I haven't given up on PHP — yet - <AUTHOR> http://phpadvent.org/2008/yet-by-marco-tabini <comment><USER2> PHP definitely has its flaws and lack of conventions but for me that is what makes it beautiful. It's a language which has allowed me to grow as a developer over the years. If I look back at how I structured and wrote my code when I first started it's nothing close to how I code now. Since PHP allows so many different variations I didnt have to conform to one style but instead developed my own. If I would have chosen a different language to start with I am quite sure I would have given up on programming quickly. PHP has allowed me to learn from my own mistakes and create my own unique way of solving problems.

Besides how I feel about it; it's been great for all the projects I've worked on and now for the first time I'm using a framework (Codeigniter) for my startup and it's proving to be even more solid and progressing my style even more.

I believe PHP code is as good as its developer. Like mentioned in the article; you can paint a mess or a masterwork, all the colours and brushes are there.

<comment><USER3> 10 years ago I wrote my first web application. I was hooked. The ability able to write an app that ran anywhere in the world was magical. My journey since has led me to PHP4 and the LAMP stack, away to C++ and Java and back to PHP5, away to C#, Scheme, and Python, and again back to PHP5.

The truth is I have a love-hate relationship with PHP. The linguist in me abhors PHP sprawl and the pragmatist in me adores PHP's simple execution model and practical ubiquity.

Upon returning to PHP this September it felt both familiar and unsettling. The feeling of returning to the town you grew up in. Frameworks, like familiar faces, looked the same as when you last saw them just heavier and a bit more mature. Nowhere as spectacular as the framework heroes of other towns like of Pythonville or Rubyfordton. City council was still making unorthodox decisions like enforcing backslashes for namespaces. Yet downtown was booming- many of the greatest internet successes of the world had since established themselves here: Facebook, Flickr, Yahoo!, and others.

So I set out to create an open source framework called "Recess!" which will be available on GitHub in preview form "any day now".

I just recorded its first screencast that dives into how it Recess! handles routing. Interested to hear your thoughts:

[http://www.recessframework.com/screencasts/routing/index.htm...](http://www.recessframework.com/screencasts/routing/index.html)

(disclaimer: the flash video may be slow to load - until which you'll see an empty black page)

<comment><USER4> Controller route prefixing seems suspicious. Do you include every controller at runtime and use php reflection with some regular expressions to parse all of their prefixes only to figure out what single route to use?

<comment><USER3> In development mode, yes. We look at every controller and form a routing tree.

In deployment mode that routing tree is serialized and cached. Only a single (matching) controller is then touched. Unserializing the data structure is extremely fast and finding a match is roughly an O(log n) operation.

</comment></comment></comment></comment><comment><USER5> I started programming when I was 12 and sadly my path to PHP looked something like this:

      QBasic -> Visual Basic -> HTML/CSS -> PHP

With what I know now (various bits of Java, C, bash, Python, OOP, etc), I wish so much that my path to PHP looked more like this:

      C -> Bash -> Java -> HTML/CSS -> PHP

Everyone who uses PHP professionally knows that it's extremely easy to write crappy PHP code. While PHP is easy for beginners to learn, it's equally as easy for them learn bad programming habits.

After 15 years, I'm finally putting in the time to learn the language I should have started with: C. I really wish it was the first language I learned because it would have made learning other languages so much easier (and learning those other languages would have made me a much better PHP programming when I started using it).

I believe every language has its uses and PHP is no different. While its a shame there is so much crappy PHP code out there, open-source projects like WordPress have shown it has its place. (If WordPress themes and plugins were not so easy for non-programmers to learn how to create and modify, I don't think WordPress would be where it is today.)

<comment><USER6> My evolution is like this:

Pascal (object oriented) -> C++ -> C# - > PHP

Despite a reasonably strong background in developoing software, I've found it way too easy to build crappy code in PHP. But, I think it's as much me as it is PHP.

Perhaps PHP brings out the evil that is lurking inside of us as programmers?

<comment><USER5> Or perhaps humans are lazy by nature and, since PHP does a very bad job of keeping us in line, the less disciplined of us end up writing bad PHP code. Of course, if we don't know how to write good code to start with, it's not PHP's fault. I think the simple fact that you _can_ write good, elegant PHP code goes to show that it simply demands a more disciplined programmer (or a framework to help with that discipline).

</comment></comment></comment><comment> old-gregg I apologize for an off-topic, but this question has been itching for a while and I just couldn't resist:

"... did so specifically to solve _his or her_ immediate problem in a manner that catered to _his or her_ unique needs ..."

I understand that speaking/writing like that you come across as a super- cultured, modern liberal or whatever, but am I the only one who finds this bastardization of English awkward? I've learned this language about 8 years ago at the age of 23 (relatively recently) and even then it wasn't so crippled by such idioms, and to this day every time I stumble upon a sentence like that, it pings my ear, kinda like seeing "chickenfucker" in the middle of Declaration of Independence, totally out of place, out of context.

Does anyone else feels this way?

<comment><USER7> Kind of like "cease and desist"? Doesn't cease have the same meaning as desist?

I read that the legal doublespeak comes from English roots. When the Anglos and Saxons had to start getting along, their lawyers had to use a word from both languages. Big [citation needed] here, so I hope someone obliges. I'd love to know the truth.

But back to "his or her." I often use simply "her," to be both consise and politically correct. ;)

<comment> old-gregg After some googling I found something: <http://plover.net/~bonds/genderedlanguage.html>

"... The problem is that in the English language, the "traditional" gender- neutral form -- "his" -- happens to be the same as the masculine form. And to say or imply that an arbitrary or unknown person must be male, as those who use "his" are claimed to do, is discriminatory... "

</comment></comment></comment><comment><USER8> _As an insider, it's actually funny to see endless discussions on newsgroups or the latest PHP-bashing entry on the Slashdot-of-the-day web site where people who aren't familiar with our platform disdain its ludicrous awkwardness while marveling at its popularity._

I'm very familiar with PHP. I built my first start-up on it, and it was a costly mistake. I know PHP very well and loathe it for many good reasons.

I think the author should try giving up on PHP now. He may well find that the world seems like a better place after that step.

<comment><USER9> Could you name reasons why it was a costly mistake for you? Were there scaling problems or issues with maintaining existing code? I'm not trying to protect php, just curious.

<comment><USER8> PHP's main flaw from my point of view is its ugliness. It's almost impossible to distinguish bad code from good code. All of it looks equally bad (well, some of it looks even worse).

The downside of that is that you don't get the automatic "bad feeling" when you put in a hack. It just doesn't stand out like a sore thumb (like it would in Ruby), so it's very easy to ignore the hack. Since PHP is an extremely hack-friendly language, where it is very easy to take damaging shortcuts, and it lacks the feedback mechanism to make you aware of when you've taken a bad shortcut, every large PHP project seems to eventually end up the same: a monstrous pile of hacks, one uglier than the other.

I don't have that problem with Ruby at all, for the record. Ruby is very hack- friendly too (even more so than PHP), but because of its natural elegance, whenever you do something plain bad it is immediately visible and remains so until you clean after yourself.

I could talk about all the cruft in the global namespace, the lack of consistency in the API, the appalling OO implementation, the lack of a super- successful framework like Rails... but ultimately, what bothers me is the result of all those problems: ugly code that keeps getting uglier.

Why did ugly code bother me with my first start-up? Because it is hard to care for ugly code. Once your beautiful start-up's code turns into a pile of spaghetti, you start to wish you were doing something else. And that's a pretty bad place to be when you are the sole maintainer of your start-up's code. It won't stop you from ploughing on - but it will slow you down a lot, and you don't need that when you're a start-up.

</comment></comment></comment><comment><USER10> PHP is a tool. Just like all other programming languages. If PHP can be used to solve your real-world problems then okay - Go for it. It's free, easy to use, the documentation is the best there is And lots of frameworks to choose from. If not, then use something else. But for me, after a few years of coding PHP, I haven't had anything that PHP can't do for me (in terms of web development). Especially these days that Code Igniter, Zend Framework and the likes are going more mainstream...

EDIT: just wanted to add that I have been wanting to use Tools like Ruby on Rails, but when I think of it -- it is so much easier to do this and that in PHP.

i have read books on RoR, etc. but haven't find the time to implement on a real-world project yet. maybe it's just me or that i'm too lazy :D

</comment><comment><USER11> Summary: PHP is cluttered, people like to bitch about it but use it anyway, sometimes frameworks are good. The 'yet' is merely a weak thread through the vague, obvious noise. I want my 10 minutes back.

</comment><comment><USER12> <http://www.symfony-project.org/>

</comment><comment><USER13> _If there were a product statement for PHP, it'd probably be something like "only a drunken Martian could come up with this."_

I know I'm pretty much stating the obvious, but this is the problem that will keep PHP cemented in its current state for years and years.

Like everyone knows, and like stated in the post, PHP is riddled with inconsistent naming-convetions for functions, inconsistent parameter-order and inconsistent functional behaviour. Let's also not forget how 99% of the functions in PHP are "binary safe", like treating text like binary data is a good thing. There is code out there working on binary data and relying on _string-operations_ to work properly.

Let us for a second assume the PHP developers are actually capable of making good and thought trough decisions and just ignore that whole backslashed namespaces incident.

If the PHP developers were to address the inconsistencies of the language and actually _standardize_ on something, even with some decent refactoring-tools, this would still be a rather big undertaking and would no doubt lead to _more_ bugs in the core framework until all the itches get sorted out.

And for what? PHP is well known for causing applications to break between releases, but intentionally breaking and crippling _all_ PHP code in existence? They might as well give it a new name and release it as something different than PHP all together.

But why would anyone actually bother to do that? Does PHP as a language have _any_ qualities not found in other languages? Does PHP, besides existing codebase which in this case would be a moot point, offer anything which isn't already offered everywhere else?

For PHP to solve its problems they would have to abandon the only thing which support it as a platform. I postulate that PHP, in its current shaky state, is the way PHP will remain for as long as it is considered relevant.

<comment><USER14> _Does PHP as a language have any qualities not found in other languages?_

Yep.

1\. Everything's a template. This is a double-edged sword.

2\. mod_php is stupid simple. Makes deployment is a cinch.

I'll update this list if I think of others, but these two are a boon for new and impatient developers alike.

<comment><USER13> _1\. Everything's a template._

Hardly unique. Microsoft's (now deprecated) ASP had this. ASP.Net can also be treated like this if this is desired, although most of the time it isn't.

 _2\. mod_php is stupid simple. Makes deployment is a cinch._

As I have mentioned in another reply, the easy of deploying PHP solutions is hardly unique. Out of my mind I can think of perl, python, asp and asp.net which offers similar ease.

In fact it can be argued that PHP's problematic compatibility betweens, dependency on server-settings and other similar less predictable parameters when deploying on a random hosting service makes PHP deployments more problematic than those mentioned above.

My experience with Asp.net would lead me to believe that Asp.net deployments are just as easy and can be done much more reliably without encountering deployment issues.

<comment><USER15> You're forgetting the popularity of cheap shared hosting plans. PHP is offered on many hosting plans for $10 or less dollars a month and "just works" in that you upload a PHP file and it works with zero extra configuration. Most cheap hosts don't offer this low barrier to entry with Python, ASP, ASP.NET, RoR, etc.

<comment><USER13> I'm fully aware of this, but that can hardly be accounted for as a feature of the _language_ itself, which was what I was asking about.</comment></comment></comment></comment></comment>


Building Carousel: How we made our networked mobile app feel fast and local - <AUTHOR> https://tech.dropbox.com/2014/04/building-carousel-part-i-how-we-made-our-networked-mobile-app-feel-fast-and-local/ <comment><USER2> For more on the subject of "optimistic interactions", check out Luke Wroblewski's post from July of last year on getting the Polar app to feel super-responsive: [http://www.lukew.com/ff/entry.asp?1759](http://www.lukew.com/ff/entry.asp?1759)

<comment><USER3> Awesome man, thanks!

</comment></comment><comment><USER4> Super interesting, but for the enterprise software crowd I don't think those lessons be applied 1:1, the complexity of such a solution in enterprise apps will be higher.

Why?

Conflict resolution is costly and if coupled with a delay can be irrevocable. This means you need as much data validation and associated business logic offline in your app to prevent the user from even saving wrong data in the first place.

Some customers will _want_ their users to work disconnected during their whole work day to save on data costs. Again, think global, data plans are not the same between the US and Brazil, for example.

Even if permitted to work online, the work environment the user enters might prevent them from going online. Think hospitals, where mobile phone usage is restricted in certain areas or is simply blocked through an active MRI machine in the vicinity.

The amount of data needed locally will likely be higher than in consumer apps.

A fully offline capable model to ensure maximum independence of connectivity needs a mix of sync mechanisms that should follow their respective business use cases. Conflict resolution and error handling is not exactly simple in such an environment, pervasive logging is key - plus a way to sync down app logs to the online backend. Users can freely fiddle with time/date and locale settings on iOS devices for example, which can wreak havoc on your sync logic - being able to backtrack such events is key when dealing with customer support issues.

<comment><USER5> There are some general purpose algorithms for conflict detection and management. Google CRDT or watch my Strangeloop talk about the data structures used by Apache CouchDB and Couchbase Lite. [http://www.infoq.com/presentations/sync-mobile- data](http://www.infoq.com/presentations/sync-mobile-data)

</comment></comment><comment><USER6> I once used a similar trick -- queuing uncomfirmed outgoing edits, and replaying them on top of incoming models -- when working on a web client app (Laszlo Calendar, a browser UI to an iCalendar-backed server). It was an act of desperation: user edits would disappear and reappear, depending on the relative latency of client->server and server->client connections, and trying to add delays was a game of whack-a-mole. Replaying an edit queue onto the incoming model eliminated lots of code and all the bugs.

I tried to write something up about this although looking back half a decade later leaves me even less impressed by my communication skills. Nonetheless, in case it's useful to see some coding details, a (pre-Promises, pre-Harmony, 2008) JavaScript sketch of this is here: [http://blog.osteele.com/posts/2008/02/synchronizing- client-m...](http://blog.osteele.com/posts/2008/02/synchronizing-client- models)

This was before Operational Transform, but in retrospect it could be viewed as a simplified subset of that algorithm.

Several times since I've seen clients that try to skip this, sending the edit upstream and then synching to the model that comes back down, which may not reflect the edits. And then add delays which sometimes hide the problem.

</comment><comment><USER7> The couple of short code fragments in this article suggest that the cross- platform code in this app is in C++. Can anyone inside Dropbox say whether this is correct? And if so, were you able to use any tools to make the JNI glue code less tedious to write for the Android version?

<comment><USER8> The short answer is yes, we use a fair amount of C++, and yes, we've eliminated writing the JNI code for developers on the team. We're planning on writing more about both of these topics in a future blog post and we're interested in sharing our tools with the community, though it will take some work to make them less specific to our code base.

</comment></comment><comment><USER3> Came across "The Decline of the Mobile Web" here on HN a few days ago:

[http://cdixon.org/2014/04/07/the-decline-of-the-mobile- web/](http://cdixon.org/2014/04/07/the-decline-of-the-mobile-web/)

Don't optimistic actions prove he's wrong?

</comment><comment><USER9> Only operations that can be rolled back locally should be done, since you might have to roll them back if the server says something else happened than you thought.

</comment><comment><USER10> I don't understand. Isn't this what Dropbox Sync API for?

<comment><USER11> Not in the least. The app does not sync so much as browse--I have many more times photos than my phone can even hold.

<comment><USER10> Sync API caches remote files, but not all of them.

</comment></comment></comment><comment><USER12> Isn't carousel just a dragnet, which Rice has joined to oversee? I do not believe this is an at all unfair hypothesis, in the light of the Snowden revelations and Rice being a war criminal and all.

<comment><USER13> As little as this site enjoys political interference with technology and progress, I think this is an unfortunate issue that a lot of people should hesitate over when considering continual use of Dropbox and its related products. I'd love to switch, but then... I'd also like something as easy as Dropbox for sharing photos and keeping light backups.

<comment><USER12> I think it's bizarre that people went a-lynching over Eich, a man who a decade ago voted against gay rights... But nobody cares that a woman who actively destroyed rights for all over the last decade now has steer over an organisation who hold your data.</comment></comment></comment>


Google Meet Free for Everyone - <AUTHOR> https://blog.google/products/meet/bringing-google-meet-to-more-people/ <comment><USER2> I just can't understand why Google, with all their different messaging apps, could not compete with Zoom at the beginning of the confinement. Same for Microsoft/Skype. With all their intellectual power they could not make a simple and enjoyable product like zoom did.

By the way it's the same for Slack. Microsoft had a wonderfull and enjoyable MSN service that they killed for the awful skype experience, and Slack take their chance. Slack is just a dumb chat board, it's like living in 2000, just with bigger upload possibilities. I feel there is something broken.

</comment><comment><USER3> hard to trust Google with personal data, Zoom is lesser of two evils.</comment>


Ask HN: Has my domain name been hijacked - <AUTHOR>

A couple of days ago, the name server for my site suddenly changed to something else. On my domain provider it is showing as the right one. For example this is what my domain registrar is showing
example.com ns7.abc.com <<comment>---- this is the correct value
However, when I use nslookup, I am seeing something else altogether:
example.com dns1.xyz.com
My whois entry is indicating the incorrect value. The whois record continues to show the right owner of the domain though.
Has my domain been hijacked? How can I fix this? </comment><comment><USER2> If your domain registrar is showing the right name server then it should be okay. Try to contact the registrar and talk to them about the problem, They should be able to fix it. It may also take some time for the DNS to set (aprox. 24 Hours).

<comment><AUTHOR> Thanks. The registrar has not been very helpful. We waited 48 hours and still no resolution.

<comment><USER2> Hmmm... I highly doubt your site has been hijacked if you can still access the registrar and your whois information is showing. Can you tell me the name of the domain and registrar. Thanks

<comment><AUTHOR> It is for a client who is not comfortable publicly sharing the name of the domain. Is there anything I can do besides waiting it out?

<comment><USER2> If that's the case then what I suggest is that you try to contact the registrar as this seems to be a mistake on their part.

</comment></comment></comment></comment></comment><comment> mike-cardwell What is the domain, and what _should_ the records look like?</comment>


A Matlab Programmer's Take On Julia - <AUTHOR> http://2pif.info/op/julia.html

<comment><USER2> This post was discussed constructively on the Julia mailing list some time ago, and spawned a long and interesting thread. Worth perusing for some followup.

[https://groups.google.com/forum/?fromgroups#!searchin/julia-...](https://groups.google.com/forum/?fromgroups#!searchin/julia- dev/a$20matlab$20programmer/julia-dev/W2C9-HbXH3o/86D4GUYtYgwJ)

<comment><USER3> The authors seem very receptive to feedback -- which is encouraging. Maybe I missed if they addressed this, but I wish they'd consider the IDE to be an important part of the language ecosystem. A web REPL is good... but I suspect that (despite Steve Yegge's prediction that the browser is the next IDE) that programmers will expect a serious language/environment to be called interactively through emacs as can R, matlab, and python/ipython (I heard vim can also do this with R?). Or, possibly through an IDE like Rstudio with optional local/server access.

<comment><USER4> I expect the Web REPL will ultimately evolve into something like RStudio (which itself is web-based, even in local mode).

There is already an emacs mode for Julia: [https://github.com/JuliaLang/julia/blob/master/contrib/julia...](https://github.com/JuliaLang/julia/blob/master/contrib/julia- mode.el)

<comment><USER3> Emacs mode already? They're doin it right. :)

I was not aware RStudio was web-based. News to me...

<comment><USER4> Yep, RStudio is GWT driven (<https://developers.google.com/web-toolkit/>) and uses some very particular configuration tricks to keep you from accessing it with a browser in local mode.

</comment></comment></comment></comment></comment><comment><USER5> I'm the post's author. I submitted it to HN a couple of weeks ago, but it didn't get much attention; I'm happy to see more comments this time around.

Regarding IDEs: I guess it's a matter of taste. I don't like IDEs, but I wouldn't mind using one as long as it allowed me to code in my editor of choice.

Plotting: I decided to scratch my own itch, and created Gaston, a gnuplot interface. It already offers quite a bit of functionality. It's available at <https://bitbucket.org/mbaz/gaston/>

nargin vs length: this is something I overlooked when I wrote the article.

I will post a new article with the perspective and knowledge that working on Gaston has given me. I already know what the conclusion will be: julia stands a very good chance of becoming the new standard language for technical computing.

</comment><comment><USER6> Interesting points, the matrix edge cases seem a bit weird. I program in Matlab all the time, but I basically can't imagine leaving it for Julia no matter how good the language is.

The main reason being that the single most valuable part of Matlab, for me, is its amazing IDE. I've seen a lot of people caught up in debates about languages, obsessing about this feature or that one but it is much more rare to see people argue about the IDE, as if it was merely an afterthought. I find this article guilty of the same crime. The author also dismisses Matlab because a statement with no semicolon prints its result (something I take advantage of often) and other small issues , but there is no mention of everything else you lose when going to Octave. Really?

Maybe I'm spoiled, but I now can't live without seeing all my variables and their size, types and values listed, my ability to quickly execute blocks of code at random, jump around all files, super fast and flexible visualizations, great debugger, profiler, docs at fingertips, etc etc etc all integrated into a single package that just works out of the box. It's development on steroids and I've never seen anything that lets me code faster. I feel sorry for people who code in vim.

<comment><USER7> I would leave MATLAB's IDE in a heartbeat for something that ran in the browser. In my experience, MATLAB's IDE is a terrible piece of crap. It's slow. It's particularly slow when accessed via X11 forwarding, even from the same network. It's memory-hungry. It crashes randomly on OS X (and semi- randomly on Linux). The plots aren't anti-aliased. If you open too many plots, it runs out of Java heap space and crashes. The only thing it has going for it is the tight integration with mlint, but even that's kinda stupid because they could have just written a better optimizing compiler.

<comment><USER8> Why the browser? In my experience, editing text in a browser is pretty horrible. It doesn't matter for banging out HN comments or emails, but for code, I don't think I could put up with it. It's bad enough having to use the text editors in Eclipse and IntelliJ; regressing all the way to browser text boxes would be a tragedy.

Is it for the sake of having persistent server sessions that don't go away when you close your client? That could easily be done, and has been done, without resorting to using a web browser. I admit that Emacs with Slime is not a paragon of simplicity and reliability, but I suspect it would be easier to recreate the convenience and polish of a web UI in an independent client (possibly based on a hacked version of Chrome or Firefox, if you really, really like your browser) than it would be to turn a text box into a decent code editor.

<comment><USER7> My main reason for the browser is that it makes seamless to execute code on a remote machine. Text-based interfaces are not very useful because you can't see plots without saving them and copying them. X11 forwarding is slow. My current solution is NX, but it's not optimal, since I hate NX 4 and NX 3.5 doesn't run on Lion.

Cloud9 IDE is already a decent browser-based code editor. It's already better than the MATLAB editor in just about every way but integration with the interpreter. Using a browser-based IDE will solve both the cross-platform UI issue and the remote access issue.

</comment></comment></comment></comment><comment><USER9>
      > Furthermore, in Julia the varargs tuple x will have to be
      > processed without the convenience of Matlab's nargin
      > function.

I genuinely don't get that. _nargin_ is equivalent to _length(x)_ in this scenario, and Julia's overall handling of default/variable arguments seems significantly more convenient than MATLAB's

      if nargin < 5
        foo = 21;
      end

preambles.

</comment><comment><USER8> _In Julia, I could do

      (s,z,zz) = spectrum(x);

but I end up with variables z and zz that clutter the workspace and take up memory._

This is easy to fix with a bit of additional syntax. Using a placeholder to indicate values you don't care about, that would be:

      (s,_,_) = spectrum(x);

I don't know if it's simple on the implementation side, but it's easy to read and understand.

</comment><comment><USER10> It seems to be a bit early to criticize Julia on details like that. Still, not a bad article.

<comment><USER11> Because Julia is at such an early stage, such articles are important to help it improve.

</comment></comment><comment><USER12> _No plotting, except in the web REPL, and only very simple (if pretty) 2D plots supported._

This is something I'd miss. I use R sometimes only because it's plotting features are so fantastic.

<comment><USER13> it's just for now. as soon as the language gathers steam you can expect for the modern amenities to show up, including 2D plots on the desktop.

Julia has a stub-free FFI; you don't have to write anything to interface with C. trivial to add your favorite 2D graphics library.

P.S. Don't people know how to interface with Gnuplot?</comment></comment>


MomoCupid – Tinder for Geeks. Because Geeks Are Worth It - <AUTHOR> http://momocupid.com <comment><USER2> I'd highly recommend getting a lawyer to do a name search on this domain/brand. OKCupid is (probably too) similar and has the money to sue, if they want to.

<comment><AUTHOR> It's an April fools joke

<comment><USER2> That's too bad. It's a good idea.</comment></comment></comment>


Out-Of-Office Messages Are a Security Risk - <AUTHOR> https://lonesysadmin.net/2019/02/03/out-of-office-messages-are-a-security-risk/ <comment><USER2> Stuff like this is what keeps organizations from taking corpsec guidance seriously. Whatever the infinitesimal risk you accept by setting an autoresponder, it's dwarfed by the risk of convincing the rest of your team that you're a crank, and that what you have to say about phishing and email attachments isn't to be taken seriously.

<comment><USER3> I agree absolutely. It's similar to previous companies I've worked at that do phishing test emails for all their employees (usually at 9am on a Monday). There's little evidence it works, it is security theater and generally harms productivity. Knowing when not to bother people about security can be really helpful.

<comment><USER4> Followed immediately by HR sending an unsigned email about critical deadlines for benefits or something, telling you to click a link and/or a PDF attachment.

<comment><USER5> The most obvious phishing email I ever received was from some random domain informing me I had not take the required anti-phishing tracking and to please click the link to take it. Like a good employee, I sent the email to our spam@ account and didn't give it any more thought. A month later, my manager comes in and informs me that the anti-phishing training is not optional and I had a week to complete it.

<comment><USER6> At a large company, shouldn't someone be monitoring the address where people report phishing, who can tell you if a reported message is legitimate?

I work at a small company, so I don't know if this is how any IRL organizations work, but it's how I assumed the procedure went.

<comment><USER7> Anecdote time:

At one of my previous jobs, there was this big part of intranet that was used by sysadmins, and various other people from fields other than software development. My team didn't have to deal with it, so we weren't even aware of it, much less had access to it. One day, however, someone wanted me to review a document from there. I bounced off the "Unauthorized" error, and dutifully followed the instructions to fill in an appropriate box with a justification, and send a request to be granted access.

The issue wasn't critical, so I didn't pester anyone about it, just patiently waited for the access, re-filing my request every other month. Many months later, with me still not getting access, I eventually brought this up to my boss, who then smiled and told me that this access request form literally goes to /dev/null. Apparently after some software migration, no one bothered to connect this to anything.

</comment></comment></comment></comment></comment></comment><comment><USER8> As always with security the first thing to ask is "What is your threat model?"

This person's threat model seems to be people who email him for a legitimate business reason, but see that he's away & take the opportunity to attack him? I just don't buy it - I think there is nothing wrong with always setting an autoresponder.

<comment><USER9> Yeah, this is a stretch...

I'm getting pretty tired of this kind of thing. It's pretty clear to me that the infosec industry (within appsec and netsec at least, not risk and compliance) is bifurcated into two distinct groups. The first group consists of people who have real technical expertise, find serious vulnerabilities and make concrete suggestions about legitimate issues.

The second group, and the one I see more and more often (especially in bug bounties), consists of people who find ridiculous "security" "risks" in all manner of things. They're not appsec or netsec people but they _think_ they're identifying actual security issues. Sometimes they point out superfluous implementation issues but more often than not they're writing articles like this - nitpicking the design of a thing without clarifying their threat model and with only a vague grounding in the potential risk of compromise.

I mean did we really need a security PSA about the risk of email autoresponders? Come on.

<comment><USER10> I have heard the term "security vultures" being applied to the second group, and wish it was more common (the term, not the group...)

<comment><USER11> I like "security fatalism" for the underlying behavior.

</comment></comment></comment></comment><comment><USER12> Or you just check the box that says "only send to people at my organization".

<comment><USER13> What if you are working mainly with customers? BTW, the article says: > Set the autoresponse to the smallest group possible. In many cases you can narrow it down to coworkers, and/or have a different message for people inside your organization than outside your organization.

<comment><USER14> I think the context of the blog post, "the lonely sysadmin", means "working mainly with customers" isn't its target audience.

Bikeshedding for a moment, I suspect the right response for people "working mostly with customers" is for the CRM to automatically re-route known-customer and cold-call emails to someone else on the "working mostly with customer" team, instead of first up telling customers or leads "Sorry, Bob's away for 2 weeks", which is _never_ going to be the message you want to be sending there...

</comment></comment></comment><comment><USER15> > Don't tell people anything more than they need to know. Does everybody > really need to know where you've gone and how long? Probably not. You're > just gone. Set some expectations around response time, though.

That's a borderline contradiction.

<comment><USER4> True -- fixed. Thanks.

</comment></comment><comment><USER16> 'Don't record "we're on vacation"' on you home phone answering machine is _ancient_ knowledge/advice.

<comment> yjftsjthsd-h Indeed - who has an answering machine these days?

<comment><USER17> Most people have voicemail which is pretty much the same thing.

<comment> yjftsjthsd-h In general, touche. For this context, there's a meaningful difference: voicemail, unlike an answering machine, is accessible from anywhere, so there's no reason to set a "we're out of town" message.

</comment></comment></comment></comment><comment><USER18> [https://twitter.com/natashenka/status/974822101067612161](https://twitter.com/natashenka/status/974822101067612161)

<comment><USER19> Next time a little comment would go a long way confronting with HN guidelines.

</comment></comment><comment><USER20> I haven't seen any mention of his other point.

"If you're gone be gone."

I don't respond to emails on vacation or after I get off of work. Not even meeting invites. If I happen to be working late trying to figure out something, I make it a point not to let anyone know. I don't want to set the expectation that I'm always reachable.

I have a project manager and a QA person who will send me messages on our Slack channel. They ask me did I see it I tell them when I'm home I'm home.

One exception is that I will answer an email to our offshore team, but even then I take the local developers and manager off of the email list.

</comment><comment><USER21> Microsoft Outlook allows separate settings for internal versus external out- of-office messages. There's no real security risk in telling my work colleagues where I am.

<comment><USER22> Google allows you to limit our of office messages to within the company as well.

</comment></comment><comment><USER23> Even worse: Social media posts of traveling/vacation.

</comment><comment><USER24> Important to keep in mind that security is always balanced with convenience. Individuals need to just judge how much "risk" they want

</comment><comment><USER25> This reads like something someone logiced out in their head but has no basis in any information that indicates if any of this is a real risk.

</comment><comment><USER26> 2 cents on the topic. Potentially. Auto responders let spammers knows its a live mail account. It can also become a backscatter problem.

</comment><comment><USER27> I fail to see how being out of office and not responding to work email has any relevance to a person not recognizing when their bank accounts are being zeroed. I also fail to see the vector by which someone being out of office gives an attacker access to their bank accounts.

</comment><comment><USER28> Q "hey did you get my email? im following up. that thing X needs to be done and they are asking me why not"

A "well, i was out of office. jamaica is amazing... have you been"

Q "No, uhm, so the thing is that we are going to lose 5 bajillion dollars if this is not done by 2 pm"

A "jerk chicken. its just like my mind opened up to a whole new way of seeing the world.... "

Q "Right so.. .. will we be able to have that paper by noon maybe? Then I can get it signed and we can rush it back to the.."

A "no, sorry, it takes 3 days to send it through Central, then West has to backsearch the kumquats, its not something i really have control over"

Q ".... was your out of office not working? i couldnt see it.. i mean i thought you were there..."

A "no, thats a security risk. i wouldnt want us to lose money due to some scammer"

Q "what.. is that some new IT policy? i dont remember seeing that..."

A "no, no, i read about it on this site for experts in computer stuff, its called Hacker News, you should check it out"

</comment><comment><USER29> Out of office? Its an invitation to a thief with the address attached in the signature.

<comment><USER30> Is it? If I leave for a week is it assumed all of my coworkers also leave, our doors unlock and alarms are off?

Maybe that's a risk for a single person working in a coworking space. Probably less so for companies that have >1 employee.</comment></comment>


Civil War message opened, decoded: No help coming  - <AUTHOR> http://hosted.ap.org/dynamic/stories/U/US_MESSAGE_IN_A_BOTTLE?SITE=PAPIT&SECTION=NATIONAL&TEMPLATE=DEFAULT

<comment><USER2> Presumably somebody is now going to be charged with rape - for releasing classified US army information

<comment><USER3> That would be the CS Army. Very different.

<comment><USER2> If the secret that they lost got out - wouldn't it harm the morale of US forces from the south?

and therefore treason

</comment></comment></comment><comment><USER4> Encoded with a Vigenere cipher ... cool!

<comment><USER5> Not saying it would take me less time but damn, it took the retired CIA code breaker "several weeks" to solve?

<comment><USER6> From the article, it seems as if its breaking was done A. by hand, and B. more as a hobby than anything else. It was explicitly noted that if they had bothered feeding it through a computer, it would've taken "a fraction" of the time.

<comment><USER7> For maximum fun, you cannot use tools stronger than were available to make the code, to break the code.</comment></comment></comment></comment>


Fontgate: Anachronistic typography topples defense in Panama Papers case - <AUTHOR> https://www.theguardian.com/world/2017/jul/13/fontgate-microsoft-wikipedia-and-the-scandal-threatening-the-pakistani-pm <comment><USER2> duplicate, please help keep down the noise and check before submitting!

[https://news.ycombinator.com/item?id=14751358](https://news.ycombinator.com/item?id=14751358)</comment>


Google's Diversity Rumpus – The Fun Thing Is He's Right About the Cause - <AUTHOR> https://www.forbes.com/sites/timworstall/2017/08/07/googles-diversity-rumpus-the-fun-thing-is-hes-right-about-the-cause-of-the-gender-disparity/#3820983e2b41 <comment><USER2> How on earth did this get published... Here's my main question, as stated by Marco Rogers: "This is what I don't understand about these white dudes. They will _admit_ to a history of racial and gender discrimination. Yet they insist on starting current arguments from the basis that the representation we see today is justified. How does that make sense?" [https://twitter.com/polotek/status/894551256596832256](https://twitter.com/polotek/status/894551256596832256)

This was a cover article in the Atlantic: "Why Is Silicon Valley So Awful to Women?" [https://www.theatlantic.com/magazine/archive/2017/04/why- is-...](https://www.theatlantic.com/magazine/archive/2017/04/why-is-silicon- valley-so-awful-to-women/517788/) Discussion [https://news.ycombinator.com/item?id=13871915](https://news.ycombinator.com/item?id=13871915)

Gender disparity is extra high in computer science and engineering subjects. [http://d3i6fh83elv35t.cloudfront.net/newshour/wp- content/upl...](http://d3i6fh83elv35t.cloudfront.net/newshour/wp- content/uploads/2015/04/Cummins.bachelors-degrees-1024x553.png) We know there were historically more women [http://www.smithsonianmag.com/smart- news/computer-programmin...](http://www.smithsonianmag.com/smart- news/computer-programming-used-to-be-womens-work-718061/) so it's not like you can argue that it's just momentum, let alone genetics. The article is factually wrong from top to bottom.</comment>


The End of Manufacturing (or why buying Amazon stock is still a good idea) - <AUTHOR> http://a1.blogspot.com/2011/08/end-of-manufacturing-or-why-amazon.html

<comment><USER2> I have doubts. 3D printers are effective at replacing casting and (sometimes) stamping. But they don't replace forging, rolling or assembly of moving parts. That is, I think they most replace manufacturing operations which were low labor anyhow. I doubt they'd actually reduce labor in those areas, since the number of people needed for them seems to be _one_ already.

If I was looking for an industry to be hit hard by 3D printing technology, I would look at companies which specialize in tooling or warehousing specialized single component parts.

</comment><comment><USER3> I always have the same dream since childhood. however the cloner machines could be sold to everyone. and we could copy all manufactured goods to friends.</comment>


Plan to bring UK clocks forward - <AUTHOR> http://www.bbc.co.uk/news/uk-12517762 <comment><USER2> I hope they factor in global costs. Also when the DST stuff changed here in the states a while back, I either missed an update on my corporate managed machines (or something) cause I was showing up late in the Spring and early in the Autumn to various meetings during the dates in between the new and old dates. I eventually got a new laptop and didn't have the problem anymore :D However, I do remember many of our servers being out of sync at least for the first change, and we eventually just relied upon GMT dates and did a lot of fudging by hand with anything during those time periods.

<comment><AUTHOR> This is the government we're talking about, there's no way they can factor these type of things in :)</comment></comment>


Show HN: Los Angeles Startup Club - <AUTHOR> http://lastartupclub.com

<comment><USER2> Cool! Since the startup I work for has been acquired I've been working downtown and lamenting the lack of such things. I'd like to check out your spot sometime!

There's also an interesting group of folks over in silverlake at the "silverlake headquarters (SLHQ)", which is also decidedly non west side. :)

</comment><comment><USER3> Good luck with this!

I can't commute downtown right now (trying to get back into the swing of things after having our first child) but would consider future sessions.

</comment><comment><USER4> Sounds fun. I wonder if the demand will be large enough to overcome the number of tiny difficulties in getting involved, such as location and application process.

</comment><comment><USER5> There's also Droplabs, free downtown LA co-working with a Burning Man vibe. There's at least one Very Interesting startup developing out of Droplabs.

</comment><comment><USER6> Scanned from right to left, read the URL and thought "Last artup club? What's an artup?"

Regardless, great idea!

</comment><comment><USER7> First I'm hearing of it, but a) awesome! and b) recommended based on the folks involved.</comment>


FBI: Hundreds Of Thousands May Lose Internet In July  - <AUTHOR> http://www.huffingtonpost.com/2012/04/20/hundreds-of-thousands-may-lose-internet-in-july_n_1441260.html?ref=mostpopular

<comment><USER2> I really dislike the way this has been handled. Yes, I'm sure the FBI is legally prohibited from notifying the victims of the problem directly or even fixing it remotely, but there are many other avenues available to address the issue than needlessly partnering with a single private contractor. Even the posts addressing the issue don't provide clear instructions to verify or clean the issue, and the external sites they reference are provided by DNS name rather than IP.

I think that at the very least the G20 need to agree to the creation of some form of unified body able to address these types of issues effectively. For that to happen the governments involved would need understanding and expertise in online security, which they are all sorely lacking. It's going to be a very rocky road.

Not to be a jerk, but I don't come to HN to see headlines from the Huffington Post. In restrospect I don't think I should have commented.

<comment><USER3> Where do you think HN should source it's headlines from?

<comment><USER2> I have nothing against reading Huffington Post for entertainment or opinion pieces, but it's hardly a source for anything relevant to hacking(in the HN sense) or startups. I come here to see news that doesn't make the headlines of major media outlets. I probably shouldn't have commented on the article that I didn't want to see on HN, but I felt I should contribute if I was going to criticize.</comment></comment></comment>


Why is Twitter Partnering With Gnip? - <AUTHOR> http://www.readwriteweb.com/hack/2010/11/why-is-twitter-partnering-with-gnip.php

<comment><USER2> Uhm. Because they could use the money?

[http://www.readwriteweb.com/archives/twitter_co- founder_ev_w...](http://www.readwriteweb.com/archives/twitter_co- founder_ev_williams_addresses_the_peren.php)</comment>


Ask HN: A kid-proof desk that accommodates a laptop and 2nd screen? - <AUTHOR>

I've got a work-from-home programming gig, and I'm looking for a good desk that can accommodate my laptop (15" MacBook) and an LCD screen that I'll be using as a second monitor (size TBD, although bigger is better).
Only thing is, my living room is my "office," and I've got two small kids who are very curious.
Ideally, I'd like to get an armoire or something else that closes up, so the kids can't touch the laptop or the LCD screen (or the printer, which I'm hoping to also store inside).
Any recommendations? <comment><USER2> Give them proper education

<comment><AUTHOR> Proper education only goes so far with a 1-year-old.

</comment></comment><comment><USER3> You can look for an armoire style desk. I nearly bought one of those once (then it wound up not in the budget or something). My recollection is that it did come with room for a printer, so I think that's entirely possible to find in an armoire desk. An alternative you could consider is a drop-leaf desk. I had a small drop leaf desk at one time that I used with a laptop. I loved it. I think one benefit of a drop-leaf desk is you can get them with legs so there is more leg room than you might get with an armoire. They tend to be somewhat cheaper as well.

Here is a picture of a drop-leaf desk with a laptop on it: [http://www.cymax.com/Common/Product/Coaster-Desks- Traditiona...](http://www.cymax.com/Common/Product/Coaster-Desks-Traditional- Secretary-Desk-in-Cherry-800371.htm)

I used to close my laptop up, stick it in the desk and close the desk. My children were older than yours and I have no idea how that would work with a second screen added. Style-wise, mine was more oriental looking than western. I have been googling and so far haven't seen anything like what I once had.

Best of luck finding something that works for you and your situation.</comment>


How alcohol causes liver damage - <AUTHOR>

Alcohol can ruin liver cells and result in liver harm that triggers fatty liver health, irritation, alcoholic hepatitis or cirrhosis. Drinking even a small amount of alcohol could make it worse if you already have liver health disease. <comment><AUTHOR> [http://mcohol.com/how-to-protect-your-liver-if-you-drink- alc...](http://mcohol.com/how-to-protect-your-liver-if-you-drink-alcohol/)</comment>


New Zealand mosque shooter livestreamed killings on Facebook - <AUTHOR> https://nypost.com/2019/03/14/new-zealand-mosque-shooter-livestreamed-killings-on-facebook/ <comment><USER2> Stop calling these "killings" this is terrorism.

They are nazi terrorists. Today they killed children while they prayed.

They set bombs on cars at the nearby hospitals.

No one refers to 9/11 as killings. No one refers to the Ariadne grande concert as killings.

This is terrorism, by a bunch of racist bigots.

<comment><USER3> The prime minister of NZ clearly called it a terrorist attack. And NZ media are carrying that line throughout.</comment></comment>


Ask HN: What Are Good Product Manager Qualities - <AUTHOR> How important are design skills for a product person? Is it more important to have engineering background or good design skills? <comment><USER2> A basic understanding of the development process is necessary since product managers need to be able to work with the engineering team, but since PMs don't write code, they don't need to have an engineering background. I think design skills are more important. (They may need an engineering background if you have a very technical product, like an IDE, that's being sold to developers.)

What you didn't mention, and what I think is very important in a PM, is "people skills". PMs have to be able to interact effectively with the sales, marketing, and support organizations, and also with users. They have to be able to envision themselves in the position of the user, and have empathy for users problems.

(I'm an engineering manager who has worked closely with many PMs over the years.)</comment>


Fad or Icon? How the Crocs brand crashed & burned - <AUTHOR> http://ries.typepad.com/ries_blog/2009/10/how-crocs-crashed.html <comment><USER2> While the stock price has certainly crashed, Crocs is still worth $650M dollars: [http://www.google.com/finance?client=ob&q=NASDAQ:CROX](http://www.google.com/finance?client=ob&q=NASDAQ:CROX)

If that's a fad, I hope I can create a fad business someday.

Maybe the Crocs business strategy was exactly right - milk it while it's trendy, and then keep a good business at the end.

It's not like these shoes are Nintendo Wiis. There is absolutely no limit on how many you can produce. If Crocs hadn't saturated the market, then all those knock-offs would have stolen more of the total money to be made on the idea.

<comment><USER3> > If Crocs hadn't saturated the market, then all those knock-offs would have > stolen more of the total money to be made on the idea.

That is true. I think the total amount of crocs sold is the same - the only difference is that 90% of them are knockoffs. I am wearing a $2 pair of knock- offs right now.

The problem is that it was a good idea which everyone could copy.

</comment></comment><comment><USER4> I could understand these as cheap water shoes for children. I've been a fan of these watershoes for adults: [http://www.rei.com/product/780680?cm_mmc=cse_froogle-_- dataf...](http://www.rei.com/product/780680?cm_mmc=cse_froogle-_-datafeed-_- product-_-780680&mr:trackingCode=C837B1FE- FB85-DE11-B7F3-0019B9C043EB&mr:referralID=NA)

They stay on really well, and when combined with neoprene booties provide the best cold water/mountain river shoe I've ever found. I use these when I go kayaking or try to hike up a stream or creek.

They're not that much more expansive, but provide a significantly improved experience, and look a lot nicer. Overall though, I the crocs fit a certain need -- cheap watershoes, for infrequent use, or for children.

</comment><comment><USER5> I wondeer if this helped their downfall.

<http://www.thebestpageintheuniverse.net/c.cgi?u=fashion>

<comment><USER6> While I doubt Maddox alone was a serious influence on anyone's stock price, commentators like him definitely have an influence on people's attitudes; when Crocs became ugly and smelly in the minds of many potential customers, those people were no longer potential customers.

(Whether Crocs are _actually_ ugly and smelly is beside the point, though I agree with maddox here)

</comment></comment><comment><USER7> Yeah, their stock was trading around a P/E of 60 for a while. Its the first and only time I bought a put on a stock. Complete irrational exuberance.

</comment><comment><USER8> If they hadn't produced to sustain and satisfy demand, they might have made less money, if the trend was destined to falter anyways.

</comment><comment><USER9> Question for debate: is twitter a fad or an icon?

<comment><USER10> This is not a question that can be answered in a span of less than a decade.

<comment><USER9> Yeah, you're right, but it's an interesting one to ponder.

</comment></comment></comment><comment><USER11> Oh come on. Everyone and their mother saw this one coming. Anyone who bought shares of Crocs was only playing a game of timing.

</comment><comment><USER12> Funny, I doubled my money on the stock in the last 6 months... I think they're doing great!

Yes it was a fad, and yes they didn't stick to fundamentals with their product line, but there are enough fat people, diabetics, and children in the world to sustain the company for the long haul.

</comment><comment><USER13> All the knock-offs at one fifth of the price probably helped too...

</comment><comment><USER14> <http://news.ycombinator.com/item?id=900866></comment>


Ask HN: Are OTPs never prime? - <AUTHOR>

Indian banks use one-time password for two-factor authentication. Prashant (https://twitter.com/pacificleo/status/600132236730441728) is saying that he has never seen an OTP that is prime. Which makes him ask if this is intentional.<p>- Is this true? If yes, why?<p>PS: this is my first submission to HN. Thanks. <comment><AUTHOR> I think that this is just probability in play. OTPs are usually 4 or 6 digits. Probability of seeing a prime number is little because of prime number theorem. I might be wrong though.

<comment><USER2> Some digging reveals that a common method for generating OTPs is through repeated hash function applications. A good hash function should produce uniformly distributed outputs.

There are 78,498 primes less than 10^6 (so, primes less than 6 digits), meaning that there is about a 7.9% chance of independently seeing a prime OTP if the OTPs are uniformly distributed. That seems pretty high. The expected value for seeing a prime OTP after multiple trials is just 15.

So I wonder if your friend is just unlucky or if his OTP provider is using another method for OTP generation.</comment></comment>


Why are my Go executable files so large? - <AUTHOR> https://www.cockroachlabs.com/blog/go-file-size/ <comment><USER2> I don't really consider go binaries large when I compare to the size of my node_modules.

Is ~100MB large these days?

Maybe for a go binary, mine all seem to be < 30MB

<comment><USER3> Node_modules fetch readmes, images, tests etc. The actual assets that are loaded to your code are less than half of every module, sometimes 10-30%</comment></comment>


Starting a venture - <AUTHOR>

pls let me know any possibilities <comment><USER2> You could open a hamburger stand.

</comment><comment><USER3> I think some important areas to cover in such a post might be:

What do you do? What have you done? What do you want to do?</comment>


The year-long rash of supply chain attacks against open source is getting worse - <AUTHOR> https://arstechnica.com/information-technology/2019/08/the-year-long-rash-of-supply-chain-attacks-against-open-source-is-getting-worse/ <comment><AUTHOR> _The unknown attacker made a subtle change to a Webmin script called password_change.cgi. The change gave attackers the ability to send a command through a special URL that an infected Webmin server would then execute with root privileges. In version 1.890, which had more than 421,000 downloads between June, 2018 and last weekend, the backdoor was turned on by default. ... Backdoored versions were distributed on SourceForge, which is the primary distribution source the Webmin website points to._</comment>


The Idea About Ideas - <AUTHOR> http://iggychaos.blogspot.com/2006/02/idea-about-ideas.html

<comment><USER2> Great post, a bit too long.

Summary -

Ideas do not fall into just good or bad.

a) Dating Julia Roberts is a good idea, but its not feasible.

b) A free email address that has no password or registration is a good idea. (read the article if you're curious)

4 types of ideas:

a) "The obvious next" - ideas that follow logically from what's currently existing.

b) "Now we're ready" - ideas that have a certain technology or other requirement before its possible.

c) "infeasible" - ideas that are good but infeasible because technology/society/whatever is required not ready (its not a 'b' idea). Also ideas that have no money making business model fall into this category.

d) luminary ideas - ideas that are unique and original not just to the thinker, but to the rest of the world too. These are rare.

In short, work off of the 'b' and 'c' ideas, since technology is moving so fast. 'a' ideas are risky because you're competing with everyone else and a lot of luck/skill is required, and 'd' is out because lets face it, no one has them. 'c' ideas quickly become 'b' ideas -

"You merely have to act on them first. Given how fast our technology advances, it's a good idea to perpetually reconsider infeasible ideas every now and then. You never know when an infeasible idea might become feasible."

<comment><USER3> Given his analysis, it may also be the case that "d" ideas occur quite frequently, but since they are (by definition) orthogonal to the way most people think, they do not catch on.

I'd say a lot of this occurs in science fiction and other literature, and these ideas eventually permeate culture and get turned into actual products. E.g. submarines, spaceships, robots.

</comment></comment><comment><USER4> I disagree. Beethoven's 5th Symphony doesn't fall into any of those.

1) Definitely not the "next obvious step."

2) The theoretical principles of canons and fugues, etc. were all in place in the 18th century, but no one but Beethoven could have made the 5th symphony, or anything close to it.

3) Obviously, nothing to do with infeasibility.

4) Again, not luminary, because no one would ever have though of it. Contemporary musical style would change, and Beethoven's work would never exist.

P.S. And if anyone dare try to say the 5th Symphony wasn't an idea, it's brought a lot more good, happiness (relaxation, concerts, etc.), and wealth (selling records, etc.) than most startup ideas...

<comment><USER5> Once we understand precisely how music affects the mind, it will be clear what makes the 5th Symphony work, and it will be possible to create its functionality as "the next obvious step". After all, it's not the sequence of notes that matters, it's the emotion that it creates. So yes, it's (4).

</comment></comment><comment><USER6> There's a slight mistake imho. Einsteins theory of relativity is categorised as a "now we're ready" idea meaning that if he hadn't thought of it somebody else would have. While this is true for the special theory of relativity published in 1905 it is not true for the general theory of relativity which also includes gravity published ten years later.

Many scientists believe that if Einstein hadn't incorporated gravity into the theory there's a good chance that it would still be undiscovered today.

But aside from that a really worthwhile article.

<comment><USER7> "Many scientists believe that if Einstein hadn't incorporated gravity into the theory there's a good chance that it would still be undiscovered today."

Actually, no. If you start out with flat spacetime & try to describe massless spin-2 particles, you'll find gravity falls right out of the equations. It's quite elegant, really.

<comment><USER6> Wasn't this only discovered in the 70's or even later?

</comment></comment></comment><comment><USER8> I wouldn't call "dating Julia Roberts" an idea. By that measure, becoming king of the world, solving P vs NP, winning Wimbledon, would all be ideas. All these are goals, not ideas.

</comment><comment><USER9> That color scheme burns my eyes.

<comment><USER10> Should burn a lot less than black on white, actually.

<comment><USER11> It does seem like it should, but I don't care for the white on black either. Maybe it is similar to why it is easier to drive during the daytime vs. nighttime.

<comment><USER10> The real issue is not "burning" but "low-contrast."

</comment></comment></comment></comment><comment><USER12> Oldie but a goodie. The Lizard Brain post on that blog I think is the best tho.</comment>


The "high-level CPU" challenge (2008) - <AUTHOR> http://yosefk.com/blog/the-high-level-cpu-challenge.html <comment><USER2> _Suppose you want to support strings and have a string comparison instruction. You might think that "it's done in the hardware", so it's blindingly fast. It isn't, because the hardware still has to access memory, one word per cycle. A superscalar/VLIW assembly loop would run just as quickly; the only thing you'd save is a few bytes for instruction encoding._

Actually if you've actually looked at things like SSE memory copying/comparison routines, it's not "a few bytes", it's more like a factor of 100x+. REP MOVSB is 2 bytes; a SSE memcpy, highly unrolled - incidentally, also a bad idea for modern CPUs - is easily a few hundred. I've seen ones over a kilobyte(!) The former is essentially the same speed as the latter, but makes for significantly less instruction cache utilisation, which is increasingly important today.

 _You see, RISC happened for a reason._

When memory bandwidth was not the bottleneck, it was a good idea. Now, not so much. Even ARMs which are considered "RISC" are growing into uop-decoding decoupled OoO machines like x86, and adding more instructions with each new generation. I like to mention this article, where the "purest" RISC, MIPS, turns out to be the least power-efficient:

[http://www.extremetech.com/extreme/188396-the-final-isa- show...](http://www.extremetech.com/extreme/188396-the-final-isa-showdown-is- arm-x86-or-mips-intrinsically-more-power-efficient)

I'd say that CPUs are certainly getting more high-level and CISCy, but not in the same way as their original proponents imagined. If you don't think so, try beating POPCNT, CRC32, AESENC, etc. with a sequence of simpler instructions...

<comment><USER3> I find strange your point about ARM vs MIPS given that ARMv8 seems much more 'MIPSy' than previous ARM ISAs..

<comment><USER4> Why? It's very intentionally _not MIPSy_. ARMv8 removes anything that may dictate any microarchitecture decisions, while MIPS exposes it in an ISA (delay slots and all that). Even predication had been killed for this reason (it's not good for OoO anyway).

<comment><USER5> Yeah, but

* mips didnt have predication to begin with

* arm didnt have delay slots to begin with

* and then afaik 64b arm uses more registers and removes shifter operands

So definitely more mipsy.

<comment><USER4> If "simpler" = mipsy then yes. If "mipsy" = "closer to hardware" then definitely not.

<comment><USER5> MIPSy = closer to MIPS, the actual ISA.

</comment></comment></comment></comment></comment></comment><comment><USER6> 2008? So... anything happen since? I assume nobody took him up on his offer!

"Alan Kay: [...] "Just as an aside [...] a benchmark from 1979 at Xerox PARC runs only 50 times faster today. Moore's law has given us somewhere between 40,000 and 60,000 times improvement in that time. So there's approximately a factor of 1,000 in efficiency that has been lost by bad CPU architectures.""

Is he complaining that machines today aren't a bunch of micro-coded, multi- chip computers like in the good old days, or does he have a better proposal to the modern multi-core, superscalar OoO processors coupled to GPGPU multi- threaded engines?

Because complaining about Moore's Law feels a bit meaningless if DRAM is still 100ns away.

<comment><USER5> In 2015 I find the claim that you could beat Intel by 1000x with a better arch much more idiotic than I did in 2008. Because apart from it being idiotic from a technical standpoint I'm now dumbfounded by the extent of its idiocy from the business angle. If you're so smart, what's stopping you from making a trillion dollars off it?

You need to be an Alan Kay to utter such bullshit repeatedly and still have crowds of worshippers taking each of your utterances as gospel while chanting that you singlehandedly invented computing as we know it.

<comment><USER4> It's trivial to beat a generic CPU by 1000x with a specialised ASIC or even an FPGA in many cases (think cryptography, for example).

<comment><USER7> Make that _a few cases_ for FPGAs. Modern desktop CPUs are incredibly fast and run circles around modern FPGAs, even for many specialized, repetitive, parallel, integer-computation-bound algorithms.

Of course, there are a couple of applications where FPGAs are actually faster than CPUs.

Source: I'm an FPGA developer with a software engineering background.

<comment><USER8> That's fascinating and startling! Why is that? Is it that the FPGA's cost per bit operation is just so many times larger than the CPU's that the FPGA can't compete? Where do GPUs fit in?

<comment><USER7> Several factors:

1) FPGAs are much slower due to the overhead of the flexibility they provide. With a lot of effort, you can get some FPGA designs (not even all of them!) to maybe 400 MHz on the more expensive FPGAs, and then it will do much less per cycle compared to an ASIC (CPUs are ASICs), so you need deep pipelines, with all the cost, complexity, and restrictions this entails.

2) CPUs have a lot of memory on-chip in the form of cache (several MiB), and they have sophisticated prefetch logic. In FPGAs, memory comes in several 100 blocks of, say, 4 kiB (depending on FPGA model). All memory management is purely manual.

3) CPUs tend to have a much higher external memory bandwidth.

4) Complex operations that are not directly provided by the FPGA fabric, like floating-point arithmetic or large memories with more than two ports, are expensive in terms of area and performance.

5) Modern desktop CPUs are incredibly well optimized: high clock frequency, out-of-order execution, superscalarity with several execution units, SIMD, automatic cache management, branch prediction, ... It's just very hard to beat that, and this is only possible for certain, very restricted applications. Highly parallel DSP (Digital Signal Processing) with integer/fixed-point arithmetic comes to mind.

</comment></comment></comment></comment></comment></comment><comment><USER9> [https://www.cs.york.ac.uk/fp/reduceron/](https://www.cs.york.ac.uk/fp/reduceron/)

It's still fairly young technology but there has been work on processors for HLLs. The one above (if my understanding is correct) is effectively a combinator processor, and its input language is a subset of Haskell.

(and now I notice it's already linked in the article comments, but I'll keep it here for those interested.)

<comment><USER6> Yah, the author does a follow-up blogpost (albeit, only a few days later, and not years, hehe).

[http://yosefk.com/blog/high-level-cpu-follow- up.html](http://yosefk.com/blog/high-level-cpu-follow-up.html)

<comment><USER9> I don't 100% agree with the author that the reduceron is a "Haskell Machine" \- it seems very much to be the motivation for the project, but I think it's more of a 'strongly typed functional language machine'.

I'd be inclined to think that the more general machine Yosef wishes for would come with time and more languages implemented. Heck, maybe restricting the kind of languages best supported is a necessary feature - you can't say that von Neumann doesn't best support imperative & procedural languages after all.

</comment></comment></comment><comment><USER10> A plausible tl;dr of the post could be: "Dreaming up high level instruction sets is useless because today's CPU's spend most of their time waiting for memory access (accept for rare applications doing lots of math on a small amount of data ... e.g. bitcoin mining)

<comment><USER2> _Dreaming up high level instruction sets is useless because today 's CPU's spend most of their time waiting for memory access_

...which doesn't make much sense, because the benefit of small but powerful multicycle instructions is precisely so you can spend the time decoding and executing them (and less time fetching them) while the CPU is waiting for some memory access. One factor that many people seem to forget is that instructions also need to be fetched from memory, and the less bandwidth that takes, the better.

<comment><USER10> Not defending the OP's thesis but clarifying my tl;dr summary of it: Fetching instructions is not the main problem, it's the data that the instructions have to act upon (Hence the exception for the compute heavy, data-light applications.) And since most of the compute power in the world today is basically processing and moving massive amounts of data around, I can see how that thesis would make sense in the general case.

</comment></comment></comment><comment><USER4> The future might be in an FPGA fabric tightly coupled with generic RISC cores (things like Zynq SoCs, but with a tighter integration, allowing a direct access from FPGA to the CPU internal registers, pipelines, etc.). Bigger macro cells (like entire ALUs, generic caches, etc.) might be useful too.

This way hot spots can be optimised (even in a JIT engine in runtime) into hardware circuits.

I played a bit with some crazy ideas like mixing HDLs with a low level C code (see the Mandelbrot example here: [https://github.com/combinatorylogic/soc/tree/master/backends...](https://github.com/combinatorylogic/soc/tree/master/backends/small1/sw/long_hdltests) ) - this sort of things can become practical with a tighter integration between a CPU core and FPGA fabric (in my case it was a soft core, of course).

</comment><comment><USER11> All the EEs I know think 1000 lines of code is "a lot". I've never met any EEs that used source control. I've never met any that tracked issues beyond forwarding emails back and forth. Their idea of documentation is separate PDFs for electrical properties and programming APIs.

So if us software engineers don't know the hardware side well enough to design hardware, I'm not really sure electrical engineers understand the software side well enough to design hardware, either.

Not saying there aren't EEs that understand software. Just saying I've never met any.

EDIT: wait, I know one EE who uses source control. I finally got my wife to start using Git. She kept looking over my shoulder at home, asking me "what is _that_?" pointing at my changelog in SourceTree. "Oh, you know, it's just an annotated record of every change every member of the project has ever made, including when they did it, in such a way that we can share these changes with each other without having to have long discussions about which particular folder on which particular network drive is the 'latest' code. Oh, you think that would be helpful in your work? Who would have thought?"

<comment><USER4> Every EE company I worked for used source control (perforce, git or svn). And a typical Verilog module is far longer than 1000 lines.

<comment><USER11> If it weren't a meme, it wouldn't be a meme.

</comment></comment></comment><comment><USER12> Well, the obvious place to start is via using separate memory channels. If you have separate load/store queues for the stack and heap you can have substantially higher max performance for the same area/power since the cost of that structure scales super-linearly. But that means you can't have arrays with a mix of pointers to heap and stack allocated objects.

That's one of the things the Reduceron (mentioned elsewhere) does.

<comment><USER5> I plan to write about it; the thing is, the Reduceron is not a more performant machine when all is said and done. Memory costs you a lot in area and power and throwing channels at the problem needlessly and saying youve solved the von neumann bottleneck is a worse idea than trying to avoid banging at the memory needlessly; using C is a part of a working strategy to acheive the latter.

<comment><USER12> Breaking up the load/store queue would basically just be a way of increasing parallelism at the core level for free. You wouldn't be changing the amount of memory in caches, just increasing the rate at which you can issue loads or stores and the number of outstanding accesses the core could support. Well, you might consider a split L1D but there are lots of tradeoffs with that and you'd have to simulate to figure out if that'd be a good idea.

</comment></comment></comment><comment><USER13> Aren't GPUs a good enough example of hardware that can be programmed to do things way faster than what is possible with CPUs of the same era?

Also what about FPGAs? If compiling a specific program down to an FPGA is possible, what kinds of optimizations can we bring in? (I am indeed waving my hands here, but we already have had genetic-proframming optimized FPGAs for over 15 years in research.)

<comment><USER5> Isn't it obvious after all these years that gpus or fpgas give hlls nothing?? Nobody actually runs hlls there, even! And everyone had years and years to try! On these machines in reality hll performance blows much much harder than on cpus and at what point does it become obvious that nobody doing something must be due to reasons that can be learned and understood instead of ignored?

I wrote tfa to explain some of those reasons and nobody seems to read it, they just keep saying what they always do.

Someone is wrong on the Internet!!

<comment><USER13> I didn't state my point clearly. My point was not that GPUs give some new capability to HLLs, but that GLSL itself is higher level for a restricted domain than what is afforded by a general purpose processor ... and, owing to their specialization, GPUs are faster than normal CPUs.

FPGAs blur what it means to "run a HLL", since you can optimize the circuitry to a point where there is no explicit representation of the "code" or "microcode" anywhere so the question becomes pointless. Heck even what part of _physics_ is used is blurred! [1,2]

[1] [https://en.wikipedia.org/wiki/Evolvable_hardware](https://en.wikipedia.org/wiki/Evolvable_hardware) (Ref: Adrian Thompson's work)

[2] [http://www.damninteresting.com/on-the-origin-of- circuits/](http://www.damninteresting.com/on-the-origin-of-circuits/)

</comment></comment></comment><comment><USER14> Surely there is _some_ improvement to be made by automatically parallelizing map and filter functions, and for side-effect free languages, automatically parallelizing functions that do not share state? Maybe this is more on the compiler side than the hardware side, but wouldn't this potentially provide a significant speedup if you have a lot of cores to take advantage of? A speedup that you can't get from procedural programming languages?

</comment><comment><USER15> > in fact lots of standard big O complexity analysis assumes a von Neumann > machine – O(1) random access.

i don't see the logic here.

<comment><USER16> Memory lookup can be considered O(log(m)) where m is the amount of memory you are using. e.g. If the addressable memory space exceeds the word size then it would take two cycles to do a load from memory.

In practice memory lookup is O(1) but there is hard limit to the amount that can be used. Except of course this is not true - there are costs to using more memory - because of the cache hierarchy.

<comment><USER8> If we're _really_ going to talk about memories of over 2⁶⁴ bytes, in the limit it's O(m^⅓) if you're talking about latency, because larger memories need to be physically further away, on average.

<comment><USER17> The newest physics is even more pessimistic, putting it at O(m^½) because of the holographic principle.

Essentially, the theory goes that the amount of data you can cram into a spherical volume of space scales in proportion to its surface area, IIRC with a density on the order of bits per Planck area.

[https://en.wikipedia.org/wiki/Bekenstein_bound](https://en.wikipedia.org/wiki/Bekenstein_bound)

[https://en.wikipedia.org/wiki/Holographic_principle#Limit_on...](https://en.wikipedia.org/wiki/Holographic_principle#Limit_on_information_density)

<comment><USER8> I don't understand the Bekenstein bound well enough to comment very intelligently, but isn't that a bound on the information _content_ of your CPU rather than its information _throughput_ or latency?

<comment><USER17> > a bound on the information _content_ of your CPU

Sure, though I'd have said "RAM". When you have a bound on information density, you naturally get a bound on worst-case memory latency provided you obey a fixed speed of light.

<comment><USER8> Oh! Good point!</comment></comment></comment></comment></comment></comment></comment>


Hashable is shutting down - <AUTHOR> http://techcrunch.com/2012/07/11/hashable-the-app-that-aimed-to-replace-business-cards-to-shut-down-on-july-25/ <comment><USER2> \- They raised a $4M round led by USV in 2010 (<http://avc.com/a_vc/2011/03/the-hashable-pivot.html>)

\- The founder (<http://linkedin.com/pub/michael-yavonditte/3a/919/3b6>) was previously the CEO of an ad company that AOL acquired for $340M, and he's also an angel investor and partner at a VC fund -- so, he's obviously an experienced entrepreneur and has an amazing network to support him

Best of luck to everyone on the team and all in their future endeavors, but I think this just tells you how hard startups really are, esp during these crazy times.

It's a constant reminder that having all the money and connections in the world doesn't mean shit about whether you're actually going to build a strong business and end up dominating your market. Obviously, having a nice war chest and good connections will help you execute, but it's only a means to an end and still kind of superficial, and not what makes startups fundamentally succeed. Drop.io was another case in point, the founder was extremely well- connected in the tech scene and in VC circles, yet they failed and got owned by Dropbox - only thing that matters in the long-run is talent and hardcore execution.

Also highlights just how important timing/luck and product-market fit are: [http://pmarca-archive.posterous.com/the-pmarca-guide-to- star...](http://pmarca-archive.posterous.com/the-pmarca-guide-to-startups- part-4-the-only)

"Markets that don't exist don't care how smart you are."

<comment><USER3> I think this is yavo's second failed startup post quigo, the ad network. He did tracked first, then hashable. I'd bet he'll do well in mobile ads though given how well he understands the space. And never underestimate the power of the right rolodex.

<comment><USER4> Mobile ads is a _shitty_ business, and by 'shitty' I mean 'hugely competitive'. The margins are so slim it can be very difficult to turn any kind of profit - not to say the right idea can't totally shake up the industry, just that it's very, very competitive.

</comment></comment></comment><comment><USER5> Yet another startup with no viable business model shutting down after spending the investors' money. I simply don't understand how companies get funded when they have no real way of turning a profit.

</comment><comment><USER6> Well I suppose users got 2 weeks notice of the closure - though for many who are on holiday as it is summer(apparently in some countries), then this will be moot.

Not sure what there doing next and advertising a advertisng company on the back of a demise of a project that has failed is not entirely inspiring, though in this day and age I doubt it will be held against them.

If they open source the old system then I'm sure even more will forgive them. Though I'm sure alot of investors will not be too happy, but thats how investing works.

I wish them well, if only for the aspect they explained how to get your old data, even if only a two week window of opertunity, could of been worse.

</comment><comment><USER7> People who like business cards, use business cards. I think in the future "intentional identity communication" will be moot, where people will either know who you are already, or know how to find you (FB, LinkedIn, Ravelry, etc.). If all you really need is a name and a saved contact, I can see people getting used to not carrying and exchanging stuff. "Back in olden times, your 'wallet' had like a quarter-inch of these business cards, both other peoples' and yours to hand out. Yes, we had back problems."

<comment><USER8> I imagine a ubiquitous feature in every business smartphone that just broadcasts your vCard to nearby smartphones if you want to be contacted. Just something more comfortable than current Bluetooth vCard sharing. I say a "feature" because I think that there is no monetization opportunity in this idea. It would only look good as a standard feature.

<comment><USER7> VCard is still on the "intentional transmission" side of things. What I'm talking about is the question, "why have a discrete identity blob to hand out (physically or digitally) when your identity is out there and easy to find with the right proximity. "Proximity" being measured by social distance.

If I meet you someplace and we're talking like "I'm rhizome from HN," you can then click on my name when you get home (or from your phone) and get a means of communicating further with me. The goal of business cards isn't really just to collect pieces of paper, it's to have a reference by which to enable further interactions. Those references are becoming more and more ephemeral, and more and more ubiquitous.

</comment></comment></comment><comment><USER9> My friend was in the right place at the right time, had a small company that made millions. He figured it was all him, so he spent all of his money on a second attempt. It failed, and he's back working a j.o.b. now.

I wonder: If we could track enough of these cases where a successful entrepeneur started a second company (and then track whether it succeeded/failed), could we come up with a measurement of how much luck has to do with overall success rates?

</comment><comment><USER10> I still remember the big hype about Hashable.

I wonder what they are pivoting to next.

<comment><USER11> Hashable's CEO mentioned on Twitter that they've been working on a "very unique mobile ad system"

<https://twitter.com/mikeyavo/status/223256300874764290>

<comment><USER12> More ads, great...

</comment></comment></comment><comment><USER13> $4 million in funding, all down the drain, wow.</comment>


Behind-the-scenes look at making fonts - <AUTHOR> http://ilovetypography.com/2015/01/13/making-fonts-gt-sectra/

<comment><AUTHOR> Thierry here from Grilli Type – we released GT Sectra. Let me know if you have any questions or comments!

<comment><USER2> Zooming out on the sample page ( [http://grillitype.com/typefaces/gt- sectra](http://grillitype.com/typefaces/gt-sectra) ) seems to indicate there is no font hinting. I think it would be nice if you'd indicate to customers that it's a bad idea to use this font in low-dpi situations.

<comment><AUTHOR> Font hinting is relative, and there's many levels of font hinting. To simplify (a lot), the main levels are: 1) Absolutely no hinting information present 2) Auto-hinting process used to create hinting information 3) Manual hinting process used to create hinting information

Our typefaces for the web are auto-hinted, the only realistic possibility for smaller foundries. We hint them with all possible auto-hinting tools and then decide which one looks best (per style) across all rendering environments. The results will never be perfect, but absolutely acceptable across a large number of rendering environments and type sizes used.

No auto-hinted font is going to look perfect at 8px sizes, for that you absolutely need hand-hinted fonts (and even then they look like crap). But hand-hinting a font costs thousands of dollars per style – or about $50 per character, more or less. Only big foundries and operating system providers like Microsoft can do that. GT Sectra for example contains around 900 glyphs per style, across 30 styles.

Additionally, the whole industry is moving away from manual hinting, as more and more high-dpi devices are on the market, and operating systems' rendering of typefaces becomes less and less dependent on hinting information (OS X ignores it completely, for example). It's just not an investment that's really worth it going forward.

You can see GT Sectra in small use for example in use on [http://reportagen.com](http://reportagen.com) – and it holds up pretty decently in my opinion. Or don't you think?

<comment><USER2> Thanks a lot for the detailed information! Personally i still wish people would not release unhinted fonts, because they are invariably used by people who're completely oblivious to the difference and simply make large swathes of text nigh-unreadable.

That said, the usage on reportagen.com does impress me. It's by no means perfect (A and other uppercase letters could use some love), but otherwise the width of vertical lines is consistent overall, making it quite readable even at small font sizes and without anti-aliasing.</comment></comment></comment></comment>


What I Learned About Sales But Foolishly Forgot When Raising VC - <AUTHOR> http://randfishkin.com/blog/50/what-i-learned-about-sales-but-foolishly-forgot-when-raising-vc <comment><USER2> Great points. VCs (and larger angels) will tell you all day long that there's no such thing as pitching too early (cf. [http://www.thisisgoingtobebig.com/blog/2009/10/19/never- too-...](http://www.thisisgoingtobebig.com/blog/2009/10/19/never-too-early-to- talk.html)). It's simply not true. As Rand mentions the power dynamics in those talks are entirely one-sided (not your side).

This isn't black and white and investors are great at playing the game. Often they'll send an associate your way in the early stages (or send you back down to an associate after a MD intro). If this happens, insist on talking to the MD. If they agree, they're interested and possibly trying to mask that interest. If they don't, they're not interested and just trying to "hang around the rim".

Unless you love pitching, don't spend time with investors that don't have partners chasing YOU.

</comment><comment><USER3> This is so relevant to me in my business where we have been shifting into business development mode.

I've had a bunch of meetings that have come about from cold calling potential clients. Almost every one has not ended in new work. All of our new work comes from referrals where clients have heard about us through their friends or seeing something we've built in the marketplace and wanting to find out how we can help them.

Our focus now has shifted from getting meetings to producing great work for our existing clients, work that they can be show their friends and which gets recognition. Sounds like a slight shift in thinking but it's already having great results in the quality of our output.

</comment><comment><USER4> Getting an unsolicited intro to a VC from a 3rd party can also be viewed similarity as the VC reaching out directly. For example, if you are introduced to a VC by a large customer or partner of yours who sees the promise of your business, there's a chance the conversations they're having are close to the ones the author is suggesting happen before a VC sends an e-mail to you to get coffee. (But not always!)</comment>


Show HN: Coderust – Prepare for Programming Interviews - <AUTHOR> http://www.coderust.com <comment><USER2> Why do you support everything except the PC :)

As someone prepping for interviews, I'd have loved to give this a shot if it was on the web.

<comment><USER3> Ditto. Why on earth would one want to develop on a tablet or phone? Even for toy interview problems they make awful dev environments. Between lack of a physical keyboard, tiny screen, slow processor, no VM support, no IDEs to speak of, and no mature command line environment they're dead in the water. A complete non-starter. You can't draw a diagram on them, typing symbols on them is a mess, and they don't support screen-sharing worth a damn, even in the stone-age sense of having two people standing side by side staring at the same thing. As hypothetical interview tools they're literally worse than a piece of paper or whiteboard. Which is probably why I've never seen them used as interview tools.

It boggles my mind that the authors of this app prioritized iOS and android support, let alone made it iOS/android exclusive. You guys had me convinced and ready to sign up. And then I find out you don't support the platform it makes most sense for you to support. Madness.

</comment></comment><comment><USER4> This should not be an app - it should be a service, billed at $12/year (or $10 for a 3 month pass), with fresh content/languages added regularly. This would turn your company into something potentially investable, and would give you a steadily increasing stream of income. You'd also be able to increase the price over time as you add more and more value to your offering.

This should also be a web app, as many people have pointed out to you. As awesome as mobile is, web is still easier to share and convert users on, and while everyone has a web machine, not everyone has a tablet.

<comment><USER5> Yes! I'd pay 10$ a year for it or 8 for 2 month.

</comment></comment><comment><USER6> Sounds neat. Has anyone here tried it? I might buy it if people think it's really good.

I've got to say though, the reviews on the google app store are getting the side-eye from me. Lots of five star reviews that praise the features listed in the marketing. That's not all there is to it, but I'm not quite sure how to convey why they seem fake.. Did anyone else get that feeling?

<comment><USER7> 9 reviews and 1-5 installs.

Not sure how those numbers are generated, but I get the same feeling as you.

<comment><USER8> Google Play Store hasn't updated the install count since last 48 hours or so. Flurry data is showing about 50 users for paid and about 200 users for lite version (These numbers contain both iOS and Android installs but we are sure that Android downloads are more than 5.

</comment></comment></comment><comment><USER9> You should consider listing the topics it helps you cover, I think it would be a great selling point and help convert visitors to buyers faster.

I noticed one of the slides (not the 1st) contains a blurry phone image in the right corner with what I think might be some sort of table of contents: linked lists, trees, stacks & queues, etc.

Perhaps to keep the description terse you could group the features using something like: 'the most important data structures, problem-solving heuristics and math'.

</comment><comment><USER10> Why "Code rust"? (The Rust language already has enough problems of confusion with the Rust game.)

<comment><USER6> I'm guessing it is "rust" as in "rusty," like "my skills are rusty, so I will use coderust to improve them." I did click the link expecting to see something about rust, though, so I guess it's unfortunately a little confusing.

</comment></comment><comment><USER11> I'm building a web app that takes a similar approach (mobile-friendly, you can expose hints as you work through the problem, etc): www.interviewcake.com.

Love to sync up and share notes. My email is in my profile.

</comment><comment><USER12> I had to look at the screenshots to see if the point of this was to test you on the questions or explain the questions. Exactly what it is could be a lot clearer.

Actually, the other side could be really interesting. The app shows you a problem (like the recognition of a number in a string) and shows you the unit tests. Then you're graded based on how many you pass.

</comment><comment><USER13> I was a bit skeptical because of the reviews. Tried the lite version and liked it so I ended up paying. The list of questions is impressive although they can go a bit light on the explanation.

I agree with the lack of swipe gesture.

</comment><comment><USER14> One tip cause it's a big pet peeve of mine: move the images at the top in the a tags. That way you can click on them instead of just the text.

Looks cool, if it works and has good reviews, I'd buy it!

</comment><comment><USER15> This sort of thing could be useful. I like the format. Not wild about code explanations with 5 clause sentences. This kind of mental juggling is what I love about programming and reading David Foster Wallace, but the writer(s) of the app don't write like my brain or DFW.

I'm just saying, when you are trying to make a dry subject explicable, you need to break up the sentences and make your variable names more distinct.

<comment><USER8> Thanks for your feedback. We agree that there is always room for improvement. In coming versions, we will be addressing the issues in problem explanations, fixing reported bugs and adding more problems.

</comment></comment><comment><USER16> Looks neat. I'd buy if it doesn't require internet. Does anyone know if internet is needed to run the app or you can read offline?

<comment><USER8> The app can run in offline mode. No internet connection is required.

The only time Internet is required is when you buy it from Google Play and run the application for the first time. Connection is required to validate the purchase with Google servers.

Internet is never required for iOS.

<comment><USER16> Thanks, I'll give it a try.

</comment></comment></comment><comment><USER17> To echo some earlier comments. As someone currently preparing for an interview, I would definitely like to see a web version.

<comment><USER9> Can you deal with Python? This is free and available on-line as just a regular static site. ([http://interactivepython.org/courselib/static/pythonds/index...](http://interactivepython.org/courselib/static/pythonds/index.html)).

From what I could tell, it's the full version of 'Problem Solving with Algorithms and Data Structures Using Python 2nd ed', 2011. I haven't read it cover to cover, but it seemed well written. You can read some reviews on the printed version at [http://www.amazon.com/Problem-Solving-Algorithms- Structures-...](http://www.amazon.com/Problem-Solving-Algorithms-Structures- EDITION/dp/1590282574/)

</comment></comment><comment><USER18> I bought it. I don't like the way it looks in iPad, with the column on the right side that's cut off. I also feel like I should be able to swipe to view it, instead of just pressing the arrow at the bottom. But, otherwise, I like it and I think I'll use it to brush up on some fundamentals. PS, add Ruby!

</comment><comment><USER19> Why do they need to know my location?

<comment><USER8> We are using Flurry to track usage (pretty standard among apps) and it uses the location information to show the usage of app by Country and City.

We don't explicitly collect your location information and our privacy policy clearly states that we don't share any information with any one.

<comment><USER20> If it's just getting country/city data, you should only be requesting "course" location permission. You're requesting "fine" location, which will give the user's precise lat/long. You might want to change that.

<comment><USER16> According to androidpit, they need course location. Not sure how they got this info though.

[http://www.androidpit.com/en/android/market/apps/app/com.hes...](http://www.androidpit.com/en/android/market/apps/app/com.hesive.apps.coderust/Coderust)

android.permission.ACCESS_COURSE_LOCATION

*On the permissions page, it says 'fine location as well'

</comment></comment></comment></comment><comment><USER21> Selling on a $5 price for quiz question seems much more than I expected.

After all, its free material all over the internet.

Dont really expect to learn anything from a quiz, but to remind of things.

To be honest, I was quite surprised it is "Paid App".

<comment><USER22> The cost per problem is a lot lower than books that offer the same content, so it seems reasonable.

</comment></comment><comment><USER23> 1) Why is it just an app, with no option to use on the web? 2) You should probably post more details about what this actually, well, does.

Cool concept, would love to try it out.

</comment><comment><USER24> I would have bought it except I really dislike the font! It looks unprofessional.

</comment><comment> alok-g I would love to see this on Amazon Android store.

</comment><comment><USER25> any plans to support more languages?

<comment><USER8> Yes. We are looking for suggestions on what languages people want. Any feedback or preferred language is appreciated.

</comment></comment><comment><USER26> I love it!</comment>