Ask HN: Any way to measure how much I speak? - <AUTHOR> I speak so little every day; I want to improve my communication skills, so I wonder any way I can measure how much I speak every day? <comment><USER2> I see I do not speak much when I am inside, in front of the screen. I suggest you getting out, and putting yourself in situations where you have to speak...

I know you are asking for technological tool for this, but looks like the problem you are trying to solve is created by technology , so maybe the solution is non tech and getting away from the technology.

<comment><USER3> One of my kids suffered from selective mutism when she was younger. She would speak normally with family, but would not speak outside of the house at all, incl. at school. Not a single word for more than a year.

Creating safe situations where she was forced to speak is the #1 technique to treat that condition. The speech therapists used situations like going out to buy ice cream to get her to speak.

So, yea, think of situations that are comfortable but will force you to speak. It's a very effective technique.

Volunteer to host/speak at a meetup?

<comment><USER4> >Volunteer to host/speak at a meetup?

This could be nerve wreaking for someone who is just getting started. Improv maybe? I dunno.

<comment><USER3> Hosting wouldn't be. Speaking certainly could, but that would depend also on his familiarity of the topic.

The meetup crowd, usually, is really cool and understanding.

I was actually thinking of other volunteering events. Soup kitchens, building houses with habitat for humanity, anything really that's a group activity.

Team sports as well.

<comment><USER5> > Hosting wouldn't be. Speaking certainly could, but that would depend also on > his familiarity of the topic.

Could you talk more about this? I have little to no anxiety about public speaking, but hosting a meetup sounds like a lot of work and stress to me. Are you talking about putting a new meetup group together from scratch, or asking a preexisting meetup group if you can MC for them one night, or some third thing?

<comment><USER6> Disclaimer: my experience is limited to London scene only.

Hosting a meetup is indeed a bit of extra work (I have just read the coordination notes our HR sent out, and oh boy...).

Offering to do a talk at an established, not too large meetup should be easy. Only the biggest and best known ones can pick and choose their speakers. Everybody else has to hunt, sometimes even beg for talks. As a result, these "lesser" meetups tend to be more casual. Nobody expects a professional, conference scene level of presentation.

So as long as you find a meetup that suits your taste, offering to do a talk every now and then should be more than welcome.

</comment></comment></comment></comment></comment></comment><comment><USER7> Probably not applicable if you'd like to know how much you speak face to face. But if you're mostly on the phone: I've my sales use a chess clock to become aware of how much they speak when interacting with prospects and clients. Works pretty well.

</comment><comment><USER8> One idea in response to your problem, not your question: read everything onscreen out loud.

Will slow down your mental processor to communication speed, by teaching you to listen to yourself.

I used to do this with books. Very different, rewarding experience.

<comment><USER9> This is very good advice, as when I practiced for public speaking competitions one technique was to deliver readings or speeches in front of a mirror. In private. A bathroom is good because keeping volume at talking voice is kind of important, and it will probably improve speaking technique with practice and attention to desired goals.

</comment></comment><comment><USER10> I'd recommend you to join a Toastmasters group! It's fun, scary, and highly rewarding!

[http://www.toastmasters.org](http://www.toastmasters.org)

<comment><USER11> I considered this years ago, and just now discovered two clubs immediately next to my house. My concern is that I'm coming at this from a place of fairly severe social anxiety; I do fine in business settings, but anything else causes me a great deal of anxiety. In your experience (or anyone else who wants to chime in), are people fairly understanding in this regard? What is the typical age range?

<comment><USER12> I was a member for 6 months. People are extremely understanding - there are a number of people who get very visibly nervous on stage who get very helpful feedback from everyone in the club. Age rage was 20-60 for my club, the only thing I disliked about ToastMasters was that occasionally a speaker would talk about things a bit too personal or act like its a self help group (might be different in the clubs in the CBD.)

</comment></comment></comment><comment><USER13> Why do you feel you speak so little? Is it because of insecurities, working alone or simply because you have little to speak about in the situations you are in?

Oftentimes people speak for the sake of being heard but don't add anything meaningful to the conversation. Then you get the quiet ones who speak very little but when they do, it is meaningful and everyone hears what they say.

I think a lot of us could benefit from learning how to do a little more listening and a little less speaking ;)

</comment><comment><USER14> Arthur C. Clarke wrote a short story in which a scientist invents such a device to measure how much his wife talks, relative to him. No idea how easy it could be, but it seems straightforward: connect speech recognition software to a mic and counts the number of words. The only problem could be detecting the speakers when there is more than one.

</comment><comment><USER15> As someone who speaks far too much, I envy your problem :P

To give a more constructive (although nontechnical) answer, make friends with someone like me. (in the "talks too much" sense) Find someone who likes engagement, conversation, etc (hopefully in a domain of shared interest) and associate with them a lot. I've found a decent track record at getting quiet teammates to become more outspoken by engaging them on that level in a friendly environment on a regular basis, because then talking more becomes the norm.

There's even (at least from my perspective) mutual benefit as the same reduction-to-the-mean helps the more talkative party get better at listening/engaging quiet people too.

<comment><USER16> I'm a fan of signal to noise ratio over bandwidth when it comes to communication and think talking more isn't a problem if there's good content in it. The problem is that those with higher bandwidth oftentimes lower the signal or transmit at a rate too high for receivers, effectively lowering throughout to almost nothing. Thus, I also agree that being a good speaker has a fair bit to do with how well you listen and adjust.

A lot of people that don't talk much simply don't want to and they may not give any body language to indicate otherwise and more chatty people could be a nuisance as a result.

</comment></comment><comment><USER17> I don't talk much as well (I am originally from Russia, we don't smile much too + I am a software developer). And if I do, I prefer to talk for a reason.

But now I live and work in New Zealand and smalltalks here is a must. And that is really difficult for me.

My advice: just talk. People like to talk random meaningless things. Talk to your colleagues about the weather, about plans for weekends, about their current tasks, ask if they are ok, ask about their car/bike/cat/dog, invite for a coffee etc.

And don't be afraid to repeat yourself. Literally, they ask the same things everyday.

<comment><USER18> I'm a New Zealander. Do you understand why we engage in smalltalk? I know it can be difficult for people from other cultures.

<comment><USER17> As far as I understand, the difference is that in our reality and perception, all strangers are 'bad' by default, they want to hurt us, they are suspicious etc. But if we know each other closer, if we confirm that the other guy is a good guy, then we can relax, talk, smile etc.

In your culture you tend to think that all strangers are good by default, they are harmless, they are kind and interesting, hence you are trying to be polite with them. But if you know each other closer and you find out that the other guy is not a good guy, then you stop being polite.

So, basically we are coming from the opposite directions :)

</comment></comment></comment><comment><USER19> First, pick something interesting to you to work on. Really deep dive. Ask interesting people working in your area and adjacent to breakfast every week day to chat about your thing. Do half the talking. Rinse and repeat a few dozen times.

Then, see if you can engage people at a bar, first the bartender and then a random barmate. This is the test for whether you have storytelling, presentation, emoting, expression, vocabulary, register, eye contact, body language, and the other elements of communication in sync.

</comment><comment><USER20> You could take a look at the Speaker Recognition API from Microsoft Cognitive Services [https://www.microsoft.com/cognitive-services/en- us/speaker-r...](https://www.microsoft.com/cognitive-services/en-us/speaker- recognition-api)

</comment><comment><USER21> Hook up a microphone recording your whole day in extremely bad quality. Then run it through an analyzer and just set a threshold that will pick up when you actually speak.

After you've successfully tried it on yourself package it as a simple prototype app. Add some gamification and put it on Kickstarter.

<comment><USER22> In theory this could be illegal in certain states, right? You have to notify all parties that they are being recorded.

<comment><USER23> There are only ~11 states that require all-party consent to record, and most of the states state that the law only applies to telephone/wire recordings. On top of that, the states who are all-party consent generally specify that public conversations are not protected under the law.

<comment><USER24> Not to mention he wouldn't necessarily be recording, just logging time where the amplitude of the signal was over a certain threshold.

</comment></comment></comment></comment><comment><USER25> There are tools Designed for measuring how many words a young child says & hears each day that ou might be able to repurpose Versace starling is a commercial product (looks a lil silly since it's meant to be attached to a toddler, but you might be able to repackage it) Versace.com This article about the academic studies of the phenomenon references a tool called LENA. [http://www.babyispeech.com/30-million-word- gap.html](http://www.babyispeech.com/30-million-word-gap.html)

</comment><comment><USER26> Speaking as far as true communication skills is a bell curve. 90% of communication is non verbal so you might be focusing on the wrong metric. Give 'What Every Body is Saying' a read.

</comment><comment><USER27> Two suggestions that might be of help:

UberConference shows you the minutes each person spoke in a meeting. May be setup a dummy meeting with yourself, or with a friend who you normally connect well with, and measure the time spoken and consciously try to improve it? It removes the social anxiety part.

Another option is to use an app like Ummo, which measures how many words you speak. May be take a topic, and speak away?

1 - uberconference.com 2 - ummoapp.com

</comment><comment><USER28> How about a vibration sensor attached on your chest below the throat connected to a raspberry pi zero?

</comment><comment><USER29> You could start a video blog.

Or just decide to go out every day and approach new people. And then just measure the amount of interactions.

Or just decide to have some "social" time every day, and measure consistency, make sure not to skip it.

</comment><comment><USER30> You could try playing video games with an in-game voice chat. Although, please, be cautious as some gamers have extremely poor manners and can be offensive.

</comment><comment><USER31> Why are you speaking so little?</comment>


Ask HN: My attempt at empowering companies to make better product decisions - <AUTHOR>

As a developer, I have built many features. I wouldn't say all, but many of them were a waste of everyones time. These features were usually built because the product group told us to build them. I found product teams make these decisions based upon some customer interviews, email feedbacks, phone complains and mostly their "gut". And its hurts the most when we would bust our asses building and releasing it, to only realize that our customers are not using it. Reasons vary from customers wanting X and we building Y to the user flow not being right. Its further disappointing to learn after a release that customers didn't even care enough to click on the feature i built, forget about using it.
Prioritizing what to build, which features to double down on and which ones to ignore, what to prototype and what to scrap etc. are all important questions which the product team needs to decide. In their defense I feel like these are difficult questions. To me its just that I don't think they can afford to get this wrong. Building the wrong features, maintaining them and then eventually killing them is very expensive and just a moral killer.
The question in my mind is can product teams make better product decisions? Why do we have to ask developers to build things, release it and then learn whether customers really wanted it. To address this issue and empower product teams I have built www.featureKicker.com. It enables teams to deploy features before building them, collect feedback, analyze data and make better, more informed, data backed decisions. It enables a product manager to look a developer in his or her eye and say "I need you to build X and I need it done by Y. I have Z number of customers waiting for it. Here you can read what they have to say".
I would love to hear from the community of what they think of this solution. I want to help companies make better product decisions and am looking at the community for guidance.
Sandeep CTO FeatureKicker.com <comment><USER2> I checked the website, looks promising so congratulations on that. I do have a comment, your entire website is still linking to your Heroku subdomain.

If I'm not mistaken, this pretty much feels like A/B testing with the implementation being a survey.

So have you tested users' sentiments about trying to use a feature only to realize it isn't implemented and then being promoted to answer a few questions?

I'd speak for myself, I'd rather not see a button to for example Authenticate with my Twitter account if it doesn't work, than to see one of which when I try to use it, I get asked a few questions.

I'd feel that's a bummer.

To that point, why would I use FeatureKicker instead of a service like Qualaroo, which works fairly well.

<comment><USER3> Cofounder of FeatureKicker here...

>> "I checked the website, looks promising so congratulations on that. I do have a comment, your entire website is still linking to your Heroku subdomain."

I hear you. We were being as cheap as possible and didn't want to pay for SSL certificates, etc. while building early version of the product. But we're hearing this more and more, so perhaps it's time to move on :)

>> "If I'm not mistaken, this pretty much feels like A/B testing with the implementation being a survey."

It's interesting and refreshing to see someone else boil down our product. Thank you!

So I agree that it "feels" like A/B testing because you're adding a new element (and potentially removing it based on our rules engine). But it's unlike A/B testing because our tool is not designed to split your traffic across page variations.

Here's what I would add to your distillation: it's being able to ask the right user, the right question, at the right time. And this is where our product is like a "hyper targeted survey".

>> "So have you tested users' sentiments about trying to use a feature only to realize it isn't implemented and then being promoted to answer a few questions? I'd speak for myself, I'd rather not see a button to for example Authenticate with my Twitter account if it doesn't work, than to see one of which when I try to use it, I get asked a few questions. I'd feel that's a bummer."

Absolutely. This was our primary risk. After user testing, we're finding that this concern is more of a theoretical anxiety than actual feeling in practice.

>> "To that point, why would I use FeatureKicker instead of a service like Qualaroo, which works fairly well."

I think the tools and use cases are different.

With Qualaroo, you get a pop-in question based on a timeout, and those questions are typically related to overall customer satisfaction or net promoter score. But we believe that using Qualaroo to ask a specific question about a specific feature on a page will not work as well as FeatureKicker. Why? Because the question may be irrelevant to whatever the user is doing at that time. This gets even trickier when you want to ask a question about an unbuilt feature. Then you have to worry about showing the experimental feature only sometimes and coordinating your Qualaroo question to pop-in when you're selectively displaying the experimental feature.

In contrast, FeatureKicker allows you to ask the right user, the right question, at the right time. Let me unpack that. It's the right user because it's the person using a particular (built or unbuilt) feature. It's the right question because you're going to ask something relevant, specific about that feature. And it's the right time, because you're capturing the user at the point of interaction, which is the peak of their curiosity. We believe this explains why we're seeing up to 64% response rates to our clients' questions.

</comment></comment><comment><USER4> I think this is amazing.. a huge problem all around and a very clever solution. Surveys are broken, putting the feature on site and testing who clicks on it-- so good!! Engineers all over the world thank you!!

Any thoughts on how to do this for "non-button" content features? Like say, do our users want to see product images in the search result page?

<comment><USER5> Amazing, amazing, wow this is so good. Lots of astroturfing here even from very new accounts (not yours), why so many exclamation marks with praise when the real value of HN is in getting you actionable feedback?

<comment><AUTHOR> Jacquesm: Did you have any feedback on featurekicker or in general about making better product decisions? Would luv to get your insight.

</comment></comment></comment><comment><USER6> Update video to show g+ example and results no more no less about 20 secs tops - the video on main site takes to long to show the meat of what you do...

bar that, not a bad product we just built something not to dissimilar in house for our needs, this would have saved a ton of time...

Good luck with the product.

-Scott

<comment><USER3> Awesome and timely feedback. Thanks, Scott.

</comment></comment><comment><USER7> I signed up for your beta. Definitely seems like a wonderful idea. Looking forward to trying it!</comment>


Thirty Meter Telescope to be built in Hawaii - <AUTHOR> http://www.tmt.org/news/site-selection.htm

<comment><USER2> Sorry to be pedantic but the title is a bit misleading.

TMT has selected Hawaii as its preferred site. In order for it to be actually built on Mauna Kea, it has to obtain a Conservation District Use permit, as explained in the linked article. Due to Hawaii politics this isn't necessarily a slum dunk, but I whole-heartedly wish them luck.</comment>


iOS Authentication Blocks - <AUTHOR> http://www.bleonard.com/blog/2014/04/05/ios-auth-blocks

<comment><USER2> I believe you could achieve something similar by passing around NSInvocation instances too, no? But that wouldn't be nearly as cool, I love blocks :)

<comment><AUTHOR> Yes maybe, but I've been a ruby/js guy for a while now and grown to love the proc/function.

</comment></comment><comment><USER3> Blocks ftw!</comment>


For Modern Astronomers, It's Learn to Code or Get Left Behind - <AUTHOR> https://www.wired.com/2017/05/modern-astronomers-teaching-code/ <comment><USER2> Bah Humbug!

Many academic fields, notably including astronomy and physics, have been doing heavy duty software development and data analysis for many decades, long before the current "data science" hype.

Chuck Moore developed FORTH in 1968 (yes 1968) for controlling radio telescopes: [https://en.wikipedia.org/wiki/Charles_H._Moore](https://en.wikipedia.org/wiki/Charles_H._Moore)

Astronomers developed a widely used interactive scripting language/tool for astronomy data analysis known as IDL in 1977 long before vanilla Python was created, let alone recent add-ons such as NumPy, SciPy, etc. Python is playing catch up.

[https://en.wikipedia.org/wiki/IDL_(programming_language)](https://en.wikipedia.org/wiki/IDL_\(programming_language\))

The Hubble Space Telescope was launched in the 1980s and has been using Python for over 10 years: [http://www.fperez.org/py4science/2009_guido_ucb/perry_STScI4...](http://www.fperez.org/py4science/2009_guido_ucb/perry_STScI4Guido.pdf)

[http://www.stsci.edu/institute/software_hardware/pyraf/stsci...](http://www.stsci.edu/institute/software_hardware/pyraf/stsci_python)

Perry Greenfield - The Development and Future of Python at STScI [https://youtu.be/R_UcjjUC8bE](https://youtu.be/R_UcjjUC8bE)

Only a few of many examples of software development and data analysis in astronomy specifically.

The market leading data analysis tool SAS derived from academic agricultural research in the 1970s. Ronald Fisher developed many of his still relevant techniques for agricultural projects at the Rothamstead Research ([https://en.wikipedia.org/wiki/Rothamsted_Research](https://en.wikipedia.org/wiki/Rothamsted_Research))

The second biggest data analysis tool SPSS is short for Statistics Package for Social Sciences, also came out of academic research ... in social sciences in the 1970s.

Mathworks MATLAB is derived from numerical and statistical software developed for physics research at the Argonne National Laboratory. [https://www.mathworks.com/company/newsletters/articles/the-o...](https://www.mathworks.com/company/newsletters/articles/the- origins-of-matlab.html)

Mathematica has its roots in Stephen Wolfram's work on SMP as a graduate student in high energy physics (particle physics) at Caltech. [http://www.stephenwolfram.com/publications/smp-symbolic- mani...](http://www.stephenwolfram.com/publications/smp-symbolic-manipulation- program/)</comment>


Static Analysis in GCC 10 - <AUTHOR> https://developers.redhat.com/blog/2020/03/26/static-analysis-in-gcc-10/ <comment><USER2> Author.. if you're here... this is awesome, great job. Putting this on my list of stuff to dig into today. I've been doing a lot of thinking about this exact concept and it's impressive to read about the legwork you've put into this. I think there's so much room to grow in terms of implementing effective static analysis in the toolchains and this seems like a great way to expand an already powerful tool instead of just reinventing the wheel

</comment><comment><USER3> Hmm, I wonder what the theoretical foundation is. Looks like you are searching for counter examples to a set of assertions. How general/expressive is the language you describe these assertions in? How do you implement the search?

</comment><comment><USER4> Wouldn't it make more sense for -fanalyze to work like a rust borrow checker?

<comment><USER5> No, because C's memory model is freer than Rust's. E.g. it's perfectly legal for memory to have multiple owners, as long as you respect the rules around accessing and freeing it.

<comment><USER4> Yes but a static analyzer could enforce _new_ projects to maintain single ownership model, which could push C and its existing tools closer to Rust.

A borrow checker for C is totally feasible as it is just compile time analysis of object lifetime. Something like gcc -fborrow-check would prop up C to safe new heights.

<comment><USER6> If you're writing new C, why wouldn't you write C++ or Rust? I think part of why Rust's borrow checker works so well is because its support for higher- level abstraction is so good; my impression is that manual iteration and general array munging is pretty hard to do in Rust (especially without runtime checks), but that doesn't matter because the iterator abstraction is so good. It'd be pretty hard to build something like Rust's iterators in C.

<comment><USER4> C is still prevalent in embedded systems. Something like a clean slate strong type checker to remove C's weak type checking would be greatly appreciated for those who mainly work in IOT where C++ is already treated like C with classes.</comment></comment></comment></comment></comment>


Ask HN: How to Deal with Lowballed Offers? - <AUTHOR> How do you negotiate if you received a super low balled offer from a FAANG or similar company. Is it good move to accept the offer due to the brand value? <comment><USER2> Once I accepted lowball offer without negotiation due to harsh conditions (long out of job, morgtage, bad market). The company somewhat knew about my conditions and leveraged that.

While working there and making ends meet I kept calmly looking for job. In 4 weeks I reciprocated - received much better offer and fired my boss. In addition I didn't have to stay 2 weeks because boss forgot to force me to sign employment agreement. Being nice for their client I stayed for 2 days and then left for good.

So use to to your advantage. Keep looking for job and leverage their FAANG-y name to boost your market value.

</comment><comment><USER3> First, make sure your expectations are in line with reality. I recently talked with a new college grad that was pissed he wasn't getting $150-200k base offers, he's an idiot. Not saying you are, but make sure your expectations are lined up with reality. If they are, and you were lowballed then either go back with a realistic number showing them you know your value or move on.

Companies will try to take advantage of people who don't value themselves enough because if the person is happy to make 100k even though their peers are making 120k then most companies will try to make that happen. They aren't going to give you 120k just cause others already make it. Usually their range for a position will be broad so they can play these games.

In the end never accept a lowball offer just cause of the name of a company, you'll never get the value out of the name brand if they don't pay you it in compensation.

</comment><comment><USER4> FAANG or no-FAANG, if they won't offer what you think you are worth, then walk away. I'm assuming you're a seasoned professional and not straight out of college. If the latter, are you sure you know what you're worth?</comment>


Consciousness Is Made of Atoms - <AUTHOR> http://nautil.us/blog/consciousness-is-made-of-atoms-too <comment><USER2> I normally like Nautilus but this is a pretty poor article. For example:

> In every case, these environmental stimuli exist in analog form and are > converted into digital form by the receptor cells and the neural circuits > connected to them.

"Digital" means information processing using ones and zeroes. There is no evidence that human neurons use ones and zeroes to process information. The evidence that we do have hints at the opposite: that neurons use a wide variety of signals to accomplish analog computation.

It's also questionable to use "circuits" to describe active collections of neurons. While there are electrical signals involved, it's not a circuit like in your iPhone.

The article is full of imprecise and vague language like this. Very unsatisfying and I'm having trouble understanding why it was written.

<comment><USER3> Extremely poor article. Especially those findings are proven wrong when applied to quantum theory. Heard of the Zeno Effect?

</comment></comment><comment><USER4> I was quite enjoying the introductory paragraphs and looking forward to the meat of the article, when it abruptly stopped. It doesn't read like a complete composition.</comment>


Is Ego-Depletion a Replicable Effect? - <AUTHOR> https://replicationindex.wordpress.com/2016/04/18/is-ego-depletion-a-replicable-effect-a-forensic-meta-analysis-of-165-ego-depletion-articles/ <comment><USER2> Ego depletion is framed as an effect in a particular direction: applying self- control reduces self-control in the near future. So studies are called successful if they see that direction, otherwise unsuccessful.

But the other direction is a reasonable hypothesis too: applying self-control increases self-control because the brain regions are activated and ready, or something.

So you could frame the problem bidirectionally: applying self-control affects self-control ability according to some time-dependent formula with parameters that we'd like to estimate.

Framing the problem bidirectionally might reduce publication bias, since every estimate of the parameters would seem equally valuable.

<comment><USER3> The common mistake that many (but not necessarily you) make is to assume that conscious effort is proportional to energy use in the brain. The idea that willpower brain is some kind of store that can be depleted is not as parsimonious as other hypotheses.

Cognizing is a costly activity, whether daydreaming or thinking, a lot of stuff is going on. So why does thinking in particular feel difficult?

The least terrible analogy I can think of is to imagine a distribution network. Postal systems, railways, the internet; whether they are at 20% or 100% utilization, the marginal costs don't budge much. The other key concept is that the brain both learns as well as has to figure out how to do so efficiently. Reward schedules and surprises play prominently into this.

The hypothesis: some things feel difficult in a way not directly related to energy use because it's attention that is key and it is better thought of as a resource to be allocated and managed.

The questions are: why is it so hard to maintain focus on abstractions for extended periods of time? Someone is going to mention the ADHD hunter ancestor theory as selectors for extended focus, but even then, I will say that their attention still did not stay as fixed or devoid of obvious rewards as some abstract thinking requires. Is focus trainable? Why are some better at not responding to immediate rewards? Is this trainable?

<comment><USER4> I think conscious effort in itself is not difficult. What is difficult is to be lacking acceptable options or strategies to solve the problem at hand. That is causing anxiety and fatigue.

To put this in terms of machine learning, the brain is doing reinforcement learning maximizing a value function. But when the value function is very low and options (strategies) available are too limited, the system can't output a satisfactory action for the next step so it interprets this as suffering.

It's all about availability of choices, not the actual effort. What's depleting is not energy in the brain but the perception of how well we can handle the situation. The state of flow is also related to conscious effort, but in flow there is always a good outlook, there are many options available, many strategies, creative possibilities of combination, and consequently, it's a joyful activity.

<comment><USER5> That is a near perfect description of a feeling I feel a lot when debugging without a clear path.

</comment></comment></comment></comment><comment><USER6> This really strikes me more as a problem of incentives than "lol psych researches need to learn statistics".

Incentives in this situation are funding and publication. These both require positive results. This seems to be tied to increasing monetization of science driving it away from a principled search for the truth.

We also see this with patents. My girlfriend has her first lab job this summer, and they had a day long seminar with the university's patent foundation on methods to ensure that nobody stole their ideas. This leads to a lot of secrecy (for example, this particular patent office doesn't allow researchers to store anything in the cloud, which speaks to lack of technical understanding, but also to an intense paranoia). This also dramatically reduces the capacity for sharing basic lab know how - there's nothing remotely like StackOverflow for scientists.

This issue is a bit near to my heart, as the company I work for was originally founded to help researchers share data in a secure way. It turned out that there wasn't any demand for that, because, as our CEO put it, "Everybody thinks their going to win the damn Nobel Prize". So we pivoted and now sell mostly to financial and tech companies that are serious about protecting user data.

</comment><comment><USER7> The main thing I got out of the article was that I should ignore results from the fields of psychology or sociology for the foreseeable future. The standard of proof seems very low.

I never fell for Tony Robbins-type pop psychology, but I loved books like "Influence: The Psychology of Persuasion" by Robert Cialdini and "The Tipping Point" by Malcolm Gladwell.

I thought I was getting useful, non-obvious, actionable information. I'm disappointed that the lessons from those books might be BS as well.

<comment><USER8> > I should ignore results from the fields of psychology or sociology for the > foreseeable future

Yes, you should. The problem is that some of these bad results have become key political tenets. Try voicing skepticism about the reality of stereotype threat and see how long it is before HR finds some excuse to fire you.

If you haven't noticed, there are powerful social pressures in the Bay Area to go along with certain kinds of reality denial. The more reality suggests that dominant Bay Area social beliefs are false, the louder supporters reiterate these beliefs and the greater the ferocity with which they punish dissent.

<comment><USER9> > HR finds some excuse to fire you

Which shouldn't be surprising, because unless carefully expressed, skepticism towards the stereotype threat effect can be interpreted as a justification for stereotyping, especially when the skepticism is expressed in the context of political tenets.

<comment><USER8> Stereotypes _are_ accurate, though. People are good pattern-recognizers, and the characteristics that we use to form stereotype do convey useful information.

Pretending that stereotypes are factually bogus is wrong. It creates resentment. It's much better to accept that stereotypes exist for a reason, but emphasize that it's a grave injustice to let stereotypes hurt our evaluation of people who defy these stereotypes.

> skepticism towards the stereotype threat effect can be interpreted as a > justification for stereotyping

Current HR policies go beyond requiring fair treatment of individuals as individuals. Every sane person supports doing that. HR demands that we silence truths about the natural world go unstated. HR demands that we make untrue statements about the world. That's anathema to anyone technically-minded.

<comment><USER9> I like to think of myself as technically minded. However, your stereotype of technically minded people seems to sugest that either I accept the "natural truth" of stereotype accuracy or forfeit my technically minded view of myself. I will do neither.

The claim that one can engage in stereotyping people while exibiting fair threatment of the same people as individuals is dubious to say the least given the definition of stereotyping.

Once engaged in stereotyping no amount of post factum fair threatment of the individual will make up for the unfairness.

Later edit: People are imperfect pattern recognisers, in fact our pattern recognition generates a significant amount of false positives. From an evolutionary perspective this was acceptable at a time when tigers could be lurking in the bush. The penalty for running from an imaginary tiger in the bush is insignifiant compared to the penalty of not running from an undetected tiger.

</comment></comment></comment></comment></comment><comment><USER10> As a layman when it comes to statistics and academia, this is the first I've heard of "publication bias". It seems like a pretty big problem at first glance, especially if it recurses and calls into question meta-analysis being done to investigate the presence of the bias itself. Sounds like a massive headache.

If this problem is as big as it sounds, what are the repercussions?

<comment><USER11> Oh it's far worse than that. Iirc about a third of studies fail to replicate, and in psychology it might be higher. In fact we even have a control group for science. A fake field of research that spends it's time studying phenomena which can't possibly be real, the paranormal researchers. They produce tons of positive results anyway. See _The Control Group is Out of Control_ : [http://slatestarcodex.com/2014/04/28/the-control-group-is- ou...](http://slatestarcodex.com/2014/04/28/the-control-group-is-out-of- control/)

<comment><USER12> If your view is a priori that psi effects are impossible all you will see in the studies that 'it must be invalid and flawed or faked'. Yes, this makes people doubt scientific practices in general. You will always feel you are winning that argument, no matter what criteria those scientists meet.

But psi researchers these days jump through far more hoops, run far more replications, spend far more time looking for weaknesses and alternative explanations, garner far more scrutiny and second guessing. To call that a 'fake field of research' when it is more rigorous is disingenuous.

Negative results do get published regularly. And more replications take place. It is quite hilarious really, because it makes people panic about what is wrong with the methods we apply across the board in science. Skeptics just raise the bar abritrarily and shift the goalposts as a means of sweeping things under the rug while calling it scientific rigour.

We have also now gotten to the point that the fact that we commonly have failed replications (across all social science), it means the whole premise of a line of research must be completely flawed. But we should expect failed replications - for one, it's impossible to repeat a set of circumstances exactly. Many replications aren't true replications.

<comment><USER13> > _But psi researchers these days jump through far more hoops, run far more > replications, spend far more time looking for weaknesses and alternative > explanations, garner far more scrutiny and second guessing. To call that a > 'fake field of research' when it is more rigorous is disingenuous._

But that's the point of Scott's article. We have more than enough reasons to believe the whole field is bullshit (did you see a working practical application of that research?), but because it does all the moves and rituals of Real Science, it forms a perfect baseline for how many positive results we can expect with _pure_ cargo-cult science.

<comment><USER12> Explaining away thousands of studies that happen to study controversial effects with unknown mechanisms in one brush is not demonstrating intellectual rigour nor does it make you come across as upholding 'real science'.

The explanation that psi-researchers are just good at finding the appearance of signal from noise, small as it may be, is fine, but then personally, I'd like to see the same vigour for explaining what the signal actually is. And people that have a firm belief that any 'psi'-explanation can't possibly true (and this a pretty arbitrary notion at that, as psi would just follow conventional physics and adhere to normal biological mechanisms) just aren't going to accept any other explanation. So they look for issues with the statistics used.

The notition that the whole field is BS, as you put it, requires all the researchers in involved to be utterly mad, stupid or deceitful. That is a claim easily made by skeptics, a thing that they have no trouble agreeing to. That view is not born out of scientific honesty, it's just another form of cargo-cult thinking.

</comment></comment></comment></comment></comment><comment><USER14> After reading this whole article I do feel a bit tired... does that count as a meta meta study? Just kidding! Let's eat some cookies!

Richard Feynman was right... this whole field of statistical studies should be called something other than science.

[http://calteches.library.caltech.edu/51/2/CargoCult.htm](http://calteches.library.caltech.edu/51/2/CargoCult.htm)

</comment><comment><USER15> love this quote:

> Every researcher knows about publication bias, but the practice is so > widespread that it is not considered a serious problem.

<comment><USER16> It is considered a serious problem by many, being a key part of the whole replication crisis. The idea that studies need to be preregistered is slowly gaining ground I feel.

<comment><USER17> It seems to me, not serious enough for decisive action apparently. Progress is slow on that front. "Knowing" and "doing" are different. Most people who smoke or eat badly are aware that it's a (serious) problem, but it does not necessarily lead to action. So that people "are aware" of something doesn't tell the whole story.

</comment></comment></comment><comment><USER18> While the picture seems bad for Ego-Depletion, I find the counter arguments put forward in the article not wholly satisfying, either.

So they tried to replicate it in a large effort and failed, but they didn't use the same test as in the original paper. How is that a replication study? I think to properly fail a replication study, you should use the same test as in the original study. In the replication the used many participants, but developed a cheaper test to administer (wholly computer based).

As it is, they have another indicator that Ego Depletion might not be real, but just as well there could be some other effect that explains why the replication failed.

Likewise for meta analysis: it looks good on paper, how could an average of n studies be wrong? Surely the mass of papers studied will cancel out all the flaws of the individual studies? But on the other hand it seems to me meta analysis would overestimate the impact of bad studies, as they are easier to make so there a probably more of them.

A meta study is certainly an interesting data point, but I feel it can not always be the end of the story. It can maybe point out the need for deeper questions or further research, but not be proof on it's own.

</comment><comment><USER19> So... do I eat the chocolate cookies, or not? This is so difficult!

<comment><USER17> By the way, the marshmallow study has been redone and reinterpreted. It has been found that the children's behavior is heavily influenced by their life experience. When they live in an environment where they can't trust adults they eat the marshmallow sooner, quite rationally. So it isn't an inherent trait of the child but of its environment whether it waits for the promised future return or not.

<comment><USER20> Oh, wow. That is such an obvious explanation, now that you point it out. Where can I read more?

<comment><USER17> This is one link, but I think there probably is more follow-up research on that study:

[http://www.sciencedirect.com/science/article/pii/S0010027712...](http://www.sciencedirect.com/science/article/pii/S0010027712001849)

I've seen an interview with a researcher who said something along the lines of "we take reliability into account" \- but what he then said seems to show a very narrow interpretation. The experimenter must be well-known to the children and has played with them before the experiment, and that "the marshmallows are right there in front of them, so it's not a reliability issue". Personally, I don't think that is even remotely enough to account for the effect and that is a somewhat naive take on the issue, especially the second part that solely relies on _reason_. Which doesn't even work in adult scientists to counter social effects.

</comment></comment></comment></comment><comment><USER21> I'm glad to see sociology is becoming more rigorous.</comment>


Vitamin D deficiency in pregnancy is linked to autism traits in the child - <AUTHOR> http://www.qbi.uq.edu.au/news/qbi-confirms-vitamin-d-link-autism-traits <comment><USER2> Looks like it's at stage two in the science hype cycle. [http://www.phdcomics.com/comics.php?n=1174](http://www.phdcomics.com/comics.php?n=1174) I'll pay attention when a randomized control study shows that supplementing vitamin D lowers rates of autism.

<comment><USER3> Be aware that this study is about vitamin D deficiency. It's not start for some crazy health trend. You can go and check you vitamin D levels and if you don't get enough, use supplements to correct the situation.

<comment><USER4> Can any HNers recommend a cheap and accurate vitamin D test I can do at home? I asked my doctor for a vitamin D test at my last checkup and he warned me that my insurance probably wouldn't pay for it since "many people are asking for one these days without any symptoms of deficiency". Since I had no idea what the lab might end up charging me for it (in the U.S.) I decided against getting the test.

<comment><USER5> Hope this isn't considered spammy by anyone, I certainly have no incentive (financial or otherwise) to recommend it, but there's a company called "Life Extension" that allows you to order blood tests online.

They email you paperwork, you take that to a local lab and then get your results online. It looks like Vitamin D is $47.

I used it for a while when I was suffering from a health issue that required regular blood tests, since it ended up being cheaper than a doctors visit + co-insurance for the lab fees.

The biggest downside is there's nobody to explain the results to you, although the report they provide does show if you are outside the normal range of whatever they are testing.

[http://www.lifeextension.com/vitamins-supplements/blood- test...](http://www.lifeextension.com/vitamins-supplements/blood-tests/blood- tests)

<comment><USER6> I second this. I use Life Extension. However, I've been paying out of pocket. I'm interested if there's a way to get it covered at all.

By the way, this is really just using LabCorp, and you can order similar tests directly via LabCorp. Might be worth price shopping between them, and checking out their different test options.

</comment></comment></comment></comment></comment><comment><USER7> It'd be interesting to see if there's a seasonal correlation here - since most of our vitamin D comes from the sun, expectant moms are probably more deficient in the winter. Wonder if third trimester during those months, when there's rapid neurogenesis, leads to an even higher incidence of these traits.

<comment><USER3> There is correlation at least in Northern countries in Europe.

</comment></comment><comment><USER8> Somalian children living in Minnesota have a higher rate of autism compared to whites and non whites. They have also noticed this in Stockhom as they also have a lot of Somalian immigrants. Researches have found "The increased prevalence remained and was now between four and five times higher in children of Somali background. A clinical observation was that more than 80%, in addition to autism and learning disability, had a profound hyperactivity." [http://onlinelibrary.wiley.com/doi/10.1111/j.1469-8749.2010....](http://onlinelibrary.wiley.com/doi/10.1111/j.1469-8749.2010.03812.x/full) People have hypothesized vitamin D could be contributing to this as having darker pigmentation makes it harder to absorb sunlight.

<comment><USER9> Do they have higher rates of autism than Somalis in Somalia?

<comment><USER10> likely hard to get good data on that.

</comment></comment></comment><comment><USER11> Wouldn't we be seeing "hot spots" in darker northern climates and trouble-free zones in sunnier southern locations?

The most compelling linkages I have seen are to certain pesticide / herbicide exposures and pollution exposures.

<comment><USER12> In Minnesota, the Somali immigrants allegedly never saw autism until they came here, and they get a lot of it now.

They call it the "Minnesota Disease".

I also once read that Cable television penetration rates were correlated with autism as well...

<comment><USER13> Well, to be perfectly fair, we never "saw" it before 1943, either. I'm not trying to be flippant, our society is set up in a way to diagnose cases of autism, and it is reasonable to suspect that the increased rates of diagnosis are not all caused by increased rates of the condition.

<comment><USER14> I read somewhere a while back that said that the reason for rising autism rates in the 90's/00's was because we broadened the definition of autism.

</comment></comment></comment></comment><comment><USER15> "New research states that 330,000 lives could be saved by optimizing vitamin D levels through sun exposure.[1] That compares to 450,000 deaths linked to tobacco. This is to be expected, since a Swedish study demonstrated that over a 20- year period, women who avoided the sun were TWICE AS LIKELY TO DIE OF ANY CAUSE, as women who were sun-seekers,and the researchers stated the following: "Nonsmokers who avoided sun exposure had a life expectancy similar to smokers in the highest sun exposure group, indicating that avoidance of sun exposure is a risk factor for death of a similar magnitude as smoking."

Citing: Lindqvist PG, Epstein E, Landin-Olsson M, Ingvar C, Nielsen K, Stenbeck M, Olsson H. Avoidance of sun exposure is a risk factor for all-cause mortality: results from the Melanoma in Southern Sweden cohort. J Intern Med. 2014 Jul;276(1):77-86

<comment><USER15> So why aren't we replacing window glass (especially in hospitals!) with UV transmitting OP4 plastics?

</comment></comment><comment><USER16> Correlation is not causation.

Autism is genetic and an autistic parent is more likely to stay inside most of the time.

Staying inside most of the time can lead to vitamin D deficiency.

If one biological parent is autistic, there is a 50% chance their child will also be autistic.

</comment><comment><USER17> From my quick skim of the article, I think this is the key part:

> These results imply that, after correcting for confounding variables (see > notes under Table 3), those who were deficient at time of birth had on > average 0.06 point higher gender-weighted SRS score, which corresponds to an > increase of approximately one fourth of the s.d. (s.d. of the SRS in the > total sample=0.23). When treating SRS as a dichotomous outcome, that is, > comparing children with SRS scores above the suggested cutoff with children > below the suggested cutoff, those who were vitamin D deficient at mid- > gestation were 3.8 times more likely to be screened positive than those who > were vitamin D sufficient at mid-gestation (see also Supplementary Table 4).

(SRS is the Social Responsiveness Scale)

</comment><comment><USER18> > We would not recommend more sun exposure, because of the increased risk of > skin cancer.

Broad spectrum lamps could be useful here. Exercising your body's natural ability to produce vitamin D seems like a good idea. There are also other well documented psychological benefits to controlled fullspectrum light exposure.

* [http://www.health.harvard.edu/blog/seasonal-affective-disord...](http://www.health.harvard.edu/blog/seasonal-affective-disorder-bring-on-the-light-201212215663)

* [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3181775/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3181775/)

<comment><USER19> I though vitamin D was produced via UVB rays? How would a lamp without UV allow the body to produce vitamin d?

<comment><USER18> [https://www.amazon.com/s?field-keywords=uvb](https://www.amazon.com/s?field- keywords=uvb)

</comment></comment></comment><comment><USER20> What does 'linked' word mean here?

I see that verb in biological/medical articles very often and it always makes me think that researchers are very unsure about the results. It is like 'We believe there is a correlation, but we don't know for sure'.

Am I wrong?

<comment><USER21> I agree with you, the effect size is relatively small, here's the main table:

[http://www.nature.com/mp/journal/vaop/ncurrent/fig_tab/mp201...](http://www.nature.com/mp/journal/vaop/ncurrent/fig_tab/mp2016213t3.html#figure- title)

Beta is the effect size here, which ranges from 0.07 to 0.03, not exactly high. The p-values may be tiny but that's just a measure of the likelihood of getting these effect sizes by chance.

>These results imply that, after correcting for confounding variables (see notes under Table 3), those who were deficient at time of birth had on average 0.06 point higher gender-weighted SRS score, which corresponds to an increase of approximately one fourth of the s.d. (s.d. of the SRS in the total sample=0.23

Now is 0.06 a large growth for SRS? Let's have a look at the scale of that value:

>The SRS-A mean total score was highest in the ASD sample [autism disorder] (M = 78.5, SD = 13.7), intermediate in the CLIN [other disorders] (M = 63.4, SD = 15.4), and lowest in the TD [typically developing, 'normal ] (M = 55.5, SD = 9.9)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3425739/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3425739/)

So you have about 10 points on average between these groups, an effect size of 0.06 doesn't seem extreme to me (but it is nevertheless linked!)

</comment></comment><comment><USER22> To extrapolate a bit too far; Basement dwellers beget basement dwellers.

Serious thought: Can these traits be considered (de)evolutionary after 2 generations? Will more wealthy bloodlines become better due to improved diet and care? Do we need to start incentivising going outside more often? Or just scale back the demonization of sunlight exposure? Or do we just start a social program mailing out sunlamps as a preventitive measure?

<comment><USER15> I'm not sure that mentioning epigenetics, etc, is really going "too far." It's not unlikely, and epigenetics isn't exactly speculative science anymore. Yes, the comment is flip, and eschews the proper (but quite recent) scientific terms but it is very closely aligned with the science. There's no shortage of evidence of better longevity for the privileged, and better health, for example, although better nutrition from higher-value foods is a more usual speculative cause of this mentioned by researchers.

<comment><USER23> I am from Southern India (typically darker skin) and have noticed 6 cases of ASD (non-verbal and very basic or non-existent social interaction) amongst friends and relatives. 3 of these cases come from the same family (mine) and the other 3 are unrelated. All 6 were born either in the US or UK. All 4 families don't have previous occurrence of ASD or similar symptoms (non-verbal or awkward social skills would be easy to pick up).

Since reading/experiencing a family member with ASD, I do see some ASD characteristics and behaviors in some other family members residing in India but they somehow have been able to overcome that and lead a typical life. Can't explain why there aren't more severe cases (in which case, they would've been reported) and if more sunlight or exposure to a lot more people/social situations is helping correct it.

There was an Indian news article that reported a higher incidence of ASD in NRIs (non-resident Indians). With Desk jobs becoming more prevalent, Vitamin D deficiency is showing up in India as well. Given my small #samples, it does seem like something is triggering more severe ASD in people with dark-skin in countries with less sunlight. Increase in incidences of ASD, can be attributed to its broadened definition but there seem to be other minor reasons (Vitamin D being one) which need more research instead of dismissal. Current incidence levels of 1 in 68 (boys - 1 in 42, girls - 1 in 189) is plain crazy and needs more attention.</comment></comment></comment>


Making a (Long-Winded) Case for Turbolinks - <AUTHOR> http://blog.graykemmey.com/2019/03/11/making-a-case-for-turbolinks/ <comment><USER2> Turbolinks is amazing - for small teams, rapid development scenarios I think it's an underrated (at least outside of Rails) solution. I've been using it with Django lately with great results. Combining it with Prefetch can yield even faster apparent user experience (see [https://www.mskog.com/posts/instant-page-loads-with- turbolin...](https://www.mskog.com/posts/instant-page-loads-with-turbolinks- and-prefetch/))</comment>


How I review code - <AUTHOR> https://engineering.tumblr.com/post/170040992289/how-i-review-code <comment><USER2> _" Senior engineers sometimes need to be reminded that highly performant, abstract, or clever code is often difficult to read and understand later, which usually means asking them for more inline comments and documentation."_

Ha! That's not a senior engineer. Senior engineers write the most simple- looking code that just works. In every rainy day scenario imaginable. The clever code writers aren't there yet.

<comment><USER3> Ha it does make me think of this tweet [https://twitter.com/KevlinHenney/status/381021802941906944](https://twitter.com/KevlinHenney/status/381021802941906944)

You nailed it really, senior engineers code is the most simple looking as generally they've picked the right abstraction for the problem.

<comment><USER4> Is this a senior engineers are literally superheroes meme I've missed?

Everyone is capable of making poor decisions and straight up logic errors. Senior devs sometimes more-so because we tend to get entrenched in a particular issue solo for longer periods.

<comment><USER3> Not at all and it's now how I view senior engineers. True senior engineers though do tend to find the right abstractions more often than other engineers but it doesn't mean they can't make huge mistakes with bigger implications.

My thoughts are also on actual senior engineers, not 2 years of experience etc.

</comment></comment></comment></comment><comment><USER5> I echo the author's point in "Review the code with its author in mind".

Without comments, sometimes it's really really difficult to navigate the code. I have been adding more comments than ever: don't assume every line is obvious, write a comment to explain what the next few lines really do.

        # base case: stop dividing when we find the largest square.
        if width == height:
            return width, height
        else:
            # otherwise, we know that we can break the land into several
            # pieces, some are already square-sized, but there must be
            # left over, which is the difference of the width and height,
            # and can be divided again.

            remain = abs(width - height)
            return largest_square_plot(remain, min([width, height]))

^ This code is only for me to read so I didn't really care much about grammar... but a year from now I shouldn't have trouble understand the code in a minute or two.

Some of my function/method has a pretty long docstring which may include explaining the rationale, and perhaps even some ascii diagrams. If you have trouble understand a piece of code after a few passes, that's a bad code. Also, use more newlines...

> I check every Github email I get; I make sure that I don't get notified for > everything that happens in the repo

Not sure about others, but I am tired of reading PR notifications in my mailbox. I don't know how kernel developers can live with this.

I have been thinking about just build a bot.

* receives PUSH from GitHub

* adds events to a queue

* notifies based on priority

* pings me once in a while to remind me that I have outstanding PRs to review (as reviewer and as author of the patch).

If someone needs me to review right away, he/she can reach out to me directly in chat.

<comment><USER6> A good counter argument to Comments:

[https://blog.codinghorror.com/coding-without- comments/](https://blog.codinghorror.com/coding-without-comments/)

<comment><USER7> That article doesn't make a compelling case.

It suggests taking this code:

      // square root of n with Newton-Raphson approximation
      r = n / 2;
      while ( abs( r - (n/r) ) > t ) {
          r = 0.5 * ( r + (n/r) );
      }

      System.out.println( "r = " + r );

And refactoring it to this function:

      private double SquareRootApproximation(n) {
          r = n / 2;
          while ( abs( r - (n/r) ) > t ) {
              r = 0.5 * ( r + (n/r) );
          }
          return r;
      }

      System.out.println( "r = " + SquareRootApproximation(r) );

I'm all for this refactoring, but something was lost in the process. What kind of square root approximation is being used? Does the algorithm have a name? What would I search for if I wanted to read more about it? That information was in the original comment.

<comment><USER8> There's an infinite amount of detail that's impossible to capture in a comment and which invariably changes over time and doesn't hold in the future.

For my team, the solution has been writing longer commit messages detailing not only what has changed, but also the why and other considerations, potential pitfalls and so forth.

So in this case, a good commit message might read like:

``` Created square root approximation function

This is needed for rendering new polygons in renderer Foo in an efficient way as those don't need high degree of accuracy.

The algorithm used was Newton-Raphson approximation, accuracy was chosen by initial testing:

[[Test code here showing why a thing was chosen]]

Potential pitfalls here include foo and bar. X and Y were also considered, but left out due to unclear benefit over the simpler algorithm. ```

With an editor with good `git blame` support (or using github to dig through the layers) this gives me a lot of confidence about reading code as I can go back in time and read what the author was thinking about originally. This way I can evaluate properly if conditions have changed, rather than worry about the next Chthulu comment that does not apply.

<comment><USER9> Now you have to look in two places for the information- the code and the commit messages.

<comment><USER8> How so? The code still documents what is happening, the commits however lay out the whys.

The point is that these two are separate questions, and that trying to use comments as a crutch to join the two religiously is a headache. It's impossible to keep everything in sync and I don't want to read needless or worse misleading information.

What's worse, in comments we often omit the important details such as why was the change made, what other choices were considered, how was the thing benchmarked, etcetc.

That said, comments still have a place. Just not everywhere for everything and especially not for documenting history.

<comment><USER9> I disagree. I think the "whys" belong in the comments- in fact, that's the most important part of the comment if the code is cleanly written. I don't want to be happily coding along, get to a glob and have to go to the repo pane, hunt for the commit that explains this particular thing, then read a commit message. Put it in a comment in the code. Pretty please.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> A conundrum for me is how to get other people to code review the way I want to be code reviewed? Particularly, I noticed code reviewers on my team are pretty pedantic, obsessed with correctness, and need to be explained why each change is okay. These are people that regularly write good quality code themselves, but there is a high amount of distrust. Why doesn't a team of talented programmers trust each other?

(in case it needs to be stated, to date, I have reviewed about as much code as I have written, upwards of 100k lines, as have most of the other people on my team. We aren't amateurs, but it often seems like we're babies.)

<comment><USER11> I'm an overly pedantic reviewer because I feel the review is one of the few places where I can counteract the accumulation of technical debt. Once the less than ideal code is in the codebase it's there to stay. I also ask a lot of pretty dumb questions during a review because I want to make sure that my understanding of the requirements matches the understanding the other engineer had.

<comment><USER12> > Once the less than ideal code is in the codebase it's there to stay.

That is not objective fact across projects. That means either the process or culture is bad.

<comment><USER11> I've never seen a project where you go back to fix something just because its implementation is not ideal. If it works it stays, because there is always something more important to do.

<comment><USER13> This, this and this.

You get told to quickly write something as a Proof of Concept. Then get told, it works so put it in the code and reelase it. We will rewrite it later.

You _never_ get to rewrite it later.

Over time the code base goes to hell. _Every single time_

<comment><USER12> I have hard time to believe you never refactor function you come across. I see how refactoring whole architecture or something major is avoided, but when it comes to smaller functions and pieces of code, refactoring it as you go takes around same amount of time as refactoring it during that detailed code review (e.g. often very little).

The really big mess tend to be emergent - when features and code base grew too much for original architecture over time. You cant prevent that one by detailed code review and it takes a lot of effort to fix it.

<comment><USER13> At my last job, if you had unecessary changes for the work item (e.g. refactoring) you failed the code review.

But then we had 5% unit test coverage on a 5million+ LOC code base, they were terrified that refactoring (with no tests to back it up) might break things.

We were writing medical software and they were very risk adverse (obviously), so if i refactored a method I would have to raise that and would mean test cases would have to be written and manually run to ensure I hadn't broken anything.

So refactoring hardly happened (The code was an absolute mess), when i left they were working on a project to fix it but the timescales for it were 5 to 10 years.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> > We have repositories for the PHP backend, our database schemas, our iOS > (Swift/Obj-C) and Android (Java/Kotlin) mobile apps, infrastructure projects > written in Go, C/C++, Lua, Ruby, Perl, and many other projects written in > Scala, Node.js, Python, and more

Why do organizations allow this? I realize that some platforms require their own languages (iOS, Android), but outside of that, just pick one or two and hold the line.

<comment><USER15> Why? Having many languages allows to pick the sweetspot for each subsystem. Each language has special strengths and weaknesses, there is no silver bullet that excels at everything. Go, C/C++, Lua, Ruby, Perl, Scala, Node.js, Python... each of these are THE best choice for certain classes of problems (and terrible for others). It may be because of language features that elegantly express a solution, or particular efficiency considerations (speed, latency or memory footprint), or integrations with specific libraries (if language X has a lib that does 90% of the requirement, use it instead of reimplementing from scratch in language Y). Also, it may be a team consideration: the talent pool for front-end engineers has different preferences than the talent pool for some back-end systems.

In a large system like Tumblr, they are likely highly distributed with many different subsystems running in different parts of their infrastructure, each with their own SLA and resilience requirements.

Their team is probably large enough that most engineers focus on only some of the subsystems, and communication between them is via defined interfaces.

Though having a diverse ecosystem fosters an openess of mind, instead of enforcing "One Metaphore To Rule Them All". You find yourself borrowing efficient patterns from other environments, as they eventually start cross- pollinating.

<comment><USER16> > Each language has special strengths and weaknesses, there is no silver > bullet that excels at everything. Go, C/C++, Lua, Ruby, Perl, Scala, > Node.js, Python... each of these are THE best choice for certain classes of > problems (and terrible for others).

Not quite true... not all languages have a sweet spot in a production environment. Node.js isn't particularly excellent at anything, the attraction is mainly "I know JS, and I don't want to learn anything else right now", which is a terrible attitude for someone who wants to have a career in tech. Knowing more than one tool in the toolbox is a key skill, since there is no one-size-fits-all.

Jury is still out on Scala. It's a big language, but unclear if there's a production sweet spot or not compared to other JVM hosted languages.

The rest of the ones you listed have their definite sweet spots. There are tons of languages though, and most don't have one.

<comment><USER15> > Node.js isn't particularly excellent at anything

That's not very kind. Yes it has its flaws but it's not bad at being a higher abstraction over async-everything, augmented with a huge module repository. Support for isomorphic javascript can come in handy for some applications.

I've never done Scala but my understanding of it is that it could be a good fit for modelling certain types of business logic while being able to take advantage of exiting java libs out there.

> Knowing more than one tool in the toolbox is a key skill, since there is no > one-size-fits-all.

Yes, we agree here. That was the point I was making.

<comment><USER16> Node is adequate at async, but not excellent. As I said in a sibling comment, things that are synchronous still, like GC, make it fall down at scale. Isomorphic JS isn't that useful in most real situations.

My point about Scala is that there doesn't seem to be a clear cut niche that it excels at. There are numerous other non-Java languages that run on the JVM that could be in the running, and they all get to take advantages of the whole Java ecosystem too.

</comment></comment></comment></comment></comment><comment><USER17> My code is well commented. //eslint-disable-line all over the place.

<comment><USER18> Invoking eslint-disable needs to have comment of it's own justifying why the line in question is being skipped. What use is the linter if we just disable it everytime it complains?

<comment><USER17> I dont have permission to remove lint rules but some of them are absurd.

I refuse to remove 'extrenious' parenthesis that make the code more readable to junior devs who may not know the language specific order of evaluation in a logical expression.

</comment></comment></comment><comment><USER19> For me the most important part of reviewing any nontrivial changes it actually check out the branch and test every change I see. This keeps a lot of issues from reaching the QA team and catches issues they could have missed since they don't actually go through the code.

<comment><USER20> This is an ideal but is hardly scalable if you're doing 3-4+ PRs per day and are expected to do your own coding as well (plus attend bureaucracy).

You can effectively do this by checking that every nontrivial change has sufficient automated test coverage. This saves you from having to test changes yourself and saves future devs from having to go through your thought-process when they touch that code next.

</comment></comment><comment><USER21> Something the author doesn't bring up, but that we started doing about 9 months ago at my company, is synchronous reviews. Meaning the committer is on the phone or in person with the reviewer. It's great. We don't do it for all PR's, but anything medium sized or above, or even small one's if they involve critical logic. The way we usually do it is the committer walks through the changes with the reviewer. Often the committer will realize their own ways of improving the code. And with the added context, the reviewer can often provide better feedback. Plus the X factor of just two people talking who come up with ideas, improvements, etc. And half our team is remote, so this wasn't a natural outgrowth. We make it happen, but I think it's worth it.

<comment><USER22> That sounds very similar to Rubber Duck Debugging.

</comment></comment><comment><USER23> I am a junior developer and my latest feedback was that one of the main skills I should develop is to make better, more well-thought, critic and deep code reviews (including of PRs from more senior developers).

Any tips on how to improve this?

Would a checklist help? Have a clear process on what to review first?

<comment><USER24> A checklist can help. (he says, and then does a mental one because there isn't one nearby).

What I look for is:

1) What's the problem being solved? Does this look like a reasonable approach? Is the code pythonic (Obv: for python)?

2) What edge cases are there? Does this handle the important ones? Does it punt properly on the less important ones?

3) Look for a short list of bug classes that have come up in the project before that have lead to emergency patches. E.g. Decrefing, Checking mallocs, any exec sorts of things. (This is a clear application for a checklist)

4) Are there tests/documentation/other required fixtures and stuff?

5) Does the code generally match the style of the project?

1000) Code formating and whitespace and line wrapping and all that bikeshedding stuff.

Feel free to short circuit anywhere once it becomes clear that there's more work required.

<comment><USER25> 1000 should really be handled by automated tools. Takes useless burden from the reviewer, and emotionally easier for both sides too.

<comment><USER24> It can be, especially at a company. (But then watch the bikeshed discussion on the tools. And PEP8 is a guideline, not a set of hard and fast rules. Beautiful is better than ugly and all that. ).

What I see as one of 5 maintainers of an open source project is that when a review comes back with a bunch of formatting comments, it's because the reviewer didn't step back and see the other parts. Raymond Hettinger has a talk where he discusses it, but it's the sort of feedback that can be given in almost any case and can obscure the more fundamental issues with the code.

</comment></comment></comment></comment><comment><USER26> > I look for code that is well-documented (both inline and externally), and > code that is clear rather than clever. I'd rather read ten lines of verbose- > but-understandable code than someone's ninja-tastic one-liner that involves > four nested ternaries.

"Clear" and "clever" aren't in opposition, and likewise "verbose" and "understandable" aren't correlated.

I think this characterisation, and especially the example, shows a lowest- common-denominator straw man of "clever one-liners" which seems to miss the reason that some people like them. In particular, it seems to be bikeshedding about how to write branches. The author doesn't say what those "ten lines of verbose-but-understandable code" would be, but given the context I took it to mean "exactly the same solution, but written with intermediate variables or if/else blocks instead".

This seems like an analogous situation to [https://wiki.haskell.org/Wadler's_Law](https://wiki.haskell.org/Wadler's_Law) where little thought is given to what the code means, more thought is given to how that meaning is encoded (e.g. ternaries vs branches) and religious crusades are dedicated to how those encodings are written down (tabs vs spaces, braces on same/new lines, etc.).

Note that even in this simple example there lurks a slightly more important issue which the author could have mentioned instead: nested ternaries involve boolean expressions; every boolean expression can be rewritten in a number of ways; some of those expressions are more clear and meaningful to a human than others. For example, `loggedIn && !isAdmin` seems pretty clear to me; playing around with truth tables, I found that `!(loggedIn -> isAdmin)` is apparently equivalent, but it seems rather cryptic to me. This is more obvious if intermediate variables are used, since they're easier to name if they're meaningful.

In any case, compressing code by encoding the same thing with different symbols doesn't make something "clever". It's a purely mechanical process which doesn't involve any insights into the domain.

To me, code is "clever" if it works by exploiting some non-obvious structure/pattern in the domain or system. For example, code which calculates a particular index/offset in a non-obvious way, based on knowledge about invariants in the data model. Another example would be using a language construct in a way which is unusual to a human, but has the perfect semantics for the desired behaviour (e.g. duff's device, exceptions for control flow, etc.).

Such "clever" code is _often_ more terse than a "straightforward" alternative, but that's a side-effect of the "cleverness" (finding an existing thing which behaves like the thing we want) rather than the goal.

If the alternative to some "clever" code is "10 lines of verbose but understandable code" then it's probably not that clever; so it's probably a safe bet to go with the latter. The _real_ issues with clever code are:

\- Whether the pattern it relies on is robust or subject to change. Would it end up coupling components together, or complicate implementation changes in unrelated modules?

\- How hard it is to understand. Even if it's non-obvious, can it be understood after a moment's pondering; or does it require working through a textbook and several research papers?

\- Whether the insights it relies on are enlightening or incidental, i.e. the payoff gained from figuring it out. This is more important if it's harder to understand. Enlightening insights can change the way we understand the system/domain, which may have many benefits going forward. Incidental insights are one-off tricks that won't help us in the future.

\- How difficult it would be to replace; or whether it's possible to replace at all.

This last point is what annoys me in naive "clever vs verbose" debates, and prompted this rant, since it's often assumed that the only difference is line count. To me, the best "clever" code isn't that which reduces _its own_ line count; it's the code which _removes problems entirely_ ; i.e. where the alternative has caveats like "before calling, make sure to...", "you must manually free the resulting...", "watch out for race conditions with...", etc.

One example which comes to mind is some Javascript I wrote to estimated prices based on user-provided sliders and tick-boxes, and some formulas and constants which sales could edit in our CMS (basically, I had to implement a spreadsheet engine).

Recalculating after user input was pretty gnarly, since formulas could depend on each other in arbitrary ways, resulting in infinite loops and undefined variables when I tried to do it in a "straightforward" way. The "clever" solution I came up with was to evaluate formulas and values lazily: wrapping everything in thunks and using a memo table to turn exponential calculations into linear ones. It was small, simple and heavily-commented; but the team's unfamiliarity with concepts like lazy evaluation and memoising made it hard to get through code review.

Also, regarding "straightforward" or "verbose" code being "readable": it's certainly the case that any _particular_ part of such code can be read and understood _locally_ , but it can make the _overall_ behaviour harder to understand. Just look at machine code: it's very verbose and straightforward: 'load address X into register A then add the value of register B', simple! Yet it's very hard to understand the "big picture" of what's going on. Making code more concise, either by simplifying it or at least abstracting away low-level, nitty-gritty details into well-named functions, can help with this.

When used well, "clever" code can reframe problems into a form which have very concise solutions; not because they've been code-golfed, but because there's so little left to say. This can mean the difference between a comprehensible system and a sprawling tangle of interfering patches. This may harm local reasoning in the short term, since it requires the reader to view things from that new perspective, when they may be expecting something else.

When used poorly, it results in things like nested ternaries, chasing conciseness without offering any deeper understanding of anything.

<comment><USER27> An HN gem of a comment!

</comment></comment><comment><USER28> I don't know how much time he spends code reviewing. But if at the end of the day he wants anybody to get the complete context of what the change entails by looking at the PR... I would think the code review process is more elaborate and time consuming than many companies can afford.

</comment><comment><USER29> > _clever code is often difficult to read and understand later_

I have seen this many times and they are actually usually talented developers that are just not used to working in groups....

but what I have seen more often (back when I did code reviews)... is lazy copy and pasting or something analogous.

</comment><comment><USER30> I don't understand why you need to know the progamer behind the code ? You need to be totaly impartial when you judge something.

So i think it's a wrong way to review the code. You don't need the WHO but the WHY.

</comment><comment><USER31> > I'd rather read ten lines of verbose-but-understandable code than someone's > ninja-tastic one-liner that involves four nested ternaries.

One of my pet peeves is the inability to solve a K-Map for 6 variables and do stuff based on the resulting boolean expression. Just because it is utterly unreadable. I've tried this with many reviewers but nope.</comment>


Ask HN: How are Senate/House bills prepared? - <AUTHOR> Specifically, how do tens to hundreds of senators or representatives collaborate on documents that often grow in excess of 1000 pages? How are changes tracked?<p>I noticed that today's Senate healthcare reform bill appears to be laid out in TeX (https://www.budget.senate.gov/imo/media/doc/BetterCareJuly13.2017.pdf). Does anyone on HN have insight into the production process that resulted in that final document? <comment><USER2> I know literally next to nothing about this, so beware my comment. However, I'm pretty sure that " tens to hundreds of senators or representatives collaborate" is not a thing for bills.

It's typically a small group of people who create the bill. (Like a Senator and their staff) It gets proposed to a subcommittee who reads it (I believe they also give feedback) and then accept/reject it. If accepted it then gets passed to the entire Senate/House for people to read and accept/reject.

If you're curious about how the actual writing occurs, I'm sure its nothing special. Just like writing a group paper in school.

</comment><comment><USER3> That was created with Adobe Acrobat Distiller -- That font isn't CMR, it's New Century Schoolbook (The Supreme Court likes that font as well). There's also a "gpospec5" font (perhaps GPO is the Government Printing/Publishing Office). I could only find a handful of references the the gpospec5 font, including this one [1] on the previous healthcare bill. Windows user ERN was involved with both, so I would guess he's a GPO employee.

1: [http://blynken.blogspot.com/2009/11/health-care-bill-geek- st...](http://blynken.blogspot.com/2009/11/health-care-bill-geek-style.html)

</comment><comment><USER4> > _how do tens to hundreds of senators or representatives collaborate_

I'm actually curious to know whether this assumption is accurate. Do they really collaborate? Do they read their own bills when they're this long? Or do their staff handle all of this? Do they really read each other's bills? Does one senator's staff just write a bill by itself, and then everyone else agrees to the language? Or do they collaborate from the beginning?

I've read before that Congresspeople spend almost 100% of their time fundraising and very little time legislating. I imagine their staff must handle the rest.</comment>


Curl 7.51.0 Released - <AUTHOR> https://curl.haxx.se/changes.html#7_51_0 <comment><USER2> I see that Ubuntu 16.04 LTS have version 7.47.0 [1]. Its been 9 months, 9 releases and at least 15 CVEs since then. I can also see that some of the CVEs was reported to distros@openwall [2]. I (naively) assumed that once this was reported, the package maintainers would update the packages, push a release at the same time as the original developer made a public statement. Then I could just update my system and be done with it.

Where is the fault in this chain? How can I as a maintainer of a few servers be sure my servers are secure without manually patching every package?

[1] [http://packages.ubuntu.com/xenial/libcurl3](http://packages.ubuntu.com/xenial/libcurl3) [2] [http://oss-security.openwall.org/wiki/mailing-lists/distros](http://oss- security.openwall.org/wiki/mailing-lists/distros)

EDIT: changed "12 CVEs" to "at least 15 CVEs". The changelog don't have CVE- numbers in the title for all of them.

<comment><USER3> It's the concept of LTS distributions to stick with one version and only patch important bugfixes and security vulnerabilities.

So if the Ubuntu security team does its job properly then you shouldn't have a reason to worry.

(However given the number of security vulns these days it's often challenging for LTS distributions to backport all security fixes. There are already breakdowns of the LTS concept, e.g. sticking with latest upstream versions for some packages like chromium where backporting is not realistic.)

<comment><USER4> Yep, you can see that Ubuntu has been backporting security fixes: [https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.1](https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.1)

</comment></comment></comment><comment><USER5> Those looking from a "reimplement it in Rust" angle may like:

* [https://github.com/hyperium/hyper/](https://github.com/hyperium/hyper/)

* [https://github.com/lukaszwawrzyk/rust-wget](https://github.com/lukaszwawrzyk/rust-wget)

* [https://github.com/tokio-rs/tokio-curl](https://github.com/tokio-rs/tokio-curl)

<comment><USER6> tokio-curl uses libcurl internally

<comment><USER5> Yes. I linked it to show how a web client can run requests in parallel using Rust's tokio and futures libraries. If anyone makes a similar implementation, it might go in tokio-hyper/examples ( [https://github.com/tokio-rs/tokio- hyper/tree/master/examples](https://github.com/tokio-rs/tokio- hyper/tree/master/examples) ) or near rust-wget to add more of wget and curl's wrapped functionality.

</comment></comment></comment><comment><USER7> Does anyone have an abbreviated explanation of what the security vulnerabilities that were addressed here? I recall there was a very ominous post to look out for this release because of some nasty stuff they found.

</comment><comment><USER8> I love cURL. Keep up the good work.

</comment><comment><USER9> What is the biggest usage of Curl? I am new to Linux,sorry.

<comment><USER10> Apart from the oodles of software that depends on curl/libcurl, my favourite thing is to "Copy as cURL" from a Chrome request.

<comment><USER11> Or Firefox, but yes, first to debug all web bugs!

</comment></comment></comment><comment><USER12> Change log for this release

Fixed in 7.51.0 - November 2 2016

Changes:

        nss: additional cipher suites are now accepted by CURLOPT_SSL_CIPHER_LIST
        New option: CURLOPT_KEEP_SENDING_ON_ERROR

Bugfixes:

        CVE-2016-8615: cookie injection for other servers
        CVE-2016-8616: case insensitive password comparison
        CVE-2016-8617: OOB write via unchecked multiplication
        CVE-2016-8618: double-free in curl_maprintf
        CVE-2016-8619: double-free in krb5 code
        CVE-2016-8620: glob parser write/read out of bounds
        CVE-2016-8621: curl_getdate read out of bounds
        CVE-2016-8622: URL unescape heap overflow via integer truncation
        CVE-2016-8623: Use-after-free via shared cookies
        CVE-2016-8624: invalid URL parsing with '#'
        CVE-2016-8625: IDNA 2003 makes curl use wrong host
        openssl: fix per-thread memory leak using 1.0.1 or 1.0.2
        http: accept "Transfer-Encoding: chunked" for HTTP/2 as well
        LICENSE-MIXING.md: update with mbedTLS dual licensing
        examples/imap-append: Set size of data to be uploaded
        test2048: fix url
        darwinssl: disable RC4 cipher-suite support
        CURLOPT_PINNEDPUBLICKEY.3: fix the AVAILABILITY formatting
        openssl: don't call CRYTPO_cleanup_all_ex_data
        libressl: fix version output
        easy: Reset all statistical session info in curl_easy_reset
        curl_global_cleanup.3: don't unload the lib with sub threads running
        dist: add CurlSymbolHiding.cmake to the tarball
        docs: Remove that --proto is just used for initial retrieval
        configure: Fixed builds with libssh2 in a custom location
        curl.1: --trace supports % for sending to stderr!
        cookies: same domain handling changed to match browser behavior
        formpost: trying to attach a directory no longer crashes
        CURLOPT_DEBUGFUNCTION.3: fixed unused argument warning
        formpost: avoid silent snprintf() truncation
        ftp: fix Curl_ftpsendf
        mprintf: return error on too many arguments
        smb: properly check incoming packet boundaries
        GIT-INFO: remove the Mac 10.1-specific details
        resolve: add error message when resolving using SIGALRM
        cmake: add nghttp2 support
        dist: remove PDF and HTML converted docs from the releases
        configure: disable poll() in macOS builds
        vtls: only re-use session-ids using the same scheme
        pipelining: skip to-be-closed connections when pipelining
        win: fix Universal Windows Platform build
        curl: do not set CURLOPT_SSLENGINE to DEFAULT automatically
        maketgz: make it support "only" generating version info
        Curl_socket_check: add extra check to avoid integer overflow
        gopher: properly return error for poll failures
        curl: set INTERLEAVEDATA too
        polarssl: clear thread array at init
        polarssl: fix unaligned SSL session-id lock
        polarssl: reduce #ifdef madness with a macro
        curl_multi_add_handle: set timeouts in closure handles
        configure: set min version flags for builds on mac
        INSTALL: converted to markdown => INSTALL.md
        curl_multi_remove_handle: fix a double-free
        multi: fix inifinte loop in curl_multi_cleanup()
        nss: fix tight loop in non-blocking TLS handhsake over proxy
        mk-ca-bundle: Change URL retrieval to HTTPS-only by default
        mbedtls: stop using deprecated include file
        docs: fix req->data in multi-uv example
        configure: Fix test syntax for monotonic clock_gettime
        CURLMOPT_MAX_PIPELINE_LENGTH.3: Clarify it's not for HTTP/2

<comment><USER13> Why repeat this here in an inferior format?

<comment><USER14> I think this format is superior for mobile users, it gives them only the relevant information in just a few kB of data.

In this case, haxx.se is not that bad, but many news sites present so much ads, overlays, non-responsive UI, dark UI etc etc that most mobile browsers crash, and loading takes forever due to 10+mb of ads on a 3G connection just to display 20 lines of information.

<comment><USER13> I read this first on my android phone and can assure you that your copy paste is inferior, especially so due to the use of a fixed width font causing line truncation.

Also this kinda thing is about as popular here as "tldr" posts which are quickly suppressed.

My friendly advice is to not make a habit of this</comment></comment></comment></comment>


Shaving digitally - <AUTHOR> http://smart-machines.blogspot.com/2009/02/shaving-digitally.html

<comment><USER2> The dude with the beard seems to have a slight smile, while in the photo of him without the beard he seems to have a more hostile expression. Does anyone else see that, or is it just me?</comment>


A density map of all devices on the internet - <AUTHOR> https://twitter.com/achillean/status/505049645245288448

<comment><USER2> Interesting; its not the usual heatmap of population because Asia is cooler colors. Its a heatmap of money maybe?</comment>


Code Everywhere: Why We Built Cloudflare Workers - <AUTHOR> https://blog.cloudflare.com/code-everywhere-cloudflare-workers/ <comment><USER2> > the most peered network on the planet

That's a bold claim. I'd expect Akamai, Google and Amazon to be peered at more locations, maybe even more. Or have they become that big?

<comment><USER3> Yes. We are that big.

[https://bgp.he.net/report/exchanges#_participants](https://bgp.he.net/report/exchanges#_participants)

<comment><USER4> Who is hurricane electric?

<comment><AUTHOR> [https://en.wikipedia.org/wiki/Hurricane_Electric](https://en.wikipedia.org/wiki/Hurricane_Electric)

</comment></comment></comment></comment><comment><USER5> Very similar to lambda@edge

Trade offs I see

* Cloudflare is probably slightly closer to customers, but cloudfront is still very close

* lambda@edge should be cheaper with amazons scale and ecosystem

* cloudfront itself is very expensive compared to Cloudflare, almost every project can integrate Cloudflare and use this, where small projects don't really make sense for cloudfront

<comment><USER6> > lambda@edge should be cheaper with amazons scale and ecosystem

I suspect price will have more to do with the tech's underlying ability to scale to lots of (separately-sandboxed) customers at lots of edge locations. Our tech is pretty different from Amazon's so it will be interesting to see how that shakes out.

</comment></comment><comment><USER7> It would be amazing if those workers supported WebSockets. Running game servers in them would be tempting, as long as they don't charge exorbitant prices for bandwidth.

<comment><USER6> WebSocket support is planned (not sure if it will be in v1).

The issue with game servers is that you probably need to make sure all the players in the same game instance hit the same worker. There won't be any way to do that with workers in v1. But, this is definitely something we've thought about, and as a big gamer myself I would like to see it happen someday. I have some particular ideas for a different kind of worker (not a Service Worker) that serves this use case. But it's probably a year out.

</comment></comment><comment><USER8> This is pretty interesting, especially if one get some kind og local storage where one can cache the data from the users and also keep some extra data one need to handle the requests. One can also imagine some kind of MQ solution that distribute to the edges and then updates the clients (for games and such scenarios)

<comment><USER3> Yes. We are exploring adding data storage at the edge. We would love people's feedback in the product and what features we need to add.

<comment><USER9> It sounds like you're slowly working towards becoming some sort of insane hosting company

<comment><USER3> I don't see us going into hosting. I do see us doing everything that makes sense when you are a few ms from everyone on the planet.

<comment><USER10> > Run JavaScript Service Workers at the Edge

> We are exploring adding data storage at the edge.

> I don't see us going into hosting.

You must have your eyes closed then, because that's clearly pushing the camel nose into the Amazon lambda tent.

</comment></comment></comment></comment></comment><comment><USER11> How does this deal with proxy loops?

As an example, I would assume worker is making requests with the internal view of the site, but can not have an internal view of other sites or security problems would ensue.. So what happens when two of my sites have service workers fetching something from each other on each request?

<comment><USER6> As you guessed, when your worker makes a subrequest to your own zone, it goes directly to your origin server, but when you subrequest to some other domain, it goes in "the front door", and that other domain's scripts apply.

If a request bounces back such that the same worker script would need to run twice as a result of a single original request, then it fails with an error. There's nothing else we can do here: we can't let the request loop, but we also can't let it skip your script after it's bounced through a third-party script.

<comment><USER12> To clarify, yesterday you mentioned that subrequests go through the regular caching subsystem.

Does this hold true even for subrequests to your own zone, where you say here that they go directly to the origin server?

<comment><USER6> Yes. I meant that those requests don't loop back into the Worker again -- I didn't mean that they skip cache.

</comment></comment></comment></comment><comment><USER9> Summary: Service Workers on the Edge Server.

Very interesting, especially since it allows for a Cloudflare ESI system.

Wonder if many will take advantage of it

<comment><USER13> What is ESI in this context? Edge Server Infrastructure?

<comment><USER9> Edge Side Includes. Imagine putting some sort of template syntax in a file, that file is cached, and when it's called from cache it grabs a file from the remote server based on the template syntax.

<comment><USER12> Notably, implementing ESI directly at Cloudflare's edge enables them to cache page fragments, rather than fully constructed pages.

That could do wonders both for the size of caches and for cache hit-rates</comment></comment></comment></comment>


Apple iOS Hardware Assisted Screenlock Bruteforce - <AUTHOR> http://blog.mdsec.co.uk/2015/03/bruteforcing-ios-screenlock.html?m=1

<comment><USER2> Huh. I wonder how many other devices can be brute-forced via the same type of attack?</comment>