USER15> It's also pretty easy to do in Excel, favored tool of "marketing gurus". Find/replace, import, pivot.

<comment><USER16> I actually found a solution for it in excel before writing the following:

      asort($data);
      $duplicate = function ($val) use (&$data) {
        $count = 0;
        foreach ($data as $i => $entry)
          if ($val == $entry) $count++;
        return $count;
      };

      foreach ($data as $v)
        if (($count = $duplicate($v)) > 1) {
          printf("%d, Count %d\n", $v, $count);
          break;
        }

I assume it would be possible to use a sort+callback to return the value as well.

<comment><USER17> sort + callback is what I did in JavaScript:

        .sort(function(a,b){if(a==b){throw a;}return a-b;});

<comment><USER16> Did you eval the dom to get the dataset?

<comment><USER18> I did :)

      JSON.parse(p.innerHTML.split('\n')[2])

</comment></comment></comment></comment></comment></comment><comment><USER19> Text editor, break into lines, numeric sort, find the line where the count goes out of sync with the line number.

</comment><comment><USER20> C#: data.GroupBy(i => i).Where(g => g.Count() > 1) .Select(g => g.Key) .ToList().ForEach(x => Console.WriteLine(x));

</comment><comment><USER21> node.js + underscore.js

var numbers = [];

require("./underscore-min.js"); var dupe = _.reject(numbers, function(number) { return _.lastIndexOf(numbers, number) == _.indexOf(numbers, number); }); console.log(dupe);

</comment><comment><USER22> solved it with no code by copying and opening as csv, transpose paste, sort, scroll to match column number with number, check for mismatch, bingo!

</comment><comment><USER23> I'm learning Python (3) w/ MIT OCW and here's my solution (<http://pastebin.com/EQevWQWC>). def dupefinder(lister): '''Function to find first duplicate in a list; Variable to pass to this function should be of type "list" ''' listerdupe = sorted(lister) for index,item in enumerate(listerdupe): if item == listerdupe[index+1]: print('First duplicate number is {0}'.format(item)) return item

</comment><comment><USER24> Open Matlab --> answer = mode(Copy --> Paste)

</comment><comment><USER25> Open up web inspector.

var arr = (paste)

arr.sort()

for(var i = 0;i<arr.length;i++){if(arr[i+1] == arr[i]){console.log(arr[i])}}

<comment><USER26> Or the recursive version, upon sorting:

      function find_dupe(a){ if(a.length==0) return -1;
      if (a[0]==a[1]) return a[0]; else return find_dupe(a.slice(1,a.length)); }

BTW, are loops more efficient than recursion in JS? It sure seems like a lot of JS libraries out there including jQuery avoid recursion like plague.

<comment><USER25> For recursion vs. looping, it really depends on what you're doing. In my js experience though, most of the time looping is either faster or equal to recursion, while being significantly easier to understand at a quick glance.

In this case, the loop will outperform recursion because of all of the slice calls in the recursive version.

</comment></comment></comment><comment><USER27> Since they changed the puzzle to now require finding the prime duplicate number.

Is is each number delimited by a (random?) alphabetic letter? Is this to make parsing into Excel/an array harder?

Also, even the new 'harder' puzzle is easy to solve in Excel. Maybe that isn't a bad thing, however.

</comment><comment><USER28> Solved the puzzle with a couple lines of Python ;) Unfortunately, I won't be attending SXSW this year. Boo. If someone can solve that puzzle, I'll teach you all the hacks I know.

</comment><comment><USER29> What day is the event?

<comment><USER30> You need to solve the puzzle or are you joking?

</comment></comment><comment><USER31> the lemons of this string when you take out all of the spaces and align the words end to end and prefix it with the word win</comment>


YAML: Probably not so great after all (2019) - <AUTHOR> https://www.arp242.net/yaml-config.html <comment><USER3> Earlier discussions:

[https://news.ycombinator.com/item?id=17358103](https://news.ycombinator.com/item?id=17358103)

[https://news.ycombinator.com/item?id=20731160](https://news.ycombinator.com/item?id=20731160)

</comment><comment><USER4> One of my favorite bugs of all time, which turns out to be a pretty common yaml bug (the article touches on a similar example), was when we used yaml to configure some localizable data. Everything worked fine until Norway came online. Sweden worked fine, so did Denmark and every other country, but the app crashed when it loaded the config for Norway.

Turns out the country code for Norway, "no", is interpreted as boolean false when unquoted in yaml.

<comment><USER5> But it is because you do not use a yaml serializer.

If you use a template you have to put "" for strings.

<comment><USER6> If your human-writable format requires a serializer to avoid unexpected types, it's not human-writable. If your human-readable format requires special cases for certain keywords but treats others as strings, it's not human-readable.

<comment> yjftsjthsd-h > If your human-writable format requires a serializer to avoid unexpected > types, it's not human-writable.

That sounds like there are no human-writable formats.

> If your human-readable format requires special cases for certain keywords > but treats others as strings, it's not human-readable.

 _That_ I can 100% support; _sometimes_ needing to quote strings is a recipe for disaster.

<comment><USER6> > That sounds like there are no human-writable formats.

I'm not sure why it sounds that way. There are formats where types are explicit, either by stating them or by their delimiters or by their contents.

</comment></comment></comment></comment></comment><comment><USER7> I've never understood the love for significant whitespace. I see where the idea came from - "No more missing semicolon errors! Woohoo!" \- but it should've been clear after trying out the idea for five minutes that it was not at all worth it. It constantly causes trouble and all just to save a couple of keystrokes.

Though: now that I think about it, most of the problems happen at the block level, not the line level. So maybe significant newlines are fine but not indentation.

<comment><USER8> Maybe after trying it out for five minutes you make up your mind - but mine was decidedly for it

<comment><USER9> Always liked the idea of whitespace-only indenting but always suspicious of it. Problems I've found are that automatically generated code can't just be dumped in with { and } around it.

A colleague spent a few hours tracking down a python bug caused by a bad merge that messed up the indent without it outright causing the code to crash, just produce wrong output. That's IMO too expensive a bug type to permit just to save a few keystrokes. But YMMV as they say.

<comment><USER10> It is a great deal, millions of keystrokes and code reading impediments avoided over _decades_ vs. one exception a colleague of someone on a discussion board had once.

That's a 1000x advantage in my book. Not mention exceptions are often avoided with a professional editor with whitespace highlighting and indentation guides.

<comment><USER11> > one exception a colleague of someone on a discussion board had once

You're not even trying to have a reasonable discussion about this, are you.

At least this guy has a datapoint. You just have a hunch that you can write code faster if it's formatted slightly differently. I don't think it's true -- I don't think typing semicolons and curly braces slows down my coding enough to warrant omitting them. Most of my time coding is spent thinking and reading, probably less than 15% of my time is spent typing. So if I only type semicolons and commas 5% of that time, that means I'm saving 0.75% of my time by not typing them, which is about 14 hours a year if I work 40 hour weeks.

I've definitely debugged a yaml error or two due solely to formatting in the past year, which probably cost me at least 4 hours of productivity. If my entire codebase was formatted solely by indents and returns, I imagine that number would balloon significantly, which is why I opt to use semicolons and other formatting characters.

Also, they're not "reading impediments," at least not universally. Being able to use my code-editor to jump to the end of a code block (by matching a { or }) has been immensely useful in my experience.

<comment><USER10> The detriment to readability of punctuation chars is documented. I write code all day in .py and .js and it is obvious which is easier to read. I won't bother to mention .pl.

If you need 4 hours to fix a yaml file, then what can I say? Perhaps you need better tools, or reduce tech debt.

<comment><USER11> > If you need 4 hours to fix a yaml file

Yes, recognizing a bug, investigating it, sourcing it to a yaml file, finding the offending line, fixing it and testing it, and getting the fix merged up probably took me a minimum of 2 hours, and I had to do it at least twice.

You just handwave away every argument that is brought against you, without actually thinking about what you're saying or if it's even true. You're the worst type of engineer.

<comment><USER10> Yeah, the worst type, who has never faced/complained about/belabored whitespace issues in over twenty years. Because they are shown trivially in any editor. As opposed to the hysterical type who needs hours to fix a text file.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Nearly every time I have to make any changes to a CI environment (or set one up for a new project), I end up with a stream of increasingly unintelligible and often increasingly grumpy commit notes. It's almost always because YAML, as a format, is confusing and frustrating to write.

Structured data with only vague, and often misleading, indication of its structure is awful to work with. Sure, it's "human readable", but if your data is of any real complexity you're almost certainly better off just machine- generating it.

<comment><USER12> It makes me grumpy. Even the self-ironic name "Yet ANOTHER mark-up lanuguage" is a set-up for disappointment.

My personal belief is that XML was "good-enough" having been engineered for many use-cases and easy to comprehend for what it provides.

It's a tragedy that XML was abused so vigorously in the early naughts. People got so sick of it because they were compelled to edit XML manually in a text- editor with shitty to none schema support. It didn't help that the worst monstrosities of that era (soap and ws-* crap) heavily invested in turgid, badly designed XML.

I think that if there had been some more effort on tooling and good-practices, XML could have remained popular and we would not have had jason, yaml, and whatever awful thing is next.

<comment><USER13> > XML could have remained popular and we would not have had jason

One of the selling points of json is file size, xml started dying when people realized that more than half their bandwidth was going to xml structure rather than actual data

<comment><USER14> Is the difference in size really significant? When the files are small it doesn't matter much, and when they are large you can throw some compression in the mix. I've never heard filesize as an argument for json before.

<comment><USER13> Imagine a table of numbers, the xml would be 90% repeated header names and structure. Now multiply that by hundreds of little Ajax requests, it added up.

</comment></comment></comment></comment></comment><comment><USER15> Heartily agree with this post.

One of the things I most dislike about yaml is that they persuaded JSON to remove comments from the spec for some psuedo compatability nonsense. Without comments, json is less useful for config files and working/documented examples.

I have written a pre-parser to permit comments in JSON and for nodejs apps I use javascript as config. Naturally where security is not a concern.

Yaml always seemed like a mess to me.

Liking Toml, decent compromise.

And linux style: name space value, hash and semi for comments. Unless I really need a heirachy.

<comment><USER16> > I have written a pre-parser to permit comments in JSON and for nodejs apps I > use javascript as config. Naturally where security is not a concern.

JSON5 allows comments and a few other niceties. I'd trust JSON5 parsers more than my own hand-rolled one

</comment></comment><comment><USER17> I find YAML distressingly hard to work with. Just one example- because it's white space delimited, copying and pasting a block of code will often blow up between docs based on nesting levels. This is intensely frustrating when the setting is tied to a CI pipeline that takes 5 minutes to get to the error.

The human unreadability if JSON is greatly exaggerated. While you can get horrible looking JSON, you can also then pretty print it into something much better. If we could just all agree to allow comments into a spec it'd be fine.

<comment><USER18> > This is intensely frustrating when the setting is tied to a CI pipeline that > takes 5 minutes to get to the error.

I also detest this, but it's not really about YAML - it's ridiculous that so many of our tools no longer allow any validation / linting of files before attempting to use them; some that do require the "full service" running to provide sufficient context; even those that don't don't always give good (i.e. consistent, structured) errors. This problem would remain if the format was JSON, TOML, or even XML when working without schemas for every namespace.

The worst is the tools that layer Jinja on top of the YAML (Salt/Ansible/Puppet) which is basically impossible to validate statically. At least with GitLab, Docker Compose, and Kubernetes I have some hope - <USER2> integration into other tools is awful.

<comment><USER16> CircleCI has a CLI, you can `circleci config validate` (or something like that) and it will check that what you wrote is valid YAML and that it's a valid CircleCI config (so syntaxical and semantic validation). Very useful, one of the many thing that make me prefer Circle over the other solutions I tried (Travis, Jenkins and a couple other I forget)

</comment></comment></comment><comment><USER19> Since he opens by referring to a similar argument against JSON for human- editable configuration files, I wondered what format he did like for that. Answer at the end appears to be TOML, if you must have one at all.

> Don't get me wrong, it's not like YAML is absolutely terrible – it's > probably better than using JSON – but it's not exactly great either. There > are some drawbacks and surprises that are not at all obvious at first, and > there are a number of better alternatives such as TOML and other more > specialized formats.

> One good alternative might be to just use commandline flags.

> If you must use YAML then I recommend you use StrictYAML, which removes some > (though not all) of the more hairy parts.

(I do agree YAML is in retrospect a mistake. The reasons why remind me in some ways of the problems with Markdown).

(Oddly, I can't seem to find an up to date TOML parser in ruby that supports the 1.0 spec...)

</comment><comment><USER20> Fun fact: YAML is a superset of JSON. That is, any JSON is also valid YAML.

YAML is a complex and unintuitive mess that allows doing every thing in a million ways. I'm surprised it ever got so much traction. TOML is a breath of fresh air next to it.

<comment><USER21> > Fun fact: YAML is a superset of JSON. That is, any JSON is also valid YAML.

That's false. [https://metacpan.org/pod/JSON::XS#JSON-and- YAML](https://metacpan.org/pod/JSON::XS#JSON-and-YAML)

</comment></comment><comment><USER22> Wait, what? It's built in to the format that it can execute arbitrary shell commands?

"Who approved this?!"

I can't imagine the cluster fuck of ideas in a person's head to lead to thinking that this was an ok design for a configuration file. The person who designed this and I just don't live on the same planet.

And here I thought the reason I didn't use YAML was because the syntax looked stupid.

<comment><USER23> No, it's built into the format that implementations can extend it with their own types. Then library authors decided it would be neat if _any_ object in their language could be serialized as yaml, and so extended it with types that happen to be able to execute arbitrary code, because that's what objects do in dynamic languages.

A more conservative implementation wouldn't have that particular vulnerability.

</comment></comment><comment><USER24> YAML allows escapes to executable code?

        !!python/object/apply:os.system
        args: ['ls /']

Who put that backdoor in?

<comment><USER21> That's a leading question.

Authors of some libraries did not consider the security implications of the object serialisation part of the spec. I assign the blame to them for not looking beyond their own limited horizon, metaphorically speaking. When they made their libraries, the reference implementation was already available and it was secure by default.

<comment><USER24> A "call arbitrary external program" feature does not get in there by accident.

<comment><USER21> It's not a "call arbitrary external program" feature, but an "object serialisation" feature that has security implications which some implementers did not handle correctly because of their language parochialism and lack of experience.

That does make it closer to an unfortunate (but entirely avoidable) accident rather than what you believe, that evil people maliciously and intentionally added a backdoor. You can keep believing it, but that does not make it any more true.

</comment></comment></comment></comment><comment><USER25> My biggest gripe with YAML is its meaningful whitespace.

Debugging nearly invisible indentation problems can be such a pain.

<comment><USER26> I'd argue that's the defining feature, though. That's one of the main reasons people use it over JSON.

<comment><USER27> It is not so much about indentation vs. brackets. For me the main reason over JSON is that YAML works without quoting the entries and the possibility of comments. And btw: every JSON file should be a valid YAML file in theory.

</comment></comment></comment><comment><USER28> When I first saw json, compared to XML, it was so simple. As a fairly new programmer I could say to myself "hey I can write a parser and dumper for this quite easily".

When I first saw YAML, it was nice but it felt a bit too complicated.

All I really want is Indented JSON. New lines instead of commas. That's it.

Json is fast to parse. See simdjson doing it at > 2.5GB/s. One can't do this with YAML where no could mean many things.

And god I hate k8s for their bajillion yaml configs. Thank god for jsonnet that can dump to yaml. Jsonnet is truly nice and makes working with json like configs a pleasure.

</comment><comment><USER29> I see a lot of criticism of YAML, and I've looked a few other minimal configuration languages like TOML as well.

Serious question: why doesn't this language space have a universally adopted candidate like SQL?

<comment><USER30> For a brief period, it did: XML

But everyone thought "that's too complex" and so reinvented something simpler. Then kept adding features, and more features, and now YAML is more complicated than XML.

This process will repeat ad infinitum.

<comment><USER31> Thankfully in Java and .NET land it is still mostly about XML.

It is so ironic to see these fads come and go, and then one wonders why we are so cinic regarding newcomers.

<comment><USER32> .net core uses json for config files

<comment><USER31> Still using .NET Core 1.x?

One can use the XML Configuration Provider just as well.

<comment><USER32> > Still using .NET Core 1.x?

We're on a mix of 2.2 and 3.1 where the default still is json or have i got this wrong?

<comment><USER31> Just because it is the default, it doesn't mean it cannot be changed.

I just thought that XmlConfigurationProvider wasn't in 1.x, as I avoided that crash train with multiple reboots how projects and .NET Standard was supposed to look like.

So I stand corrected regarding when it was introduced.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> It is so easy to complain about something, but seriously: what are the alternatives for human readable config files?

<comment><USER33> For a scripting language, how about the language itself?

<comment><USER34> Turing complete configuration is a no-no.

<comment><USER35> Why?

<comment><USER34> I want my configuration to be guaranteed to halt for one, I don't want my configuration to have the ability to open sockets, I don't want configuration to import business logic or 3rd party modules, etc.

</comment></comment></comment></comment></comment><comment><USER36> The specification of YAML is about three times as long as XML 1.0, but while XML includes a whole grammar-based validator with such niceties as referential integrity of IDs and default values for omitted parameters, YAML spends all this on syntactic sugar.

</comment><comment><USER37> YAML isnt my idea of clarity but thats fine. I tend to go with using a python script to generate a json file. This supports comments, if-else decision making, modules and all sorts of other smarts. Tell users not to edit the resulting json file - its readonly.

Python gives you all the power of scripting including validation and json gives you the easily readable format for both humans and machines. Great for knowing exactly what the settings evaluated as.

And when you don't need the power of full expressive python script, you can just json.dump() a python dictionary and be done with it.

I've also used sqlite as a config file format and that is very polite and easily read from anything I use.

</comment><comment><USER38> [https://cuelang.org](https://cuelang.org) is a very nice alternative that has nice import/export support for yaml among others

</comment><comment><USER39> I have not seen anything that could come close to the robustness and flexibility XML has to offer. When being used for configuration XML seems to be the superior choice. People tend to give XML a bad name in RPC usage for being verbose. But, for config it's perfect for me.

There are tons of IDEs supporting XML (syntax highlight & collapsing brackets, etc...). XML schema is also great to ensure the config is conforming. I keep thinking we are trying to reinvent a worse wheel here.

</comment><comment><USER40> I just recently replaced a bunch of YAML in a project with JSON. At face value the YAML still _looks_ easier to grok, but I kept needing to periodically think about YAML<->JSON. At one point in the middle of yet again running JSON through a YAML conversion process to see how I would write something, it dawned on me that YAML wasn't saving making my life easier it was making it harder.

</comment><comment><USER41> The opening sentence is incorrect.

yaml.load is now a wrapper around yaml.safe_load that negates the risks he highlights

</comment><comment><USER5> YAML in kubernetes works very well.

If yaml is not working for you have to search a serializer format that fit in your project.

There is not silver bullet.

<comment><USER18> > If yaml is not working for you have to search a serializer format that fit > in your project.

If I need a serializer format, it's not human-readable/writable, and I might as well have something like XML or s-exp that are easier for many tools to work with, more easily composable, easier to generate automatically, etc.

> There is not silver bullet.

This phrase needs to be retired. It's true, but invoked far too often to excuse shit bullets.

<comment><USER42> Moreover, a silver bullet is meant to be especially effective in very specific scenarios, ie. shooting werewolves or vampires, whereas in colloquial usage 'silver bullet' refers to a thing that works well under all circumstances.

</comment></comment></comment><comment><USER10> Use strict yaml, solvable problems solved.</comment>


Cloudflare CEO: DDoS Attacks Will Now Be History - <AUTHOR> https://motherboard.vice.com/en_us/article/59dd5q/cloudflare-ceo-ddos-attacks-will-now-be-something-you-only-read-about-in-the-history-books <comment><USER2> Does anyone else notice a pattern of behavior with this guy? First he takes it upon himself to decide what websites get to exist, and now he says DDoS will die forever because HIS service offers mitigation. In other words, EVERYONE is going to join his network. Where he gets to decide who has internet access.

When you see people exhibit signs like this the best advice is often run away as fast as you can.

</comment><comment><AUTHOR> Original title: Cloudflare CEO: DDoS Attacks Will Now Be 'Something You Only Read About In The History Books'

I suggest title be changed to: Clodflare to offer free unlimited (unconditional?) DDoS protection

</comment><comment><USER3> never say never ;D it will end in tears!</comment>