Ask HN: I got screwed and now im looking for a place to do my internship in. - <AUTHOR> My name is Simon, 23 years old and currently studying Applikationsutveckling(Software Development) in Malmö Sweden. Ive been studying this programme since the fall of 2009 and in October this year I get my degree. Lernia offers KY education(which in Sweden is like a university programme with 6 months of mandatory internship.
I had an internship at a Swedish company who promised me a paid internship. But now they are saying that they never promised me that, and I'm not going to take it so now I'm looking for a place to do my internship in London between 16april and 16 October as I'm tired of the Swedish weather and want to spread my wings a little.
Relevant work experience: I'm currently working as an tutor for the first year students and so far Ive had "Introduction To Computer Programming", "Introduction to Object Oriented Programming", "Algorithms and Datastructures" and "Introduction to databases".
The iPhone-app Hitta Pizza(http://itunes.apple.com/se/app/hitta-pizza/id387973084?mt=8)
Porting a ASP site to ASP.NET and redesigning the underlying database (www.tryckeriguiden.se)
Backup and Unix administrator at AstraZeneca.
*Driven an project at the Kosta Boda concern where a couple of hundred computers where to be replaced and I was in charge of the installation, distribution of software and integrating with the network.
So, if you know a company that's looking for an intern or your company is, do tell! I will be in the UK between the 24:th and 28:th March to meet up.
I can only work at places that offer paid internship as Im not currently able to survive without food, concert tickets and shelter. If you have a cure for that I would be glad to hear from you too!
A little about myself: I have been drawn to computers for literally as long as I can remember. When I was a child I played with the computer all the time and once a month they were forced to call in a guy to fix the computer after I deleted some files just to see what would happen, rearrange the windows folder, fiddled with the BIOS setup etc. etc. etc. etc. Finally my family got fed up and got a Windows 95 install CD and said "You fuck it, you fix it. Otherwise no allowance for you Mr!". That certainly did the trick on me as I was a huge candy addict, so I could say my computer career started as a 8 year old afraid to not get money for my junk!
Since then my computer interest grew and soon I found myself codig hideous websites with lots and lots of gifs, borrowing books about computers at the school library and spending all my allowance on computer magazines and copying example code from them and making small changes to see what would happen.
At the age of 15, broadband finally allowed me to download a Slackware iso. And boy did I get sold on this Linux stuff. Here was a operating system that run smother than Windows, made my friends think i was hacking someones computer when I mounted a cdrom and had all the programs and compilers I could ever want, free and available by a couple of key strokes. What more could you ask for?
But my life is not all about computers. I play electric guitar in a band and record a lot of stuff solo at home(math rock, prog rock, kraut rock´ish things, noise, ambient, electro) and I enjoy riding my fixie bike and skateboard.
On my spare time right now I'm building a computer from the awesome cource TECS(http://pramode.net/2011/01/03/the-most-amazing-cs-course-i-have-seen/), gathering information about fluid math to write a multi core water simulator and playing around with Pure Data.
Thanks for taking the time to read this long! Here is a nice tune for you :) http://vimeo.com/13279606
Edit: Here is my CV!
https://docs.google.com/document/d/1VTEr8XiySD4L7id6bGLdoTGx0hR7P10lTEGjzAT57BA/edit?hl=en&pli=1# <comment><USER2> Apply for Google Summer of Code.

It's not the most profitable option, as it pays "only" $5000 or so, but it's a great experience and looks incredibly good on your resume. And you can work from wherever you want, on whatever schedule you want.

(Disclosure: I've been a GSOC mentor for three years now, soon to be a fourth.)

<comment><USER3> He'd better make sure that his university accepts that as an internship first, or he might be unable to move on without the mandatory "traditional internship".

Depending on the university (Are they looking for tech experience? Experience "on a job"? Are they progressive thinking or conservative?) they might or might not accept that working on ~something~ during summer fulfills their requirement.

Except for that I totally agree with the advice.

</comment></comment><comment><USER4> You might want to elaborate on your skill set and what you hope to learn

<comment><USER5> And consider expanding your profile to point to github, your CV, or anything else where someone might be able to gauge your skills, interests, competencies, etc.

</comment></comment><comment><USER6> Why not just do more iPhone apps? Fund yourself that way?

Alternately, all the iPhone developer job ads in my country demand someone with an actual published iPhone ap, which you have, so you already have a leg up on the competition.

And if you turn up for an iPhone job looking like a dirty hippie (read as: artist type) that may actually work in your favour as it is expected :D

</comment><comment><USER7> I work at Softwire – we have a paid internship program in London. Details are here: <http://softwire.com/recruitment.htm>

It's a friendly and relaxed small company. We do software development and consultancy for other companies, so it's not a "startup" in the HN sense, but instead we get to write new software in a variety of languages and platforms for a different product every 3-6 months.

You can apply on our website if it takes your fancy. We're always looking for top class developers for internships and graduate positions.

</comment><comment><AUTHOR> Thank´s everyone for taking the time to read, post and spread!

I´m surprised how helpful you have been and how much attention this post generated. HN is truly a force to be reckoned with and I salute you all.

</comment><comment><USER8> Many years ago I did a CS degree as a 4 year "sandwich" course which involved 1 years industrial experience. My college had to pre-approve my choice of employer/employment and required regular reports (EDIT I know, I wrote one of them). I would be astonished if your college was any different and I strongly doubt that writing iPhone apps would suffice. I found that 1 year period the most valuable of my whole degree, choose wisely.

</comment><comment><USER9> In the UK paid internships are the norm for software developers, quite a few people are hiring, your best bet might just be to grab a list of UK startups and just go through their websites to see who's looking.

Most tend to advertise internships on twitter as well.

</comment><comment><USER10> Off the topic: I really recommend you to write your CV in Latex. it'll take some time, but looks much better than a MS-doc-look CV.

Some templates here: <http://www.cv-templates.info>

<comment><USER11> Also regarding the resume:

1) I'd separate "Languages" and "Computer skills" 2) A couple of English spelling/punctuation errors 3) Write something concrete like "started with Slackware in 200x" instead of "interested in computers for as long as I can remember" -- cliche, overused phrase.

Hope this helps.

</comment></comment><comment><USER12> Have you thought about freelancing? It's a bit scarier, the learning curve is much steeper, but ultimately I think it's a lot more fun and you learn a whole lot more than being pampered at some internship.

You also earn more.</comment>


Only Connect: on the automated telephone exchange - <AUTHOR> https://technicshistory.wordpress.com/2017/04/09/only-connect/ <comment><USER2> Start from the beginning of the story to get all the context. It's an interesting read:

[https://technicshistory.wordpress.com/2016/11/25/an- expediti...](https://technicshistory.wordpress.com/2016/11/25/an-expeditious- method-of-conveying-intelligence/)

And if you like this, I recommend _The Victorian Internet_ :

[https://tomstandage.wordpress.com/books/the-victorian- intern...](https://tomstandage.wordpress.com/books/the-victorian-internet/)

[https://www.amazon.com/dp/162040592X](https://www.amazon.com/dp/162040592X)</comment>


Ash HN: What are the best designed personal web sites? - <AUTHOR>

What are the best designed personal web sites? <comment><USER2> I love Frank Chimero's website:

[http://frankchimero.com/](http://frankchimero.com/)

<comment><USER3> I really love how clean and straight to the point this is.

</comment></comment><comment><USER4> I like

[http://www.syedrezaali.com/output/](http://www.syedrezaali.com/output/)

Nice showcase for his work, which is excellent as well.

[http://acko.net/](http://acko.net/)

Make sure to open some articles, especially the one on the website header (that's not an image).

[http://jwz.org/](http://jwz.org/)

One of the bastions of the older internet, started in 1993. Design of the main site is pretty polarizing.

</comment><comment><USER5> Good design is almost never memorable, unless it's sole purpose is to be aesthetically pleasing, like a painting.

</comment><comment><USER6> Mine, of course!</comment>


87% of SMBs suffered a cyberattack last year, only 44% see security as a prio. - <AUTHOR> http://nakedsecurity.sophos.com/2013/11/28/87-of-smbs-suffered-a-cyberattack-last-year-only-44-see-security-as-a-priority/

<comment><USER2> I would hazard a guess and say its actually much lower than 44. Security will never be a business priority to most types of business, especially the ever struggling smb market.

At least not until there is fines imposed for improper handling of user/ customer data.

Its a cost benefit thing plain and simple.

Edit further on that, take Sony for example, lose 500k ccs along with user data, they just played the victim card and psn players rallied in their defence. They had some extremely negligent security practices and not a single fuck was given. This, this is the role model smb's have to look up to.</comment>


Ask HN: How to dismantle Bot Networks and micro-ads which do political propaganda - <AUTHOR> Just read this piece
https://medium.com/join-scout/the-rise-of-the-weaponized-ai-propaganda-machine-86dac61668b
tldr: Bot Networks and Micro targeting are used to manipulate your opinions and spread propaganda 1-on-1
You wanna win an election in your home town or Country? Hire a few data analysts and run some bots and ads...
So my question is: What are ideas to stop / dismantle those propaganda activities from a technical point of view? <comment><AUTHOR> If we think about Twitter bots and Facebook fake profiles there might be an opportunity to automatically detect and flag those accounts. Would that Work?</comment>


The boring Front-end developer - <AUTHOR> http://thebfed.com

<comment><USER2> this is a duplicate of [https://news.ycombinator.com/item?id=9879172](https://news.ycombinator.com/item?id=9879172)</comment>


Facebook's Privacy Pivot - <AUTHOR> http://www.slate.com/articles/technology/future_tense/2014/07/facebook_s_privacy_pivot_mark_zuckerberg_s_plan_to_win_back_trust.single.html

<comment><USER2> Facebook thinks "Privacy" is controlling what your friends see.

Controlling what my friends see is the least of my concerns on Facebook.

<comment><USER3> So what is your real concern about Facebook?

<comment><USER4> Data mining his data to extrapolate what advertisers they can sell his data to, not excluding their quasi-partner (the NSA) who extrapolate whether his views are 'sheep' or 'wolf'. Wolves go on the 'potential terrorist' list.

</comment></comment></comment><comment><USER5> Obviously Facebook wants people to feel comfortable so that people will share as much as possible, even if it's within a closer circle. (Facebook is still recording everything about you, and might tap into more intimate info this way.)

What might be less apparent is that this is a great way to make a news feed more relevant to people. By having posters self-select who sees what, it reduces noise and make's Facebook job easier for determining what content is displayed in the feed.

</comment><comment><USER6> Still not sold on the idea of a company whose revenue source is targeted ads caring about their user's privacy. I think this is a good direction for Facebook to go, but to assume they now have the user's privacy at heart is probably too far. At best, they are controlling the user's data better so people not paying for ads don't get free information.

<comment><USER7> Funny that Facebook is citing the time when they used to have more privacy options. A bit late now. Business model changes would have a better chance of regaining lost trust.

</comment></comment><comment><USER8> Looks like slate bought right into some excellent PR that seeks to redefine "privacy" \-- moving concerns away from how FB uses all of the data it gathers, and instead into how it presents a subset of that data amongst its users.

<comment><USER3> It's not a definition from the "PR" \- it's the fundamental interpretation of privacy as a social construct. You being a very private person means your desire to share your personally identifiable information (PII) with other human beings is very narrow. It has very little to do with the entity that facilitates that sharing (i.e. Facebook). Privacy concerns about Facebook is essentially concerns about how (some) Facebook employees will look at and use your data (including sharing it with third parties) without permission. Since I very much doubt Facebook (or any ad-supported Internet company for that matter) is letting that happen, I have always felt that privacy concerns with Facebook as a whole is kind of silly. What people usually express outrage against (including myself) is that Facebook facilitates easy inter-user consumption of information that often breach the basic notion of privacy for many users. One prime example of that is the opt-out of default public sharing of posts.

<comment><USER8> You did say that privacy concerns are essentially concerns about how [FB] will look at and use the data. Which is actually my point as well - privacy is much broader than which of my friend and followers will see what I post. It is even broader than which third party apps have what access to my account -- yet the article makes it seem like those things are the only privacy concern instead of just a subset of it.

Agreed they won't share your information with third parties or use it themselves without permission - but they myriad of ways in which they ask for that permission, and in which you default to giving it means it serves only as the loosest constraint. By default users allow them to perform analytics that reveal a disturbing amount of information about them, among many other things.

Similarly, I think the notion of privacy in which data you share is quite silly - if you're sharing stuff on the Internet, you should expect it to be public for all time. No matter who you're sharing it with or through. However, I would also expect the company I'm sharing _through_ to act only as a middle- man, and not use my data for its own ends*. (That seems to be a different take on the silly angle that you have. )

</comment></comment></comment><comment><USER9> Fear Uncertainty Doubt

In the beginning, Facebook was, to some extent, private. I'm thinking back to the days when they were rolled out college by college. Even after then, mostly people of a certain generation were on FB.

Since then, their reach has gone global and it reached the late adopters: parent, grandparents, uncles and aunts. As that circle became larger, Facebook felt less private.

What the article seems to have missed is that the popularity around other sharing models is actually relatively new. 1-1 messaging, at least on mobile, really only got huge within the last 2-4 years. How old is Snapchat? < 3 years? And it's been mainstream-ish for less than that. Secret, Whisper, Kik... all of these apps with different sharing models are a pretty recent phenomenon.

It seems pretty silly to call this an "about face" considering the span of time considered. Opinions always evolve over time. Look at Steve Jobs: Famously known for saying that Apple would "never" make a tablet smaller than the original iPad. Lo and behold, they did.

Products and the philosophy around them change over time, especially in an area like tech which is quick moving and ever-changing.</comment>


Parsing JSON is a Minefield - <AUTHOR> http://seriot.ch/parsing_json.php <comment><USER2> Well, first and most obviously, if you are thinking of rolling your own JSON parser, stop and seek medical attention.

Secondly, assume that parsing your input will crash, so catch the error and have your application fail gracefully.

This is the number one security issue I encounter in "security audited" PHP. (The second being the "==" vs. "===" debacle that is PHP comparison.)

As one example, consider what happens when the code opens a session, sets the session username, then parses some input JSON before the password is evaluated. Crashing the script at the json_decode() fails with the session open, so the attacker can log in as anyone.

Third, parsing everything is a minefield, including HTML. We as a community invest a lot of collective effort in improving those parsers, but this article does serve as a useful reminder of a lot of the infrastructure we take for granted.

Takeaways: Don't parse JSON yourself, and don't let calls to the parsing functions fail silently.

<comment><USER3> A parser should never crash on bad input. If it does, that's a serious bug that needs immediate attention, since that's at least a DoS vulnerability and quite likely something that could result in remote code execution. You definitely need to assume that the parser could _fail_ , but that's different. Unless you're using "crash" in some way I'm not familiar with?

<comment><USER4> What about raise an exception?

<comment><USER5> Exceptions should only be used for exceptional cases. For a parser, bad input should be expected.

<comment><USER6> You say that as fact but you must know it is a matter of opinion: I would say you should match the language idioms. For example, Python iterators and generators work by raising/throwing when there are no more items: it is fully expected and will always happen when you write a for-in loop.

<comment><USER7> That seems like bad design. Rust iterators return an Option<T>, for example.

<comment><USER8> In Python a lot of flow control uses exceptions as it's cheaper to ask for forgiveness rather than permission and then still have to deal with errors.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> > In conclusion, JSON is not a data format you can rely on blindly.

That was definitely not my take-away from the article. More like "JSON is not a data format you can rely on blindly if you are using an esoteric edge-case and/or an alpha-stage parsing library." I haven't ever run into a single JSON issue that wasn't due to my own fat fingers or trying to serialize data that would have been better suited to something like BSON.

<comment><USER10> You are not considering a hostile environment like the internet where an attacker will use edge cases to get unforeseen results.

<comment><USER9> I couldn't really care less if someone POSTs some garbage JSON that results in them getting a 500 response. Better than someone POSTing an XML bomb and affecting other peoples' requests. Please enlighten me if you know of a serialization format with libraries for all common languages that lacks any gotchas or edge cases.

<comment><USER11> All software has edges, so edge cases are unavoidable.

The best you can do is:

\- interpret the spec to the letter.

\- for every fragment of a statement you write, consider whether it might conceivably go wrong, and handle those cases (in the simplest matter because 'handling' means writing code, and that code, too, needs to go through this process).

For example, a json parser must be prepared to handle missing values, extremely long keys and values (integers may have thousands of digits, think long about the question whether 64 bits always is enough for storing a string length, etc.), etc.

\- if you are truly paranoid, have very stringent security requirements, or expect to be heavily attacked, run the parser in a separate process.

\- fuzz your implementation.

<comment><USER12> > think long about the question whether 64 bits always is enough for storing a > string length, etc.), etc.

I'm struggling to think of any realistic scenario where this isn't true!

<comment><USER11> So do I, but you should still consciously decide whether to add an overflow check.

Let's do a quick estimate: one can read in the order of 2^24 bytes/second from disk. A day has on the order of 2^16 seconds, so that's 2^40 bytes/day.

=> You will need 2^24 days to read 2^64 bytes. I think that's around 50k years. That an attacker will try to generate a buffer overflow this way is a risk I would take, even if I thought the hardware had room to store that string.

The only way I can foresee a real risk is when an optimizer can optimize away the computation of a string whose length it is asked to compute by an attacker.

That's still very much far-fetched, and if no string gets allocated it's hard to see how it could become a security issue, but it could be a reason to be extra careful, for example when providing online access to a C++ compiler, with its template metaprogramming capabilities.

</comment></comment></comment></comment></comment></comment><comment><USER13> Figures that something like this would be posted on my day off. I put this through a parser that I cover, and found that the only failures were for top- level scalars, which we don't support, and for things we accept that we shouldn't. I'll look through the latter tomorrow, as well as the optional "i_" tests.

Test suites are a huge value add for a standard, so thank you, Nicolas, for researching and creating this one. I was surprised that JSON_checker failed some of the tests. I use its test suite too.

</comment><comment><USER14> The correct answer to parsing JSON is... don't. We experimented last hackday with building Netflix on TVs without using JSON serialization (Netflix is very heavy on JSON payloads) by packing the bytes by hand to get a sense of how much the "easy to read" abstraction was costing us, and the results were staggering. On low end hardware, performance was visibly better, and data access was lightening fast.

Michael Paulson, a member of the team, just gave a talk about how to use flatbuffers to accomplish the same sort of thing ("JSOFF: A World Without JSON"), linked in this thread: [https://news.ycombinator.com/item?id=12799904](https://news.ycombinator.com/item?id=12799904)

<comment><USER15> Not sure what your point is (or the point of that presentation, for that matter).

Of course there are binary serialization formats that are faster than XML or JSON, and of course they're less error-prone. This has been known for about 40 years now.

JSON/XML are used precisely _because_ people want a human-readable interchange format. For high-performance uses, consider Google's Protocol Buffers or Boost::serialize. You're acting like you just hackathoned the biggest thing since sliced bread, but that's exactly how payloads have been sent (until high-bandwidth made us all lazy) since the inception of the Internet.

<comment><USER16> From experience, I think the whole "human-readable" idea is a bit overrated. All it means is that the format is entirely/mostly in ASCII. But if you have a hex editor, like all good programmers should, binary formats are not any less human-readable (or writable) nor more difficult to work with; and for some, even a text editor with CP437 or some other distinctive SBCS will suffice after a while. It's somewhat like learning a language; and if you are the one developing the format, it's a language that you create.

Then again, I grew up working with computers at a time when writing entire apps in Asm/machine language was pretty normal as well as other things which would be considered horribly impossible by many developers of the newer generation, and can mentally assemble/disassemble x86 to/from ASCII, so my perspective may be skewed... just a tiny little bit. ;-)

<comment><USER17> But the phrase is "human-readable" and not "programmer-readable".

<comment><USER18> A minor gripe with your comment, but as a programmer conceivably must be human, both conditions are satisfied when a programmer is capable of reading it.

</comment></comment></comment></comment></comment><comment><USER19> Wow! This was a great practical analysis of existing implementations, besides a great technical overview of the spec(s). Thanks for open sourcing the analysis code[1], and for the extended results[2]

[1] [https://github.com/nst/JSONTestSuite](https://github.com/nst/JSONTestSuite)

[2] [http://seriot.ch/json/parsing.html](http://seriot.ch/json/parsing.html)

</comment><comment><USER20> I did write my own parser, but for a reason: I need it to be able to recover as much data as possible from a damaged, malformed, or incomplete file.

Turns out that a good chunk of these tests are for somewhat malformed, but not impossible to reason about files. Extra commas, unescaped characters, leading zeroes... I'd rather just accept those kinds of things rather than throw an error in the user's face. It's a big bad world out there, and data is by definition corrupt.

And this is borne out when I plug my parser into this test suite: Many, many yellow results, which is exactly how I want it.

</comment><comment><USER21> Lots of issues are trivially answered.

\---

> Scalars..In practice, many popular parsers do still implement RFC 4627 and > won't parse lonely values.

Right. RFC 7159 expanded the definition of a JSON text.

> A JSON text is a serialized value. Note that certain previous specifications > of JSON constrained a JSON text to be an object or an array.

If RFC 7159 wasn't different from 4627, there'd be no reason for 7159. Same with RFC 1945 and 7230 for HTTP. (Of course, HTTP is versioned...maybe he just means to repeat the earlier versioning criticism.)

\---

> it is unclear to me whether parsers are allowed to raise errors when they > meet extreme values such 1e9999 or 0.0000000000000000000000000000001

And then quotes the relevant part of the RFC 7159 grammar with answers the question:

> This specification allows implementations to set limits on the range and > precision of numbers accepted. Since software that implements IEEE 754-2008 > binary64 (double precision) numbers [IEEE754] is generally available and > widely used, good interoperability can be achieved by implementations that > expect no more precision or range than these provide, in the sense that > implementations will approximate JSON numbers within the expected precision. > A JSON number such as 1E400 or 3.141592653589793238462643383279 may indicate > potential interoperability problems, since it suggests that the software > that created it expects receiving software to have greater capabilities for > numeric magnitude and precision than is widely available.

Parsers may limit this however they like. And so may serializers. This includes yielding errors. (Though approximating the nearest possible 64-bit double is IMO the better choice.)

\---

So yeah, in the end there is fair amount of flexibility in standard JSON.

To summarize:

> An implementation may set limits on the size of texts that it accepts.

> An implementation may set limits on the maximum depth of nesting. [this one > was never mentioned though]

> An implementation may set limits on the range and precision of numbers.

> An implementation may set limits on the length and character contents of > strings.

Most implementations on 32-bit platforms will not parse 5GB JSON texts.

</comment><comment><USER22> What ever happened with EDN (pronounced "eden") from the Clojure people? [https://clojure.github.io/clojure/clojure.edn- api.html](https://clojure.github.io/clojure/clojure.edn-api.html) [https://github.com/edn-format/edn](https://github.com/edn-format/edn)

I always thought that seemed like a nice alternative data format to JSON. Anyone using this it in the wild?

<comment><USER23> Clojure programmers use it everywhere. I suspect almost nobody else does though.

<comment><USER24> Even if you're a clojure shop, you've got the issue that at your system boundary, everything else the world accepts json and/or XML, and nothing supports EDN/transit. So your data needs to be serialisable to one of those anyway, at least if it crosses the boundary. There is such a thing as a network effect, even in data serialisation formats...

</comment></comment></comment><comment><USER25> An informative article. The point is not that parsing JSON is "hard" in any sense of the word. It's that it's underspecified, which leads to parsers disagreeing.

Although the syntax of JSON is simple and well-specced:

* The _semantics_ are not fully specified

* There are multiple specs (which is a problem even if they are 99% equivalent)

* Some of the specs are needlessly ambiguous in edge cases

* Some parsers are needlessly lenient or support extensions

</comment><comment><USER26> There was a great article at some point that explained why 'be liberal in what you accept' is a very bad engineering practice in certain circumstances, such as setting a standard, because it causes users to be confused and annoyed when a value accepted by system A is subsequently not accepted by supposedly compatible system B. Leading to pointless discussions about what the spec 'intended' and subtle incompatibility. Anyone know what article I mean?

<comment><USER27> Perhaps "The Harmful Consequences of Postel's Maxim"?:

[https://news.ycombinator.com/item?id=9824638](https://news.ycombinator.com/item?id=9824638)

If not, perhaps one of these:

[http://programmingisterrible.com/post/42215715657/postels- pr...](http://programmingisterrible.com/post/42215715657/postels-principle-is- a-bad-idea)

[https://bitworking.org/news/There_are_no_exceptions_to_Poste...](https://bitworking.org/news/There_are_no_exceptions_to_Postel_s_Law_)

[http://trevorjim.com/postels-law-is-not-for- you/](http://trevorjim.com/postels-law-is-not-for-you/)

<comment><USER26> Yes, thank you, it was the one by 'programmingisterrible' and the linked paper by Patterson, Sassaman, and Bratus.

</comment></comment></comment><comment><USER28> "NaN and Infinity"

Yeah. And I learned this the hard way with the Perl module JSON::XS. It successfully encodes a Perl NaN, but its decoder will choke on that JSON. (Reported it to the maintainer who insists that is consistent with the documentation and wouldn't fix it)

<comment><USER29> Similarly, Python's encoder violates the JSON specification by default, as it produces `Infinity`, `NaN` and `-NaN`, which other JSON parsers choke on.

<comment><USER30> I don't get it. Why would unaware JSON parsers choke on `Infinitiy`, `NaN` or `-Nan`? JSON has no concept of schema.

So if a parser sees "Inifinity", which it doesn't have any concept of, why would it do anything except treating that as string of a word "Infinity"?

<comment><USER31> Because it's not quoted like a string, it's a literal

</comment></comment></comment></comment><comment><USER32> If JSON is comparable to minefield, then I guess XML and ASN.1 are nothing short of nuclear Armageddon in complexity and ones ability to shoot themselves into the leg ;-)

<comment><USER33> Also, as someone who has written an XML parser, according to some of the comments in this threads I'm way beyond medical help, and should give up on life :).

<comment><USER34> Depends on when you did this crazy thing. Was it in the dark days before they were "ubiquitous"? (for lack of a better word. also it's just a fun word)

Then you're a hero to those who made use of it.

If someone were to do that today, though, then yes, seek help.

;)

</comment></comment></comment><comment><USER35> I still love JSON regardless :) Client / server side languages have first class support for serialization and in most cases the data structures are rather easy.

I'd be very skeptical if one would suggest an alternative format for a web based project, however I can imagine such situations.

</comment><comment><USER36> > In conclusion, JSON is not a data format you can rely on blindly.

What does HN suggest for configuration files (to be written by a human essentially)?

I am looking at YAML and TOML. My experience with JSON based config files was horrible.

<comment><USER37> Funnily enough, as I've been experimenting with Chef and trying to stick to JSON config files where allowed, I was again struck that (a) it's not a good choice for config files (b) it's an OK choice though (c) lots of people are using it anyway (d) nearly everyone that does so (including Chef) allows comments, so in reality are not actually using JSON at all.

Point (d) is the important one. I really think we need a standard for json- with-comments. JSONC or whatever, but it should have a different standard filename and it should have an RFC dictating what is and isn't allowed. Personally I would allow only // comments because there are too many subtle issues with C-style comments, but it may be too late to agree on that.

Half the point of JSON is that if application A stores its data as JSON then application B can parse that without any nasty surprises. Except, there are now probably thousands of noncompliant implementations in the wild that only exist because the standard doesn't allow comments. Each one of those standards adds subtle differences (in addition to the comments themselves) depending largely on how they remove the comments before passing to the standards- compliant JSON parser (assuming they do that, which being DC's recommended approach, is as close to a standard as currently exists).

<comment><USER38> _> (b) it's an OK choice though_

I really think it's not an OK choice. A config file format that doesn't allow comments provides some of the worst possible UX.

One of the nice things about config files is that normally they are self- documenting, explaining the meaning of the various directives and providing possible values.

Without comments, you have to constantly switch between the documentation and the config file.

Also, the restriction on trailing commas is another really bad issue for a config file language as it pollutes diffs, makes moving lines around needlessly difficult and is one more landmine waiting to happen for the sysadmin editing a file.

No. JSON not at all OK as a config file language.

<comment><USER39> How does json "not support comments"?

{"comment":"default values for this object"}

<comment><USER38> Since when is in-band signalling a good idea? What if one of your configuration keys is named "comment"?

<comment><USER39> {"notes to self":["Don't edit config files by hand","use a decent hierarchy"]}

//Http://jsoneditoronline.org

<comment><USER40> You could even write comments as a linear RSS feed of nested OPML outlines, by converting all that XML to JSON.

[http://convertjson.com/xml-to-json.htm](http://convertjson.com/xml-to- json.htm)

<comment><USER39> Yep, I went through the process of replacing all our XML objects into json ones about 6 years ago now. Smaller files and much easier to read, manipulate store and transfer.

And while I personally quite liked XSLT, javascript is a much more flexible and reliable option.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER41> The page has been taken down for some reason (getting a 403).

Google cache: [http://webcache.googleusercontent.com/search?q=cache:8jVuBmx...](http://webcache.googleusercontent.com/search?q=cache:8jVuBmxKEkQJ:seriot.ch/parsing_json.php)

<comment><USER42> Works for me.

Edit: But you are not alone. Elsewhere in the thread: [https://news.ycombinator.com/item?id=12797032](https://news.ycombinator.com/item?id=12797032)

<comment><USER41> Yep, looks like it was down only for a few minutes.

</comment></comment></comment><comment><USER43> Now the mess that is called JavaScript dates has crept into any system imaginable in the world. I can understand we needed to go for the lowest denominator but Crockford's card really could cram in another line with a date time string format.

<comment><USER44> I think adding a date type would have probably doubled the complexity of JSON and taken it right out of the sweet spot that has made it popular.

<comment><USER45> This. Datetime is hard, because RFC 3339 is underspecified [1], and TOML wrestled with this a lot.

[1] [https://news.ycombinator.com/item?id=12364393#12364805](https://news.ycombinator.com/item?id=12364393#12364805)

</comment></comment></comment><comment><USER46> Speaking as someone who wrote a JSON parser, this article and the accompanying test suite looks to be very valuable, and I will be adding this test suite to my parser's tests shortly.

That said, since my parser is a pure-Swift parser, I'm kind of bummed that the author didn't include it already, but instead chose to include an apparently buggy parser by Big Nerd Ranch instead. My parser is [https://github.com/postmates/PMJSON](https://github.com/postmates/PMJSON)

</comment><comment><USER47> tl;dr JSON with a bunch of shitty extensions is awful. The error handling among JSON parsers is inconsistent.

</comment><comment><USER48> When I didn't know better, I wrote my own JSON parser for Java (it was years back and I didn't know about java libraries). From experience: DON'T. DO. IT.

That said, if you have decided to do it....

1) know fully well that it'll fail and build it with that assumption.

2) Please, please, please...give useful error messages when it does fail or you'd be spending way too much time over something simple.

</comment><comment><USER49> By sheer randomness I was having the thought about it today: I made some code to highlight where the stdlib json module sees the mistakes in JSON decoding in the python stdlib.

I used the exception with string "blabal at line x, col y, char(c - d)" to actually highlight (ANSI colors) WHERE the mistake were.

[https://gist.github.com/jul/406da833d99e545085dac2f368a3b850...](https://gist.github.com/jul/406da833d99e545085dac2f368a3b850#file- test-png)

I played a tad with it, and the highlighted area for missing separators, unfinished string, lack of identifier were making no sense. I thought I was having a bug. Checked and re-checked. But, No.

I made this tool because, whatever the linters are I was always wondering why I was not able to edit or validate json (especially one generated by tools coded by idiots) easily.

I thought I was stupid thinking json were complex.

Thanks.

</comment><comment><USER50> Writing parsers is hard and takes some experience, but its not as hard or as impossible as most of these comments make out. JSON is retarted simple to parse, even in the face of certain edge case ambiguities.

I can say this from experience after having written an HTML/XML parser that provides support for various template schemes: Twig, Elm, Handlebars, ERB, Apache Velocity, JSP, Freemarker, and many more. I have written a JavaScript parser that supports React JSX, JSON, TypeScript, C#, Java, and many more things.

In years I have been programming I frequently hear whining like, "its too hard". Don't care. While you are wasting oxygen crying about how hard life is somebody else will roll a solution you will ultimately consume.

<comment><USER51> where are all these goodies you boast about then ?

<comment><USER50> [http://prettydiff.com/](http://prettydiff.com/)

</comment></comment></comment><comment><USER52> when parsing human constructed JSON, use JSON5 for the win.

[http://json5.org/](http://json5.org/)

</comment><comment><USER10> The important lessen is that you can't blindly rely on your JSON parser to save your ass when you are dealing with untrusted input.

If sending 1000 "["s will crash your application, you have a problem.

I hope the JSON parser authors will improve their parsers.

</comment><comment><USER53> This is fantastic. However, it looks like the detailed conclusion is "exactly matching the RFC is a minefield".

About a month ago (for the third time, since I don't own the first two implementations) I made a very forgiving (and very error-unprotected) JSON parser: [https://github.com/narfanator/maptionary](https://github.com/narfanator/maptionary)

The core of JSON parsing, from that experience, seems really simple; it's catching all the edge cases that's hard.

In any event, I look forward to taking the time to test against this test suite!

</comment><comment><USER54> People tend to screw up the unicode aspects more than the general parsing. And, indeed, the example JSON parser provided checks for a UTF-8 byte order mark, but doesn't validate that the data is valid UTF-8, so it will let through strings that might cause an application problems.

Although there is a commented out method to validate a code point, so I guess he understood that it was an issue.

</comment><comment><USER55> Fixes for many of the issues raised by this post have since made it into crystal master: [https://github.com/crystal- lang/crystal/commit/7eb738f550818...](https://github.com/crystal- lang/crystal/commit/7eb738f550818825786e90389ac84d2a2eb13e13)

<comment><USER56> I love how quickly things move in crystal right now.

</comment></comment><comment><USER53> Do you have an explanation anywhere of why each (or any) of the edge cases is supposed to succeed or fail, or why it commonly does what it's not supposed to do?

I realize that's almost as much work as writing each test case in the first place, but even a subset of the test cases having that explanation would be valuable.

</comment><comment><USER57> Crap like this is why people should just use older ones that work. Some of the issues I see in the comments weren't present in Sun's XDR:

[https://tools.ietf.org/html/rfc4506](https://tools.ietf.org/html/rfc4506)

Or even LISP s-expressions if you want organized text.

</comment><comment><USER58> In practice, people use increasingly smaller subsets of JavaScript to transmit data.

For example, a common pattern is to transmit (numeric) user IDs as strings so that they don't get mangled by floating-point precision issues with large numbers. You see both Twitter and Facebook APIs do this, for example.

<comment><USER59> I've read that you should treat IDs as strings anyway because you want to discourage incrementing IDs, adding IDs together etc. Anything else you want to do with integer IDs, e.g. comparing, can be done with sting IDs as well.

</comment></comment><comment><USER60> Anyone else seeing forbidden?

Forbidden

You don't have permission to access to this document on this server.

<comment><USER61> yes, same here

<comment><USER42> You are not the only ones, but it works for me. Google cache link is posted elsewhere in the thread: [https://news.ycombinator.com/item?id=12797047](https://news.ycombinator.com/item?id=12797047)

</comment></comment></comment><comment> vhost- You definitely can't rely on it. Just the other day I was given a task to take a request payload from our front end and do some stuff with it on our backend. The payload looked like this: {"thing": [{"values": ["foobar"], "type": "blah blah"}, "some identifier"], "other thing": "some string"}. It's mixing types in arrays which is problematic for most statically types languages.

Tips for Go: Don't use map[string]interface{} and circumvent the type system (I've seen this a lot in production). The fix involves the UnmarshalJSON and MarshalJSON interfaces. This lets you put the data into a structure that's sane and re-encode it back to something the other system expects.

</comment><comment><USER62> > it won't parse u-escaped invalid codepoints: ["\ud800"]

How is this not expected behaviour?

The string is not well-formed.

Same thing with decent XML parsers. They croak when you give them invalid codepoints.

</comment><comment><USER63> Crockford needs to write "JSON, The Good Parts."

<comment><USER64> No he doesn't. "JSON, the good parts" is just JSON. The problems the post is describing have to do with RFC 7159 allowed extensions.

</comment></comment><comment><USER65> So what's the alternative? If you had a time machine and went back in time, what would you recommend/bring as an alternative to JSON?

</comment><comment><USER66> Am I wrong in seeing that PHP seems to fail the least weirdly in the full results?

<comment><USER29> It's more complicated in practice. Prior to PHP 7.0, the official JSON extension was replaced with a completely different one in many distributions due to licensing issues, and since PHP 7.0, PHP's official JSON extension is yet another completely different implementation.

</comment></comment><comment><USER67> One of the biggest flaws of JSON is that it doesn't support "undefined". This makes translating Javascript structures to and from JSON actually not preserve the original value. Sigh.

<comment><USER68> But undefined is specific to Javascript… there are lots of other Javascript things that JSON doesn't handle either, like Set or Map objects. It's not intended to serialize arbibtrary JS objects — it's intended to serialize a useful least-common-denominator which has proven useful through experience.

</comment></comment><comment><USER69> JSON = require('json5')

And you can even use comments!! (no comment)

// [http://json5.org/](http://json5.org/)

</comment><comment><USER70> unless for fun, rolling your own json parser is like writing bubble sort for use in your prod app.

</comment><comment><USER71> it is an improvement but when i am in these situations i usually grab the first library out there.

</comment><comment><USER72> this is kind of a vulnerability developers wet dream, especially that graph...

</comment><comment><USER73> There are alternatives to JSON that are OS, available in many languages, actively supported, and both CPU and memory efficient.

FlatBuffers & Netflix [https://www.youtube.com/watch?v=K_AfmRc- TLE&feature=youtu.be...](https://www.youtube.com/watch?v=K_AfmRc- TLE&feature=youtu.be&t=21m30s)

</comment><comment><USER74> Bad thing to read when I'm writing a sass to json module

<comment><USER42> The encoding takeaway seems simple: escape everything with \uxxxx characters that is outside of the ASCII range /[ -~]/ (regex) and you'll be pretty much fine. Set the encoder to utf-8, don't leave [dangling,commas,], and a few other things that are obvious from json.org.

<comment><USER44> Escaping everything outside of ASCII is terribly human-unfriendly and wasteful in bytes as well.

</comment></comment></comment><comment><USER75> Oh boy this is another one of those threads..

Party A: X is harder than it looks

Party B: X isn't as hard as you're making it look

Boring.

</comment><comment><USER76> Wrote my own JSON parser ([https://github.com/MJPA/SimpleJSON](https://github.com/MJPA/SimpleJSON)) a while ago... not sure how it's a minefield unless I'm missing something?

<comment><USER13> Perhaps you'd be interested to know that your JSONDemo program fails the following tests:

hang:

y_number_huge_exp.json

segfault:

n_structure_100000_opening_arrays.json

n_structure_open_array_object.json

fail:

n_number_then_00.json

n_string_unescaped_tab.json

n_structure_capitalized_True.json

<comment><USER76> I would :)

Was going to run the tests myself later but needed a box with python3 on it!

</comment></comment></comment><comment><USER77>
        JSON is the de facto standard when it comes to (un)serialising and exchanging data in web and mobile programming.

I disagree. Take protobuf for example. You get schemas, data structures, and a parser in one package which is actually a lot smaller than JSON and compiles to nearly all the commonly used languages. Ever since I've started using it my life became so easier! If you don't want your data to be human readable (which is very common) you should not use JSON as a data interchange format.

<comment><USER78> JSON is still the de facto standard, regardless of whether it should be.

<comment><USER77> I don't think so. Can you back it up with facts?

<comment><USER79> Since you haven't demonstrated your premise beyond talking about what you personally prefer, that particular ball is still in your court. The world isn't obliged to accept your unsupported opinions as truth until you're convinced otherwise.

<comment><USER77> I don't need to demonstrate anything. It _is not_ de facto standard since if it were everybody were using it which is not the case (Google is the best example). Look up what the term means and you will understand.

<comment><USER21> Google uses JSON for their APIs.

[https://developers.google.com/drive/v2/reference](https://developers.google.com/drive/v2/reference)

</comment></comment></comment></comment></comment></comment><comment><USER80> You know what is more like a minefield...a minefield...

[http://www.afghan-network.net/Landmines/](http://www.afghan- network.net/Landmines/)

Not trying to be a dork, but thought this would be a good place to bring up...if anyone is interested...in the usage of landmines in current conflicts and the way that they tend to linger.

Call this a comment factoid. Off topic, but interesting.</comment>


NY Payroll Company Vanishes with $35M - <AUTHOR> https://krebsonsecurity.com/2019/09/ny-payroll-company-vanishes-with-35-million/ <comment><USER3> Since this is sort of my beat:

If this ever happens to you, immediately call bank, say "Electronic transaction posted in error.", specifically identify the transaction, and ask what address the bank takes Regulation E written complaints at. If the CSR doesn't know that answer, their supervisor does, or in the alternative FedEx HQ addressed to chief counsel or head of compliance. The letter just needs to state transaction details, date you first called them, and your desired action ("Credit me back $X."), but it's marginally more effective to say Regulation E in it since that will put the fear of God into whomever opens it.

You'll get the money back.

<comment><USER4> Hey Patrick, I'm surprised to see "this is sort of [your] beat". Do transactions like this happen to you often? What sort of speed-to-recovery do you see when you take this approach?

<comment><USER5> The guy works for Stripe. I'd say as a company they're pretty savvy about banking regulations in general, and transaction disputes specifically.

<comment><USER6> His blog also mentions that he's ghostwritten a few hundred letters to various financial institutions in order to resolve errors in credit reports ([https://www.kalzumeus.com/2017/09/09/identity-theft- credit-r...](https://www.kalzumeus.com/2017/09/09/identity-theft-credit- reports/)).

</comment></comment></comment></comment><comment><USER7> This was confusing to understand, because multiple bad things happened. Normally:

* Step 1: Transfer funds from each Employer's account to Cachet's holding account

* Step 2: Transfer funds from Cachet's holding account to each Employee account

Both of these steps are handled with an 'instructions file'.

\---

The crime (or horrible mistake that _really_ looks like a crime):

Step 1's file was changed so that the funds went to an account at Pioneer Savings Bank (controlled by MyPayrollHR)

Step 2's file was sent as it normally would be.

\----

Mistake 1: The file for Step 2 was processed, and funds from Cachet's holding account were transferred to employees, despite funds from Employers not coming in.

Apparently Cachet had at least $26M extra in their holding account for this to work.

As a result of this, Cachet tried to reverse these transactions, since basically they hadn't actually been paid.

\----

Mistake 2: The reversal file was improperly formatted. NACHA rules say these files should be ignored or rejected, but..

\----

Mistake 3: Some financial institutions processed the improperly formatted file anyway.

\----

To fix Mistake 2, Cachet submitted a new reversal file, which was then _also_ processed by the companies.

It sounds like this "reversal file" was actually just a transfer in the other direction (as opposed to "undo transaction ID 937641745"), so of course it would make sense that it was processed.

\----

As a result, all employees paid via MyPayrollHR were paid, then had that payment removed. Some also had the same payroll amount removed a second time.

One thing I haven't figured out, is apparently the MyPayrollHR account at Pioneer Savings Bank is 'frozen' \-- but I can't find any reporting about whether it has $26M in it or not. Meanwhile the CEO has disappeared.. So did he get the money, or just cause a massive life disruption for thousands of people?

<comment><USER8> Thank you for explaining it, you did a great job at helping me understand what happened. The whole process seems way too convoluted for something as serious as paychecks. It really relies on everybody acting in good-faith and in the proper fashion. By Cachet working Step 2 before Step 1 and _possibly_ assuming Step 1 was going to happen, they already were too far gone and only made the situation worse for them and a bunch of employees.

<comment><USER9> The whole idea of ACH transfers and giving everyone write access to everyone's account in this day and age is crazy to me.

There should not be a way for money to leave an account without the account owner's explicit permission.

<comment><USER10> We insisted that our bank provide positive pay for ACH. If you are a business you should consider this if you hold large balances. It works very well. Only authorized ACH entities up to authorized limits can debit (or I can set it to notify and someone has to approve each one).

</comment></comment></comment></comment><comment><USER11> In the US anyone with your bank account number can debit your account irreversibly?

In Europe (with SEPA Core) we have 8 weeks to reject any debit even if the entity issuing the debit has a signed mandate to debit the account.

<comment><USER3> Knowledge of a bank account number is sufficient to attempt to debit it. Whether it will appear to succeed or not depends on the bank and a variety of factors. Regardless of whether it initially successes, it is (very) reversible.

There's a lot of technical nuance here which I'd ordinarily geek out on but don't quite have the time to today.

</comment></comment><comment><USER12> This does seem like a nightmare scenario for the vast majority (4 in 5?) of Americans who live cheque-to-cheque.

Your pay is yanked, life doesn't stop and the bills keep coming. A few days, a week later, it's corrected and the pay reappears. Who's on the hook for your overdraft fees?

<comment> the-dude What is an overdraft fee? How much is it? Is it interest?

<comment><USER13> This is a flat fee assessed if your account goes into "overdraft" to cover a check (or other liability). If your account is set up to do this (pretty standard in the US) rather than a check failing to clear your bank will cover the check and charge, e.g. $30-$50 for covering it. Of course you owe the overdraft amount as well.

<comment><USER14> I also think it's mostly meant to be a deterrent. When I had BofA, any time I got overdraft I just called and they would take it off, usually without an explanation.

<comment><USER13> That's true, but as in other areas I think it probably has a lot to do with how much they value your future business.

</comment></comment></comment></comment></comment><comment><USER15> It seems the FBI in the NY Albany office is now looking into this.

[https://twitter.com/FBIAlbany/status/1171827423333289985](https://twitter.com/FBIAlbany/status/1171827423333289985)

</comment><comment><USER8> Honestly, this is really scary. Personally, I would be unable to take a [2x my bi-weekly salary] hit to my account and that would result in a pretty negative balance. I think I recently saw an article about a bank depositing too much money into an account and the account owner spent it then got arrested. It just seems like the people in charge of how we get/hold our money can screw up with minimal blow back, yet the receiver of the money is almost always the one who draws the short straw. I could be wrong, but it really makes me question the safety of (what little) money I have.

<comment><USER16> If you earn 3k a month, one month you get paid 100k, and you spend 5k on normal things, you aren't going to be arrested.

If you earn 3k a month, one month you get paid 100k, and you spend 95k on stuff you don't normally buy, you are going to be arrested.

If you pick up 20 centrs from the floor and spend it, you won't be arrested.

If you find $50k in a bag and spend it, you will be.

<comment><USER17> I'm pretty sure if you find a bag of money on public property, you're under no obligation to actually return it.

<comment><USER18> This is not correct. If you find a bag of money (or, much more common: a wallet) and you can identify the owner you are obligated to return it. Not doing so is a crime. As it should be.

<comment><USER16> California Civil Code section 2080.1 for example

"the person saving or finding the property shall, if the property is of the value of one hundred dollars ($100) or more, within a reasonable time turn the property over to the police department of the city"

[https://codes.findlaw.com/ca/civil-code/civ- sect-2080-1.html](https://codes.findlaw.com/ca/civil-code/civ- sect-2080-1.html)

<comment><USER19> I'm sure that'll make for some great "well we can't get them on anything else" prosecutions in a few decades as inflation works its magic. Hard coding dollar amounts into law is beyond stupid. At least it's a civil infraction so you should only get a fine in most cases. (I'm making the charitable assumption that having the amount decrease over time was not intended).

<comment><USER20> Hardcoding dollar amounts into law isn't so bad because future laws can update them. For example, a future law might say "All dollar amounts put into law more than 10 years ago are hereby doubled".

The UK has a similar system for fines. Laws are written that if a particular offence occurs, a "Band A fine shall apply", and a separate bit of regulation says what each band of fine or punishment entails.

<comment><USER19> >Hardcoding dollar amounts into law isn't so bad because future laws can update them.

Sure, but we all know that never happens until a sufficient number of easy to feel sorry for people get screwed real hard. Those people are getting needlessly screwed because the legislators were lazy. For example, most states have felony charges as an option for vandalism over a certain dollar amount, in some states these dollar amounts are low. This results in teenagers getting threatened with felonies (and the charges inevitably stick sometimes) because cleaning up their mess cost a few hundred bucks. That is a level of draconian- ness that is not ok in a free society.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Interesting, and a bit frightening about the lack of security.

I have had to work with the equivalent process for payments in the UK - <USER2> where fixing up a problem when the accounts receivable system would not cut the BACS tape for 6 months!

Submitting a BACS Tape required the use of onetime codes and a physical device and this was in the late 80's

</comment><comment><USER22> Besides the banking issues, when do the people get paid?

If the disappeared payroll company got money from employers, it's possible some employers may not have enough cash to pay a second time.

Then they out of business, or close to it.

The old businessman's phrase "You've never had to meet a payroll" is really meaningful here, the scramble to pay everyone.

<comment><USER23> The article said that Cachet is covering the transactions, even though they haven't been paid. The companies will have to find a new payroll provider before their next payroll, but not have to come up with the extra cash.

<comment><USER20> If I were Cachet's shareholders, I wouldn't be happy about that...

<comment><USER24> If I was one of their shareholders, I would be happy instead, as they seem to have come out as the real good guys in the whole story (unless they were legally obligated for covering the mess).

<comment><USER25> If they begin to offer payroll services directly to some of the affected companies, I imagine the shareholders would be quite happy. They might be out the money until the insurance pays up, but ongoing fees and goodwill could well cover that inside of a year or two.

</comment></comment></comment></comment></comment><comment><USER26> Is it possible to protect one's direct-deposit wages from (unjustified) ACH reversals, by transferring funds into a different account ASAP after the deposit occurs?

I.e., by maintaining an account that serves only as a temporary inbox for direct deposit?

<comment><USER27> I think that this doesn't protect you and you would just end up over drafting your account, resulting in fees.

<comment><USER28> Overdraft fees caused by fraud will probably be reversed. I have never heard of it not happening -- it would be a terrible PR for a bank that allowed for it. It will simply take time.

<comment><USER6> It ought to be a regulatory incident, not just bad PR.

<comment><USER28> I'm sure it will be, but bad PR triggers resolution much faster than OCC.

</comment></comment></comment></comment></comment><comment><USER29> This may be tangential and specific to United States, but is there a way to prevent someone from withdrawing money from your account if they know the account and routing number? Both of those numbers are on checks.

<comment><USER6> There isn't a good way to do that. Electronic funds transfers are generally reversible, though. After informing your bank of an unauthorized electronic funds transfer, they are required to investigate and provide you at least a provisional credit for the amount within ten business days.

</comment></comment><comment><USER30> Why such a complicated transfer chain just to pay salaries? In my country you just export a bank file from your payroll system and that's it.

<comment><USER31> I suspect it's partly because there's a complicated employment arrangement going on, with the employees being sorta employed by the payroll management company ("employer of record"), and sorta employed by the company they actually work for, which then pays the payroll management company to handle all that stuff so they don't have to.

</comment></comment><comment><USER32> What form of financial network allows a random company to take money from people without any authorization or interaction on their part?

If the employees had somehow set up whatever the USA calls a direct debit, then sure, I can see a reason for this to happen. But through mistake or malice they are still able to dip into peoples account - that's the real issue here, surely?

</comment><comment><USER33> Really makes me appreciate the non-obvious complexity for companies like justworks (and all the other companies) to operate in this space

</comment><comment><USER34> ok

</comment><comment><USER35> Shades of office space! I'm calling it... the crack coder screwed up the instructions files! Instead of redirecting fractional pennies from each employee to his pioneer bank account, he redirected the whole shebang! boom! ruh ohh!

</comment><comment><USER36> ACH reversals are horrible when they mistakenly happen. They really are a selling point for getting paid in cryptocurrency.

<comment><USER37> Wouldn't a flag on the ACH that makes it irreversible accomplish the same goal with considerably less overhead? I think it's already possible to do this with a wire transfer.

<comment><USER38> I'm not sure these ACH transactions are actually processed like reversals. Otherwise, you wouldn't be able to reverse the same transaction _twice_ , as happened here. They just pulled money back out.

</comment></comment></comment><comment><USER39> And people say crypto exchanges are bad because of exit scams. The same thing essentially happened here, except the authorities are actually investigating.

<comment><USER40> Bollocks. Once a crypto exchange is gone your money is gone.</comment></comment>


Brothers, I Must Go - <AUTHOR> https://christianity.meta.stackexchange.com/questions/6718/brothers-i-must-go <comment><USER2> So this guys problem is that the new CoC requires him to respect peoples chosen pronouns? And it looks like this was that Monica person's problem too.

I think SE are totally within their rights to enforce a policy like this without negotiation, although clearly a miscommunication has occurred. I think the people who object to it are imagining a situation with a mythical SJW boogeyperson saying "Don't misgender me! my pronouns are xe/xem/xyr on weekdays and xi/hir/hir after 7 o'clock, unless I feel like a ve/ver/vis in which case you must read my mind and use those."

In reality, I think the likely scenario is more like "I'm a she :)", and unless you continue to use 'he' pronouns then there isn't a problem.

When put this way, it sounds like a much more reasonable policy and I think it would be fair to eject people who object to this from the community ( _with due process_ of course).

SE have failed to communicate this properly, and also have failed to react to this crisis in a reasonable way. However, from reading this blog post (which actually goes as far as to quote that "First they came..." poem), and Monica's one, I suspect this is not the root of the problem. Not all beliefs can or should be tolerated, as is touched upon in a quote in Monica's post. That is the purpose of a CoC, to set up a reasonable framework of rules upon which debate and discussion can take place.

<comment><USER3> > In reality, I think the likely scenario is more like "I'm a she :)", and > unless you continue to use 'he' pronouns then there isn't a problem.

This is flatly contradicted by both Caleb's post (upon which this whole thread is based) and Monica's.

Caleb resigned because the new rules proposed would not allow him to compromise by simply referring to trans people by name and avoiding all pronouns. His issue is not that he insists on using "he" for a transwoman, but that he refuses to use "she", and would rather stick to names.

Likewise, per the from-memory transcript she posted, Monica - who has no issue referring to a person who has changed gender by their preferred gendered pronoun! - simply stated that she often prefers to avoid the singular genderless "they" when referring to a specific person, and so would prefer to refer to a person who has that as their preferred pronoun by name. That, apparently, was enough to get her fired.

<comment><USER4> Then why don't they just use the pronouns the persons chose and communicated to address them?

<comment><USER5> Apparently the person was concerned that this would allow people to control any narrative they want. For example he suggested that nobody should have to be obligated to acknowledged him as, say, a Christian. I genuinely dont know if this is a good equivalence.

<comment><USER6> I actually think it's a very strong equivalence.

Both are self selected descriptors which could be reasonably objected to without denigrating or disrespecting the person specifically.

Removing the ability to engage in thoughtful conversation where parties disagree is a travesty.

I'll be blunt - as a strong atheist, I'm in full agreement with the moderator who posted this. I personally don't agree with his opinions on gender pronouns, but I think his point stands loud and clear: Respectful disagreement is no longer allowed.

I think that is especially poignant given the community he moderates almost certainly aligns with his views.

I believe many of the communities that press these gender issues are broken. Not because I care about "pronouns" but because when disagreement with the majority opinion is IN ITSELF considered an insult worthy of exclusion or derision, there is no longer any apparatus to allow honest discussion.

I have the same opinion of the most restrictive church communities. The mental process is the same - Disagreement is threatening, remove the threat through ostracism and social pressure instead of honest conversation. Fuck that. Fuck that on both sides.

<comment><USER5> I guess it is equivalent in some ways. In modern society we don't really see religion as fundamental to personhood, or perhaps not to the extent of gender. And many would argue that a person do not choose their gender, although since I'm also not religious, I can't tell if religious people see themselves as "choosing" their religion or not.

As for respectful disagreement, far as I can tell, concerning pronouns, if people see discussion as tantamount to disrespect, it is often because they believe that the overwhelming majority of people who insist on pronouns should be taken in good faith. There will always be people who use discussion as an excuse to in fact disrespect. It is a difficult issue and I really don't know what to think.

<comment><USER7> > we don't really see religion as fundamental to personhood

In saying this, you are doing exactly the thing that I've been called a bigot for. You've excluded me from "we" because I do see religion as fundamental to my identity. In fact my identify is first and foremost defined by the my maker and redeemer. If the God who made the very material from which I am made and breathed breath into my body isn't allowed to be a core part of my identity, then what is? Just because you believe I'm wrong about those facts doesn't give you the right to force me to affirm your view of them.

<comment><USER8> I do not understand why someone would downvote this.

A question was asked, then it was answered by the only party who can give an accurate answer.

This vote demonstrates to me the animus towards people of faith. This is an example of the wrong-headedness in how we approach disagreements. Conform or leave.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Apparently there is an ongoing Stack Exchange sites' moderator rebellion: [https://judaism.meta.stackexchange.com/questions/5193/stack-...](https://judaism.meta.stackexchange.com/questions/5193/stack- overflow-inc-sinat-chinam-and-the-goat-for-azazel) [https://cs.meta.stackexchange.com/questions/1650/i-am- resign...](https://cs.meta.stackexchange.com/questions/1650/i-am-resigning-as- a-moderator) [https://meta.stackexchange.com/questions/333965/firing- mods-...](https://meta.stackexchange.com/questions/333965/firing-mods-and- forced-relicensing-is-stack-exchange-still-interested-in-cooper)

</comment><comment><USER10> I've heard hundreds of versions of this metaphor, but none so affectively well phrased and poignant.

>That agency has been stripped away from us. I feel like if I stay hiding behind my diamond moderator I'll be like a captain staying at the tiller of a boat whose rudder has been removed. The wheel I'm holding doesn't do anything any more and I know it. So why pretend this is going to be anything but a shipwreck eventually?

Regardless of one's viewpoint, the whole letter is a great example of persuasive-testimony. Or I thought so, anyway.

<comment><USER7> Thanks, I hope I didn't ruin it just now with all the copy-editing ;-)

</comment></comment><comment><USER11> Can someone leak the new CoC so we can actually see if these issues are valid or, as all of these self posts seem to be, just transphobic mods going their own way?

</comment><comment><USER12> There have been many incidents like this lately: [https://meta.stackexchange.com/questions/333965/firing- mods-...](https://meta.stackexchange.com/questions/333965/firing-mods-and- forced-relicensing-is-stack-exchange-still-interested-in-cooper)

</comment><comment><USER13> Yep, definetely this dude must go.

<comment><USER7> Do you think I am unfit to moderate the specific site and community I was appointed (and later elected) to moderate? Does any of my history indicate that I did a bad job of that? Has any of my history on any other site on the network been offensive or been disrespectful even when I disagreed?

Or are you just happy to see less platform space given to belief systems that differ from your own?</comment></comment>


Ask HN: Good resources to learn about writing tests for web sites? - <AUTHOR> I'm currently working with Django, but I'm curious about more general testing (rather than just Django tests) and how web developers do this sort of thing. <comment><USER2> what technology stack are you working on?

<comment><AUTHOR> Right now just Django + Heroku</comment></comment>


Konami code in one tweet (140 chars) - <AUTHOR> https://twitter.com/mxwllt/status/639377040060338177 <comment><AUTHOR> Just need a callback

var konami = [the tweet code]

konami(function () { alert('hooray'); });

Ok it's perfectible, and the code probably miss a lot of use cases. But it was just for the challenge to fit it in a tweet.</comment>


Ask HN: Peer Review for MDPI? - <AUTHOR> I have been asked to review a paper for MDPI.  Upon a quick google search, it seems that the credibility of this journal is questionable.  Was hoping more people could comment with their thoughts. <comment><USER2> {Full disclosure: I'm an open access advocate working exclusively with organizations that are working to accelerate the adoption of Open Access to all scholarly journal content. MDPI is one of my clients} Your "quick google search" is likely to have picked up disparaging comments initiated in large part by having been listed for 18 months [from February 2014 to October 2015] on Jeffrey Beall's list of potentially predatory publishers. On October 22 of 2015, Jefferey Beall himself tweeted the news that they had successfully appealed their inclusion on this list and that he was taking them off of his list. [https://twitter.com/jeffrey_beall/status/659321914582679552?...](https://twitter.com/jeffrey_beall/status/659321914582679552?..). "Jeffrey Beall  @Jeffrey_Beall MDPI removed from publisher list following successful appeal. #OA #MDPI 3:52 AM - 28 Oct 2015 from Denver, CO".

Nevertheless this episode remains prevalent on such sites as Wikipedia. MDPI does not engage any of the professional "reputation management" schemes that might fight all the ways which those 18 months on Beall's list continues to crop up in various places on the Internet. They focus instead on the interests of academics who publish in their journals by providing excellent peer review with unnecessary delays taken out of the process.

They are an exclusively Open Access Publisher. They have almost 200 journals and have published exclusively open journal content since 1996. Many of them have impact factors and participate in Web of Science. All of their established journals are given the seal of approval by DOAJ (The Directory of Open Access Journals), and they are members of COPE (Committee on Publication Ethics) which did a specific review of their operations as part of MDPI's appeal to be removed from Beall's list.

I'd suggest in deciding whether or not to do peer review for any specific journal of theirs: look at the editorial board and particularly at the editors-in-chief. Are they respected people in your field? Contact them directly if you have any doubts. All decisions whether or not to publish articles submitted to them are made by members of the editorial board under the guidance of the editors-in-chief. So that should be the measure of whether or not the journal is meeting your sense of what is high quality in your discipline.

</comment><comment><USER2> {Full disclosure: I'm an open access advocate working exclusively with organizations that are working to accelerate the adoption of Open Access to all scholarly journal content. MDPI is one of my clients} Your "quick google search" is likely to have picked up disparaging comments initiated in large part by having been listed for 18 months [from February 2014 to October 2015] on Jeffrey Beall's list of potentially predatory publishers. On October 22 of 2015, Jefferey Beall himself tweeted the news that they had successfully appealed their inclusion on this list and that he was taking them off of his list. [https://twitter.com/jeffrey_beall/status/659321914582679552?...](https://twitter.com/jeffrey_beall/status/659321914582679552?lang=en) "Jeffrey Beall  @Jeffrey_Beall MDPI removed from publisher list following successful appeal. #OA #MDPI 3:52 AM - 28 Oct 2015 from Denver, CO".

Nevertheless this episode remains prevalent on such sites as Wikipedia. MDPI does not engage any of the professional "reputation management" schemes that might fight all the ways which those 18 months on Beall's list continues to crop up in various places on the Internet. They focus instead on the interests of academics who publish in their journals by providing excellent peer review with unnecessary delays taken out of the process.

They are an exclusively Open Access Publisher. They have almost 200 journals and have published exclusively open journal content since 1996. Many of them have impact factors and participate in Web of Science. All of their established journals are given the seal of approval by DOAJ (The Directory of Open Access Journals), and they are members of COPE (Committee on Publication Ethics) which did a specific review of their operations as part of MDPI's appeal to be removed from Beall's list.

I'd suggest in deciding whether or not to do peer review for any specific journal of theirs: look at the editorial board and particularly at the editors-in-chief. Are they respected people in your field? Contact them directly if you have any doubts. All decisions whether or not to publish articles submitted to them are made by members of the editorial board under the guidance of the editors-in-chief. So that should be the measure of whether or not the journal is meeting your sense of what is high quality in your discipline.</comment>


The push for more higher education has led to an excess of business degrees - <AUTHOR> http://nces.ed.gov/programs/digest/d09/tables/dt09_271.asp Was the explosive growth of business degrees what was envisioned when "everyone gets a college education?" It's not that degrees are useless, but that there are too many of them, while the growth rates of many other degrees fields have stayed more or less stagnant. Shouldn't a push for higher education aim to lift all ships? <comment><USER2> Those are some pretty strange groupings. I suppose they're counting Economics and Finance degrees as business? I'm also pretty surprised about the amount of social sciences/history degrees that are being pursued. What exactly were these people planning to do? Certainly explains the law school problem.

<comment><AUTHOR> What's the law school problem? I'm not familiar with it. This link breaks the groupings down into more distinct pieces: <http://nces.ed.gov/programs/digest/d09/tables/dt09_271.asp>

<comment><USER2> The "law school problem" is that there's too many law students and not enough jobs. People are increasingly using law school as their "I don't know what to do with my life" card, whereas those people used to just get a business administration degree and trip into some element of the corporate ladder after undergraduate studies.

The "problem" is that they're incurring another $80k of debt for another degree that doesn't make them particularly useful to anyone.

</comment></comment></comment><comment><AUTHOR> So much for encouraging people to get college degrees. If they all end up getting the same degree and flooding the market, what was the point? I hoped that the growth would be spread out between many fields, but everyone just piling in and getting business degrees doesn't help.

</comment><comment><USER3> Is there newer data? The latest data is 2007-2008 and now we're in academic year 2010-2010. A lot has changed in 3 years.

<comment><AUTHOR> <http://nces.ed.gov/programs/digest/> is the original report where the numbers were compiled. It seems like 2009 was the last report and that 2007-2008 academic year is the latest data available that the report used when dealing with degrees conferred.</comment></comment>


Service for sorting photos by tags and keywords - <AUTHOR> http://explorino.tilda.ws/ <comment><AUTHOR> Hello! Thank you for visiting to my post.

My name is Konstantin and I am from the Akademgorodok of Novosibirsk (this is true in Siberia).

Once, going through the sixty-seventh folder in my google drive and pretty tired, I thought, why not tag the photos so that you can search for them by keywords in seconds? I started to look for similar functionality in the Google drive and DropBox, but did not find it, then I started sorting through various products, but I couldn't find anything. My main desire was the ability to put down the tags and not stop using my usual cloud. From this point on, we decided to develop our own service, which synchronizes with your Google Drive, dropbox or other storage and is a new interface for them, which allows you to: 1\. Generate keywords for photos or a set of them 2.Tags can be marked manually or with the help of recognition of objects, people, emotions or colors by artificial intelligence. 3\. Possibility of both individual and team work. 4\. And most importantly, no change in the usual cloud storage.

I would be very happy if you join the testing service [http://explorino.tilda.ws/](http://explorino.tilda.ws/) or tell about how you are now solving the problem with sorting and searching for photos.

Thanks for attention!

</comment><comment><USER2> I'm not sure that this product will become massive, but you can find your niche.

</comment><comment><USER3> Is it possible to use this service on local drive?

<comment><AUTHOR> Yes of course. Please tell me if it doesn't bother you, why do you prefer local storage to cloud storage?</comment></comment>


Google Drive Uses Hash Matching to Detect Pirated Content - <AUTHOR> https://torrentfreak.com/google-drive-uses-hash-matching-detect-pirated-content/ <comment><USER2> Chnage one byte a few kilobytes from the end of the file, then share.

<comment><AUTHOR> I personally encrypt everything before cloud storage. So this doesn't actually concern me.</comment></comment>


Cancer Vaccine, tailor-made for each patient, advances to Stage 1 clinical trial - <AUTHOR> http://www.wgrz.com/news/article/152242/37/Roswell-Park-Makes-Major-Annoucement-on-Cancer-Vaccine <comment><USER2> Disclaimer: I am not an expert and basically just some random internet person. I've read several recently-published books on cancer, including "The Emperor of all Maladies," (<http://amzn.to/xr2Mx1>) which I highly recommend.

We keep thinking we have a lock on curing cancer, but it continues to be very elusive.

As I understand it, using automation to "debug" individual cancers is scalable. That is, reading a cancer, adapting to it, and creating a vaccine is something that can be done with increasing levels of detail as automation increases.

So if they only show a 1% improvement, it's a strategy definitely worth continuing. This is very much like the hacker who keeps playing around with a broken method until it works -- only it's all automated. It very well may be that we "learn" how to contain/control many cancers without having a traditional understanding of them at all. Fascinating approach, and much different from previous forays. Watch this space. Given the history, my money says it's still going to be a long, hard slog -- perhaps decades, but still, a promising approach.

<comment><USER3> I would hope we eventually start to put money towards prevention to reduce cancer to begin with. Prevention will always be less cost and less suffering.

<comment><USER4> Trouble is, preventing cancer is hard when we don't even know what causes cancer. Obviously smoking is a big one and people have been working hard to great success to eliminate it. How about cooked vegetables? Raw vegetables? Processed sugar? Burnt pieces of meat? Cell phones/wifi? Sunlight? Artificial light?

The reason it seems like everything causes cancer is because everyone is at risk for cancer. Living is a cancer risk. A lot of people don't die from cancer because they don't live long enough, but prevention will never happen. Cancer is inevitable.

<comment><USER5> _> A lot of people don't die from cancer because they don't live long enough, but prevention will never happen. Cancer is inevitable._

Except of course for all those that do live long enough, I don't think the centenarians and beyond die of cancer [http://biomedgerontology.oxfordjournals.org/content/60/7/862...](http://biomedgerontology.oxfordjournals.org/content/60/7/862.short)

From what I can see at FastStats <http://seer.cancer.gov/faststats/selections.php?series=age> incidence does go up with age, but there's still plenty of cancers that happen at relatively young ages, and if you look at the trend, going back to 1975 which is not that much really, you can see a marked increase towards 1990 and then a stabilization, which to me suggests it's quite likely that environmental and lifestyle factors do come in play, as similar trends occur in other health related issues (metabolic syndrome). Markedly lower Vit-D levels, our increased consumption of n-6 poly-unsaturated fatty acids and processed foods, all likely play a role.

I short, I agree with gp in that there is surely a bigger payoff in prevention, but that doesn't mean that cures wouldn't be welcome too. I can't agree that cancer is inevitable.

Edited to add links, formatting.

<comment><USER4> >Except of course for all those that do live long enough, I don't think the centenarians and beyond die of cancer

There are people immune to AIDS as well. These are the outliers. Just because people die of disease before they get cancer doesn't mean they wouldn't have gotten cancer otherwise.

>it's quite likely that environmental and lifestyle factors do come in play

Yes, I accepted that in my post. There are ways to increase your risk of cancer. My opinion was that there is never a statistically relevant zero risk for cancer. Prevention of cancer will never completely stop cancer from forming unless we know and can avoid all possible risk factors of cancer (impossible). Prevention is a good step, but finding a way to reverse cancer is the only way to keep people from dying from it.

</comment></comment></comment></comment></comment><comment><USER6> My life partner has grade III brain tumor. Recently diagnosed and operated. She took surgery well. Apart from slightly higher chance of mispronunciation she feels as good as ever. It's interesting that you can live unchanged without the part of your brain. Her brain had time to adjust while her tumor was growing. She'll be starting irradiation and chemo next month.

I really hope this vaccine will be available and effective when her tumor grows back.

</comment><comment><USER7> I'm proud to say that I work at Roswell Park. I'm one of five web developers in the IT dept. I write internal applications focused on supporting the many clinical trials happening here.

There is definitely a huge buzz going through Roswell's campus regarding this.

Here is the publicly available information regarding this particular Phase I study.

<http://www.roswellpark.org/clinical-trials/list/191511>

<comment><USER8> I'm curious, how do you like working there?

I'm a programmer in Buffalo, NY. I always check Roswell's "Available Careers" and they always have to same two Programmer Analyst postings.

Do you have a chance to use cool technologies there? The postings mention JSP/VB/blah.

I'd love to send in a resume to support meaningful work.

<comment><USER7> I've been at Roswell nine years. I intend to retire from here. I'm also a Buffalo native and I can't think of anywhere else in the city I'd rather work.

Roswell is run similarly to a college campus (I've had previous experience supporting NY State colleges), meaning there are many departments, each run fairly independently of each other and each with different technical needs.

The departments usually fall in one of three categories: there is an educational group that works with UB's medical campus, a clinical component that treats patients, and obviously a heavy research component. During my time here, there have been at least four startups/companies that have formed as a result of research I've helped support.

Roswell currently has about 3,300+ employees. The Programmer/Analyst positions you have seen are an attempt to fill needed positions in various departments.

Everyone's version of "cool technologies" is different. I'm of the opinion, for the most part, whatever gets the job done thoroughly and accurately works.

In the past nine years I've written and maintain about 20+ applications in VBscript, C#, Actionscript, PHP, Ruby, etc with the various associated frameworks. Since every department requires something slightly different I've had to adapt as needed. However, recently we've been running with an inhouse PHP framework called Surebert which was/is written by a co-worker.

<http://www.surebert.com>

<https://github.com/surebert>

Interestingly enough for me, I've never written anything professionally in Java, but a lot of my co-workers have.

Out of the five of us on the web team, I'm the Apple fanboy. So I'm on a MacBook, iPhone, etc. Another one is on Fedora, another is using a Dell (ugh). To each their own.

And Roswell lets me moonlight on the side. I've had fairly steady freelancing gigs for a couple years now.

Interesting place to work. Good people. Very little complaints (nothing's perfect).

<comment><USER8> I appreciate this response so much. Thank you.

</comment></comment></comment></comment><comment><USER9> Remember, stage 1 clinical trials are just "does this treatment accidentally kill people" trials. They're a _long_ way off from testing to see if the treatment actually works.

<comment><USER6> Nobel laureate Ralph Steinman had some of this kind of vaccines tested on himself when he got pancreatic tumor. He lived unusually long for this kind of tumor and died of pneumonia.

There's piece about his fight in recent Scientific American. [http://www.scientificamerican.com/article.cfm?id=the- patient...](http://www.scientificamerican.com/article.cfm?id=the-patient- scientist)

<comment><USER10> Right, but that's the thing... some of these drugs might work for some and kill other people unexpectedly. The efficacy for one person doesn't mean that it wouldn't kill every other person that takes it, and looking at a sample size of 1 (nobel laureate or not) doesn't make for good science or good medicine.

<comment><USER11> This is exactly why personalized medicine, bioinformatics, computational pharmacokinetics, etc is key for the future of medicine.

I am not a biologist but I imagine someday soon a scenario like this will be possible: You have a model of the sites and interactions the drug targets, and optimum biology - metabolism, target cells' proteomes etc. Measure these in the patient and you can predict ahead of time the efficacy of the drug and then optimize the drug's chemistry to be more effective for this individual. With a better understanding of protein modelling and such you could do a search for similar structures and compute the expected interactions and optimize for personalized effectiveness.

</comment></comment></comment></comment><comment><USER12> There is already an FDA-approved therapeutic cancer vaccine that is sold by Dendreon for the treatment of prostate cancer (Provenge). Like this Roswell Park therapy linked to, Provenge also harnesses dendritic cells.

More info on Provenge: <http://en.wikipedia.org/wiki/Sipuleucel-T>

</comment><comment><USER13> Soon, everyone can smoke without worry.

</comment><comment><USER14> Two words: zombie apocalypse

</comment><comment><USER15> Stage 1 clinical trials take healthy individuals, give them the drug, and wait to see if it kills them. To go from stage 1, through stage 2 (which determines effectiveness), through stage 3 (which determines safety for general distribution) takes 10-15 years.

In other words, this is not news. There are probably hundreds of similar clinical trials every year.

<comment><USER16> Not quite. Phase I trials often happen in patients with the disease, because otherwise the data you get on toxicity aren't that relevant.

Definitive efficacy is established in a phase III trial, along with safety.

en.wikipedia.org/wiki/Phases_of_clinical_research

This trial is news-worthy for a few reasons. One is that the only documented cases of cure of a disseminated cancer are proabably all due to an immune- mediated attack (exceptions are lymphomas and testicular cancers which can be cured with chemotherapy even if widespread). Vaccines are trying to exploit this mechanism. Another reason is that most of the treatments we use in phase I trials are poorly understood. The treatment employed in this study however utilises a pretty simple and elegant approach - find something that only cancer cells have, then try and bait the immune system with it.</comment></comment>


Ask HN: Can you recommend an ad network to help me monetize my unique site? - <AUTHOR>

birejji.com - Incentivized site where users are paid to chat and play games.
Average CTR: 2-3% Impressions: 1/4 Mil
I'm looking for an ad network which would accept this kind of site since networks such as google adsense will not accept it. <comment><USER2> I'm using lijit.com - it's worth a try

<comment><AUTHOR> Unfortunately I was rejected from lijit</comment></comment>


Why a Front-end developer should also be a UI developer - <AUTHOR> https://www.imaginarycloud.com/blog/why-a-front-end-developer-should-also-be-a-ui-developer/ <comment><USER2> I don't understand the difference between UI and frontend developer. What do you work on if you are a frontend developer but do not actually care about the UI?

<comment><USER3> > _I don 't understand the difference between UI and frontend developer._

That's the second paragraph of the post.

> _What do you work on if you are a frontend developer but do not actually > care about the UI?_

You could code JS, React, HTML, CSS, etc and implement other people's mockups, without giving a toss about UI principles and UI design...

Working in front-end = implementing the technical parts of a given UI.

Being a UI developer (as per the post) = knowing UI priciples, design, etc.</comment></comment>