What computer games do HNers play? - <AUTHOR>

When I feel tired of improving my app, I feel that a game of Defcon can refresh me. What games do other people on HN play, if you have any time for such things?<p>Also, anyone up for a game of global thermonuclear war? :) <comment><USER2> I play good old-fashioned one-player Japanese RPGs. I just can't get into stressful fast-paced calculations/button-mashing, or extremely complicated long-term planning of minute details (no offense to games that can be described as that, it's just not stress-relieving for me). I can handle Sim City and Starcraft though, I'm just afraid to start playing Starcraft 2 for fear of addiction.

<comment><USER3> FWIW: I played _Simcity_ for years. My sons sold me on _Master of Magic_ by emphasizing the city-building aspects of _Master of Magic_. I often choose Myrron (sp?) as a pick when setting up so I can focus on building my civilization for a long time before I have to actually fight some NPC (because if you are Myrron, you probably don't have any other mages nearby -- the odds are good they are all on Arcanus and won't get through a gate for quite a while). The game became a lot more fun for me after I began learning how to do good site selection for settling a new city.

I am also curious as to some of the names of the _good old-fashioned Japanese RPG's_ you play, if you don't mind. :-)

<comment><USER2> I'm so old-fashioned as to play Super Nintendo RPGs!

I've played all the famous and popular ones like Final Fantasy 3 & 6, Chrono Trigger, and Breath of Fire, etc, so for the past few years I've been discovering all the little-known hidden treasures, which there seems to be an endless supply of.

An English patch was just released for Lennus 2, which, along with its predecessor Paladin's Quest, pretty much take the cake for originality, creativity, and world design in an SNES RPG. So I'd have to strongly recommend both of those. I have to warn you that Paladin's Quest's graphics are not everyone's cup of tea, and some people hate the game. But Lennus 2 is a lot more polished. ("Paladin's Quest" is the official English release name for Lennus 1, but Lennus 2 never had an official US release, only the recent fan translation, which I hear is really good.)

I'd like to check out Master of Magic, but it looks like it's PC-only, and I use a Mac. : (

</comment></comment></comment><comment><USER4> Minecraft currently, I love the cooperative exploration and creation going on on our private server. Random Flash games (Kongregate etc). New games on my Android or iPhone Touch to keep an eye on where things are at.

In the past lots of games with editors / mod capability, starting with map making for Duke3D. That was a big part of getting me into programming.

</comment><comment><USER5> Two huge favourites of mine are Head Over Heals ( <http://en.wikipedia.org/wiki/Head_Over_Heels_(video_game)> ) and Batman ( <http://en.wikipedia.org/wiki/Batman_(1986_video_game)> ).

</comment><comment><USER6> World of Warcraft and tower defense games are my favorites. I spend more time playing games than I should, probably, but I also make games so it's not completely a waste -- it's research. At least that's what I tell myself! LOL

</comment><comment><USER7> I really don't play many computer games. I found information on the internet quite interesting to refresh me.

I used to play Sim City, but that was quite a long time ago.

</comment><comment><USER8> I tend to play backgammon online at <http://www.gamesgrid.com/>

Since my Xbox 360 RROD'd I don't generally get much gaming in. I play a lot on my iphone though as I get more opportunity. Dropzap is an awesome iPhone game and free if I remember correctly.

</comment><comment><USER9> Team Fortress 2.

</comment><comment><USER10> Starcraft 2 most of the weekends. Although haven't played it for some time. Any players around?

</comment><comment><USER11> <http://minecraft.net>

<comment><USER12> Use their sign up form as an example in what NOT to do.

I just spent 5 minutes trying to create a user, having to reenter a capcha each time I was informed of my username being taken, or unnamed length limits were imposed on me.

I ended up giving up.

<comment><USER13> > Use their sign up form as an example in what NOT to do.

Its revenue tells us otherwise.

<comment><USER12> Does it? If the form was better could their revenue be higher?

</comment></comment></comment></comment><comment><USER14> Team Fortress 2, Football Manager, SimCity 4

</comment><comment><USER15> Most of the games which left me a great impression were of a now-dwindling genre (adventure games). I personally hold The Longest Journey ( <http://en.wikipedia.org/wiki/The_Longest_Journey> ) as its apex.

</comment><comment><USER16> I usually prefer to hang out with friends for an hour or go out for a walk when tired.

May be because I'm not usually bored of working but tired of looking at the screen.

But it helps. You might wanna give it a shot.

</comment><comment><USER17> I've been spending a lot of time designing buildings in Sauerbraten recently.

</comment><comment><USER18> HTML 5 games ;) [http://www.casualgirlgamer.com/articles/entry/28/The- Best-30...](http://www.casualgirlgamer.com/articles/entry/28/The- Best-30-HTML-5-games/)

</comment><comment><USER19> Chess and checkers. I find it to be quite engaging and extremely satisfying to beat an opponent over the Internet on my GNU/Linux computational device.

</comment><comment><USER20> Sins of a Solar Empire, Mount and Blade, or an RPG - I loved the Neverwinter series, and I can't wait for Fable 3 to come out for PC....

</comment><comment><USER21> Nonograms ( <http://www.goobix.com/games/nonograms/> )

</comment><comment><USER22> Heroes of Newerth, Battlefield Bad Company

</comment><comment><USER3> I'm a (former?) big Simcity fan. More recently, my sons have introduced me to Master of Magic and Master of Orion 2. I've played Tiberiun Sun as well. I'm sure there are more games in my future.

</comment><comment><USER23> Civ V at the moment.

</comment><comment><USER24> Dwarf Fortress

</comment><comment><USER25> Call of duty

<comment><AUTHOR> Amazing game, makes me miss having an XBOX.

</comment></comment><comment><USER26> Wargames ("hacking" games). I like that they are much harder than normal games, and you learn a lot of useful stuff playing them.

Web based: <http://bright-shadows.net>

Console based: <http://www.smashthestack.org/>

</comment><comment><USER27> TF Classic

Everquest 2 Extended (EQ2 fremium version)

F1 2010

Burnout - original and best

Total War - all versions</comment>


[XKCD Flowchart] How to tell the year of a map, from it's features - <AUTHOR> http://xkcd.com/1688/large/ <comment><USER2> [http://explainxkcd.com/1688/](http://explainxkcd.com/1688/)

</comment><comment><USER3> s/it's/its</comment>


Look at yourself objectively - <AUTHOR> http://www.aaronsw.com/weblog/semmelweis <comment><USER2> Semmelweis is a favorite "management science" topic; there's even a pop-psych phenomenon called the "Semmelweis Reflex"; the Wikipedia article on it recapitulates much of what Aaron wrote here. The Gladwell formula of using Semmelweis' personal narrative to articulate a frailty of human reasoning was employed to great effect in Ayres _Super Crunchers_; the Semmelweis section is, for instance, noted prominently in the NYT book review.

Aaron has oversimplified the Semmelweis story in some material ways:

* Semmelweis didn't institute "handwashing" in Vienna hospitals. Contrary to the conventional wisdom, which suggests that doctors in the 1840s were sticking horse-manure-covered hands into the exposed wounds of patients, handwashing was apparently already a norm. What Semmelweis did differently was to use lime to wash hands.

* Semmelweis' actual theory of the cause of childbed fever was wrong, and it was wrong in ways that made his recommendations hard to take seriously. Semmelweis' contention was that "cadaveric particles" were making their way into patients, and that those particles could only be removed by lime. But doctors observed cases in which no contact with either cadavers or injected or symptomatic patients lead to the same cluster of illnesses. It was thus difficult for Semmelweis to make a "scientific" case for why the lime worked; it obviously didn't help that he was wrong about why it did (his work predates the germ theory of disease, which would have taught him that rather than lime being effective at removing specific particles, it was instead effective at killing bacteria).

* Aaron's story (and Ayre's) has a heroic Semmelweis pleading for doctors to simply wash their hands in a specific way to save lives. But that's not necessarily what Semmelweis was arguing. Instead, the case he could have been making, loudly, was for an actual, specific, _incorrect_ cause of childbed fever.

* Semmelweis himself was, apparently long before he lost his post, a notorious asshole. It did not help his cause that instead of carefully reasoning about the actual evidence, he instead seized on a single explanatory theory of childbed fever and then demanded (often by barging into hospital wards and berating the staff) that his peers adhere to it.

The point is not that Semmelweis didn't make an important discovery, or that we shouldn't be mindful of warped-sounding new knowledge that contradicts our existing theories. Of course we should be objective when considering facts that threaten our existing theories. But there's a reason John Snow and Joseph Lister [and Pasteur] are better known in the development of the germ theory of disease, and there's more to learn from the Semmelweis story than how the audience to a new theory should behave.

<comment><USER3> That he named the things that were killed by lime "cadaveric particles" and not "bacteriae" at the time nobody knew that bacteriae exist can't be considered wrong.

How he named them was irrelevant. His explanation was good enough -- there WAS something on the hands of the doctors that was small enough and not visible that lime was able to destroy. Why was it hard to take it seriously then? Certainly not because others knew better -- nobody had "bacteria" in their language. He had to call that what was neutralized somehow.

<comment><USER2> You're rationalizing what Semmelweis said with a modern understanding of medicine. Of course, today, it's obvious that thoroughly clean hands help eradicate pathogens, and so it seems obvious that to note in 1840 that handwashing in chlorinated lime lowers death rates is to come immediately to the crux of the problem.

In fact, doctors in the 1840s were well aware of the concept of contaminants. They had already assumed a regime of handwashing. Moreover, Semmelweis himself was not content to lobby attendants to wash their hands. He was instead fixated on the idea of cadaverine particles, going so far as to invent new vectors for their creation in cases where no contact with dead bodies could have occurred. Semmelweis wasn't even correct about the mechanism of action in cleaning hands; he believed the chlorinated lime more thoroughly removed particles, when in fact the key was to kill the pathogens.

A simple way to sum the problem up: Semmelweis advocated handwashing... _for staff who had been conducting autopsies_. Semmelweis was on to something, but he himself seems to have missed it by a wide margin. Things could have been different if Semmelweis himself stuck with the evidence, rather than seizing the first bit of it that confirmed his theory and running away with it.

<comment><USER3> I hope you recognize that when you say "A simple way to sum the problem up: Semmelweis advocated handwashing... for staff who had been conducting autopsies" you also confirm that there were _actually_ the doctors that did autopsies who didn't disinfect their hands. So he was obviously right. You can just claim that he set his goals too narrow, but even that much was not accepted by others.

<comment><USER4> _So he was obviously right._

Not at all. Semmelweis thought something associated with _death_ was what was killing people (eg, he chose chlorinated limes _which he found best removed the stink of death_ ).

I suspect the focus on _death_ and _dead people_ meant people focused on that, and "proved" to themselves he was "wrong".

I can imagine scenarios where doctors dealt with one woman who had a good birth experience, didn't use the Semmelweis handwashing method (because the first woman didn't have the death particles) and then the next woman got infected and died. To many (unfortunately), that would prove his theory was wrong.

<comment><USER3> Citation needed, since you claim that doctors actually used the results of experiments to disprove him but at the same time didn't heed to the results of the experiments that showed that using lime was obviously beneficial.

<comment><USER4> _Citation needed_

No it isn't.

 _you claim_

No I didn't. I was very careful to make clear this was my opinion only ("I suspect" and "I can imagine scenarios").

As I noted, lime wasn't _obviously_ beneficial, because Semmelweis claimed it removed the "cadaveric particles", and yet people were still dying when there should have been no "cadaveric particles" around (ie, no one had died).

It's like the story of how scurvy started happening again in the early 20th century with Scott in the Antarctic[1]. In the 18th century scurvy had been defeated by drinking (fresh) lime juice on long sea voyages, without a correct understanding of the mechanisms involved.

Read the linked article about how it happened.

[1] <http://idlewords.com/2010/03/scott_and_scurvy.htm>

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> While overall, I like this article, there is real danger in advice like this:

>Look up, not down. [...] to do that you need to look at the people who are even better than you.

While this is great for those who exaggerate their skills, I doubt those would even read this piece. For people with self-esteem problems and a tendency towards depression, however, this is about the worst advice you can give, because they tend to look at the top 1% already and therefore experience their life as a complete failure.

>But people will feel more comfortable telling you the truth if you start by criticizing yourself, showing them that it's OK.

In theory this is fine, but if you start seriously criticizing yourself in front of others, you anchor this critique in the minds of your listeners.

<comment><USER6> Cordelia Fine, in "A Mind of Its Own," makes a similar point:

 _Fine says, "that your unconscious is smarter than you, faster than you, and more powerful than you. It may even control you. You will never know all of its secrets." So what to do? Begin with self-awareness, Fine says, then manage the distortions as best one can. We owe it to ourselves "to lessen the harmful effects of the brain's various shams," she adds, while admitting that applying this lesson to others is easier than to oneself. Ironically, one category of persons shows that it is possible to view life through a clearer lens. "Their self-perceptions are more balanced, they assign responsibility for success and failure more even-handedly, and their predictions for the future are more realistic. These people are living testimony to the dangers of self- knowledge," Fine asserts. "They are the clinically depressed."_

<comment><USER7> Is this merely a correlation, or are you (or Fine) attempting to posit causation here? That is to say, is this merely pointing out that viewing "life through a clearer lens" is seen in connection with higher frequency of clinical depression, or is the inference here that this clearer lens _causes_ clinical depression?

I find it a hard case to make the latter statement, and the former statement doesn't imply (to me) that one ought to eschew the clearer lens. I wonder if there is some analysis that digs into what mental processes, emotions, thoughts, etc. occur in the wake of viewing the world through the clearer lens that might lead to clinical depression?

I _feel_ like there could be some not-so-weak element of not having as balanced a view/method of how to respond to one's failures that would lead toward depressive thought patterns. I don't think self-esteem issues are _caused_ by viewing oneself more objectively and rationally, but instead by placing unwarranted weight on the (potentially errant) _conclusions_ one draws from a more objective view of oneself. That is, if one has a more balanced and nuanced objective view of the world, but has an equally unbalanced and un- nuanced view of oneself--say, that one's abilities or potential for improvement are strictly circumscribed and not easily changed--I would hedge my bets toward that person having a greater likelihood for depression than someone who does not draw such conclusions.

I think I tend toward viewing myself and others fairly objectively, and actively work to do so. I also compare myself to others I subjectively and objectively find better in some ways. But then I respond by improving the parts of me that I have found to be weaker than those who are a level above my own. I don't experience depressive thoughts (that I am aware of). (shit, that's just anecdotal and can be dismissed. nevermind.)

[edit: typo and calling out my own anecdotal evidence that is unhelpful]

<comment><USER6> I'm not really asserting any sort of causal effect; I just thought it was interesting. Here's a bit more detail on the topic:

[http://biasandbelief.pbworks.com/w/page/6537201/Is%20Bias%20...](http://biasandbelief.pbworks.com/w/page/6537201/Is%20Bias%20Beneficial)

<comment><USER7> Thanks a bunch. I didn't think you were asserting causality; just thought you might know if Fine was instead.

</comment></comment></comment></comment></comment><comment><USER8> This is a well-written and useful article. If a lot of people are against you you may be onto something big, or you may be just wrong.

I wonder if Aaron will discuss the furor caused by his JSTOR activism ([http://bits.blogs.nytimes.com/2011/07/19/reddit-co- founder-c...](http://bits.blogs.nytimes.com/2011/07/19/reddit-co-founder- charged-with-data-theft/) also see the many discussions on HN, e.g. <http://news.ycombinator.com/item?id=2781615>). The case here is not as clear cut as, say, the case of Semmelweis. I am also undecided (hate the greedy closed magazines, don't quite approve the sneaking in part) on it.

I would really know what his objective analysis of the situation is unless he's already done a post that I've missed or if he can't talk about a court case.

<comment><USER9> I'm fairly sure that the federal case against Aaron is still being litigated (<http://en.wikipedia.org/wiki/Aaron_Swartz#JSTOR>), which means that he almost certainly can't discuss details publicly.

</comment></comment><comment><USER10> I've always told people that many of the best conversations with folks have started out with "Chuck I think you are wrong and here's why ..." This is especially useful when you are "important" (like someone's boss) because getting honest feedback when you are the boss can be nearly impossible at times.

Steve Bourne (yes _that_ Bourne) told me once that you should try to cultivate people who could give you a different view on the world, That is helpful stuff but you do have to also get people to be honest. That is hard to do if they think you're 'hot headed' or likely to shoot the messenger.

</comment><comment><USER11> _saying "You were right, I was wrong." It didn't destroy her reputation; it rescued it. [...] Wayne Hale took full responsibility: "The bottom line is that I failed to understand what I was being told…I am guilty of allowing Columbia to crash." He was promoted. When JFK admitted the responsibility for the Bay of Pigs fiasco was "mine, and mine alone," his poll numbers soared_

I would guess that the survivorship bias is at play here. How many people we will never hear about took responsibility and were demoted, fired or prosecuted?

<comment><USER12> Not only that, but Aaron seems to be skating perilously close to the position that admitting that you screwed up is, in itself, sufficient reason for you to be promoted. It's not.

</comment></comment><comment><USER13> I think the biggest challenge of this is finding friends that will tell you when you are wrong. And no wonder, it's really hard.

A friend of mine sent me a short story that they wrote not to long ago, and it was not very good. But I could not bring my self to say that, instead I made some little criticism and did not comment on the writing as a whole.

Anyone have tips on how to do this better?

<comment><USER14> The tricky aspect here is that most people believe that taste, and the 'quality' of artistic work, is mostly a subjective matter, but when they make criticism of art they treat their views as objective truth. Thus when you criticise a friend's work, or vice versa, the temptation is to think of it as "(Your|their) work sucks!" instead of "Oh well, (I|you) didn't like it, maybe someone else will."

Semmelweiss, on the other hand, had no subjective matter. He had the statistics showing that as soon as doctors started washing their hands, infant mortality went way down. It was just the doctors' pride which made them think he was accusing them of regularly killing newborn babies.

Of course there _is_ bad art which everyone agrees is terrible, and telling people that truth is hard. In the end, though, it's better to be honest because it's probable that your friend would respond with a determination to do better next time. The trick is to be tactful.

<comment><USER15> It's easy to criticise a minor detail of a friend's work, but harder to say "you don't have the talent for this, give up."

<comment><USER16> >It's easy to criticise a minor detail of a friend's work, but harder to say "you don't have the talent for this, give up."

I would question whether most people honestly have the expertise to make a judgement like 'you don't have the talent for this, give up'. I think people routinely overestimate their own abilities and discernment. Taking a hasty/faulty analysis and then telling someone to 'give up' seems like a terrible idea.

</comment></comment></comment></comment><comment><USER17> While this, on its face, looks like good, morally sound advice, I worry about the practicality of it for a certain class of individuals.

The people I see in leadership positions are far more likely to be narcissistic sociopaths than reflective mediators.

If you're not in a position of power / individual freedom, this is excellent advice to make sure that you can, and are seen to, play nice with others. It will probably help your blood pressure and promotion prospects. I'm just not convinced that this strategy is one that leads to the top more often than brutal myopia and conceit.

<comment><USER18> I don't think he meant "top" meaning (necessarily) leaders of a hierarchy. I think it meant more like look to people who are performing "better" than you -- for whatever thing you want to measure.

</comment></comment><comment><USER19> Just wanted to add that there is another interesting article here that links the Theory of Contagion to sympathetic magic:

[http://laphamsquarterly.org/essays/very- superstitious.php?pa...](http://laphamsquarterly.org/essays/very- superstitious.php?page=all)

Apparently the idea that diseases can spread through contagion is a prime example of something that was previously considered to be magic that later came to be accepted by science.

<comment><USER20> Sympathetic magic was one of the first forays into actual science. It sought explanatory power for phenomena. That they did this ass-backwards and propagated through superstition and rumor is why it's not _actually_ science, but when you start talking about controllable and manipulable mechanisms, you've taken the first important step.

"Magical thinking" doesn't refer to this. It refers to an utter ignorance of the mechanism, leaping from observation to conclusion without isolating any variables experimentally.

</comment></comment><comment><USER21> Really good stuff. I'll try to take it to heart.

Thanks for sharing :)

Small gripe: 30em-wide text is pretty tough (for me, at least) to read on a high-res display

<comment><USER22> agreed. I hate when people have anything less than 14pt font now. Luckily I have a readability for chrome installed.

</comment></comment><comment><USER23> >"people will feel more comfortable telling you the truth if you start by criticizing yourself, showing them that it's OK."

I disagree with this assertion. Some people criticize themselves in hopes that their listeners will contradict them. For these self-criticizers, affirming their critical statements greatly upset them. I have not found much correlation in my personal life between people who criticize themselves and their ability to listen to criticism. There are other attributes which I have found correlations, such as being easygoing and thoughtful. I still often try to gauge a person's willingness to listen to criticism by starting with very small criticisms and working my way up.

</comment><comment><USER24> A bit of observation, of self or others, will quickly show we all exhibit the Semmelweis Reflex at some time or another:

<http://en.wikipedia.org/wiki/Semmelweis_reflex>

</comment><comment><USER25> _This is what we're taught: make five compliments for every criticism, sandwich negative feedback with positive feedback on each side, the most important thing is to keep up someone's self-esteem._

 _But, as Semmelweis showed, this is a dangerous habit. Sure, it's awful to hear you're killing people—but it's way worse to keep on killing people!_

Semmelweis did exactly what you're advocating and he was marginalized for it. Maybe he would have fared better if he was more conscientious of their feelings?

</comment><comment><USER26> That was what I hated about my previous work. Damn management was so protective that you could feel good about yourself, so there was no negative feedback and there was no way you could improve. I think they wanted us to work for them for low wage and never get better job. But in the matter of facts we sucked badly at that job, I felt this, and I felt it when I was going to interviews, I got new job and we'll see how it will turn out.

</comment><comment><USER27> Great post. Whenever I remember, I try to thank people who criticize me, so they'll be willing to do it again. They really are taking a risk.

</comment><comment><USER28> The thing about new ideas being rejected (better/different hand washing) reminds me of how everyone thinks that a web page or web application UI must to be hand coded.

I think that is very stupid and eventually we will use graphical tools to create the UIs for web pages and web applications and look back at the days when every single web page had to be hand coded in HTML and CSS and laugh.

</comment><comment><USER29> I'm always up for an Ignaz Semmelweis [1] reference. I read his story for the first time when my woman was taking a Microbiology course. Incredible stuff.

1: <http://en.wikipedia.org/wiki/Ignaz_Semmelweis>

</comment><comment><USER30> > Force students through an embarrassing initiation to take a class, and > they'll insist the class is much more interesting.

Does anyone know which experiment he is referencing here?

<comment><USER31> There are so many studies like this it is hard to say which one specifically he may be referring to. There is a mountain of literature on the topic; as usual, Wikipedia is a good place to start: <http://en.wikipedia.org/wiki/Cognitive_dissonance>

<comment><USER32> It frustrates me a little when people conflate cognitive dissonance with effects caused by dissonance reduction, like in this article. Cognitive dissonance is simply the uncomfortable experience of believing two conflicting things. Dissonance reduction is the class of biases that we use to reduce that discomfort.

</comment></comment></comment><comment><USER33> Semi OT, but I signed up for email alerts at the bottom of the previous article in this series, and haven't received an email since. Am I alone with this?

<comment><USER34> Maybe email him and let him know?

</comment></comment><comment><USER35> I've started loving this new series started by Aaron. Thanks a lot, Aaron. Keep 'em coming!

<comment><USER36> These posts have been reminding me of Malcom Gladwell, in the unfortunate way: an collection of interesting anecdotes that together would make an interesting story instead are blown up into a broader statement that doesn't seem to follow.

<comment><USER37> I agree. There is also a bit more to the Sammelweis story than simply doctors refusing to be self-critical.

From the wikipedia article on Sammelweis (<http://en.wikipedia.org/wiki/Ignaz_Semmelweis>):

"It has been contended that Semmelweis could have had an even greater impact if he had managed to communicate his findings more effectively and avoid antagonising the medical establishment, even given the opposition from entrenched viewpoints."

<comment><USER38> > It has been contended that Semmelweis could have had an even greater impact > if he had managed to communicate his findings more effectively

This is the point. Anyone who is properly introspective is already following the good advice given here. But how about the total ramrods one has to deal with on occasion, those people who are crazy and deluded, whose self- confidence totally exceeds their grasp of the subject matter? Blessed is the man who can say to his line manager "I won't deal with N.N. any longer, he is incompetent and unaware of it." But sometimes the constraints of work do not permit not dealing with some people, or the boss is the crazy one. What to do in such situations?

</comment></comment></comment></comment><comment><USER39> This anecdote, holy crap.</comment>


Show HN: Test { fuzzyset, sifter, lunr, fuse, levi } output at the same time - <AUTHOR> http://fiatjaf.alhur.es/js-search-engines-comparison/ <comment><AUTHOR> Please allow a few seconds of unresponsiveness for the levi index to be filled. It's all on memory, but it takes more time than I would like.

Nothing is optimized in any way, this is just a piece of bad code.</comment>


We Managed to Slightly Beat the Market with Machine Learning - <AUTHOR> https://towardsdatascience.com/how-we-have-beaten-the-crypto-market-using-machine-learning-a45e8a7dbdcd <comment><USER2> What do you think your edge is? ELI5 please.

<comment><AUTHOR> I was thinking about it a lot recently... This is pure speculation but I believe with both infrastructure and algorithms / data science we ended up in a sweet spot: ordinary algo-traders and small teams are quite unlikely to get that far and big guys don't care about "pennies" we're making due to their fixed costs (salaries alone in a hedge fund would make our current strategy non viable).</comment></comment>


Critical vulnerability of NPM package macaddress - <AUTHOR> https://nodesecurity.io/advisories/654 <comment><USER2> Here's the offending line of code[1]:

         exec("cat /sys/class/net/" + iface + "/address", function (err, out) {

That's some serious amateur hour and may even be a new contender for the Useless Use of Cat (and "exec(...)") Award.

Would be simpler and less error prone to just read the file via fs.readFile(...) after verifying that the iface parameter does not contain a directory separator.

[1]: [https://github.com/scravy/node- macaddress/blob/dd079620d11c9...](https://github.com/scravy/node- macaddress/blob/dd079620d11c91957ac897e88d539dfceec41d56/lib/linux.js#L4)

<comment><USER3> Nodejs API docs for exec say:

> Never pass unsanitized user input to this function. Any input containing > shell metacharacters may be used to trigger arbitrary command execution.

I've always wondered what exactly the best way to do this is... searching about sanitising user input into shells always results in suggestions for something quite extreme like stripping non-alphanumerics or something similar. But much of the time user inputs are just passed as parameters or built into paths as in this case, so I wondered, is it enough to quote them instead? we don't need the features of double quotes when building the string in some other language in which case the rules for single quotes apply:

From GNU Bash 184.108.40.206 Single Quotes:

> Enclosing characters in single quotes (''') preserves the literal value of > each character within the quotes. A single quote may not occur between > single quotes, even when preceded by a backslash.

In which case is it possible to get away with just "sanitizing" for single quote usage and then single quote all paramaters?:

        exec(`cat '/sys/class/net/${iface.replace(/'/g, '')}/address'`, () => {})

Is it possible to break out of that? I think in order to use && or ; to start a new command you need to end the context of the string, but .replace(/'/g, '') seems to remove that ability? e.g

        iface = `'; touch /uhoh;`

results in the following string passed to exec

        cat '/sys/class/net/; touch /uhoh;/address'

        => cat: '/sys/class/net/; touch /uhoh/address': No such file or directory

Also you can't do further exec inside single quotes with backticks e.g

        cat '/sys/class/net/` touch /uhoh `/address'

        => cat: '/sys/class/net/`touch /uhoh`/address': No such file or directory

<comment><USER2> Escaping and quoting is the wrong way to go. Even if it works you're technically not totally correct as you can't reference my network interface named "bad'name"[1].

If you can avoid fork/exec you're always better off. In this case reading the file directly is fine. I can't think of a valid reason to fork and invoke cat.

If you have a legit reason to fork and run then use execFile(...) as you can pass the arguments as an actual array. No escaping needed as it gets passed in total without shell parsing of args. Your example would be something like:

        execFile('/bin/cat', ['--', `/sys/class/net/${iface}/address`,], (error, stdout, stderr) => { ... })

Though that has the issue of being able to pass in ../../../ and read a file named "address" anywhere on the filesystem. Should also add in a regex validation that no directory separators are in the text of iface.

[1]: Yes this sounds stupid but it's a valid file name. A more realistic one may be something like "Alice's Wi-Fi".

[2]: [https://nodejs.org/api/child_process.html#child_process_chil...](https://nodejs.org/api/child_process.html#child_process_child_process_execfile_file_args_options_callback)

<comment><USER3> > Escaping and quoting is the wrong way to go. Even if it works you're > technically not totally correct as you can't reference my network interface > named "bad'name"[1]. If you can avoid fork/exec you're always better off. In > this case reading the file directly is fine. I can't think of a valid reason > to fork and invoke cat.

Yes I get that, I should have clarified: in the general use of exec (i.e a valid and necessary use).

> If you have a legit reason to fork and run then use execFile(...)

You are absolutely right, execFile is a much better way, I've used it before and I guess you are right - in _most_ cases this should be the #1 choice.

[edited] - irrelevant details of obscure case where execFile isn't enough.

Anyway, in a case where exec through a shell is necessary for some reason, i'm wondering if this method of single quoting is actually safe or not, as far as I can see it is, but i'm not a security expert.

</comment></comment></comment></comment><comment><USER4> Many people here are saying that the problem had been in the code base for years, was super obvious, and that just no one looked at the code.

I think that it is much more relevant that the node community does do many micro packages, that it makes so much nose to look at the quality of pulled in packages.

I recently pulled down a web app (Zulip) the packages.json expands to almost 1400 npm packages. How is any human going to look at all that. And apparently it is "normal" for an npm project to have that many dependencies.

Too me this is madness. It is impossible to know the quality of all those packages.

<comment> pi-squared I am not a fan of the whole javascript craze but for comparison on my desktop machine with I assume average setup of ElementaryOS:

        $ apt list --installed | wc -l

        2394

And on my server the number is 502. Couldn't the same argument be applied here as well? I understand that (probably) users of Ubuntu are more involved than supporting npm packages (or... are they) but it's still a lot of packages to eyeball.

<comment><USER4> Sure, but the major difference is that those packages are for everything on your system. Dependencies are often added very carefully.

In the node case it is not uncommon for a small app to include 50 small packages, and then those packages pulled in 30 unique smaller packages each (on average).

Imagine you did an apt upgrade on your system, or decided to install a new package and it said it was going to install 1500 new packages. Would you continue? It would definitely make me pause for a while. But this is the norm in the node world, and people seem to think it is a good idea.

</comment></comment></comment><comment><USER5> npmjs shows 1,325,674 weekly downloads.

The current version was released 3 years ago.

The code is small and straightforward.

Using exec("cat x " \+ userdata) to read a file in any language should immediately drive any developer nuts.

Apparently, nobody ever looked at the code. Or maybe some people did, but never reported it. Pretty sure some companies did, fixed it in their closed local fork and never notified the author nor contributed their fix back.

This is really scary, and really bad for the trustworthiness of open-source software.

</comment><comment><USER6> This has been biting a lot of people as the mostly unmaintained cssnano uses it, which in turn is used by create-react-app. Previously this would have probably gone unnoticed, but npm audit in npm6 has brought it front and centre.

<comment><USER7> It's amazing that something like cssnano would have a dependency on getting MAC addresses. WTF?

<comment><USER8> I maintain a package that has an indirect dep to macaddress because of UUID generation. UUID v2 is generated from Mac address + timestamp. My package only generates uuid v4 (fully random) and even if it was, the uuid dep doesn't expose the vulnerable argument. As such it isn't vulnerable. But the dep is still there.

This isn't surprising at all tbh.

<comment><USER9> A dependency for uuid4 is hardly needed:

      crypto = require('crypto');

      function uuid4() {
          const bytes = crypto.randomBytes(16);
          bytes[6] = (bytes[6] & 0x0f) | 0x40;
          bytes[8] = (bytes[8] & 0x3f) | 0x80;
          return bytes.toString('hex').match(/(.{8})(.{4})(.{4})(.{4})(.{12})/).slice(1).join('-');
      }

<comment><USER8> I mean sure. But I also need to parse UUID. And do other things with it. Even if I didn't need to, I'd still likely use the uuid-1345 crate for it.

Here's the thing: If I import this code in my codebase directly instead of using a library, it suddenly becomes my "responsibility" if it breaks. And when we're talking about a FOSS side-project, I don't have that kind of time. Third-party libraries means I get any improvements and bug-fixes for free. And if it breaks, I get to talk with the original maintainer to figure it out, and we're suddenly two people, with one hopefully knowledgable enough on the topic, working on the problem.

Importing this kind of thing in make codebase makes it an ugly unwieldy mess that _will_ inevitably break, and I suddenly will be alone trying to figure out what I did wrong. This is what's good about npm and libraries: the community that's built around it.

<comment><USER9> Well, surely you put the line somewhere? Would you depend on `leftpad`? How about `is-odd`?

Your view of dependencies is very idealistic. And if I'd venture to guess - apologies if I'm wrong - young, at least to programming. I'm saying this because you don't tend to hear such phrases once reality hits.

Everything you said can be flipped:

> If I import this code in my codebase directly instead of using a library, it > suddenly becomes my "responsibility" if it breaks.

I have full control & understanding of the code; I can adjust & trim so it fits as much as possible. If it breaks, I can fix it directly.

> And when we're talking about a FOSS side-project, I don't have that kind of > time.

Copying/hand rolling some trivial code is often faster than deciding among a dozen libraries which do the same thing, reading their docs, their issue pages and open PRs, adding and integrating to my project.

> Third-party libraries means I get any improvements and bug-fixes for free.

I must keep the dependencies updated. I must read changelogs and hope nothing breaks.

> And if it breaks, I get to talk with the original maintainer to figure it > out

I must use inefficient communication with a more-often-than-not absent maintainer in order to resolve my problem instead of fixing it directly.

> I suddenly will be alone trying to figure out what I did wrong

I am able to be self-reliant in fixing the problem, because I wrote the code and I understand it.

I do not have to trust the maintainer of the package or the maintainers of any of its transitive dependencies to be competent or non-evil.

\---

For some things this is worth it. IMO for generating 16 random bytes it is not worth it.

<comment><USER8> Well, everything I've said here are grounded in personal experience working on FOSS projects. They're also grounded in trust of the maintainers. In 5 years of full-time programming as a job and a hobby, I have found that to work to my advantage. I can understand that this might not be everyone's experience. I also understand that different projects have different needs - some might simply be too sensitive to depend on external code if they can help it.

To answer your rhetorical questions: I would certainly depend on leftpad, as it allows me to free my mind to something more useful. I probably wouldn't depend about is-odd because I intuitively know how to make it work. That's pretty personal. The line is basically drawn at "do I need to think to figure this out." Yes, leftpad is trivial. But this is death by the thousand papercuts: When I program something, I'm solving a problem. Having to solve a million other problems at the same time - no matter how trivial - is going to take me away from what I'm supposed to actually doing. It breaks my flow. I don't like that.

> Copying/hand rolling some trivial code is often faster than deciding among a > dozen libraries which do the same thing, reading their docs, their issue > pages and open PRs, adding and integrating to my project.

I have found this to not be the case. In the JS land, depending on a library is beyond trivial. Especially for those "simple" libraries that simply export a function. Yes, I do need to read the docs, but there isn't a million ways to do leftpadding, nor is there a million ways to do UUID generation. Copy pasting code might require playing with requires, figuring out transitive dependencies, and just some manual work that take time away from actually thinking about the code I'm working on - again, breaking my flow, forcing me to context switch.

> I must keep the dependencies updated. I must read changelogs and hope > nothing breaks.

Semver takes care of that for you. And yes, I trust maintainers to follow semver. Again, that generally works. I only had a single case of semver- breaking release in my life, and that was in the Rust land - docopt.rs 0.8.2. [https://github.com/docopt/docopt.rs/issues/235](https://github.com/docopt/docopt.rs/issues/235). Debugging the issue took me at most an hour, reporting it to upstream took seconds, and the fixed version was released literally 10 minutes later. In the meantime, my install still worked due to the lockfile pinning the previous docopt version. I could easily continue working normally.

Breakage happen. I've found that breakage also happen internally. Sometimes I change my code and break my own invariants. Refactor and forget to fix an instance, which breaks the code in subtle ways. Bugs happen. I accept that.

> I have full control & understanding of the code; I can adjust & trim so it > fits as much as possible. If it breaks, I can fix it directly.

This is where I totally disagree. Depending on a third-party package does not deprive me of the ability to fix code when it breaks. And in fact: it empowers me. Again, the major advantage of dependencies, in my view, comes from the community. And if it needs adjustment that could be beneficial to others, I can PR it. I can fork, and npm has tools to make it easy to inject a fork into the dependency tree, replacing all instances with my own. This lets me experiment with potential fixes with ease, as if it was my own code.

Sure, sometimes, the library might not do exactly what I want it to, exactly how I want it to. Maybe what I want to do is incompatible with said libraries. In those cases, rolling my own might make sense.

In the end, it comes down to this: I trust the community, and believe in taking and giving back. If that's a young point of view, then so be it. Maybe I'll learn the hard way that reality is not so forgiving, that my trust was misplaced.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> The actual report, as that page contains nothing interesting: [https://hackerone.com/reports/319467](https://hackerone.com/reports/319467)

</comment><comment><USER11> According to the HackerOne report[1] there was no response from the maintainer and the last package update was 3 years ago. And yet the package is downloaded several _million_ times a month (meaning it's definitely used in something -- I imagine looking at the reverse dependency tree would cause some concern).

This is something that bothers me a lot with most of these home-grown package ecosystems. In distributions we remove packages from their main repositories if old maintainers are no longer available and nobody is interested in becoming the new maintainer (we do this in openSUSE all the time). Does the Node (and Rust, Python, Ruby, ...) community have this sort of process for deciding that a project is no longer adequately maintained?

One of the benefits of having macro-packages is that it's always clear whether a package is being maintained -- if there isn't a release for a long time then it's probably no longer maintained. But with micro-packages there are thousands which are so trivial they require no updates (see left-pad, ansi-{green,blue,red,yellow,cyan,...}, and so on) that a very large number of projects depend on. Not to mention that distributions don't generally have projects with thousands of dependencies each -- so removing a dependency and everything that depends on it will not destroy the entire package ecosystem.

[1]: [https://hackerone.com/reports/319467](https://hackerone.com/reports/319467)

</comment><comment><USER12> That yet another NPM package proves to be pretty broken seems to be par for the course, but what especially shocks me is that on Hackerone the people working on this vulnerability can't reach the original maintainer and then say: "Doesn't look epic to me, also last publish was 3 years ago."

It doesn't look epic, yet it's a package that has over 1.2 million weekly downloads.

Also, fun fact, one of the dependent packages is react-input-select...WHY?

<comment><USER13> react-input-select has 640 (!) dependencies, all of which were added by the author in a commit named 'type fix'[1] which seems to have been ostensibly intended to fix a typo, and none of which seem to be required to actually use the library.

The only thing I can imagine is that the author somehow added their entire node_modules tree as dependencies. Maybe it was an ill-fated attempt at pinning?

[1]: [https://github.com/rayescmata/react-input- select/commit/cd7b...](https://github.com/rayescmata/react-input- select/commit/cd7b82578d70b9562013e00eb1ee7594ef628e9d)

</comment></comment><comment><USER14> love those little bobby tables

</comment><comment> cc-d Another month, another ridiculous issue involving NPM that has no place being in software with millions of weekly downloads.

It really is never ending amateur hour in the NPM community.

<comment><USER15> This has nothing to do with NPM. It is a specific package published on NPM. Also, stereotyping and insulting the NPM community is nonconstructive and out of place. Vulnerabilities in packages happen all the time in all kinds of package managers. The lesson here is to not blind-trust any package you come across that might make your job easier.

</comment></comment><comment><USER16> This one has been out for about a month:

[https://snyk.io/vuln/npm:macaddress:20180511](https://snyk.io/vuln/npm:macaddress:20180511)

Unfortunately, it's introduced into any Rails app that uses webpacker or any app using node-sass through a long dependency chain.

And once again demonstrates how the JS community is far too dependent on extremely trivial, unsupported, and unaudited libraries.</comment>


Anti-Piracy Group Blackmails ISPs to Censor The Pirate Bay - <AUTHOR> http://torrentfreak.com/anti-piracy-group-blackmails-isps-to-censor-the-pirate-bay-111205/ <comment><USER2> Am I being stupid? If you use your ISP that "DNS Blocks" TPB, then surely all you need to do is switch to using Open DNS (or similar) and suddenly what your ISP does to their DNS server is irrelevant.</comment>


AWS management console is down - <AUTHOR> https://www.amazon.com/ap/signin?openid.assoc_handle=aws&openid.return_to=https%3A%2F%2Fsignin.aws.amazon.com%2Foauth%3Fresponse_type%3Dcode%26client_id%3Darn%253Aaws%253Aiam%253A%253A015428540659%253Auser%252Fhomepage%26redirect_uri%3Dhttps%253A%252F%252Fconsole.aws.amazon.com%252Fconsole%252Fhome%253Fstate%253DhashArgs%252523%2526isauthcode%253Dtrue%26noAuthCookie%3Dtrue&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&action=&disableCorpSignUp=&clientContext=&marketPlaceId=&poolName=&authCookies=&pageId=aws.ssop&siteState=&accountStatusPolicy=P1&sso=&openid.pape.preferred_auth_policies=MultifactorPhysical&openid.pape.max_auth_age=120&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&server=%2Fap%2Fsignin%3Fie%3DUTF8&accountPoolAlias=&forceMobileApp=0&forceMobileLayout=0

<comment><USER2> console and SES are working for me now (2:41 CST)</comment>


Shopify POS Int Overflow that is breaking the inventory count of 318M products - <AUTHOR> https://medium.com/@alexleclair/shopify-s-pos-integer-overflow-d280594aacf <comment><USER2> Author here, happy to answer any question :)</comment>


Congress Finance Graph - <AUTHOR> https://congress-finance.herokuapp.com/ <comment><AUTHOR> Thought this may be of use for journalists or anyone interested in money's influence in politics.

I whipped this up over the last few days and could use some contributors if anyone is interested. [https://github.com/jacob-ebey/congress- finance](https://github.com/jacob-ebey/congress-finance)</comment>


Internship in SF led to a fulltime job offer – should I drop out and take it? - <AUTHOR>

Hi, I'm going into my second half of my third year of computer engineering at a top university in Canada, and I'm currently on co-op at a well funded tech startup in SF (~50 people, raised 100+ million). I recently received a fulltime offer with a 105k salary and competitive amount of equity.
Here are my reasons for considering dropping out and taking it:
1) I don't like my program - a lot of the circuits/embedded systems will not be applicable to my career post-graduation. I tried transferring to Software Engineering but it was full
2) The salary and equity is competitive. I truly believe this company has a good chance at succeeding, so the equity could be worth something
3) I'd probably just work here post-graduation either way, so I'm not sure if going to school for 2 years then coming back here would be a good idea, when I could just stay here right now. (and, I probably wouldn't even be getting equity in 2 years considering the company is growing exponentially right now)
4) This company is very well known by recruiters in the Valley, and the people working here are all extremely brilliant, so this is a fantastic opportunity (both for my resume and for the skills I'd gain)
Thoughts, opinions? I've heard that I could easily get accepted back to UW a couple years down the line if I decide to go back? Also, how important are degrees really for top companies including Google and Facebook?
I have a meeting with our immigration lawyer tomorrow, but I was told that I could get a TN visa no problem (through a loophole - there is another person who was exactly in my position who' currently on a TN, so I know this does happen), then after a year get an H1 and eventually a greencard. Gonna clarify this with our lawyer. <comment><USER2> 1\. I think you are being underpaid if you are going to live in SF and get paid 105K for a company that is both well funded, and very well known. Unless your equity is very very significant.

2\. Companies don't disappear in two years; if they do, you don't want to join that company. There is no hurry for you to join the company now. In fact, you could intern every year and continue to build relationships in the valley and come back.

3\. Degrees aren't that important for top companies.

4\. You need to talk to the immigration lawyer. I don't think you can apply for an H1B without at least a Bachelors degree. The TN visa does not let you apply for a Green Card directly.

<comment><USER3> $105k is a livable wage in San Francisco, but expect about half of that paycheck to disappear into rent and about a quarter or a third going towards food and whatnot. On the other hand, my salary at this point isn't my main source of income, my stock grants are.

As for the immigration, I can confirm that you need at least a bachelors degree. I went through the H1-B (and GC) process and you can pretty much forget about it if you can't show at least equivalency. The main reason I finished mine and didn't do the exact thing you did (but 6 years ago) was for visa eligibility.

Be careful about saying TN, H1-B and GC in the same sentence. While an H1-B is a dual-intent visa (meaning you can pursue a GC), a TN is not. If you show intent to stay on a TN visa, that can hurt your chances in the future. This should be fine to talk about with your lawyer, but mum's the word when dealing with anyone in an official capacity.

</comment></comment><comment><USER4> Congratulations on the offer. Obviously they want you.

On one hand, there's a lot to recommend putting off the start of your career. On the other, if you're already awesome as a rising junior, you'll probably not be any less awesome as a graduate and have opportunities at that point. For me, the kicker is that you cannot get into the program you want at your university, and studying something that you don't love borders on tragedy [in the large, not on a class by class basis].

However, unless the employer is paying for the immigration attorney, I'd be skeptical of the prospects just based on my lay person's reading of the TN Visa requirements [1] and the description of the plan of attack as a loophole and the next step as an H1 visa.

Good luck.

[1]: [http://www.nafsa.org/_/file/_/amresource/8cfr2146.htm](http://www.nafsa.org/_/file/_/amresource/8cfr2146.htm)

</comment><comment><USER5> You'll never be in college at college age again. Meanwhile, you'll have your whole life to work in the Valley. Unless this job is really something amazing, stay in school.

Of course if you find yourself violently recoiling at that argument, that'll tell you something too.

<comment><AUTHOR> That's definitely a valid reason - I'm having a blast in school, so I guess I'm just naively eager to begin working (since this past co-op term in SF has been one of the greatest times of my life). I guess SF won't be going anywhere, and it'll be just as good in the future.

</comment></comment><comment><USER6> If you're banking being able to get back into UW in a few years if you change your mind, you should also talk to someone at the school about that. As well, banking on a loophole to get a work visa (the TN restrictions are pretty specific about needing a degree in the field) seems like a pretty risky idea.

I have a strong feeling I know what company you're talking about as well (and no, I don't believe it's Github as someone else here does), I have to say that even if the company is full of brilliant people, you should also consider the relative risks in the field that they operate in. Bitcoin can be a risky business, even for the golden child.

My overall recommendation would be to stick with your degree. In a year and a half you wont have to worry about whether or not you can return to an undergrad if you wish, nor worry that a visa loophole will come back to bite you in the ass. If something happens and you need to find a new job, you wont have to worry about having to find one that will be willing to risk dealing with visa loopholes. Not to mention that you sound like you still have 2 coop terms left. Even here you could very likely return to this specific company for those terms if you wish, or (my recommendation) take advantage of the terms to explore different options.

<comment><AUTHOR> I'm scheduling a call with my academic advisor sometime this week. I'm in good standing at school, and I take part in a bunch of extracurriculars, so even if I have to re-apply I don't think it would be difficult to get accepted again.

Agreed about the visa though - I have a call scheduled with an immigration lawyer tomorrow, so I'll determine how difficult it is (if it's even possible) to get an H1 or GC.

Thank you for your other points - seriously, much appreciated.

</comment></comment><comment><USER7> If you're even close to going forward with this, definitely lawyer up. Especially considering you're talking about a "loophole". Also talk with an accountant who has helped people in this situation, as that can cause some big surprises when it comes to what you owe at tax time.

Consider where you're leaving behind: KW is a rad area; I've been here in the startup world for just over 3 years (born and raised not too far away). A decent starting offer here is $60-80k, potentially more if you're at a 'name brand' company (I started at $65k for reference, with $50k the number I had in mind to stay local after wrapping up my CS degree). The cost of living here is way less than SF, so there's lots left over for actually spending on living.

If you really want to be in a city, go an hour east to Toronto and make your mark there.

I know the valley is a mystical, magical place, but if you're putting salary/equity high up on your list of "Pros", consider that you could do just as well, or better, in the area (when looking at purchasing power, cost of living, etc).

</comment><comment><USER8> Get your degree.

Seriously, the lack of a CS degree will screw you over. Maybe not with this job, but you don't expect to work at this place for your whole career, right?

<comment><USER9> Pretty much this.

You'll see "or equivalent experience" but you'd be surprised at how many web startups using bootstrap will test you for data structures + algorithms chops.

As an example: I'm talking about hopping on skype for front-end jobs in angular, and they have some guy snickering at me not being able to solve a pathfinding equation.

</comment></comment><comment><USER10> If you are certain that you can go back to uni anytime and finish your degree then I don't really see why you shouldn't go for the job. Degrees matter if you don't have a lot of experience (something like less than 5 years) in the industry you are trying to work for. degrees might look like they don't matter much at the moment (because software engineers are in high demand) - but that can change quickly.

<comment><USER11> Completely agreed. I would add that 105k seems high as a starting salary for a software engineer at a sustainable startup, so either you have unique capabilities, or the startup is super well-funded, or the startup is burning cash at an unsustainable rate. It might be interesting to discover what the story is (diplomatically!) before you commit.

</comment></comment><comment><USER12> I would take the job, but find out exactly how long you can postpone your schooling and return in good standing.

What I learned in college wasn't really relevant to what I do as a professional. Will you miss out on the theoretical underpinnings without finishing your degree? Meh. I'd say yes if you were building hardware (where the physical properties of what you're building are well understood and define the project), but software is changing and evolving all the time. The only way to know how to do it right is to be a part of what's happening right now.

I don't personally know about what avenues are closed without a degree (e.x. large companies). I suspect tech has some of the lowest requirements for a pedigree if you've got a proven track record.

A word of caution: A friend went back to finish his degree some time after he dropped out, and found out he had just barely missed the deadline. All of his credits were now expired and he would have had to start over as a freshman. Just make sure that doesn't happen.

</comment><comment><USER13> Having been in the same situation, I picked staying at UW, and I graduated this past June.

You can always come back and do another coop at the same employer. As someone in 3A or 3B, you are really close to the end of your studies (and the courses in 4th year, along with FYDP, are the best parts of the program). Others have addressed some of the financial points. Obviously talking to a lawyer is a good idea.

Send me an email (in my profile), if you want to talk more about this.

</comment><comment><USER14> Stay in school. You're in 3.5 years already, just finish it out. If they really like you, they'll understand and the offer will remain open for when you finish.

</comment><comment><USER15> If you don't have plans to pursue a career in the academia, then I think you should take the job. You can also discuss it with any university rep to find out until when you could possibly go back to where you stopped should you wish to finish your degree in the future.

</comment><comment><USER16> I'm going to venture a guess and say this company is GitHub.

Not a bad gig, and honestly if I were you, I'd take it. A degree really isn't that important anyway (for the goals you have, which I assume is to become a great engineer and build top notch products)

</comment><comment><USER17> I'd finish my degree before embarking a formal job. There are plenty fishes in the pond. Without a degree, it's a problem for your every job search afterwards.

</comment><comment><USER18> Be careful ... I would be surprised if you can get an H1B or GC with no college degree.

</comment><comment><USER19> Tell them you will work for them from Canada while you finish your degree.

<comment><AUTHOR> I asked that, and they didn't seem very eager for remote work. Additionally, I'd be getting no equity if I did this.</comment></comment>


DIY Drones: Home for everything about amateur Unmanned Aerial Vehicles - <AUTHOR> http://diydrones.com/ <comment><AUTHOR> Although not a drone, it is pretty cool to see this tech being open sourced, getting miniaturized, and at a price point where many people can afford them. Take the Crazyflie Nano Quadcopter [1] for example, open source and fairly cheap, there is even a really cool demo video [2], I guess you could use the DIY drone software on your laptop to control this thing. I generally think of open source as software, but it's very cool to see hardware project too, there are even wikis for the copter [3] and radio [4], which explain the projects and the hacks. To help get a sense for how small this thing is check out this assembly video [5].

[1] [http://www.seeedstudio.com/depot/crazyflie-nano- quadcopter-k...](http://www.seeedstudio.com/depot/crazyflie-nano-quadcopter- kit-10dof-with-crazyradio-bccfk02b-p-1365.html)

[2] [http://www.youtube.com/watch?v=3WBUVYZkODI](http://www.youtube.com/watch?v=3WBUVYZkODI)

[3] [http://wiki.bitcraze.se/projects:crazyflie:index](http://wiki.bitcraze.se/projects:crazyflie:index)

[4] [http://wiki.bitcraze.se/projects:crazyradio:index](http://wiki.bitcraze.se/projects:crazyradio:index)

[5] [http://www.youtube.com/watch?v=kS3qR1IjeGE](http://www.youtube.com/watch?v=kS3qR1IjeGE)

<comment><USER2> You can't use the "DIY Drone" (really Ardupilot) software to control Crazyflie until Crazyflie supports the MAVLink communication protocol.

</comment></comment><comment><USER3> To add some context, this page is run by Chris Anderson, formerly editor at Wired, and now CEO of 3D Robotics. His book "Makers" [1] includes a few stories about the DIY Drones community.

[1] [http://www.amazon.com/Makers-The-New-Industrial- Revolution/d...](http://www.amazon.com/Makers-The-New-Industrial- Revolution/dp/0307720950/)

<comment><USER4> Also, this is basically a forum + storefront for his internally developed drone kits. I find his Optical flow sensor the most interesting of these.

I met him once when he gave a presentation at my employer. He is quite aware of the defense and security repercussions of this technology, but he didn't really want to discuss it. My impression is that he sees himself as a military consultant, long-term.

<comment><USER5> The Optical flow sensor is not his, it is: [https://pixhawk.ethz.ch/px4/modules/px4flow](https://pixhawk.ethz.ch/px4/modules/px4flow)

I say this, because the 3Drobotics/DIYdrones guy doesn't go out of his way to make these distinctions.

These swiss guys have 3Drobotics/DIYdrones place the parts & sell their board because these guys have very aggressive marketing & a pick & place bot. This allows them to focus on the actual engineering.

3Drobotics/DIYdrones have a fork of the Swiss guys code with a generic interface plastered over the top. They are moving to this hardware, because "their" own hardware is out of date & no longer competitive with the current generation of STM32 hardware everyone now uses. They have a couple of employees who are capable of making this eventually approximate the original design.

<comment><USER4> He said his development team was working on a optical flow sensor and he showed us slides of his workshop. Perhaps they're selling a 3rd party until they can provide their own?

</comment></comment></comment></comment><comment><USER6> This is very interesting. A friend of mine is trying to make an Arduino quadcopter so he can learn the framework. It's already functional, but there's still some work to do like stabilization algorithms and GPS stuff.

<comment><USER7> Check out these guys at ETH Zurich. They have an open source quadrotor control package, though their main product is an optical flow sensor.

[https://pixhawk.ethz.ch/](https://pixhawk.ethz.ch/)

<comment><USER5> I would characterize their main efforts as building a modular autopilot software & hardware infrastructure, for which the optical flow sensor is one part. They are both an academic research group & generous providers of an open source platform competitive with the best out there.

Also check out Openpilot & Paparazzi--of which [http://transition- robotics.com](http://transition-robotics.com) is a good current example.

</comment></comment></comment><comment><USER8> Are all Drones so loud? Is there any possible way to make the quieter? Even silent? Looking through the videos and reading a bit it sounds like an issue is with the gears or motor producing the majority of the sound.

<comment><USER9> I'm assuming you're referring to fixed-pitch hovering drones. There, most of the noise is made by the propellers. For reference, running a quadcopter at full blast with no props on is pretty quiet.

There are some optimizations you could theoretically do by moving to variable pitch, and trading off pitch for RPM (or the other way around, I don't fly helis myself)

<comment><USER8> Yes, sorry I should have been more specific.

After researching the blades a little further is seems a company called eurocopter did find a way to reduce the noise made by the propellers [1]. Heres a video of the difference between the two blade types [2]. Do you think this would be applicable to the blades at the drone level?

[1] [http://www.wired.com/autopia/2010/02/eurocopter-moves-one- st...](http://www.wired.com/autopia/2010/02/eurocopter-moves-one-step-closer- to-whisper-mode/) [2] [http://www.youtube.com/watch?v=dBS1NRsYuF8](http://www.youtube.com/watch?v=dBS1NRsYuF8)

<comment><USER9> Helicopter propellers are typically even louder, since the tips are going supersonic (due to the diameter of the propellers). The trademark "chop chop chop" sounds, as far as I know, are caused by sonic booms. The tech you're linking to is about minimizing the source of sound for the sonic boom.

Airplane and drone props are entirely subsonic. They make a lot of noise when the pitch is significantly different than the speed that the airplane "should" going at. In other words: if you imagine a propeller cutting through butter, there is a certain distance it would go in one rotation. Propellers are loud when they're going significantly over or under that distance. Also - I'm just a hobbyist, so my explanation may not be correct.

This effect is especially noticeable with fixed-pitch propellers used for hovering.

For reference, check out these videos. Note that airplanes have 1D variable pitch.

[1] [http://youtu.be/e8nYZ-fMSHg?t=1m5s](http://youtu.be/e8nYZ-fMSHg?t=1m5s) \- note the sound at 1m12s

[2] [http://youtu.be/QB6vtE3rIrQ?t=9m15s](http://youtu.be/QB6vtE3rIrQ?t=9m15s) \- note the sounds at 9:25 and 9:53.

For more examples, see [https://www.youtube.com/results?search_query=propeller+taxii...](https://www.youtube.com/results?search_query=propeller+taxiing)

</comment></comment></comment></comment><comment><USER5> This "community" while having been around for awhile is controlled by an autocratic self promoter who uses it to sell his stuff, & longs to sell out the community to the fullest extent of his abilities. Note the content of the main real estate of the front page versus the wider interest of the broader community.

For the higher quality stuff & open source in good faith goods, google PX4 ETH native (not the Ardupilot version ), Openpilot, & Paparazzi.

J

</comment><comment><USER10> I'm thinking they should add a 'legal' page, where they can notify potential UAV pilots of laws they might break accidentally when flying these things. I'm sure there are a few regional restrictions in addition to any federal ones.

<comment><USER11> Would be better to have a Google Maps embed tagged with "Areas of Interest".

That'd probably motivate the legal page even more, though.</comment></comment>


Status Board - <AUTHOR> http://panic.com/statusboard/ <comment><USER2> I'm always underwhelmed by these things because I think they are solving the opposite problem to the one that needs to be solved. The basic premise is that it's possible to pick a collection of important things and put them on one screen. And it's interesting from their example how poor that selection is: there's a huge amount of space wasted on time, there's a specious graph of inbox depth and a useless graph of sent emails.

I believe that rather than gathering information together in one place we are far better served by ambient information (a small example: [http://blog.jgc.org/2012/03/ambient-bus-arrival-monitor- from...](http://blog.jgc.org/2012/03/ambient-bus-arrival-monitor-from- hacked.html) and my as yet unwritten up ambient weather display). Then information that's useful becomes part of the environment.

So, then I ask myself why this has been upvoted so much. And I think the answer is because it _looks good_. It's all shining and new-car-smell.

<comment><USER3> I think my favorite example of "useful information now" is Google Now.

I love how when I search for a place on Google Maps, my phone or tablet assumes I want to go there soon and gives me a driving time estimate and an option to start navigation.

I also find it very useful when my web searches and linked accounts are taken in context: searching for a flight brings up the flight details on the day of the flight, and Google Now automatically pulls up my daily upcoming events so I don't forget.

<comment><USER2> Yes. There's a multi-billion-$ startup to be created that can deliver 'relevance' like that.

<comment><USER4> And it's not only knowing what is relevant - I used to use some nokia phone and it would show my meetings on the sign in screen - so I know when I was going to get interrupted. With my iPhone, technically superior in every way, I have at least three clicks or swipes and I never know what my day is shaped like.

Luckily I use it as an excuse to get my head down and work.

But the point (another long one!?) is iPhones UI whilst much lauded, misses some useful functionality - and that will become more more painful as relevance becomes achievable

<comment><USER5> That sort of thing is available if you jailbreak.

</comment></comment></comment></comment></comment><comment><USER6> Actually pretty unimpressed, and I usually like most things Panic makes. The UI seems like gloss for the sake of gloss, and it is very hard to parse too. What's with the super-bright colors and super-bright whites on a super-black background?

Not only that but Emails Sent seems like a useless vanity metric, so I'm surprised it made the demo screenshot. Is anyone really going around thinking that they need an emails sent dashboard?

And is it a personal status board or a team status board? Do I really need to see a MacRumors feed on team board? And a clock? All in the screen space of an iPad? Seems like they went with a "hey what can we put on this screen" design process instead of things a team _really_ needs.

Edit: I wasn't sold when Dashing[1] first launched, but the demo[2] that siong1987 posted seems pretty promising.

1: <http://shopify.github.io/dashing/> 2: <http://dashingdemo.herokuapp.com/sample>

<comment><USER7> "Not only that but Emails Sent seems like a useless vanity metric."

We use it on our board to track the volume of support e-mails going out the door for each support agent. It's very useful!

<comment><USER8> If you measure something, people will adapt their behavior to what you're measuring. If you measure productivity by volume of mails, people will try to increase the volume of mails at the expense of what is in those mails.

From that perspective, I think dashboards are useful as a sort of warning signal for things going wrong, but not as indicators of whether things are going right. So, the right way to approach it in my opinion is to measure whether mails are being sent at all, because that would indicate a major issue.

<comment><USER9> You're assuming it's a productivity measure and not a "sheesh, Bob looks like he could use a hand today" sort of thing.

</comment></comment></comment></comment><comment><USER10> ...or you could get an Android for much cheaper and install some home screen widgets.

Apple fanboys insist that Android features, such as widgets, are unnecessary. Then they go crazy over iPad dashboard apps that weakly simulate Android functionality.

<comment><USER11> How do you know that those who insist widgets are unnecessary are the same people who go crazy over iPad dashboard apps?

Really though: as an Android and iOS user, widgets are almost always sub-par compared to a regular app. I highly doubt that you could get as good an experience with widgets as you could with a dedicated app by Panic.

</comment></comment><comment><USER12> Is there any app like this already out for desktop Macs? I have an old iMac that I would love to repurpose for a status board.

I was considering throwing together a one-off webpage with a bunch of favorite sites in frames that refresh, but that wouldn't be nearly as nice to look at as an app like this with prebuilt widgets that are designed to be laid out in a fullscreen grid.

I wanted to just use Dashboard, but it is really slow (widgets seem to freeze for minutes at a time, and Web Clips randomly fail to work for no apparent reason).

<comment><USER13> I want something which lives "inside the firewall" vs SAAS, too, since a lot of the metrics I want to track are on servers which I wouldn't want to have touch the Internet bareback.

<comment><USER14> I agree with this. Have VPN, will travel.

</comment></comment></comment><comment><USER15> I guess that was why they were playing with video out adapters and wrote about the shortcomings of the lightning adapter a while ago in their blog: [https://www.panic.com/blog/2013/03/the-lightning-digital- av-...](https://www.panic.com/blog/2013/03/the-lightning-digital-av-adapter- surprise/) .

</comment><comment><USER16> The biggest problem with this release is how few modules are available. I see no end to the native modules they could make as in app purchases –– and that's not necessarily a bad thing. OmniFocus, Charles Schwab... these are just a few of the modules I would want before buying this app. Until then, I'm holding out.

</comment><comment><USER17> It is pretty, and probably looks great on Retina screens. I would be worried though (and would include a "light" theme) when displaying on TVs. Black levels on most low to midrange TVs are notoriously bad, and even worse in high light environments - like it would be if you placed this in your company's lobby.

<comment><USER18> Agreed, I don't know if I'd be able to sleep if my status was displayed on anything with less than a 20000:1 contrast ratio

</comment></comment><comment><USER19> Panic has a history of doing "Status Boards" for their internal use. I assume that they did this project for their own needs as much as to create a new product.

Three years ago they described creating a status board using a large Samsung screen with an embedded copy of Windows XP running Chrome:

<https://www.panic.com/blog/2010/03/the-panic-status-board/>

It is amazing the polish that they put on tools for internal consumption.

</comment><comment><USER20> You must pay extra for HDTV out? What?

<comment><USER21> It's a feature that adds value. They are capturing that value via an in-app payment. If the value you would receive from this feature is less than the asking price, don't pay for it. Pretty simple, really.

<comment><USER22> Do users also have to pay extra to get audio through the headphone jack?

One could argue that all features add value. Should all features then be à la carte via in-app purchases? That'd be absurd.

Things can be both absurd _and_ simple. Really.

<comment><USER23> You can probably use the iPad's builtin hdmi out feature for free, but it will output an iPad-shaped display. The one you pay for will dynamically resize to fit the screen it's attached to and display different stuff. Not a huge difference but it isn't like they did NOTHING for the feature.

</comment></comment></comment></comment><comment><USER24> This is great, but I have to sacrifice a perfectly good iPad to run on the TV out. This would be perfect if the Apple TV allowed apps.

<comment><USER25> If you look at it the other way around, early adopters who bought the iPad 1 finally may have a use for it (the app runs on iOS5).

</comment></comment><comment><USER26> It looks great, but its pretty cost-prohibitive.

After all the problems with Coda 2, I'm hesitant to fork out money up front for something from Panic that _looks_ fancy, but I have no idea how reliably it performs.

<comment><USER27> Yeah, god forbid you're out the price of lunch and aren't 100% happy with what you got.

<comment><USER26> Happens all the time when I eat at Taco Bell. Yet I keep going there...

</comment></comment></comment><comment><USER28> Customer Reviews #1 "Buggy, crashing constantly after the first launch This may be an interesting app, but I can't tell because it cashes as soon as it launches. Not ready for prime time."

QA must be quivering.

</comment><comment><USER29> If you are after something similar to run on a TV without having to buy an TV + Apple TV + iOS Device - the guys over at Librato [1] have a post about how they turned a $50 Android mini PC into their office dashboard

1\. [http://blog.librato.com/posts/2013/03/how-50-can-turn- your-t...](http://blog.librato.com/posts/2013/03/how-50-can-turn-your-tv-into- dashboard)

2\. <http://www.rikomagic.co.uk/>

</comment><comment><USER30> It reminds me of <http://ducksboard.com/>

</comment><comment><USER31> Section 11.8 of Apple Store Review Guidelines

"Apps that use IAP to purchase access to built-in capabilities provided by iOS, such as the camera or the gyroscope, will be rejected"

How'd they get around this rule for the AirPlay unlock?

<comment><USER9> That may be the reason they brag about it dynamically reformatting the dashboard to work on a TV.

</comment></comment><comment><USER32> Oh, this looks wonderful. Impressive that there's already third parties catering to it: <http://www.stathat.com/docs/statusboard>

</comment><comment><USER33> I find it quite funny that their FAQ says about showing the temperature in Celcius, but not "Is there an Android version coming?".

So... if you're an android developer, you know what product I want you to clone?

<comment><USER34> Why is it funny that their FAQ has an answer for Celsius? It's pretty much only the US that uses Fahrenheit for temperatures, the rest of the modern world uses celsius to display temperature. That coupled with the fact that Panic are a renowned Apple-based developer, should indicate really that there's likely no chance of getting a Panic-developed Android version.

<comment><USER33> Funny because it's a trivial feature that's actually implemented, just obviously in a slightly confusing way that someone's asked about it.

They're famous amongst HN readers, but not amongst people who might land on their site googling for "status board tablet"

<comment><USER35> It's really not trivial to those of us outside the US (Fahrenheit is meaningless to me), and enough US developers are US-centric enough that it sadly doesn't go without saying that they would support Celsius.

</comment></comment></comment></comment><comment><USER36> Why would I choose to use this over a web based dashboard? A web service could be used from any device, code can be updated more rapidly, and I won't be locked into Apple's sandbox.

</comment><comment><USER37> I really like the idea of this but I don't think it's _quite_ right for me. It's incredibly handsome, and I have been looking for, essentially, a one stop shop 'this is what's happening and happened for X hours' to give me a high level overview. This looks close, but not quite there.

Tempted to buy it still, I might be able to tweak it to get it close. Panic software is rarely a disappointment (and Prompt is fantastic, with the few niggles I've had mostly disappearing).

</comment><comment><USER38> It worked out my location (nice) but didn't bother changing dates and temperature to metric/local format so it immediately looked confusing.

</comment><comment><USER39> Another take at dashboards is what we're taking with manager's team dashboards at Weekdone: [http://blog.weekdone.com/be-a-better-manager-new-team- dashbo...](http://blog.weekdone.com/be-a-better-manager-new-team-dashboard/)

What we're trying to do is connect analytics dashboards to real actionable people behind some nice graphs.

</comment><comment><USER13> This looks really interesting, especially the AppleTV support (a great device to use for digital signage/etc. applications)

<comment><USER40> Are they actually supporting AppleTV? I was not aware that AppleTV apps existed. There seems to be some speculation that they are coming this fall. Perhaps Panic knows something we don't?

Edit: The App Store only says "Compatible with iPad. Requires iOS 5.0 or later.".

<comment><USER26> Apple gives developers a way to stream unique content to AirPlay, separate from what's on the iPad screen.

</comment></comment></comment><comment><USER41> You guys are like native americans with shiny baubles :)

I love Panic and I am sure this is excellent app, but... wait a week or two, there will be a sale or something for sure. BTW, I am not buying this, I would go with open source things someone posted in comments. Because it is free to use and flexible.

<comment><USER42> That's a narrow and one sided view of history.

I don't see much point in any further derailing of the discussion, but I don't think you picked a great topic for your humor.

<comment><USER41> I apologize if this offended you in any way, I think you get that I am mocking apple fanboys and their love for shiny things.

Disclaimer would be that I have a lot of apple gadgets and am happy owner of several Panic sw titles.

<comment><USER42> I'm not particularly offended. But basing your mockery in a crass stereotype isn't really necessary.

Basically, I'm assuming you are a decent person and hoping that you might think a little more about whether native Americans deserve to be stereotyped as foolish.

</comment></comment></comment></comment><comment><USER43> Interesting... How did they manage to work around item 10.4 of Apple's guidelines?

<comment><USER44> From their twitter, "Our best guess: non-interactive. Read-only status. Not "widgets" per se."

Source: <https://twitter.com/panic/status/321846592921534465>

<comment><USER45> I have a hard time believing they built this before checking if it would make the app store. That's at least the vibe I get from this tweet.

<comment><USER44> Right, if you follow the conversation, they also replied this afterwords, "But at WWDC they couldn't tell us either way! "Submit it and find out", was the advice. So we did."

<https://twitter.com/panic/status/321846667030695937>

</comment></comment></comment></comment><comment><USER46> A few months back on HN there was a similar project that ran wholly in bash, and displayed widgets based on push and pull HTTP. Does anybody remember the name of the submission?

<comment><USER47> I believe you're looking for Hubble: <https://github.com/jaymedavis/hubble>

<comment><USER46> That's it, thanks.

</comment></comment></comment><comment><USER48> Interesting that it has a panel where you can provide your HTML. I'd have thought that would be against Apple's rules (haven't looked into how restrictive the HTML renderer is)

<comment><USER49> It's totally acceptable and very common: [https://developer.apple.com/library/ios/#documentation/UIKit...](https://developer.apple.com/library/ios/#documentation/UIKit/Reference/UIWebView_Class/Reference/Reference.html)

<comment><USER50> That's where the dev provides HTML, this is where the user provides HTML.

<comment><USER51> You could load any website using UIWebView, what's the difference if user provide the HTML?

<comment><USER52> Probably earned them a 17+ rating.

</comment></comment></comment></comment></comment><comment><USER53> Obvious has a nice write-up of a similar tool they never shipped. [1]

[1]: <https://medium.com/didnt-ship/3002a2aaac50>

</comment><comment><USER54> Less bling and more function for us. We use Librato Metrics to report on anything that moves. It makes it very easy to pick our aberrations and monitor trends.

</comment><comment><USER55> Panic's previous foray into this space: <http://panic.com/stattoo/>

Not many panels. Payware that was abandoned in 2006.

</comment><comment><USER56> Seeing shiny effect as used in this app makes me realise how much I appreciate the trend towards a much simpler, flat design in software.

</comment><comment><USER57> Judging by the "Nowy Sacz" location, I am guessing it's a Polish application. Makes me pretty happy :D

<comment><USER58> They just use GeoIp to show your currently location there.. For example, they showed Penang for me :-)

<comment><USER57> Oh. The rest of the data didn't really seem related to my location so I thought it was a screenshot. Especially since Nowy Sacz is more than 200km from me, normally my geoip shows Krakow, Nowy Sacz is much much further away.

</comment></comment></comment><comment><USER59> I think these apps should be called "Status Bored", because they are most useful when you 're bored.

</comment><comment><USER60> Woah! It's Dashboard for iOS! ;)

</comment><comment><USER14> This would be a great app if they released it for Android and Roku as well.

</comment><comment><USER61> Would be a great native app for AppleTV. Hope Apple does that soon.

</comment><comment><USER62> "clook"

</comment><comment><USER63> tough crowd.</comment>