Startup says it wants to fight poverty, but a food stamp giant is blocking it - <AUTHOR> https://www.nytimes.com/2018/04/23/technology/start-up-fight-poverty-food-stamp-giant-blocking-it.html <comment><USER3> I've had the pleasure of doing some contract work that involved dealings with Conduent, and my oh my are they absolutely horrible to work with, and generally incompetent.

Their m.o. is to put you on the phone with some folks from Bangalore, where if you ask anything off script they stonewall you with "that's against internal security policy."

Then, because the project is 6 months delayed and the main stakeholders are upset (the ones paying $$$ of taxpayer money), some account manager there CC's every living soul who has ever been involved and tries to get them all on the phone together, which goes about as well as you would expect. Promises get made, timelines agreed upon, and then they never deliver.

<comment><USER4> Sounds exactly the like the type of company states choose to be sole suppliers of software and services. Not even joking, this sounds perfectly typical in my experience.

<comment><USER3> I suppose there is comfort in choosing an organization that operates similarly to your own.

<comment><USER5> This proposition is missing an _actual_ motive. In other words, what's comfortable about that?

We might also ask "what is 'their own'?"

If you are proposing that the government is the organization of the elected officials, you're wrong. A democratic government belongs to the members of the society. Many Americans don't realize that so I'll assume you're one of them.

In reality, most American elected officials don't make decisions on behalf of their electorate because they get paid more by private companies to specifically not do so, which is clearly the issue at hand.

But furthermore, if you are an American, it is _your_ society who hired this company by proxy, and who is paying for it.

When you give these strange narratives which insult your own government, you are only insulting yourself. You are the people who let this happen.

<comment><USER3> No, I'm talking about an organization of civil servants, with layers of beuracracy and process, similar to any large organization.

</comment></comment></comment></comment></comment><comment><USER6> Many will only read the image captions and will miss this buried "info" bit:

"Conduent, in another twist, has begun competing with the start-up. The business services outsourcer, which has $6 billion in yearly revenue, introduced its own smartphone app last year. Conduent's entry, ConnectEBT, has significantly fewer reviews and lower ratings on the Google and Apple app stores than Propel's FreshEBT."

<comment><USER7> In most cases, I would agree that Conduent is within their rights to build their own data stream for their product, and cut off a competitor. But, when your product is the redistribution of taxpayer dollars, doing so turns into a government sponsored monopoly.

<comment><USER8> I'm happy you agree, but how is being a monopoly better than being a government sponsored monopoly? They result in the same outcome.

<comment><USER9> I think the difference is that they are using public funds and public data which they are withholding. Google is/was a natural monopoly due to sheer technological advantage however someone can (and sort of has) built a competing product. There is no way to build a competing product in this case because it relys on data that is being withheld, it is doubly annoying because that data is (or should be) public and is funded by taxpayer dollars.

</comment></comment></comment></comment><comment><USER10> This is something we're going to have to get way better at.. ...government created markets.

Modern governments run many monopsonies, sectors where they are the only buyers. Spacex is selling to such a monopsony, for example. It seems that there, a simple change from cost-plus to fixed-quote pricing system made a huge difference.

A bigger example is roads, comm cables and a lot of "infrastructure" generally. These are sectors with a centralize core, and less centralized layers above it. Generally, the centralized layer is publicly run, contracted or highly regulated. Lending/money markets are a big example. Central banks at the core, large banks in the next layer, consumer financial services above that.

This sounds like an example of a centralized-core market.

There are just tons of example of things I would class as designed markets. Private companies can design/control markets too, the app stores are an example. The difference between a well designed/managed market and a badly designed one is huge.

In this example, how does it work? You need (or at least, they opted for) a centralised core: the part that keeps track of users, balances and allows transactions to happen. If there is to be a layer built onto this core, it needs to be well designed and designed for openness. We also can't expect competition or market forces to fix problems with the central core, at least unless that competition can be designed in.

We're really bad at this. Governments today do a lot of this, it's a core instrument. The difference between being good or bad at this is tremendous. One way or another, it'll need to improve.

<comment><USER11> Private prisons and munitions manufacturers, too.

Your general point speaks to a major source of corruption in the United States, which is often glossed over when well-meaning people push for increased government spending that will go to service providers rather than recipients directly, and is IMHO a vastly underappreciated argument in support of UBI.

<comment><USER12> One big answer to the unbridled graft in public-private partnerships is to nationalize such services and run them as public enterprises.

<comment><USER13> True, but that results in other problems - lack of accountabbility and control. Perfect example is the VA.

I think the ultimate solution is to simplify access to, and limit govnerment control of, all entitlement programs. The ultimate expression of that would be UBI - I'd even be in favor of a means-tested phase-out of the UBI.

After that's done, all we gotta do is fix the tax code...

<comment><USER14> > I'd even be in favor of a means-tested phase-out of the UBI.

This is a bad idea. A phase-out is indistinguishable from a tax in the same amount, but it harder to reason about and consequently tends to be implemented incoherently.

Suppose you have $10,000 basic income with a 20% phase-out rate and a progressive income tax with a 15% tax rate up to $50,000 and 25% thereafter. Then what you really have is a $10,000 UBI and an income tax of 35% up to $50,000 and 25% thereafter. Probably not what you wanted, right?

Much better to have a $10,000 UBI with no phase out and a flat 30% tax rate. Which has the added benefit of vastly simplifying the tax system -- no need for multiple rates and all the complexity and opportunities for tax avoidance that go with them.

<comment><USER13> Your phase-out and progressive taxation numbers don't work out for any logical application of the concept. A means-tested pahse-out of a UBI in a progressive tax scheme would reduce the UBI for earners only in the highest tax bracket, thus further increasing their tax rate.

I would prefer a flat tax, with the UBI acting as the progressive mechanism while also being phased-out for high earners. Your assumptions in your response are really bizzarre...

</comment></comment></comment></comment></comment></comment><comment><USER15> I don't see where Propel is fighting poverty. Instead, it's a for-profit company that requires an audience of low-income people for it to make money. And, if considered like that, Propel actually has a perverse incentive to keep people in poverty.

It saddens me to see NYT publish these types of PR pieces, disguised as journalism.

<comment><USER16> Are you arguing that no-one should be allowed to make a profit when providing services to low-income people? What incentive would there then be to offer these services?

<comment> noir-york > What incentive would there then be to offer these services?

Justice.

The state should be providing these services to low-income people itself. Low- income people are not 'customers' \- they are citizens and any money that is diverted to profit is money that is not going to the people who need it.

<comment><USER17> Good luck with that approach.

<comment> noir-york Why? The countries I am familiar with (in Europe) manage to provide most social services through the government agencies just fine. When there is a scew up, its usually when the provision has been out-sourced (at great cost).

</comment></comment></comment></comment></comment><comment><USER18> Can we stop these hyperinflated mission claims already. Fighting poverty is a good ambition, not quite sure an app will solve that problem.

<comment><USER19> "Fight poverty" is certainly a grandiose mission statement.

But this core function--checking benefits balances--is very helpful to EBT users.

Why? In my neighborhood there are quite a few EBT users. I've seen several of them run over their limits at the supermarket checkout. It's humiliating. (I volunteer at the drop-in center for kiddos in the local public housing project, so I know a few of these families.)

Plus, the nudges in this app to good nutrition are undoubtedly helpful. Generally super cheap food isn't the healthiest food, and an app like this can help.

I pay lots of taxes so poor people can have a fair shot at getting themselves and their families out of poverty. EBT helps fulfill that mission.

I know some people take the default position that recipients of public assistance ought to endure some hassles. I don't agree: being poor is hassle enough. The states where this big contractor does business should require them to cooperate with innovating stuff like Propel.

<comment><USER20> In most cases you can do an EBT Balance Inquiry right at the checkout (or customer service, etc).

<comment><USER21> Yeah but it's easier to look it up before you even go to the store. Why waste gas if you've only got $10, wait til next bit comes in a few days, that sort of thing.

<comment><USER20> Most EBT cards I've seen also have a toll-free number on the back to call and check your balance through an automated system (similar to gift cards).

<comment><USER22> >Most EBT cards I've seen also have a toll-free number on the back to call and check your balance through an automated system (similar to gift cards).

Yeah, and my bank does online phone banking. Which I've literally never used because it takes a couple of seconds with online banking to check my balance and roughly 10,000% more time to perform the same action with phone banking and that's IF I can remember all the details needed to get to that point.,

</comment></comment></comment></comment></comment></comment><comment><USER23> Folks here might not be aware that when you get food stamps the balance appears on your receipt after each purchase. Calling a balance checking app "fighting poverty" is very much a misrepresentation.

<comment><USER24> It's more than just checking your balance.

</comment></comment><comment><USER25> "A digital skin" sounds like they were scraping the big company's website, and they shut them down. That's hardly surprising.

<comment><USER26> It's an issue because the data in question should be open, as it's for a purely public service and is entirely funded by taxpayer dollars.

<comment><USER27> Sure, but to what extent should it be open? I'd imagine EBT balances count as "sensitive information" which should not be directly available to every single member of the general public; the general public should not need the ability to determine that I'm dependent on food stamps at all, let alone my exact EBT balance.

That would mean that some degree of access control is required, which in turn means that - short of implementing food stamps as a cryptocurrency - <USER2> would need to be a central authority delegating that access. That central authority, in this case, was (allegedly) experiencing a surge of traffic from some random startup; restricting that traffic is not an unreasonable response.

The article tries to convince the reader that "but think of the poor people!" is a legitimate excuse for unauthorized overloading of service. I ain't buying it, not for one bit.

<comment><USER26> The service was being used for exactly what the government was presumably paying Confluent to deliver -- the ability for EBT beneficiaries to see their balance. If Confluent can't deliver on serving customer data to customers, they have no business holding that contract.

</comment></comment></comment></comment><comment><USER28> Frankly, gov't programs should be fully open and transparent. If Conduent is "blocking" access then the gov't needs to step up and make them "play nice".

<comment><USER29> There should be some access provisions but if you aren't in the API business then Propel relying entirely on screen scraping (or equivalent) could be a problem. The article doesn't detail what technical discussions the two have had. I've seen enough poor capacity planning that I can easily imagine a new app causing issues depending how it is designed.

</comment></comment><comment><USER30> >In those states, where 60 percent of Propel's users live, Conduent maintains the database that Propel's app uses to let people check their accounts.

there's the problem. decentralize the database, i.e., take it out of the hands of a private entity. why do they control it anyways?

<comment><USER31> Because most governments abandoned their systems for administering these programs and outsource it to companies like Conduent nee Xerox. It doesn't save money, but it shifts risk to the vendor.

Once a vendor gets one of these contracts, they can repackage it for other states, or get acquired by a bigger company. They don't "own" the databases, but they end up controlling it and acquiring competitors. It is a many-billion dollar market.

<comment> GCU-Empiricist The hurdle of bringing "government data" back inside the government lifelines is one of the things large contractors can use to minimize the risk of the contractor being changed.

It's a non-trivial challenge as the government agencies seldom staffs up to the level of tech personnel required, and can't really afford to attract sufficient talent to automate without outsourcing the support contract.

Source: I've been adjacent to these efforts in the DOD/Mil sector with a military region BOSS (Base operations Support services) contractor in question.

<comment><USER32> Even small contractors do this.

I once worked on a range safety reporting application, with a budget of _4 hours per month_ for the developer maintenance. It was not by any means a big- money contract. But the site still had a database behind it, and I was given explicit instructions by management to _not_ give too much of _our_ data to the government customer at once.

It's almost like the company was trying to punish the government for not paying them more money. I really had a personal ethical struggle with that one, as I'm a citizen more than I am an employee, but the latter definitely pays better. In the end, I chose to _not_ slip a complete copy of the database onto a delivery CD, and the company shuttered the branch office and fired everyone working in it shortly thereafter. But then I did get to do some consulting work for the successor company as I was looking for a new "permanent" position, which allowed me to pay some bills while otherwise unemployed. Slight win for me, individually, but that government customer got screwed, mainly because a different government customer (that was paying a lot more per month) pulled their big contract and awarded the work to someone else.

As I walked out of the customer's office for the last time, the Army officer in charge of the program encouraged me to apply for open government technology positions, and I couldn't help thinking about what a bad deal that would be for me financially. It all boils down to limits on individual direct employee salaries, but no limits on what a contractor company may be paid for hiring exactly the same person to do exactly the same work. So the government can pay me $35/hour directly, or they can pay a company $200/hour, so they can indirectly pay me $50/hour. Oh, and they can then fire me at the drop of a hat. (This was before 18F, by the way.)

I have no idea how anyone justifies the argument that outsourcing essential government functions to private companies saves money. It's pants-on-head stupid. It exposes enough flesh for the parasitic military-industrial contractors to dig in their mouth-parts, and then never stop sucking out the blood.

It's the same for non-military privatized functions. The agency problem always gets in the way. People insert themselves into the system to become unmovable middlemen, and extract maximum value by standing between work and workers.

</comment></comment></comment></comment><comment><USER33> Wow, this is actually pretty strange. It feels as if the ability to query your own food stamp information should be free and publicly accessible. But the food stamp information is hosted on Conduent private servers that are getting a huge increase in requests due to Propel users.

Very strange, feels like the correct distinction between private and public is very messed up here.

</comment><comment><USER34> It's a slippery slope when you start profiting from misfortune. This company seems to be doing it right, for now. But it makes me wonder, if they're successful, will they be so symbiotic if something better tries to dislodge them in the future?

Seems to me, that a lot of these things start with good intentions and quickly become parasitic.

</comment><comment><USER35> I don't like when the title changes without apparent reason but, at least you could use a gramatically correct title.

</comment><comment> noir-york Propel is a feature, a digital skin over Conduent's data. If Propel really wanted to help poor people, it would help them go out to vote for candidates who want to fund social welfare and a higher minimum wage.

You would be forgiven for thinking that Propel, seeing the huge (in absolute terms) fed govt spend on programs, wanted a piece of that pie while draping itself in moral virtue. But that would be cynical...

<comment><USER36> Yep. They might want to detail their business model before making any moral claims.

</comment></comment><comment><USER37> I dont understand this? Why do you guys have foodstamps? Are you not one of the richest nations in the world?

<comment><USER12> You got downvoted, but here's what the UN Special Rapporteur on Extreme Poverty and Human Rights said about the US: [http://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?Ne...](http://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?NewsID=22533)

"3\. The United States is one of the world's richest, most powerful and technologically innovative countries; but neither its wealth nor its power nor its technology is being harnessed to address the situation in which 40 million people continue to live in poverty."

"6\. American exceptionalism was a constant theme in my conversations. But instead of realizing its founders' admirable commitments, today's United States has proved itself to be exceptional in far more problematic ways that are shockingly at odds with its immense wealth and its founding commitment to human rights. As a result, contrasts between private wealth and public squalor abound."

As an American I can't agree more.

<comment><USER37> I agree completely. Why discus some apps access to cardbalances, when the issue is actually, why do people, making the minimum wage (or similar), need foodstamps?

Here in Europe we had foodstamps during WW2.. but not since.

</comment></comment></comment><comment><AUTHOR> NB: Title edited for length & declickbaiting.

</comment><comment><USER38> The article makes it sound that Conduent has been in this business for years, but they started in Jan 2017? So how old is Propel?

It seems to me Propel saw an opportunity to make improvements using someone else's data. Both seem eager to help people in poverty but not so eager that they are willing to work out their issues or better, work together to meet their goals.

Neither company seems to be "wrong" or "right". Looks like more of a matter of pride and poor business.

</comment><comment><USER39> I mean... if you scrape someone's website and they block you, it's totally legit. This article is fairly biased in the way it portrays the situation.

Conduent isn't blocking Propel from "fighting poverty", they're just keeping them from scraping their sites and launching a competing product.

<comment><USER40> Hmmm... but unless I'm misunderstanding something here, Conduent "clients" are not voluntary "clients", and Conduent "product" is literally taxpayers' money, so there's a case for the data to be public and access regulated and open.

<comment><USER39> Ofcourse, and that's definitely a good case for them to fight over. However, as it stands, it's a lot like Amazon blocking scrapers from giving price recommendations.

</comment></comment></comment><comment><USER41> One of the most difficult things for any organization based on a political mandate or a cause is to plan for its dissolution.

One of the best examples I have seen of this is in Denmark where libraries are now renting out a lot of other things and setting up plays and culture nights to keep staying relevant.

</comment><comment><USER42> On iOS App Store, it's a free app. How does propel make money?

<comment><USER36> I would guess by selling out their customer's privacy, which seems to be the standard operating model.

<comment><USER43> "It does not store or sell users' personal information, the company said."

</comment></comment></comment><comment><USER44> Sounds like they are web scraping and got caught.

</comment><comment><USER45> The government gives food stamps to poor people (good). The stamps are replaced by an electronic debit card system (good). The government outsources the food stamp/debit card management to a private contractor, Conduent (not inherently bad in a capitalist society). Conduent make an app (good).

The startup, Propel, makes their own app, and uses the Conduent database through an API (good). Many users like Propel's app (good), and it becomes more popular than Conduent's app.

Conduent controls the database, and tries to block Propel from database access (rude, possibly anti-competitive). Their reasoning is that Propel are making too many API requests ("a capacity ambush"). Propel turns to mass media to defend themselves (rude, possibly libellous).

If I trusted the government, I'd recommend that they take back control of their database, and offer it as Open Data. In the meantime, I think Propel should scrape the data from Conduent and run their own servers so they're not vulnerable to API blocks. The Internet is great, but we can't always expect servers to keep working (for political reasons like this, or technical ones), and that's one reason I dislike the shift from the Digital Hub to Cloud Subscription business models.

<comment><USER46> Was it an public API, or scraping Conduent's website?

I'm not sure Conduent is really the "bad guy" here. The states should supply the API.

<comment><USER47> Looks like when they started out the drain was drawing some MB per day:

> "On average, users check their balances seven times a month")

Now that they have scaled, and added more content, making the app more attractive and visited more often, this may go up. And perhaps Conduent is the first who reacts on the jump on the requests ("capacity ambush").

Giving away one glass of water per day, for free, is acceptable.

Giving away 50 buckets of water per day is just to much to be free.

<comment><USER48> Isn't the better response to start charging for API access at that point? Not revoke access and go silent?

</comment></comment></comment></comment><comment><USER49> Rich ONLY get richer at the expense of others.

</comment><comment><USER50> Is it common that food stamp recipient can afford cell phone?

<comment><USER32> A cell phone is one of the highest utility-per-unit-cost items in existence.

They are so useful that a person could conceivably choose to keep a cell phone and phone service in preference to a permanent housing arrangement. You can sleep in a lot of different places, if you can respond to your e-mail, or pick up the call extending the job offer, wherever you happen to be.

<comment><USER27> As the saying goes: "You can sleep in your car, but you can't drive your house to work"</comment></comment></comment>


The JavaScript phenomenon is a mass psychosis - <AUTHOR> https://medium.com/@richardeng/the-javascript-phenomenon-is-a-mass-psychosis-57adebb09359 <comment><USER2> "I've been writing web applications for over a decade and it's utterly shocking how little JavaScript I know"

Well, glad to hear your opinions on something you know shockingly little about!

But it does highlight one thing that I think that people usually miss when they look for javascript alternatives: You still need to be experienced in making _web_ applications. Transpiling from Brainfuck or Idris or whatever doesn't get you away from the fact that you still have to deal with the DOM and you still need to worry about what happens when someone loads this in IE6 on Linux under Wine... cause that's your life now!

<comment><USER3> > _you still need to worry about what happens when someone loads this in IE6 > on Linux under Wine_

Do you? I work almost exclusively with government clients, who are notoriously slow to adopt anything. An application we are launching soon for external/public use is IE11/Edge only for IE users.

If you are using IE6 on Linux under Wine, you are making a choice to have a broken experience on the internet. Best of luck to you.

</comment></comment><comment><USER4> There are two kinds of languages: those people complain about and those nobody uses.

There is a bit of bandwagon effect here, sure but this is more due to the fact that JS is the only solution for the web and that the software development industry in contexts where JavaScript is seeing the most use is treated like an extended CS project instead of an engineering discipline.

That the former is important is because of the ship-first-build-quality-maybe mentality that has a hold of the industry. The latter is in part a reflection of this.

<comment><USER5> Not sure about that. With regards to Browsers, we are only given ONE language to work with, and that is JavaScript.

So there is no bandwagon effect, I think everyone is just trying to work with the language they are given.

But the fact that there are transpilers (Coffeescript, Typescript, Clojurescript, etc) means that people want to move away or improve JavaScript.

Now that WebAssembly is being worked on is a big relief. We now have options on what language we think would be best for the job.

<comment><USER4> Certainly, but all of these things are nascent or not adopted with sufficient volume to assert a de facto standard. In that sense I think "JS is the 'only' thing available for the front-end" isn't unfair.

As regards the backend, I don't think it's justifiable that anybody would actually choose JavaScript. There are far better, more stable options. The only reasons, as I see it, to choose JS for the backend are to cheap out on developer spend or to follow a fad. "Isomorphic development" falls in the one or both of these. Excellent, highly (Google) scalable products have been produced without that for two decades now. Asserting it is just, in my opinion, a way to mask one or both of the other reasons.

</comment></comment></comment><comment><USER6> Once you get over the fact that JS is basically a functional language where everything is given a false veneer of the object-oriented I'm not sure it's really all that bad. (Which isn't to say that it's good or elegant or isn't filled with badly named things.)

That said, I think the idea that full stack JS is somehow driven by designers or front-end people is mistaken.

I'm pretty sure many businesses find the idea of a "one language" stack appealing and figure it means they can hire less expensive employees. Likewise, I imagine quite a few individual developers hear the same thing and conclude that they could build an entire project with less complexity and some amount of code and library reuse between back and front end.

<comment><USER7> > Once you get over the fact that JS is basically a functional language where > everything is given a false veneer of the object-oriented I'm not sure it's > really all that bad.

I was going to point this out, too. I haven't written JS in an Object Oriented way in years, and couldn't be happier. Its a beautifully simple language that can do a lot if you approach it right.

</comment></comment><comment><USER8> WARNING: HYPERBOLIC CLICKBAIT. No substance, no informed critique or examples. The headline leads one to believe that there would be a thoughtful analysis, maybe pointing to some sociological research, that illustrates why javascript has gained so much popularity in recent years. Instead, it is a weak protest.

</comment><comment><USER9> A NSFW warning would have been nice. I'm lucky nobody was walking past my desk when I opened that...

</comment><comment><USER10> > JavaScript programmers have been mind-fucked into thinking that JavaScript > is a good programming language

In the same way that English-language speakers have been mind-fucked into thinking that English is a great language?

<comment><USER11> English has survived over a millenia and multiple attempts to remove it. English is a great language and pound for pound much better than JS will ever be.

</comment></comment><comment><USER12> > The language is so bad that the use of a linter (such as JSLint or ESLint) > is practically mandated for all JavaScript programmers.

Worth noting that many of the "better" programming languages strictly mandate the use of a compiler. In those languages, you don't even have the option of skipping the ahead-of-time code analysis step before running your code.

Of course, regardless of what language you use, if you're a professional software engineer, you probably should be running at least some sort of analysis tool on your code, whether it's a linter or typechecker or full compiler. I think when evaluating whether JavaScript is a "good language", you should evaluate it in the context of the tools that nearly all JS developers use. It certainly has issues, but a lot of the worst problems (e.g. coercion in `==` and accidental global assignment) can be and are checked by any reasonable lint config.

</comment><comment><USER13> I don't get what the beef with linters is. Linters are good to make all the code in a project look like it was written by one person.

</comment><comment><USER14> Yes, the JavaScript world has gotten quite complex. Yes, there are a lot of different flavors of JS these days. Yes, the language itself has quite a few warts.

Maybe try to realize that there are actual reasons to use it on the server side like isomorphic/universal rendering and code reuse. JS is one of the most accessible programming languages that exists, making it easy to find developers who are familiar with it.

As far as linters go, I don't get the hate. Almost all of the languages the article lists as alternatives recommend the use of linters. Several even have linters built-in.

Take your clickbait somewhere else, and get over your "I don't use JS" superiority complex.

</comment><comment><USER15> _Well, no. And it's worse, because at least before, we were screwing up small things with X, it was a toy. The thing is, there is a mass psychosis about X and it's like everybody is pretending that it isn't awful._

Instead of JS, you could just as well have C or C++ or Java in there. I've been in situations where I was working for the vendor of a language accused of being a toy.

 _What other modern programming language is so bad that a linter is most recommended for safety sake?_

The use of valgrind and the like has become _de rigeur_ for C. Linters and other software checkers have been a best practice across many languages for awhile. Don't get me wrong, I think Javascript is an example of bad language design. But the language is only one factor out of many. If you have a good _shop_ then it matters much less how good or bad your language is. If you have a good shop then you will have coding standards and tools which will run the linter as part of your integration/release process. If you have a good shop, then the more experienced coders can steer the new programmers away from the gotchas and towards the good parts of the language.

As project size, complexity, and age increase, a good shop with the worst language will outperform the worst shop with the best language. In the long term, a great language community with a mediocre language will outperform a great language with a language community riddled with group pathologies. Choice of language is one of those things that gets too much attention, where the experts know that other things actually matter more. (Just like more horsepower vs. better tires, or choice of golf clubs vs. practice time.)

</comment><comment><USER16> > What other modern programming language is so bad that a linter is most > recommended for safety sake?

Linters are just tools that emit warnings. In the case of JS, a language with multiple implementations and without a separate compilation step, it's good practice to have warnings be emitted by a dedicated tool. That way, no matter what browser you're testing on, you get the same comprehensive suite of diagnostics.

Needless to say, lots of languages have warnings.

</comment><comment><USER11> Not a good article, but I generally agree.

Using JS all over the place is stupid, it feels faddish and cliquey, and that you always have to keep up with the Jones'. I have been moving my career towards the back end, where the culture is a little more mature and stable. Y'all can have your 27000 framework world.

</comment><comment><USER17> For my job I do about 80% of my work in JS. I recognize that it's not a great language as far as design and ergonomics go. I also recognize that I shouldn't take these critiques personally - after all I'm just writing all this JS because someone is paying me to.

Even so, it wears on me to see the regular JS bashing on HN and other sources (even from more senior devs at my company). It makes me feel like a lesser engineer (which I already feel like being relatively inexperienced). And it just seems purposeless to me. Most of the people writing JS are just doing it because it's what we're paid to do. I know most of these critique aren't coming from a place of wanting to belittle JS devs, but that's the only effect I see them having.

<comment><USER18> Some programmers do get to choose what programming language they use. How should they discuss amongst themselves without making you feel belittled?

</comment></comment><comment><USER19> I wan't to buy this man a beer

</comment><comment><USER5> And this is why I use Dart. Not sure why everyone hates Dart, but after working with Dart for sometime, it makes me happy that I never get to touch JS, directly at least.

The tooling, libraries, in Dart is great. No need for jQuery, or other libraries, just use the language and focus on your product.

</comment><comment><USER20> I love JavaScript :-)

</comment><comment><USER21> I love C# but I can't use it with the ease of deploy that node.js has on only having a single executable.

.Net Core is getting there but it's still pretty new compared to the battle- tested Node.js

</comment><comment><USER22> I'm flagging because of the NSFW image. Is that kind of imagery necessary to get your point across?

<comment><USER23> You have made a small step for a better, naked women-free world.

</comment></comment><comment><USER24> JS is the new PHP! Yaay! :)

</comment><comment><USER25> Yuck.</comment>


Fabrik - A Visual Programming Environment From Apple (1988) - <AUTHOR> http://web.archive.org/web/20070927190552/http://users.ipa.net/~dwighth/smalltalk/Fabrik/Fabrik.html <comment><USER2> Nice reminder of how ahead of its time was Smalltalk and the stuff built on it. So much of what came after it seems so... primitive in comparison.

For those of you who are reading this and think Eclipse+Java and Visual Studio+C# are the most sophisticated development environments, grab a copy of Squeak by Example, download a copy of Squeak and play a little.

It will be enlightening.

</comment><comment><USER3> Before Fabrik was LabView (I see it referenced at the bottom), and that engine is underneath the Lego Mindstorms robot stuff. It is used in several industries today and continues to evolve. I am unaware of other modern graphical programming environments with quite the features and flexibility.

ni.com/labview

Sorta Disclaimer: I do not have anything to do with NI, but I did play with some toys that used this language and thought it was a cool approach to programming.

</comment><comment><USER4> i wonder if any of those authors/engineers were involved with Automator

</comment><comment><USER5> Interesting. Reminds me that I should look at Quartz more closely some time...

<comment><AUTHOR> Quartz composer?

Quartz composer is freaking awesome. I do a lot of video stuff as a hobby and always start out in QC before I move it to pure cocoa.

If you ever get really bored, try hooking up TouchOSC with QC using the OSC patches.

<comment><USER5> Yep, that's the one. I've only ever effectively glanced at it, but what I've seen I'm extremely impressed with. It's much more complete and functional than any other component-based programming environment I've ever seen.

Any suggestions on how / where to start, or any links you'd recommend? I see very little about QC online, so I'd be starting at square 1.

</comment></comment></comment><comment><USER6> I'd love to see a Fabrik-like environment for the iPad.

<comment><USER7> They killed it. C.f. [http://web.mit.edu/newsoffice/2010/3q-resnick- scratch-0428.h...](http://web.mit.edu/newsoffice/2010/3q-resnick- scratch-0428.html)

<comment><USER6> That was a viewer, not an editor.</comment></comment></comment>


Why Not Use Port Knocking? (2012) - <AUTHOR> http://bsdly.blogspot.com/2012/04/why-not-use-port-knocking.html

<comment><USER2> I have read that rather lengthy article and still didn't get the reason "why not?". From the article "The amount of information an attacker would need to get right, measured in number of bits or bytes is a fairly useful measure". So yes, port knocking means one need to know more bits in order to gain access. If some one got the message, could you please provide points "why not?"

<comment><USER3> From what I could gather, is that because most port knocking _examples_ use 3 port sequences, that boils down to 3 Unicode characters. Likening that to a password, I think he's saying putting a layer of security in front of SSH, protected only by a 3 character password, is not a great idea, and that he's seen _slow_ brute force attacks that seem to be able to overcome such things.

(Edit: For what it's worth, when I tried out knockd, it supported arbritrary port sequences, so you could easily have a 16 port sequence, making it as robust as you want. Timing however, was quite a pain. I had to use specific timeouts (relative to the RTT time from my network to my VPS), and manually enter each port in the sequence).

Personally, I've found that whitelisting IP's for SSH access, as well as a default block-all policy, disabled root login, and Key authentication have been enough to keep people out of my VPS.

Sure, seeing all of the denied traffic in the logs is annoying, but there's not much you can do about that (other than not log it).

<comment><USER4> Changing the port to something other than the default (even to something obvious like 22222) will get rid of all the log spam. You could also use something like fail2ban, but changing the port is much simpler.

<comment><USER3> oh yeah, sorry, I didn't mean to make it out like I was complaining. I log all blocked traffic, so I get data related to ports other than just SSH. I was more lamenting that people even _want_ to attack my VPS, as there's really nothing interesting about it.

<comment><USER4> It's not people, though. It's bots! While changing the ssh port adds a comically small amount of security (if any), it isolates you from 99.99% of automated attacks and keeps those logs clean, so I'd recommend it for everyone.

Just remember that the port argument to `scp` is -P and not -p like it is for `ssh`. :p

<comment><USER3> Yeah, I whitelist IPs, and just drop all other packets, so I'm not really worried, but thanks for the advice, it's always good to get other peoples opinions on best practices.

</comment></comment></comment></comment></comment></comment><comment><USER5> Here is a rebuttal to the "why not" argument:

[http://www.cipherdyne.org/blog/2013/10/port-knocking-why- you...](http://www.cipherdyne.org/blog/2013/10/port-knocking-why-you-should- give-it-another-look.html)

</comment><comment><USER6> I stopped using port knocking simply because it made remote access a hassle.

Scanning logs for intrusions and banning offending IP's deals approximately the same locus of issues that port knocking does.

Now if you absolutely must have deathly silence in your SSH logs, then only port knocking will do.

<comment><USER7> I use iptables to ratelimit ssh connections to 4 per 300 seconds per ip. I feel like that plus using a key provides a reasonable level of security while not being a pita.

Open question -- is there any reason this is a bad idea?

<comment><USER6> This is _all_ connections, even if every connection attempt from a given IP succeeds?

It's not a bad policy overall, but of course it interferes with a legitimate use: a script which rapidly executes numerous SSH commands.

<comment><USER7> yes, all connections

things like scp and rsync recycle connections across files though, so it hasn't been a problem in practice; ansible does too if you use openssh instead of paramiko

ps -- if someone knows iptables well, and is willing to share a similar script for failed connections, I would be grateful! But doing this across all ssh connections was easy enough that even I managed to get it working.

<comment><USER6> I'm talking about have a shell script like:

      while whatever ; do
        # hit host with a ssh command numerous times in loop
        ssh user@host command ...
        ...
      done

Banning more than X failed connection attempts from an IP in Y minutes is done with utilities like fail2ban, which wheedle that information from system logs.</comment></comment></comment></comment></comment>


Ask HN: Where to find artwork for landing page? - <AUTHOR>

Hey all,
Throwing up a landing page for something I've been working on. I'm wondering where all of you normally go for images & artwork to use on a landing page? Something like Shutterstock?
Suggestions appreciated, thanks! <comment><USER2> I've often found something suitable at iStockPhoto.com

If you have some budget for it, you might also consider having something custom done. I'm really fond of Duane Bibby's illustrations, for example (he did the illustrations for _The TeXBook_ , _The Little Schemer_ , etc.), and I've worked with him before.

</comment><comment><USER3> morguefile.com has pro photos for free</comment>


Big Companies Are Where Small Companies Go to Die - <AUTHOR> http://www.37signals.com/svn/posts/1197-big-companies-are-where-small-companies-go-to-die

<comment><USER2> Well, to be fair, they have taken that article and generalized it in a broader way, but based on what firsthand experience? Oh, right... firsthand experience reading the original article.

It's so funny that people can take one or two articles and use them to build a case -- kind of like when DHH found that some successful companies were not run by MBAs and declared that MBAs don't really add much value (paraphrased).

Here's the thing: The press prefers to report about things going wrong because that's what people like to read. For example, they'll report about people getting killed in traffic accidents, but they are unlikely to report on how many people didn't get killed on any given day. Should I therefore declare that people shouldn't drive cars and prove my point by linking to two articles about traffic accidents? I'd be laughed at, but then again, I'm not 37Signals.

I have firsthand experience with the type of acquisition they are writing about. The experience was amazing! The company worked really hard to make us feel like part of the family, brought their best people in to help us scale everything up (including putting one of their founders on the team), and they drove tons of traffic to our app. Their stock climbed-up 10x over the course of my time there (but cashing out is all about timing, unfortunately), and I now have a network of really great friends in the industry -- many of which are now running their own successful startups. Ouch, right? I really got burned.

I'm just _one_ datapoint but, IMHO, one firsthand datapoint is all it takes to prove that their sweeping generalization isn't really worth paying attention to in this case.

</comment><comment><USER3> Come on, folks...the story that this blurb points to is the _top rated_ story in the site right now. This article doesn't add anything to the discussion.</comment>


Github spamming... - <AUTHOR> http://github.com/repositories

<comment><USER2> I can't believe that they haven't got a captcha (or similar) anti bot system upon account creation. I these spammy days, it's a must. And even more for such popular website. Anyway I bet this will be fixed in the following days. Afaik, most captcha system are crackable, and if not, will be in the next few months/year. Google has been working on a new captcha system: [http://googleresearch.blogspot.com/2009/04/socially- adjusted...](http://googleresearch.blogspot.com/2009/04/socially-adjusted- captchas.html)

This is kind of old, I wonder how it has progressed.

<comment><USER3> As you noted, most captchas are crackable. This is the reason we have decided not to implement one. It's common thought that captchas reduce spam -- which they do -- but they do so by reducing total signups (human and robot).

Personally, I'd rather deal with spam in craftier ways than prevent legitimate people from signing up.

<comment><USER2> Thanks for replying. But I have a hard time understanding how filling a captcha can make people willing to signup run away.

Either you're offering a lightweight service with one single and simple functionnality (like instapaper.com for instance, which only requires a username for registration (not even a password !)); either you offer a multi purpuse service like github and if someone begins the registration process on a site like this and runs off because he doesn't want to fill a captcha.. maybe it's better he doesn't register after all.

Anyway what I really want to know is your numbers and how you got them :)

</comment></comment></comment><comment><USER4> The correct link is this : [http://github.com/ka891fqrxqn6au1/Download- Prophecy--Forsake...](http://github.com/ka891fqrxqn6au1/Download-Prophecy-- Forsaken--The-movie)

<comment><USER5> Well, at this exact moment, the two top entries are:

* Jane-Austen-Book-Club--The-dvd

* Download-Jane-Austen-Book-Club--The-movie

which works good enough as examples.

</comment></comment><comment><USER6> I don't really understand why you would have your bot spam a site that's dedicated to developers and software engineers.

<comment><USER7> one spams github because github.com has a high google page rank.

<comment><USER8> The project links are rel="nofollow", though. There really is no benefit to spamming it.

<comment><USER6> I thought that at first too, but then I picked apart the link. They are javascript redirects to another site that then forwards the traffic on to a referal system for another site. Also, I'm not totally sure every search engine completely honors rel='nofollow'

</comment></comment></comment></comment><comment><USER9> We're aware of the problem and sorry about the annoyance. It's a targeted attack, so normal solutions to prevent this aren't going to work. We'll figure it out, though.

edit: the spam listings should be gone within the hour.</comment>


Fed study finds US tariffs backfired - <AUTHOR> https://www.marketwatch.com/story/fed-study-finds-trump-tariffs-backfired-2019-12-27 <comment><USER2> People with business interests reliant on cheap foreign manufacturing desperate to have tariffs reversed. More news at 11.

</comment><comment><USER3> A Tax on something backfired?

The most frustrating thing is watching this pattern repeat itself thousands of times.

</comment><comment><USER4> Sure, tariffs are rough in the immediate if your business model is selling cheap Chinese steel to a dwindling middle class. You might even miss your quarterly numbers and donate to Mitt Romney. However, wage growth for the bottom 25% is at a decade high. [https://www.frbatlanta.org/chcs/wage-growth- tracker.aspx](https://www.frbatlanta.org/chcs/wage-growth-tracker.aspx) Trump won't be in office forever. Soon enough, you can sell us all out all over again.

<comment><USER5> Isn't the wage growth the result of a long period of high employment? Your comment makes it sound like it's the result of tariffs.

</comment></comment><comment><USER6> US policy is now driven purely by emotion, not logic or math.

The tax cuts briefly juiced growth, but not to the predicted 4% growth. Now growth is back down to 2%. Tariffs might be a contributor.

<comment><USER7> Yeah, but the tariffs only provoked any growth because companies rushed to stock up on supplies before the tariffs went into effect, anticipating that the coming price increase would decrease profitability and potentially destroy specific supply chains.

Tariffs can't produce any net growth, they can just juice short term growth at the expense of long term growth, and they can produce localized growth (ie for US steelmakers) at the expense of the broad domestic sector (ie all US manufacturers that use steel).

In general, tariffs are an own-goal. Trump had to implement new subsidies for US agricultural firms on the order of tens of billions of dollars annually (and has cost more than twice what Obama's big three automaker bailout cost) to prevent the collapse of US ag that lost a ton of export business because of the tariffs. If we could get China to stop stealing US intellectual property, perhaps the tariffs would be worthwhile, but there is a zero percent chance that will happen.

Tariffs are just bad economic policy.

<comment><USER8> Some agricultural subsidies were automatic and in place prior to recent tariffs. Tariffs are bad economic policy if you're trying to maximize global output, few rational actors try to do that.</comment></comment></comment>


Reddit Adds Image Thumbnails to Submissions - <AUTHOR> http://www.brentcsutoras.com/2008/07/12/reddit-adds-image-previews-to-submissions/ <comment><USER2> They just hate us OGs, don't they? Every change in the past year = suck</comment>


Ask HN: For SOPA proponents, what is wrong with DMCA? Why isn't it good enough?  - <AUTHOR>

Does any one know the details of why SOPA legislation is needed? What is it about the DMCA legislation that isn't enough to fight piracy?
I'm asking to better understand the underlying problem statement. We all keep talking about how SOPA will destroy the internet and that we need to stop it immediately. I think the best way to make that happen is to come up with an alternate solution that will improve the position of copyright holders without stifling innovation or leading towards a censored internet. I'm not talking about a compromise, I'm talking about genuinely trying to solve a problem.
To do that, we need to know what the problem is--beyond a vague statement of "piracy on the internet".
So, what is it about the DMCA legislation that they've already put through that isn't getting the job done? What are the failings of the legislation that prevent it from working? It would also be helpful to know not just how it's failing copyright holders but also consumers--since it seems as a whole we are generally against it too.
I'm sincerely asking, this isn't rhetorical or anything. I'm hoping anyone that is(has been) seriously following DMCA/SOPA/PROTECTIP can provide insight on. If there are actually supporters of SOPA here, or if not SOPA itself more legislation focused on digital content and piracy, what explicitly are they looking for. <comment><USER2> SOPA explicitly does not have the power to silence sites based in the US. This is because the DCMA already applies to those sites. So SOPA won't block facebook, or youtube, or google, or any other US based site. The problem occurs when a site isn't in the US. A rights holder can't send a DCMA takedown notice to The Pirate Bay for instance.

SOPA gives an alternative for rights holders when faced with a foreign site. They can ask for the site to be blocked at the DNS level by ISP's. They can prohibit any US based payment processor from paying the infringing site money. Rights holders can even ask search engines to block infringing sites.

Basically it stems from "As a rights holder, what can I do to prevent my work from being stolen internationally?" Some people in congress believe they have found a way to help rights holders in this position. Unfortunately there are some extremely serious mostly unintended consequences of these new powers.

<comment><AUTHOR> >Unfortunately there are some extremely serious mostly unintended consequences of these new powers.

Is this alone from poor wording of the legislation? Could these issues be addressed by simply reformulating the SOPA legislature? Or do these issues stem from how violations are determined, or how the process is implemented? Is there too much left up for loose interpretation?

<comment><USER2> In my opinion the issues stem mostly from how violations are determined. Basically in the current wording, a rightsholder would go to the US Department of Justice (I think) and put in a complaint stating that "website X has unauthorized copies of my work on their site." The DoJ and the rights holder would then go to a federal judge and say "here is our evidence." If the judge agreed with the DoJ and the Rights holder, they could issue a court order to ISP's, payment processors and search engines to block the site. The accused infringer is never given a chance to face their accuser or even know that they are under investigation.

<comment><AUTHOR> > The accused infringer is never given a chance to face their accuser or even > know that they are under investigation.

So, how about if the legislation required a DMCA adherence clause--that before a site could be taken down an official notice would need to be sent to administrative contact of the domain. If no official response is received in X days then the DOJ could issue a black listing. However, if the administrator does respond either by complying or by issuing a counter claim then the DOJ could not issue a black listing. The issue would have to be worked out the way DMCA conflicts are worked out. Now, should the initial DMCA take down notice be found to be legitimate and the site operator still does not comply in X days, then the DOJ may issue a black listing.

Would that resolve your concern?

<comment><USER2> What you describe would be orders of magnitude better than the current bill. That is how most court cases in the US today are run. I accuse you, the court issues a sopena for you (which you must receive), if you don't show up, you automatically lose the case. The problem then becomes, there is no way to internationally issue sopenas. The solution you gave was "if no official response is received in X days then ..." however a smart infringer could then sue for something along the lines of "our administrative contact was our (hosting company, private DNS listing company, at a non-existing building, made up, etc.), thus it never got to us" there is a way to write law to deal with all of these cases but it would not be easy to write for international dealings. (And I doubt anyone in congress understands how DNS records are listed enough to understand how to write it correctly)

</comment></comment></comment></comment></comment><comment><USER3> The DMCA doesn't apply outside the US. Given that US laws cannot be applied in other countries (but they are trying with ACTA), you need to block piracy at the border. ICE has been doing this with Operation In Our Sites, but SOPA attempts to streamline the process.

(Some copyright owners mistakenly or optimistically sent DMCA takedowns to The Pirate Bay, and TPB wrote hilarious ridiculing emails back.)

<comment><AUTHOR> Thanks for that information.

Just addressing SOPA from this angle, would SOPA legislation be okay if it only applied to domains that did not adhere to DMCA voluntarily or regulatorily? IE, SOPA wouldn't be capable of black listing any US site, because US sites have to adhere to DMCA. In addition to not applying to US based domains, what about for foreign domains if the site operator was contractually obligated to adhere to DMCA by a legal document that was under the jurisdiction of the domain registrant. Ie, say some European domain registrar offered its clients an opt-in option for sites. The opt-in legally obligated them (in the EU) to adhere to DMCA regulatory operation. Doing so would mean the domain could not be black listed by SOPA.

Obviously, it seems SOPA is much more that just what you said since Reddit operates inside the US, however the founder has indicated that with SOPA, it and similar sites would not be able to operate due to SOPA. So I'm just brain storming on this specific aspect of why DMCA isn't good enough.</comment></comment>