What the world can learn from the UK's A-level grading fiasco - <AUTHOR> https://blogs.lse.ac.uk/impactofsocialsciences/2020/08/26/fk-the-algorithm-what-the-world-can-learn-from-the-uks-a-level-grading-fiasco/ <comment><USER4> In reality, I think this fiasco has more to do with politics than algorithms. One of the big problems is that the alternatives had downsides which were largely glossed over for political reasons - for example the university growth cap isn't just an arbitrary creation, it exists to stop more prestigious universities siphoning off a disproportionate share of students and leaving less prestigious ones in deep trouble and this seems likely to happen now.

Another big problem is that private schools seem to have made more realistic predictions of their students' results than state schools, as demonstrated by the fact that just taking many of their predictions as-is only caused slightly more grade inflation than in the state school results where 40% were downgraded - and this was portrayed in the press as proof that it was an attack on state schools because their results were disproportionately affected by the algorithmic downgrading.

A third problem is that what it was OK to be concerned about varied depending on which political side it benefitted. For example, there was a completely false and made up claim on social media and in publications that should know better that the Education Secretary had said taking the results would cause students to be promoted into jobs that they weren't competent to do: [https://fullfact.org/education/gavin-williamson-fake- quote/](https://fullfact.org/education/gavin-williamson-fake-quote/) I can't imagine that it would've gone down any better if he claimed students would get onto courses they weren't good enough for, yet a week later after GCSEs went the other way and used predicted results that exact claim was uncritically regurgitated by the media.

<comment><USER5> It seems like a classic political no-win situation: if you go with an algorithm then anyone who gets a lower than predicted grade is going to complain (and of course has every right to, as any algorithm is likely to unfairly disadvantage some section of the population). If you give everyone their predicted grades then you're accepting massive grade inflation which makes the grades far less useful as a predictor of a student's ability which then means lots of problems further down the line.

<comment><USER6> However, the unfairnesses of the two options are very different. On the one hand, you leave it to educators and employers to select candidates based on unreliable grades, versus excluding swathes of the population from opportunity. Leave it to decision-makers that seem to fetishise exam grades and you come to what I'm sure the vast majority of people regard as the wrong conclusion. Yes, there would have been fallout, but so much less toxic had they chosen otherwise.

<comment><USER7> > On the one hand, you leave it to educators and employers to select > candidates based on unreliable grades, versus excluding swathes of the > population from opportunity.

That "versus" is unwarranted - unless everyone is given top marks, exclusion happens in either case. In fact it would happen in that case as well, as top colleges (practically by definition of 'top') cannot accept everyone. All you've done is changed who gets excluded, by not adjusting for differing school grading.

> decision-makers that seem to fetishise exam grades

Calling it "fetishizing" is a fine way to suggest there's something wrong with it, without stating what, or how to improve it. Would it be better if, instead of on the basis of grades, students were judged based on who they know, or how much they can donate to the college?

<comment><USER6> Ofqual Chairman Says It Was A "Fundamental Mistake" To Believe Algorithm Grades "Would Ever Be Acceptable" [https://www.politicshome.com/news/article/ofqual- algorithm-m...](https://www.politicshome.com/news/article/ofqual-algorithm- mistake-williamson)

<comment><USER7> "Students will now receive grades based on their teacher's estimate of what their grade would have been"

But if those estimates are improved using statistics, there's a political fallout. There's _some_ valid criticism of the algorithm used (far less than that BBC article tries to imply), but there's no question the algorithm's estimates were more accurate.

So much ink was spilled calling the algorithm biased for its 4% increase in A-grades for independent schools, yet teacher's 40% increase of grades above the expected average is... what? Unbiased?

On any other topic, such a position would be called "anti-science".

<comment><USER6> There's a fundamental asymmetry here. Fail a student unfairly, and the harm to them is potentially irreparable. Pass more than usual, and you increase competition for places and while there's certainly some unfairness there, the system will ultimately compensate through interviewing, delayed starts, etc.

<comment><USER7> > the system will ultimately compensate through interviewing, delayed starts, > etc.

A roundabout way of saying that some students that would have been accepted to their chosen college, won't be, because their grades weren't as inflated as their competitions. Isn't that also potentially irreparable harm, not just "some unfairness"?

<comment><USER6> There's a massive difference between not getting your preferred place and being denied the opportunity even to apply

<comment><USER7> So you would consider using the algorithmicaly adjusted grades an improvement, _if_ in case of a failing grade, the teacher's estimate was used instead?

And a follow-up question: How many such cases were there? Where the adjusted estimate failed a student, but the teacher's estimate didn't?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This virus situation has (or will) produce a lost year of productivity. But people don't want to admit that and are still trying to operate under old constraints or processes. It will break somewhere. They want to keep schools running, and years / classes of students progressing through. But they also want to have some semblance of standards, without being able to teach properly or assess progress properly. All these factors cannot be simultaneously satisfied.

As others have said, you might just have to drop standards and have a lottery, or open enrollment. Putting in these ridiculously bad algorithms is worse than falling back on random chance.

High school/university is where it becomes easiest to hide behind bad logic and less obvious consequences. I hope we're not going to do the same for doctors, pilots, etc. and just let them pass the test because classes were canceled.

<comment><USER9> It's not about passing the test though, it's about sorting out who gets to go to university and who doesn't.

If the training of pilots one year was compromised so none of them could certified, we'd go a year without certifying any new pilots. We'd cope somehow. Universities can't go a year without any new students though, that's just not a reasonable outcome.

On the face of it basing grades on predicted outcomes and adjusting for the historical record of specific schools to overestimate those predictions seems to be a pragmatic approach.

<comment><USER10> You can't learn to fly without really flying (although that is also probably arguable - there should some skills which are transferable from simulators). However a lot of western higher education is based on giving enough info on how to study yourself.

</comment></comment></comment><comment><USER11> Serious question: Why weren't the exams taken?

Everything I have read about this glosses over this critical bit which I am very curious about. I understand there is/was a worldwide pandemic and all of that, but it feels to me that there wasn't necessarily a reason exams couldn't be taken in socially-distanced class rooms (with students wearing masks, as well as the teachers, of course) or if needed be in repurposed venues, like football stadiums (leaving plenty of space between students).

Was there a concern for fairness should the exams proceed? Or was it safety? Or did the government put their foot down on no exams? Or was it the teachers/unions? What happened?!

<comment><USER12> > it feels to me that there wasn't necessarily a reason exams couldn't be > taken in socially-distanced class rooms (with students wearing masks, as > well as the teachers, of course) or if needed be in repurposed venues, like > football stadiums (leaving plenty of space between students).

Exactly what you're proposing just isn't feasible, because of the sheer numbers. I see American posters on reddit complain about having to do a handful of finals at the end of high-school, and the SAT/etc as well, which I understand is optional.

"In my day..." (wow I'm old... this was only about 12 years ago) my sixth-form had about 1,300 students (650 in yr12/L6, 650 in yr13/U6). Most L6 students did 5 AS-level subjects and 4 A2 subjects. Most subjects are then comprised of modules (e.g. In mathematics: Pure P1/P2/etc, Stats S1/S2/S3/etc, Mechanics M1/M2/etc, Decision/Discrete D1/D2/etc), and each module has its exam at the end of the term/trimester.

In my case, I took 5 subjects at AS-level (L6) and had no less than 8 exams in the May-June of my first year. Multiply that by 1,300 - with probably over 100 different exams. That's almost 11,000 Covid-safe exam-sittings that need to be arranged.

Social-distancing regs mean that you need _four times the floor-space_ for an exam room than previously (doubling distance from 3 feet to 6 feet in both directions). Doing exams outside on a field wouldn't work: inclement weather and even a gentle breeze and writing on paper difficult and distracting. Doing it indoors means you'll not only fill your sports-halls and cafeterias (which we did every year anyway) and need to spill-over into smaller classrooms - which means you need many more exam invigilators.

...and invigilators, in my experience, tended to be older people (60s-70s) - often recent retiree teachers. The exact same people who are quite legitimately fearing for their life over Covid so we can't blame them for choosing to stay home.

...so we have a 2-month long period where schools and colleges need 4x the space and with far fewer authorised staff to oversee it.

Some schools will be able to handle it, others won't. If it's a combination secondary-school + sixth-form then they'll also need to handle GCSE exams for the yr11 kids and SATs (unrelated to the US SAT exam) for the kids in yr9. Additionally schools also have "mocks" for yr10 (mock-GCSEs, but they still count towards your score in yr11). There may also be additional testing done for other years at the county-level. So that's another few thousand exam sittings to add to that. My secondary-school sent the Yr7 and yr8 kids home for a week if they were overloaded with handling exams for so many. So if the LEA/exam-boards were to press-on with the exams then that's unfair to the kids at schools that don't have the capacity.

——-

Grading "by algorithm" - especially when that algorithm isn't public - <USER2> probably even we'll-understood by the MPs in-charge - is a bad idea, yes. But I can't think of a workable alternative: people's lives should not depend on the outcome of exams - but we can't trust teachers own subjective grading of their own students to be necessarily and sufficiently objective enough. There's no economically-viable solution to this problem - even without a pandemic going on.

——

Now that I think about it - I suppose _one_ option would be still do in-person exams, but only do the core/essential exams for the most important course modules and use that as the basis for university admissions - so if this pandemic happened 12 years ago I'd only sit the P1/P2/P3/etc exams for mathematics and disregard Mechanics/Statistics/Discrete - ditto for physics, and so on. So the exam load would drop from my estimate of 11,000 to maybe 7,000-ish - I don't think that would be small enough to manage still)

<comment><USER13> This was feasible here in Poland and some other European countries managed to proceed with exams seemingly safely as well.

</comment></comment></comment><comment><USER14> It's hard to see how the algo could do anything but disappoint. If you don't have the exam information, what information have you got left? Just results from previous years, and a guess as to where you might be in the class, from a teacher who doesn't want to disappoint anyone.

But people have since forever seen exams as a way to stand out from the crowd, individually. If you went to a bad school, exams were a chance to show some extra effort. If you were a slacker, you'd be found out.

Without the specific exam results, all you've got is the reputation of the school, and chances are variation within a school is greater than between.

</comment><comment><USER15> The problem was not using an algorithm, it was that they used a crap algorithm that could award students grades that were higher than those even available on the paper that they sat, and made it impossible to get a high grade if no-one fromm your college got one before.

I'd love to see the details of the algorithm itself. Surely it can't have been too difficult to put some guard rails in there to prevent it moving any grade more than say, two places (maybe even one) from the predicted grade.

Instead it seemed to have the freedom to do whatever it liked. Moving Bs to fails. Students predicted to fail getting As.

That's just incompetence on the part of whoever made that algorithm.

<comment><USER16> _and made it impossible to get a high grade if no-one fromm your college got one before_

Well that is unlikely. If you are going to handle it algorithmically then what else would you expect. Clearly the teachers can't be relied on because now everybody is getting an A*, the grades are effectively useless as an indicator.

I was disappointed although not surprised that the government caved on this.

<comment><USER17> It's not unlikely, it's practically certain. If you have hundreds of schools there absolutely will be a handful of students who do better than previous years and there will be a handful of students who do worse than ever before. Maybe it's not a big deal to hand a C to someone deserving of an E, but it's certainly a big deal that the moron at the school that gets good grades (read: private school) gets a pass, whilst the genius at the school that historically did badly (read: state school) gets screwed. Now, given that's how this system works, take a look: do you think the politicans repsonsible for this went to the state school?

<comment><USER16> There are always outliers.

Interestingly the private schools seem to be to be grading their students more accurately, the problems were more common in state schools. The moron in a private school was unlikely to get their grades inflated. I'm not a fan of private schooling but in this case they appeared to be doing the right thing.

There will always be outliers, no system is perfect but what we have just done is worse in my mind.

</comment></comment></comment></comment><comment><USER18> We know that university admissions is a very poor, deeply flawed process. That people object this year but didn't object last year is very telling. It shows that people will happily accept a bad system with poor results AS LONG AS they are given some small illusion of personal control over that system. As long as people can say "people like me are very unlikely to do well BUT _I_ will be fine because I will work harder than people in my group do" they're happy, even though they are by definition wrong most of the time.

<comment><USER19> The students just wanted to be measured against the objective standard that they were promised.

This doesn't require assumptions of naïveté on their part about equality of opportunity w.r.t teaching quality, schools resources and so on.

</comment></comment><comment><USER20> Well, what can we learn from this? That it's not a good idea to simply assign a grade to someone for an exam they didn't take, and it's an even worse idea to base this grade only partly on their own performance? And, if you are going to do it, you'd better make sure that the grades exceed the students' expectations, otherwise of course there will be protests...

</comment><comment> 076ae80a-3c97-4 The only true fair solution would be to put everyone back at least a year and wait until the exams can actually be done. In the mean time they could've invested the energy in getting an online exam system working and improve/innovate online learning mechanisms so that if we go back into lockdown again they are ready for it.

<comment><USER9> I don't think doubling the size of the classes in the year below, and forcing schools to retain an extra year's worth of students is at all practical or would actually solve any problems. Let alone all the new problems it would create. What do Universities do if they have a whole year's worth of students just not show up, then suddenly gets two years worth come in at the same time?

I suspect you've not actually thought this through.

</comment></comment><comment><USER21> That anyone ever thought it was a good idea boggles the mind. Random lot would have been better.

<comment><USER22> Oh think of the natural experiment if you randomly assigned Universities to students.

Awful, unethical, but fascinating

</comment></comment><comment><USER23> Recent and related: [https://news.ycombinator.com/item?id=24185621](https://news.ycombinator.com/item?id=24185621). I feel like there may have been others?

</comment><comment><USER24> How did they deal with this problem in other countries, say Ireland or Japan?

<comment><USER4> It looks to me like Ireland was planning on using literally the exact same process, but after it caused such a political problem for the UK government they announced that data on how schools had previously performed wouldn't be used in the standardisation process: [https://www.citizensinformation.ie/en/education/state_examin...](https://www.citizensinformation.ie/en/education/state_examinations/leaving_certificate_2020_calculated_grades.html) (Notice how the linked explaination document from May 2020 says this would be the basis for the calculated results.) How that's meant to work I'm not sure. The results aren't out yet.

<comment><USER25> Additionally Scotland had an similar issue - algorithmically adjusted grade estimates were discovered to have punished kids from poorer schools. This happened a few weeks earlier than the English A-Level results, which is interesting because the ruling party in the rest of the UK:

1\. took a GREAT deal of pleasure in loudly trashing the Scottish government in the press ...

2\. knew they faced the EXACT same issue themselves ...

3\. did absolutely nothing about it ...

4\. then did a frantic cleanup of the attacks (deleting tweets and such) after the English debacle unfolded

At this point I shouldn't be surprised. It's to be expected - they're politicians playing their little game. But this debacle was avoidable - <USER3> could have faced the music earlier and started coming up with an alternative, but they chose instead to gloat, score a cheap win and kick the metaphorical can down the road.

</comment></comment></comment><comment><USER26> Why not just hold the tests, except outside and far apart. They have stadiums and stuff. Honestly, this whole thing seems like a manufactured problem.

You could hold them outside, and stagger them so there are ten papers, and then just normal-curve-adjust to the first paper.

Other countries already do multi-day tests easily. And if you don't want to do curving, just treat it the way you treat GREs/IELTS/TOEFL etc. Don't curve and just use overall percentile.

<comment><USER27> Maybe cheating? It would be easier to sneak a peek at your smartphone if one proctor has to cover an acre of students.

<comment><USER28> if you can cheat a test off a smartphone its probably not a good test

<comment><USER27> Cheating via smartphone can encompass anything from directly looking up an answer, to sending someone the essay prompt and having them send you a completed essay which you just copy down.

Can you name a good test by your standards?

</comment></comment></comment></comment><comment><USER29> Having worked with engineers and software managers in the UK Government, it doesn't surprise me that this was such a fuckup.

The solution would have been not to completely close schools in the first place - there was no evidence that children were particularly susceptible to COVID or at risk then, and there's lots of evidence now that they aren't. Exams could well have taken place as normal - exam halls are, by definition, socially distanced.

<comment><USER4> Not closing schools was the government's preferred option for exactly the reason you point out. Unfortunately, the teachers' unions had different views on the matter and it's rather difficult to keep schools open without teachers, especially when they can easily just carry out a mass sick-out. Exam halls are probably a bit of a transmission risk though since they involve a bunch of people who wouldn't normally mix sitting in the same room sharing the same air for a few hours.

<comment><USER30> Also once the schools have been closed it becomes a lot harder to properly prepare the pupils for the exams.

<comment><USER25> You're right and this is often ignored - the few weeks or so prior to exams where the curriculum is largely over can significantly change your grades</comment></comment></comment></comment>


Ask HN: Has anyone used TextMate 2 recently? Did you face any issues? - <AUTHOR>

<comment><USER2> I used to code in it pretty regularly as for a 2-3 months ago, and it was pretty solid for my usage (but I wasn't doing anything too crazy with bundles).

But since then, including the recent beta, I've only been using it fairly sparsely -- not because of anything TM did wrong, just a change in what I'm working on for now.</comment>


Show HN: PandwaRF – RF Hacking Tool with Sub 1GHz RF Transceiver, BLE and USB - tania-b https://github.com/ComThings/PandwaRF/wiki <comment><AUTHOR> As someone with some but not much exposure to RF, can anyone shed some light on how this is different from a regular transmitter/receiver hooked up to a pi (I've done just this with a pi zero for ~$20) and what the use cases for this might be?

<comment><USER2> It's an SDR, so it can transmit and receive over multiple frequencies. It's basically a programmable transceiver that can be used to interact with many different protocols and transmission encodings on different frequencies. Looks like it also has some specialized abilities for security stuff, e.g. brute forcing RF codes.

<comment><USER3> Technically I don't think it is an SDR, as it's not using software to generate arbitrary modulation schemes. The chip is capable of transmitting data through certain modulations.

[http://www.ti.com/corp/docs/landing/cc1111/](http://www.ti.com/corp/docs/landing/cc1111/) \- is the chip they're using.

<comment><USER4> Yes, it is not a SDR because CC1111 doesn't send the I/Q samples, so no custom demodulation possible. Only support some standard modulation AM/FM/FSK, ...

</comment></comment></comment></comment><comment><USER5> This is perfect timing for me, as I've been experimenting with the Texas Instruments CC110L attached to an ESP8266 running the Arduino stack. I started on this after having written an SDR receiver application to receive my electric and water meter readings using an expensive rtlsdr dongle and a raspberry pi. Thanks for sharing!

<comment><USER6> What? RTLSDRs go from ~$9-$20 max (I got mine for $10 on eBay), and a Raspberry pi is $35. The PandwaRF is ~$150 USD alone. Does the CC11xx series chip in this device make a difference to your use case?

<comment><USER5> Well, I was more talking about a general device to assist in reverse engineering various RF protocols (and that was before I found the price for this device :) ). Now knowing the price, it puts it up with the YardStick One, which is probably out of my price range (I'm cheap). The CC110L + ESP8266 setup that I'm working with currently cost me about $12 shipped, combined (eBay as well).

The selling point on using the CC11xx vs. generic rtlsdr is the scanning speed. The particular protocol that my electric and water meters speak is spread spectrum with 400kHz channel spacing and 25 channels. I'm able to park my rtlsdr on a frequency and get about 1/4 of the packets (luckily there is no change in channel during packets). I've tried scanning, but the dongles I have just aren't quick enough. The meters themselves actually use the TI chips, so I know they're up to snuff.

<comment><USER6> Ah, I see. I have a HackRF and several USRPs, so I'm kinda spoiled in terms of bandwidth and capabilities. You could try combining more than one RTLSDRs into one virtual stream using GNURadio. Check this out: [http://www.rtl- sdr.com/combining-the-bandwidth-of-multiple-r...](http://www.rtl- sdr.com/combining-the-bandwidth-of-multiple-rtl-sdrs-now-working-in-gqrx/) The only catch is that it is not phase coherent, but if you're doing FSK or AM then that's perfectly fine.

<comment><USER5> I've had a HackRF on my wishlist ever since discovering Mike's awesome SDR video series. That said, I wouldn't want to dedicate the device to the meter reading (hence my trying to pare down to the bare essentials).

Funny you mention using multiple dongles, I've actually been doing just that while working out the protocol to capture as many messages as possible. Except in my case, since 2.4MHz gets me exactly 6 channels, I can just run multiple instances of my application, each looking at their own 2.4MHz chunk of spectrum. No need to truly synchronize them.

</comment></comment></comment></comment></comment><comment><USER7> Another RF neophyte here - what's the selling point or applications of an RF transceiver over the 300 - 928 Mhz band? It looks like those frequencies were used for TV broadcasting but the spectrum has been reallocated, and there's not a lot of unlicensed space to play with. Given this what kind of applications are there for this device?

</comment><comment><USER8> Just to make sure I understand - the advantages of the PandwaRF compared to the HackRF would be: (a) price (b) size (c) battery-powered?

<comment><USER4> I would add: (d) BLE connectivity (e) Android App (f) Easy scripting (JS/Python)

</comment></comment><comment><USER9> This is very cool. Adding to wish list.</comment>


Common Language Server Protocol - <AUTHOR> https://code.visualstudio.com/blogs/2016/06/27/common-language-protocol <comment><USER2> I think Visual Studio Code introduces much better extensibility philosophy than Visual Studio.

Of course VS is old product and has some legacy we have to excuse, like COM, writing tons of boilerplate code just to show item in context menu, etc., but I mean philosophy of being friendly to everyone, regardless of underlying technology, is very important. For instance, writing language service, in C++ or C# only is a real limitation for some languages and prevents many languages of being integrated, so "Common Protocol for Languages" is right decision.

From another side, Visual Studio is very powerful in terms of customization. Creating virtual item hierarchy is easy (if we consider something can be easy when creating Visual Studio extension), so we have things like database project, with a lot of items, but no real files. I look forward to find similar possibilities in Visual Studio Code.

</comment><comment><USER3> Decoupling the language support from the tool will be great if it gets wider support. This would give new editors a big leg up, as they _only_ need to support the protocol and handle editing, and can lean on other parties to provide cross tooling language support. The same applies for new languages, write the server once, and get support from many tools.

The most interesting part of this announcement was who they didn't mention: JetBrains. It will be interesting to see if they come on board with this.

</comment><comment><USER4> This is cool. Presumably this could be implemented for other editors (vim, emacs, etc) so the language servers could be shared across editors.

<comment><USER5> Many languages already have something like this. For example, look into ENSIME, ghc-modi, and Racer. I guess the innovation here would be a common protocol for "any" language, but I somewhat doubt that this will have much adoption outside of the .NET/Typescript communities.

<comment><USER6> Well it's nice to know there's at least some 3rd party support listed:

> the protocol has been adopted by Codenvy, who have added it to the next > generation Eclipse IDE, Eclipse Che, as well as by Red Hat, who are working > to publish a standalone language server for Java which can be consumed by > any tool that utilizes the protocol.

> ... communities for programming languages like OmniSharp (C#), JSON, C++, > xText, JavaFX, and R have made commitments to release language servers for > their languages in the future.

Obviously we'll see if it actually happens, but at least other's are looking to support it.

</comment></comment></comment><comment><USER7> is this server protocol also responsible for syntax highlight (aka colorization) of the source code?</comment>


Will Sri Lanka Ban Facebook? President Rajapaksa Calls it a 'Disease' - <AUTHOR> http://www.nextbigwhat.com/srilanka-ban-facebook-297/

<comment><AUTHOR> It's terrible, the way politicians fear social media. On the flip side, there have been real instances of panic spreading widely through the internet.</comment>


PDFKit - A PDF generation library for Node.js. - <AUTHOR> http://pdfkit.org/

<comment><USER2> The source code is a nice read, and quite illuminating, if you've ever wanted to dig under the hood of a PDF:

<https://github.com/devongovett/pdfkit/tree/master/lib>

 _edit:_ In particular, some of this TTF font handling stuff is pretty fun:

[https://github.com/devongovett/pdfkit/blob/master/lib/font.c...](https://github.com/devongovett/pdfkit/blob/master/lib/font.coffee)

You get bonus style points for embedding PostScript in a heredoc.

<comment><USER3> Thanks Jeremy! You just made my day. :)

</comment></comment><comment><USER4> Not|soon to be confused with the Ruby gem, PDFKit.

<https://github.com/jdpace/PDFKit>

<comment><USER5> Apple also has a Framework called PDFKit.

[http://developer.apple.com/library/mac/#documentation/Graphi...](http://developer.apple.com/library/mac/#documentation/GraphicsImaging/Conceptual/PDFKitGuide/PDFKit_Prog_Intro/PDFKit_Prog_Intro.html)

</comment></comment><comment><USER6> Very nice little library: I used it to make a 5-year planner for my mother (who is one of the few who still uses such things: you can't buy them anywhere any more, presumably everyone else plans online now) this year.

Some things seem locked to integer multiples of 1/72th of an inch (so A4 comes out at 8.3x11.7 rather than 8.27x11.69 and laying out lines and text more precisely than that doesn't work) though I didn't delve into it to see if this could be rectified (by using using a smaller unit perhaps) as I didn't need more precision (which I'm guessing most people don't either). Line drawing widths and such take non-integer values fine, just not the line start/end coordinates.

Nice library though, I'll be using it again in future and may even be able to contribute. It may even be my impetus to play with CoffeeScript properly.

</comment><comment><USER7> I recently switched to using this for a web app from Prawn. The main app is in Ruby, but this was so much nicer (simpler API, much, much faster PDF generation) than Prawn for our particular use case (PDFs with lots of exact positioning of text and images) that I actually set up an entire Node server just to use PDFKit. Give it a shot if you generate a lot of PDFs.

</comment><comment><USER8> Would be awesome to be able to pass in simple text HTML like:
Paragraph here.

Second paragraph here.
.

</comment><comment><USER9> I can vouch for the quality of PDFKit, it is highly pleasant to work with

</comment><comment><USER10> Looks good and mark it.</comment>


Micrometrics for CI/CD Pipeline - <AUTHOR> https://blog.gceasy.io/2018/07/10/micrometrics-for-ci-cd-pipeline/ <comment><USER2> The title should say "Java Micrometrics for CI/CD Pipelines". Because these metrics are all for Java apps.

It's not clear how the Java app performance is related to the CI/CD pipeline performance, but maybe that's cleared up after you buy their service?</comment>


What is the best thing you've learned from HN comments and discussions? - <AUTHOR> I am surprised daily by points of view I never would have imagined existed. It's not a matter of agreeing or disagreeing; rather, it's that ways of looking at and being in the world that I would never have been aware of are all around me. <comment><USER2> I learned what you did. But, I also learned a lot of users are not seeking those things too.

Now, they get to do them, us, us. No worries, but it's kind of a shame.

We've got a smart crowd, and do hobble ourselves more than we need to.</comment>


JPM Coin Is the Wildest Big Bank Idea in Many Years - <AUTHOR> https://www.bloomberg.com/opinion/articles/2019-03-21/jpmorgan-proposes-a-wild-idea-for-crypto-and-banks <comment><USER2> If one views blockchain money in the distributed spirit of Bitcoin, the idea of a _" private cryptocurrency"_ will seem like an oxymoron. If it's a private blockchain JPM controls, JPM might as well run a traditional database. Yes, I agree.

But setting that aside, here's my best guess at what JPM is trying to do: Maybe it's not the blockchain as storage that matters but the _programming API_ that their institutional customers can use for transferring money between accounts.

Maybe instead of thinking of JPM's blockchain as a broken version of Bitcoin's ideals for public money creation, JPM's main use is to let the big customers move money on their own -- using a forked version of Ethereum (called Quorum). Some of JPM's code examples on github.[0]

There are pre-existing places where JPM customers can move financial instruments. Their dark pool exchange called JPMX is one example.[1] JPM's customers can trade stocks there outside of NASDAQ/NYSE.

But what about cash instead of stocks? I think that's what JPMCoin tries to be. Yes, their's already the SWIFT network[2] for wire transfers but I don't think banks want to expose that to account holders to the same flexible degree that the Quorum programming language would allow.

So, JP Morgan wants to enable their customers to instantly transfer money with their other customers without the legacy of SWIFT messages. For obvious reasons, they won't use the PayPal API, or the Stripe API. Instead, they use a flavor of the Ethereum API to let their customers execute "programmable money".

The real Ethereum is too volatile for business-to-business money transfers. But with JP Morgan's financial backing to reliably convert JPMCoin to $USD, that would instill confidence for account holders to use it.

In my opinion, JPMCoin isn't that revolutionary since it's only intended for their big institutional customers. Time will tell if their customers will adopt it or ignore it.

[0] [https://github.com/jpmorganchase/quorum- examples/tree/master...](https://github.com/jpmorganchase/quorum- examples/tree/master/examples/7nodes/samples/simple-event)

[1] [https://en.wikipedia.org/wiki/Dark_pool#Broker-dealer- owned_...](https://en.wikipedia.org/wiki/Dark_pool#Broker-dealer- owned_dark_pools)

[2] [https://en.wikipedia.org/wiki/SWIFT_message_types](https://en.wikipedia.org/wiki/SWIFT_message_types)

<comment><USER3> > Maybe it's not the blockchain as storage that matters but the programming > API

Even if that was true, you could easily implement a compatible API that doesn't use a blockchain under the hood, especially seeing as it is centralized by JPM.

I see this as JPM just trying to ride the hype wave, and as a contingency if blockchains go mainstream (spoiler: they won't).

<comment><USER4> You could implement a compatible API, but it turns out that consistent distributed payment systems are a hard problem, and blockchains are a solution to that.

<comment><USER5> It's not a distributed payment system, its a centralized one (owned and controlled in every way by JP.)

There's no reason to add the problems of distributed data to your payment systems unless you HAVE to.

<comment><USER4> There's distributed and there's distributed. Blockchain might be overkill, but it solves the "JPM's transactional database of financial transactions is down" problem.

</comment></comment></comment></comment></comment><comment><USER6> This is terrifying. If this, and similar ideas, gain adoption, this will undoubtedly lead to the next financial crisis.

From my understanding, JPMC wants to issue a new coin and make the market for that coin by buying the coin for $1. Then, they plan to use this coin for it's normal banking tasks, such as lending money, except they would use JPM Coins instead of dollars. By using this coin, they would be able to skirt their fractional reserve requirements. Of course, this coin only has value because of trust in JPMC. If this trust or breached, or if external economic events cause a large amount of JPM Coin to be sold, then this will effectively be a run on JPMC. Given JPMC's size and importance in the marketplace, the aftermath would not be pretty.

<comment><USER7> > skirt their fractional reserve requirements.

...wait you can just do that? Just declare a "thing" to equivalent but not identical by reference to a dollar and go around laws using dollars because you technically aren't using the dollar?

Yeah that's terrifying.

<comment><USER8> > ...wait you can just do that? Just declare a "thing" to equivalent but not > identical by reference to a dollar and go around laws using dollars because > you technically aren't using the dollar?

Yes, they're basically taking dollars out of demand deposit accounts and putting them into brokerage accounts. Demand deposit accounts are liquid, guaranteed with FDIC insurance, and the account holder is entitled to the funds at any time. JPM Coin is theoretically liquid and "guaranteed" by JPM in the form of a promise to purchase it for at least $1 (up until they can't of course) but from the article it seems the funds won't be immediately available to account holders:

> Purchases and redemptions may not always be immediate, but once converted to > JPMCoin, transfers should be quick and error-free.

The benefit of JPM Coin for JPM is a quicker/cheaper way to facilitate transfers between and among their various legal entities while also reducing the bank entity's total deposits (which in turn reduces the bank's capital and reserve requirements).

The benefit of JPM Coin for JPM _customers_ on the other hand, is not immediately obvious to me.

<comment><USER7> I mean for things like CDs and savings accounts, JPM Coin is irrelevant. I'm concerned more if JPM decides to use JPM Coin for higher-risk activities. What happens if they decide they would treat a supply of JPM Coin as a supply of USD, with the knowledge that if things go south, they could change the value of the pegged psuedo-currency and get a slap on the wrist?

Every bank could then conceivably be a central bank, except as a central bank that is profit-driven.

</comment></comment></comment></comment><comment><USER9> Why does JPM Coin need a distributed ledger if it will inevitably have identity requirements and central control by the bank itself? This is something like when CompuServe wanted to create their own version of the internet, and pretend it was still open. No thank you. Bitcoin is both open, distributed, and has a non-inflationary gold-like token as its underlying currency.

<comment><USER10> The way I see it, most existing financial transactions are trust- _based_. Many cryptocurrencies aim to be trustless. I see this as a compromise, with the visibility and implementability of cryptocurrencies, while still being trust- _backed_.

This way, if there is a problem with a transaction, or the currency, etc. there is someone left holding the bag, which is a better fit with the existing legal infrastructures that are already in place.

I'm actually pretty surprised that this is coming from a corporation, and not a national government. SWIFT can be an absolute bear, and providing a programmable currency interface à la Stripe, but with lower fees and the full backing of a government could be a killer app for international trade facilitation.

<comment><USER11> One of the main benefits of trust is to be able to rollback transactions. A warm fuzzy feeling of trust is not what is needed.

This provides the fuzzy feeling without any tangible benefit, and all the of the downsides of trustlessness.

</comment></comment></comment><comment><USER12> JPM coin just seems like someone put some money into some blockchain / coin like projects at JPM and came up with this product as a way to have something to show for it.

I'm not really sure if the resulting product is really the result of some big idea, or just an amalgam of things / ideas put together in a way JPM finds acceptable, even if to show something for their own work.

This is a weird situation where I can't tell if this is just some wonky homognized or otherwise last ditch effort idea that isn't anything, or is super complex and really a big idea....

<comment><USER13> Lol that's exactly my view as well. They hired some crypto whizkid a while back who didn't stay long and left, probably just tying up remains of their project just to have something to show for

<comment><USER12> I know there was talk of a lot of hiring in the financal sector of bitcon guys, talk of culture mismatches, and folks leaving.... makes you wonder.

</comment></comment></comment><comment><USER14> It seems rather farcical, after Jamie Dimon openly rubbishing cryptocurrency, we now have another stablecoin competing with Tether.

[https://cointelegraph.com/news/jamie-dimon-comments-on- bitco...](https://cointelegraph.com/news/jamie-dimon-comments-on-bitcoin-yet- again-says-he-doesnt-give-a-sht-about-it)

</comment><comment><USER15> as media luminary Matt Levine has often pointed out, the blockchain doesn't solve a technological problem in cases like this, it solves a social and organizational problem.

at a big bank, managing the process of modernizing or replacing legacy databases is a very low-status job. on the other hand, pioneering a new initiative with distributed ledger technology is much higher status.

<comment><USER16> > at a big bank, managing the process of modernizing or replacing legacy > databases is a very low-status job

Its also incredibly high-risk, so it generally doesn't happen. They'll keep ancient software running as long as they can until they need to switch over to something new. So, yes, you're right, they use separate, new initiatives with newer tech to essentially do "upgrades".

</comment></comment><comment><USER17> I'll put my money on an actual tech company coordinating with banks rather than a bank itself for the mere fact that a tech company most likely will know it better and attempt to do it more securely than outsource consultants to put it together for me.

IBM's World Wire - [https://www.youtube.com/watch?v=GtQY8Jfa4NA](https://www.youtube.com/watch?v=GtQY8Jfa4NA)

Also full disclosure I have been buying a little bit of stellar here and there since it was less than 2 cents, before IBM even partnered with Stellar. Now IBM attempting to coordinate many banks worldwide to be able to transfer money seamlessly.

I'm still waiting for the day we get payed per minute our salary and have to manage cash flows rather than balances.

<comment><USER18> I had a realization the other day when I rented a sports car on vacation. In the future you will just show up to a garage and scan QR code to view and accept contract for car rental. It would charge you by the minute so you can drop it off whenever you want. Also, if something came up and you wanted to leave the car somewhere else or switch cars, the cost to transport the car to another "share garage" would be easily calculated.

<comment><USER19> Car2Go, DriveNow, Sunfleet, countless others have existed for years with more- or-less literally that model.

</comment></comment></comment><comment><USER20> I really don't get the point of a blockchain in these situations where you start with a hard requirement for a central authority.

What advantage does this offer over a normal database ledger, in this situation?

<comment><USER21> Transparency is the big usecase.

All a crypto currency is, is a public append only database. There is no need to overcomplicate this.

There are lots and lots of reasons why a transparent append only database could be useful.

<comment><USER22> Which does not need a cryptocurrency.

A public SQL database (which only they can alter) works just as well.

<comment><USER23> You would still want to gpg sign your withdrawal and deposit transactions. You would need and want to audit for fraud etc... control the key server, manage write/update operations etc... At this point you've basically written a block chain

<comment><USER24> Which can also be done by adding an extra layer to a public SQL database.

It becomes a blockchain when JPM allows third-party, anonymous actors to mine the blocks and take control of the network, which JPM is certainly not going to do.

<comment><USER21> What if I were to tell you that Git is a Blockchain? Would you think that Git is useless, and should just be a SQL database?

A Blockchain is just a public append only database that multiple people have a copy of.

Despite people incorrectly thinking that this I'd a break concept, lots of things in the world follow this pattern, and it has been useful for a very long time.

The method of "commiting" things to a Blockchain have nothing to do with proof of work, or mining or whatever. You can "commit" things to Blockchains in many different ways.

GitHub, for example, allows owners of a repository to designate specific users with the permissions to "commit" code to their repo/Blockchain (which just happens to represent source controlled code, in their case).

But there could be lots of ways of determining what is the next block in that Blockchain.

<comment><USER24> I would say that you are diving into the semantics of the word _blockchain_ in an attempt to redefine the word to fit this project.

If we're talking semantics now: Do people think, 'Oh, that's a blockchain!' when they think about Git? Is JPM building a new code repository?

<comment><USER21> My point is that a public append only database (AKA, a Blockchain) is useful for a whole lot of things, in a whole lot of different usecases.

And just because JPM isn't following the exact same formula that other people are following, doesn't mean that an append only public database is useless to them.

Lots of people have used append only public databases for all sorts of things, for decades. (My example being Git).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> I wrote this a while ago when this was first mentioned:

"JP Morgan says that it is trialling crypto-currency and blockchain in order to speed up payment transfers, as well as reducing clients' counterparty and settlement risk, and decreasing capital requirements." Is a pretty frightening thing to read. Specifically, the way that sentence reads, JP Morgan would be issuing coins to reduce capital requirements…which means either:

The journalist is confused, and they are using blockchain to speed up payment speeds which reduces risk, and the lower risk is what reduces capital requirement. in essence, faster transactions and settlement allows lower leverage/short term borrowing and therefore a slightly reduced capital buffer.

They are issuing the coin as a security, which means the coin is actually raising capital. And so the sentence should say it reduces other capital requirements.

They are issue the coin as "corporate points" which are redeemable for money from JPM, but which others cannot actually treat like capital. I.e. If I end up with a bunch of JPM coins on my balance sheet, I would treat them as an non-interest-bearing debt instrument? Kind of?

I guess it isn't clear yet, but I presume that these will only be used over short settlement times to facilitate easy transfer but there will be some kind of real money settle up at some point? Holding someone else's non-interest- bearing loan certificate doesn't sound that attractive in the long term. But, presumably #1/3 are the likely options because #3 means no new capital is actually generated, and #1 means that it is really transaction speed arbitrage.

</comment><comment><USER26> So, do I read this right?

JPM issues a coin for every dollar it holds of client money - presumably to the client who has to have a wallet. Clients can then move that money to other JPM accounts using the blockchain transfers. As long as they somehow remove a coin from the chain when client walks out of the bank with it, then what we get is ...

Bank Of America and Deutsche can issue BoACoin and DBCoin doing exactly the same thing, and then those coins, all being worth $1 and on the (an) blockchain can be transferred between BoA and JPM.

So we get trusted third parties asserting that a coin is actually real fiat money, and then actual workable cryptocurrency. It seems ... credible.

My concerns are what ensures that BoA and JPM dont issue coins for the same dollar (ie how does JPM revoke a coin)

I would be interested in any feedback - if I understand this right, it might be time to look into github for the python client wrappers again.

<comment><USER27> The transition between chains will happen via blockchain middleware like Chainlink.

</comment></comment><comment><USER28> I actually thought this was always going to happen, I just didn't know which bank would do it first, and I'm surprised it is a bigger bank.

Think about what a bank account is. You give up your money for a voucher and the bank keeps a ledger of all transactions. Turning it into a token that you can exchange for dollars really isn't that much of a stretch.

They now have a 'currency' of sorts where they get to use all the deposits for fractional reserve banking, keeping only 10% available at any one time. Money out into this token is basically free money to lend out, just as bank deposits are. The difference here is that the liquidity is higher, since they don't need to use it through the traditional banking system.

I would expect it to have some traction with business and internationally.

<comment><USER29> > use all the deposits for fractional reserve banking

They already do, and it's supposed to be limited per law, it's called the leverage ratio.

<comment><USER28> Yes, that is the point I was making and why I pointed out that they only have to keep 10% on hand. Once the coin is connected to fractional reserve banking the same way deposits are, the path to monetization becomes much more clear.

</comment></comment></comment><comment><USER30> Other than the ceremony around the tech how is this much different from the practice of banks issuing their own notes that was the norm forever?

</comment><comment><USER31> This is just self-issued credit which can be transacted on the blockchain. That a mega-bank would want to issue credit in a novel way should not be surprising to anyone. This plan is essentially "digital IOUs with blockchain record-keeping". I'm not sure how they will entice consumers, but seems like a good play for JPM if they can get people using it.

</comment><comment><USER32> Is it? Citi had started one in July 2015 [0]

[0] [https://blockmanity.com/news/citicoin-in-the-dump-as-citi- gr...](https://blockmanity.com/news/citicoin-in-the-dump-as-citi-group-scraps- their-cryptocurrency/)

</comment><comment><USER33> From the article:

> JPM coin... are unsecured promises by a bank to give you dollars

From JPM:

> JPM coin... represent United States Dollars held in designated accounts at > JPMorgan Chase

So, is it secured by deposits or not?

<comment><USER34> It's an unsecured deposit. lol.

</comment></comment><comment><USER35> Mr. Robot really was a dramatized version of real life.</comment>


Relative Line Numbers in VIM - <AUTHOR> http://jeffkreeftmeijer.com/2012/relative-line-numbers-in-vim-for-super-fast-movement/

<comment><USER2> Is it really not possible, even by plugin, to use absolute and relative numbering at the same time? While being able to switch is great, having both at the same time (in the form of a second column next to absolute numbers) would be amazing.

I have more than enough horizontal space, and this would be a great way to use it.

<comment><USER3> It is technically possible. There is a plugin from before +relativenumber was a feature, called RltvNmbr[1]. It's a bit broken (doesn't update the line numbers very smoothly) but it displays the relative numbering side-by-side with the absolute numbering.

I just don't use relative numbering enough to warrant trying to re-write it. Maybe you do?

[1] <http://www.vim.org/scripts/script.php?script_id=2351></comment></comment>


HN Toolkit: Several bug fixes and improvements - <AUTHOR>

For anyone using this GM script, I just wanted to let you know that I made several fixes to it today (splitview got broken and there were some quirky UI annoyances). If you updated/installed in the last 24 hours, please upgrade again to get these fixes. If you haven't updated in a while, you might find something new!<p>http://userscripts.org/scripts/show/25039 <comment><USER2> This is awesome! Thanks.</comment>


Lifetime ISAs - <AUTHOR> https://www.moneysavingexpert.com/savings/lifetime-ISAs?utm_source=MSE_Newsletter&utm_medium=email&utm_term=20-Feb-18-7966&utm_campaign=nt-hiya&utm_content=1 <comment><AUTHOR> Posted because it's an example of how complicated governments like to make a tax system to incentivize something (in this case home buying). Instead, why not just eliminate stamp duty & build more houses.

<comment><USER2> Because LISAs encourage saving rather than just acquiring debt to buy property.

Also, LISAs are aimed at first time buyers... and most first time buyers don't pay stamp duty (there's a £300,000 threshold)</comment></comment>


Silicon Valley may be popular for innovation centers, but losing ground to Asia - <AUTHOR> http://venturebeat.com/2016/12/17/silicon-valley-may-be-popular-for-innovation-centers-but-its-losing-ground-to-asia/ <comment><USER2> If you interpret the title literally, it's probably true. It's not something to worry too much about, however.

Just like the rest of the world starting large universities has rarely had a negative effect on institutions like Oxford, Harvard or MIT, the rest of the world starting innovation center is unlikely to do much negatively to Silicon Valley.

Starting an 'innovation center' and actually creating lots of innovative companies (including some really large ones) are not the same thing at all. In fact, just like IITs are a great feeder into MIT or Stanford, some of the best companies outside Silicon Valley have become a feeder for the SV ecosystem.

I'm not saying it can't happen. I'm just saying quantity is not the same as quality, and quality innovation center is very hard to create without _lots of_ quality people in all parts of the ecosystem.

<comment><USER3> Silicon Valley has two major things going for it. Talent and money. Asians are intelligent and talented, if they were not they would not be pulling huge work loads in American univerisities. At this point they have lots of capital too as a result of the ascension of the economies in their respective countries. Your comparison of so-called elite universities is a false dichotomy, those work on different rules than technology. Technology does not recognize social status and all that other stuff. Technology belongs to no one and can be acquired by anyone with money and talent.

<comment><USER4> Chinese have won plenty of Nobel prizes, just not when they were in china.

It just isn't about aptitude, or even capital, but society has to be developed and free enough to let innovation happen. Where all the capital (human and financial) has accumulated (China), this simply isn't the case. We will continue to see young Chinese leaving for the west to realize their full potentials.

<comment><USER5> >society has to be developed and free enough to let innovation happen.

see parallel discussion on "China invents the digital totalitarian state" \- [https://news.ycombinator.com/item?id=13201926](https://news.ycombinator.com/item?id=13201926)

</comment></comment></comment></comment><comment><USER6> What exactly is the definition of an innovation center, and why are there so few of them in the world?

There are only 7 in the silicon valley? That seems... suspect. And only 2 in Tokyo? This whole article puzzles me.

<comment><USER7> Counts in the report are for new "innovation centers" in 2016; sources and methods for compiling the list are not provided.

<comment><USER6> So I'm not attacking you, but this article, without the sources and methods is basically useless?

It might as well read "Silicon Valley may well be a 7, but Asia is on its way with a couple of 2s and 3s."

<comment><USER2> Exactly. The article focuses on something marginal (number of large companies starting an 'innovation center' aka a tiny office in Silicon Valley has come down). The title is misleading because it makes you think it's talking about Silicon Valley being left behind in innovation.

What it actually talks about is 'large companies are opening more satellite offices around the world than in Silicon Valley in the last few years'.

The appropriate response to this article is: 'so what? How does that matter?'

</comment></comment></comment></comment><comment><USER8> "The reason behind the abandonment of Silicon Valley, and even Europe, is due to the supply of talent in Asia."

\- sounds like a fancy way of saying "outsourcing".

</comment><comment><USER9> Silicon Valley has nothing on Asia. In China's Silicon Valley, if you have an idea and comparatively far smaller bank roll, you can have a prototype of your idea at your desk within a week.

Compare that to SV which is like a backwards feudal kingdom.

The examples of "innovation" spouted now in SV are software and service frameworks, stuff like social networking and OS, and this stuff is backed by open source work performed by people from all over the world. In the big scheme of things today's Silicon Valley's so-called "innovation" is a big loser.

edit: It makes sense that technologically capable countries pursue their own technological infrastructure rather than have to depend on and pay US corporations simply for the privilege.

All Silicon Valley really provided was to "innovate" the traditional American business model and classism into their technological infrastructure.

</comment><comment><USER10> Just like the death of Moores Law. Over 50 years and counting.</comment>


Fabrik – A Visual Programming Environment (1988) - <AUTHOR> http://sp.cmc.msu.ru/courses/smalltalk/fabrik/Fabrik.html <comment><USER2> See also Lively Fabrik: [http://www.lively-kernel.org/repository/lively- wiki/Fabrik.x...](http://www.lively-kernel.org/repository/lively- wiki/Fabrik.xhtml)

</comment><comment><AUTHOR> _Experience with Fabrik suggests that a successful visual programming kit requires only three things: Specification of an effective visual and computational interface for each component, interactive access to an interesting (network) library of existing components, and the ability to use and combine these components interactively to build new library components and finished applications._

To maybe get some discussion going: are there any programming kits today that have all three of these attributes?

<comment><USER3> > _are there any programming kits today that have all three of these > attributes?_

While not a fully visual development environment, I'd say Delphi. I think they got the design right 21 years ago. They struck the right balance between visual and non-visual development and married that to a language (Object Pascal) which had fast compilation, directness, and simplicity while also offering low-level capability.

Chuck Jazdzewski was one of the original Delphi developers. Last year he wrote a series of articles on the early days of Delphi: [http://removingalldoubt.com/](http://removingalldoubt.com/)

It's a shame Object Pascal isn't more widely used. It's a nice language. Maybe Free Pascal ([http://www.freepascal.org](http://www.freepascal.org)) and Lazarus ([http://www.lazarus-ide.org/](http://www.lazarus-ide.org/)) can spread the Pascal gospel.

<comment><USER4> The articles from Chuck Jazdzewski made my day. I sometimes wonder what the early members of the Delphi team are working on today. Thanks for sharing the link!

</comment></comment></comment><comment><USER5> That looks a LOT like PureData : [http://en.flossmanuals.net/pure- data/introduction/graphical-...](http://en.flossmanuals.net/pure- data/introduction/graphical-programming/)

</comment><comment><USER6> Talend also offers a visual programming environment, and I would rather write code any day. If your programming work is simple, and you don't care about conditionals, logging, or error handling, it makes some tasks easier. The second it doesn't make your task easier, it makes it much harder than programming with code.

</comment><comment><USER7> Haha, this is very much like Reaktor 6 'blocks', esp. the "user frame" stuff.

[https://youtu.be/yl_VXrTET7k](https://youtu.be/yl_VXrTET7k)

</comment><comment><USER8> Take a look at Fractalide [http://github.com/fractalide/fractalide](http://github.com/fractalide/fractalide) It uses Nix Expressions to lazily coordinate the building and port linking of components.</comment>


Thoughts on "Apple Stole My Thunder" - <AUTHOR> http://medium.com/all-things-apple/a418217dd9a1

<comment><USER2> interesting reminder that its still Steve jobs world, and we are just playing in it.</comment>


How to deal with client who is "looking for funding" - <AUTHOR> Around a year ago I had started a project with a group of people who had an idea, enthusiasm, and (I believed) money to back it. My role in the project was to design/develop an iPhone, Android, Web App and API for their idea and we were all excited to get started.
We signed a contract stating that I own all rights to the software and IP until the full amount was paid, contract could be terminated whenever, and they paid an initial deposit. We were off to the races. Over the next 6 months or so they paid 2 of the 5 payments, with no payments coming in the last 4 months of development. Having had someone vouch for them ahead of time, and their timeliness with the first 2 payments I assumed the rest would come soon after... and kept assuming that.
Now, clearly that's my fault for letting it get to this point :) But, now that I realize they don't have the money but are "working on getting funding" and "are very close with multiple groups"... what are my options?
Has anyone been in a similar situation? Should I let them keep the software running (which is currently live with multiple contracts)? Should I shut it off, which may limit their ability to get funding? Should I try to sell the whole package to a third party? They are also using and pitching a product I built that they have not paid for, which kind of rubs me the wrong way for obvious reasons.
Fun stuff! Any thoughts are greatly appreciated :) <comment><USER2> What are the features? How much are you looking to get for the software?

<comment><AUTHOR> Hey @sharemywin, pretty solid question :) Should have mentioned that. It's a content management system for Medical Marijuana dispensaries.

The main feature-set for the Software Owner:

1) Add new dispensaries 2) Customize dispensary info 3) Generate a custom iPhone/Android app for that dispensary

The main feature-set for the Dispensary Owner:

1) Enable/Disable features (Instagram-esk Gallery, Rewards, Points, Punch Cards, Menu, Location, Events, etc.) 2) Modify branding/colors 3) View/manage dispensary users 4) Send notifications to users

The main feature-set for Dispensary Cashier:

1) Add points 2) Punch cards 3) Lookup/verify users 4) View rewards/punch cards/menu

The main feature-set for Users:

1) iPhone App (with above features) 2) Android App (with above features)

There are probably some things I'm missing, but that's the gist of it :) As you can imagine, it took me a long time to build all of that. If I were to sell it (is that something people do when this happens?) the goal would be to get something around 100-150k for the entire setup, but getting back any of the money (aka, time) I undoubtedly lost on the project would be ideal.

Thanks for any advice!

<comment><USER2> Seems like it could be re-engineered to pretty much any industry. Is it web based? why not sell it Saas for any industry and try to recoup that way.

<comment><AUTHOR> Interesting point!! Could definitely be repurposed for any industry.

Selling it as a SaaS system is definitely one option, though it would mean I would have to spend time selling, promoting and supporting it, which isn't something I'm toooo keen on.

Thanks for the great advice though! Definitely a thought to keep in mind.</comment></comment></comment></comment>


Everyone is a Social Media Consultant - <AUTHOR> http://michaelyurechko.com/2009/01/everyone-is-a-social-media-consultant/

<comment><USER2> If he is not a social media consultant, why should I trust him to tell me who is a social media consultant? SCNR...

</comment><comment><USER3> In my mind, the definition of a social media consultant is someone who sells consulting services related to social media. This does not require that they actually know what they're talking about. Personally, I think it's a good indicator for who you can safely ignore. Give it a few months any they'll all be on to the next fad career label.

</comment><comment><USER4> Thanks for drawing attention to this. Seems like blogs and twitter are more and more becoming platforms for posting about blogging and twittering. Could we start a list of bloggers/tweeters who actually contribute value?

Terry Tao, PZ Meyers (Pharyngula)

<comment><AUTHOR> Not a lot of people contribute value. Myself included. I just felt I had to call out the douchebags who talk about blogging and twitter via my blog and twitter ;)

<comment><USER5> The blogosphere is expanding to meet the needs of an expanding blogosphere</comment></comment></comment>


Journalist Kim Wall's head found in sea near Copenhagen - <AUTHOR> http://www.bbc.co.uk/news/world-europe-41536552 <comment><USER2> I wonder if this guy was a major serial killer...and how many victims he might have?</comment>


Proof that money does in fact buy happiness - <AUTHOR> http://finance.fortune.cnn.com/2013/05/01/money-happiness/

<comment><USER2> One of the biggest problems with Deaton & Kahneman's "happiness doesn't increase after $75k" is that cost of living is very different from place-to- place. At least this article points it out.

In the best version I can find (anyone have a link to the original paper?), they don't address this in their study. [https://www.google.com/url?sa=t&rct=j&q=&esrc=s&...](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=14&ved=0CDwQFjADOAo&url=http%3A%2F%2Fwww.aeaweb.org%2Faea%2F2013conference%2Fprogram%2Fretrieve.php%3Fpdfid%3D395&ei=PXGBUcPiLKasigKz84D4Bg&usg=AFQjCNEwZAx9yZ0LBY9KQW_Oo5kOUK_tVA&sig2=Q2Rlo2zhXNxoL6O80ro5Dg&bvm=bv.45921128,d.cGE)

Money doesn't buy happiness. But it has a role.

<comment><USER3> I believe they noted that. Their explanation was that you spent more to live in New York etc. but that money bought you experiences that made you happier so it mostly balanced out.</comment></comment>


The exponential growth of Bitcoin value explained - <AUTHOR> http://bitcoinowl.com/exponential-growth-bitcoin-value-explained

<comment><USER2> The article just supposes that Bitcoin is the next big thing and then it portrays where we might be in terms of adoption if indeed the supposition is right.

But I would rather want to know why people are adopting Bitcoin and what they are exchanging it for. That way I could truely understand the Bitcoin economy and whether it is actually the next big thing or not.

I don't want to be a harsh critic but I always get my hopes up for nothing with these kind of articles.

<comment><USER3> > what they are exchanging it for.

I went to a Subway in Allentown and bought subs with bitcoin last week. Scan QR code, send amount with a (in fiat) .5 cents confirmation fee to get it accepted quickly, done. No signing paper, no pinning codes, no 5% vendor transaction fees for using a piece of plastic.

I've bought humble bundies, reddit gold, wordpress themes, and an sd card from a bitcoin auction site with bitcoin. I regularly tip people on reddit with /u/bitcointip and its simple syntax. I donate to various open source projects in bitcoin because I just copy paste their address and send a few USD worth in seconds.

<comment><USER4> This isn't an attack on your response, because yours is a realistic answer to the question.

However, I find it difficult to believe these things warrant the massive increase that bitcoin has seen the past few weeks. Open source projects, indie games and one sub shop do not a currency make.

That said, I am a believer in bitcoin and hold a few myself. I also exchange it for the things you speak of. But I desperately want to get from auction sites, humble bundles, reddit gold and wordpress themes to groceries, fuel and clothing. Then we might justify this market cap.

<comment><USER5> You can buy plane tickets for btc now at cheapair.com

<comment><USER4> Interesting. Is this site legit? Considering the ridiculous and opaque pricing scheme of airline tickets, I've always looked at sites like Kayak and now cheapair with some skepticism (preferring the old standards of expedia and orbitz). However, there's really no reason to believe that expedia has some magic that cheapair and kayak couldn't also harness.

</comment></comment></comment></comment></comment><comment><USER6> Someone said that current BTC is more like to target of speculation/venture rather than a device for exchange because it's too unstable.

He also said, if you want speculative investment, do whatever on BTC. But if you want a real money for value exchange, BTC is not yet for that.

I think that sounds reasonable.

</comment><comment><USER7> The article asserts this:

"All technologies eventually become outdated"

There are easy counterexamples:

* Wheels

* Fire

* Knives

These are technologies that predate written records (did I mention _writing_ as another example?) yet they all remain use and are actually _fundamental_ in our daily lives. I am not going to claim that fiat currency will be so enduring, but I see no reason to assume that it will be replaced by anything short of a post-scarcity age.

<comment><USER8> fire superseded by central heating and electric fires

knives superseded by guns (weapons) and fork (cutlery).

I'll give you the wheel only because I'm still waiting for my hovercar

<comment><USER9> I'd like to see how you cut bread with a gun or a fork.

<comment><USER3> I'll just use a concentrated laser to cut my steak! And char broil it at the same time!

</comment></comment></comment></comment><comment><USER10> I'm holding some bitcoin, but I'm still not sure whether I'm speculating or if I'm in for the long run.

Sure, the Chinese are plowing huge sums of surplus cash into BTC, but where can it go? If the US, EU, and China decide tomorrow to freeze out bitcoin exchanges (like the US has already pretty much done), then where does that value go? Does it sit in BTC until adoption hits critical mass? How do you reach critical mass if you can't get in and out of fiat during the transition?

All it takes at this point is for China to decide on the socialist side of the fence and seize btcchina. All that Yuan hasn't really left the country and I'm sure Beijing will make damn sure it never does.

<comment><USER11> If you aren't spending, you are speculating. A unit BTC is currency, not a producer of value.

<comment><USER10> Why would I spend at this point? The deflationary aspect is just too hard to work with.

I have a $8,000 iPod Touch in my pocket that I bought in 2011 when I cashed in 10BTC @ $30.

<comment><USER12> This point is probably too subtle for a lot of BT fans.

</comment></comment></comment></comment><comment><USER13> Bitcoin's rise in value will reflect the same curve that rise of information has taken:

[http://peculium.net/2013/04/08/bitcoin-is-a-bubble-only- if-y...](http://peculium.net/2013/04/08/bitcoin-is-a-bubble-only-if-you-think- the-rise-of-information-is-a-bubble/)

Straight up is also a curve.

</comment><comment><USER14> how legit is this? because I'd love to buy me some bitcoins right now

<comment><USER15> Please tell me you are being sarcastic. You are asking how legit a speculation about the astronomical rising price of bitcoin on a _bitcoin_ .com website, with a graph that accurately pinpoints our location in time at the foot of a giant mountain of $$$$$, predicts the downfall of normal money, has no scientific sources.

Consider all "you should buy bitcoin now" to be bait from gamblers who want to maximize their speculative outcome. Bitcoin is nothing but speculation. And right now it is in a ridiculous bubble.

I would flag this if I could.

<comment><USER14> I don't expect real currencies to plummet but if bitcoins go above $1000 mark, that's pretty amazing.

</comment></comment></comment><comment><USER16> How many bitcoins does the writer/his friends/investors own? BitCoin Bait? The Bitcoin bubble will burst - there are enough reasons for that as well.

</comment><comment><USER17> I don't understand bitcoin. In the sense, for a normal person to use it. I don't understand a normal consumer using bit coin.

I can't even figure out how to setup this stupid wallet. It has been downloading a block file for over 5 days. How the fuck is this the future?

The future is retarded.

<comment><USER18> Since you are apparently very used to people doing things for you, you might want to look at online wallet services[1] that hold your money. You might think that it is less safe to do things that way, and you are right, but it is no less safe than giving your cash to the bank.

EDIT: Sorry for being rude; last night was a long night. What I'm really trying to say is that, by running wallet software locally, you are opting yourself in to a few responsibilities that go beyond just storing your own money. If all you want is the ability to store your bitcoins, there are already services that will provide you that ability with no fuss.

[1] [http://bitcoin.org/en/choose-your-wallet](http://bitcoin.org/en/choose- your-wallet)

<comment><USER4> People are critical of these services, but the poster you're replying to is correct: bitcoin is not ready for prime time. As much as the bitcoin faithful would like to deny it, bitcoin will not be widely adopted until there is a financial services industry around it. The necessity of credit, the convenience of easy payment, the security of your money in a bank, it's just too tempting for people to walk away from. Nevermind that there is still a _massive_ part of the first world population that can't program their clock, much less download a bitcoin wallet. And the fact that Internet infrastructure is still limited worldwide. Try paying with bitcoin on your phone in some more remote parts of Montana.

<comment><USER19> That's the most exciting thing about Bitcoin. The protocol and the technology is sound, just imagine how it will explode once the UX is polished.

You're looking at the internet in the BBS stage right now.

<comment><USER12> In this analogy does that make bitcoin the future AOL?</comment></comment></comment></comment></comment>


SpaceX's Dragon cargo ship splashes down in Pacific - <AUTHOR> http://phys.org/news/2016-08-spacex-dragon-cargo-ship-splashes.html <comment><USER2> > SpaceX's Dragon is the only cargo carrier in use that can return gear to > Earth.

Don't they mean the only American cargo carrier? I thought the Soyuz was the only capsule ferrying Astronauts to and from the station, at least until the Commercial Crew program gets to that point.

<comment><USER3> Technically Soyuz _can_ return a small amount of cargo, but it is extremely weight and volume limited. I couldn't find a precise figure, but it looks like it can return at most 50kg or so of cargo, in addition to crew.

Dragon can return about 2500kg in total (though it is quite volume limited), and has special facilities such as cargo racks that can support, for example, a powered freezer to hold scientific samples requiring such facilities.

None of the other operational vehicles -- Progress, Cygnus or HTV -- have any cargo return capability.

So the quote is correct in two respects: firstly, Soyuz isn't generally considered a "cargo vehicle"; and if you expand that definition, Soyuz can only carry an extremely small amount of a limited subset of possible return cargo that does not include the most interesting payloads such as frozen biological samples.

When the Commercial Crew vehicles become operational in the next couple of years they will also provide some cargo return capability, but that isn't their primary purpose and will be fairly limited under most circumstances.

The second round of the Commercial Cargo program -- CRS2 -- has selected Sierra Nevada Corporation's Dream Chaser in addition to Dragon and Cygnus. Dream Chaser is a spaceplane that will provide substantial cargo return capability by landing on a runway. This will subject the payload to lower g-forces than Dragon and allow for a very short interval between leaving the station and cargo offloading and processing on the ground. Such capabilites will be extremely useful for returning delicate and time-sensitive experiments.

So, until Dream Chaser becomes operational, almost all cargo return capability will be provided by Dragon; and right now, the cargo that is returned not on Dragon is on the order of a rounding error.

<comment><USER2> Thanks, that's interesting! Do you know if the future upgrades to Dragon with propulsive landing for the crew return will provide similar capabilities for fast landing at bases as the Dream Chaser?

<comment><USER4> First flights of Dragon 2 will splash down under parachute because NASA is nervous about propulsive landing. When propulsive landing happens (probably at CCAFS) we'll see how fast can the capsule be decontaminated (superdraco uses hydrazine fuel, will need something like this: [https://www.wired.com/images_blogs/dangerroom/2011/11/120310...](https://www.wired.com/images_blogs/dangerroom/2011/11/120310af_x37_landing_800.jpg)).

</comment></comment></comment></comment><comment><USER5> I'm curious how Dragon carried a docking adapter to ISS. Such things generally don't fit through hatches.

<comment><USER6> Dragon has an unpressurized "trunk" which it can use to carry stuff like this. Here's a picture (a rendering, looks like, but it gets the point across) of the adapter being removed from Dragon's trunk:

[http://imgur.com/LAMS49w](http://imgur.com/LAMS49w)

The rear part (with the solar panels) is discarded before the capsule at the top returns to Earth.

<comment><USER7> Here are some photos of the trunk on the ground: [http://www.spacex.com/news/2013/03/26/dragon- trunk](http://www.spacex.com/news/2013/03/26/dragon-trunk)

Quite a lot of space in there.

<comment><USER8> The BEAM was transported in the trunk as well. That couldn't have fit through any hatch either.

</comment></comment></comment></comment><comment><USER9> > returning a load of NASA research from the International Space Station

Is it common practice to send down only, say, half of the results, while keeping the other half at the ISS for backup purposes?

<comment><USER4> ISS freezer is space limited. They might spread samples over different dragons for safety, if they have the space.

</comment></comment><comment><USER10> SpaceX is really setting itself up for interstellar travel. I am really proud of Elon Musk and SpaceX in general.

<comment><USER11> Well, saying that SpaceX is setting up for interstellar travel is like saying that me going kayaking is preparing me for transatlantic navigation... but mighty impressive nonetheless.

<comment><USER12> The first ocean navigators did use small rafts to do it. That's how they managed to go to Easter Island, for instance. So your affirmation confirms that SpaceX is preparing for interstellar travel.</comment></comment></comment>


The Best Chore Chart in the World - <AUTHOR> http://keyankousha.com/the-best-chore-chart-in-the-world.html <comment><AUTHOR> As I commented in the "Show HN" I posted for Choremate:

I made Choremate for our house, but I know the problem isn't ours alone. My hope is that another household will find the approach useful too.

37% of American adults live in shared housing, up from 25% just a few decades ago. Regardless of the cause of the increase, I'd like coliving to be easier. Choremate made coliving easier for us. And even if Choremate isn't the right solution for everyone maybe it'll lead to one.</comment>


Show HN: Hexagon Microservices Toolkit (For Kotlin) - <AUTHOR> https://hexagonkt.com <comment><AUTHOR> Hexagon is a microservices toolkit written in Kotlin. Its purpose is to ease the building of server applications (Web applications, APIs or queue consumers) that run inside a cloud platform.

I would appreciate the feedback. Thank you very much!</comment>


How to Link Cells in Different Excel Spreadsheets - <AUTHOR> http://vitamincm.com/excel-link-cells-tutorial Learn how to link data in one Excel Spreadsheet to data in cells of another worksheet or workbook using linking formulas. <comment><USER2> This looks like spam but I'll bite. I'm a huge fan of excel in certain situations (Like to generate VB6 Code or bash scripts if you travel back in time) but ten years later when you're stilling using it to run your business or you reorganize your "shared network drive" and all your file reference links break you are going to be really sorry. Also, you're doing it wrong. You should be using named ranges for everything and not things like =Products!B1 etc.

For an ugly but useful site about excel look at <http://www.excel-vba.com/></comment>


The Matrix Cookbook (2012) [pdf] - <AUTHOR> http://www2.imm.dtu.dk/pubdb/views/edoc_download.php/3274/pdf/imm3274.pdf <comment><USER2> I clicked wondering what kind of food they were making from the movies.

<comment><USER3> Must confess, before clicking my mind immediately went to "wonder if it contains a recipe for the mush they ate on the nebuchadnezzar?"

</comment></comment><comment><USER4> Since we're on the topic of matrices and linear algebra, here is a tutorial on the basics: [https://minireference.com/static/tutorials/linear_algebra_in...](https://minireference.com/static/tutorials/linear_algebra_in_4_pages.pdf)

</comment><comment><USER5> This PDF literally got me through grad school. It's an amazing reference.

</comment><comment><USER6> Similar, but more "cheat-sheet" style: [http://www.cs.nyu.edu/~roweis/notes/matrixid.pdf](http://www.cs.nyu.edu/~roweis/notes/matrixid.pdf)

</comment><comment><USER4> This is an awesome resource that I keep coming back to again and again. Save this somewhere on your computer so you'll have it handy whenever you see some weird matrix derivative...

<comment><USER7> I used to use this a bunch when calculating gradient descent algorithms, but I've since moved to using libraries with auto-differentiation (numpy with autodiff or theano) and it's a huge force multiplier for my work (not to mention GPU implementations basically for free).

Of course there's always some derivation that's easiest done by hand.

<comment><USER8> Isn't tensorflow the most popular auto differential library these days?

<comment><USER9> Probably you could look at # Watches, Stars, forks etc to gauge that, but if you want to look at vs theano, torch, pyTorch, Caffe2, start with cs231N lecture: [http://cs231n.stanford.edu/slides/2017/cs231n_2017_lecture8....](http://cs231n.stanford.edu/slides/2017/cs231n_2017_lecture8.pdf)

(I think there's vid on youtube)</comment></comment></comment></comment>


Hilarious site that I just found. These guys are funny. - <AUTHOR> http://totallyultimate.wordpress.com/

<comment><USER2> This isn't Hilarious News, this is Hacker News. You know, entrepreneurship, hacking, code, technology, startups?

Come on.

<comment><AUTHOR> 99% of my posts are serious, and about hackers/technology/coding/startups. But entrepreneurs have lives too. I might be wrong and I apologize if its outside the terms of service, but when I'm working my ass off, a break everyone once in a while is nice. Not forcing you to read it, but it does bring a smile to my face. Thats not that bad is it?

</comment></comment><comment><USER3> I want my 28.5 seconds back. That was the least funny 28.5 seconds of my life. It was so unfunny, that I think it stole past funny moments from my memory and used them against me, like some kind of evil psionic attack. My soul hurts.</comment>


Unravelling Code Injection in Binaries - <AUTHOR> https://suchakra.wordpress.com/2016/07/03/unravelling-code-injection-in-binaries/ <comment><USER2> Maybe it shows my ignorance, but I was surprised to learn that Valgrind converted the binary to be analyzed into bytecode.

This was an interesting exploration of using trampolines for debugging instead of relying on traps.</comment>


Topics Verboten on HN - <AUTHOR> In my 9 months here, I've noticed certain topics will either be wilfully ignored or quickly downvoted. These are the ones that come up for me:
What's wrong with socialism.
What's wrong with nuclear power.
What's wrong with Elon Musk.
What's wrong with Uber.
It doesn't matter how factual the content, these topics are always slammed. We have a lot of smart people on HN. Why the fear of open discussion on these verboten subjects?
Which ones have you discovered? <comment><USER2> "What's wrong with socialism" seems to fall under the topic of politics, which is off-topic on HN according to the official guidelines:

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

I've seen quite a bit of criticism of both Musk and Uber (I'm not a fan of either). For a recent example of the latter, see the comments in the article about Uber's IPO:

[https://news.ycombinator.com/item?id=19879500](https://news.ycombinator.com/item?id=19879500)

<comment><AUTHOR> Yet many posts here suggest socialist principles. There's one today about guaranteed employment. So _suggesting_ socialism is ok but countering that isn't?</comment></comment>


Humans Running in Place on Water at Simulated Reduced Gravity (2012) - <AUTHOR> https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0037300 <comment><AUTHOR> Could humans run on water? [https://www.outsideonline.com/1783941/could- humans-run-water...](https://www.outsideonline.com/1783941/could-humans-run- water#targetText=A%3A,but%20only%20under%20specific%20conditions).</comment>


Jeff Bezos working closely with the White House on the Covid-19 pandemic - <AUTHOR> https://techcrunch.com/2020/03/16/amazon-ceo-jeff-bezos-has-been-in-regular-contact-with-the-white-house-on-coronavirus-pandemic/ <comment><USER2> Old enemies become new friends.

<comment><USER3> The return of JEDI</comment></comment>


37Signals "just says no" to feature request: "please fix that security flaw" - <AUTHOR> http://www.matasano.com/log/1067/web-20-redux/ <comment><USER2> I've gotten that "Soft No" from 37signals, too. I was reporting a bug in the BaseCamp example API and was told that maybe we just had different views of how the API should be designed. I guess I was the only one in the conversation with the view that it should return data instead of raise exceptions and crap out. I no longer use BaseCamp.

</comment><comment><USER3> I find 37signals pretty stubborn when it comes to listening to its users, in general.

-just my 2 cents

<comment><USER4> We listen to everyone and 9 out of 10 things we add to our products start out as customer requests. We encourage feedback everywhere we can and interact with our customers as often as we can -- often by posting comments on their own blogs.

But, we also get thousands of requests a year so we can't do everything everyone wants. Many of these requests conflict with one another, and many of them just aren't a good fit for our products (adding Gantt charts to Basecamp, for example). The good ones, however, often make it into the products eventually. Sometimes exactly as requested, sometimes in a different form, but customer requests are almost always the seeds of improvement.

It is our job to be editors and museum curators. We have to decide what makes it and what doesn't for the benefit of the overall product and the overall customer base. No combination of yes or no is going to satisfy everyone, so we have to work on behalf of the majority.

Every company with millions of users has to say no more than they say yes, we're just honest and up front about it about it. We don't want to set false expectations or promise things we won't be able to deliver.

While this policy may rub some people the wrong way, we think it's the right policy. And seeing that 94%+ of our customers would recommend Basecamp to a friend or colleague, I think we're on the right track. <http://basecamphq.com/survey>

<comment><USER5> The issue here is not about adding new features, but fixing bugs and security issues.

Perhaps the 94% are not tech savvy enough to identify these problems?

Incidentally, I've read that specific example of adding Gantt charts to Basecamp before: [http://www.37signals.com/svn/posts/1050-ask-37signals-how- do...](http://www.37signals.com/svn/posts/1050-ask-37signals-how-do-you-say- no)

</comment></comment></comment><comment><USER6> Just post the vulnerability to a forum 14 days after notifying the company.

<comment><USER7> 14 days after? Just disclose the vulnerability to bugtraq and be done with it. Whether the company follows up or not is up to them.

<comment><AUTHOR> So you think the right plan is to punish the end-users and hope the vendor notices? Do you read Bugtraq? It's a mess.

This strategy works better. Several thousand people have already read Dave's article. We don't have to worry at all about the "wrong people" getting details and messing with other users. This seems like a win-win.

</comment></comment></comment><comment><USER8> Did he not mention the flaw, or did I miss it? If he didn't, I'd say this article is linkbait.

The bug is probably something really trivial that affects a small portion of users in an insignificant way. The secrecy about specifics on the author's part seems to be just to spare him embarrassment at this point.

<comment><USER9> I'm guessing it's this:

<http://forum.37signals.com/basecamp/forums/5/topics/3155>

Suppose we're both basecamp users. It may be possible for me to steal your session by giving you a link to a shared calendar or something with malicious javascript. Or I can steal the login cookie of one of the admins by luring them to my website with a support request.

I don't think permitting XSS is a good idea in a shared environment.

<comment><USER8> You can steal cookies with XSS?

<comment><USER9> In some situations. See:

<http://jehiah.cz/archive/xss-stealing-cookies-101>

<comment><USER8> document.cookie, wow... Guess you learn something new every day. For those interested, this has a good explanation:

<http://www.quirksmode.org/js/cookies.html>

</comment></comment></comment></comment></comment><comment><USER10> I'm gonna go against the grain on this one and call it karma whoring. Here's the formula:

1) Pick a company that has been the source of recent controversy.

2) Find a silly security flaw in one of their products that you can make sound serious with a bit of sensationalism. This should be easy to do, because most web apps have a few silly security holes.

3) Inform the company, and when they inevitably assign the silly flaw a low priority, write an inflammatory blog post and submit it to major news aggregators (e.g. news.yc)

<comment><AUTHOR> I'm going to go exactly with the grain of all my previous comments here and call you full of it.

Did you read the post? We reported this _over a year ago_. We notified them _repeatedly_. We withheld the name of the vendor for over a year as a courtesy. They started with a "soft no", and, when Dave checked in a few months later, they simply ignored our email.

Also: 37Signals has nothing to do with the recent Ruby "controversy" (where by controversy, you mean "someone found security vulnerabilities in it, and some blogger freaked out about it"). 37Signals doesn't produce Ruby; an Open Source team does.

The issue here is that one of 37Signals signature philosophies is "just say no" and be true to your own vision of your product when users request things you don't want to do. Fine. But there's a slippery slope to that logic, and you need to be careful not to fall down it. Some requests that you don't want to do, especially when they come from paying customers, can't be blown off.

</comment></comment><comment><USER11> Security flaws are bugs. They should be prioritised along with the rest.

<comment><AUTHOR> That's what 37Signals has done. They've simply put it at the bottom of their list, behind adjusting the pixel alignment of their sidebars.

<comment><USER7> And yet they're still making plenty of money. Security would be taken seriously if users gave a damn. But they don't.

<comment><AUTHOR> Depends on who you're talking about. An XSS vulnerability in a web app will get you shelved at a Fortune 500 company. When new apps get deployed on customer DMZs, third party audits happen. When they find vulnerabilities, you spin dot releases. On a typical 4/2 dev/qa dev team, in the _hopelessly optimistic_ case where you can turn a QA'd dot release in 2 weeks, you just lost $37,500.

</comment></comment></comment></comment><comment><AUTHOR> It's _really_ not a major flaw. But, I mean, come on.

</comment><comment><USER5> Even if it is not a "major" bug, why has it taken more than a year to fix? Unless 37signals does not consider it to be significant?

<comment><USER12> "Unless 37signals does not consider it to be significant?"

That's the real disconnect here. It isn't that responding to secuity vulnerabilities needs a unique process, it's that the author considers this issue significant and 37Signals does not.

<comment><AUTHOR> I doubt --- kind of a lot, actually --- that any actual developer there even saw our report.

[Edit] On second thought, this is a dumb thing to say, and I retract it. I have no idea if anyone's seen it, which is itself a problem. If I was going to assign a cause to this, it's that the cost of fixing this particular bug may exceed the perceived risk of the vulnerability.</comment></comment></comment>