Chinese Tech Companies' Dirty Secret [video] - <AUTHOR> https://www.nytimes.com/2018/04/23/opinion/chinese-tech-sexism.html <comment><USER2> Am I the only person who sees the perhaps inherent conflict between the liberal impulse for multiculturalism and its vision of racial and gender equality, in the sense that _a liberal, Western perspective on gender and race is not a culturally neutral perspective_?

As a Chinese-American, I feel whipsawed when on the one hand, well-meaning generally liberal people make lofty paeans about how we should respect other cultures, but then turn right around and judge those same cultures and find them unworthy for not adhering to liberal Western cultural norms.

In this case, the position is even more tenuous, because a substantial portion of Western society does _not_ fully agree with liberal norms for gender equality. This is basically exporting the West's own culture wars, fought since the 60s, to other societies.

There are of course tensions between the genders and sexes in China, like in any other society, but it's interesting to read the entire op-ed and not find an attempt to actually ask Chinese people what they think about the issue (the author notwithstanding), just a string of accusations with the unspoken presumption that 'if it feels wrong to us right-minded people, then it must be wrong'.

To be completely blunt, paternalism is very deeply embedded in Chinese society, and its roots go back a couple thousand years to Confucianism. I don't see anyone seriously acknowledging or discussing that fact, nor the major changes that have happened since the 50s (often under an explicitly Communist ideology, where the only allowable conflict is between the classes).

TL;DR - We respect all cultures and viewpoints, except all those which we judge wrong and sexist.

<comment><USER3> The general feminist perspective (which I find fairly sensible) is to avoid engaging in overt criticism of other societies and simply "signal boost" the voices within those societies pushing for increased equality. The author of this piece, Lijia Zhang, is such a voice.

<comment><USER4> But this is hardly unbiased. You effectively are choosing to feign cultural superiority by co-opting a native-voice that shares your criticism. Rather than sharing a non-biased perspective, your hiding your voice behind a native face. This isn't sincerity in debate, it's cowardice clothed in tolerance.

<comment><USER3> There is no such thing as a non-biased perspective, and feminism makes no claim to avoid bias; it's literally an ideology, with gender equality as one of its goals. The purpose of the signal-boosting strategy is to avoid patronizing echoes of "I know better" colonialism, not avoid bias. In this case we can listen to the many, many women in China who speak of the problems they face. In no sense are their voices co-opted.

<comment><USER4> I'm arguing that the definition of "gender equality" you are advocating for is definitely a western one. You can't argue your definition of equality while trying to feign anti-colonialist attitudes, that's a disingenuous position. I personally don't take issue with you (or anyone for that matter) arguing for their own cultural values over another (at least then we are having an honest discussion). I can't tolerate a position that tries to feign an obviously western-centric position while virtue-signaling as culturally indifferent.

<comment><USER3> Anti-colonialism doesn't require moral relativism. It's as simple as that. If you want a concrete example of how signal-boosting differs from simple pushing of Western feminist opinions, the hijab debate is worth looking into. Some feminists in the hijab-wearing regions of the world see it as a tool of oppression, others not. That's a debate for them, and not for westerners to decide.

If there's a vocal contingent of Chinese women pushing for the above-mentioned patriarchal Confucian values, well... I haven't yet seen it. All the Chinese women I've yet met (and had the opportunity to speak with on the subject) view sexism as a real problem, although granted I've only ever met Chinese women who came to America so selection bias is at play.

</comment></comment></comment></comment></comment></comment><comment><USER5> Here are some other dirty "secrets" about China:

* No free and fair elections.

* No freedom of speech and of the press

* One party rule

* People imprisoned for their political and religious beliefs

* Nobel Peace Prize winner died in Chinese custody

* Freedom of travel can be fairly restrictive, especially if you are trying to leave the countryside

China embraces the open market purely from a utilitarian perspective as to what will help them become and stay a superpower. There really is no big commitment to an individual "rights" based foundation for society. Because of that, it is not surprising that they discriminate against women.

<comment><USER6> > One party rule

pretty well straight up dictatorship now.

</comment></comment><comment><USER7> It's not a secret. The general discrepancy — of differing cultural norms — is also not unique to China.

Amazing how many people fantisize about a globalist utopia, accepting of all cultures, except the "offensive" cultures.

</comment><comment><USER8> In China, man pays for everything in a relationship...... and wives manage family account..

</comment><comment><USER9> Given all the public job postings, how does it become a secret?

</comment><comment><USER10> reminds me of some bay area job postings

<comment><USER11> They would be breaking the law if they did. Unlike China, sex discrimination is illegal in the USA and would be resolved very quickly in court if they decided to put out a job posting like that (likely with a huge civil settlement).

<comment><USER12> When I worked in IT, the standard technique Western employers used to practise discrimination was to use independent recruiters to place job adverts and vet candidates before they were forwarded to the employer. When the recruiter and employer had an informal conversation a little later, perhaps over lunch, the employer would casually let slip that "if the new employee could speak another language, she would be able to interact easier with prospective clients", which the recruiter took mental note of before changing the subject.

But perhaps things are different nowadays.

<comment><USER11> If jobs ads were as blatant as they were in China, then they would definitely get sued.

But there are many ways to game the system in rather legally safe ways where subjective decisions are involved.

<comment><USER10> insidious and subtle discrimination is the name of the game in the US. it's definitely worse in that it's far harder to fight against.

</comment></comment></comment></comment></comment><comment><USER13> > companies like Alibaba have published recruitment ads promising applicants > "beautiful girls" as co-workers, labeling them "late night benefits." While > tech companies tout themselves as progressive to the rest of the world, > these disturbing recruitment strategies show how deeply entrenched > discrimination against women remains in China.

How is promising that the work environment is full of girls an example of discrimination _against_ women? If they promised that girls were rare, that would presumably be an improvement?

<comment><USER14> >How is promising that the work environment is full of girls an example of discrimination against women?

If, as the author asserts, the women are being hired merely as rewards for the male workers while not really being given actual opportunities at their work.

<comment><USER13> Being hired into a do-nothing job is usually considered a perk.</comment></comment></comment>


Processes Paralleling to Speed up Computing and Tasks Execution in Linux - <AUTHOR> http://kukuruku.co/hub/nix/processes-paralleling-to-speed-up-computing-and-tasks-execution-in-linux

<comment><USER2> > _Besides, xargs isn't good at transferring special symbols, such as space or > quotes._

Well, no, not when you're piping ls into it. That's what --null (or -0) is for. (Use find instead.) The man page offers a similarly baffling argument:

> _xargs deals badly with special characters (such as space, ' and "). To see > the problem try this:_

      touch important_file
      touch 'not important_file'
      ls not* | xargs rm
      mkdir -p "My brother's 12\" records"
      ls | xargs rmdir

Same problem as the article: piping in the output of ls into xargs.

> _You can specify -0 or -d "\n", but many input generators are not optimized > for using NUL as separator but are optimized for newline as separator._

I still don't see the argument: if the generator is "optimized for newline as a separator", then -d is what you need. But if your generator is outputting a list of file names (perhaps the most common case of xargs), then -0 is what you need. It is perhaps somewhat unfortunate that its use of whitespace (and bash's use) make it so easy to write subtly incorrect programs; this is perhaps why there's such common advice to use Python, or anything not Bash. But the argument above leads me to think that `ls | parallels` would somehow work, which it cannot, for the very reasons we must use xargs -0.

I suspect this is a long way about saying "we have (somewhat more, but still not quite) sane defaults".

The correct command has always been `find . not* -print0 | xargs -0 ~/code/random/args.py`. Anything else is subject to weird corner cases of failure. It's a sad state of affairs really, and I'd love to change it. If you're just pounding out a command on the command line, you can usually ignore those corner cases, as you probably mentally _know_ whether `ls not*` is going to cause issues or not; if you're writing a script for general use, then it's only a matter of time until it fails in interesting ways.

<comment><USER3> > The correct command has always been `find . not* -print0 | xargs -0 > ~/code/random/args.py`

If you need to be portable, you can do pretty well with

      find ... | sed 's/./\\&/g' | xargs command

This will only break with filenames that have newlines in them.

(see [http://www.etalabs.net/sh_tricks.html](http://www.etalabs.net/sh_tricks.html))

</comment></comment><comment><USER4> Use pipelines with simple filter commands. No thread programming required. Use ssh to distribute this across nodes securely, assuming the I/O doesn't make that unworkable.

</comment><comment><USER5> The 'make' trick is cool. Used that a couple of times. I just kind of discovered that on my own. Then someone told me about xargs, so now that is my default.

Sometimes by playing with the -j or xargs --max-procs you discover interesting bottlenecks. Remember spending time trying to speed up this script. Used the make trick, it still was not running fast enough, it turns out disk i/o was the bottleneck.

<comment><USER6> I don't know enough about make to explain, but sometimes -j will break the build. Some Debian packages are explicitly built without -j enabled.

<comment><USER5> Sometimes there are incorrectly specified dependencies between source files and things that depend on them. For example rules that are implicitly sequential in -j1 mode but if they are written as

target: dep1 dep2 then dep1 and dep2 might be executed in parallel if -j>1

There are not many make expert (I am not one) so looking and figuring out the issue is sometimes tricky so often I see -j1 used always by default.

</comment></comment></comment><comment><USER7> I also like the simple option to spawn processes in a loop in bash and then wait.

[http://stackoverflow.com/questions/356100/how-to-wait-in- bas...](http://stackoverflow.com/questions/356100/how-to-wait-in-bash-for- several-subprocesses-to-finish-and-return-exit-code-0)

</comment><comment><USER8> Here's a bash script for running scripts in parallel (which I use in production at work).

[https://github.com/jchavannes/procman](https://github.com/jchavannes/procman)

<comment><USER9> Yes, running in background and checking the status of the pid is coming to mind when one has to do that Bash. I always feel that it's stretching beyond the normal level of usage. For example what can you do with the output? There is no way to sync it unless you'll capture it in a file and analyze later. In cases when I need to write something parallelized I feel that using Bash isn't the best idea.

<comment><USER8> Yeah, I agree, but there are some use cases for a simple bash script. I updated the GIT repo with a PHP version that has output and errors like you said.

</comment></comment></comment><comment><USER10> See also Gnu Parallel - [http://www.gnu.org/software/parallel/parallel_tutorial.html](http://www.gnu.org/software/parallel/parallel_tutorial.html)

</comment><comment><USER11> why doesn't the person just use 'time' to show how long it took instead of saying off the cuff 'saved X seconds'

</comment><comment><USER12> There have been 14 posts from this site (not counting deleted ones) and most appear to be unauthorized, uncredited translations from a Russian site, habrahabr.ru. Some of the Russian texts were themselves translated from English. See the discussion at [https://news.ycombinator.com/item?id=7754641](https://news.ycombinator.com/item?id=7754641).

Should we ban kukuruku.co? There's good content (if not good English) in the articles, but these tactics are sleazy and it doesn't feel like behavior HN should be involved in encouraging.

[https://news.ycombinator.com/item?id=7770909](https://news.ycombinator.com/item?id=7770909)

[https://news.ycombinator.com/item?id=7770887](https://news.ycombinator.com/item?id=7770887)

[https://news.ycombinator.com/item?id=7770727](https://news.ycombinator.com/item?id=7770727)

[https://news.ycombinator.com/item?id=7768391](https://news.ycombinator.com/item?id=7768391)

[https://news.ycombinator.com/item?id=7765671](https://news.ycombinator.com/item?id=7765671)

[https://news.ycombinator.com/item?id=7764938](https://news.ycombinator.com/item?id=7764938)

[https://news.ycombinator.com/item?id=7763187](https://news.ycombinator.com/item?id=7763187)

[https://news.ycombinator.com/item?id=7753792](https://news.ycombinator.com/item?id=7753792)

[https://news.ycombinator.com/item?id=7753166](https://news.ycombinator.com/item?id=7753166)

[https://news.ycombinator.com/item?id=7741937](https://news.ycombinator.com/item?id=7741937)

[https://news.ycombinator.com/item?id=7734202](https://news.ycombinator.com/item?id=7734202)

[https://news.ycombinator.com/item?id=7732049](https://news.ycombinator.com/item?id=7732049)

[https://news.ycombinator.com/item?id=7727016](https://news.ycombinator.com/item?id=7727016)

[https://news.ycombinator.com/item?id=7702566](https://news.ycombinator.com/item?id=7702566)

<comment><USER13> Please ban them, this is absolutely unacceptable. The original author put hard work into his writing, and I _still_ don't see any credit in a majority of their translations. They have published 14 articles in total without any credits going to the original author. It's definitely not the type of news I would expect to be associated with a "hacker". I do not see any links to the original source at [http://kukuruku.co/hub/cpp/lock-free-data-structures- introdu...](http://kukuruku.co/hub/cpp/lock-free-data-structures-introduction)

They are stealing content.

Another user (leephillips) posted the following about their posts: "I went to the site and left a comment complaining about how they stole your article. They deleted the comment, and you still aren't credited. Does HN have a blacklist of sites that steal content or publish only blogspam? I think they should consider it." \- [https://news.ycombinator.com/item?id=7754641](https://news.ycombinator.com/item?id=7754641)

<comment><USER12> I understand how you feel. But to be fair, the author of that translation has said (on HN, as well as in a reply to an email I sent him) that he didn't mind it being used and that it was itself a translation of an English article to begin with.</comment></comment></comment>


Learning a New Language - <AUTHOR> http://simergence.blogspot.com/2009/05/learning-new-language.html

<comment><USER2> Thanks for submitting my blog article to HN, I have to admit I was momentarily shocked when I ran across it on the 'new' page.

The post documents my nascent exploration of functional languages as a long time Java developer. If anyone out there who is curious about doing the same thing, or has made the switch themselves, has any questions or ideas for followup posts I would love to hear them!</comment>


Peter Thiel and Silicon Valley's Obsession with Superficial Thinking - <AUTHOR> http://www.institutionalinvestor.com/inside-edge/3387493/peter-thiel-and-silicon-valleys-obsession-with-superficial-thinking.html

<comment><USER2> Contrarian thinking doesn't reflexively oppose the consensus, but rather _starts with the assumption_ that the consensus is wrong, insufficient and or irrelevant.

In this case, the reviewer notes a seeming contradiction between Thiel's critique of higher education and his implicit acknowledgement of the value of relevant credentials on the Founders Fund website. The reviewer attributes this to a sort of subconscious hypocrisy since he _assumes_ that Thiel takes "everything about higher education is bad" as a first principle. If he sees this rather as an initial hypothesis, it's quite easy to see how he'd conclude (in this case) that the _signaling_ component of prestigious credentials has a value apart from the entire higher ed enterprise. It does not follow that if higher education is in a "bubble" it also has _no underlying value_. Both assertions could very well be true.

I think both a "consensus impulse", i.e. the impulse to agree, and a "contrarian impulse", the impulse to disagree, is present in everyone to varying degrees. In most people, and in most circumstances, the former dominates for good reasons: the practical social benefits of "going along to get along" _and_ , intellectually, the likelihood that even if not "correct", the consensus captures some underlying truths, particularly in rigorously tested domains such as science. As such, treating the consensus as your acting hypothesis is a great heuristic for success.

It is _precisely_ for this reason that opposing the consensus, even if only as a thought experiment in your own mind, is _also_ of great value. If Einstein took Newtonian physics as unalterable doctrine, say as the Church used to view Aristotelean physics, he may have dismissed his own intuitions about relativity to his (and our) great detriment. Where exactly to draw the line and apply your reasoning is a highly subjective and particular exercise, and "think for yourself", cliched as it sounds, is seems as good a rule as any. To paraphrase Orwell, the hardest things to see are those right in front of your own nose.</comment>


Line Notify Client SDK – Lotify - <AUTHOR> https://github.com/louis70109/lotify <comment><AUTHOR> Lotify is my first client SDK with my friend, It support developer use LINE Notify quickly,

I referenced line-bot-sdk-python tests which I think so good!

Welcome Issue or PRs if any problems :)</comment>


Trying to understand incubator math - <AUTHOR> http://startupnorth.ca/2011/08/21/trying-to-understand-incubator-math

<comment><USER2> As in startup investing generally, the expected value comes mainly from a small chance of a big hit, multiplied by lots of investments. You're hoping that if you invest in 100 startups, one will be a Dropbox or Airbnb.

For this to work, you have to (a) invest in a lot of startups and (b) they have to be drawn from a pool that could include big winners.

The latter could actually be a problem, if you're not founders' first choice. If you lose the big winners, your returns might be orders of magnitude smaller, even if you get everyone else.

Yes, you do have to invest for years before you end up in the black, even if things go well. That's also true for startup investing generally.

When we started YC, the returns seemed completely unpredictable. (They still do actually.) What allowed us to do it was that we didn't care if we made money.

<comment><USER3> Though the big hit makes the major returns, doesn't the one small hit per session cover the operating expenses? (Reddit, Zenter, 280North, etc. etc.)

I think this is what the original post might be missing. The top incubator(s) can patiently wait for the big hits, as long as they've got 1-in-20(ish) small hits to keep them in the black.

<comment><USER2> You can't count on that, because acquisitions are so unpredictable. In bad times they dry up entirely. YC was not in the black till December 2010, more than 5 years after we started.

<comment><USER4> Sounds like it was Heroku's $212 million sale to Salesforce that pushed YC into the black. Though, I imagine if you also include on paper gains, you were in the black much earlier.

<comment><USER2> Actually it was either Zecter or Cloudkick. December was a big month.

</comment></comment></comment></comment></comment><comment><USER5> _"it's sole purpose should be to make money."_

Wrong use of "it's". Wrong application of "sole".

Why would an incubator, or any business, only have a "sole" purpose? Certainly, it makes sense for them to have a purpose that is "to make money", but what requires that to be its sole purpose?

If a client every came to me and declared their sole purpose in business was "to make money" I would 1) not take them on as a client, but not before 2) strongly suggesting that there is something far deeper than money which needs to drive them and their business if they're to make that money. Maybe their underlying reason is still personal, like being able to holiday 11 months a year or have enough money to send their kids to a better school than they went to. Maybe their other purposes include changing peoples' lives or delivering health initiatives into a third world country. Both benefit enormously from a sustainable, profitable company. And it's a lot easier to recruit motivated staff, build clients, gain media attention etc when your authentic reason is more than money.

Trying to solely make money is like running a business solely to not make money - makes no sense, and I've not seen anything in incubators that indicates they're any different.

<comment><USER6> Also:

 _"If your running an incubator.."_

Wrong use of 'your'.

<comment><USER5> Possibly missing my main point, so I must refrain from nitpicking, especially when I'm making a more significant point.

</comment></comment></comment><comment><USER7> what are you missing? the fact that the vast majority of your return will come from just one or two major exits after funding 50+ companies.

</comment><comment><USER8> It certainly makes ycombinator's performance seem all the more impressive.

What is left out of the equation is the opportunity cost of Angel/VC time. And benefit too. The caliber of advice and strength of networking has a huge impact on fund performance. This comes at a large opportunity cost, as advisor time and attention could be deployed elsewhere. I believe this opportunity cost is higher than tangible dollars. Te benefit certainly is.

</comment><comment><USER9> re: "An incubator is a business and it's sole purpose should be to make money."

Not necessarily. Some incubators are government organizations or non-profits, with the goal of improving the local economy.</comment>


New Study Finds Eating Spicy Food Doubles Your Chances of Dementia - <AUTHOR> https://bestlifeonline.com/spicy-food-dementia-study/ <comment><USER2> _Researchers out of Qatar University assessed the chili intake and rate of cognitive decline of nearly 5,000 Chinese adults aged 55 and older over a 15-year period._

If you are poor and in China, those chilis may be getting dried over an open coal fire. This is known to come with myriad negative health impacts.

 _At least 3,000 people in Guizhou Province in southwest China are suffering from severe arsenic poisoning. The primary source of the arsenic appears to be consumption of chili peppers dried over fires fueled with high-arsenic coal._

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC34284/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC34284/)

</comment><comment> xkcd-sucks Given the limited geographic distribution of study participants, the study might suggest pervasive environmental contamination of hot-pot ingredients instead of a capsaicin effect

</comment><comment><USER3> What is the capsaicin content of 50 grams of "chili"? What is the scoville measurment of these chilis?

This is totally absurd.

Those who are more chili were more active and had a lower BMI? I'm considered overweight and eat crazy amounts of spicy things. Sounds like a bunch of hooey to me.

<comment><USER4> Yes, even the study says as much, for example: "In our study, there was a significant difference in chili intake among people with different education levels. Therefore, it is possible that the confounding effect of education may still contribute to the relationship between chili intake and cognitive function." So it's equally possible they discovered that poor people eat more spicy food than rich people in China... If there actually is a causal relationship, we would expect to see much higher rates of dementia in India or Mexico, which doesn't seem to be the case.

<comment><USER5> > So it's equally possible they discovered that poor people eat more spicy > food than rich people in China...

It'd be surprising if that wasn't true, since spicy food is a very regional phenomenon. There are two provinces known for spicy food: Hunan and Sichuan.

If an American study demonstrated that eating Cajun food spiked your odds of being poor, what would that mean?

</comment></comment></comment><comment><USER6> Bollocks. Seriously.

</comment><comment><USER7> Pseudoscience bullcrap. Pry my dozen jars of Trader Joe's sweet pickled jalapeños in the pantry from my cold, dead, demented hands. (I'm not even kidding.)

</comment><comment> chupa-chups [https://en.wikipedia.org/wiki/Replication_crisis](https://en.wikipedia.org/wiki/Replication_crisis)

If you're downvoting, please just reply with a reasonable explanation why, since I like to learn where I am likely wrong, and you hopefully like to educate someone having a differing opinion. Thanks.

<comment><USER8> This. It's not science if it hasn't been replicated.

OT: does anybody know if there's a site that tracks which studies have been replicated and which ones haven't?

<comment><USER9> I've found it useful to just google a particular study + replicated/reproduced. But some time ago I also found [https://replication.uni- goettingen.de/wiki/index.php/Portal:...](https://replication.uni- goettingen.de/wiki/index.php/Portal:Replication_in_other_fields_of_science) that links to a few resources (that wiki itself is for replication in economics).

<comment> chupa-chups I can't find any. Can you help?</comment></comment></comment></comment>


Cluep, a Canadian startup that raised just $500K, acquired for $40M - <AUTHOR> https://techcrunch.com/2018/09/20/cluep-a-canadian-startup-that-raised-just-500k-acquired-for-40m/ <comment><USER2> Good for them, with just a 500K investment I would guess the following

1\. The founders should own at least 75% of not more which gives them a neat 30M in this deal.

2\. As others pointed out, why such a poor multiple on revenue? The possibility is that they had a service heavy business (ie bulk of revenue came from service to customers).

3\. From point 2, they mostly had negligible or no IP. If they had significant IP and sold for this multiple then it is a poorly made deal.

4\. They raised only 500K, ie equity capital. There is no mention about their debt & other liabilities. This could be another reason for the low multiple.

5\. Deal type is key, if it was cash it is good but if it was equity/options, then not so good.

We closed our acquisition beginning of this year as follows:

Value: 9.5M USD Type: Cash Revenue: ~1M USD Valuation: 10X Investment: 300k USD Debt/Liability: nil Status: Profitable Investor returns: 5X Location: India

<comment><USER3> What is the name of the aforementioned acquired Startup?

<comment><USER2> It's a private deal and unfortunately I cannot reveal due to the non disclosure terms.

<comment><USER4> Why would you agree to those disclosure terms?

Would they have walked if you told them you wanted it taken out of the agreement?

Why I ask: curious why people agree to gag orders and similar for no justifiable reason.

</comment></comment></comment></comment><comment><USER5> My instinct tells me that this is a much better outcome for founders and many employees than "unicorns".

It's possibly not as good an outcome for investors, and they might actually view this as a bad exit.

Am I wrong? Would most investors be pretty happy with this? Would most founders/employees be better of going for creating a unicorn?

<comment><USER6> Given that Cluep is Canadian, I would expect the $500k they raised to be on a $2M Cap convertible note or some similarly valued instrument. That's totally a guess, btw. They could've sold way more or way less of their company. But, ballparking here.

So, ~20x return over 6 years for investors that are likely non-institutional. In short -- it's probably a very good deal for Angels. That's about a 65% YoY compounded return. It's likely that outside of the founders nobody is going to retire, but that's OK. It's only when deep institutional pockets get involved that <$100M exits are considered "weak."

<comment><USER5> For Angels but what about seed funding? YCombinator/Other incubators?

<comment><USER6> There's likely not much if any institutional money involved in a $500k raise.

If there was, then it's not as great of an outcome, but to an institutional investor this would likely just have been a "let's see what happens" check -- which makes it pretty good regardless.

</comment></comment></comment></comment><comment><USER7> "Everyone loves a tale of a bootstrapped startup founder's journey to an eight-figure exit."

How is raising $500,000 bootstrapping?

<comment><USER8> The point is that they grew their business mostly out of revenue. Yes you can get into a technical discussion of what a self-funded company is, but it generally misses the point. Setting yourself up so that you can be sustainable out of revenue at times requires a different approach and mindset which is at the core of self-funded companies.

<comment><USER7> But bootstrapping has a binary definition. You have either raised money or you haven't. And there is a huge difference between $500k and $0. And I don't say that in the theoretical sense. I currently run a bootstrapped company that does $10m+ in revenue and $500k is still a huge amount of cash for us that would change the way that we conduct business. I can't imagine how big a difference it would have been in the early years of the business.

</comment></comment></comment><comment><USER9> Can anyone shed some light on that revenue multiplier? Seems pretty low for a growing company.

<comment><USER10> It's possible they book or publicize revenue like 'ad sales' in which they only take a commission. So their gross margins wouldn't be huge.

</comment></comment><comment><USER11> For context, $500K is a big investment in Canada. Startups here get very little funding. Smart Silicon Valley investors could make bank by investing in Canadian startups for pennies on the dollar.

<comment><USER6> That could be a start, but this is the wrong mentality.

Investors shouldn't back Canadian startups because they're cheap. That's almost a distinctly Canadian view of investment -- get things cheap, undervalued, or with a low risk profile. (Sorry, Canada, somebody in Canadian VC is going to roll their eyes at me here but it's pretty accurate.)

They should back Canadian or Canadian-led startups because _talent_ is undervalued, and with the right mentorship and a good talent aggregator (an ambitious company that can compete on the world stage), the ROI on product development is going to be through the roof. Don't think about it as getting talent on the cheap, think about it as: if you pay the talent what they're worth, they're going to do 10x the job for you.

Note: there's been a huge uptick in Canadian tech $ recently. Both Microsoft and Uber investing $750M combined in Toronto, announced just this month. People _are_ noticing.

... but that's just my $0.02 :).

Edit: First thing you learn when you talk to sophisticated investors / founders in SV is nobody gives a shit about cheap. Bad investors chase "cheap." What's most important is total magnitude of the opportunity space: who cares what we pay today, how big could this be? Because if the answer is "there's a $3T opportunity here over the next decade" then it doesn't matter if you invest $1M or $10M from a $1B fund -- in fact you'd probably rather invest more to ensure the company you're funding stays capitalized.

You're not going to get top SV VCs dumping $ into Canada because they can make a few bucks on cheap deals. You'll get top SV VCs dumping $ into Canada when the collective Canadian psychology changes from, "we're cheap, invest in Canada" to "we're going to be the most technically sophisticated nation on the planet, and a primary home of the next five major $100B technology companies over the next 30 years."

Canada will get there. Already leading in AI. But not by being "cheap."

<comment><USER11> I meant cheaper while still offering the same degree of talent. Not just cheaper. But I think you raise very good points about framing the discussion in terms of talent rather than cost.

</comment></comment></comment><comment><USER12> After reading the revenue figures, the sale is a lot less outrageous than the title makes it sound.

<comment><USER13> Unless their product is extremely manual and depends on hiring on a bunch of engineers to train models for each customer

<comment><USER14> Firstly, you'd probably want 50% data people, 50% engineers to make that work acceptably. Secondly, that kind of stuff is totally viable to throw automated grid-search at, especially if you've just been acquired by a profitable company.

Finally, I reckon that the comment upstream about GDPR is probably correct. Suddenly facing way harsher terms for 30% of revenue (assuming standard breakdowns) is double-plus ungood, which may have sparked this.

To be fair, if I were them, I'd totally have taken the money and ran.

</comment></comment></comment><comment><USER15> The article states that they're on track to get $30M in revenue in 2018.

At $53M (CAD), that's just a little over a 1.7x multiple

Isn't that a little low? I've seen crappy AdSense websites go for 2x multiples

</comment><comment><USER16> Lots of people think about the low rev multiplier but maybe a) the founder, all being quite young, just wanted out and do something new, b) the money is all in cash without strings attached or c) they have a sense that with the GDPR in europe and similar laws possibly coming up elsewhere their company and revenue might plateau rather soon.

If someone offered me >10 million, I'd take the money and run.

</comment><comment><USER17> Not clear what the product really is. How are they getting Instagram data for the users?

</comment><comment><USER18> A little bit about the company

That's a cookie cutter Internet ads DSP shop with few buzzwords painted over on top, namely the alleged "smart AI algorithm." Something now standard.

</comment><comment><USER19> Oh boy, another advertising platform, just what the world needs.</comment>


Ask YC: what if you can't attend the 3 month program? - <AUTHOR>

Is it possible to be funded by YC even if the founders can't be in SV for 3 months? I know the founders would miss a lot of the value of YC by not being able to attend the program but has it been done and is this even allowed? <comment><USER2> It's a FAQ <http://ycombinator.com/faq.html>

_Can we do it without moving to where you are?

Sorry, no. We tried this once, and by Demo Day that startup was way behind the rest. What we do, we have to do in person. We would not be doing a startup a favor by not making them move.

You can leave one founder at home, but the rest, including the CEO, have to live in the Bay Area during the 3 month funding cycle._

<comment><AUTHOR> Thanks for that - not sure how I missed it.</comment></comment>


QT on Google Native Client - <AUTHOR> http://labs.trolltech.com/blogs/2009/12/17/take-it-with-a-grain-of-salt/

<comment><AUTHOR> 1997^H^H^H^H1961 is calling; someone just picked up the rotary phone. [http://video.google.com/videoplay?docid=-2950949730059754521...](http://video.google.com/videoplay?docid=-2950949730059754521#21m25s)

</comment><comment><USER2> This should be written Qt, not QT (QuickTime)

<comment><AUTHOR> True that.

</comment></comment><comment><AUTHOR> (Via <http://www.reddit.com/user/markmuetz> on Reddit.)</comment>


Partial password usability sucks - <AUTHOR> https://gaevoy.com/2019/03/06/partial-password-sucks.html <comment><USER2> > _The idea is good it gives you an extra layer of protection against password > theft (link 1, link 2, link 3)._

That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out.

Sounds like ING Poland needs to be called out by some security researchers.

[0] [https://security.stackexchange.com/a/194818/47800](https://security.stackexchange.com/a/194818/47800)

[1] [https://security.stackexchange.com/a/7479/47800](https://security.stackexchange.com/a/7479/47800)

[2] [https://security.stackexchange.com/a/196430/47800](https://security.stackexchange.com/a/196430/47800)

<comment><USER3> What's more likely - that the bank gets hacked, or that you install a keylogger?

Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted. One example I just thought of:

Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't remembered (and fill the ones you remembered, then hash everything and compare).

You can adjust the percentages as needed if having 25% of the password in clear text is too insecure.

<comment><USER2> > _What 's more likely - that the bank gets hacked, or that you install a > keylogger?_

Given the (apparent) lack of security for the bank, I'd say the former. IF the bank was actually secure, then sure it'd be more likely for me to have a keylogger.

> _Also there are ways to implement this without keeping the whole password in > plaintext /reversibly encrypted_

Maybe.

> _One example I just thought of: Ask for 75% of the password each time, > remember random 1 /3rd of that (25% of full password) till the next login > together with the hash, and on the next login ask for all the letters you > haven't remembered (and fill the ones you remembered, then hash everything > and compare)._

I challenge you to really think about what you're proposing to do. I think it's far more convoluted: it does _not_ solve the keylogger problem and adds complexity to both the client and the server. If you think I'm wrong, then write it up in a spec and show us.

<comment><USER3> > If you think I'm wrong, then write it up in a spec and show us.

Sure. It's fun.

On password creation:

0.0. demand 25% longer passwords from users than considered safe

0.1. along with the hash of the whole password remember a randomly choosen 25% of the characters of the password and their positions (in clear text or reversibly encrypted)

On each login:

1.0. ask only for the characters in positions you haven't remembered

1.1. server-side fill the positions you remembered

1.2. hash the result and see if it matches

If hash matches:

2.0. randomly choose 1/3rd of the freshly provided positions and remember them in clear text on server replacing the previous ones

2.1. give access

If hash doesn't match:

3.0. deny access, don't change anything on server

If I understand correctly - to get the whole password keylogger must be specific to this bank site (to understand which characters are provided), and must be active on at least 4 logins. In my book that's a big improvement.

And I can imagine writing the login page in a way that makes parsing it in keylogger to understand which characters are masked.

<comment><USER4> > If I understand correctly - to get the whole password keylogger must be > specific to this bank site (to understand which characters are provided), > and must be active on at least 4 logins. In my book that's a big > improvement.

The difference in difficulty of keylogging 4 logins, and 1 login is, in practice, small. Once your computer is pwned, all bets are off.

<comment><USER5> I think there's a big difference between capturing the whole password at once, and having to reconstruct it contextually - it may be difficult to recover the typing context. Even if the context is known 100% reliably, it will take far more than 4 logins to scrape enough information to reconstruct the password - you need overlap to match the fragments. It the user visits any other site that uses a similar scheme, it gets harder. If a a site chooses to 'salt' the password by making the user retype random characters, it gets much harder - now you need enough logins to apply statistical analysis. If the site makes the user type the characters in the wrong order, you can't reassemble the password at all - all you can do is guess the order.

To gather enough contextual information to defeat all this reliably, the keylogger would also need to be a screen scraper, internet monitor, etc. Straight away, this defeats the not-uncommon case of the inline USB keylogger.

<comment><USER4> Someone breaking into my apartment, and putting an inline USB keylogger on my computer, that is incapable of doing anything but recording keystrokes, to steal my banking login, is both seriously overthinking their crimes, and, at the same time, seriously underachieving.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> > Open partial-password.github.io & copy-paste your password there.

Sounds like a great idea, let's all paste our bank passwords in this website!

Banks have peculiar ideas about security sometimes, I don't think this partial password business will have a net positive effect (especially if people use "solutions" like these and potentially send their password to a third party)

<comment><USER7> Exactly this. I have the misfortune of occasionally needing to deal with an online banking portal (located in South Africa) that uses this stupid scheme. Every time I log in, I wish an eternity of torture on the idiots who came up with it.

I just cannot imagine the thought process of the people who though that partial passwords could be better in any way than classic passwords.

<comment><USER8> Banks especially seem heavily "invested" in finding the biggest/laziest loopholes in security laws that they can and driving forklifts through them for as long as possible.

In the 90s, laws in multiple countries asked banks to research and implement Two-Factor security. They invented all of these stupid, stupid Wish-It-Were- Two-Factor things that _are not_ Two-Factor but "feel Two-Factor enough" to avoid actually deploying proper 2FA, but avoid security fines: "Security Questions" (bonus passwords, still 1FA), multi-step login with "user selected pictures" (not an extra factor, just a silly memory game to potentially cut down on phishing), "partial passwords" (still 1FA).

(Then other idiot sites copy these "security best practices" because Banks use them, rather than actual security best practices.)

It is starting to seem like a lot of the money spent on the development effort of these "not 2FA" workarounds and portal workflows could easily have just paid for sending every bank customer a YubiKey or three by now.

</comment></comment></comment><comment><USER9> Make your security policy difficult enough to comply with, and people will find workarounds like pasting their passwords into strangers' websites.

<comment><USER10> Or people will just pick short passwords so its easier to count along the chars in their head. Again, not a thing we really want to encourage.

</comment></comment><comment><USER11> Perhaps I'm misunderstanding the security model behind this, but why should the site be storing my password's length at all? Why does it know I have a 10th character at all? The site should just have a hash of my password (normalizing the length).

<comment> john-radio I guess (hope) they just have a collection of patterns that they apply (like (3, 9, 11, 12, 15) from the OP), and when they store your password's hash, they also store the hash of those several characters so that they can present the pattern to you later and check whether you matched the pattern correctly.

<comment><USER12> 5 characters is "pretty simple to bruteforce" area, and now you've got 5 characters, replicate that for the other patterns, and you can probably crack the whole password pretty easy

</comment></comment></comment><comment><USER13> "Please enter your password in this mutable github pages page." Eek.

I have a real desire for a document firewall mode where nothing can enter or leave.

<comment><USER14> Nor be stored for later retrieval.

Such a firewall, when disabled, would essentially have to restore the whole page memory to how it was when it was enabled, and block access to localStorage / IndexedDB / Cookies / Cache.

</comment></comment><comment> munk-a Partial passwords are a terrible idea for a multitude of reasons but one in particular stands out to me. We have come to the general conclusion that humans shouldn't remember their passwords, they should remember one complicated pass key that is linked to a number of otherwise inaccessible secret keys used to interact with servers but, let's step back for a moment and assume people are remembering their passwords (which most people not on HN still do)...

A password has an entropy n, a higher n yields more security but comes at a cost in terms of memory power, I think it's reasonable to state that very high entropy passwords exhaust our memory quite quickly which is why password reuse is so common, this particular authentication is requiring the user to have a high entropy password n, and then is reducing it to an entropy m where m is at most as large as n (usually much smaller) and using that for authentication.

We, users and tech people, don't care about the cost to transmit bits over the wire or the cost to verify those bits on the far end (in this scenario) we care about the cost on the user's memory more than anything so why are we optimizing this puzzle to be least efficient for our most valuable resource.

When I first read this article I thought this practice was silly, now it strikes me as stupid... it is a transformation that simply discards some of the potential security of the system for no reason.

(Also, banks love ease of use, which is why up here in Canada they love to send out password dongles to customers that make it even easier to log in to a site than this while still requiring possession of a physical thing - and many of those dongles require additional authentication to activate whenever using, though not all)

<comment><USER15> Advice and tactics for passwords have been bad for a long time, perhaps even comically so:

[https://imgs.xkcd.com/comics/password_strength.png](https://imgs.xkcd.com/comics/password_strength.png)

<comment> munk-a I agree, and a concise response to this article can pretty much be summed up as "Don't roll your own security" for... the fun of it I suppose, I wanted to take a swing at one particularly (IMO) good tear down of why it's stupid for technical reasons, but simply rubber stamping "Don't roll your own security" is pretty acceptable on any of these proposals.

This stuff is complicated, if you're a professional at it good on you, it's a tough job, otherwise... just listen to the professionals/best practices and don't feel the urge to be creative, you'll probably break something. It is possible that everyone is wrong, but it's unlikely... and when everyone is wrong (for example Dual_EC_DRBG) if you're using that system it'll be hard not to be aware of the issue when it comes to light.

</comment></comment></comment><comment><USER16> That's such a strange UI. I couldn't tell you the fifth letter of most words without writing them down, let alone that of my 20 character passwords.

<comment><USER3> You just spell it in your mind going through all the letters and only press keys where asked.

I'm recently switched from a bank that uses regular passwords to a bank that uses partial passwords, and it took me a week or so to get used to this, and it is a little slower (takes me like 10 seconds instead of 1), but it's nothing significant.

<comment><USER10> You have made the assumption that everyone who uses strong passwords can remember them in their head :-)

</comment></comment></comment><comment><USER17> Coming soon to a Poland near you: partial fingerprint authentication at ATMs:

"Please put these tiny stickers in the correct locations on your thumb, and then press it against the sensor ..."

<comment><USER18> How about "Spit on this sensor to see your checking account balance"?

<comment><USER17> With a collection gutter at the bottom, from which your yearly interest will be derived.

</comment></comment></comment><comment><USER19> I'd love to run some math on the entropy this actually gives you... If you assume people are using common dictionary word passwords, you could even develop special tables based on common letter positions or substrings.

Assuming a character is 5 bits of entropy...

An 8 character password gives you 8 choose 4 = 70 possible variations it could ask. Each variation is 4 characters (20 bits of entropy). So, that brings it up to 20+log2(70)=26.1 bits of entropy for an 8 character password... Compared to 40 bits of entropy normally...

And that's not even accounting for using common words/phrases. This scheme seems to lose about 1/3 the entropy.

12 character password gives only... 28.9 bits of entropy instead of the expected 60 bits.

And that's not even including more obvious attacks like stealing the plaintext from the server, since it obviously isn't salted on the server side (and it reveals the length of your password on the front end too??)

Edit: I noticed I used "choose 4" instead of "choose 5" but the math is similarly bad. I leave it as an exercise for the reader.

<comment><USER19> And an 12 character password only giving you ~500 possible subselections means if the 4 character string was stolen, you could brute force in within a few minutes. This is hardly better than than just leaking the entire password.

</comment></comment><comment><USER20> This sort of thing needs to be built into password managers.

<comment><USER21> Agreed but I'd rather they allow normal passwords where you can use the "password you can't remember" and U2F token like civilized people.

</comment></comment><comment><USER17> Jawdrop ... that is the most idiotic thing I've been made aware of in quite some time.

First of all, never mind all the gaping usability problems and obvious decrement in security.

The system must be storing passwords in plain text in order to make this work.

I can think of ways that don't require plain text storage (like pre-computing various partial passwords and hashing them separately), but (1) people who came up with this idea would be too stupid to have implemented that, and, (2) in practical terms, it significantly reduces the possible number of partial passwords: we can't hash all of the subsequences of the string, because there are vastly many, so we have to rather generate some reasonable number of canned subsequence positions. Such a reduction in itself is a security compromise.

</comment><comment><USER22> The solution to keyloggers is not partial passwords. The solution is requiring two factors! In Norway there is a shared authentication infrastructure used by banks and other services called BankID: [https://www.bankid.no/en/private/](https://www.bankid.no/en/private/) They facilitate second factor auth either with an OTP device or via your cell phone's sim card. It just works.

All Norwegian banks use a password + second factor. And these days I think most of them have liberal password rules, in that you are allowed quite long passwords. Schemes like the one described in the post seems like a poor attempt at improving security.

</comment><comment><USER23> So they are storing length and hashes of subsets of the password?

You could brute force a subset of 4-5 characters way easier than a 20 characters password.

How is this secure? Anyone care to explain how this adds security?

<comment><USER24> It doesn't. It's theater.

</comment></comment><comment><USER25> For the context: partial passwords have been the default and a de facto standard for Polish banks since early 2000s. They are not "cutting edge novel idea" but more a common legacy.

I think people got used to them, so changing this now for everyone would feel weird (and would probably annoy many).

In some banks you can opt-out in settings and have regular password instead.

I guess it's an equivalent of swipe cards in USA.

</comment><comment><USER26> > If you don't trust partial-password.github.io consider to save the page > locally and run it from there

This doesn't really make it safe per se, there still can be a script running that triggers an AJAX call in the background, sending the password to some web URL.

<comment><USER27> I think the assumption is that you would check the source code before executing it.

</comment></comment><comment><USER28> My solution to this:

i use password that contains only 5-letters words

so each new word starts at 1, 6, 11, 16, 21 etc

it's easy to scan the password for specific letter in memory this way

funny thing: i didn't do that on purpose. I just came up with a password that happend to have such words only.

<comment><USER28> PS. If author reads that maybe:

saving a webpage on disk can still be considered unsafe. you can send a password to the internet via various way, like insering an image with url: evil.com/pass.jpg?pass=enteredpassword

</comment></comment><comment><USER29> i m sure someone was promoted for this 'security innovation'

</comment><comment><USER30> Convenient 2FA is the answer, not weird UX.

</comment><comment><USER31> Lloyds TSB used to do the same. No idea if that's still the case.

<comment><USER10> Halifax does it still. All the same bank really ;)

</comment></comment><comment><USER32> This is a retarded feature and I hated it when I had to use it.</comment>


How Garmin Failed to See the iPhone Threat - <AUTHOR> http://allthingsd.com/20120612/how-garmin-failed-to-see-the-iphone-threat/

<comment><USER3> My personal experience with Garmin (hopefully not too off-topic): I purchased a Garmin hiking GPS. Hiking GPSs, unlike the ones you get for your car, often don't come with maps. So, I purchased Garmin's U.S. Topo 2008 map, which covers the whole country with modest resolution. They also sell more detailed regional maps at a higher price. I found that Lake Nockamixon, one of the biggest lakes in Pennsylvania (1450 acres), was missing from the map. Marsh Creek (535 acres) was also missing. I reported this problem to Garmin, expecting them to apologize and vow to fix it in the next release. Instead, they claimed that the map I purchased didn't have enough "detail" to display those lakes and tried to get me to purchase the more expensive regional maps (which they confirmed did have the lakes). Both of those lakes were man-made lakes constructed in the 70's by damming up small creeks. The Topo 2008 map showed the creeks that were there 40 years earlier, rather than the lakes that existed in 2008. I pointed that out, but they continued to insist that it was due to a lack of "detail" rather than outdated data. I asked how the map could have enough detail to display the tiny little creeks from 40 years ago, but not enough detail to display huge lakes. I asked how the map could have enough detail to display 20-acre lakes but not enough detail to display lakes that were over 50 times larger. They had no answer for those questions. I asked to have it escalated to a manager, and I was told that the manager was in agreement -- it's just a lack of detail. No matter how hard I tried, I could not get them to care about the inaccuracies in their maps.

This article, with Garmin's CEO ignoring warnings of the threat from smart phones, reminds me of that experience. Heads buried in the sand, not wanting to listen to anyone.

</comment><comment><AUTHOR> "Fast forward to mid-2012 and yesterday's demonstration of new mapping and navigation capabilities on Apple's iOS 6. Garmin isn't a nonparticipant in the smartphone ecosystem: It builds many iPhone and Android apps for navigation, boating, aviation and outdoor sports. And, indeed, half of Garmin's business is in those nonautomotive areas. But it's about to get killed in the half that everyone pays attention to: Automotive navigation. "

Convergence works when there is a dominant physical device that is good enough to supplant purpose-built specialized devices.

<comment><USER4> True, but in this day and age - if you are running a tech company and you are not paranoid as hell about Apple/Google/Facebook farking you over - <USER2> you're unfit to run a tech company.

Now more than ever should everyone be worried about the famous question: "So whats to stop [Apple/Google/Facebook] from doing this?"

You need to take the OMGPOP route: build something very well and very successful that the Zyngas cant just steal it - they HAVE to buy you.

(Lets just hope the post acquisition health of the acquiring company is far better than Zynga's :)</comment></comment>


Ask HN: How do you find out about startup parties/events? - <AUTHOR>

Is there a master mailing list, facebook group, meetup, or some other organized approach?  Or, is it all just word of mouth via friends? <comment><USER2> There are a couple of sites you can lookup or subscribe for alerts:

<http://startupdigest.com/events/>

<http://lanyrd.com>

<http://www.eventbrite.com>

<http://www.meetup.com>

</comment><comment><USER3> They are everywhere. Go to a place where people are working on interesting things and there will be plenty of invites. I would never go to FB group, meetups could work depending on the city.

<comment><AUTHOR> What if you don't live nearby? How would someone from San Francisco find out about parties/events in New York or Houston?

<comment><USER4> Its almost impossible to miss if you live in SF. There are way too many everywhere. Especially if you have friends in the area who are into tech. Also people list events all the time.</comment></comment></comment>


AT&T names 11 new metro areas for gigabit fiber Internet - <AUTHOR> http://arstechnica.com/information-technology/2016/10/att-names-11-new-metro-areas-for-gigabit-fiber-internet/ <comment><USER2> Sadly we can't compare this reality to an alternate Earth where Google Fiber never came along, but given the launch schedule and pricing of FTTH service by incumbents, it's hard not to conclude that competition from Google Fiber was a key driver.</comment>


Ask HN: Twitter marks my link as suspicious - can't figure out why... - <AUTHOR>

My website is a sweepstakes/giveaway platform. We don't do anything fishy. I read through Twitter's terms and rules and don't see why our links are being blocked as spam and suspicious. Google says our site is safe and there is no malware. Really would like to understand the issue so we can resolve it. I have submitted the link for review via Twitter's form several times with no feedback at all.
Appreciate any one's help since I haven't had much luck figuring this out myself.
Please email me at email@example.com. Thanks so much, means a lot to me <comment><USER2> A sweepstakes/giveaway platform is almost always inherently spam. The name itself also is not good ( _never_ use a domain with "free" in it) and likely set off a few Bayesian red flags.

<comment><USER3> Even if they are inherently spam there should at least be some confirmation of this before marking an entire website as unsafe. Naturally they can do as they wish.

<comment><AUTHOR> yes they can do as they wish. just very frustrating that there is no feedback at all from filing tickets or emailing them. no way to know how to resolve the situation</comment></comment></comment>


How 'visionary' raised - and lost - a fortune  - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/12/06/MNIK147QU3.DTL

<comment><USER2> As an employee who worked at Pay By Touch, I can say this is a fantastic profile. Drugs, sexual harassment, crimes and hundreds of millions of dollars lost.

Pay By Touch's biggest problem was too much money. It chased a lot of initiatives at once and collapsed under its own weight. It really needed to be smaller and more focused.

I've did a post-mortem write-up here: [http://bhc3.wordpress.com/2008/03/19/farewell-pay-by- touch-f...](http://bhc3.wordpress.com/2008/03/19/farewell-pay-by-touch- farewell/)</comment>


How to recognise a good programmer - <AUTHOR> http://www.inter-sections.net/2007/11/13/how-to-recognise-a-good-programmer/

<comment><USER2> I always ask two questions: What's the coolest hack or project you've ever worked on? and What's the worst hack you've ever committed?

I like these questions because if a programmer is good (in my opinion)...you'll see that person light up and get excited.

</comment><comment><USER3> I'd say that there's a better single indicator of a good programmer. Many other valuable hobbies besides programming. Things like math, economy, philosophy etc.

<comment><USER4> Interestingly enough, those along with film, writing, and ping-pong are all hobbies I've got, yet I remain an excellent programmer if I do say so myself. ;)

Programming is not a passion that has to blot out all others.

<comment><USER3> I mean valuable hobbies. ;)

</comment></comment></comment><comment><USER4> This is good advice. In particular, I've never met a good programmer who treated it as a strictly 9-to-5 thing.

</comment><comment><USER5> Sorry, interesting little article, but I don't buy any of it.

A better title would have been, "A List of Some of the Traits That May Correlate with Good Programmers". Would you bet your business on judgements made from this list? I certainly wouldn't.

AFAIK, there's only one way to recognize a good progammer (or a good anything else):

* * * * * * * DEMONSTRATED PERFORMANCE * * * * * * *

Did you do it?

On time and under budget?

Does it work well?

Does it satisfy the stakeholders?

How easily is it extended or maintained?

<add your own evaluators of demonstrated performance>

I also believe that if you can do it once, you can do it again.

Evaluating quality by anything other than demonstrated performance is stupid and unfair to everyone involved.

<comment><USER6> I think the article is talking about a new-hire situation, not evaluation of one's own employees' efforts.

It'd be pretty hard to get metrics like yours in a hiring situation.

<comment><USER5> "It'd be pretty hard to get metrics like yours in a hiring situation."

And who here signed up for easy?

In a new hire situation, require examples of work done (on-line or otherwise). Make them code. Give them a conditional mini-project. Get appraisals from former clients, employers, co-workers. etc. etc. etc.

I could think of a hundred better ways to evaluate unknown talent that the suggestions from this article.

<comment><USER7> I might jump though that for a 150k job and or a fairly long 150+$/h project after the interview but IMO an extended interview process is a bad sign. If you can't tell if someone can code in a 2-3 hour interview you're in really bad shape and I probably want to avoid your team and your code.

Here are some real questions to separate the coder from the poser.

What's the worst hack you have ever done and why did you do it? What's you least favorite language and why? What's the hardest problem you have ever worked on? Why was it hard and how did you solve it? What's the most elegant solution to a problem you have ever devised?

IMO: Trick questions and odd syntax issues are just as useless as asking about their IDE of choice or how to solve a trivial problem.

PS: If you want to validate my credentials after while we nail down my fee that's one thing, but I am not going to give out references early in the process.

<comment><USER5> "Here are some real questions to separate the coder from the poser."

This is EXACTLY THE OPPOSITE of what I posted and everything I believe.

To repeat - there are NO questions or character traits to accurately assess quality from B.S.

The only differentiator is DEMONSTRATED PERFORMANCE. You need to find a way to determine this. I never suggested long interviews or trick questions (and have never employed them). Whatever it takes to determine DEMONSTRATED PERFORMANCE is necessary and sufficient.

And whoever downmodded my previous posts (and will probably take a hack at this one too) either doesn't get it or hasn't been burned yet.

(Why is it that when I willingly share my hard earned skills and knowledge, I get downmodded, and when I post a smarta$$ remark, I earn 20 unexpected points?)

<comment><USER8> I started restricting myself to smartass remarks for that reason.

By the way - a conditional mini-project seems like a good idea. Let them do something small but useful - for full pay - and evaluate performance.

I guess I could live with that on the receiving end.

<comment><USER5> "I started restricting myself to smartass remarks for that reason."

I understand why someone would do that; it's easy and fun (especially if you only have short breaks).

I implore you to reconsider. My own personal lack of peers to debate and commisserate with drives me to this site. The karma may be the gravy, but the experience is the meat. Sure would be nice to have you as part of it.

<comment><USER8> I just went from smartass remarks to citing for even easier karma. I hope you did not mind.

From a more serious point of view I agree. The quality of comments and submissions attracts me to this site, too. Thanks for the warm welcome.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> From the comments: "I didn't even realised [career programmers] existed! I assumed that all computer science/software engineering etc graduates were previously teenage hackers."

</comment><comment><USER9> So, he will only hire a Ruby programmer?

I thinks it's time to proclame: _Ruby is the next Blub. Long life to Blub!_

</comment><comment><USER10> #7 IBM sends them over and charges 160/hour.

<comment><USER11> That would hardly be a good indicator.

<comment><USER8> Too bad irony tags are invisible.

</comment></comment></comment><comment><USER12> Contribution to a free software project can be a good indicator too.

</comment><comment><USER13> I can't believe he didn't include Ramaze in his #5 list. :-)</comment>


First draft of R7RS (Scheme) small language available - <AUTHOR> https://groups.google.com/d/topic/comp.lang.scheme/MCfPoeir90s/discussion

<comment><USER2> _Apologies if you receive multiple copies of this message._

Like the other one still on the front page?

<http://news.ycombinator.com/item?id=2453832>

<comment><USER3> That is a standard preface for many lists that get a lot of crossposts. You'll see it a lot on most academic mailing lists where conferences and papers are announced and crossposted to many similar lists that receivers may be subscribed to.

<comment><USER2> I'm aware of its use as a courtesy to the readers. I was amused to see it on something that got posted here multiple times and hoped to let everyone else in on the joke.

</comment></comment></comment><comment><USER4> _The case-folding behavior of the reader can now be explicitly controlled._

Meh.

 _Module System_

Is there a discussion of this somewhere? Why this style of module system?

</comment><comment><USER5> Summary : [https://groups.google.com/forum/#!topic/comp.lang.scheme/MCf...](https://groups.google.com/forum/#!topic/comp.lang.scheme/MCfPoeir90s/discussion)

</comment><comment><USER6> What's wrong with R5RS?

<comment><USER7> Nothing's wrong with it; it just doesn't go far enough.

It doesn't define a standard module system or macros (beyond syntax-rules), exceptions, or record types. Most R5RS implementations offer those, but they're all different and incompatible. The standard also doesn't help with boring but necessary stuff like file encodings, character sets, etc.

So instead of writing a (nontrivial) program for R5RS Scheme, you have to write it for MIT Scheme or Racket or Chicken or Chibi or ...

<comment><USER6> What's right, though, is you can implement an interpreter in a weekend. That makes it usable in a lot of places. Once you add exceptions, that goes away. File encodings and character sets are nice, but short-sited. R5RS was eternal. No one predicted the move to Unicode 35 years ago when Scheme was created, and that lack of definition let it make the transition fine.

I'm all for recommendations on things like those, so if you chose to implement them, there's a standard way, but I'm not in favor of making those part of the standard.

<comment><USER8> Implementing an interpreter for a language in a weekend is a less common need than writing a program for the language. If you want to write an interpreter that does no more than R5RS in a weekend, R5RS is perfect for you. But surely you can see the need for a standard beyond that.</comment></comment></comment></comment>


Faster Firefox landing page increases download conversion by 15% - <AUTHOR> http://blog.mozilla.com/metrics/2010/04/05/firefox-page-load-speed-%e2%80%93-part-ii/ <comment><USER2> This worked about as well for me as it did for Firefox, when I implemented it a few years ago, after reading the YSlow presentations. I've said it three times on HN but I'll say it a fourth: watch one of the YSlow presentations, get their checklist, go down and tick off items on it. It is the easiest money you'll make in your life. Look at the improvements here: combining uncombined JS files and inlining CSS. These are tweaks that you can have coded, tested, and live in ten minutes or less.

As an aside: It is a little disturbing to me that I'm ahead of Mozilla on the Internet technology adoption curve.

<comment><USER3> does it make sense to inline css if it's the same across multiple pages?

<comment><USER4> Should do, since it's one less connection/round trip back to the server to get more data.

<comment><USER5> Shouldn't it be cached, though? You can't cache if it's in-line. (I'm not a web expert)

<comment><USER6> The short answer is no. Even an extremely intense, CSS heavy page might have say 16 kilobytes of CSS. After gzipping, that should turn into about 3 kilobytes. 3 kilobytes, inline with the rest of your content, is utterly negligible and caching that would probably classify as a micro-optimization, even though every instinct is telling you to put it in a nice, cacheable stylesheet.

It feels dirty not to cache it, but if you look at a download waterfall and see how much time it takes to send that separate http request (while blocking the display of the page) it is well worth it.

<comment><USER7> So what you would need is a bit of logic that applies your site-wide css to your landing page html on the server side and sends that to the browser, either on demand or by statically producing a transformed html page. Does anybody know about something like that? "html css server" are not really the terms to enter into a search engine if you want specific results...

<comment><USER6> No, you really just want to use inline CSS. Is it really worth all of the trouble just to cache 3 kilobytes of data (probably 20 milliseconds of download time)?

<comment><USER7> That is what I said, yes, except that I wanted a tool that does the inlining. But as another comment said, that tool would probably not worth the hassle, too.

<comment><USER6> I'm not totally sure what you mean by tool. Whatever framework you're using surely can include an external file, and if not, even Apache itself can handle this via SSI. It really depends what your web app looks like.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> It's clear that a benefit was seen. Moreover, it's clear that in other cases (shopping at Amazon, searching at Google), more responsive servers mean an increase in traffic, since people are free to shop / browse more, and it keeps people's interest.

In the case of a single site with a single product / purpose (ignoring Mozilla's other products), is there a generally agreed on explanation for what is going on here? Do people really change their mind about something as big as changing their web browser because of a delay of one-two seconds? Are these people marginal users and unlikely to actually finish installing it, or likely to abandon the browser after a single use?

I'd like a peek into the psychology of the marginal people in a scenario like this.

<comment><USER9> I often conclude that the people running websites are doofuses, and thus their product may be a no-good product, if the website doesn't meet the universal usability standard of speedy page views. That's a simple quality proxy heuristic.

</comment></comment><comment><USER10> Finally! It looks like someone actually did some simple math to determine if their results were statistically meaningful. I wish more people would include a section like this when they talk about conversion rates.

<comment><USER11> _15% looks great, but how confident are we?

Running a one-sided Student's t-test with a means difference of 14%, our experimental data yields a P value of 0.000051. This means that there is only a 0.0051% chance that we would obtain a 14% (or greater) improvement if the real effect wasn't at least this large._

Err... Student's t doesn't assign a probability to P(measured>=14 | actual<14), it assigns one to P(measured>=14 | actual=14) under the assumption of equal variances (which here means actual=0, so clearly not applicable).

I figure that the actual effect is 16.05% +- 0.17%. And that's simply by assuming 145k is close enough to infinity, and for IE.html only.

That is, unless I'm mistaken about this, since I grok only the fairly basic stuff. Which is certainly plausible in and of itself.

</comment></comment><comment><USER12> I don't know if this talk was ever made public but I heard at Google that under some circumstances cutting a few hundred milliseconds of latency can double click-through, conversions, etc., or even more. I do occasionally see Google people encouraging web developers to make their pages faster at conferences and such. Personally I would be very concerned about the money I was losing if I had a web site where the 95th worst percentile of my paying customers had to wait more than two seconds (from the client's perspective) for a pageload. I'd buy a bigger database machine, spread my servers to more geographical regions, whatever it took to try to bring that latency down.

<comment><USER2> Google's Marissa Mayer has presented their page loading results a few times publicly: in one unplanned experiment, about .5 seconds in marginal load time caused number of user searches (and, by extension, clicks on ads and Google revenue) to decline by 20%. That was the Web 2.0 Conference in 2006.

 _I'd buy a bigger database machine, spread my servers to more geographical regions, whatever it took to try to bring that latency down._

Why make life hard. Buying a bigger database server costs actual money and time. Getting out the YSlow checklist and knocking two to three things off of it costs nothing and no significant amount of engineer time.

Gzip CSS/JS files: four lines in your Apache config, warm restart, done. Collapsing CSS/JS together: 16 characters (:cache => true) in Rails, warm restart, done. Spriting CSS images: open a web page, type a bit, copy/paste what it tells you to to development, push to staging, verify it works, done.

Moreover, as compared to buying a DB or spreading your servers, these are virtually guaranteed to _actually work_. Many, many of the suggestions that come under the heading "performance improvements" do not _actually work_ because they address things that are not problems. (For example, unless you have data which convincingly demonstrates differently, the vast majority of websites can assume that the web stack is _not_ a problem. Optimizing your code within the web stack is generally a hideously expensive waste of time.)

<comment><USER12> Sure, fixing the webpage would come first. I only mean to demonstrate that I would spare no metaphorical expense in fixing the problem.

</comment></comment></comment><comment><USER9> It's surprising it would take people with their background so long to figure that out.

<comment><USER13> Yes, but as seen by lots of recent HN postings have shown, actually using a/b tests seems to be a rarity.

<comment><USER9> My comment was more along the lines that a page that promotes your service should load reliably rapidly, because people who are kept waiting by page loading may not stay around to convert to a user of your product, even if it is free. The comparisons the Firefox team show with the webpages of Brand X products made me think "Ouch!" because I am a user of Firefox myself.

<comment><USER14> I've been using Firefox since ... well, since Mozilla 1.2. [1] It makes me sad and nostalgic, but I have to admit that Chrome kicks ass at sheer page- rendering speed. I still use Firefox for testing and troubleshooting (Firebug is amazing), but I'm increasingly using Chrome for straight browsing.

[1] <http://www-archive.mozilla.org/releases/mozilla1.2/>

<comment><USER15> Some of us are still using Firefox out of pure loyalty. I'm painfully loyal (That's why I'm still watching _24_ and _Heroes_ ) but I'm thinking seriously in Chrome.

<comment><USER16> I have a firefox shirt and backpack, I can't turn back now!

But really, Chrome is nice (and I occasionally use it), but it is still lacking extensions that I use on my main machine. Some of them (such as noscript) I hear wont be possible with Chrome's extension model.

</comment></comment></comment></comment></comment></comment><comment><USER17> Incidentally, how is HN for speed?

<comment><USER2> "Very freaking fast."

The front page loads with 10 HTTP requests on an empty cache, and doesn't have any user-perceptible blockage while waiting on elements. (Pulled this straight out of YSlow.)

Improvement is overkill, but if you wanted to:

1) Creates images{1,2}.ycombinator.com and split y18.gif, s.gif, and grayarrow.gif, and your JS and CSS files across the three domains. This will cause older browsers to load them all in parallel. (The HTTP spec suggests having no more than 2 requests to any one domain open at a time, so you end up with stairstep loading graphs on browsers which are spec-compliant, such as IE6. Browsers which have a more pragmatic view towards compliance with published specifications, such as Firefox 3, will do 8 ~ 10 requests in parallel.)

Note the balancing act in that every domain you add is another DNS query that needs to get resolved once. Ideally you want to keep it to about 4 domains or less.

2) Put far future expires headers on your static assets. You can bust caches by using the Rails-y filename.js?timestampOfLastModificationOfCode method.

But, again, this site is probably the fastest one I use on a regular basis, even from braindead clients like my Kindle. I wouldn't guess the marginal improvement is worth the expensive engineer time.

<comment><USER6> This is good advice, but not optimal. Using multiple domains in this case will actually slow down the site because of the additional DNS lookups -- only do that if you are serving up a ton of images.

a) The CSS file should be inline.

b) The images should be done away with entirely by including them as a data uri.

c) For IE6-7 (data uris not supported) the fallback image should be sprited.

d) For bonus points (if you want HN to be served nearly instantly, globally) splurge for an application caching CDN provider like Akamai.

</comment></comment></comment><comment><USER18> Things like this always make me worry about the patience levels of some people.

<comment><USER9> People ALWAYS have something more important to do than wait for your site to load, always. It's not that your site is unimportant, it's that your users' personal lives are more important to each of those users. But don't take my word for this; this is a well replicated finding of usability research in hypertext environments that go back before the development of the World Wide Web.

<comment><USER18> I think they have hit the long tale of firefox browser adoption, people that don't care much what browser they use.

<comment><USER9> We don't know how long that tail is

<http://en.wikipedia.org/wiki/Long_Tail>

until all Web browsers are equally easy to install, as the submitted article shows that Firefox is discovering to its chagrin.</comment></comment></comment></comment>


Ask HN: Advise on buying a mac - <AUTHOR> Which laptop is better suited for programmers :
 1. Macbook air
 2. 13 inch Macbook pro
 3. 15 inch Macbook pro<p>Cheers <comment><USER2> Really depends on the type of programming you do. For many cases, any of those three will be more than enough.

If you're doing a lot of data crunching, data science, or other computation - then you'll need more CPU/GPU/etc, which takes you down the 15" route.

I opted for a 13" Macbook Pro as I travel a lot, work away from my desk a lot and generally have my computer with me anyway. If I was desk-bound I'd consider at 15", although I'd also consider an iMac/cheap laptop as an alternative combo.

I'm not a huge fan of the new Touchbar series. Actually think if Microsoft keeps it up I'll consider a Surface next round.

</comment><comment><USER3> To add what's sure to be a minority view, I prefer the Air. But a couple of caveats. First, as a web developer my programming is not CPU intensive. Second, I have a laptop mainly so I can shuttle back and forth between home and work, and at both locations I have external displays and keyboards. That makes the laptop display (and touchbar) mostly irrelevant. Benefits of the Air are price, portability (I bike, so light weight is great), and easy connections with my Apple displays (MagSafe + Thunderbolt). Air also has better keyboard and more flexible ports)

</comment><comment><USER4> 15 inch pro. And if you are not into gaming or 3D graphics, I would not get a dedicated GPU. Might increase the lifetime of the machine a bit (less heat inside).

By the way, the iGPU is good enough for games like Hearthstone, League of Legends, etc...

</comment><comment><USER5> 15 inch pro

</comment><comment><USER6> 15 inch pro

</comment><comment><USER7> 3</comment>


Yelp Mobile (Android) App Thoughts - <AUTHOR> https://medium.com/p/yelp-mobile-app-5617fffed081

<comment><USER2> > _By default, the app doesn't tell me if the place is open or not? It makes > me wonder why "Open Now" is not enabled automatically and needs to be set > manually from the Filters section. It is bewildering because it is a quick > fix..._

Only bewildering because you have incomplete knowledge. Yelp's business hours data is far from accurate or complete. Lack of completeness is the biggest problem, as many if not most business are missing this data in Yelp. Using _Open Now_ results in a huge number of false negatives since Yelp treats businesses with unknown hours as closed. It makes a lot of sense for Yelp to not have it on by default.

With respect to business hours, business addresses, and photos, you have to remember that Yelp is primarily crowdsourced. You can't expect it to be as accurate as Airbnb, where the proprietor creates and maintains the info, and selects the best photos. Yelp's UI will ask randomly ask users whether a photo is "useful", and probably shows the ones voted more useful first.

By the way, on iOS, the Yelp app does provide a carousel of photos, whether by pulling down or clicking on any of the thumbnails that are shown.

The number one failing for me is that Yelp does a horrible job with respect to user saved favorites. When I look at search results in a map view, I would like all my favorites shown in a different color. I also would like to filter my favorites in the same way I can filter regular search results. For example, "Show me all my favorite cafes nearby".

<comment><AUTHOR> I was unaware that Yelp has that issue regarding business hours. If that is the case, I can understand their current approach. Though in such a case, they could fit in the hours (even if approximate) in the search results page so that the user could call up to inquire if the place is still open.

Personally, I have never faced the scenario where the mentioned business hours were incorrect.

Your point regarding saved favorites is very valid and it would be extremely handy to have them marked in between other search results.</comment></comment>


Microsoft to patch 17-year-old computer bug - <AUTHOR> http://news.bbc.co.uk/1/hi/technology/8499859.stm

<comment><USER2> Mistake in the article. The hole was not discovered last month, it was announced last month. It was actually discovered and reported in June, 2009. See [http://jordanopensource.org/freeplanet/article/microsoft- con...](http://jordanopensource.org/freeplanet/article/microsoft- confirms-17-year-old-bug-windows) for confirmation of that.

<comment><USER3> Also: the photo shows boxes of Windows 95, which isn't part of the Windows NT line and thus doesn't contain the buggy code. Of course, on Windows 95 there's no such thing as privilege escalation, as all users have full access to the system anyway.

<comment><USER2> Actually the bug had to do with support for 16 bit code and _was_ present in the Windows 9x line as well. It might not have mattered so much there, but the bug existed.

</comment></comment></comment><comment><USER4> The exploited is detailed here: <http://seclists.org/fulldisclosure/2010/Jan/341>

My favorite part comes at the end. The last step involves predicting where a specific BIOS handler lies in memory. It is a static address in all pre-Vista OS.

Starting in Vista, Windows introduced address space layout randomization to make hacks like this more difficult.

However: "Unfortunately, this potentially useful exploit mitigation is trivial to defeat locally as unprivileged users can simply query the loaded module list via NtQuerySystemInformation()."

Whoops.</comment>


Ask HN: What's the coolest PHP snippet you know? - <AUTHOR>

I'm redecorating the office, and came across the challenge of needing 8 lines of PHP to spraypaint onto the wall at LinkUp.
The problem: I can't think of any code that's cool enough to display in 12" lettering for an extended period of time.
What code would you put up? The heart of phpBB? Leaked source code from the early days of Facebook? The first sample code that Rasmus ever made public? A WTF answer from phpGolf? <comment><USER2> I'd just go with "T_PAAMAYIM_NEKUDOTAYIM", personally.

</comment><comment><USER3> [http://www.reddit.com/r/programming/comments/dst56/today_i_l...](http://www.reddit.com/r/programming/comments/dst56/today_i_learned_about_php_variable_variables/c12np38)

One of the code examples from here might be good if you're looking to scare people :-P

Edit: I have a more serious suggestion. Why not pick 8 lines from your own codebase?

<comment><AUTHOR> I have been playing with that, the problem is that everything is really just cool within its context. We also try to follow the logic that good code must be easy to understand, not the kind of magic code that works great but can't be debugged. Put that code on the wall and it is, well, boring.

The sample I started with is kind of a magic-method interpretation of how our system works:

      <?php
      $jobs = array();
      foreach (Companies::getAll AS $company) {
        array_push($jobs, $company->getJobs();
      }
      $results = Search::fromKeyword($jobs);
      foreach ($results AS $result) {
        $result->displayJob();
      }

</comment></comment><comment><USER4> print_r( json_decode( file_get_contents( "[http://twitter.com/statuses/user_timeline/hntweets.json?coun...](http://twitter.com/statuses/user_timeline/hntweets.json?count=1)),true ));

Oneliner: prints out the latest HN frontpage story

</comment><comment><USER5> I would include a pattern matching line:

$date = "2011-07-29";

$list($year, $month, $day) = explode("-", $date);

With whatever is cooler than a date, or with the company's creation date.

</comment><comment><USER6> while(pcntl_fork()|1);

</comment><comment><USER7> exit;</comment>


Sony CEO casually mentions he's supplying cameras to Apple - <AUTHOR> http://www.engadget.com/2011/04/02/sony-ceo-casually-mentions-hes-supplying-cameras-to-apple/ <comment><USER2> I think this might be a carefully orchestrated leak to counter the rumors about iPhone 5 not shipping until the Fall. There are massive speculations about a larger screen, LTE support, and now 8MP camera.

Apple really knows how to keep their customers in suspense. I admire their products, but their marketing tactics annoy me.

</comment><comment><USER3> Not anymore!</comment>


Usage of content management systems for websites - <AUTHOR> https://w3techs.com/technologies/overview/content_management/all <comment><USER2> And how much of that is auto-generated blog-spam?

There are people out there generating wordpress blogs with slightly different variations on design and text, but almost exclusively the same links. All for SEO.

Any quantitative analysis of software behind websites is garbage because most web sites are generated for SEO.

</comment><comment><USER3> 30% of http servers on port 80 are not hosting wordpress. Vast amounts of embedded stuff out there.

The method used to find "websites" is almost designed to return this answer [https://w3techs.com/technologies](https://w3techs.com/technologies)

<comment><USER4> They describe their methodology here.

[https://w3techs.com/technologies](https://w3techs.com/technologies)

</comment></comment><comment><USER5> Consider that WordPress trending no Google has droped slowly in past 5 years[1]. I really wonder how much does its market share the peak (around 2013-2014). Also, how w3techs know/estimate that there's 50% of websites that's doens't use a Content Management?

[1] [https://trends.google.com/trends/explore?date=all&q=wordpres...](https://trends.google.com/trends/explore?date=all&q=wordpress,joomla,drupal)

<comment><USER6> [https://w3techs.com/technologies/history_overview/content_ma...](https://w3techs.com/technologies/history_overview/content_management/all/y) says now is the peak so far.

</comment></comment><comment><USER7> Everyone interested in software development should take a really long look at this. This is unusual. Which is to say, WordPress is a really remarkable software.

<comment><USER8> I teach Wordpress Development at a post-secondary school that is design focused.

Two things make it remarkable in my eyes:

1\. How many tasks Wordpress can perform really well for a non-technical user.

2\. How messy, inconsistent and "complex" it for a developer to build the tools that serve those tasks.

That 30% of the web is Wordpress, is a testament to whose needs win at the end...

</comment></comment><comment><USER9> I thought it was 30% Netflix

<comment><USER10> It's 30% Netflix and 30% Wordpress and 50% Amazon and 40% Google.

<comment><USER11> You forgot pornography</comment></comment></comment>


Omitting the "o" in .com Could Be Costly - <AUTHOR> https://krebsonsecurity.com/2018/03/omitting-the-o-in-com-could-be-costly/ <comment> et-al No offense to Cameroon, but they should have never allowed .cm TLDs in the first place for this reason.

<comment><USER2> and .co, .om?</comment></comment>


Artificial Intelligence as Alien Intelligence - <AUTHOR> http://boundary2.org/2015/03/25/artificial-intelligence-as-alien-intelligence/ <comment><USER2> Ok, read it, not worth reading. Go read Stuart Russell instead : [https://www.cs.berkeley.edu/~russell/papers/russell- edge14-m...](https://www.cs.berkeley.edu/~russell/papers/russell-edge14-myths- moonshine.docx)

1) He is an active and substantial participant in the community. 2) It's about 500 words 3) It makes sense 4) It doesn't mention Freud 5) It uses short words

<comment><USER3> _" Any sufficiently capable intelligent system will prefer to ensure its own continued existence and to acquire physical and computational resources – not for their own sake, but to succeed in its assigned task."_

I am always surprised when people say this kind of thing. A human-utility designed AI would identify "it's own" to be decidedly human. And thus it's assigned task would be human. Assuming you properly pinned down human utility sufficiently to call it a successful AI.

<comment><USER2> I agree with you - I think that being frighted of AI's is as rational as being frightened of children, but Prof. Russell is a more authoritative source than me, and I think it would be better for people to read his stuff than the nonsense that the parent links to.</comment></comment></comment>


How to write a parser in Go - <AUTHOR> https://about.sourcegraph.com/go/gophercon-2018-how-to-write-a-parser-in-go/ <comment><USER2> Or you can read this: [https://interpreterbook.com/](https://interpreterbook.com/)

<comment><USER3> That's a good read. I extended my version of monkey to add a ton of new features and found it easy:

[https://github.com/skx/monkey/](https://github.com/skx/monkey/)

Over the past two days I also switched a toy-project for deploying software via SSH/SCP to using a lexer/parser, rather than parsing via regular expressions and string-splits. I guess that means that I learned something:

[https://github.com/skx/deployr](https://github.com/skx/deployr)

</comment></comment><comment><USER4> I played with this last year but couldn't wrap my head around it. I don't recall if it was poorly documented at the time or if it couldn't handle something I was trying to do or if I was just depressed by the generated code quality, but I eventually gave up and tried rolling my own parser by hand. It was the first time I'd done such a thing and I didn't really understand patterns for writing parsers so I eventually gave up there too. I'm really excited to read Thorsten Ball's "How to write an Interpreter in Go" book which walks the reader through writing a parser by hand (his blog post about book- writing tools was on the front page here—or maybe it was /r/programming?—yesterday, incidentally).

</comment><comment><USER5> Another very good take on this topic that really was the first thing that made it all click for me:

[https://www.youtube.com/watch?v=HxaD_trXwRE](https://www.youtube.com/watch?v=HxaD_trXwRE)

</comment><comment><USER6> tl;dr: write a parser using goyacc, a yacc port that therefore has some impedance mismatch with Go. (go)yacc is LALR(1)

I've been using PEG/Packrat implementations providing a more "native" experience to great effect lately, notably ruby's treetop and golang's pointlander/peg.

[https://github.com/cjheath/treetop](https://github.com/cjheath/treetop)

[https://github.com/pointlander/peg](https://github.com/pointlander/peg)

</comment><comment><USER7> This project gives me I have a solution please give me a problem feeling. I remember looking into yacc a while ago, for some reason but I can't really remember doing why. Might've been for a configuration type of deal, but nowadays I just use json for that because it intersects other areas of the code and therefore saves time.

</comment><comment><USER8> yuck, I'd take boost.spirit every day over this

<comment><USER9> good for you. Maybe try saying something positive next time, even if you have to fabricate it. Or just don't comment.</comment></comment>


3 simple steps to improve your React Redux code - <AUTHOR> https://www.ckl.io/blog/3-simple-steps-to-improve-react-redux-code/ <comment><USER2> _The idea of having a globally accessible Store with all the variables from the system might sound promising, but listen to me: [It 's a trap!]_

No doubt. This has been my biggest issue with Redux. Any tutorial pretty much says don't ever use component state. But when I couldn't come up with a good reason on why I needed to write an action creator, action, reducer, and state mapper to expand/collapse a menu, over using this.setState(), I came to the conclusion that was pretty much bs.

The article also touches on the related issue of stale state. I experienced a similar bug where modals would randomly appear. It was because the user backed out of a page with an open modal, and then revisited it, and the state was never reset, so the modal immediately opened. I understand that I need to clean up state, but in Javascript land, deconstruction/cleanup feels very unnatural.

I really think Redux is a great idea, but it has suffered from a lack of best practices and good, complex examples. The toy examples work great, but quickly break down once state gets complicated, and components become deeply nested.

Dan Abramov dropped a great piece of technology into the Javscript environment, and did that amazing time travel debug demo. The idea of an single immutable state is awesome. But he has failed to progress the project any further. In a github issue titled "Recommended usage of connect()," Dans answers a question regarding best practices with "Maybe we should just say "people have difference preferences here"."[1]

Simple things like state clean up, how best to leverage containers, what belongs in state, have all been left unanswered. Also there is a debate if data should be processed in the action creator, in middleware before the reducer, in the reducer, or with state selectors. There are so many layers to put logic, but there has never been a clear answers as to what each layer's responsibility is.

[[1][https://github.com/reactjs/redux/issues/419](https://github.com/reactjs/redux/issues/419)

<comment><AUTHOR> I do believe Redux's single Store solves one of the biggest React problems, which is passing props along all children components – but, as you said, I miss having good guidelines to help developers reason whether it makes sense to store all state info in a Store, or rather in a local state.

I'm sure (or at least I hope) those questions you've stated will be answered throughout time, since we're dealing with a fairly new technology and architecture.

Thanks for the comment and the GitHub issue reference! :)</comment></comment>