Ask HN: Online Class or Resources To Learn PHP - <AUTHOR>

I've recently joined a startup run on Wordpress (the core focus of our product is not technical). I'm mostly in a marketing role, but it would be useful for me to be able to modify the site.
My programming experience is working through the C Programming Language, taking Udacity CS 101, and finishing most of Michael Hartl's Rails Tutorial.
Are there any good, similar resources for PHP? I'm not at the level where I can just read the docs and learn.
I checked Codecademy, Code School and Udacity, but they generally just teach Ruby and Python.
Any suggestions? Thanks <comment><USER2> I started learning PHP in W3Schools (<http://www.w3schools.com/php/default.asp>) for the basics. But after I got a hang of the syntax, I started a PHP project and just search in for some things I need. Mostly, stackoverflow got the answer for me.

I'm not a big fan of those step by step tutorial. I usually get into it just for their syntax. In my opinion, the best way to learn a language is to implement an application using it.

Good luck learning PHP!

</comment><comment><USER3> How about this: <http://thenewboston.org/list.php?cat=11>

Disclaimer: I've never gone through his tutorial series but others seem to think highly of him. I've work in PHP previously but most of the tutorials I went through are several years old...

<comment><AUTHOR> Thanks, I'll take a look. Looks comprehensive.</comment></comment>


Ask HN: Building a side project that makes money. Where to start? - <AUTHOR> I want to build a side project. Especially, one that makes money. Even if it brings in $100, I feel that it will provide more satisfaction than my current job.
I can code in python with some help.
Can you provide some ideas on where to start? What are some simple things I can build by myself? Any ideas? <comment><USER2> I would recommend finding an existing market. By that find something that already exists and has paying customers. If they have hundreds of reviews or if there is a forum where the product or service is actively discussed go there. Look for one or two common problems that paying customers have that is not being addressed. Try to make a product that is similar but solves those one or two problems.

Then work your way nicely into the forum and be helpful. Only after some time, suggest your product as a solution.

</comment><comment><USER3> Do you have any hobbies? If so, what is the king you wished you had for that hobby. Make it for yourself, then sell it too.

Mine was making cool gifts for people. Now I have a art-piece that I sell: www.finewordclocks.com

It's not a lot of revenue but it's fun, gives me an excuse to buy cool "toys" aka tools, and I get to teach my Kids about making cool things with fancy tools.

</comment><comment><USER4> The archive[1] of the video content from YC's "Startup School" is freely available. There's some really good content there that would probably help you a lot. I'd suggest go through those, and just skip the ones that obviously aren't relevant to where you're at (like the ones on fundraising, hiring staff, etc.). The ones about "product" issues would likely answer a lot of your questions.

The other thing I'd suggest is to read _The Four Steps to the Epiphany_ by Steve Blank - or the follow-on / 2nd Edition, which was re-titled as _The Startup Owner 's Manual_. They're the same book in a sense, but they're different enough that I'd actually recommend reading both eventually. But personally I'd still start with TFSTTE.

[1]: [http://startupschool.org/library](http://startupschool.org/library)

</comment><comment><USER5> [https://indiehackers.com/products](https://indiehackers.com/products) has a list of apps that earns money. If you want to skip through those market research work, you can clone some of the profitable apps there, maybe with your own little twist.

If you are willing to do the market research work, pick an audience (say, python developer, since you are one and understand it most), find out whats their problem (maybe setting ENV? maybe setting up a server to deploy to?) , and start from there.

</comment><comment><USER6> Start by finding a small group of people that have a problem that you might be able to solve by writing python scripts or a simple web app perhaps built with flask. Joining a few meetups or online forums or looking for problems in your current job may give you an idea of how to connect with these people. Then it is a matter of throwing together the simplest possible app that could address the main issues these people are having and going and talking to them to see if they would pay for it and adjust your product based on their feedback

</comment><comment><USER7> This doesn't really answer your questions directly, but it's something that I've learned the hard way over the years: start small and fail early.

Don't spend hundreds of hours on ideas before you know if it will work or not. If your intention is to make money, make the smallest MVP you can to start testing if it has real potential. If it clearly doesn't work, move onto the next idea.

</comment><comment><USER8> I run a side project that earns $500-$800 per month and my intention was to make something useful for myself. Never thought of money. You should not think of money first. Only think of usability. Think about money later.

<comment><USER9> Link ?</comment></comment>


Linux cgroups v2 - <AUTHOR> https://github.com/torvalds/linux/blob/master/Documentation/cgroup-v2.txt <comment><USER2> How is it different from v1? Why was v2 necessary?

<comment><AUTHOR> It's actually a substantial re-write. They got rid of multiple hierarchies, in other words a process can now belong to only one cgroup. Threads cannot belong to cgroups different from their parent anymore.

v1 was okay given that slicing the system into partitions was rarely needed outside of VPS service provider use cases. Then container goldrush happened and user applications started using cgroups in earnest exposing some design shortcomings, or rather excessive flexibility.

<comment><USER3> As someone who maintains a container runtime (runC) I don't really agree with the statement that v1 had too much flexibility. Sometimes you want to have different resource pools for different resources. That's a useful feature. And while I understand the reasoning of the no internal process constraints, there's just some issues there that just make life annoying (you have to create two subtrees if you actually just wanted to make one). The reason some of these constraints and requirements came about is (IMO) because of bugs in cgroup controllers and the maintainers of the controllers didn't want to fix the bugs (for example, the CPU controller would weight processes in an internal node differently to processes in leaf nodes).

However, the fact that you can only have one hierarchy is a good thing (it makes container setup much nicer). Too bad that systemd will probably assume that it should own the root hierarchy (which will probably result in countless conflicts with container runtimes that don't buy into nspawn).</comment></comment></comment>


Y Combinator startup Scribd raises VC and creates secret jobs page just for news.ycombinator readers - <AUTHOR> http://www.scribd.com/static/newsyc <comment><USER2> This is a great opportunity for someone. Scribd has lots of potential for getting very big and it's still so early.

I think it would have been more hackerish if they made their normal jobs dynamically display alternate text for requests that include a news.yc Referer.

</comment><comment><USER3> Considering it appeared on ValleyWag, it's definitely not a secret anymore =)

</comment><comment><USER4> The coming battle: Google Search + Google Desktop VS Scribd :)

<comment><USER5> Scribd _is_ obvious google-bait. Google's "all the world's information" bit makes something like scribd almost irresistible to them. Of course, google may try (and/or succeed in) rolling their own, first.

But kudos to the scribd guys for delivering a simple twist on Napster/Flickr/YouTube (share music/photos/video) that no one else had done. I expect they'll do very well out of it.

</comment></comment><comment><USER6> This is not Google bait. This solves no real problems.

</comment><comment><USER7> awesome!</comment>


Why Every Language Needs Its Underscore - <AUTHOR> http://hackflow.com/blog/2014/06/22/why-every-language-needs-its-underscore/ <comment><USER2> Being a Ruby developer for quite a while, Underscore.js always struck me as an attempt to bring some of the native functionality of Ruby into the language that had none of it. Internal iterators being the most immediate example.

Problem is that Javascript lacks a lot of the things programmers need at hand. So they write stuff to complement that deficiency. I write in Dart as well and can tell you I love it precisely because it provides better OO capabilities through its core.

Which really brings a very important question to the table: what should be a part of the language and what shouldn't. A Unix minimalist in me wants a language to be as small as possible. But then when you actually start writing code, you mostly want simple things done without having to import new libraries.

<comment><USER3> It's not a coincidence that Underscore looks like Ruby, its creator has a Ruby background and similarly developed CoffeeScript along those lines. (Both of which are perfect for me as someone who uses Rails on the back-end.)

Yes, JavaScript never had anything resembling a decent utils library, so an elegant and popular implementation like underscore was heaven when it arrived. It's the usual problem of browsers evolving too slowly and fragmenting too much for something like Java's collections to emerge as a standard.

The situation has gotten better now, with even IE moving towards auto-upgrade, but it's still not feasible for JS core to ship with large, frequently- updated, JS libs. The closest thing is Node's standard library, but that's not going to be ubiquitous in browser's anytime soon.

"what should be a part of the language and what shouldn't"

In the absence of a standard library, you end up with a dozen competing libraries trying to fill the void, and that stifles end-user applications.

We saw that a few years ago with the DOM. For the first ~8 years of JS, there was no significant DOM library, so app developers had to suck up the unfriendly raw DOM API. Then the toolkits started to emerge, giving way to huge fragmentation between jQuery, Prototype, MooTools, Dojo, and YUI. Suddenly libraries were jQuery plugins or MooTools plugins and your app was using the jQuery stack or MooTools stack. So the next 8 years of JS saw vast effort duplicated as developers built parallel libraries for each toolkit.

So I think the answer is to launch a language without the kitchen sink, but watch the community and gradually standardise useful functionality as the need emerges and adapt popular open source libraries as they becomes popular. Java did this well in its heyday. In JS's case, a lot of the DOM conveniences are now becoming core JS, but the nature of JS means libraries move slower than other languages.

<comment><USER4> >the nature of JS means libraries move slower than other languages.

prior to node and npm maybe. The JS npm ecosystem is actually growing faster than any other language's module/library system, it's on the cusp of becoming #1 in the world. [http://modulecounts.com/](http://modulecounts.com/)

</comment></comment></comment><comment><USER5> Maybe it's just me, but I find:

      d = {}
      for k, v in request.items():
          try:
              d[k] = int(v)
          except (TypeError, ValueError):
              d[k] = None

much easier to read and understand than:

      walk_values(silent(int), request)

I need to find our what the "silent" attribute does and I'm not sure what type of errors are caught here. Although I'm all for hiding implementation when it's useful, I find it counter-intuitive to do it at this level in python, it makes things harder to read.

<comment><USER6> I feel like this is why types have such a benefit in Haskell. This would be typed

        walkValues :: (v -> a) -> Map k v -> Map k a
        silent     :: (inp -> Either e a) -> (inp -> Maybe a)

Here, `silent` is the contextualized version of a really standard error- ignoring combinator which simply throws away the additional error details conveyed in `Either`.

        silent'    :: Either e a -> Maybe a

`walkValues` is an extraordinarily common function usually called `fmap` and its existence tells us that `Map` is a `Functor`

        instance Functor (Map k) where
          fmap = walkValues

Ultimately, this pattern is really common and would be written in Haskell as

        fmap (silent' . int)

The types ensure it cannot be used incorrect. The notion of `Functor` happy compresses all ideas of "mapping" such as what walk_values is doing.

<comment><USER7> I love Haskell, and I totally agree with you, but I don't think you're making much of a case to people who don't already know Haskell. I'm pretty sure everyone who doesn't grok Haskell reads your post and thinks "Ah there's another Haskell weirdo spouting some weird syntax incomprehensible code."

So for them: What tel is saying is that in Haskell you annotate your functions with type information (and if you don't the compiler will generate the info for you), which gives you an immediate understanding of what moves into and out of a function, often making it easier to understand what a high level function does.

<comment><USER6> Additionally, the reason why we have weird typeclasses is that they cut such a wide swath of abstraction that you usually can recognize common functions for various types and minimize the number of things you must memorize.

<comment><USER8> It's so simple! Thanks, tel!

</comment></comment></comment></comment></comment><comment><USER9> I don't disagree with the main point, but Python already has quite a bit of this. A more pythonic version of the first example:

        @retry(DOWNLOAD_TRIES)
        def download(url):
            ...

        images = [download(u) for u in urls]

To check if a sequence x is ascending, you can use standard library functions:

        all( t[1] > t[0] for t in zip(x[0:-1], x[1:]) )

<comment><AUTHOR> Just

        zip(seq, seq[1:])

Won't work with iterator though.

<comment><USER10> itertools.islice would work.

<comment><AUTHOR> No it won't, unless you `tee` an iterator first.

<comment><USER11> FYI, the official documentation of itertools has its very own pairwise example:

        def pairwise(iterable):
          "s -> (s0,s1), (s1,s2), (s2, s3), ..."
          a, b = tee(iterable)
          next(b, None)
          return izip(a, b)

[https://docs.python.org/2/library/itertools.html#itertools.i...](https://docs.python.org/2/library/itertools.html#itertools.izip)

<comment><USER12> for the record: the official itertools docs have a lot more examples than this one and they're all really worth knowing about if not studying.

</comment></comment></comment></comment></comment></comment><comment><USER13> What this article also nicely illustrates is the tradeoff between readability and compactness. As a generally experienced programmer I can easily read the original versions and I can also easily imagine how I would make similar improvements in a language I'm very familiar with. The condensed Python version is only comprehensible to me after reading the rest of the article.

Is there value in code that's readable by non-experts? Sometimes yes, more often no.

<comment><USER14> > tradeoff between readability and compactness

What do you mean by "readability" exactly? Can you provide some kind of definition for what "readability" is? Can you point me in a direction of _any_ research on "readability" (in programming) and it's impact on programmers' productivity?

Sorry for the OT, but this is a pet peeve of mine: we have no way of defining, let alone measuring "readability" in any meaningful way, yet people, including even experienced programmers like you, talk about "readability" as if they knew what it is, how it looks like and as if it was some universal feature of physical world like force or speed.

<comment><USER15> > Can you provide some kind of definition for what "readability" is?

Sure. In this particular case, your parent considers an algorithm "readable" if it can be readily understood by someone who is _not_ familiar with the particular language being used, and is _not_ experienced with Lisp-style languages, but _is_ experienced with ALGOL-style languages.

That's not a universal definition, but at this moment in this path-dependent world it's a reasonable thing to consider.

<comment><USER16> I think in most cases a working programmer should be able to write code under the assumption that it will be read and maintained by people who are familiar with the programming language being used.

<comment><USER14> I think you missed GP point, which I believe was that "you can write Fortran in any language". Or more precisely that you can know a language very well, but that won't help you much if you are confronted with unfamiliar idioms and patterns you don't know.

</comment></comment></comment></comment></comment><comment><USER17> Interesting that all the examples were monads. There is another level of abstractions waiting behind the abstractions in Underscore.js.

</comment><comment><USER18> Heh, might as well just use another language at this time. Guido himself seemed to be very pissed off at the common lispers for being forced to add some functional language features. You can see it from the crappy implementations of single-arity lambdas, non lazy map, filter, reduce, etc. The language will never catch up to the times, as evident in the lame feature list in python 3. Most python users seem blissfuly ignorant of modern languages and Guido doesn't seem to like learning new stuff either.

<comment><USER19> I'm also out of love with python for similar reasons, but please note that map is lazy in python 3.

        >>> map(lambda x: x*2, range(100000000000000000000))
        <map object at 0x104792240>

<comment><AUTHOR> It's not lazy, it returns iterator. There is a difference, you can't slice or index its result anymore. Compare to Clojure or Haskell map, which are truly lazy.

<comment><USER20> Is it true that this is O(1) in Haskell? (Making up function names but you get the idea)

        (fmap a function anArray) `get` n

?

How does fmap construct its value?

<comment><USER21> How fmap constructs it's value depends on how that type implements the functor typeclass I believe.

</comment></comment></comment></comment></comment><comment><USER22> I think the biggest point why python does NOT need underscore is that python has pip and for almost every problem exists a simpler helper library.

Probably _the_ reason for underscore is that it can be distributed via CDNs and cached by the browser. This reason does not exist for other languages. If i want to retry stuff i can use a retry library, easily downloaded via pip. Same as i use argtools because argparse sucks. Same for database access, etc. etc.

</comment><comment><USER23> In all of those python examples the non-underscore code was much more easy to read. We can save the extreme compactness for the IOCCC.

<comment><AUTHOR> It's easy cause it's familiar. But it's not simple.

This excellent talk by Rich Hickey explains the difference [http://www.infoq.com/presentations/Simple-Made- Easy](http://www.infoq.com/presentations/Simple-Made-Easy)

</comment></comment><comment><USER24> I feel like under score just makes your code compact. They're also ignoring that I might want to be doing input validation while iterating over those lists. Forcing me to add a loop right after that very compact code and nullifying it only purpose. Then on top of that ill need to add comments to explain the compact and cryptic code.

I really don't see the benefit.

<comment><USER25> You don't have to add a loop to do your validation:

        if not all(is_valid, the_values):
            inform_user("You supplied bad data")

Or perhaps

        bad_values = select(is_not_valid, the_values)
        if some(bad_values):
            inform_user("The following values were bad", bad_values)

Yes, sometimes you might want to do several things in a single iteration for reasons of efficiency, but in that case you can compose() the functions representing the per-element operations.

This code is only "cryptic" to people not used to functional programming. If the intended audience is the set of everyone who knows Python, using these abstractions will reduce the number of people who understand the code. If it's your startup's team of three programmers, there's a good chance the time saved is worth the learning curve.

</comment></comment><comment><USER26> Strikes me as more of an argument about why Python doesn't need an Underscore library, given its expressive syntax.

<comment><AUTHOR> It doesn't need direct port. But it can take advantage borrowing ideas or library design principles.

<comment><USER26> I won't belabor the point, but I think these concepts in Python (and Ruby) influenced the design of Underscore, not vice versa.

<comment><USER6> Or that they all took influence from a bunch of languages from the 70s like Lisps and MLs

</comment></comment></comment></comment><comment><USER27> No idea how but I'd managed to miss underscore.js up to this point (this is one of the things that drives me crazy when I have to move into a domain that is adjacent to mine I never know if I'm doing things the best way).

This is going to make things much simpler for me working on the client side.

Nice!

<comment><USER3> You may want to check out Lo-Dash too ([http://lodash.com/](http://lodash.com/)). It's a drop-in replacement for Underscore with some extra capabilities and claims to be faster and more reliable. It's become a major project in its own right now.

<comment><USER28> Also there is lazy.js which is even more faster than lo-dash especially when chaining multiple methods. [http://danieltao.com/lazy.js/](http://danieltao.com/lazy.js/)

</comment></comment></comment><comment><USER29> Debugging underscore's endlessly created anonymous functions can be quite painful, leading to huge, nondescript stacktraces and sometimes straight crashing the debugger. I have ripped it out of multiple projects and found performance gains and much better readability. It seems like a great idea but in practice native features are usually better. Only in certain browser cases are certain underscore methods useful.

<comment><USER30> On the flipside - I've never had to suspect _ for being the cause of a problem.

That's a huge benefit. I actually spend less time debugging. I've reduced my program to data manipulation strategies. If I get something wrong, it's because I did my logic wrong, not because I typoed in a nested for loop somewhere.

In fact, when I happen upon code that isn't using underscore, it tends to be really long, loaded with unnecessary state and memos, and is very fragile and not easy to reorganize. One of the first things I do is start utilizing underscore. Once you get used to the extended language, you can do things like convert 200 lines of code down into a few lines. It frees your mind up to think about other things (which, for me, is the single most important thing in programming).

I suggest learning to love the higher order data flow abstractions.

Edit: I also suggest you utilize breakpoints ability to backwards through the call-stack (at least in DevTools), within the 'Breakpoints' tab, when paused, you will see a trace which you can click through, and be plopped into the scope of that execution as if you had a breakpoint anywhere along the chain of function calls. Even if the function is anonymous, you're interacting with it and so it shouldn't matter as much.

</comment></comment><comment><USER31> IMHO, if the program logic is essentially to loop over some steps, it had better be written in the form of a loop over some steps.

<comment><AUTHOR> OTOH, if the program logic is mapping a sequence, then you better use map() on the sequence.

<comment><USER31> Sure, I agree. If the "map" verb is in your vocabulary, and it is the very right verb to use, why not?

Just, if possible, please make sure it is easy to find out how the map() is actually implemented (like please don't hide it deep in a language runtime).

</comment></comment></comment><comment><USER32> Although underscore.js is more widely-used, I think sugarjs.com is an improvement and makes the syntax much nicer.

</comment><comment><USER33> It would help to give an explanation of what underscore is besides saying it "makes life better." I am an avid python user and have never heard of Underscore.js. Thought this was an article about semantic underscores in Python, or underscores as used in variable names (which I dislike) :)

<comment><USER19> It's a utility library for JS. Consider that the article mentions Python's itertools and functools as equivalents. [http://underscorejs.org/](http://underscorejs.org/) does a good job:

"""

Underscore is a JavaScript library that provides a whole mess of useful functional programming helpers without extending any built-in objects. It's the answer to the question: "If I sit down in front of a blank HTML page, and want to start being productive immediately, what do I need?" … and the tie to go along with jQuery's tux and Backbone's suspenders.

Underscore provides 80-odd functions that support both the usual functional suspects: map, select, invoke — as well as more specialized helpers: function binding, javascript templating, deep equality testing, and so on. It delegates to built-in functions, if present, so modern browsers will use the native implementations of forEach, map, reduce, filter, every, some and indexOf.

"""

<comment><USER33> Yeah, I figured that out. I just didn't like how the introduction assumed everyone knows about it.

</comment></comment></comment><comment><USER34> Shameless plug: [https://github.com/serkanyersen/underscore.py](https://github.com/serkanyersen/underscore.py)

Underscore.py is a direct port of underscore.js to python.

</comment><comment><USER35>
       s/underscore/lodash/g

Underscore,like Backbone feel like it is in maintenance mode.They didnt get significant new features for years.People should better use lodash.

<comment><USER36> > They didnt get significant new features for years.

[http://c2.com/cgi/wiki?FeatureCreep](http://c2.com/cgi/wiki?FeatureCreep)

</comment></comment><comment><USER37> I use underscore a lot in JS but never felt the need in Python. In the examples given, I'd rather see explicitly what the exceptions being raised are, or the comparisons.

</comment><comment><USER38> For Java, I think Google Guava or Apache Commons are more of the de facto standard library enhancements than the one linked in the article.</comment>


How a Russian S-400 Could Shoot Down an F-35 (Thanks to Turkey) - <AUTHOR> https://nationalinterest.org/blog/buzz/how-russian-s-400-could-shoot-down-f-35-thanks-turkey-50822 <comment><USER2> Maybe because the whole lower-right corner of Turkey is a well established CIA base and they want to do it themselves? The airport there has been a CIA base for at least 50 years, and that's probably being understative by decades. At least 50 years, at the leastest.

</comment><comment><USER3> Why can't Turkey leak us information about the S-400 missile that will help the F-35 evade it?

<comment><AUTHOR> F-35 is a $ trillion project...why even risk it?</comment></comment>


How patio11's Appointment Reminder's revenue grew from $29 to $12000/mo - <AUTHOR> https://www.indiehackers.com/businesses/appointment-reminder <comment><AUTHOR> Hi patio, besides anecdotal validation, did you ever do market size research and market opportunity research to decide on building the Appointment Reminder product, or was it mostly opportunistic?</comment>


Take A Closer Look At The Icon For Apple's Terrible Maps App - <AUTHOR> http://www.sfgate.com/technology/businessinsider/article/Take-A-Closer-Look-At-The-Icon-For-Apple-s-3898650.php

<comment><USER2> The app has many shortcoming sure. But criticizing an icon is getting petty. Icons are abstractions of items, not the item. So, while it could be used as representative of the problems of the map in an editorial way, it's not really a problem.

<comment><USER3> Precisely. The maps icon has basically taken the on-ramp for the highway and abstracted it away for simplicity. Because there actually is an on ramp that you turn left onto after the overpass this icon is accurate.

If they had included the amount of detail shown in the second accurate picture on the link it would look completely cluttered and amateur.

</comment></comment><comment><USER4> Now I see that all icons are lies!

A calculator with four buttons isn't useful.

Why is my letter flying off into the sky.

This minute hand is 20 minutes to the hour but the hour hand is clearly at 10.

Why hasn't this little green Android's arms fallen off?

</comment><comment><USER5> Bashing Apples map app has jumped the shark.

</comment><comment><USER6> The icon is rendered in a quarter of a square inch. Making it abstract and not directly representative is for legibility and visual reasons. Anyone navigating based off the icon for a navigation app deserves to drive into an overpass piling, because they would undoubtedly endanger others if they were on the road.

</comment><comment><USER7> When did it become "terrible"? It has some problems that are a result of being brand new and behind Google's years of experience, but I don't think any of this warrants being "terrible."

We saw this criticism of the icon when the beta came out as a "lol, that's mildly entertaining" months ago. It's just an icon. It's not supposed to be used as literal directional advice. Do these people really expect them to put the very slight angle of the on-ramp in an icon?

This is starting to get really painfully ridiculous.

</comment><comment><USER8> Note: the linked article was not originally written by SFGate or the San Francisco Chronicle, but rather republished from Business Insider (the small logo to indicate this seems a bit subtle to me).

I would argue that this is a worthwhile distinction, in that Business Insider is generally regarded as being closer to the inflammatory and attention- grabbing nature of a tabloid than a traditional news publication—though I recognize that they are simply one of many popular outlets using similar tactics.

</comment><comment><USER9> This is funny, but I think that apple maps is just fine. I like the new maps app and don't understand the huge deal people are making this into.

<comment><USER10> Presumably you live in a place where they haven't completely mucked everything up...

</comment></comment><comment><USER11> steve jobs would have never allowed this! is this the beginning of apples demise?! etc.... a funny find though, made me chuckle!</comment>


What I learned not drinking for two years - <AUTHOR> https://medium.com/@andymboyle/what-i-learned-not-drinking-for-two-years-c94167ecd329#.fvhe0fuin <comment><USER2> I had an interesting experience with alcohol growing up. My parents were pretty strict, so I didn't go to drinking parties in high school. I didn't get drunk for the first time until near the end of my senior year in high school. It was great fun, and it helped me feel accepted. I drank a bit more, especially as graduation got closer.

One night I blacked out, and scared myself at how much I drank. I asked my best friend that week to "Stop me if I ever start to drink like that again." He looked me in the eye and told me he couldn't do that, because his dad was an alcoholic and he'd grown up hearing comments like that all his life. I had no idea.

I decided to hold off on drinking for a while, knowing that I have a tendency to dive into new things. I ended up not drinking at all through college. I went to plenty of parties, and it wasn't awkward at all because everyone knew me as someone who just didn't drink. It was a relief to try a beer some time after graduation and realize I could enjoy a drink or two with friends and not get drunk.

I've seen a lot of lives seriously impacted by alcohol, and I'm grateful every day that I found a way to manage my consumption at a young age. I admire people who can pull back from heavy social drinking like the author describes.

</comment><comment><USER3> I think the title should be "what I learned no longer participating in nightlife."

I can't think of anyone who participates in nightlife successfully who doesn't at least get a little buzzed when out. If you want to skip nightlife altogether, which is what OP seems to be advocating (going to sleep early, saving money), then of course, it's an easy choice not to drink.

If OP wanted to write about how to fully participate in nightlife (2am outings, etc.) without drinking at all, that would be more radical, and a pretty interesting read at that.

<comment><USER4> As a devil's advocate:

Perhaps 'nightlife' is just boring without drinking, which makes me wonder if it's worth at all if it's no fun without drinking. Perhaps it's just a way to moderate drinking, then?

Anesthesia is generally used to help with pain, not improve the quality of an experience.

<comment><USER5> Nightlife is when you are awake but the sun is down and all of the people around you don't mind. There is sometimes lots of alcohol, yes, but also music and conversation and hopefully a convivial atmosphere. I recommend it. No anesthesia necessary for most people.

<comment><USER4> This definition of 'nightlife' is much better than the parents as implicitly as a venue that requires alcoholol to be fun.

</comment></comment></comment></comment><comment><USER6> > "I can't trust someone who doesn't drink."

The author says he doesn't understand this sentiment, but actually he almost managed to explain it in the preceding section:

> I'm in control of my actions basically all of the time.

Drinking helps to build trust precisely because everybody is less "in control", i.e. less able to put up and maintain a fake front.

<comment><AUTHOR> That's a strange fear to have because fake fronts* are fairly easy to detect in sober people. People might say shit they wouldn't while sober (true or otherwise), but alcohol isn't some magical truth serum and plenty of secrets have been kept while hammered. Very few people are out to get you, and if you're using alcohol to detect such a bias you're using the wrong tool.

I'm not sure why a drunk person's actions should be representative of their "real" selves anyway. Does a drunk person's meandering path indicate they're actually faking the ability to walk straight while sober? No. And what about the person who becomes more lively and silly when drunk? Are they faking being calmer while sober? Doubtful. People are different when they're drunk and they're just a stupider version of themselves, not necessarily a truer one.

I know people who choose not to drink because they consistently made bad choices when drunk that didn't fit with their "real" nature. I see that as a sign of a responsible person, not a less trustworthy friend. Some I know have been traumatized by an alcoholic parent. I don't trust them any less because of this. I know others who just don't like the taste of alcohol. Everyone has personal tastes; I don't like spicy food. There are others that will drink but not drink to excess because they don't enjoy wasting a day to a hangover. I'm pretty sure they're not trying to pull the wool over my eyes.

Most importantly, there are also those who are actual alcoholics, for whom alcohol interferes with their physical and mental health, together with their ability to make progress towards their life goals. If you can't trust someone because they stopped making a bad choice, I'm not sure what you're looking for in a person. Personally I'm happy when someone stops a destructive action.

Arguing that you can't trust someone that doesn't drink is anachronistic and founded on specious reasoning. Most people drink and some don't. I can't assume that someone's sobriety or desire to stay in control (they may just be a control freak) is a sign they're trying to hide their true selves from me, because that just doesn't make sense. For some people drinking is fun and cool, but for others it's unpleasant, destructive, irresponsible, and distressing.

* I'm going to interpret a "fake front" as the intention to maliciously misrepresent and deceive for some sort of personal gain at a loss to someone else.

<comment><USER7> Hehe.

It's a big step to admit that your knowledge in human nature is just bad.

The most wrong decisions I have seen were made because people thought they knew other people better than they actually did.

</comment></comment></comment><comment><USER8> Just to offer my own insight on the subject.

I'm 28 years old and haven't drank a drop of alcohol in about 10 years. I still go clubbing until the sun rises (only when certain artists are playing, not a regular night).

I don't drink for various reasons. I don't like the taste, I get no enjoyment from being drunk or tipsy and I dislike the lack of control.

Almost every friend I have, and a long list of strangers, have told me while drunk that they will never drink again. I've lost count of how many times I've heard it, it's kind of funny. I've also had people open up to me much more when they are drunk and they know that I'm not. More-so than I've noticed them be with other drunk people. I don't know why this is.

Every time I go out clubbing people ask to buy drugs from me. Drug dealers must always be the sober ones.

I've had many people refuse to believe that I'm only drinking water and that it must be for taking pills.

One downside to being in constant control is being hyper-aware of what's going on around you. I notice every little detail of everyone's actions and have to remind myself that they're all drunk and didn't mean to do most of what they are doing.

One nice thing about being sober while going out is I've had to force myself to be comfortable talking to strangers without being drunk. It's made me much more confident. Not drinking has made me face my thoughts and feelings in the moment much more directly. You eventually mellow out after getting over the "hyper-aware" phase.

</comment><comment><USER9> The quote about inhibition rings a bell to me, although I won't conclude to aim for 0% drinking.

I believe I'm the of the `badly calibrated` kind. A drink or two won't make me drunk, just loose. Like warming up for a sport event. I'm naturally still too introverted, a bit of alcohol disengage that grain of sand that forbids my mind to be in the moment.

Leading to the ability to go with the flow, which is exhausting but in non stressing way. Just like being able to use some part of you you never do. And even when almost drunk, the counter intuitive part, I sleep like a f __*n baby, and wake up at 6am ready to run (from hitting the bed at 3-4am). No stomach or headache .. nothing.

I see this as the equivalent of jitter for the tribal part of the self. Alcohol is mostly bad and useless, but a few drops here and there and your system just run smoother.

</comment><comment><USER10> I think among millennials drinking has been in a steady decline - not sure if its due to the recession and its effects.

I already have difficulty dealing with caffeine at work - and sugar generally due to how common it is everywhere.

I am not sure if I want to add any more drugs to my life. Already sleep is a premium these days - I would never understand why people would want to screw with it further by drinking or doing cannabis.

<comment><USER11> Grouping alcohol, caffeine, and sugar together makes no sense. Alcohol is estrogenic and inflammatory and dramatically depletes B vitamins and vitamin A. Sugar is simply a clean source of calories; perfectly harmless and often beneficial. Caffeine is quite simply good for you. All the epidemiological studies bear out the idea that it's protective against stress and disease. It improves performance. There's zero reason to limit caffeine consumption.

<comment><USER12> Just like there were studies in the 70s which vilified saturated fats like butter and animal fat which have since been refuted? You can find a study claiming positive (and negative) health effects for near every substance. Ultimately caffeine is a neurotoxin produced by the coffee bean to repel insects.

I think saying there is _zero reason to limit caffeine consumption_ is a bit of a stretch since we're talking about a drug which causes dependence, reduces motor control and increases anxiety.

I say this as a __huge __coffee fan. Grind my own single origin beans, brew them in my Hario pour over or Aeropress etc.

But I'm not going to pretend it's this wonderful health drink when it clearly has negative side effects.

Source: [https://en.m.wikipedia.org/wiki/Caffeine](https://en.m.wikipedia.org/wiki/Caffeine)

<comment><USER13> > reduces motor control

Does it? I remember reading that it increased reflexes, improves stamina, and increases physical strength.

If that's all true (I might have read an outdated/bad study), then what counts as motor control?

<comment><USER12> Whilst sipping a tasty brazilian coffee there's a little irony in me checking back on this comment to back up my critique on coffee.

(Gonna lump all my responses to the various comments here, so apologies if I come across as a bit strong.)

Here's what I found regarding motor control:

> There is also some evidence that fine motor control may be impaired as a > function of the increase in anxiety

[http://www.ncbi.nlm.nih.gov/pubmed/12204388](http://www.ncbi.nlm.nih.gov/pubmed/12204388)

From the aforementioned Wikipedia article:

> Caffeine in plants acts as a natural pesticide: it can paralyze and kill > predator insects feeding on the plant

Regarding my comment on it being a neurotoxin. Caffeine is a central nervous system stimulant. You're basically ingesting plant insecticide which in turn stimulates the nervous system, causes the adrenals to release adrenaline and causes a heightened alert response as well as many other positive AND negative effects. Hence my remark.

Source: [http://brown.edu/Student_Services/Health_Services/Health_Edu...](http://brown.edu/Student_Services/Health_Services/Health_Education/alcohol,_tobacco,_&_other_drugs/caffeine.php)

Most of the research I've seen promotes its health benefits in narrow isolation on one particular facet of human physiology. I haven't seen any evidence that could conclusively sway me towards going from 1 cup a day of coffee to say 4-6 which apparently is the amount a lot of people drink.

My own feeling on coffee is that like anything which has pros and cons it should be drunk in moderation.

</comment></comment></comment></comment></comment><comment><USER14> I get the impression that the OP has underestimated the effect that giving up meat may have on these changes as well.

I have no idea what proportion of credit can be attributed to that change alone but it must surely have had some effect?

</comment><comment><USER15> I almost completely stopped to drink alcohol. The inital reason was the headache I get from it the day after. But especially the effect on my psychic wellbeing is tremendous. I experience much less anxiety and muss less depressive or aggresive moods. All in all I feel much more stable.

The price? Participating in nightlife is much less fun. I know a few people who are teetotal and can have fun with buzzed people. I can not. Is it worth it? Yes, for me it totally is. I do not miss drunken nightlife at all. There are enough alternatives to have fun and to sozialize with others.

</comment><comment><USER16> I liked this piece, it wasn't preachy.

Personally I've cut way back. One day I just realized it wasn't fun like I remember. Not even sure what changed.

</comment><comment><USER17> It's interesting to see how defensive people get if anyone suggests not drinking isn't that big of a deal, even in this thread.

<comment><USER18> I for one am monitoring this thread very closely.... I was admitted to hospital on Christmas day with acute Pancreatitis, and the advice after that is to avoid alcohol for good. I've accepted that, but am interested in the article and comments here because I used to be an extremely regular drinker. Not to get shitfaced per se, but it was a useful relaxant and sedative...

Sure hope I get the sort of boost in energy and productivity that he mentions in the article.

</comment></comment><comment><USER19> I did quit drinking for about 9 months during my masters year at university and I have to agree with a lot of what the author is saying.

I felt more energetic, I slept better, I was a lot more organised and productive, my hobbies felt more interesting and engaging, I saved a boat load of money etc.

I hadn't felt so good pretty much ever. The reason for this has to be that nearly all my social interaction since the age of 15 or so had involved at alcohol (or weed and other stuff to some degree) and while I don't do 'the other stuff' really anymore, most of my social interactions still unfortunately involve drinking. I've never really been one for 'night life' as such, but I do enjoy a few pints in a quiet pub during the day time so I can chat shit to my friends.

Out of all my good friends (say about7 or 8) there are only 2 that I socialise wityh sober. Usually we spend the day in a cafe in town playing board games which is awesome. I drink with these two guys a lot too, but we don't have to like I seem to with all my other friends.

I'm really considering quitting the booze again, just to get that feeling back that I had last time I did. I'd never felt so good.

</comment><comment><USER20> A quarter of a down payment for a condo came from not drinking over 2 years. And he lost 75 pounds. He must had been one heavy heavy drinker to be wasting so much calories and money on it!! Good for him to quit on it.

</comment><comment><USER21> From the perspective of not drinking by default, it's pretty funny to see someone's impressions after trying it out for two years. Nearly everything mentioned is relateable. Although it can at times be shocking to deal with the inevitable treatment detailed in #3, it's my favorite social effect of not drinking. Most people will respect you either more or less, and they'll let you know about it.

<comment><USER22> I can definitely appreciate #3, having faced many incredulous questions when I refuse drinks at social events, but I think most of the author's claims are greatly exaggerated. Your mileage may vary.

<comment><USER21> Believe him. I've heard 3/5 of the comments he mentioned and more.

</comment></comment></comment><comment><USER23> If you start working out 3 times a week, going to bed earlier and eating more healthy, you will notice a big change in how you feel no matter the drinking (depending on amounts of course). Good for the OP though that he has overcome something that was big for him. I am just not sure about the title of this post and the reasoning that it is _all_ due to not drinking.

</comment><comment><USER24> Well ... With all due respect. The primary incentive for a man in nightlife is girls. The guy on the right most likely didn't get much of a chance in that area. The guy on the left might enjoy sober nightlife quite a lot. Girls prefer sober men.

</comment><comment><USER25> > I remember everything that happened during the events

I don't get this. I know alcohol seems to erase memories for some people, but i've never forgotten anything i did while drunk. Something genetic maybe?

<comment><USER19> I've lost memories of most or even entire gigs I've been to before because I drank too much.

The next morning I'll wake up and remember getting to the gig, buying a drink and watching the band's opening track or two then everything is just a blur of images.

At that point you realise you're wasting your money if you can't even remember seeing the thing you paid for.</comment></comment>


Is Your Site Leaking Password Reset Links? - <AUTHOR> https://robots.thoughtbot.com/is-your-site-leaking-password-reset-links <comment><AUTHOR> If you use javascript to extract the token from the URL then you can simply pass it via the hash ("fragment") part of the URL. The hash portion is only interpreted by the user agent and never sent to a server (see [https://tools.ietf.org/html/rfc3986#section-3.5](https://tools.ietf.org/html/rfc3986#section-3.5)). This is how we solved it at paperhive.org.

<comment><USER2> Obviously, the drawback is that you've introduced a javascript dependency to a core function which definitely doesn't require it. Having said that, I notice that paperhive.org renders an entirely blank page if javascript is unavailable, so I guess the password reset is the least of your concerns in that scenario.

<comment> angry-hacker And what percentage of the users have javascript disabled? Objectively you have bigger concerns when you run a site than 10 people who have js disabled.

<comment><USER2> Definitely more than zero. It's not just a case of javascript being disabled, either - there are many other reasons why it might be "unavailable", which is why I used that word.

Of course I'm not suggesting you're not allowed to use _any_ javascript on your site, or even that you should only use it when it's strictly necessary, but if it's entirely unnecessary and you don't engage in best practise by, for example, using progressive enhancement, then that's something that could be improved.

</comment></comment></comment></comment><comment><USER3> If you steal someones else password-reset link, change the password, then at the end of the day, won't you end up with a password, but missing email/username in order to log in? I mean the reset password link shouldn't reveal any other credentials about the account. (I know at some sites after reseting a password you may end up automatically logged in, but i think this is a bad practice).

<comment><USER4> Depends on how the reset behaves. Some resets log you in immediately after providing a new password. Some require you to log in after resetting the password.

I feel like I've seen more of the former than the latter.

</comment></comment><comment><USER5> One option is to avoid putting the token to the link and at least provide user a simple way of copy-pasting the token to the password reset form.

Sometimes this is actually something I as user want to have, since it might be that I'm receiving the email on device A, but want to reset the password on device B.

And please keep the password reset tokens sane. If you are not encoding some data into the token, you don't really need that 80 character random string for security.

<comment><USER4> I'd certainly consider this for some applications. It depends on the value of what you are protecting. For some sites and users, the error rate introduced by this method would be unacceptable.

Tradeoffs...

</comment></comment><comment><USER6> This is bad but not horrible, especially in the example given leaking the reset token to Cloudfront. The application is loading JavaScript from the Cloudfront origin, so that origin by definition could already read the tokens by modifying the JavaScript (assuming no SRI). The request is sent over SSL/TLS so the token cannot be viewed by a MITM, and referers aren't sent across HTTP<->HTTPS transitions.

Again this is far from ideal, but also not readily exploitable by attackers that couldn't already access the data.

<comment><USER4> Author here. I completely agree that it's unlikely to be exploited but also think fixes are mostly simple enough that it should be addressed.

</comment></comment><comment><USER7> What I do is I start a session on password reset page. I send an email with the reset link. User visits the link. The web page checks wheter the requester is same with the session identifier. Only then the user has a right to create a new password. So, in other words, if the user tries to visit the link with a different browser a warning says "use your browser that you used to reset your password".

<comment><USER8> So if I'm in a private session and clicking the link in my email opens a new page in a different session, then I can't reset my password? That's lame.

I've even had a situation where I was on my desktop machine and clicked a reset link on the web site. I realized I didn't have my email set up on that machine yet, so I went to my phone and did it from there. In your scenario, this wouldn't work. That seems problematic.

<comment><USER7> If you are on a private session you can copy the link to a new private tab and it will work.

My web site's visitors are only from my universty. Only to those who have METU email addresses. It is easy to log in to a web mail from the browser. Password reset is not a something done on daily bases. It is okay for my situation. Not very user friendly but it is a bit more secure.

In fact the idea come from this; what if a student fills registration form and sends the validation email to his teavher. And the teachet, without reading click, in other words validates the registration process mistekenly. Now, I have a criminal case (I shouldn't allow Professor Naughty Elizabeth to be registeted for example) against me! I wanted to protect my ass. And I used it too in password resets.

</comment></comment></comment><comment><USER9> Referrer leaks are such a foot-shoot. There should have been a piece of the URL which never touched the Referrer but also _was_ submitted to the server from the get-go. But obviously an easy edge case to miss in 1991 - 1996 [1] [2].

But this is sad: [http://caniuse.com/#feat=referrer- policy](http://caniuse.com/#feat=referrer-policy)

[1] - [http://www.w3.org/pub/WWW/Protocols/HTTP/AsImplemented.html](http://www.w3.org/pub/WWW/Protocols/HTTP/AsImplemented.html) [2] - [https://tools.ietf.org/html/rfc1945](https://tools.ietf.org/html/rfc1945)

</comment><comment><USER10> I've read the article twice, and I'm not totally clear as to what the problem is, and how it's being addressed (web n00b here). Also, this bit:

"Browsers will not send the Referer for resources fetched via HTTP from a document loaded via HTTPS"

So using HTTPS resolves the issue? But breaks analytics?

Any further clarification would be nice, thanks!

<comment><USER11> The article is simply pointing out that services which record referrers can inadvertently store live password reset tokens if you're not careful.

For instance, someone places Google Analytics in the head of the default layout for a given site. Now traffic to and from the password reset page, which uses that layout, is being recorded. This means an attacker would only need to gain access to that account, which is probably much less guarded, and gather referrers containing password reset tokens. From there they could quickly try the last few--which might still be active--and easily gain access to one or more accounts within the site.

<comment><USER10> >>...would only need to gain access to that account, which is probably much less guarded..

So "that account" you mention, is it the Google analytics account or the web application (leaking urls) account? Why is it much less guarded?

<comment><USER11> I mean the analytics account; and in my experience it is less guarded due to clients handing out access as it's "just reporting" in their eyes.

</comment></comment></comment></comment><comment><USER12> For analytics this isn't a big problem.

Once a reset link has been clicked, it should be immediately invalidated.

So unless the server was able to respond to the link and provide the analytics stuff but not somehow invalidate the token, I can't see how this is a problem.

Another related problem is that some third party mailers move all their links via URL redirectors. In that case there's a chance the host application fails and the link is left valid.

<comment><USER13> >Once a reset link has been clicked, it should be immediately invalidated.

I'm not sure about this... Couldn't this produce some unexpected reset failures in cases of browsers preloading links in webmail clients?

<comment><USER14> Drupal (and WordPress, if I recall correctly) invalidate immediately. Considering reset links are sent in plain text by email, it's a good way to test whether the link has been used by someone else.

Besides, it would be an odd security hazard if browsers/webmails preloaded links in emails (malicious URLs in spam/scams).

edit: in Drupal, the reset link loads a page with a button that the user must click on. This avoids issues with potential preload or anti-virus scans.

<comment><USER9> What if they click the link but don't click the button? Do they need another password reset token at that point? If not, is there still an attack window there that needs to be plugged?

<comment><USER14> The links usually expire after 24 hours (attack window), if unused.

Loading the page without clicking does not invalidate the link.

I agree this is not highly secure. It's basically one notch above sending cleartext passwords by email (which many websites unfortunately still do).

</comment></comment></comment></comment></comment><comment><USER15> So the fragment solution requires JS, invalidate on request can be upset by email scanning antivirus, manual token entry is inconvenient.

So my first thought is returning a page with no external requests (render on the srrver) which isn't very dev friendly.

My other thought is returning a redirect to a page with a token derived from the original token and the clients IP or some other fingerprinting information.

<comment><USER16> Redirect is the cleanest solution.

Most frameworks provide some form of storage (whether server-side or client- side) that is tied to a specific session, so you can use that to remember the fact that the current session recently used a valid password-reset token for user ID 123.

Or you could use a similar mechanism to put the token in a hidden <input> after redirection, so that it gets submitted again when the user types in their new password.

<comment><USER17> >Redirect is the cleanest solution.

Exactly. Submitting tokens via GET requests (as is necessary for an emailed token) should be handled in the same way as POST (POST-redirect-GET): the resource which validates the token should not be the one that presents the "password reset" form.

</comment></comment></comment><comment><USER18> You can also use the meta referrer tag on modern browsers.

[https://moz.com/blog/meta-referrer-tag](https://moz.com/blog/meta-referrer- tag)

<comment><USER4> It's covered in the article, but this is not supported by IE11. That's pretty modern...

</comment></comment><comment><USER19> Would putting the token to url fragment id resolve the issue? I suppose the downside would be that then js is required on the reset page. But that is fairly minor imho.

</comment><comment><USER20> British regulators have highlighted this problem too. [https://iconewsblog.wordpress.com/2015/09/16/does-your- websi...](https://iconewsblog.wordpress.com/2015/09/16/does-your-website-have- a-leak/) I wish someone would sue Mozilla, Google, Microsoft and Apple for data protection violations for supporting referer

</comment><comment><USER21> Does anyone have a list of common vulnerabilities that you should check your app against, maybe excluding the obvious ones like SQL Injection, XSS, etc... ? Because I can't keep track of all the vulnerabilities that exist in the world :(

<comment><USER22> [https://www.owasp.org/index.php/Top10#OWASP_Top_10_for_2013](https://www.owasp.org/index.php/Top10#OWASP_Top_10_for_2013)

This is a good one in specific. In general, be very careful of what information you share with who. Information is dangerous, and it leaks all over.

</comment></comment><comment><USER23> The problem is that your password reset token shouldn't be reusable. The token is only leaked after the person visited the reset page, which should invalidate the token on load.

Without a valid token, the reset form shouldn't load. Problem solved.

<comment><USER4> This requires non-idempotent get requests as you must invalidate the token on get.

I did consider this approach for Clearance and intended to go with it, but was discouraged from doing so after hearing reports that some enterprise email AV does things like open some links in emails.

There is also the user experience concern that a click the link in my email, do something else, then click the link again, having forgotten I already clicked the link. Now I'd have to re-request again.

Also, this approach is impossible if you use HMAC tokens.

I don't think anyone who opts for this approach is wrong but like most things, it's a tradeoff.

<comment><USER24> Thanks for the additional thought process here; just a minor question, what's an HMAC token?

<comment><USER4> [https://en.wikipedia.org/wiki/HMAC-based_One- time_Password_A...](https://en.wikipedia.org/wiki/HMAC-based_One- time_Password_Algorithm)

I might not be using the right term here, but the general idea is that you create an encrypted token out of some data and verify that the data is unchanged and still valid on the server. In that way you can provide a token that ensures the user had access to the link you sent them, but you don't have to store it in the database.

</comment></comment></comment></comment><comment><USER25> I'm a bit of a web noob as well, so I have a related question: If I have an https url with a token will the token only be sent through the https connection or is it contained in any lookups or connection metadata or such?

<comment><USER26> Query parameters are encrypted if you are using HTTPS. The domain/host name (e.g. news.ycombinator.com) obviously is not protected, since the DNS lookup is required and the server (resolved IP) may host multiple sites. Seeing the hostname plaintext in the request is required for the server to disambiguate.

So, for single-use tokens, you're probably OK for passing it in the URL (e.g. myhost.test/resetpw?token=abcdef), but it is usually considered a bad idea to use the URL for non-single-use secret info. Once it hits the server, the full URL may be stored in log files unsecured or if you use SSL termination before the server, it could be logged in other places as well. Additionally, the user's browser itself may store your secret URL in the history.

<comment><USER4> In my experience, password reset tokens are not single use. They are good for both loading the form and submitting the form. They are not invalidated until the form is submitted with the new password.

They are good for 1 password reset, not 1 page load. It's possible to make them good for 1 page load, but most I've encountered are not due to the tradeoffs that would involve (see other discussions).

</comment></comment></comment><comment><USER27> He should have also considered the option of not loading third-party assets and analytics on password reset pages.

I'm grumpy enough to suggest not loading them period, but I'm a curmudgeon.

</comment><comment><USER28> Can anyone check if [https://stormpath.com/](https://stormpath.com/) has this issue?

</comment><comment><USER29> Anyone here happen to know how Basecamp works? They seem to be comfortable with emailed login links, no username or password.

</comment><comment><USER30> Why not have a URL that identifies the reset request uniquely but also requires a code that is entered manually?

<comment><USER2> In my experience, that really confuses users. Some just do not understand or read the email too quickly; they click the link, then they get stuck. If everything just works as a result of clicking a link, users are satisfied.

BTW, why would the URL that identifies the reset request need to be unique if the tokens have enough entropy?

<comment><USER30> Going to need a whole lot of characters to prevent someone being malicious and just resetting passwords randomly. Long characters are also more annoying to type for the end user. If the link is unique you can keep the passcode a little shorter and it requires two pieces of information to complete a reset.

</comment></comment></comment><comment><USER31> There's absolutely no situation when it's a risky behavior. It is not a problem at all.

<comment><USER32> Just to illustrate a potential scenario:

You use a piece of open source software that has a javascript file which the author has hosted on a CDN. In order to mitigate an attack where someone changes the content of the javascript file you use a hash[1] to ensure the file does not change. You think you are safe, but a malicious actor gets access to the CDN and instead of changing the file, instead builds a quick scripts that looks for password reset referrer patterns and races the human to reset the password first. A computer is probably going to win that game that majority of the time.

[1] [https://github.com/twitter/secureheaders#hash](https://github.com/twitter/secureheaders#hash)

<comment><USER33> Or the attack just skips the secure hash check on the server... This example doesn't seem to hold water either.

</comment></comment></comment><comment><USER34> Why not pass the token as an HTTP header? e.g. X-RESET-TOKEN=foo and then read that via JS

<comment><USER35> How exactly do you encode a HTTP header into an URL?</comment></comment>


My Garbage Cat Wakes Me Up at 3AM Every Day (2015) - <AUTHOR> https://grey2scale.itch.io/garbage-cat <comment><USER2> Really funny to play. I'd like to have a layer of complexity maybe nightmare monsters.</comment>


Recommendation for Facebook Platform Team - <AUTHOR> http://blog.anekdotz.com/2010/04/recommendation-for-facebook-platform.html

<comment><USER2> well stated.. though with Facebook I doubt they would implement something so bold</comment>


African looking for FOSS complete beginner materials - <AUTHOR>

am a young african working for the moment in a cyber cafe, i am planning to quite my job because there's nothing am learning from it an i can't grow. i am interested about FOSS(Ubuntu) web design and apps development, i wish to know where can i start to learn and contribute in putting African content online. i wish to know how where i can go to start learning and if they are place for complete beginners. i will really appreciate to collaborate with any one interested in AFRICAN's living on the continent. just google  my name : NKOULY MARC STEPHAN
to have an idea on who i am and you can join me on  G+ hope i can make some friends who can guide me. <comment><USER2> Arguably the best place for a beginner interested in programming and Unix development in general is "The C Programming Language" by Brian Kernighan and Dennis Ritchie. Completing the exercises is essential, once you're done, you ought to pick up a text on Algorithms. Good luck!</comment>


A Raspberry Pi Killer? - <AUTHOR> http://www.newegg.com/Product/Product.aspx?Item=N82E16856119057

<comment><USER2> If you were buying a Raspberry Pi to be a familiar x86 PC with gigabytes of RAM and hard drives, this would probably be a better choice.

If you were interested in a 1 watt device with exposed GPIO pins that also had a pretty spiffy graphics engine, you might prefer the Raspberry Pi. (or three, both systems need more components to be complete).

I have plans for upgrading some telemetry with Raspberry Pis [eww, that doesn't read well, does it] but also bookmarked the Foxconn machine for the next x86 box that dies. (Beats wrestling linux onto an original AppleTV).

<comment><AUTHOR> Well said.

I guess my first thought with the Raspberry Pi was as a ridiculously cheap/efficient HTPC, and secondly as a tool for relatively poor kids to be able to have their own computer to program/explore on with decent hardware. This fills those same niches, while having some notable advantages: better CPU, GPU, compatibility, extensibility, etc. (And obvious disadvantages.)

Outside of these two niches, the advantages of the Raspberry Pi matter a lot more.

</comment></comment><comment><AUTHOR> And just as a disclaimer, I am no stooge trying to make a buck nor a troll. I would link to some product page on FoxConn's website, but the price/ease-of- actually-buying is a big part of the reason why this is worthy of discussion. (Granted, the title is intentionally incendiary.)

The real question is: how fast are cheap computers with astonishing computing and gfx capabilities going to overrun society? And what will the results be?

</comment><comment><USER3> It's "barebones", meaning you need to purchase memory and storage too. And power consumption is going to be at least 10 watts, which is an order of magnitude more than the rPi. Still, if you are in need of more horsepower and/or need to run x86 binaries, this would be a great choice.

</comment><comment><USER4> Power Supply 150W Dimensions 11.1" x 11.02" x 3.74" Weight 10 lbs.

This isn't even in the same category in my opinion. Power, Dimensions and Weight are huge compared to the Pi. So to answer your question, it's a 'No' for me.

</comment><comment><USER5> The common use cases between Raspberry Pi and this are probably around 10%, which means this is hardly a Raspberry Pi killer since they barely have anything in common.

</comment><comment><USER6> The Raspberry Pi is 1/3 the cost, and at 3.5watts, the Raspberry Pi is far more efficient than the 150watt power supply on this thing.

</comment><comment><USER7> Space. I think you can cram a dozen (dozens?) of Raspberries in this box. Small for a PC, but not so small for a Pi.

</comment><comment><USER8> Don't editorialize headlines.

<comment><AUTHOR> Fair, especially in light of what others have pointed out. Something more factual. How about:

"A cheap, small, powerful computer, whose name is not a dessert pun"

Don't see a way to change it now. Can an editor?

Still, it's way less impressive now that its $130 compared to the $100 it was yesterday.

</comment></comment><comment><USER9> This is actually larger and more expensive than Raspberry Pi.</comment>


Bad code isn't technical debt, it's an unhedged call option (2014) - <AUTHOR> http://www.ontechnicaldebt.com/blog/bad-code-isnt-technical-debt-its-an-unhedged-call-option/ <comment><USER2> This article/site seems kind of dodgy in that it doesn't mention the original post, which dates from 2010:

[https://web.archive.org/web/20111220004305/http://www.higher...](https://web.archive.org/web/20111220004305/http://www.higherorderlogic.com:80/2010/07/bad- code-isnt-technical-debt-its-an-unhedged-call-option/)

... and was discussed twice on HN:

[https://news.ycombinator.com/item?id=1541211](https://news.ycombinator.com/item?id=1541211)

[https://news.ycombinator.com/item?id=8777237](https://news.ycombinator.com/item?id=8777237)

</comment><comment><USER3> I think it's useful to try to think about software development in economic terms. Metaphorically is it more like a call option or or is it more like a debt? In my mind they are both the same thing. Unless you want to be pedantic about it in which case, well it's neither, its software. But if not then Real Options is what we're talking about [1]

Two fundamental themes in economic thought are the value of optionality (opportunity cost aka options pricing) and the value of something in hand vs having it later (cost of risk, aka interest rates on debt).

Everyone determines this for themselves and behaves accordingly creating a market. One persons cost is another value, people see the world in different ways and have different desires so they come up with opposite positions and thus a deal is struck. Wait a tick, that sounds very similar. Thats because debt is an option. To the debtor it is a call option on the value of money now vs later. To the lender it is a put on the value of money now vs later. An interesting thing is that they are often both right. And it is the pricing of risk that rounds out the equasion.

My home mortgage is debt, yes, but ostensibly I did not go into that financial arrangement for the privilege of making payments and doing maintenance for 30 years. I did so because the optionality it provided was more valuable in my mind than the alternatives. I was bullish on home ownership as a benefit to me vs the cost of the debt long term. Inversely the bank had few other options with as-desirable a risk/reward profile aka yield. They were bullish on my ability to pay the debt or recoup it via reselling the asset if I defaulted. They were placing a put on their money in-hand seeing it's value going down over time. If they did not invest it or lend it out to gain yield it would lose value via inflation. Both of us are making assessments of value and risk and both of us are happy because both of us have different time horizons and different needs. I'ts actually a beutiful thing. The loan is a Real Option.

From wikipedia: A real option itself, is the right—but not the obligation—to undertake certain business initiatives, such as deferring, abandoning, expanding, staging, or contracting a capital investment project. For example, the opportunity to invest in the expansion of a firm's factory, or alternatively to sell the factory, is a real call or put option, respectively.

I think the decisions we make every day are all Real Options. We all make resk reward tradeoff decisions all the time involving how we value our limited time and our limited ability to predict the future. Software development is no different.

[1] [https://en.wikipedia.org/wiki/Real_options_valuation](https://en.wikipedia.org/wiki/Real_options_valuation)

</comment><comment><USER4> Isn't a call option really a call bond, and a bond is an instrument of indebtedness.

This article has typos & I fail to understand what they're trying to say, specifically this part:

> If that code is never called upon again than it would have been foolish to > clean it up in the first place. However, lets say a radical new feature is > going to added – these quick fixes and become very expensive to deal with. > Time has to be taken to fix these issues right before deadline or no one on > the team remembers pertinent information need for the code to make sense in > the first place

Ignoring the fact this is full of grammatical errors & makes no sense, the "call option" metahphor implies I may have to cleanup an entire codebase at some unknown point in time, which isn't true -- its always possible to shoe horn in more quick fixes instead, just like you could pay off a credit card with a cash advanced from another credit card, going further into debt. So Debt is the more appropriate metaphor in my opinion.

> The problem with technical debt as a metaphor is that for managers debt can > be a good thing

But technical debt _can_ be a good thing. And so can a call option, if it never gets called. The article itself points out you may find out later on that you do not even need the code after all, and therefore any cleanup would have been wasted effort. The author is grasping for a metaphor to make technical debt sound more evil than it probably is. No one is going to force you to cleanup your code. You still have the choice of adding more messy code, and going further into debt. Because you have that choice, its just debt, not a call option. Debt, including technical debt, can be a good or a bad thing. Just like real debt, technical debt can be used as a growth hack. If you can write some crappy code that makes you a million dollars, you can go back & pay someone to clean it up later. Its not inherently evil.

A call option would be a good metaphor for a security problem. For example an Equifax programmer may have pointed out the leak to his boss, who said let's spend time on new features & instead ignore the security problem [therefore giving out a call option to the public, for short term financial gain]. Then some hacker from the general public came along & called the option, by exploiting the leak. Now Equifax has to pay up. So technical debt is not a call option, security issues are call options.

Since writing messy code has been shown to correlated with bugs & security problems, I guess you could actually argue that messy code is a call option because it might get exploited, or crash production... both of which are a loss.

Although a liability would be more appropriate metaphor, because you can eliminate liabilities as you gain new information... your product starts becoming more popular over time. A call option cannot be canceled just because of a market uptick. Messy code can be eliminated as your product's market is validated.</comment>


Is buying startups the new R & D? - <AUTHOR> http://www.msnbc.msn.com/id/17720671/ <comment><USER2> Development? Yes. But I'm not sure anything has replaced PARC/Bell Labs style research.

See also: <http://news.ycombinator.com/comments?id=2585>

</comment><comment><USER3> Is this a dupe? Or just a rehash of something I've heard far too many times?

</comment><comment><USER4> I'm going to say yes as well.

</comment><comment><USER5> yes

<comment><USER6> pg: looks like someone picked up "hiring is obsolete" and decided they could rewrite it for a mainstream news outlet.

</comment></comment><comment><USER7> i'd agree</comment>


Ask HN: Which industries have the most to gain from software (or hardware)? - <AUTHOR>

From the recent "How to get Startup Ideas" article:<p>"So if you're a CS major and you want to start a startup, instead of taking a class on entrepreneurship you're better off taking a class on, say, genetics. Or better still, go work for a biotech company. CS majors normally get summer jobs at computer hardware or software companies. But if you want to find startup ideas, you might do better to get a summer job in some unrelated field. "<p>As a third-year CS major in college with a couple of software internships under my belt, including one at Google, I'm thinking right now about which industries would be the best to dip a toe in and see where they could use some help from ideas from the tech world. One area that's clearly been exploding is bioinformatics - I've spent some time at a lab doing research in the area, and it's an interesting field. What are some other ones that people might not immediately think about? <comment><USER2> My vote would go to the automotive industry, specifically for work in engine research. For instance, improvements can still be made to combustion and the amount of work still to be done with electric engines is massive.</comment>


A secure CAPTCHA-free login design - <AUTHOR> http://blog.est.im/archives/4431

<comment><USER2> There is one tiny issue with this approach. Your method forces storage of the password cleartext on the server which is strongly discouraged.

You should always store the password on the server as a hash of some kind to protect your users against breaches on your side.

<comment><AUTHOR> > Your method forces storage of the password cleartext on the server which is > strongly discouraged.

Actually, no.

There is no removing or replacing of characters. You can restore password back on server. Then hash, match against hashed password.

<comment><USER2> Yea i just thought about it. As long as you re-arrange before comparing to the hash.

My mistake.

</comment></comment></comment><comment><USER3> And it's inaccessible (like CAPTCHA). And will probably harm usability too.

</comment><comment><USER4> This is stupid for a few reasons

1) There are only a few types of questions, a bot can be programmed for all of them.

2) You don't need to program a bot for all of them. Even if you cover 1%, it's enough to break through and spam (attempts are cheap).

3) I don't think I've ever seen a captcha on a login box. Most of the time captchas are used for submitting anonymous (or semi-anonymous) comments, or verify a human if there are too many actions from one account.

<comment><AUTHOR> > There are only a few types of questions

Yet the answer is more flexible than traditional CAPTCHA. Remember, you have to type the correct password to check if CAPTCHA OCR is working

<comment><USER4> You're comparing a working solution (CAPTCHA) to a non-working solution (yours).

Flexible or not, it's completely useless.</comment></comment></comment>


Be My Eyes – Help blind people 'see' thru a mobile app - <AUTHOR> http://bemyeyes.org/

<comment><AUTHOR> I 'saw' it first? ;)

[https://news.ycombinator.com/item?id=8892747](https://news.ycombinator.com/item?id=8892747)</comment>


Killer instinct: the key to startup success - <AUTHOR> http://blog.rafaelcorrales.com/2010/03/killer-instinct.html

<comment><USER2> If by killer instinct you mean the value of focus then I agree. But I find most startups succeed more on their ability to negotiate win-win outcomes with partners, customers, suppliers and less on "winner take all" models.

Most markets look more like stag hunts where teams of cooperating players outperform "go it alone" firms. If a startup team sets high standards of excellence for performance that's great. But you face so many competitors, including the 'status quo' that a focus on "winning" leads to you to overlook opportunities especially in the early market. Take a look at Saras Sarasvathy's "What makes entrepreneurial" at <http://www.effectuation.org/ftp/effectua.pdf> in particular two excerpts:

"Expert entrepreneurs [...] are actually in the business of creating the future, which entails having to work together with a wide variety of people over long periods of time. [They fill their future] with enduring human relationships that outlive failures and create successes over time"

"This is largely ignored in our entrepreneurship curricula which tend to focus on market research, business planning, new venture financing and legal issues. As far as I know no entrepreneurship programs offer courses in creating and managing lasting relationships or stable stakeholder networks, nor on failure management."

<comment><USER3> Hey thanks for that, you just clued me on on a strategy I could definitely use to push my product out. Your comment is really helpful. This is especially the case for bootstrapped startups where you _really really_ need to leverage any and all resources you have. It's to say "we'll just buy our customer's attention" if your funded, but working with no money entails you pool resources, bend over backwards for those key connections, and find novel ways to get what you want, which as you point out, frequently comes down to collaboration and sharing your pie.

</comment></comment><comment><USER4> Agreed. Passion and 'killer instinct' outweighs raw talent

<comment><AUTHOR> Awesome. I think there's a "minimum" level of talent you need, and then at the margin it's about the killer instinct. Really it's about who wants it more since ideas are pretty much a commodity.</comment></comment>


Show HN: Register expiring premium domain names for just $99 - <AUTHOR> https://backordr.com/domains <comment><USER2> $99 is steep for a lot of these domain names. You also don't disclose who the registrar is. Personally I wouldn't consider this without knowing you won't put me in GoDaddy's grasp or an equally horrible registrar.

Also it seems like you misunderstand why such a site deserves a large margin: good domains.

I don't care about paying $99 for a domain that expires in 4 mins, I could nab that myself.

What I _would_ pay $99 for is a really great domain name, expiring... who cares because that's what your site is for.

<comment><USER3> You can always transfer the domain to another registrar. I got mine though Google for the free Google Apps account (no longer available AFAIK), and that ended up having GoDaddy be the registrar. I spent maybe 5 minutes and started the transfer process to a registrar I like better, and within a week (may have been 24 hours, I can't remember), the process was done.

As for services like this, I think they're mostly useful for domain arbitrage. I certainly wouldn't bother.

<comment><USER4> I thought domains are locked for 90 days?

</comment></comment></comment><comment><USER5> None of these domains are premium, and can be registered for under $10 easily without any competition.

</comment><comment><USER6> I was hoping for .com domains when you said "premium"</comment>


Why I Left Gulp and Grunt for Npm Scripts - <AUTHOR> https://medium.freecodecamp.com/why-i-left-gulp-and-grunt-for-npm-scripts-3d6853dd22b8#.vxybgijba <comment><USER2> The move to npm scripts is such a regressive fashion choice in the frontend world. Which of the following sounds better?

\- Write your build with the full power of the language you use everyday and orchestrate it with a thin layer like Gulp \- Write uncommented (and uncomment-able) bash scripts where parallelism, streaming, and cross-platform compatibility require nontrivial effort

Gulp isn't as complicated as some have insinuated. You don't even need to use Gulp plugins if that's a concern–it's just Node!

I'd much rather write Javascript to build Javascript than memorize CLI arguments and break all of my scripts on Windows.

I will say that the best part of npm scripts is that they're not Grunt :)

<comment><USER3> Exactly, you can treat Gulp like the a pure make system, and do whatever you want in each target.

</comment></comment><comment><USER3> There is a large amount of stuff to know before you can develop and debug the piping stuff in gulp, I grant you that.

But, what are you going to wind up using in npm scripts for your resource compiling? Webpack? Browserify?

Why not put that all into a gulp file? Gulp files are great for non-piping- streaming tasks. It has great support for chaining tasks and making tasks dependent upon others.

What benefit do I get by actually moving to npm scripts, that I couldn't have in a gulp file?

<comment><USER4> As he states in the article: sometimes gulp plugins are not updated to support new versions of libraries, resulting in developers being stuck on old versions of tools. There's also a risk that the plugin contains bugs, in which case you can either fix them yourself or wait for the plugin maintainer(s) to do it. Both of those alternatives takes time, energy and focus from your main project, which makes it a good thing to avoid if possible.

<comment><USER3> But my point is that you can use gulp only (no plugins), and throw your npm scripts into gulp tasks.

Where is the risk there?</comment></comment></comment>