Django and Python 3 - <AUTHOR> http://alexgaynor.net/2011/feb/17/django-and-python-3-take-2/

<comment><USER2> Here would be my plan (though I'm not good enough to carry it out):

1\. Port the dispatcher to P3.

2\. Do something magic with urls.py, so you choose which version (2.X or 3.X) you want doing the query.

At this point, people can use URL plumbing to gradually port their Django projects.

3\. Port the parts where Python 3 is a killer feature. String formatting, Unicode handling (maybe), function decorators, and metaclasses. This is the hard part - where would python 3 add some killer features to django?

You also need to do the db layer, the templating, and all that jazz, but that should follow once you have the incentive of actually seeing it work in your browser.

<comment><USER3> I've said before and will say again:

The holdup here is not technical. It's great that we've got people like Alex willing to port code, but _that's not the hard part_. The hard part is people who are using and want to continue using Django on platforms where Python 2.5 or even 2.4 is still the standard.

More on this forthcoming, once I've had a proper weekend off.

<comment><USER4> How feasible is it to have support from 2.4 to 3.x? Either with or without 3to2/2to3 as part of the packaging process?

EDIT: I'd have thought upgrading the codebase to 3.x and making sure that 3to2 produces a working 2.4 version would be better than using 2to3. Thoughts?

<comment><USER5> The problem there is that 2.4's exception statements and 3.0's have two different meanings.

2.4 only supports this:

        try:
            do stuff
        except FooError, e:
            do stuff with e

3.0 and up choke on this; they interpret it as "catch exceptions of type FooError or e and do not give the exception object a name".

2.5 through 2.7 interpret like 2.4 but also support explicit parentheses to do what Python 3 does:

        try:
            do stuff
        except (FooError, BarError) as e:
            do stuff
        except (BazError, QuxError):
            do other stuff

2to3 requires that you use the new exception syntax only, to avoid confusion.

<comment><USER6> The following will work across 3 and 2 versions going back pretty far. It's necessary if you want to support pre-2.5 versions (where `as` was introduced):

        import sys
        try:
            fn()
        except (IOError, TypeError):
            err = sys.exc_info()[1]
            print(err)

[http://docs.pythonsprints.com/python3_porting/py- porting.htm...](http://docs.pythonsprints.com/python3_porting/py- porting.html#exceptions)

<comment><USER5> Still kind of ugly, and not something which you want to litter than Django sources. Especially if you are going to put them all back when 2.4 support is dropped.

</comment></comment></comment></comment></comment></comment><comment><USER7> I started working on an app using Python 2.7. The only reason I chose 2.7 over 3.x was the lack of 3.x support in Django. I would be great to have Django support Python 3.x.

<comment><USER8> I believe that they already have the rumblings going on to move it to 3.x.

<comment><USER6> <https://bitbucket.org/loewis/django-3k> is the initial 3.x port mentioned in the post, started at PyCon 2008.

</comment></comment></comment><comment><USER9> Its nice to see posts about python and django. Ive only played around with them a little bit but having options is always a good thing and right now it seems the frameworks discussion is really dominated by Rails.

</comment><comment><USER10> So this is an appeal to get taken up for google summer of code? Doesn't google have pages for these kind of requests?

<comment><USER6> I think he's aware of the formal procedures from his previous involvement with GSOC and Django. The post seems more to be stating what's what, how it's probably going to happen, etc.

</comment></comment><comment><USER11> Kudos python 3.x</comment>


It's Google Plus vs. Twitter, Not Facebook - <AUTHOR> http://bostinnovation.com/2011/07/18/it%E2%80%99s-google-plus-vs-twitter-not-facebook/

<comment><USER2> To some extent, I agree. If Google+ plus becomes a parallel universe that is a refuge from the MySpace users now dominating Facebook, I'll be fine with that.

I used to post news articles and try to provoke discussion through the Facebook news feed, but I have since switched to Twitter for that. I suspected that many people on Facebook thought I was clogging up their stream with my news links. Facebook is too personal. People want to see the latest drunk party photos in their stream, not political and tech news articles.

The problem with Twitter is that I'm not sure anyone is reading my tweets. Every time I open up the Twitter app, I have 50+ new unread tweets and pretty much ignore all of them as I scroll to the top. Things move too fast on Twitter. Tweets get lost. Twitter is no Google Reader.

Because Twitter exists in a middle ground where, unlike Facebook, you don't follow people you necessarily know if real life, G+ has a better chance of gaining marketshare against Twitter than trying to convince grandma to move over to G+.

</comment><comment><USER3> I agree that feature wise, Google Plus has more overlap with Twitter. So why do people keep comparing it to Facebook?

Because it _feels_ like Facebook. The feeds seem like Facebook feeds, the mobile app seems like the Facebook app. Google and Facebook _feel_ like competitors.

If Google Plus had focused on text messages or had no photos or was just more stripped down in general, it would probably feel like Twitter. The way Google Buzz felt like Twitter.

</comment><comment><USER4> I'm not so sure. For what I use, at least, the only thing missing in Google+ vs. Facebook is an API so that my blog posts can get cross-posted to my Google+ stream. I still can't be bothered to use Twitter. It's always been a waste of time for me. But with Google+, I may well end up closing my blog. I don't have to put up with ridiculous message-length limitations. I am actually following people that I would never bother following on Twitter. I can't be alone.</comment>


"We have 3,000,000 users, now what?" startup asks - <AUTHOR> http://www.insidefacebook.com/2007/09/20/we-have-3000000-users-now-what-startup-asks/

<comment><USER2> Ugh, Booze Mail. Success is success, but man, how depressing is it that this is popular? It's the "According to Jim" of web apps.

</comment><comment><USER3> Time to "monetize them eyeballs!"

</comment><comment><USER4> The only thing possible is just branding and text links. The conversion rate will be horrible, why would any one click on a link under neath an icon of a martini glass? The liquor companies would probably pay to have their name associated with the booze but that's most likely pittances.

300k daily usage is insane, but at the same time, it's just Facebook. Has there been any actual success (money-wise) with Facebook apps?

<comment><USER5> Yes.

<http://www.techcrunch.com/wp-content/smincomebig.png>

My app (<http://apps.facebook.com/themafia>) is currently doing around 9K a month a revenue, and it's not even that successful by Facebook app standards.

<comment><USER4> So the disconnect for me is: if you're able to produce a 6-figure annual revenue, why is it so hard for a company (with Rifkin and Park nonetheless) with 300,000 daily users to accomplish similar track records?

<comment><USER5> They have staff to pay, office space to rent, and VC money so that they won't need ads until the achieve the kind of returns their investors require. These companies are go big or go home, 6 figure annual revenue would pay for like one employee.

My only expense is my time and hosting costs.

<comment><USER4> i mean to say, does the monetization just not scale?

</comment></comment></comment></comment></comment><comment><USER6> Ask them.

<comment><USER7> Facebook is like a money printing machine for developers. I know several apps that are making thousands a day.

<comment><USER8> Do you think the advertisers are getting their money's worth? In other words, is this thousands of dollars a day sustainable or should facebook apps ebay themselves while they still can?

<comment><USER5> This is a question that you can ask of any web 2.0 company. I don't see why Facebook apps would be significantly less monetizable than any other app.</comment></comment></comment></comment>


Deep learning for source to source computer language translation? - <AUTHOR> Anyone know of any recent work on deep learning for source to source computer language translation ? Since go and real time strategy games were the last out of reach items for machine learning, i feel like this is the next thing that's out of reach of deep learning. <comment><USER2> The only thing I've seen are graph convolutional networks: [https://tkipf.github.io/graph-convolutional- networks/](https://tkipf.github.io/graph-convolutional-networks/)

Deep learning is "messy" \- it's hard to use the output of a deep neural network for something as precise as a program, unless maybe as a heuristic with a rigorous "equivalency" harness.

<comment><AUTHOR> programs are precise, but not unique. so a little messiness can be tolerable.

<comment><USER3> Not really. A little messiness to the human eye is equal to an error for a compiler, which isn't tolerable at all.

</comment></comment></comment><comment><USER4> We did some research work on model-to-model translations (in the end, it's basically the same problem) and we ended up with mixed feelings (as we explain in the article: [https://modeling-languages.com/lstm-neural-network-model- tra...](https://modeling-languages.com/lstm-neural-network-model- transformations/) ).

Mostly, right now (IMHO) you can only get some success translating very short pieces of code.

We used LSTMs for that (which seems to be the more usual approach in this domain)</comment>


The Rise and Fall of the We Company – The Art of We - <AUTHOR> https://simon-l.gitbook.io/the-art-of-we/ <comment><USER2> An FYI for the author: under copyright law, just declaring something to be fair use, as you do at [https://simon-l.gitbook.io/the-art-of-we/fair-use-act- discla...](https://simon-l.gitbook.io/the-art-of-we/fair-use-act-disclaimer), doesn't automatically mean it _is_ fair use.

There are four factors that are evaluated when deciding if a use is fair or not (see [https://fairuse.stanford.edu/overview/fair-use/four- factors/](https://fairuse.stanford.edu/overview/fair-use/four-factors/), [https://copyright.columbia.edu/basics/fair- use.html](https://copyright.columbia.edu/basics/fair-use.html)), and republishing the full text of dozens of articles written and owned by other people without any modification or commentary doesn't come off well under any of them.

I'm not a lawyer, but I would strongly recommend taking this down before anyone from Bloomberg finds out about it.</comment>


Lamson - email app coding without the palm sweat - <AUTHOR> http://www.theregister.co.uk/2009/07/03/lamson/ <comment><USER2> I spent about 35 hours developing the first version of the mail handler we use on <www.classlet.com>. I took the knowledge I gained from that, turned around, and re-wrote it from scratch in about 15 hours.

Weighing in at under 500 lines of code, it makes heavy use of Python's mimetype and smtp libraries as well as some abstractions from Django's mail library. It operates on mail piped into stdin by procmail every 10 seconds as retrieved by fetchmail. The subsystem has basic logging and in the event of errors procmail dumps the entire message into an mbox file and notifies me. Retrying is as simple as `cat mbox | classlet/procmail.py`

That said: I applaud any attempt to make this easier, more robust, and more standard. Our mail processor is actually quite simple, but has a long way to go in terms of maturity.

I'd love to hear about other experiences with this stuff. I know the Posterius guys lurk around here, how about some insight? :-)

<comment><USER3> I've also extracted Django's mail abstractions (since django.core.mail is dependant on django.settings) for a unreleased project I'm working on. We (I?) should probably make this a stand alone package (with the relevant tests from Django's test suite).

<comment><USER2> That sounds like you're volunteering. Have at it; I won't steal your thunder :-)

</comment></comment></comment><comment><USER4> Interesting that this has gotten something this kind of attention already, the project has only just started. I suppose that it owes a lot to Zed being Internet-famous, but still.

</comment><comment><USER2> Direct link to the project page:

<http://lamsonproject.org/>

</comment><comment><USER5> I don't get it - why is this cool? Isn't "mail" one of those outdated meatspace idioms we can finally allow to die?

<comment><USER6> I've only seen the term, "meatspace", in the last few weeks. Is this some new nerd trend? Attempting to ostracise yourself from the general public by referring to them with degrading inhuman terms such as this is a rather stupid idea, IMHO.

<comment><USER7> _I've only seen the term, "meatspace", in the last few weeks. Is this some new nerd trend?_

It's at least 15 years old and faded out with the rest of the "cyberpunk" genre.</comment></comment></comment>


Mythbusters Banned From Discussing RFID By Visa And Mastercard - <AUTHOR> http://www.disinfo.com/2012/02/mythbusters-banned-from-discussing-rfid-by-visa-and-mastercard/

<comment><USER2> The statement (from 2008) has since been redacted by Adam.

'MythBusters' co-host backpedals on RFID kerfuffle: <http://news.cnet.com/8301-13772_3-10031601-52.html>

</comment><comment><USER3> perhaps an intrepid researcher or phd student in comp sci/ee/IT could do a project on how trackable and hackable those RFID chips are. A bit how cambridge researchers hacked the Chip And Pin system and published their results awhile back. ([http://www.cl.cam.ac.uk/research/security/banking/nopin/pres...](http://www.cl.cam.ac.uk/research/security/banking/nopin/press- release.html) )</comment>


Extract Text From Remote Image URL using Saaspose.OCR REST API - <AUTHOR> http://saaspose.com/blog/saaspose-ocr/archive/2012/12/18/extract-text-from-remote-image-url-using-saaspose-ocr-rest-api.html

<comment><USER2> Come on. Look at your post history. You post this website several times a week across different accounts and then you up-vote it using those accounts.

<comment><AUTHOR> My sincere apology if I did something wrong, But Could you please tell me which other account I am using?</comment></comment>


What I'm Telling US Congress about Data Breaches - <AUTHOR> https://www.troyhunt.com/heres-what-im-telling-us-congress-about-data-breaches/ <comment><USER2> Something I would have liked to see - but perhaps this letter wasn't the right place.

Let's talk about how the ubiquitous use of SSN and credit reports puts a massively unfair burden on every US citizen.

Right now, it's _all on me_. I need to safeguard everything related to my government-issued nine digit ID that I never asked for - yet is somehow accepted as my financial identity, well beyond its intended scope.

If I fail to do so, or if I fail to aggressively identify fraudulent use of it by monitoring reports from 3-4 different agencies, it's _on me_. It's _my_ credit that's screwed.

It's hard to emphasize enough how unreasonable that is. This isn't a house or other peace of real property that's in my control - it's 4 bytes of data that is assigned to me, but that I fundamentally have no control over.

In spite of that, I am accountable for any and all uses of that data. It's hours of my life each time a breach occurs - more if it's actually misused. The assumption of 'bad credit risk unless and until you convince the reporting agencies that fraud has happened' is a fundamentally flawed one.

I can't opt out. I can only keep spending my time and money to play the game - because it's the only one in town.

<comment><USER3> Indeed! I have recently been trying to come up with a new term to use instead of "identity theft" (open to suggestions). As the term itself seems almost Orwellian to me.

My identity wasn't stolen! You gave a loan/credit card/whatever to someone and didn't verify who they were. How is your organization not doing the proper work a "theft" of my identity? I'm not involved and I don't want to be!

<comment><USER4> "Identity theft" isn't real. It's a term the banks et al. use so that they can have less responsibility.

Example: Someone opens a bank account using your information. That's fraud. Someone lied to the bank, and the bank believed them. That's the bank's problem. But by pointing at you and saying "Your identity was stolen" (using the term "stolen" to make it seem like this is similar to the theft of a physical object), it suddenly seems like it's your problem.

<comment><USER5> > It's a term the banks et al. use so that they can have less responsibility.

I agree that it's misleading, but have to concede that whoever first came up with that term must have been an expert in framing and spin. There are few words that so effectively distort the discussion as "identity theft".

<comment><USER6> Indeed. When one thinks of "identity theft victims", one doesn't think of a bank.

But it is the bank, it should be! When a bank is robbed, its clients aren't the victims. The bank is. The clients aren't giving money to the bank for nothing in return; what they get in return is assurance of safety and availability (otherwise, that would be a loan, not a deposit). Spinning the failure to deliver on that obligation as the client's problem is indeed great PR work.

</comment></comment></comment></comment></comment><comment><USER7> In case someone is wondering, the previous post - "I'm Testifying to Congress about Data Breaches – What Should I Say? " was discussed here:

[https://news.ycombinator.com/item?id=15751344](https://news.ycombinator.com/item?id=15751344)

Some of the replies really touch upon what can go wrong with government regulation.

That said, I do really want something done about this:

> An attitude of "data maximisation" is causing services to request extensive > personal information well beyond the scope of what is needed to provide that > service

Stop collecting information which is not required. Most of this information ends up in some form of advertisers/advertisement in guise of creating "more engagement with users".

<comment><USER8> IMO there should be expensive data breach bond/insurance requirements for any company storing data about people, scaled by how much and possibly which kinds of data are stored. Discourage holding a bunch of stuff "just in case".

And FFS, at least outlaw the required arbitration BS for data breaches. Let the bond or insurer pay out when it happens, then jack up their prices on the breached company until they cry.

<comment><USER9> By "until they cry" I assume you mean "until they can no longer continue passing the costs directly to the consumer, at which point they simply go into bankruptcy and reincorporate 6 months later at the lower insurance rate?"

<comment><USER10> If the data you hold as a business is so valuable that the insurable risk of loss is too expensive for your business, then ask, "do we really need to hold that data?" If your business needs to pass that on to consumers because you can't afford the hit to your margins, then consumers need to ask, "is [service/product] really worth that much to me?"

The downside is that the most critical components of information which tie to identity itself, are the ones that businesses most commonly need to hold to verify identity. More challenging is that without a way to modify identity data (i.e. change your SSN), the insurable risk is huge because it needs to include a discounted cost of identity monitoring forever, and the cost of the individual losses that someone might encounter for the loss of that data. Then of course, if a person's identity is compromised more than once, how do you discount the responsibility across multiple careless parties?

IMO it all comes down to never using immutable information (Name, DOB, etc) to firmly define identity online. That information should be for display purposes only. At the backend, we need an identity that is tolerant of change, and can easily be updated if it is ever lost. In reality this will probably mean that instead of an ID, we have ID probability, which would include photos, addresses, ID numbers, Credit card account access, and companies that needed to verify it would be able to evaluate how certain they were the identity was real, and to insure against mishandling of the individual components of information.

<comment><USER8> > The downside is that the most critical components of information which tie > to identity itself, are the ones that businesses most commonly need to hold > to verify identity. More challenging is that without a way to modify > identity data (i.e. change your SSN), the insurable risk is huge because it > needs to include a discounted cost of identity monitoring forever, and the > cost of the individual losses that someone might encounter for the loss of > that data. Then of course, if a person's identity is compromised more than > once, how do you discount the responsibility across multiple careless > parties?

If it gets expensive enough, maybe banks and CC companies and such will finally get off their asses and fix the whole "identity theft" issue. That's a feature, not a bug.

I think the US is too allergic to anything with even a whiff of "secure national ID" for us to let the government fix it, so this is the next best (or, better, depending on your perspective) option. I frankly don't care how we do it, but it's really stupid this is still a thing people have to worry about, and making it cheaper for the banks to fix it than not to fix it seems like the most politically viable solution.

<comment><USER10> Agree completely. Personally, I was hoping that Visa, MC, and Amex together could just create a new standard "financial ID number" or "Credit ID Number" that they could collectively agree on and we could all just kind of ignore the government. CC numbers themselves are almost good enough in the first place, they just need to get a little more self-referential.

Hell, maybe they could even use a distributed ledger to do it and bring in the credit reporting agencies too.

<comment><USER11> >we could all just kind of ignore the government.

You mean the government that spent 26 years printing "NOT FOR IDENTIFICATION" on the bottom of every social security card.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Very cool to see Troy use my suggestion:

from [https://www.troyhunt.com/im-testifying-in-front-of- congress-...](https://www.troyhunt.com/im-testifying-in-front-of-congress-in- washington-dc-about-data-breaches-what-should-i-say/):

"Troy, to your point "Data breaches can take years to discover," I think it's helpful to put in layman's terms that breaches are closer to making photocopies where there are now two people in possession rather than a theft where the owner is deprived of access. How do you detect that a document has been photocopied?"

In the final (this link):

"However, unlike a physical commodity, the trading of data breaches replicates the asset as each party retains their original version, just like making a perfectly reproduced photocopy."

:)

To expand on my point and

> We Often Don't Know Until Years Later

You notice someone's stolen physical property from you, because you are deprived of it.

You don't notice someone's stolen digital property from you, because now there are more copies of it.

(maybe "stolen" and "property" aren't the correct terms to use for digital assets?)

<comment><USER13> > (maybe "stolen" and "property" aren't the correct terms to use for digital > assets?)

Stolen is _rarely_ the right word (that is, it's possible to steal digital assets, notably if also stealing the physical medium on which they are stored, but usually the term is used in only a loosely figurative sense), but "property" is often correct; there are all kinds of nonphysical property that share important features with physical property, and there are equally important distinctions within classes of tangible property as between tangible and intangible property.

</comment></comment><comment><USER14> While he presents a great overview of all the problems with static knowledge based authentication, I get the feeling that the very fact that this hearing was called for implies there is already a strong consensus that the current status quo is a big problem. To me it falls a bit short because he primarily elaborates on the details of the problem without offering any suggestions on how to move forward towards a solution. I mean, the details may help understanding which could inform improved policy, but these politicians also need guidance on what actions to consider.

<comment><USER15> Indeed, and if impartial security experts won't offer them, the politicians will have to rely on corporate lobbyists to write their own rules and penalties affecting those companies.

<comment><USER16> I believe the scope of what he was asked to address might not have included suggested solutions, beyond the obvious "don't suggest all the stuff I'm saying is causing a problem."

He does specifically go out of his way to say, in bold and isolated text, _Do keep in mind that the context here is the impact on identity verification in "a post-breach world"._

</comment></comment></comment><comment><USER17> Nice overview, but more importantly, what will Troy say when members ask him for solutions. Notably absent are details on whom to hold accountable, how to hold them accountable, and what penalties should be in-place.

</comment><comment><USER18> I don't mean to sound cynical (as in, this is a genuine question) but do these hearings amount to anything more than political grandstanding so that the relevant Congresspersons can claim to have been 'tough' on whatever topic was discussed?

<comment><USER19> Off topic but I just have to say it.

There isn't a damn thing wrong with being cynical. Cynicism (at whatever level) is a very valid philosophy and no one should have to apologize for having it.

[http://richardbayan.typepad.com/the_cynics_sanctuary/cynicis...](http://richardbayan.typepad.com/the_cynics_sanctuary/cynicism/)

<comment><USER19> ^^ For proof of cynicism's legitimacy see downvotes.

Some people think motive and human nature should be viewed with rose colored glasses. Many people urging others to hold this viewpoint stand to gain by advocating it. But not me. I expected.

Back to the original off topic point. Don't apologize for being cynical. It's a mental model that is quite often accurate.

<edit because I really have to get this off my chest as it's so annoying>

Here's what I think. I think you have _observed_ a pattern of hearings that appeared to be little more than political grandstanding. And maybe you haven't _ever_ observed a hearing that was anything different, as in, designed to get to the bottom of something and produce results. If the above is true you understandably expect a continuation of the same pattern. Yet you feel the need to apologize for this perfectly intelligent and rational expectation. Why? Possibly because you have been conditioned against being "negative" and led to believe that cynicism is somehow evil? Well I just have to say... Fuck That! You are right from what I can see.

</comment></comment></comment><comment><USER20> Troy: HUGE kudos for how you managed such an open and transparent process. Don't recall any other examples of such inclusiveness and openness for a senate testimony. Bruce Schnier did a good job sharing his testimony after the fact but you went all in.

</comment><comment><USER21> It is unfortunate that he uses "date of birth" and "home address" as exemplars of information that is "of no use to the service." That is because these two pieces of information are most frequently used to establish that the user is of the age of majority (an adult) and under which set of licensing regimes is the product operating. Both of which may be critical to the function of the service.

Much better examples would be "Gender" and "telephone number".

I completely agree with the notion that data maximization (or aggregation of meta data associated with a unique ID) are the roots of many evils and risks.

<comment><USER22> Verifying jurisdiction doesn't require you to know the whole address, just the country code and possibly the state.

Verifying if someone is legally an adult doesn't require you to know the exact age and definitely not the birthday, simply "yes" would be sufficient.

<comment><USER21> I don't disagree with your analysis, however I have been informed that there are reasons for asking things this way. At a class for booth volunteers for selling alcohol for example we were told to ask for someone's birthday rather than their age. The reasoning in that training was that someone could quickly lie about their age but they had to work at it to back compute a birth date that would fall within the range of legal drinking age and not be ridiculous for someone of their apparent youth.

I am not saying that this is a reason that everyone uses for asking these questions obliquely. I am simply sharing a situation for which I was explicitly told that was the reasoning behind asking the question in that way.

<comment><USER23> There is usually no time constraint when filling out an online form. And I'd imagine the physical nature of the in-person alcohol exchange allows the booth operator to evaluate the physical response of the person being asked. All of this is to say, while I understand the idea in physical exchanges, to me the logic breaks down when I can find a completely valid and full address on Google maps in a couple of seconds (assuming one of the reasons they ask for full address is the difficulty in generating at random a valid address that exists).

</comment></comment></comment></comment><comment><USER24> I'm replying in the hope that Troy Hunt reads it, because I am commenting too late for conversation to happen.

This presentation involves a lot of complex terminology from the get go. This keeps it from engaging people's logical brains, and means that you are too easy to ignore. Our first pass at analyzing people is to figure out whether they can be safely ignored. This response is well before rational thought, and the part of our brain that decides it is unable to handle complex language. It doesn't matter how right you are, you are literally not heard.

You can't fix the document. But you'll be talking in person to lawmakers. You can address the challenge there.

Don't open with something like, _Data breaches occur via a variety of different "vectors" including malicious activity by attackers exploiting vulnerabilities, misconfiguration on behalf of system owners and software products intentionally exposing data by design._

Open with something like, _Anyone can steal your identity. Your wife 's as well. My site shows you some of the security breaches that criminals can use to pretend to be you. Nobody knows how many more are out there._

Make it simple and straightforward. Make the threat personal. This requires their full attention to figure out what you are saying. That makes their logical brains connect.

Good luck. You have an important message and I really hope that they hear you.

</comment><comment><USER25> I hope some good comes from this testimony. I help run a product that works with a tremendous amount of data. I welcome additional accountability as well as the security that would come from knowing that any regulatory requirements are properly met.

On a second note, will this be the historic first time anyone says the word "Pwned" before congress?

</comment><comment><USER26> I hope they won't use the hearing for blaming foreign adversaries that need to be fought with offensive capabilities. It should be made clear that the problems are homegrown.

</comment><comment><USER27> I have a amazing idea. Why not let the companies be liable for their own data breaches. Wow, what an amazing idea! /s

<comment><USER28> Liable how? And to what extent, the idea "let the companies be liable for their own data breaches." sounds good until you think about for more than 10 seconds.

Identity Fraud is not normally carried out using just 1 breach, so it is several breaches combined that give a criminal what they need to commit full Identity fraud.

Credit Card Fraud can almost never be traced back to a single breach.

Are you holding the company that collected the data, or the company that the data was stolen from liable, often times these are not the same entities.

I can probably come up with about 1000 other things to bring up in relation to "let the companies be liable for their own data breaches."

</comment></comment><comment><USER29> I'm glad you hit the main points, but you did not offer any solutions, and I think partial encryption is one that is really important to lay out. Our social security numbers and valued information (that cannot be changed, like where you were born) need to be encrypted all the time, not just when convenient.

<comment><USER30> Encryption doesn't really help when 1/3 of Americans' SSNs have been publicized already. It's shutting the barn doors after the horses are long gone. SSN needs to be at most a username, rather than a credential.

<comment><USER29> True, but whatever supplants SSNs must be safeguarded via partial encryption.

</comment></comment></comment><comment><USER31> Clear and to the point, hopefully sparks conversations about how to fix these issues moving forward.

</comment><comment><USER32> "4\. An attitude of "data maximisation" is causing services to request extensive personal information well beyond the scope of what is needed to provide that service. That data is usually then retained for perpetuity thus adding to an individual's overall risk."

And HIBP is an example of this attitude because it collects data dumps and then (at least) collects and retains user-submitted email addresses and a record of presence/absence of such "live" email addresses in the data dumps. This is beyond the scope of what is needed to provide the service, namely, copies of the data dumps available for download. The user need not share their search terms with any third party, such as HIBP. A means to search these dumps locally (offline) without sharing the searches with third parties such as HIBP exists. "Online tools" are vectors for gathering the sort of data that is later the subject of "data breaches". Offline tools do not suffer from this problem.

"6\. Data breaches are redistributed extensively. There's an active trading scene exchanging data both for monetary gain and simply as a hobby; people collect (and thus replicate) breaches."

HIBP is collecting and thus replicating data breaches for "monetary gain" or "simply as a hobby"? Or is it something else?

As above, HIBP does not provide users with the data dumps they need to check them locally (offline) without submitting contributing more data to third parties in the process (e.g., working email addresses, associated search terms, associated originating IPs, etc.).

Further, users are not provided with transparency into what HIBP is doing i.e., what it is storing and how and where it is stored. Users cannot evaluate the security practices of HIBP as yet another online repository of sensitive user data that by virtue of its existence could be a target.

In summary, what he is not telling US Congress is that 1. "online services" or so-called "online tools", HIBP being one, are a major part of the problem and 2. there are alternative solutions, i.e., offline service and offline tools, and what HIBP provides is an excellent example of where an online service is unnecessary and is collecting large amounts of user data, unnecessarily.

Addendum: "What I'm telling you" is that I believe the problem is _data collection_. Any "solution" which collects data, and in this case data it is not supposed to have (e.g., a data breach), then collects more data (e.g., metadata) from users and finally asks users to trust the "new collector" is not a solution, IMO. Especially where the new collector shares no _technical details_ about his operation (e.g. storage of user data). This practice ignores simple, obvious solutions to the problem of data collection, such as performance of tasks offline which if performed online would likely lead to the collection of user data. It reinforces the mindset that perpetuates the problem: that data collection and trusting third parties is _always_ necessary.

<comment><USER33> > This is beyond the scope of what is needed to provide the service, namely, > copies of the data dumps available for download.

you're telling us that you'd rather that HIBP act as a clearing house for credentials and user information as a result of a data breach rather than exposing a single bit of information per user ("have i been pwned?")

I, at least, completely disagree with you, regardless of Troy's motives or any "monetary gain" he receives through HIBP. Troy has been incredibly transparent, and in fact talks about this very issue on his blog [https://www.troyhunt.com/here-are-all-the-reasons-i-dont- mak...](https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make- passwords-available-via-have-i-been-pwned/)</comment></comment>


Ask HN: Will the US suffer any consequences for its high Gini coefficient? - <AUTHOR> The US has the 4th highest Gini coefficient of OECD countries [1] although it's remained fairly stable since 1992, it does demonstrate a slight uptrend [2]. How might this affect life for most Americans, particularly the middle class?<p>[1] http://www.oecd.org/social/income-distribution-database.htm [2] https://fred.stlouisfed.org/series/SIPOVGINIUSA <comment><USER2> There is some evidence that income inequality raises the economic growth of poor countries and decreases the growth of high- and middle-income countries.

See for example this OECD Economics Department Working Paper [http://www.oecd.org/economy/growth-and-inequality-close- rela...](http://www.oecd.org/economy/growth-and-inequality-close- relationship.htm)

or this [https://voxeu.org/article/effects-income-inequality- economic...](https://voxeu.org/article/effects-income-inequality-economic- growth)

>Specifically, we find that, on average, a 1 percentage point increase in the Gini coefficient reduces GDP per capita by around 1.1% over a five-year period; the long-run (cumulative) effect is larger and amounts to about -4.5%.</comment>


Neuroeconomics: How what we know about the brain helps understand economics - <AUTHOR> http://www.project-syndicate.org/commentary/shiller80/English

<comment><USER2> Economics is affected greatly by the psyche of collective individuals. Most of the neurological research that is important to economics has already been conducted, but under the name of Behavioral Economics.</comment>


Tesla Motors wants another $250 million (IPO) - <AUTHOR> http://valleywag.com/357770/tesla-motors-wants-another-250-million <comment><USER2> Tesla has a great idea and product. What they lack is a solid mass- production/distribution system.

As much as I'd hate to see it, I think Tesla needs to be acquired by GM or some other American brand and then use their technology with their new owner's production and funding capacities to get the car to market. Current 2008 models have sold out, and they haven't produced any yet! to get one, you have to get on the 2009 waiting list, which should ship sometime in 2010, at this rate (Tesla is silent on anticipated delivery dates, I'm only speculating 2010 delivery). They're already producing and selling their battery system to Toyota I believe.

A Tesla - GM/Ford combo I believe would be what it takes to effectively compete against Toyota and Honda, who both already have the production capacity and electric cars in the works.

They could always partner with upscale car makers like BMW, too.

</comment><comment><USER3> I hope Tesla succeeds, but I wonder whether it's even possible for a new North American car company to succeed, regardless of their technology. With the falling dollar, maybe their odds have increased. And yeah, a Democrat president will likely make it easier for electric car companies. But we're only a couple of years away from Tata Motors cars, air cars, mass-produced DIY electric kits, etc. And in the midst of a recession, Tesla's cars are especially expensive! Brave souls, they are.</comment>


Ask HN: Programmer Job Crunch in SF? - <AUTHOR>

I caught a couple of mentions in recent threads about people having a hard time finding a programming job in the Bay Area. Is this a growing trend? I don't pay attention that closely but I've understood programmers to be in very high demand in the Bay Area for a number of year now.<p>If so, can anyone comment on the underlying factors that my be causing this? Enough supply now? Fewer jobs? Outsourcing? <comment><USER2> I haven't seen it amongst my friends (who, admittedly, are usually Googlers). Nor do I hear it from startup founders I've talked to, all of whom have complained that it is ridiculously difficult to hire good engineers.

It's possible that it could be that there are more marginal devs moving out to the Bay Area without many skills because they hear the pickings are good. If you can't program, you will find it hard to find a job as a programmer regardless of how good the market is. But anyone who's got a couple years of experience - or even if they don't, if they've done an iPhone app or a webpage as a hobby project - seems to have many options available.

<comment><AUTHOR> > all of whom have complained that it is ridiculously difficult to hire good > engineers.

Thanks. I guess I was mostly wondering if that trend is changing.

</comment></comment><comment><USER3> More context needed. An iOS engineer will spend different time on the market than a .NET developer.

<comment><AUTHOR> Thanks. Yeah, I don't have anything really substantial to add. I was just connecting some dots and wondered if there was an underlying trend.</comment></comment>


Seoul wants to ban Uber and build its own app - <AUTHOR> http://www.fastcompany.com/3033313/fast-feed/seoul-wants-to-ban-uber-and-build-its-own-app?partner=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+fastcompany%2Fheadlines+%28Fast+Company%29

<comment><USER2> Extensive discussion of this topic here:

[https://news.ycombinator.com/item?id=8063661](https://news.ycombinator.com/item?id=8063661)</comment>


Ask YC: What to do when VCs think opportunity/market is too small? - <AUTHOR>

Hi all, I've been a reader here since the beginning but never posted. Anyway, my question:
1. I am the 100% owner of company X, several others are involved, but not full time.
2. X has generated $100K revenue in FY1 and is $60K since new fiscal 7/1.
3. I have not paid myself a dime yet, because I can afford to live off savings and business needs the revenue for R&D, marketing, etc. 4. X is the recent winner of a major CA-based business plan competition - $100K prize. 5. VCs are sold on the pitch -- product, team, competition, IP, everything. They like it.
The problem is this: Even with a $4.4B one-time revenue and $1.6B recurring annual revenue market, they think the opportunity is too small. Due to the revenue X is generating, capital needs are much smaller because each customer added means substantial revenue. However, the market is not as small!
To quote one VC: "If we put $1M in and we realize a fantastic return of 20x, that's still a small bet for us. We chase bigger opportunities".
So I'm thinking angels are a good idea, but the angel groups seem too process-oriented: several months to get considered, lots of structure, very few deals invested in and usually not over $500K. Further, I'm hearing that Silicon Valley based angel groups are highly biased towards local investments -- X is run out of Los Angeles.
My quandary is: how do I raise a smaller amount of capital from smaller funds or angels, at a fair valuation given current traction, without a lot of network to start with?
I've gotten introductions through the competition we won and VCs, but things haven't panned out substantially yet. Disclaimer: I've only been at it for a few weeks and lots of avenues still cooking, but I'm just looking for YC advice on fundraising related to smaller capital needs.
Any comments ? <comment><USER2> You have revenue coming in! This makes you eligible for loans, especially once your business is two years old.

</comment><comment><USER3> Angels don't usually donate huge sums of money, 500k is actually higher than I had heard of.

Your income + growth should give you a fairly healthy valuation, even if your market cap is 'only ~4B + 1.6 annual'. It does take a lot of time, but one good option could be getting together a group of angels willing to invest together. It will strengthen all of their individual investments knowing the total investment is quite a bit larger, and it will give you guys the running start you need to grow quickly. It really looks like now is the perfect time for you to take some money (without giving up everything due to your track record) and grow this company.

Best of luck.

<comment><AUTHOR> Bingo - dead on; I couldn't agree more. Now where do I find these guys ? :) I think that is the root of the problem.

<comment><USER3> If I was offering that service, I would be charging for it. :)

</comment></comment></comment><comment><AUTHOR> -need it for a sales force definitely and maybe one ops head, engineers won't be necessary for a while.

-no investor has shown any problem with the team. the company is extremely well advised for its space and has lots of people putting in time here and there.

-business has too much traction to pull an unknown cofounder right now and don't know anyone who is willing to jump off the cliff without money

-i am willing to talk to anyone seriously interested in investing, but this is a pretty public forum and I don't want to reveal company details here.

</comment><comment><USER2> Also -- if you are hoping investors will contact you based on this post, you need to post your email address here or in your profile. The email address box in the profile is for YC internal use only.

</comment><comment><USER4> Not all VC's are like that... I posted a question about a week ago about Disqus a YC company... and asked how big was the market for YC to be interested in the company and invest in it

this was pg's response: "... I have no idea how big the market is in dollars. It's not worth thinking too much about anyway. Startups evolve. It's enough to start with something you know people need."

<http://news.ycombinator.com/item?id=77608>

<comment><USER5> That may be true for YC which does seed funding but the model for VCs that invest large sums of money is based on the home runs and if you can't show the hope for a home run, they'll probably not be interested.

<comment><USER4> of course, if you are not looking for seed funding (or angel funding) and looking to raise a serious series A then you will have problems... but I think if your market is in fact not too big, then you must avoid raising too much money, since there are only two scenarios where you'll actually be able to raise that much money for a project like this:

1- you raise money from an idiot, i.e. someone that really doesn't know what they are doing. You are _always_ better off not doing that no matter how much they give you

2- you can prove the idea will work, and you can gain the trust of the investor in you and your team. In this case you _might_ be able to convince a good VC to invest in the company but you will then have to give up the majority of your shares in the company

If the market is in fact not that big, why would you have to raise so much money! do you think its reasonable! And if no VC out there can tell how big this market really is or how good the potentials of this business (which is already making money, a rare case!) then maybe there is something theyoungceo can't see, and maybe its really not as big as s/he thinks it is

Anyways, I have a feeling this post is a bit about possibly finding some potential investors rather than getting advice. Which is fair, but not sure if these advices are really what the theyoungceo is looking for.

Also why is the name of the company not mentioned? (specially that the company is already out there and doing business!)

<comment><AUTHOR> The market doesn't need to be a quagillion dollars to need sales and ops guys; I still dont' quite understand the point of "sizing a market" -- I have already proven that there are plenty of people who want the product badly out there, and always thought that would be enough. No matter what you invest at what percent, this one has a lot of proven traction already and is more likely to be a winner than most deals (I think). I think what I'm getting at is the question of: what do you do if the VC model just isn't quite right? It seems everyone assumes there is no business growing with them.

Also: -theyoungceo isn't naive enough to believe that investors are scouring news.yc for deals, although he'd love to be proven wrong. -i didn't mention the company name because i know everyone knows everyone in SV and it might be unprofessional to be discussing this here from an investor's perspective (IMHO)

<comment><USER6> There are a lot of organizations looking for investment opportunities. If scalability matters I'd find a more established company in your field and try to get them on board.

</comment></comment></comment></comment></comment><comment><USER7> I haven't been in your situation, so please consider my comments accordingly, but if you're doing well can't you continue to grow the company organically? Can your business plan prize fund R&D and marketing for the near future?

I don't know your situation, but is it possible you're trying to move at Silicon Valley, light-speed pace when it might be more beneficial to throttle back a bit?

I'd think with your continued success the money would soon be chasing after you.

<comment><AUTHOR> optimal -- yes, and this was my longstanding position. I have had a lot of bugs put in my ear like "if you just took some funding, this could explode very fast, speed of acquiring customers will be key". I fall somewhere in the middle: I think it's a good idea to take a _small_ amount of funding to get some sales hounds on board, because I can't do sales by myself and I'm not a fantastic salesman. The product has been winning so far based on its own merit -- competition is really terrible, and people are hearing about it word of mouth and contacting me.

<comment><USER7> I'm sure you know this better than I do. There are just so many stories of companies that implode before their time, or get devoured when the piranhas come around.

Anyway, congratulations and good luck!

</comment></comment></comment><comment><USER4> @theyoungceo: you could always try to convince someone that has better connections and influence than yourself (like pg and others like him) to make a small investment in your company, but in return s/he could def help you to raise the funding you need a lot easier (if possible to raise it at all for this company)

</comment><comment><USER8> how much money do you need? what will you need it for? engineers? a sales force? etc. what still needs to be accomplished?

1) look at <http://venturehacks.com> to get a better understanding of how the fundraising process works and tactically how to raise interest. investors also generally want a team in place, not one person plus some part timers.

2) if you can talk more about your company, the audience here has some rich individual investors here who wouldn't put you through the bullshit that angel groups would, and even more people who, if not rich themselves, are one degree of separation away from potential investors.

</comment><comment><AUTHOR> Banks say they won't loan more than 15-20% of revenue. SBA will guarantee and might be able to get loans up to $250K, but that requires a personal guarantee -- if for some reason something goes wrong, I don't want to be personally bankrupt.

</comment><comment><AUTHOR> firstname.lastname@example.com will come direct to me for offline chat...I can discuss the business one on one but I'm wary of posting details publicly -- however open discussion here is definitely encouraged.</comment>


RediSQL, Road to ~50K inserts per seconds - <AUTHOR> http://redbeardlab.tech/2017/05/10/redisql-road-to-50k <comment><USER2> Love the idea around this. This provides an easier more powerful wrapper for querying complex datastructures. With this package we can start using redis differently.

</comment><comment><USER3> Cool post on optimization but Why use SQL for Redis when the query execution is entirely different? Seems like this would promote O(N) queries

</comment><comment><USER4> I think i don't get the purpose of it?!</comment>


Should We All Take a Bit of Lithium?(2014) - <AUTHOR> https://www.nytimes.com/2014/09/14/opinion/sunday/should-we-all-take-a-bit-of-lithium.html <comment><USER2> The article does not mention any side effects of low-level lithium. Is it known?

<comment><AUTHOR> apparently its an essential trace mineral. this is news to me.

[https://www.psychologytoday.com/us/blog/evolutionary- psychia...](https://www.psychologytoday.com/us/blog/evolutionary- psychiatry/201201/could-you-have-lithium-deficiency)

[..]Scientists first figured out lithium could help stabilize mood in bipolar disorder in the late 1800s when the mineral salt was also used to treat gout. Lithium was the original "up" ingredient in 7-UP soda, though I'm certain it is not in the modern recipe. The first research paper on lithium didn't appear until 1949, when Australian psychiatrist John Cade made his mark on psychiatric history. However, Greek physicians thousands of years earlier were treating mental disorders with mineral water now thought to be high in lithium.[..]</comment></comment>


Science finds animals that can live without Oxygen - <AUTHOR> http://news.sciencemag.org/sciencenow/2010/04/scienceshot-animals-that-live-wi.html?rss=1

<comment><USER2> Who is this Science? And where do they come from?

<http://news.ycombinator.com/item?id=1248732>

<comment><USER3> Here you go: <http://www.weebls-stuff.com/toons/science/>

</comment></comment><comment><USER4> Where by "animals" they mean multi-cellular organisms.</comment>


Ask HN: Which apps are on your phone? - <AUTHOR> <comment><AUTHOR> Other than the default Google apps, I use a dozen.

Currently, I have discord, vivaldi, screen recorder, fasthub, home workout, cardio, wireguard, bitwarden, boost, Amazon music/audible/store, signal, pharmacy apps, and nextdns.

The rest are one off that I forgot to install or have limited purpose such as instaclean for removing spam mails.

</comment><comment><USER2> \- signals \- Gmail \- Lockdown \- manyverse \- PictureThis \- slack \- teams \- GitHub \- Amazon Shop</comment>


Strategies for Offering Discounts Without Tarnishing Reputation - <AUTHOR> http://blog.instantq.com/?p=12

<comment><USER2> Wow. way to assume your customers are stupid, and to focus on appearance over substance.</comment>


Logitech will intentionally brick Harmony Link devices next year - <AUTHOR> https://www.techspot.com/news/71776-logitech-intentionally-brick-harmony-link-devices-next-year.html <comment><USER2> I still don't get how this can be legal. I understand that it is up to the consumer to repair the devices when they break due to cheap components (which are only meant to last one or two years) and are out of warranty, but if a company knowingly destroys your goods (via a software update) which is 100% intentionally and there is no way for you to fix it (either via a self hosted solution or any other solution) just sounds criminal to me.

I hope that one of these days, a laysuite will be filed against any of those companies which sets a precedent how to handle those situations.

<comment><USER3> I believe it's not quite an "intentional bricking" in the sense that Logitech sends out a suicidal ROM update. What's going on is that the product depended on a cloud service for its core functionality, and now that service is being discontinued.

This is the double-edged sword of the convience that cloud-powered products deliver. You're not buying something that will last decades. You're buying a service and the hardware to utilise that service.

<comment><USER2> Maybe I'm not getting the function of this device but what does it need the cloud for? This is just a fancy remote with app support. It really should not rely on any could server expect for updates maybe. The app should just connect to the remote using the locale network.

My Apple TV does not need internet either. I can still stream media to it using any device on the locale network (which is what I use it for mostly anyways). Sure the "apps" do not work without internet but I have never used them anyways (I always stream them using my iPhone) so even if Apple shut down the old Apple TV, I can still use it just like before and only use the function partially.

If they have such heavy (and unexpected) cloud dependencies, they should warn consumers and (even better) put an expiration date on them, and say which functions are required for them to work. I remember that Nintendo games used to have a disclaimer if the game needed internet to work with (either partially or at all). This way parents (and the store clerks) can better help the consumer understand what is required to play the game and understand how it can be played without internet.

</comment></comment></comment><comment><USER4> What a terrible move. If I had bought it I would definitely want a full refund, no discount.

This is really disappointing because I used to love Logitech the company, am friends with the founders and in general always thought of them as an example of a business done right.

I'll mail Daniel to see if I can persuade them to put the emergency brakes on this decision, I can see a very bad PR debacle happening if they do not undo this decision.

<comment><USER5> > What a terrible move.

The more terrible thing is the whole system's design made this actually possible. An electronic soap dish lying under the TV should not depend on internet access to just do its work. Though nobody thinks about it nowadays and everybody is happy to switch songs played by music centre with their iPhone.

<comment><USER3> Home automation suffers from the same problem. I'm hard-pressed to find a home automation hub that doesn't require "the cloud." You mean to tell me turning on the lights 5 feet away _requires_ I go through some North Carolina data centre some 800 miles away? This frustrating trend is over-engineered and insecure.

<comment><USER6> I wasn't able to find a cloud-less home automation solution. Ended up going the semi-DIY route and installed Home Assistant on a Raspberry Pi. It's not plug and play, but it beats having to rely on some cloud solution that'll disappear whenever the manufacturer feels like it.

</comment></comment></comment></comment><comment><USER7> As if I didn't already need another reason to absolutely distrust Logitech.

I've already seen the company's failure to honour warranty obligations.

[https://ello.co/dredmorbius/post/5y-ggnul129j7mogblrsmg](https://ello.co/dredmorbius/post/5y-ggnul129j7mogblrsmg)</comment>


Is unit testing doomed?  - <AUTHOR> http://www.thestandard.com/news/2008/08/11/unit-testing-doomed <comment><USER2> I would not say so (and the article itself presents several compelling arguments) - developers & management just need to change their attitude a bit. Getting defensive about one's code is as old as "hello world" itself and once that is brought under control and the developer starts seeing the code as a "user" would - good unit test plans usually result. The benefits of unit- testing are easy to understand but difficult to quantify which is why management in its TTM focus tends to overlook it - you need a believer in the ranks to champion that cause. Fortunately there are plenty of those around so the questions / calls are a little premature.

<comment><USER3> _you need a believer in the ranks to champion that cause_

Nah, you need an entire project that is demonstrably better executed than another and that attributes its success to unit testing (or whatever). This is where evangelists fall down. They shouldn't preach until they've gotten something tangible to show.

<comment><USER4> _demonstrably_

Not gonna happen. There are too many variables to control, and it's impossible to run the same project twice, let alone repeatedly. People with opposing beliefs will never be convinced by such a "demonstration"; they will simply find some detail or other to justify what they already believe.

The empirical literature on software projects is downright feeble. Meanwhile the programming culture is very rich in anecdotes and folklore. I find that suggestive.

<comment><USER3> Yeah, it's funny, I mean say McDonalds their whole business hinges on how quickly they can cook burgers, but no-one there would ever consider under- cooking as a way to speed things up. So the average software project manager is not even as smart as the average burger flipper.

</comment></comment></comment></comment><comment><USER5> The advantages described by the author here are the same ones you always hear in discussions about the benefits of unit testing (bugs are caught sooner, you feel better about your code, etc.)

The _real_ benefit to unit testing (at least from my experience) is that it encourages you to write better code up front. By thinking in terms of the smallest possible units, you don't bite off more than you can chew. As a results, your code tends to be more decoupled, more modular, and more logical (unit testing helps you organize responsibilities in your code).

For this reason, even if I had to delete every test I wrote after I made it pass, I'd still write a failing test before writing any implementation code. Of course I'd much rather prefer to keep my test suite, since it does provide the benefits discussed by the author. While no amount of unit tests will reveal _every_ bug in your code, the quality of code I've written after writing a failing test first is vastly superior to code I've written sans- test.

Your mileage may vary, but if you haven't tried it yet, I suggest you give it a whirl.

</comment><comment><USER3> I'd be willing to bet that a class of problems caught by unit testing in Ruby/Python simply don't exist in Java due to its strong typing.

Of course the flipside of that is that Java's design patterns aren't nearly as important in Ruby/Python as they have functional programming capabilities out- of-the box. Swings and roundabouts.

<comment><USER6> _"... I'd be willing to bet that a class of problems caught by unit testing in Ruby/Python simply don't exist in Java due to its strong typing. ..."_

And I'd say an absence of errors does not mean no errors exist. While I don't advocate unit testing as a cure to defects it is comforting to make changes on a system and know you don't break something because of coverage.

<comment><USER3> If your language is strongly typed and purely functional, a whole lot of stuff that is taken for granted these days (e.g. design patterns, unit testing) become a lot less prominent. People forget the Old Ways at their peril! :-)</comment></comment></comment>


Ask HN: A Survey of Game AI techniques? - <AUTHOR>

I'm looking for introductory material on AI as it is used in games (so not 'real' AI).  Specifically, I am not looking for a how-to on a particular high level tool or an in-depth monograph or thesis paper on a particular algorithm or method.  Rather I'm looking for a sort of high level survey of what's being used, how it's used, and the various strengths and weaknesses these methods have been found to have.  Some sufficient to give me foundational knowledge but not necessarily enough to go re-implement on my own.<p>I would prefer a video with accompanying text, as I have found I learn things better this way.  But I recognize that beggars can't be chosers :) <comment><USER2> Check out: "AI for Game Developers " <http://shop.oreilly.com/product/9780596005559.do></comment>


Ubuntu Xenial bcc/BPF - <AUTHOR> http://www.brendangregg.com/blog/2016-06-14/ubuntu-xenial-bcc-bpf.html <comment><USER2> Those are some sketchy install instructions. Add a trusted apt repo to some random ip address that doesn't do package signing? Not cool.

Setup a PPA, its really not that hard.

<comment><USER3> Yes, we're going to get this setup as an Ubuntu snap, and should get moved to the regular package repos as well.</comment></comment>