Basics of Machine Learning - <AUTHOR> http://homepages.inf.ed.ac.uk/vlavrenk/iaml.html <comment><USER2> If you want to get into machine learning, it is actually pretty easy, provided you studied Math, Engineering, or Science in University. The papers are hard at first, but they don't hide like other papers do. Everything is laid out there for you to code and run with your own data. In a field like, say, Structural Engineering, the paper writers can make claims about the structural resilience of an Ultra High Performance Concrete that they tested, without you _ever_ being able to hope to repeat the exact experiment. You may not even be able to get your hands on the proprietary compound they used.

In ML, you might not be able to use the same corpus / training set, but you're usually able to recode the actual algorithm and you're usually able to find a compatible type of data set to work off of.

Also, most ML people are lazy, so if they don't work for Google or Facebook they're usually using open data datasets anyway, which are trivial to drop in and verify.

<comment><USER3> > most ML people are lazy

That's a great virtue for programmers in general.

"Laziness: The quality that makes you go to great effort to reduce overall energy expenditure. It makes you write labor-saving programs that other people will find useful, and document what you wrote so you don't have to answer so many questions about it. Hence, the first great virtue of a programmer. Also hence, this book. See also impatience and hubris. (LarryWall, ProgrammingPerl, 1st edition)"

> they're usually using open data datasets anyway

They do that in order to be able to judge the performance of various algorithms - they need to have a common standard to test against.

<comment><USER2> I use lazy in the positive sense, I'd actually forgotten that it had negative connotations when I wrote the above.

</comment></comment></comment><comment><USER4> I'm sure these lectures are great but my computer was none too happy about 100 embedded videos in a single Web page.

<comment><USER5> Yeah, my machine learned not to visit that page again.

</comment></comment><comment><USER6> The main course website is here: [http://www.inf.ed.ac.uk/teaching/courses/iaml/](http://www.inf.ed.ac.uk/teaching/courses/iaml/)

There are more notes and so on there. It isn't an online course though, so don't expect too much.

<comment><USER7> We also have two more in-depth (and harder) courses on ML with publicly available slides:

* Machine Learning and Pattern Recognition: [http://www.inf.ed.ac.uk/teaching/courses/mlpr/](http://www.inf.ed.ac.uk/teaching/courses/mlpr/)

* Probabilistic Modelling and Reasoning: [http://www.inf.ed.ac.uk/teaching/courses/pmr/](http://www.inf.ed.ac.uk/teaching/courses/pmr/)

Unfortunately video lectures are often only available internally.

<comment><USER8> I didn't take it myself, but my (now former) classmates that took PMR told me it was one of the hardest courses they ever did.

</comment></comment></comment><comment><USER9> I also highly recommend these lectures from Cornell. The lecturer is well- known for his free SVM-light implementation. [http://machine-learning- course.joachims.org](http://machine-learning-course.joachims.org)

</comment><comment><USER10> Best I can tell, it comes in a Champagne bottle with a cork held in by wire and a nice, new label, but, when open the bottle and pour out the contents, what get is 99 44/100% pure, old cookbook-style, applied statistics, some curve fitting, some hypothesis testing, some statistical estimation with definitions, theorems, and proofs mostly filtered out. Also not much in experimental design and only little in 'resampling' techniques.

Right: Since we need a computer to do the data manipulations, the computer science people want to conclude that the statistics is also part of 'computer science'? Now bookkeeping, accounting, numerical solutions of differential equations, etc. are also part of 'computer science'? Or, what the heck ever happened to the field of statistics, biostatistics, quality control, etc.?

<comment><USER11> What's your complaint exactly? There is a lot of overlap with statistics, sure. Especially in the simpler stuff. Machine learning is literally using machines to automatically create models. What did you expect?

<comment><USER10> > Machine learning is literally using machines to automatically create models.

Good we got that clear. In statistics, the 'models' have hypotheses that should be satisfied. Checking the hypotheses and, also, the model that gets built, is tricky work not much mentioned in the book and, really, super tough to program in general.

> What's your complaint exactly?

Old wine, filtered, in new bottles.

I believe that students would be better advised to go for the original stuff in courses/books on statistics, the field itself. Yes, then a computer can do the data manipulations.

There has long been a threat of 'cook-book' statistics where get some software and a 'tool', apply it where some crucial hypothesis does not hold, and then get misleading results. Do this in medicine and can kill people; indeed, instead, actually, biostatistics is a relatively serious subject.

Well, it seems fairly clear that with 'machine learning' the threat of 'cook- book' statistics is much greater.

Or, there long was threat enough with SPSS, SAS, R, Matlab, etc., but now the threat is greater.

> What did you expect?

Something new and good, not 'statistics done badly'.

<comment><USER11> I don't know enough about the field of statistics to argue with you. But if what you say is true, why aren't statisticians using traditional methods winning competitions and benchmarks, and taking over the field?

The "cook-book" problem is overfitting and it's pretty well known and avoidable.

<comment><USER10> > taking over the field

Sorry, but "field"? What "field"? 'Machine learning' in 'computer science'? That's not a 'field'; it's a really bad joke.

> The "cook-book" problem is overfitting and it's pretty well known and > avoidable.

Gee, people have been criticizing 'cook-book' statistics for decades, and the only problem was "over fitting"? Amazing. Gee, we can clean out nearly all of the definitions, theorems, and proofs of statistics and just put in a simple solution for the "avoidable" problem of over fitting! Astounding.

Did I mention a bad joke?

<comment><USER11> >Sorry, but "field"? What "field"? 'Machine learning' in 'computer science'? That's not a 'field'; it's a really bad joke.

Ok then. I guess biology isn't a field either because I don't like their methods. They are too messy and impure, and really it's just applied physics. (Mildly relevant: [http://xkcd.com/435/](http://xkcd.com/435/))

And sorry I meant overfitting is the equivalent of the "cook-book" problem in machine learning. Otherwise it's fairly easy to try a model against test data and see how well it performs. No need to guess whether the underlying assumptions of the model are true, just see if it works.

<comment><USER10> > No need to guess whether the underlying assumptions of the model are true, > just see if it works.

No, there are assumptions also for this approach, and these assumptions also need to be checked.

Then in applying the model that has been checked, there are still more assumptions, that need to be checked.

And checking models is often essentially hypothesis testing where need more assumptions and, commonly, some experience to know what hypothesis tests to use. E.g., tests in regression can be F ratios and/or t-tests, and need to check some assumptions or at least robustness here.

E.g., in power spectral estimation, see, Blackman and Tukey, 'The Measurement of Power Spectra', there is a severe trade off between resolution and stability, another case of a trade off between bias and variance. Tough to 'automate' that consideration.

So, take a box of data. Divide it in half. Use the first half for the 'fitting' or 'training' data. Test on the second half. Not deep; I advised some people in finance to do that in about 1982; not nearly new; and I very much doubt I was the first; gotta believe that J. Tukey, L. Breiman, and others thought of this long before I did.

And if the test fails, then try to fit again. Run all night and in the morning, presto, have a model that does well on the test data. Now what have we? Not a trivial question to answer.

Why least squares instead of something else? A good answer is not easy.

I'm not criticizing biology, and it's done some excellent science, e.g., see the E. Lander lectures in his MIT course in biology.

Statistics is a good field with a lot of good work by a lot of bright people with excellent backgrounds in pure and applied math.

The first time I heard about 'machine learning' I guessed they meant filling in the optimal value function for stochastic dynamic programming. Okay, that is a kind of 'learning'. But, that's not what they had in mind.

Next an example was the children's interactive computer game Animals where a child thinks of an animal, answers some questions about the animal to chase down a binary tree, stored in the program, to a leaf, and have the computer guess the animal. If the computer is wrong it asks the child "What is true for your animal and false for my guess.", adds to the binary tree, and thus, 'learns'. Call it a parlor trick.

A little like 'self driving cars': Really 'self-driving'? Nope, not close. Only on streets where everything has been mapped down to 1 cm or better including all the painted lines, all the curbs, all the traffic signs, and all the traffic lights, etc. In no way does the 'self driving car' actually look at a new street scene, make sense out of it, and use that 'learning' to drive. Instead, so far a self driving car is about as amazing as a train on a track.

We're talking hype, old wine, filtered, in new bottles, and not much that is new and good. Or, the old academic joke goes, "the new is not good and the good, not new.". The last time I looked at a leading 'machine learning' prof, I had conclude that he needed to return to ugrad school, be a math major, and learn how to read/write math.

E.g., why maximum likelihood estimation? There are reasons, but I saw no hint of them in the Ng lectures at Stanford.

We've known a lot about pure and applied statistics and how to use them for a very long time. The good work in statistics is high quality pure/applied math, e.g., Billingsly, 'Convergence of Probability Measures', e.g. with Ulam's result Le Cam called 'tightness', Brillinger on time series, Serfling on limit theorems, Rao on linear methods, Breiman on CART, and much more. I'm not seeing comparable quality in 'machine learning'; indeed, from all I've seen only a tiny fraction of the computer science machine learning people have the math prerequisites for good research in statistics.

Yes, I've published peer-reviewed original research in statistics, indeed, applied to a problem in computer science.

<comment><USER11> For tradeoffs you design your error metric to be whatever best represents your problem.

>And if the test fails, then try to fit again. Run all night and in the morning, presto, have a model that does well on the test data. Now what have we? Not a trivial question to answer.

Minor quibble, but the proper way is to use validation data to find the best model and training parameters, the test data is only used once to test how well it actually works.

>A little like 'self driving cars': Really 'self-driving'? Nope, not close. Only on streets where everything has been mapped down to 1 cm or better including all the painted lines, all the curbs, all the traffic signs, and all the traffic lights, etc. In no way does the 'self driving car' actually look at a new street scene, make sense out of it, and use that 'learning' to drive. Instead, so far a self driving car is about as amazing as a train on a track.

That's not accurate. Self driving cars do take input and can't rely on a static map since the world changes and it has to detect obstacles and other cars. I'm not entirely certain but I don't believe they are using very much machine learning in current generation self-driving cars. However there is a startup working to make one with pure machine vision, and it was done once in the '90s with neural nets (ALVINN.)

<comment><USER10> > Minor quibble, but the proper way is to use validation data to find the best > model and training parameters, the test data is only used once to test how > well it actually works.

No: I was assuming that at your step, the text with the 'validation data' fails. So, we have to return and use the validation data on each of the fitting efforts. Then to my question: What do we have? Not so easy to answer. Net the two step approach of 'training data' and 'validation data' is not so good. Also we need some assumptions about the two boxes of data and, then, any data we plug into the resulting model.

For the self driving cars, once they see something not on their static map of the street, apparently they have to stop and wait, maybe drive around. The point is, those cars can only drive on streets very carefully mapped out, down to 1 cm.

Apparently the basic problem is, driving a car takes some basic intelligence, that is, available essentially only from humans. For anything much like real human intelligence, we don't know how to program it. In particular, machine learning doesn't know how to program it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> In case you want a better user experience...

Playlists on youtube vs. the mass of embedded videos on one page.

Naive Bayes [https://www.youtube.com/watch?v=xYqiIjaqydU&list=SPBv09BD7ez...](https://www.youtube.com/watch?v=xYqiIjaqydU&list=SPBv09BD7ez_7-4V3IJIzCHWQj9nd4rVWB&feature=share)

Decision Tree [https://www.youtube.com/watch?v=eKD5gxPPeY0&list=PLBv09BD7ez...](https://www.youtube.com/watch?v=eKD5gxPPeY0&list=PLBv09BD7ez_4temBw7vLA19p3tdQH6FYO&feature=share)

Generalization and Overfitting [https://www.youtube.com/watch?v=j9_yzC-x- js&list=PLBv09BD7ez...](https://www.youtube.com/watch?v=j9_yzC-x- js&list=PLBv09BD7ez_6FzIS3smoa8QYj3ykdPkhT&feature=share)

Nearest Neighbor Methods [https://www.youtube.com/watch?v=k_7gMp5wh5A&list=PLBv09BD7ez...](https://www.youtube.com/watch?v=k_7gMp5wh5A&list=PLBv09BD7ez_68OwSB97WXyIOvvI5nqi-3&feature=share)

K-means Clustering [https://www.youtube.com/watch?v=mHl5P-qlnCQ&list=PLBv09BD7ez...](https://www.youtube.com/watch?v=mHl5P-qlnCQ&list=PLBv09BD7ez_6cgkSUAqBXENXEhCkb_2wl&feature=share)

Mixture Models and the E-M Algorithm [https://www.youtube.com/watch?v=REypj2sy_5U&list=PLBv09BD7ez...](https://www.youtube.com/watch?v=REypj2sy_5U&list=PLBv09BD7ez_4e9LtmK626Evn1ion6ynrt&feature=share)

Principle Component Analysis [https://www.youtube.com/watch?v=IbE0tbjy6JQ&list=PLBv09BD7ez...](https://www.youtube.com/watch?v=IbE0tbjy6JQ&list=PLBv09BD7ez_5_yapAg86Od6JeeypkS4YM&feature=share)

Hierarchical Agglomerative Clustering [http://www.youtube.com/watch?v=GVz6Y8r5AkY&list=PLBv09BD7ez_...](http://www.youtube.com/watch?v=GVz6Y8r5AkY&list=PLBv09BD7ez_7qIbBhyQDr- LAKWUeycZtx&feature=share)

</comment><comment><USER13> Any chance we can get the lectures before #5?

<comment><USER14> Here's a link to the course website: [http://www.inf.ed.ac.uk/teaching/courses/iaml/](http://www.inf.ed.ac.uk/teaching/courses/iaml/) I took this course and Professor Lavrenko is one of the best lecturers at the uni.

<comment><USER15> Interesting to see that Edinburgh is using US style position naming in addition to more traditional UK positions (i.e. "Lecturer" == "Assistant Professor", "Reader" == "Associate Professor" etc.)

<comment><USER16> It's probably because a few of our lecturers are actually from/did their PhDs in the US :)

</comment></comment></comment></comment><comment><USER17> I have 32GB of ram and this nearly caused my computer to lock up.</comment>


Forward Secrecy for Google HTTPS - <AUTHOR> http://www.imperialviolet.org/2011/11/22/forwardsecret.html

<comment><USER2> What worries me here, is a cargo-cult following of this advice.

Ephemeral Diffie-Helman adds an order of magnitude to the session initiation overhead (nginx got a bad rap a little while back, becuase it has kEDH enabled by default). I don't want to see people slide back into the "SSL is too expensive" mindset, because they don't understand the SSL options they are using.

<comment><USER3> I think this is a reasonable concern about DHE, but this blog post was specifically intended to rebut the concern: they optimized DHE and use EC (faster, smaller keys), and managed to get it deployed across all of Google. The subtext is that one reason DHE isn't widely deployed is poor implementation, and they've taken a step towards correcting it.

<comment><USER2> Thanks - I missed the DHE optimizations, and it's really nice to see that these improvements were immediately fed back into OpenSSL.

<comment><USER4> The post made it sound like just the bugfixes are in 1.0.0e, but the performance improvements may have not been accepted yet. I wonder if that is the case?

This is good to see, and I really appreciate the work google has put into making tls/ssl more pervasive.

I do wonder about the performance differences between their faster DHE implementation and what they were using before (RSA-RC4-SHA). I wish they had provided a bit of data on that.

<comment><USER3> It kind of has to be less performant, just because ECDHE uses more bignum crypto primitives.

<comment><USER4> Yeah, that makes sense.

I was mostly curious about how much faster their new implementation was over the old, and how much slower it was than RSA-RC4-SHA.

<comment><USER5> I think that with the session resumptions they got by using session tickets, this could easily end up being a net gain for them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> More great work from Google legitimizing and advocating for strong HTTPS defaults. I'm looking forward to this being broadly adopted.

Securely Yours,

Lil' B

</comment><comment><USER7> I'm sure these guys have thought about the longevity of data at rest when selecting the security strengths on the EC curves and RSA keys. These chosen parameters are quite high and they link to an article which mentions a period of up to 2040 before having to be re-encrypted or expected potentially be broken.

Make your own conclusions about that.

I'm not certainly a fan of session resumption and renegotiation's from a potential security aspect, anyone care to persuade me apart from a performance standpoint?

<comment><USER5> Look at it this way: session resumption enables you not start the handshake all over again from scratch for every TCP connection your browser makes. This mean you can actually do more secure things like preferring DHE on the initial handshake because it happens much less often.

The session ticket support enables Google to use session resumption across their massively load-balanced SSL terminators.

I don't think Google is using renegotiation in this architecture, but I think we got renegotiation nailed down tight with RFC 5746.

</comment></comment><comment><USER8> I am not a cypherpunk, but can/should we differentiate between 1. encouraging those running OpenSSL/TLS servers to use a. sane defaults that allow forward secrecy and b. ephemeral TLS session ticket keys, 2. using Google's in-house EC cipher implementations and 3. doing 1. and 2.?

We could do 1. only and still reap some benefit, correct?

<comment><USER3> There are environments where ephemeral DH keys violate policy (those sessions can't be passively monitored; some sessions must be), which could militate against PFS suites becoming the default.

DHE is good, but I'm not sure forward secrecy is as pressing a security issue as simple adoption of TLS is. I admire Google's continued efforts to set the standard for its secure deployment, though.

<comment><USER5> Look at it from Google's point of view though:

Now they won't have "lawfully intercepted" packet captures showing up in their mailbox with demands that they decrypt them using their private key.</comment></comment></comment>


Ask HN: Paid app but also want to open source? - <AUTHOR> I've just written my first small paid application and would also like to release the source code publicly on github as a few people have expressed interest.
There's some pros and cons I can see with it:
Cons:
- Potential revenue loss, people wont pay if they can get it for free.
Pros:
- Giving back to community.
- Potential free advertising when technical users use the free code and non-technical users catch wind and pay for not having to be bothered with code.
Anyone do both and can share experiences? <comment><USER2> I would keep the code proprietary and donate 20% of the application's revenue to the open source projects that made it possible. As soon as profit stops, open source it.

You'll be "giving back" way more this way.

</comment><comment><USER3> Is it business software or consumer software?

Check out [https://supportedsource.org/](https://supportedsource.org/)

You can have your code public on GitHub, while still releasing it under a paid license.

<comment><AUTHOR> Thanks for the info -- it's consumer software.</comment></comment>


3D Robotics launches $729 fully assembled, drone - <AUTHOR> http://blog.3dr.cc/post/58721716754/as-some-of-you-may-have-noticed-at-the-recent-susb

<comment><USER2> This looks awesome. I want one.

How far can it fly on the battery it ships with?</comment>


A historic drop in air traffic - <AUTHOR> https://www.flightradar24.com/blog/tracking-marchs-historic-drop-in-air-traffic/ <comment><USER2> I watch that site a lot and I've noticed that you see far fewer 737 and A320 class flights then you used to over upstate NY, but still some regional jets.

I used to watch 777s and 787s head from NYC to Beijing all the time because the great circle route goes over my head, but I haven't seen one for days. I do see Prime Air going overhead with freight and I am watching a 777 freighter heading from Colonge to the FedEx hub in Memphis but it is a boring time to be planespotting.</comment>


Coin: Dead or Alive? - <AUTHOR> <comment><USER2> I learned my lesson to not develop an entire business on the buzz of a new product [https://www.kickstarter.com/projects/bendunphy/numis-the- coi...](https://www.kickstarter.com/projects/bendunphy/numis-the-coin-wallet)

</comment><comment><USER3> Likely dead.

While I like the idea behind coin and similar systems like the stratos card and would use the technology, usually these systems don't make it past prototypes.

Visa/MC/Disc/Amex put an end to a lot of these all-in-one cards. If they do get released, they don't last long.

Storing full track data, which is what these systems do, is against card company regulations. They own the magnetic stripe data and keep tight controls over how it is used.

For a simple overview see: [http://www.visa.com/dropthedata/data.html](http://www.visa.com/dropthedata/data.html)

<comment><USER4> Not to mention, the EMV rollout will kill this dead in its tracks anyway.

</comment></comment><comment><USER5> Coin has been replying to backers on Twitter: [https://twitter.com/coin/with_replies](https://twitter.com/coin/with_replies)

</comment><comment><USER6> I have one, it works in a lot of places. Sometimes it has issues on gas station machines, but besides that its great. 7/10

</comment><comment><USER7> I assume this is about [https://onlycoin.com/](https://onlycoin.com/) ?

</comment><comment><USER8> Checkout Final: [https://www.getfinal.com/](https://www.getfinal.com/)

</comment><comment><USER9> I suppose they will ship. But dates are moved</comment>


Swift vs. Go vs. Python battle - <AUTHOR> http://www.marcinkliks.pl/2015/02/22/swift-vs-others/ <comment><USER2> Would be nice to see a comparison with Swift 2.0. Article was posted in February so it's a little dated.

<comment><USER3> Yes, same as with Go 1.5 - this comparison is very dated.</comment></comment>


A Self-Learning, Modern Computer Science Curriculum - <AUTHOR> https://functionalcs.github.io/curriculum/ <comment><USER2> For those like me, and like many in the UK, whose maths education ended at 16, I can definitely recommend Khan Academy for learning or relearning pre-calc stuff. The videos are short, the exercises are well thought out and numerous, and importantly the UI is great.

For example: [https://www.khanacademy.org/math/algebra/](https://www.khanacademy.org/math/algebra/)

<comment><USER3> It's good for calculus too - I remember watching his videos on calculus before I went to uni 10 years ago so they may have improved even more now.

<comment><USER2> I remember looking at the site a few (maybe five?) years ago and everything was a bit of a mess. They've really pulled it together since then. It's really great.

</comment></comment></comment><comment><USER4> Phew, that's an overwhelming list. A less exhaustive alternative that I recommend is [https://teachyourselfcs.com](https://teachyourselfcs.com). It's tailored to those who never studied CS in undergrad, like myself.

<comment><USER5> I wouldn't say this list is exhaustive, more like a good start. It's missing some of the breadth that you are likely to find in a good CS program. I'm not seeing much in the way of OS, networking, undergraduate machine learning, robotics, software engineering, or mobile application development. Adding the above topics would make this list more comprehensive.

<comment><USER6> Agreed! Also missing HCI, Systems Analysis... But a good start, nonetheless.

</comment></comment></comment><comment><USER7> I don't really see Abstract Algebra as a super relevant topic for modern computer science. I agree on Linear Algebra and basic abstract algebra (like group theory, cyclic groups etc, stuff needed for understanding topics like RSA), but stuff like Galois theory and other advanced topics are just not relevant. They still teach you a different way to think about problems (which is good) but rather belong into a math curriculum than a CS one.

<comment><USER8> I've gotten a lot of use out of group theory and lattice theory, and particularly semigroups and semilattices. What most programmers don't realize is that design patterns (a la Gang of Four), when they aren't working around a language's quirks, are implementing some algebra.

<comment><USER9> Could you give us some pointers on where to learn more about this connection between design patterns and abstract algebra?

<comment><USER8> You know, I don't have any. It's something that I've thought about writing about for years now, but haven't gotten around to doing, and I'm unaware of anything else written about it.

</comment></comment></comment></comment><comment><USER10> OSSU has a good curriculum based on free MOOCs: [https://github.com/ossu/computer-science](https://github.com/ossu/computer- science)

Required courses in the curriculum require MOOCs, but they include a lot of the same book resources as further reading topics. The community is quite active and has been happy to answer questions in chat.

</comment><comment><USER11> "Intro to quantum computing"

Really?

otherwise This is heavy on maths for data science and machine learning..

It doesn't have any of the "software engineering" courses though.

</comment><comment><USER12> For a couple years, I went the self study route, using online resources coupled with text books. Eventually though, I ended up taking a few distant learning courses and found the accountability (i.e. deadlines, homework assignments, exams) helpful, keeping motivated. And now, I'm taking the online CS master's program from Georgia Tech, the OMSCS program. I'm actually only in my first semester and loving it!

Still, I appreciate and love all the online material (that's free!) but I tend to operate better when I can 1) Collaborate with other students (and professors) 2) Have deadlines

<comment><USER13> You can get pretty far online only, but the networking opportunities even in a non-top school are worth every penny.

It's interesting finding a new job only to have existing classmates be excited for you to be there. Rumors begin spreading that you get shit done even quicker.

</comment></comment><comment><USER14> I've had this site bookmarked for at least a year and have really enjoyed watching the curriculum grow. Now only if I could start on it...

<comment><USER15> > if I could start on it

A suggestion for getting yourself to spend time on large projects: [http://tynan.com/ornothing](http://tynan.com/ornothing) "Do it or nothing"

</comment></comment><comment><USER16> I'm working on a course much less bulky than this one. Basically mixing the first two semesters of CS at any university with your standard bootcamp curriculum. I have a theory that teaching each concept in multiple languages side by side will be far more effective than other methods.

<comment><USER17> I'm working on something similar.

</comment></comment><comment><USER18> "Use LibGen if you can't buy these books." This is literally the first guy that recommends something like that in such a literal way. +1.

<comment><USER19> Not the first one, but it's still not a frequent occurrence.

(So let's use this as a reminder that the same applies for SciHub and scientific papers, with extra suggestion to use SciHub anyway, as researchers were most likely paid already from tax money anyway.)

</comment></comment><comment><USER20> Outstanding resource.

jwasham/coding-interview-university also links to a number of also helpful OER resources: [https://github.com/jwasham/coding-interview- university](https://github.com/jwasham/coding-interview-university)

</comment><comment><USER21> For those who didn't learn CS formally and taking this guide seriously: it seems too heavy on math and completely missing in many important areas IMO. Like - no sections for OS or networking?

</comment><comment><USER22> From the headline I imagined a curriculum that updates itself based on developments in the field.

</comment><comment><USER23> Ok, I'll admit for a moment that it might be GaN networks being used to generate CS courses :-)

This is a good list, I would add something in category theory to it and macro economics (for the systems approach to highly variant systems).

</comment><comment><USER24> I like the fact that this is out there for people to do. As someone doing a degree I dont have the time for it now, but will definitely check in on it if I have some time off!

</comment><comment><USER25> I need something like this for math. i moved to engineering for my bachelors but would love to do a self-learning math curriculum.</comment>


A Teenager's IoT worm is bricking thousands of devices - <AUTHOR> https://www.zdnet.com/article/new-silex-malware-is-bricking-iot-devices-has-scary-plans/ <comment><USER3> If you have seen electric wiring inside houses from 1920's, that's the state of IoT and internet connected devices today. Bad things must happen first for standardization and regulation to happen.

Consumer devices and gadgets are not my main concern. Internet connected building automation is in similar sorry state. Someone will do large scale apartment automation systems attack, maybe just single manufacturer is targeted and as a result 5-15% of apartments go nuts at once. Just messing with the air conditioning can kill old and sick people until things get fixed.

<comment><USER4> Messing with the air conditioning can affect a lot more than just the people who have the vulnerable IoT air conditioner, if it manages to bring the grid down.

The grid is able to cope with fluctuations in demand, but that's a totally different ballgame than switching massive loads on and off, synchronized to within something like 20 milliseconds (a single 50 Hz cycle), in a controlled, intentional and malicious way - and potentially worse, the attacker could observe the grid and react to the countermeasures (e.g. to detect how quickly the grid reacts, and trigger oscillations in some system never designed to deal with something like that).

<comment><USER5> Can a thermostat do that? It takes a time scale of ~seconds for my air conditioner to click on and off.

<comment><USER6> If your air conditioner clicks on after 3 seconds, you push the button 3 seconds earlier.

</comment></comment></comment></comment><comment><USER7> I personally see Brickerbot as the IoT version of Shodan. Port scanning and probing is considered illegal and immoral in many countries around the world yet Shodan has made the Internet more secure, by opening access to port scanning and making it impossible for companies to just "hide" new tools.

I'd prefer to see ISPs/governments taking action against dangerous IoT devices in their network (sending probes to vulnerable devices and blocking Internet access until the owners of the devices have secured their shit or provide proof of running a honeypot). We can't really expect such measures from companies right now, but a tool like Brickerbot might kickstart a movement.

I'd prefer the bot to just change the password and disable vulnerable services though (which still might brick devices if their web servers are vulnerable). Still, I do believe that why device fallen to Brickerbot would have fallen to any other botnet within days anyway, so the botnet is not inherently bad in my opinion.

This problem should stary disappearing as soon as legislation is introduced by governments to make the parties producing software or hardware responsible for the stuff they dump on the open market. Until then, steps have to be taken to stop DDoS attacks as they are getting worse and worse.

<comment><USER8> > Port scanning and probing is considered illegal and immoral in many > countries

Do you know of a country where this is true? I know there are some broadly worded laws in England against the use of "hacking tools" but there are so many legitimate uses of port scanning that it'd be hard to explain why a port scanner is any more of a hacker tool than traceroute is.

<comment><USER9> In the UK it's not illegal per se, but if you go by the letter of the law you could be convicted under the Computer Misuse Act for it. But at the same time you could be convicted for sending a HTTP GET request to a server you don't have permission to access - this law is rather broad.

I'm not sure if there's even been a case to test it though, and as the general population becomes more tech savvy it seems unlikely such a conviction would be made for port scanning on it's own.

</comment></comment></comment><comment><USER10> If they can be bricked, perhaps they should be bricked. Maybe this is something we should encourage going forward to encourage security for IoT? Maybe we should hold a Brickcon where security researchers try to develop ways to brick any insecure devices before they become a threat.

<comment><USER11> No vigilante justice required. Just make the companies liable for the damage they cause when their products turn into a botnet.

Why can't products have a "declaration of security", like they have for EMI compatibility, safety standards and other such things? Declare that the manufacturer has taken reasonable steps to make the device secure and is liable for damage if that turns out to be untrue.

<comment> jon-wood We're moving in that direction in the UK. There's no legislation around it yet, but the government recently published the snappily named Code of Practice for Consumer IoT Security[1], which if rumours I've heard are correct they've basically published saying manufacturers can either voluntarily comply, or they can deal with it become legislation in the future.

When I first heard about it I was pretty dubious given government's track record on regulating technology, but its actually a really solid document, covering 13 guidelines which are specific enough to be useful, while not going deep into technical detail which will go out of date:

1\. No default passwords

2\. Implement a vulnerability disclosure policy

3\. Keep software updated

4\. Securely store credentials and security-sensitive data

5\. Communicate securely

6\. Minimise exposed attack surfaces

7\. Ensure software integrity (this is probably my least favourite guideline, as it basically says you should check signatures on all firmware, by extension shutting down people's ability to control their own hardware with custom firmware)

8\. Ensure that personal data is protected

9\. Make systems resilient to outages

10\. Monitor system telemetry data

11\. Make it easy for consumers to delete personal data

12\. Make installation and maintenance of devices easy

13\. Validate input data

[1] (PDF) [https://assets.publishing.service.gov.uk/government/uploads/...](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/773867/Code_of_Practice_for_Consumer_IoT_Security_October_2018.pdf)

<comment><USER12> Oh yes. I'd push back hard on 7. Otherwise, it's a really solid list of guidelines and I love it.

WRT. 7, forcing secure boot is an overkill and pretty anticonsumer, IMO. There _really_ needs to be a provision allowing for user-initiated software changes. If you're from UK, please let them know via e-mail to: firstname.lastname@example.com.

I was worried about 10 (I don't really like the vendor collecting _any_ telemetry on my IoT devices), but the actual document is more reasonable than the headline makes it sound - it's " _if_ you're collecting telemetry - <USER2> keep in mind point 8 - then monitor it for security anomalies".

<comment><USER13> I'm going to be very cynical and say that 7 is the only reason this legislation is being pushed, and that's the reason it's in the middle, surrounded by boringly reasonable stuff.

More cynicism says that it will require IoT devices to be closed source in order to get a signature, and require government access and audit on running devices (to confirm integrity.) That may secretly be the backdoor clause. I'm probably wrong, but the UK government is fully committed to total surveillance, and the opposition either has no position or tacitly supports it.

<comment><USER14> How many firmwares on consumer non-PC products have you ever custom flashed? Zero for me atleast, unless we count a Xbox.

If manufacturers would like to add some signature checking chip they can allready do that.

I wouldn't be too cynical, unless they make it illegal to modify the firmware.

</comment></comment></comment></comment></comment></comment><comment><USER15> The original title would be good enough for this story imho.

Worked in a bug bounty program for a spell, there are some young folks out there with borderline scary levels of talent and tenacity. Making this about the age of the person doesn't really add anything. (This is coming from a relative dinosaur, so maybe I'm just age-sensitive haha)

<comment><USER16> In high school and middle school you also have a lot more flexibility to devote a substantial amount of time to this type of stuff. You are right, it can result in really technically literate individuals.

</comment></comment><comment><USER17> One of my favorite tidbits found on the HN was this:

       The 'S" in 'IoT' stands for 'Security'

Alas, I do not remember whose comment was that.

<comment><USER18> I think this may have originated with Oleg Šelajev's tweet[0]

[0] [https://twitter.com/shelajev/status/796685986365325312](https://twitter.com/shelajev/status/796685986365325312)

<comment><USER17> I think you are right!

</comment></comment></comment><comment><USER19> I'm going to suggest that maybe this is a good thing. If the worm is really good at its job, it can take out all those zombie IoT devices that are being used for botnets. And it maybe it will act as a wake up call to consumers, regulators, and, perhaps, companies.

Not that I condone destroying people's property to accomplish that, but at least there is a potential upside.

</comment><comment><USER20> .. But is it a parthenogenetic worm?

I recently read the Shockwave Rider [1] in which the word 'worm' was first coined, thanks to the discussion on HN [2] on Stand on Zanzibar. Can recommend both books for those into SciFi and would like to thank the community.

[1] [https://en.wikipedia.org/wiki/The_Shockwave_Rider](https://en.wikipedia.org/wiki/The_Shockwave_Rider) [2] [https://news.ycombinator.com/item?id=19879830](https://news.ycombinator.com/item?id=19879830)

</comment><comment><USER21> Great article, but for the Iran smearing. Come on zdnet, you know better. Out of the thousands of ip addresses related to this attack, including a command and control center etc, whilst knowing that an attack from a VPN in Iran does in no way prove that the attacker is indeed from Iran or even Iranian, still you managed to insert a whole paragraph titled "Attacks carried out from Iranian server" in there, even though the researcher says the ip only "appears" to be from Iran, and he describes one (1!) attack from that ip. This wasn't even the command-and-control server.

And that 14-year old is living in Europe, not Iran.

Please leave the propaganda out of your tech news, zdnet.

<comment><USER22> Hey,

I'm the ZDNet reporter who wrote the story.

What in God's green earth are you talking about?

The article says the hacker's server is rented from an Iranian company. And yes, despite your ignorant claims, the IP address is the C2 server.

What imagined propaganda are you talking about?

<comment><USER23> Regardless of the importance of the Iranian IP to the operation, it is of very little significance to the story. Mentioning it only really serves to act as clickbait for people who don't understand that it's possible to stand up a server anywhere in a few minutes, and who are predisposed to think that an Iranian IP makes everything extra ominous.

<comment><AUTHOR> The Iranian IP is important because it means its unlikely that we'll ever get any data from the server. If it was in the US or EU, its much more likely we could subpoena it and figure out more about whats going on.

I read the article a few times and I don't think there is any anti-Iran sentiment in it at all.

</comment></comment></comment></comment><comment><USER24> I did a few stupid things when I was around this age, but Internet was nearly non existent so it was mostly within LANs.

I agree that IoT is a real problem, and I fear people will realize too late, with an accident or something, but this kid should have known better, depending in how it unfolds he could be in trouble.

</comment><comment><USER25> That's excellent. People still don't realize what the consequences of the so called "IoT" are - and the sooner they do, the better.

<comment><USER26> That's harsh, but probably spot on. Better to have the fear instilled while it is more of a PTA than a national catastrophe

</comment></comment><comment><USER27> I'd love to read this article, but it's so covered with ads and shit I can't. Reader mode is usually my saviour in this situation, but it's not working in this site.

</comment><comment><USER28> "It's using known default credentials for IoT devices to log in and kill the system"

basically its like knowing a computers root password with remote access apparently from anywhere. it looks pretty simple but effective and many iot devices are known for their lack of or lacking in security measures.

</comment><comment><USER29> I do wonder... manufacturers aren't liable if you allow your device to be bricked by third parties. But if such attacks were so extremely normative and carried out in such a way that they informed the user why they are possible... could the manufacturers become liable to address it?

</comment><comment><USER30> Would be way better if the worm reported back which devices were vulnerable (for naming and shaming) as it found them instead of ruining peoples' stuff just to make a point (or worse, plain lulz)

<comment><USER31> So what would that look like? You found some vulnerable webcam, great now you can add its IP address to your public shaming list. That'll teach that random farmer somewhere in Iowa. Listing the device name and count wouldn't do anything; the vulnerability is already known otherwise the worm wouldn't exist... And either the manufacturer doesn't care, or there's an update and nobody cares.

If otoh you brick the device in a way that requires flashing via jtag and suddenly have hundreds of people all over the country return their broken webcam to WalMart you make a little more impact. The thing is, it would have to keep happening for stores to start noticing a pattern and start caring. If it was a one time thing it might be cheaper for then to just throw them in the trash and hand out new ones or refund.

</comment></comment><comment><USER32> >It's expected that some owners will most likely throw devices away, thinking they've had a hardware failure without knowing that they've been hit by malware.

And... more trash. Ugh

<comment><USER33> Hopefully a lot of these devices are still under warranty and will be returned, but yeah...

<comment><USER34> That's surely just adding miles to the journey, I doubt a returned bricked device is getting repaired or salvaged for parts by the OEM.

<comment><USER35> According to the article, it just needs a firmware reflash, so I don't see why a manufacturer couldn't repair it and return it to the customer.

<comment><USER36> Money - not to mention these devices will just get re-bricked. They have to fix the fundamental problem first.

</comment></comment></comment></comment></comment><comment><USER37> I always asked myself this question: does this kind of attacks try to authenticate to every single IP address (for loop, excluding ranges from Google, Microsoft, Apple...) or does it penetrate the victim network first by executing some random file from the internet that the victim downloaded?

</comment><comment><USER38> > Who's behind the Silex malware?

Maybe people who set the same password on the whole fleet and don't make the user override it?

Come on, you can't take the responsibility from well-paid incompetent professionals and put it on a teenager from a third-world country.

</comment><comment><USER39> Which IoT devices does this affect? Is it just devices that run Linux and have an exposed SSH? Wondering if things like the Particle.io / Obniz / ESP8266 are affected.

<comment><USER40> The article says the kid wants to add SSH later and suggests that it uses telnet today.

</comment></comment><comment><USER41> VLAN your devices, and deny and outside route, if you can.

</comment><comment><USER42> Interesting that this "worm" just bricks the devices instead of repurposing them to attack targets autonomously.

</comment><comment><USER43> What are the devices? Are all my lights going to turn off?

<comment><USER44> If your light is exposed to the internet and use default security, maybe...

<comment><USER43> I was joking, but it's sort of my point - who's exposing IoT devices to the internet?

<comment><USER45> All IoT devices are exposed to the internet by design. That's what the "I" stands for, Internet.

<comment><USER46> But are the addressable?

My IoT devices are on my network but you would need to get yourself inside my network to talk to them. I'm not exposing ports for my lights...

</comment></comment></comment></comment></comment><comment><USER47> A quote from not the current worm's author, but the author of the worm that may be the inspiration for the current one:

> _The BrickerBot author argued that it would be better if the devices were > destroyed, rather than sit around as cannon fodder for DDoS botnets, and > haunting the internet for years._

... yea, broadly I'd agree. IoT vendors are causing a tragedy of the commons, inflicting quite a lot of damage without feeling any of the pain because it hits others.

It's the sort of thing that should be addressed by legislation of some kind, but absent that (which includes nearly all international cases)... what else can you do to stop the worst offenders?

<comment><USER48> What would be really nice is if a worm like this patched the crappy security of those IoT devices, but I guess that's too hard. With the question being either bricking them or allowing them to become part of a botnet, I guess the world might indeed be better off with vulnerable IoT devices getting bricked. But boy, it's really a marginally lesser evil.

Let's hope this forces manufacturers to improve their security. That's the main good that needs to come out of this.

<comment><USER35> Patching is just a subsidy for the manufacturer. This malware just soft-bricks (the device can be restored by reinstalling the firmware), so it inflicts a cost without generating extra garbage. Sounds great to me.

<comment><USER48> With the risk that the owner just throws it out and buys a new one. Possibly even from the same manufacturer.

<comment><USER49> From that perspective, would the vendors even be motivated to fix it? Hmmm...

<comment><USER50> When the 2nd device bricks within a week then yeah, the online shitstorm would engulf them.

</comment></comment></comment></comment></comment></comment><comment><USER51> Url changed from [https://boingboing.net/2019/06/25/teenaged- kicks.html](https://boingboing.net/2019/06/25/teenaged-kicks.html), which points to this.

<comment><AUTHOR> TBH I trust Boingboing's integrity more than zdnet but I truly appreciate the transparency!

<comment><USER52> I think it's more that the original source is preferred, out of respect to the producer of that content, rather than a "reblog" that doesn't add much substantive new info. BoingBoing is great, and plays an important role, but that role seems mostly to surface stories from elsewhere, highlight the key points and add its own editorial take, rather than generating original content.

</comment></comment></comment><comment><USER53> Funny how they believe that he is actually a teenager. Like the creator will reveal his real age.

</comment><comment><USER54> He's doing $deity's work. The Internet of shit needs to be culled, before it can wreck more damage.

<comment><USER55> wreak?</comment></comment>


Ask HN: How do you stay up to date with scientific papers on a particular topic? - <AUTHOR>

If you have a particular area of interest or expertise, how do you stay up to date with research on that topic outside of the journals you regularly read?<p>For example, if you were studying the effects of sulforaphane on cancer, how would you find out about research on sulforaphane published in journals around the world, short of manually checking? <comment><USER2> [http://www.eurekalert.org/search.php](http://www.eurekalert.org/search.php) will have the papers you need. Just do an advanced search for your topic, and soft by date, and then bookmark.

<comment><AUTHOR> Thanks, I will look into this.

</comment></comment><comment><USER3> A friend is developing this:

[http://recentlyapp.com/](http://recentlyapp.com/)</comment>


Ask HN: Why are more Startups using Python over Ruby? - <AUTHOR>

It was just an observation I noticed with job postings, and meeting early stage startups. Is there a reason why Python + a framework has become more prevalent over Rails? <comment><USER2> I can't give you a definitive answer, but I'll explain why my company chose to use python.

NOTE: We're a technical startup in the telecommunications industry. We build web-based telephony applications in addition to traditional phone-based applications.

1\. python's syntax is extremely clear and easy to read / maintain. I can open any python project, and immediately find my way around with no prior knowledge. This makes working in teams especially easy, when you have numerous developers committing various bits of code to various parts of the product throughout the day.

2\. In the past two years, the python community has put a great amount of emphasis on documentation for open source projects (using Sphinx), and as a result of this, many open source python packages now have _excellent_ documentation that makes it really easy to start using third party libraries and feel secure in your choices. Just check out <http://rtfd.org/> for examples (ReadTheDocs is a hosted open source documentation site, focusing on python).

3\. Django is an excellent web framework, and has tons of reusable open source applications that you can use, which makes rapidly developing web applications easy. The Django app ecosystem has been growing at an insane rate over the past few years, and there are more than enough applications to solve most common patterns.

4\. Tools like tox, nose, coverage.py, and others make testing in python simple. It also helps that Django encourages testing in a large way (providing a default tests.py module for each application, with example tests). Having such a large emphasis on testing, with such great tools, makes it easy to "Do The Right Thing" and build tests into your software.

5\. There are excellent tools in python for performing complex tasks, like celery / redis for building distributed queue processing workers.

6\. PyPY (an alternative python interpreter) has been showing immense promise with python speed improvements. PyPY can be used as a drop-in python replacement on any linux system, and yields immense performance improvements to even the simplest code.

7\. The python community in general tends to be very friendly, supportive, and encouraging. There are a lot of popular figures in the python community, and the overall personality traits of leading python community figures tends to be humble, helpful, and encouraging. This has fostered a really excellent community focused around accomplishing things, and helping people out, which I think gives the language a good overall feel.

Just my two cents.

<comment><USER3> Would it be fair to say the same points apply to Ruby/Rails (with name variances of course)?

</comment></comment><comment><USER4> None of the posts in this thread really answer the question to "why python over ruby", they just talk about all of the nice features of current python development. The thing is modern Ruby has all of those tool sets as well.

Before you even being to make the statement "Why are more Startups using Python over Ruby?" you need some data. I'd be willing to bet that more places do in fact use python over ruby, but that number is a lot closer to 50/50 than you think. In fact, it is probably so close that this argument becomes pretty silly.

I once heard a successful startup founder describe the choice to use Python over Ruby because a couple of years ago getting started with Ruby was too difficult for them. They had spent a day trying to setup Ruby, Rails, etc and nothing was going correctly. After that they tried to install Python, it worked, and from that point on code was written in python. This story isn't elegant, sexy, or thought provoking, but it goes to show you that there are all sorts of crazy, silly, and stupid reasons why some people pick one language over another.

Lets talk about reasons why startups are _NOT_ using Python over Ruby.

Python is not taught at more schools than Ruby. Well, I couldn't find a list of schools teaching Ruby, but search for the Python list (hint, its up on python.org). There are only a handful in the US and these look like nothing when you consider all of the places that use Java.

Python's syntax is not easier or better than Ruby's. Nor is Ruby syntax better than Python syntax. Anyone trying to compare the two is just looking for a flamewar. Omg significant white space vs lol meta programming type arguments.

Both languages have excellent documentation and community. Very hard to compare these sort of things.

Django is a great framework, but so is Rails. Both have very vibrant ecosystems that are just exploding right now.

Tools - great tool sets in both. If a Ruby tool comes out that is good you can bet your ass there is going to be a python port of it in the next few years (and vise versa of course). A single great tool is never bound to one language/framework.

Implementations - both languages have a ton of cool projects that revolve around finding alternative ways to rebuild the VM.

Go ask people why they chose to write in a language/framework. They are going to give you answers like "it's what we chose", "i dunno, we just knew it". Comparing things like documentation, community, MVC Frameworks, tools, syntax, etc with two languages like Python and Ruby is pretty silly because its going to become a wash every time.

</comment><comment><USER5> The web stack in Python got dramatically better in the past two years: just take a look at Flask, Werkzeug, requests, class-based views in Django, etc.

There were major improvements in deployment, too: Fabric and supervisord are maturing very nicely.

Once you've nailed the CRUD part of your startup down and want to start slicing your data in interesting ways, you have extremely powerful and easy- to-use libraries like nltk and numpy at your disposal.

Finally, Python continues to get a tremendous boost from the fact that Google uses it to write sample client code for their APIs.

<comment><USER6> Better than before or better than Ruby?

I think you struck a valid point, though. There are lots of options for relatively small Python-esque web stacks, and considering that the architecture style seems to go that way – with lots of independent services and big JavaScript frontends – you're often quite well-served with Python.

But maybe that's just my somewhat biased perception, I wonder how the general trend of Python vs. Ruby fares in comparison to the trend of Django vs. Rails.

And speaking of bias: Once you get small services, interop features and libraries become quite important to save you work, and I have the feeling that quite often generic Ruby gems could use some work. Often there's a plethora of half-abandoned solutions for one task, all somewhat orphaned on Github.

Then again, both languages still don't come close to CPAN in that regard (then again, what does?).

<comment><USER5> Oh, I should've been clearer: I meant that things got a lot better than before. I don't know Ruby all that well so I have no basis for making comparisons.

</comment></comment></comment><comment><USER7> Python is a great language. Simple. Powerful. Easy to read. Why not?

Also django is pretty great with amazing docs. I know a lot of people argue against because the django community isn't as large as the rails community (and it isn't). All that matters is that it's large enough though (and it is). Hasn't failed to answer my questions yet.

</comment><comment><USER8> What gives you that impression? Where did you get the numbers from?

I reckon RoR is faster for rapid prototyping and development of new features so I'd choose that in the beginning for a one or two man startup.

Later on if there's anything in particular you need that Python does, you can always recode once you're profitable.

<comment><USER9> Recode once profitable? That's one of the easiest ways to lose momentum.

</comment></comment><comment><USER10> I'd like to know where you are looking for job postings. Every posting I see is a Ruby on Rails shop. My own feeling around the bay area is that ruby/rails has overshadowed django/python...at least in the web arena.

General purpose stuff though I concur that python tends to beat out ruby. Except for maybe puppet.

</comment><comment><USER11> It's a bit disappointing not to see more mention of Groovy/Grails.

It has all the great features you get with Ruby/Rails but built on two solid time tested technologies being Spring and Hibernate. Not to mention the ability to integrate with pretty much no effort with existing Java infrastructures.

</comment><comment><USER12> So far you haven't provided a credible reason to think that "more Startups _are_ using Python over Ruby?"

<comment><USER13> Haven't seen a credible reason to think the inverse, either.

<comment><USER12> In which case the simple truth is that, you don't have a reason to think "more Startups are using Python over Ruby" and you don't have a reason to think "more Startups are using Ruby over Python" (and you probably don't even have a reason to think the same number are using Ruby and Python.)

We might as well both face-up to not knowing anything about that particular question :-)

</comment></comment></comment><comment><USER14> I switched from rails because I got tired of ruby magic breaking my code in difficult to debug ways. I switched to python because of its emphasis on clarity and readability.

</comment><comment><USER15> Python is being taught at unversites, and Ruby isn't (that I know of).

</comment><comment><USER16> Because they are just going by whats trendy I suppose. If they wanted to build something serious that can actually scale then they probably shouldn't be using a dymanic language at all.

<comment><USER17> The odds of your product ever having to scale are vanishingly small. Until you prove your product will actually need to grow to web scales, you should use whatever language allows you to deliver a product for the lowest possible cost in the shortest possible time. That usually means dynamic languages.

<comment><USER16> If you don't end up needing to scale then your application is most likely a failure, I guess I just don't quite get this approach of "we'll build it as cheaply as possible and then re-work it if needed" because I'm looking at this from the perspective of having worked for companies that did this (before I was working there) and then needing to deal with cleaning up the mess since their hastily built app did end up needing to scale. Web apps, by default, usually have the intention of attracting a wide user base so I can't say I agree with this line of thinking

<comment><USER17> You are suffering from selection bias. You experienced applications that already needed to scale. For every one of those, you have a hundred that never made it. Had they started with harder to develop with technologies, they would have failed without having any completed products.

</comment></comment></comment></comment><comment><USER18> Same reason rails was hot last year: fashion.</comment>


Web traffic redirected to China still a mystery - <AUTHOR> http://news.cnet.com/8301-27080_3-20019093-245.html <comment><USER2> Renesys has written about this twice with more facts and less speculation: <http://www.renesys.com/blog/2010/06/two-strikes-i-root.shtml>, [http://www.renesys.com/blog/2010/03/fouling-the-global- nest....](http://www.renesys.com/blog/2010/03/fouling-the-global-nest.shtml)

The gist of things it that the mainland Chinese network operators allowed the anycasted routes for the I-root in China to leak outside of their networks and into the global BGP routing table. If you made a DNS request to the I-root during that leak, and the best route to the I-root prefix was the leaking route from China, then your DNS traffic went through the great firewall and was altered accordingly.

Finally, I want to give the article the benefit of the doubt with regard to this:

      And he said he believes there were more instances of Web traffic
      being diverted to China, or "hijacked," around that time, but
      wouldn't elaborate. "I believe it happened more than twice,"
      Joffe said. "I can't comment on how many times because the
      information is not generally public."

but _many_ views of the BGP routing table are public (<http://routeviews.org>) and/or fairly well monitored for hijackings, etc. by network operators and others like Renesys and BGPMon (<http://bgpmon.net/>). Unless this is occurring only within China's regional networks, I expect we would've heard something about this already.

</comment><comment><USER3> Couldn't this be the result of a misconfigured router that broadcasts that it is the shortest hop to everywhere? I recall in school one of the professors said they had to put protections in place in one of the labs because one of the students router projects had once gone awry and did something similar.

</comment><comment><USER4> "Operators of those servers would have had the capability to read, delete, or edit unencrypted e-mail and other communications passing through those servers during that time, he said. The Secure Sockets Layer (SSL), used by e-commerce sites to encrypt traffic over the Internet, has been compromised so even supposedly protected traffic could have been exposed, according to Joffe."

This bit of the article doesn't make sense to me, and wasn't explained further. How could SSL be compromised via an Internet routing hack such as this?

</comment><comment><USER5> Possibly this is some kind of political statement to show people how the internet looks in china?

<comment><USER6> Possibly. Or somebody could be using servers in China in a "man-in-the-middle" attack to get information while it is en-route.</comment></comment>


A Steady-State Economy - <AUTHOR> http://www.adbusters.org/magazine/81/steady_state_economy.html

<comment><USER2> More-or-less endless progress is something I took for granted most of my life. In the last few years, that's started to appear less sound an axiom. It's good to see a thoughtful exploration of an alternative that doesn't necessarily involve a large die-off and a reversion to pre-technological hunter/gatherer tribes--something closer to "the Invisible Hand has taken all those historical inequities and smeared them out into a broad global layer of what a Pakistani bricklayer would consider prosperity."

<comment><USER3> You're confusing the last 12 months with a 4,000 + year longterm trend.

Human lifespans, human wealth, and human knowledge have been growing exponentially for a long time. Check out a graph of American income over the last century - the Great Depression is just a blip on the inexorable growth.

By failing to have any long term perspective you're just slamming to the rails, taking the most recent headlines for some sort of reasoned conclusion on the future of growth.

<comment><USER2> I made a subjective statement, leaving out the research and reasoning that changed my opinion, on purpose. I don't think this is the right forum to discuss the limits on terrestrial resources; I've participated in those threads on reddit and they're interminable, and they never seem to prompt a single genuine bayesian update.</comment></comment></comment>


Bootstrap Based UI for Logstash (Open Source Splunk) - <AUTHOR> http://rashidkpc.github.com/Kibana/index.html

<comment><USER2> Please don't call logstash "an open source splunk". It's no such thing. Splunk still has features that logstash doesn't have (yet). Logstash has quite a few features that Splunk doesn't have.

Jordan had never seen (or to my knowledge has yet to see) splunk at all. I don't know about Pete. Myself, I haven't used Splunk since trying a very early release once in the very first days of it.

Point being, Logstash doesn't call itself an "open source splunk". In fact I've considered adding an output to SplunkStorm to Logstash.

Do I think Logstash is better? Yep. Do I know people who swear by Splunk? Yep. Competition is healthy.

<comment><AUTHOR> The commonality is they both ingest logs and provide fulltext search for said logs. That's enough to loosely comare the two for purposes of promotion here on HN, or even getting good mentions on ServerFault: [http://serverfault.com/questions/62687/alternatives-to- splun...](http://serverfault.com/questions/62687/alternatives-to-splunk)

I'm certainly not the first to make this comparison.

<comment><USER3> Although logstash does have a built in elasticsearch, I wouldn't really say anyone uses logstash itself to provide search for the logs. Logstash itself just provides a way to move events from one place to another, that's all.

<comment><USER4> "I wouldn't really say anyone uses logstash itself to provide search for the logs"

Huh? The front page of <http://logstash.net/> suggests that one of the primary uses!

"logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs.

All your logs from all over your infrastructure in one place - with searching and graphing. Since we can easily parse text-based logs, you can query for more precise things like, all 404 http errors, nagios critical alerts in hard state, or mail server faults - all without accidentally finding logs with the word '404' or 'critical' in the wrong place."

<comment><USER3> Elasticsearch, the recommended backend for making your logs searchable, is a separate project from logstash. Logstash does come with a built in elasticsearch, designed to get people up and running very quickly, but if you are considering any serious use of elasticsearch you would set it up yourself as a standalone service.

Logstash does come with a simple web interface, and kibana is a slightly better but still simple interface being ported into logstash. Again this is geared towards getting people up and running quickly, and at the end of the day it's just a pretty curl wrapper for elasticsearch.

You can also use logstash without elasticsearch/kibana, which we do for a good bit of our logs. I think logstash intentionally blurs the lines of what it is or isn't so people don't get caught up in trying to figure out how to get it running. Give it a try and see for yourself exactly what it is or isn't.

</comment></comment></comment></comment></comment><comment><USER5> Currently experimenting with logstash and Kibana on internal systems and very happy so far, no complaints with it.

Be warned though that logstash is not mature software, get on the mailing list and read the github page.

Now if only the rails logging system wasn't so tightly integrated and string- happy.

<comment><AUTHOR> I'm pretty sure he's working on it fulltime as of a month ago or so.

<comment><USER5> Groovy, didn't know that. When I said "not mature" I just meant in terms of number of deployments and age of the code-base.

No knock against author intended.

<comment><USER2> You might underestimate the size of deployments of logstash. Mailchimp runs logstash in a pretty sizeable cluster for all traffic coming into HTTP front- ends. I can think of quite a few sizeable logstash installs that I can't mention.

</comment></comment></comment></comment><comment><USER6> Why on earth does being made with bootstrap matter for this? The headline should read "Logstash UI that doesn't suck"

What something is built with doesn't matter, that it works matters.

<comment><USER7> I don't see a problem with it TBH. I pretty much knew exactly what to expect because of this wording, which is a good thing.

<comment><AUTHOR> That's what I was shooting for! :)

</comment></comment></comment><comment><AUTHOR> A working demo is here: <http://urly.stackgeek.com/C2v>. Author of Logstash is here: <http://semicomplete.com>.

</comment><comment><USER8> Looks similar to <http://graylog2.org/>

<comment><USER2> Logstash and Graylog are complimentary. Most people, myself included, we're originally using Graylog2 in conjunction with Logstash.

Graylog2, though, had problems with it's original implementation based on capped containers in MongoDB. It has since moved to ElasticSearch.

There are both gelf inputs and outputs for Logstash so you can send your logs to Logstash as if they were going to Graylog2 and do additional munging and still send them out to Graylog2 from there.

<comment><USER9> Would you mind going into more details as to how they are similar and what the differences are between the two? Should I run both, or pick one? You seem to suggest to run both in tandem but I'm not sure I see why since at first sight they seemed pretty much the same to me.

I was planning to setup Logstash next week so your input would really help. Thanks!

<comment><USER2> Graylog2 only handles syslog and its own protocol (GELF) for accepting log events. Graylog2 uses ElasticSearch for data storage. Logstash can use ElasticSearch or just send the data elsewhere.

The Graylog2 web interface is pretty awesome and it has some neat stuff built in. Logstash ships with a fairly spartan web interface though we're going to replace it with a ruby port of Kibana in the future.

Logstash can accept data from GELF senders (via the gelf input plugin I wrote) or send to gelf receivers (like Graylog2).

Graylog2 is awesome, don't get me wrong. I just had to bail on it when it was still on MongoDB because I couldn't justify the cost of instances needed to get a MongoDB instance that could hold more than 4 hours of data.

</comment></comment></comment></comment><comment><USER10> You need to add some CSS to account for extra pixels the responsive navbar uses. Also, the JavaScript for the navbar menu does does not seem to be working.

</comment><comment><USER11> Could this be used on Elasticsearch in general? Any pointers what's needed for that? The interface looks nice, and we have a large(ish) Elasticsearch cluster I'd like to try this on.

</comment><comment><USER12> Whats Splunk?

<comment><USER4> <http://en.wikipedia.org/wiki/Splunk></comment></comment>


Facebook Lost a Great Engineer - <AUTHOR> https://medium.com/on-startups/4c0197625f69

<comment><USER2> "which merges two sorted arrays without allocating any additional memory. Aside from having no real-world value, it's not actually possible, and his solution code clobbered most of the data in the first array."

This is referring to me.

The author has misrepresented the truth.

(1) The problem does not state that you may not allocate additional memory; only that the memory allocated must be constant relative to the size of your input.

(2) Given #1, this problem is absolutely possible.

(3) The problem explicitly asks you to merge the two arrays "in place". If by "clobbered" you mean changed, then that means that by definition one of the arrays will be "clobbered". We can certainly have a separate conversation about whether modifying structures in place is a good coding practice, but it is generally more efficient and highly widespread in non-functional languages.

I'm sure it wasn't purposeful, but I'm disappointed that the author misrepresented our conversation to make a point. Separately:

(4) This problem is extremely applicable to real-life programming IMHO. It does not use any esoteric data structures. It does not use any complicated algorithms. All you need to do is iterate through two arrays at the same time. A great majority of candidates have solved this problem.

In general I agree with this post's thesis. Facebook's general philosophy with interviews is to allow each interviewer to ask whatever questions they want, and the consequence is a variance in the type of questions getting asked. However, based on internal conversations I know that Facebook is trying to move away from "puzzle" questions by explicitly "retiring" a number of questions that we consider to be unproductive.

<comment><USER3> This is a slightly awkward friendship you have with the author of the post.

<comment><USER2> Don't worry, I promise we're actually homies ;)

We talked it through and he removed the part that bothered me. I'm actually gonna hang out with him tonight...

</comment></comment></comment><comment><USER4> A Finance sector perspective:

In reading through the threads, there's a common underlying assumption that if you don't get the problem right, you won't get hired. That definitely is NOT the case in finance. We use the brain teasers and puzzles as a way to showcase how you think. For my interview, out of 5 brain teasers I nailed 2, was heavily helped through 2 more, and never got the last one, even with lots of help. But for each, the interviewer made it very clear that I was to think out loud. After getting the job, I later used the technique in interviews and gave positive reviews to those who had similarly struggled through puzzles but had used a similar thought process. In general we used this to weed out three different types of people:

1\. Hard science majors who learned how to solve problems instead of think through problems. These people learned how to derive the heat diffusion equation, but would never put a story modeling a random walk in connection with that equation.

2\. People who freeze when things get tough. Obviously a bad thing on the trade floor. While with coding you can often walk away from a hard problem, think about it, and come back, in finance, you can't walk away from losing lots of money over a short period of time ... you have to stop the bleeding.

3\. People who learned how to think quickly and with rigorous process. The type of people you want.

</comment><comment><USER5> Is it possible that the look of distain on his face when the interviewer asked him to solve a puzzle indicated that he wasn't a good fit for their "puzzle culture"?

I don't think it's fair to conclude he didn't get the FB job due to his failure to write a square root function. The funnier part is that this question isn't a puzzle (but does perhaps indicate how well the interviewee has internalized mathematics).

I suspect I'd have failed him for ego ... "Today, after releasing 25 Github projects, creating several widely-used apps in less than a day each, and designing an entire architecture for a streaming platform, I realize I'm a pretty well-rounded and high-performing developer/engineer/architect. At the scale of Facebook, I'm exactly the sort of engineer I'd want many of." I've been in the industry for 30 years and realize I still have so much to learn.

<comment><USER6> Yeah, I think there's definitely an ego/butthurt attitude here I wouldn't put up with.

Don't get me wrong, I think everyone needs to have a certain confidence on their abilities and expertise, but it works both ways: when hiring for our startup we'd look for honesty and humble acknowledgment of the candidate's shortcomings/lack of expertise.

I wouldn't fail you for not knowing what the Newton's method for finding square roots is, but I will fail you for thinking it's irrelevant or not caring. If you don't care about my requirements in an interview, I don't think you'll do much better with actual work.

</comment></comment><comment><USER7> Sorry for the off topic but

"How often do you expect candidates to write a function to calculate the square root of a number? I would fire any developer who chose to re-implement standard library functions."

Not this crap again.

Oh and he says he has an "interest in formal computer science"

No, I don't expect you to reimplement square root. Or maybe I do, because that's what a lot of games do (or something similar) because you have to reach a balance between speed and accuracy.

Or maybe because we need a bigger precision than a double, again there are libraries, but again we may need something else that's not in the library.

So yes, absolutely, what I wouldn't hire is a "computer scientist" that can't work their way around a math problem.

Edit: oh it gets worse, he gives the "never parse HTML without a proper HTML parser" talk

Whine whine whine

Step 1 - learn the rules. Step 2 - learn when to break them

And it's only an example

FB didn't lose a "great engineer", they were right on target.

</comment><comment><USER8> Yeah these sort of questions are pretty ridiculous.

Though I wonder what the intent is here, say for the first question - "What is the pattern here ?"

After looking up the solution on wikipedia - <http://en.wikipedia.org/wiki/Look-and-say_sequence> I would have to admit there is no way I'd figure that out without knowing the concept ahead of time.

So are they looking for someone that knows the 'look and say sequence' explicitly ? Same way if you presented the meaning of numbers 80 or 443 to someone they'd either know or not, but not be able to guess.

Or did they actually expect someone to work it out on the spot ?

<comment><USER9> It looked like it was a simple L-system to me...

V : 1 2

ω : 1

P : (11 -> 21) (2 -> 12) (1 -> 11)

I think that matches the information given in the question. Would that be an "incorrect answer"?

<comment><USER10> According to wikipedia[1], the sequence goes 1, 11, 21, 1211, 111221, 312211, 13112221, 1113213211, ...

[1] <http://en.wikipedia.org/wiki/Look-and-say_sequence>

<comment><USER9> Aye, but the L-system still fits given the amount of data shown in the question. So is the L-system incorrect, because there's _no_ way to disambiguate the sequence given the data?

<comment><USER7> I think you're right on the money

Your major problem would be finding an interviewer who knows what's an L-System

Edit: you should add the rule 111->31, so it may not be an l-system because there are infinite rules? (1111->41), etc

Or we limit it up to digit 9

</comment></comment></comment></comment></comment><comment><USER11> Title made me think that one of their lead engineers died. Perhaps there would be a more accurate title option?

</comment><comment><USER12> I'm not sure you're right. I was rejected by Google after 2 phone interviews with somewhat similar questions and to this day I feel like it was a failure on my part. I really _should_ have been able to do those puzzles better.

I have a job I love now, but I don't feel like I deserve it. Overall, I suck. You probably do too.

</comment><comment><USER13> Rephrase this as "Facebook Lost a Great Developer" and it begins to make sense, especially if Facebook was actually looking for a "Great Engineer".

> I would fire any developer who chose to re-implement standard library > functions.

Who writes the standard library functions?

> never parse HTML without a proper HTML parser

Who writes the parsers?

On merging arrays in-place:

> Aside from having no real-world value, it's not actually possible

It is possible, and has value when dealing with large data sets, which I'm sure is a common issue at Facebook. Here's another way to look at it: "Given two sorted 0.5 terabyte arrays on a terabyte drive, and 1 gb of memory, merge the two arrays without an additional drive."

There's no shame in not knowing or caring about things like this (it takes all kinds), but what the poster does (and seems to be good at) just may not be what Facebook was looking for.

> At the scale of Facebook, I'm exactly the sort of engineer I'd want many of.

Many possibly, but not only.

</comment><comment><USER14> Writing an article to bash a company for not hiring him doesn't seem like what a great engineer would do.

<comment><USER15> I'm not sure it's really a bashing. I read it as he's glad after all that facebook didn't hire him, so it's more like a message for those who already "lost" or will "lose" in puzzle-based hiring process. A message that states it's not necessarily their (i.e. prospective employees) loss in the end, and the more important part that it's not a reason they should feel bad about themselves after such "loss", because solving riddles is about solving riddles and not about finding good programmers (being one doesn't necessarily exclude having puzzle-solving ability, but it's not like a symmetric difference of these sets is empty, really, more like quite voluminous, I would say).

</comment></comment><comment><USER16> You'd have been just a cog in the machine at Facebook anyway. If you listen to some of their seasoned engineers speak they seem to take great satisfaction from delivering some inane and tiny little web app feature, seeing it through a year of testing, and seeing it in production. Whilst I'm sure that is satisfying if you've never known any different. It sure as hell isn't anywhere near as satisfying as building and scaling out a product or service of your own or one in which you are vested.

The article is well written but you really shouldn't put Facebook on some sort of pedestal. Especially after two years, it seems like you still feel sore about it. It really isn't "all that" to work at Facebook. Do you really want to write PHP all day, for example? For an engineer it is more a bragging right and CV fodder than anything else.

</comment><comment><USER17> Tyler, I have two things to say about this.

1°) I think you don't get it: when you're Facebook, Google or any other company receiving and interviewing thousands of candidates for a job, you're having a different hiring strategy than a small startup. Their strategy is "hiring a bad programmer costs us more than rejecting a good one". So they tend to reject good programmers, but they mostly reject bad programmers. In the end: they only hire good programmers, and that's what matters. In contrast, startups are having the "it costs us more to reject a good programmer than to hire a bad one" strategy. So they hire more easily, most of the time, even if in the end they hire average/bad programmers, they don't care.

2°) I was interviewed for a front-end job at facebook, and I didn't get in. I think I'm not the best programmer around, but I'm okay, and I would do a great job at facebook. And just so you know : my first interview question was way way way harder than any of your questions. I think those puzzles are a good way to spot good programmers amongst thousands of good/average/bad programmers. I'll give you a really simple example: find the highest number in an array. You can find it using several different ways, but if you just go through the whole array, you might be a good programmer, but the next person I'd interview might be one too, and he will find it with a much lower complexity. I'd hire him. Simple as that.

Bottom line — here's the question I was asked at facebook : you have a matrix of letters, and you have to find all the words you can do with it. For a front-end/product design job. And I'm not posting an article saying they suck at hiring.

<comment><USER18> Without any other information, how can you possibly implement max() without going through the whole array?

</comment></comment><comment><USER19> I understand that these questions can be ridiculous at times. But I think it is worth pointing out 2 things:

1) They may work well for a subset of applicants for a subset of companies. This, to some, is verification that these sorts of problems are a good way of narrowing down the applicant pool. Hence why they're used.

2) From Facebook (or any other employer)'s perspective, it's an incredibly hard job determining who will fit a given job specification. You may be great on paper, but be a total mismatch with regards to company ethos (I'm not saying you are, I'm just citing this as an example). The way (and that's assuming there is a particular way) of differentiating applicants and determining their suitability is not perfect. Different companies do it different ways, and all of this is constantly evolving. The fact that Facebook is using developers to conduct their interviews could be seen as progress to some compared to what there was x years ago in y company. It's never going to be perfect.

The fact that you've moved on from this and done a bunch of great stuff is fantastic. It's Facebook's loss. But instead of just commenting on why their system sucks, and why it didn't work for you, why not make some constructive suggestions on how it might be improved.

<comment><USER20> In my honest opinion, the way it can be improved is exactly the way my interview last Friday went:

I walked in, and did the introductions. I had two programming problems to solve, but these weren't puzzles. The two questions were fairly simple, that used a lot of basic features of the language they use in this shop.

The first question I couldn't remember the exact function names in the standard library (it's PHP, the stdlib is HUGE and stupid) but the interviewer helped me, and once I had the right functions in place, was easy.

The second question tested OOP knowledge, and again was easy for any actual programmer.

Then, once I'd passed that with flying colours, we moved on to the normal "interview".

This week, I'm going in for a day (paid), to see if I'm a good culture fit, and look at the projects I'll be working on.

I believe this is a brilliant way of interviewing and making sure you get the right candidate. Anyone who can't program will fail instantly (apparently thats a big problem here in Australia?), and then if the rest of the interview goes well, culture fit is actually TESTED (albeit as much as you can test in one day).

I'm looking forward to this place actually :)

<comment><USER21> I see "culture fit" mentioned so much, but I'm never sure what it actually means. There are many things it _could_ mean, some OK and some downright immoral. So purely for my elucidation, what does culture fit mean to you in this situation?

<comment><USER20> To me, it's about how my personality meshes with that of the team; How my approach to problems correlates with their expectations. Does that make sense?

<comment><USER21> It does and that's what I generally understood it to mean. The problem to me is that its so vague that it serves as a blanket justification for denying someone employment based on "gut feeling" or other basically discriminatory practices. It seems like it can also include "is willing to be in the office 12 hrs a day because he has no home life". No one would actually codify this in writing, but I have a feeling these are the types of filters that fall under "culture fit".

Some will (largely correctly) say that if that's the filter they use against me then I wouldn't want to work there in the first place. The problem is that it allows these types of discrimination to feel justified because we all discuss them under the euphemism "culture fit" instead of calling them exactly what they are: blatant discrimination. Personally I think if you have a filter that you would use to disqualify someone, you should be willing to state it plainly.

<comment><USER22> Culture fit is more generally whether your personality is a mesh with everyone else's personality. It's typically a blanket over everything non-coding in an interview.

For example..

Positives:

      * Person is a go getter, gets things done, doesn't get blocked
      * Person is meticulous, pays careful attention to detail
      * Person is a good communicator, articulating explanations eloquently

Negatives:

      * Person stumbles around an incorrect solution until hints are given
      * Person jumps to conclusion without considering the bigger picture (or the edge cases)
      * Person doesn't seem to get it, or at least can't explain himself/herself well

\</comment></comment></comment></comment></comment></comment><comment>---

And this can then be inferred from the technical "coding" question, or in more traditional companies they will ask direct questions (usually known as "behavioral" questions) that focus on just those personality traits.

To give a particular example, at Amazon the "culture fit" of a candidate is how well they adhere to the company's leadership principles:

[http://www.amazon.com/Values-Careers- Homepage/b?ie=UTF8&...](http://www.amazon.com/Values-Careers- Homepage/b?ie=UTF8&node=239365011)

<comment><USER21> It seems like defining it as "personality is a mesh with everyone else's" is exactly the vague proclaimation I am against. While it seems reasonable on the surface, it allows for so much abuse to go unchecked.

Your amazon link seems to be a good way to define "culture fit". All companies should do this instead of keeping it vague.

</comment></comment><comment><USER23> You did not get the job because of your attitude.

"...I realize I'm a pretty well-rounded and high-performing developer/engineer/architect. At the scale of Facebook, I'm exactly the sort of engineer I'd want many of...."

In my opinion there are at least three no-hire red flags attached to this statement.

</comment><comment><USER24> "Solutions are in the sidenotes."

Where are the sidenotes?

<comment><USER25> The sidenotes were too narrow? ;)

<comment><USER26> We'll just have to wait 400 years for the answer then

</comment></comment></comment><comment><USER27> I hate puzzles too, but that's primarily because I never know the answers :) On a serious note though, it is quite possible that companies use puzzles as a screening technique because they are not looking for you. Specifically, they are looking for not you.

Think about it, a big company needs an employee that would join them and work for at least 18 months in order to pay back the costs of hiring, but preferably stay for 3-4-5 years... as many as years as possible, if this is a good hacker we are talking about. Hiring someone who's likely to leave in 6 months is counter productive for a large company, and puzzles is one way to keep you away.

You'd have to ask someone who was at Facebooks and Googles in their early days and see if the hiring was based on puzzles. I suspect in those times a lot of decisions were made in much similar ways to how you'd want to do it now. Puzzles are not the answer, and large companies would probably agree with you too, but it's a tool that seems to work best for them and it's scalable to achieve a consisten outcome over a long term horizon. Precisely what large companies need.

</comment><comment><USER28> Well, the OP statement "write a function which merges two sorted arrays without allocating any additional memory. Aside from having no real-world value, it's not actually possible" seems strange.

Ok, any real-world usage might be applicable only in embedded systems which is a fairly narrow domain.

Still, it is a small (easy to describe) problem that can be used to see how the applicant does problem solving for problems without a widely known best/proper solution - and that skill is probably 90% of any serious programming; the remainder is just typing while following an arbitrary syntax which a trained monkey can do.

And the solution definitely exists - depending on how the interviewer wants output, you can either push the result out with a trivial iteration with a pointer on each array; or if the arrays aren't read only, you can sort them in-place with a slightly modified qsort or even bubblesort - both of these approaches don't need to allocate any memory on the heap, just 2 int counters in processor registers or stack.

<comment><USER29> The issue is merging the arrays, not sorting them. How do you MERGE two arrays without allocating a new one that is big enough to contain them both?

If all you need to do is print what the result of the merge would be then sure, a solution does exist.

<comment><USER30> Here's a solution that merges in place without any sorting: <https://gist.github.com/Mononofu/5029975>

The basic idea is to use the (unused) beginning of array b as swap space for the beginning of array a. This swap space needs to be shifted around, so it's of course O(n^2). Still, it was fun to write.

If you have termcolor installed ('sudo easy_install termcolor' on ubuntu), you'll see the arrays a and b as well as the swap space highlighted in color for each step. Example: <http://dl.dropbox.com/u/2135523/2013022517.png>

<comment><USER29> Yep. I did say that that solution exists ^^. I just said that you couldn't do it without creating something to hold the merged result. Your solution does allocate a buffer to hold the merged result: `self.array = self.a + self.b`

I wasn't saying you can't sort arrays in place (quicksort). I was saying you can't merge them in place. Somebody has to grow.

</comment></comment></comment></comment><comment><USER31> "At my current company, we hire based on provable real-world experience."

That is also a pretty bad hiring schema, you are leaving out a great deal of potential great programmers that are just starting, so, which strategy is better? I guess you always leave people behind, if it works for you, it's the right choice, and it has been working for facebook.

<comment><USER32> Different hiring schemes work for different companies. Hell, even different teams within companies. If this works for FB there's a _reason_ it is working.

Job offers will come and go. Don't burn bridges that you may want to cross later in your career.

</comment></comment><comment><USER33> Criticisms of the hiring process from those who didn't get hired are hard to take seriously--they may or may not be valid, but humans have a way of rationalizing defeat to protect their ego, and this cognitive dissonance tends to dent the defeated's perspective badly.

You see this with any kind of objective test--IQ, SATs, etc. and, of course, subjective tests are subject to even more criticism.

Unfortunately, those who passed their interviews have little reason to criticize the status quo.

The best approach is a data-driven, experimental approach, of the kind likely to be taken by large companies. Small companies could do it too if they pooled their data.

</comment><comment><USER34> I love the smell of hubris in the morning.

</comment><comment><USER29> Part of trying to get a job is learning about the interview practices of the company you are applying to. If they do puzzles then study some dumb puzzles. The puzzles usually aren't that hard and interviewers generally talk these types of problems over with you as you are solving them.

If you really want to work at Facebook, and you are a conscientious developer, then you'll study and be prepared for their kind of interview.

</comment><comment><USER35> Yet another take on puzzles.. I reckon people are asked puzzles because if you can solve them, the probability of you solving real world problems is higher.

Now that your raw intelligence/interest is proved, it's now a question of whether you have the tenacity to maintain huge codebases with your team

</comment><comment><USER36> Good on you. This is a great way to look at it, nothing wrong with being confident of your value

</comment><comment><USER37> Arrows mapped to next/previous article ruined it for me...</comment>