What the Hex? Guess the color. - <AUTHOR> http://yizzle.com/whatthehex/ <comment><USER2> A timer would be interesting on this to make it into a real "game." Almost anyone with knowledge of color and hex color notation can work these out eventually.. the skill, I'm thinking, is in doing it _quickly_ \- a bit like reading sheet music.

That said, the 48 edition is crazy. If you can get a few in a row on that, hats off to you.

<comment><USER3> I hate timed games. Won't buy them. This is a game as it is. Of course it could have modes to please everybody.

<comment><USER2> I don't like timed games much either _but_ in the lower levels and with no time (or time-like) restrictions this seems like a puzzle rather than a "game" to me.

That is, where a puzzle is something that can be "solved" without a time dependency. If I asked you to do 834 + 277 with no time limit, that's a puzzle. If you had to get as close as possible in 5 seconds, that's a game. Thanks for making me think about this though, I could well be wrong, but that's the difference as I see it.

</comment></comment></comment><comment><USER4> I couldn't resist to try but by using Firebug it is easy to solve all of them in one go. Just inspect the <li> items and Firebug will tell the color... Bit lame, but this is hackernews.

<comment><USER5> You're only cheating yourself!

</comment></comment><comment><USER6> With no knowledge of how hex colors work, I'm going to see how long it takes to figure it out by playing this.

<comment><USER7> Here are some tips: the first two numbers/letters stand for red, the second two stand for green, and the last two stand for blue. In hex, A is 10, B is 11, and so on, up to F is 15. One non-intuitive thing to keep in mind is that with light yellow is made by mixing red and green.

Edit: Fixed my mistake, at first I said F was 16.

<comment><USER6> Thanks.

I basically have this figured out, didn't see your comment until after.

The first hint was when Fs popped up in the first digit, which would make the color pretty red, so I thought F might mean "red". Red _is_ the last color on the color spectrum and it was the highest letter that ever appeared.

So my first hypotheses was that every successive digit modified the previous digit, adding an amount of a certain color. But that didn't make sense because I knew FFFFFF was white. If my hypotheses were true, then it would be red.

I realized right there that I'm adding at least three different colors together. How did I realize this? You add colors to make white. From there I was looking at splitting the hex color into different pieces, and if each piece is at its highest intensity then you will have white (FFFFFF). F being the "highest" influencer of a color. I knew the first to be red.

I clicked a bunch, taking note of where the Fs popped up and the color. I was thrown off by second "digit" Fs. After figuring out which digits didn't influence the color much, I basically had it.

It wasn't hard to figure out. I'd like to know how long it takes someone who doesn't know that hex is sixteen.

Note: This really only took me about ten minutes.

<comment><USER8> See, this is exactly the sort of thing kids should be doing in their very first Science class. Not blindly being filled with derived facts with no explanation as to _how_ they were derived, but rather giving them (simple) problems without any sort of solution method, and having them find possible methods on their own. (And the problems don't have to be from the natural world—they can simply be patterns, like this one is.)

After a few hundred, the test would be to look at all the ways they solved all the problems, and come up with a generalized method for problem-solving. Once they derive the scientific method, they pass—and get to learn all the things previous scientists found out using the method. I imagine it would forever change their attitude about those facts—they'd either be eager to build on them with their own experiments, or to know how they were derived and replicate/refute them :)

<comment><USER9> Sounds good, except that relearning everything in Science, from first principles, might take a little while. Some grounding in experimental methods is good, learning how to learn from other people's experiments is much better, and faster.

</comment></comment></comment></comment></comment><comment><USER10> Brilliant game. Just perfect for the iPad, with its touch interface and excellent color accuracy.

</comment><comment><USER11> There's an Android port too.

<http://www.craig-russell.co.uk/android-game-what-the-hex/>

</comment><comment><USER12> I love this thing. I enjoy guessing colors in my CSS anyways, so this is a natural <strike>addition</strike> addiction.

Suggestions:

\- Add a timer

\- Add total scoring

\- Allow "new game" to happen without a new request

\- Make the wrongfully selected color still be there but x-it out or something so you can keep it as reference

\- Hex numbers in uppercase and preferably in a mono spaced font

Please :)

<comment><USER13> Then share with friends and create a multi-player platform. =)

</comment></comment><comment><USER14> Error 500 - Internal server error

An internal server error has occured! Please try again later.

<comment><USER15> I'm only getting that on levels 10 and 48. 9 and below seem to work.

</comment></comment><comment><USER16> Nice! Any plans under all this coolness?

FYI flickr started out like this, except with random untagged images. Catherina is doing it again with Hunch.

I'm curious is this is bait for something bigger :P

<comment><USER17> I thought flickr started with game neverending?

<comment><USER16> Neverending was a competely different thing, which they scrapped to start flickr. Maybe it had some influence?

but as far as I remember, flickr was just a page with a single image loading at a time and users would type in a field to correctly tag it. Like how captcha works today.

Bradley Horowitz explained it well in a conference.

<comment><USER17> I thought it was based on photo sharing within the game itself...

</comment></comment></comment></comment><comment><USER18> Some are easy, just look for the green or red block, but on level 48, this #70eb7e color is hard. Any with simular values for the RGB, it gets much more difficult.

</comment><comment><USER19> It would be nice if it the game also did HSB, which I think is a more natural way to work with color.

<comment><USER10> Really? What's the natural meaning of the hue number?

<comment><USER19> Hue is the angular dimension in the cylindrical color geometry. It starts with the primary color red at 0deg, moving through the primary color green at 120deg, and through the blue primary at 240deg before finally wrapping back to red at 360deg. The cylindrical color geometry is easy to visualize in one's mind. For more see <http://en.wikipedia.org/wiki/HSV_color_space>

<comment><USER20> But surely both the location of the "zero" hue and the directionality of where it goes from there are both arbitrary? I didn't know red was 00 until you mentioned it.

<comment><USER21> It makes sense in terms of physics. Start at 0, red, the beginning of the visible spectrum, and the number increases along with the wavelength, all the way through violet, the other end of the visible spectrum.

<comment><USER22> Sadly, after hue goes through violet, it then disappears into magenta, which isn't in fact a colour on the spectrum at all, before arriving back at red when it reaches 1.

</comment></comment></comment></comment></comment></comment><comment><USER23> I just love it

</comment><comment><USER24> gay

<comment><USER25> I have never known a webpage to have a sexual preference.

<comment><USER24> For the record, I didn't write this. One of my friends must have played a trick on me.

<comment><USER25> Heh, I thought it seemed off. For what it's worth, I didn't downvote you (the comment didn't bother me either way). I just couldn't help being a smartass.</comment></comment></comment></comment>


Here's Why Apple Decided To Overcharge For iPad Mini - <AUTHOR> http://finance.yahoo.com/blogs/daily-ticker/report-why-apple-decided-overcharge-ipad-mini-165230978.html

<comment><USER2> Interesting... they are trying to control demand because their supply is weak. Very plausible. This means the price might drop a few months from now.</comment>


Etsy slashes almost a quarter of its staff - <AUTHOR> https://www.engadget.com/2017/06/21/etsy-layoffs-focus-on-core-marketplace/ <comment><USER2> I tried using Etsy only to have them close my shop due to my products "not being handcrafted" according to them. These were small things that I 3D printed and people were actually buying. They shut me down but allowed similar endless China produced products to stay. They were not too happy when I pointed out those China knockoffs. They also kept my money hostage from the sales I made.

I will never again use or trust Etsy and I discourage every small seller I know that makes custom things to stay away.

<comment><USER3> > They also kept my money hostage from the sales I made.

That seems illegal. Then again, Etsy does its own payment processing now, and Paypal's been using that same tactic for years. I wonder if Etsy could get in trouble for doing both, since they have more info and can generally confirm shipment, given you print labels from them, and the problem is not that your items were misleading or fraud, but that they prefer you not sell those types of items on their platform?

<comment><USER4> Most likely, it was held for the period in which customers could get returns. This is sane.

<comment><USER2> Held for 180-day period. Far longer than needed for customers to get returns and far from sane imo.

<comment><USER5> 180-day holds are generally standard if you're worried about chargebacks.

</comment></comment></comment></comment></comment><comment><USER6> Will echo others regarding China imports, but one last hope to bring me back to their marketplace is a revamp of the review system.

After spending thousands of dollars on furniture, waiting a month for the guy to make it, and another two weeks to ship, I had maybe a few days to leave a review for something I spent a lot of money on. With this policy, reviews are for first impressions only. And I won't be coming back.

Maybe it's in place to prevent review extortion, but a time limit (especially for goods made on demand) isn't the way to do it.

<comment><USER7> They used to email prompt you for reviews, or prompt you for reviews whenever you signed in. Now they don't do either, and even if I manually check the backlog of orders, the review time windows have all expired. So I never review anything anymore.

Seems like a strange decision. I don't understand how that is helping buyers or sellers.

<comment><USER6> Forgot they used to do that. The receipt emails also fail to mention the time limit policy, causing many more people to miss their chance. For one-off handmade products, reviews are more important than most other marketplaces.

The time limit also prevents you from calling out fraudulent import resellers when you later discover the fraud.

<comment> the-dude > The time limit also prevents you from calling out fraudulent import > resellers when you later discover the fraud.

Which may be the actual intended consequence.

</comment></comment></comment></comment><comment><USER8> Etsy should go back at what they did initially and support the craftsmen instead of the china imports, maybe that would help bring them back on track.

<comment><USER9> Here's a contrarian point of view: What if they do embrace China imports, get acquired by Alibaba and become from a front of artistic goods made in China.

<comment><USER10> Doesn't Amazon already have a lock on all that?

<comment><USER11> Amazon's "lock on all of that" has pretty much ruined their brand from a retail seller standpoint. They're catalogue is overrun with garbage and counterfeits. It's quickly becoming eBay. I used to look at stuff in brick and mortar stores and then buy from Amazon. Now I look on Amazon for research and buy from brick and mortar stores so I know I'm not buying Chinese counterfeit garbage.

<comment><USER10> No arguments there, but to be clear I was speaking primarily to the Alibaba -> FBA pipeline.

</comment></comment></comment></comment></comment><comment><USER12> I know this will cost me mucho karma, but

what I hear: self promoting excellent technology, best practice ops blog posts, a/b testing, poster child for product management [1] and then after years of excellence a sudden product failure (reviews, China, ...), CEO kicked out for failing and slashing staff in several rounds.

To me this looks like focusing on the wrong things. I wonder that the CEO discussed with the CTO and VP Product over the years. We'll see if I have to replace Nokia with Etsy in my "Focus" conference talks.

[1] Etsy is a database webfrontend not SpaceX

Edit: John Allspaw, famous for blameless postmortems, Linkedin profile says his CTO gig at Etsy ended May 2017.

<comment><USER13> You think the tech leads that lead their best practice ops & a/b test teams should have been somehow doing something to counter amazon.com/handmade or should have been telling Product not to bother with the non-core products the article mentions?

I don't see how the 2 are related, 'focusing on the wrong things' seems like a huge oversimplification. Your post reads like schadenfreude. 'They thought they were so smart with their best practice ops ...".

<comment><USER12> "You think the tech leads ..."

Yes.

"schadenfreude"

No. It's just a pattern we can see over and over again. I've worked for some companies that showed that pattern and consulted some which sat in that trap. And it looks like focusing on tech excellence - and I assume they are excellent - didn't help Etsy with growing their revenue.

Is Etsy a tech company? Or are they a retail-oriented market place? Did they focus too much on technical/product excellence? Many companies I have seen have a wrong selfimage. Did they solve the wrong problems? These are the questions I'm interested in.

<comment><USER13> Who are 'they'? What member of the company do you imagine is deciding to do 'good ops' over 'revenue'?

You are acting like the whole company is just an amorphous blob that chooses to siphon 'focus' into buckets. That is just not how companies work.

It simply makes no sense to infer anything negative about the company due to them having a good ops image.

</comment></comment></comment></comment><comment><USER14> I have just heard a gradual declining of Etsy's quality and creator service of the last year or two.

Their reluctance to crack down on Chinese crap along with being very unhelpful to it's creators are the two biggest issues.

I mean, I get that a tech company would struggle with service to it's sellors, that's pretty normal, but if your brand is "handmade quality", then why the hell would you allow Chinese trash?

<comment><USER15> Chinese trash is $$$$$.

It's hard to resist a stream of very easy money (in the short term at least).

</comment></comment><comment><USER16> I remember when this article about the Etsy engineering department came out on Techcrunch 3 years ago.

[https://news.ycombinator.com/item?id=9481377](https://news.ycombinator.com/item?id=9481377)

The items that jumped out at me:

> The company owns and operates its hardware and networks in its own > datacenter.

> The company has 685 employees of which approximately a third are engineers.

> It wanted to know how Hadoop worked, and the only way to do that was to > bring it in-house and figure it out.

As a means to an end, this is a _really_ expensive way of operating nowadays. And when the business isn't rolling, these costs become magnified (and the associated operation vulnerable.)

<comment><USER17> I wouldn't necessarily agree with that. It depends on scale and the skills available to you. Yes, amazon and co do a good job of pushing down cloud costs, but you still need people to manage these services.

Also it depends WHEN you build things. Redshift for example is now pretty viable and potentially more cost effective than what Etsy does. 2-3 years ago that very likely wasn't the case.

I'm not saying Etsy doesn't have somewhat higher system costs than others but I doubt it's the cause of their issues.

<comment><USER16> > It depends on scale and the skills available to you.

Skills -- yes. Scale? That's kind of the point, nowadays. You don't need a large staff to accomplish scale.

> I doubt it's the cause of their issues.

Their eng/ops approach wasn't the cause of any business issues, AFAIK. That's why my comment is directed around what happens when business performance suffers -- you start looking for cost reductions.

</comment></comment></comment><comment><USER18> I lost interest in Etsy when I saw a bunch of manufactured crap I could by anywhere else. There was a turning point where Etsy became more of this than original, personally crafted items.

</comment><comment><USER19> Etsy is a company that needed to stay private

<comment><USER20> We have a winner!

</comment></comment><comment><USER21> There was a stretch, I think 3 to 5 years ago, when it seemed that Etsy was on a hiring spree -- lots and lots of recruiters were reaching out to me and asking "Would you like to work for Etsy?" I was intrigued because I used to live in Brooklyn, just a few blocks from Etsy is. So if I worked there, I could have biked to work in about 10 minutes. That would have been cool.

But every time I asked about the tech, I was disappointed. They wanted me to come in and work on a bunch of PHP code. When I asked about the details, from the hiring manager, I was told that it was, basically, a big monolithic PHP thing. I've no idea if they later moved to microservices, but I have been traumatized by a few too many encounters with horrendous blobs of PHP. For me, its become a bit of a heuristic. If a company is apparently working with a big blob of PHP, I am wary. I need to hear very good things about that company, to offset that wariness.

More recently I've read criticisms of their search system. At the risk of indulging in "confirmation bias", I'll say this (bad search) is exactly what I would have predicted, based on what I'd heard 3 to 5 years ago.

<comment><USER22> For me, it's the opposite actually. "We have a monolithic php thing" seems to signal "We made an MVP, found traction, and have been too busy to start from scratch". In contrast, "We have ultramodern microservices" is depressingly often code for "there's no real business here, so we have all the time in the world to polish the tech".

With the former using "old, boring" tools, as they have been battle-proven time and again, and the latter using $dailyhype, as that's the thing that looks best on your CV right now.

I guess this comes down to personal preferences, and whether you value the tech environment, or the business environment. I'd rather do unexciting work in a profitable company, than exciting work in a company with a writing on the wall.

<comment><USER23> > I'd rather do unexciting work in a profitable company, than exciting work in > a company with a writing on the wall.

this is a very good point

<comment><USER24> LOL, some of us like the thrill of a plane with one engine on fire, it appears some of us are happy safe on the ground.

<comment><USER25> I'll take the plane on fire but only if the airline is profitable. A plane on fire where the airline is bankrupt sucks. That was the second part of his comment. Working for a company that's growing with revenue is always better.

</comment></comment></comment></comment></comment><comment><USER26> Seems like a sinking ship for anyone there involved in software especially since they like to blame their tech and poor search for a lot of their problems.

<comment><USER9> Morale is very low currently. Not much confidence in the business.

</comment></comment><comment><USER27> I have only had positive experiences working with Etsy but a lot of other people I've met have had their businesses shut down and their funds locked on the site. Incredibly shady especially since most of their products were legitimate crafts they made. Hopefully they get their act together because there really is no replacement.

</comment><comment><USER28> Why not initiate a share buy back, continue to trim the fat and go private? A return to their roots is necessary rather than trying to balance the share holder value of their B Corp status.

</comment><comment><USER29> I wonder if that includes the bike-pedaling office composter.

<comment><USER30> In case anyone is wondering:

[https://blog.etsy.com/news/2012/office-ecology-composting- at...](https://blog.etsy.com/news/2012/office-ecology-composting-at-etsy/)

</comment></comment><comment><USER31> A lot of negative nancies in this thread. I'm not here for kicking people while they're down.

But didn't they have a layoff a month ago? Isn't there a management saying that goes something like "If you're going to eat shit, eat enough so you only have to do it once", specifically about layoffs?

Etsy engineers (and other workers) reading this, I wish you good luck! May you survive and thrive through tough times.

</comment><comment><USER32> Etsy is looking for a buyer.

<comment><USER20> As they do all day every day [http://m.nasdaq.com/symbol/etsy](http://m.nasdaq.com/symbol/etsy)

</comment></comment><comment><USER33> I remember hearing that Etsy had an unusually large number of women working on the development team. I wonder how this layoff is going to affect that? Will they keep up their diversity initiatives, or do they consider that more of a luxury?

I also read that they were also hiring a lot of bootcamp grads. It would be interesting to see the percentage of layoffs coming from bootcamps.

<comment><USER34> > Will they keep up their diversity initiatives, or do they consider that more > of a luxury?

if they need to cut cost, they should start firing males, if anything, right?

<comment><USER35> Yes. This is economically rational, as Alan Greenspan pointed out in 1983:

> ... _the senior staff, including Miss Eickhoff, Judith Mackey and Lucille > Wu, is mostly female. Mr. Greenspan explains the gender bias with the free- > market pragmatism that has become his hallmark: "I always valued men and > women equally, and I found that because others did not, good women > economists were cheaper than men. Hiring women does two things: It gives us > better quality work for less money, and it raises the market value of > women."_

<comment><USER36> By that statement though, you're implying that men and women aren't paid equally within Etsy. Which is against the whole of diversity and equal pay for equal work campaign isn't it?

<comment><USER35> Yes, in the absence of strong evidence I would assume both Etsy and every other salaried company that permits offers to be negotiated is paying men and women non-equally for equal work, primarily because (as Greenspan points out) the _market value_ of men is higher: they are receiving competing offers from places that are more blatant about paying men more (or extending fewer offers to women, or whatever). Hopefully this difference is pretty small at Etsy, but it almost certainly exists, and even a small arbitrage opportunity is economically rational to capitalize on.

I'm using "equal work" in an informal sense. (In the legal sense, yes, equal pay for equal work is the law, but also in the legal sense, you can't give an immigrant worker a green-card-path visa unless you can't find _anyone_ in the States to do the same job, and we all know how creatively "the same job" gets defined.)

<comment><USER37> In the absence of strong evidence, you're making a bunch of assumptions you mean?

In the absence of strong evidence, I personally err on the side of caution.

I don't know what these mythical places are that vastly prefer men over women - every place I've ever worked at, everyone preferred people who are good at their job and are easy to get along with - mostly the easy to get along with part by the way.

<comment><USER38> Yes, culture fit, or 'getting along with each other' is important. When looking for people they will get along with, most people tend to prefer to be around others who seem like themselves. Given a team of all male engineers and two candidates of equal ability and with similar personalities, one male and one female, the male candidate is more 'like' the hiring engineers which makes him seem easier to get along with. And so a company which is just hiring people who 'are good at their job and are easy to get along with' can end up with a team of men.

</comment></comment></comment></comment></comment></comment></comment><comment><USER39> I didn't see any numbers on what departments were the most affected, but to my friends at Etsy looking for roles in automation/infrastructure engineering please reach out!

</comment><comment><USER40> Maybe twitter will watch and learn. They have some similar problems.

<comment><USER41> Yes, but their crap products overwhelming their ecosystem tend to be Russian, not Chinese.

</comment></comment><comment><USER42> This seems like the 'bubble' deflating.

Not so much a _bang_ , more of a fizzle as "the big kids" come in and cut deeply.

That and investors keeping out of seed-stage funding because it has gotten so bloated by everyone wanting their own startup.

I've seen Genius, Etsy, Uber... etc. It seems like a lot more startups are getting shook up and cut down.

<comment><USER43> Etsy looks to be just fine. Sales grew 33% for 2016 vs 2015. Their operating loss is down to a very small trickle at $2m for the latest quarter. To go with $275m in cash.

They appear to have a very nice business that's trading for a reasonable four times sales and likely heading toward profitability. What's the problem? Cutting bloat is exactly what they should be doing, it'll drive them to profitability faster.

<comment><USER34> it's still in a very precarious position - if they open too much to resellers and large manufacturers people will go back to the more convenient alternative - amazon.

<comment><USER44> More convenient, better experience, better search, better customer support, better shipping, more reviews, etc. etc.

I know this is a dead horse here but Etsy needs to go back to it's roots or die. I would use eBay or alibaba before Etsy if they want to sell cheaply manufactured goods.

<comment><USER45> There's no reason why the cheaply made goods couldn't be their "day job", funding the true passion of supporting the creative entrepreneur.

What would be concerning is if they see it as anything more than a way to pay the bills.</comment></comment></comment></comment></comment>


Start-up R&D Tax Credit Question - <AUTHOR> An outside accounting firm has informed us we can count a percentage of engineering salaries in 2016 toward a payroll tax credit that can be used in 2017.
I'm concerned their fee is too high for the work. The cost is <50% but >30% of the credit so it's in the end the engagement is worth it.
Does anyone know what this type of advice typically costs on an average hourly rate? <comment><USER2> I'm a CPA. We love to engage on a contingent fee basis where we collect a percentage of credits approved. I once had a client that agreed to it, and we ended up collecting hundreds of thousands in fees for a few hours of work. They did not sign the same engagement the subsequent year, but insisted on time incurred.

If I was you, I would insist on time-incurred and refuse contingent fee. Ask them for their standard charge-out rates, insist on a minimum 20% discount on those rates, and ask them to provide you with a estimated time budget. They won't like it, but they'll accept the engagement because they will still make money. If they don't accept, then choose a different service provider.

<comment><AUTHOR> Thanks for the advice it gives me confidence in negotiating a bit. Any idea what a partner would bill versus an associate in Chicago?</comment></comment>


Joomla SQL Injection Attacks in the Wild - <AUTHOR> https://blog.sucuri.net/2015/10/joomla-sql-injection-attacks-in-the-wild.html <comment><USER2> I'm literally not surprised by anything in this article. Joomla is a mess (my opinion, doesn't actually matter to my point), written in PHP so whenever a patch is released, you can see exactly what the exploit was. In fact, I'm surprised it's not less than 2 hours.

So obviously, "Patch now!" \- although, that's not the prerogative of this site, it's to convince you to purchase their "website antivirus" \-- which I still can't work out what it actually does, or where it sits.

<comment><USER3> I can't tell for sure either. Their pages about it, as usual, are heavy on marketing and light on technical details. In one case it looks like they offer a CloudFlare-like service ([http://cloudproxy.sucuri.net/features](http://cloudproxy.sucuri.net/features)), and then in another case, they offer it as a Wordpress plugin ([https://wordpress.org/plugins/sucuri-cloudproxy- waf/faq/](https://wordpress.org/plugins/sucuri-cloudproxy-waf/faq/)) (and presumably for other platforms too).

Given modern web development trends though, I'm sure they'll be very successful at selling their product without bothering with things like technical details.

</comment></comment><comment><USER4> apparently this impacts versions 3.2.0 through 3.4.4 [https://developer.joomla.org/security- centre/628-20151001-co...](https://developer.joomla.org/security- centre/628-20151001-core-sql-injection.html) but has been fixed in release 3.4.5

</comment><comment><USER5> Joomla, from the age of the monolithic frameworks, easy to take down and infiltrate because it is monolithic molasses. I feel for the souls trapped in the joomla monolith sludge.

</comment><comment><USER6> Joomla looks like a project frozen in time. The code and template engine reek of old php.

I'm glad I don't have to maintain anything in it again.

<comment><USER7> But it is such a simple CMS. I can make user groups and assign each group to a section or download section using DocMan. I can revoke rights to one use or the whole group. I cannot do this in Wordpress.

<comment><USER8> That kind of authentication and authorization can be found in any respectable CMS. Choosing Joomla because Wordpress isn't any better is like choosing to drink your own urine for breakfast because stools taste worse.

<comment><USER8> delete akwlcy4

</comment></comment></comment></comment><comment><USER9> Good (related) read about this vulnerability by the Trustwave team:

[https://www.trustwave.com/Resources/SpiderLabs- Blog/Joomla-S...](https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla- SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/)

</comment><comment><USER10> Apparently, the fabled "Joomla Jackal" is alive and well.

I wouldn't touch that software with a 10-foot pole.

</comment><comment><USER11> Ah, the tainted legacy of PHP applications originally built in the early 2000's. I doubt anything has been responsible for more exploits than the lack of the ability to do parameter binding in PHP's original MySQL driver.

<comment><USER12> The driver isn't totally to blame, too many developers weren't and still aren't trained properly.

The problem is actually that users would probably never have used parameter binding even if it was available. Despite the original mysql driver not supporting parameter binding you could still mitigate against SQL injection attacks even back then. The mysql_real_escape_string() function is available to help prevent SQL injection attacks, it's been around since the dawn of PHP4 (yes I know it's not totally secure if you're not aware of your character encoding [0]) . But barely anyone used it, or even understood the purpose of mysql_real_escape_string().

I've had to trawl through ancient customer code which uses the old mysql driver on our hosting platform to explain why their site got hijacked. There's more often that not even a single use of mysql_real_escape_string(). This is code written by pro-developers I'm often told. There's not even attempts to perform naive quote escaping.

The real issue is education. There are still hoards of developers who have never heard of SQL injection. Part of the problem was that the PHP documentation from back in the day provided poor examples, the other part sites like W3S omitting any mention of mitigating against SQL injection attacks. So folks merrily copy/paste never even having heard of the concept of SQL injection.

I still have to educate customers about SQL injection attacks and many still stick their heads in the sand and don't want to believe this could possibly happen, or blame us.

And for all of the PHP team's prognostications about binning the mysql driver, folks will just move on to mysqli or PDO and still carry on doing stuff like:

      $sql = "SELECT name FROM people WHERE name='$name'";

This isn't a problem specific to PHP, it's still endemic in codebases written in Classic ASP, ASP.NET, Java, python all churned out by herds of badly trained developers blissfully ignorant of the mess they're creating for their clients.

[0]: [http://stackoverflow.com/a/12118602/419](http://stackoverflow.com/a/12118602/419)

<comment><USER11> Yes, but mysql_real_escape_string is a horrible, inefficient solution to a well understood problem with well understood industry standard solutions. Bound parameters were introduced into Perl's DBI module in August of _1995_ [1] and in the DBD::mysql module in 1997, and those reference DBD::Oracle when noting where you can get more info, so they weren't the first.

My main problem with PHP on this subject is that their response to this problem for _years_ was so lackluster, when it wasn't non-existent, that I can't give tutorials all the blame. The entire ecosystem was initially built on terrible, insecure practices for negligible benefit (I'm looking at you, register_globals), and it cost everyone on the web, not just PHP developers, for many years. And it's not like they didn't have multiple chances to fix major problems. Conversions from PHP 3 to PHP 4 were happening back in 2001. The mysql extension survived that. It also survived the migration from PHP 4 to PHP 5 in 2004. They fixed register_globals back in the PHP 4 release in 2001, but it took until 5.5, released in June of 2013 to deprecate the mysql driver.

1: [http://search.cpan.org/~timb/DBI-1.634/Changes#Changes_in_DB...](http://search.cpan.org/~timb/DBI-1.634/Changes#Changes_in_DBI_0.61,_22_Aug_1995)

</comment></comment></comment><comment><USER13> RIP Joomla! Didn't even know people still use it ...

</comment><comment><USER7> Is Wordpress any better?

<comment><USER14> Different... But WordPress core seems to have a better security track record as of lately.

<comment><USER12> As a hoster I can say that WordPress is pretty good provided you keep up to date. Security problems such as SQL injection attacks usually arise from badly written third party plugins that don't and won't take advantage of core data access API's, and instead write their own crap.

<comment><USER7> I really enjoy Joomla because of the 3RD party module, such as Docman, for my clients. My sites run just so users can login, go to the download section which is running Docman. I can assign users in groups to certain downloads.

When I work on a Joomla site I disable the Administrator.php page and make a .htaccess line that will redirect anyone attempting to access that page. So far I've never had one SQL injection/base64 exploits (I think thats what it is called). As long as I keep it updated I should be fine.</comment></comment></comment></comment>


Have you ever printed a boarding pass? - <AUTHOR> http://bbryson.com/bill/2007/10/12/have-you-ever-printed-a-boarding-pass/ <comment><AUTHOR> Not a single person making a fuss about a "non-standard" boarding pass is something I wouldn't have guessed at all. Happiness all around :)

<comment><USER2> Oh, for sure. I started reading this and kept waiting for the part where he gets tackled by TSA or something. Terr'ist boarding pass, can be used as a weapon, or something.

Faith in US travel restored by 1%.

<comment><USER3> This happened almost 4 years ago though. The TSA has gotten a lot more jaded and hated since then. I'd be curious how something like this would go down today.

<comment><USER4> Wow, did not realize this was from 2007.

<comment><USER5> My first clue was "logged into nwa.com"

</comment></comment></comment></comment></comment><comment><USER6> It looks like we've broken his web server. Here's a cached version: [https://webcache.googleusercontent.com/search?q=cache:a4-v04...](https://webcache.googleusercontent.com/search?q=cache:a4-v04rpBwcJ:bbryson.com/bill/2007/10/12/have- you-ever-printed-a-boarding- pass/+&cd=1&hl=en&ct=clnk&gl=us&source=encrypted.google.com)

<comment><USER7> And here's a working link to another site's reprint of the original:

[http://www.sott.net/articles/show/227456-Have-you-ever- print...](http://www.sott.net/articles/show/227456-Have-you-ever-printed-a- boarding-pass-)

</comment></comment><comment><USER8> tldr: Man prints out his boarding pass in large format. Delight ensues.

</comment><comment><USER9> It would also be cool if you printed your boarding pass to PDF, but instead of printing a giant-sized version, loading it onto an Amazon Kindle and presenting that at the gate. Test Amazon's claim of being just like paper to the limit. Can't see why it wouldn't work.

<comment><USER10> I don't think it'd work since every time I fly, TSA uses a marker to write on my boarding pass...

<comment><USER11> It would work for TSA, might not work well for your kindle ;-)

I can see a smart-ass TSA agent seeing your kindle and nonchalantly mark it with his permanent red marker, then in one fluid "kthxbye" motion give it back to you and move on to the next person in line.

You'll complain but they'll just reply back with Amazon's marketing line "It's just like paper!"

<comment><USER12> Pro tip: the solvent in whiteboard markers will dissolve most permanent marker marks; likewise whiteboard cleaner spray (though spray on a cloth rather than on the Kindle).

<comment><USER13> This is very true, I learned this yesterday when I accidentally picked up a Sharpie instead of a whiteboard marker. Colouring over the mistake with a whiteboard marker worked like a charm!

</comment></comment></comment></comment></comment><comment><USER14> the sad thing is that my first thought was "as a brown guy, there's no way i'd ever dare to do that".

</comment><comment><USER15> The article is down, but on-topic, I know bunch of large airlines(EasyJet for example) that let you present boarding pass on your smartphone so you do not have to print it.

</comment><comment><USER16> Glad he had fun because that's kind of an expensive boarding pass. When I've printed posters at Kinko's before, it usually comes out to about $40 for a 1 meter^2 poster.

</comment><comment><USER17> Reminds me when I printed a boarding pass in "2-up" mode. Of course the 2D barcode on the pass was half-sized and none of their machines could read it.

</comment><comment><USER18> This makes me happy. =)

</comment><comment><USER19> good one. I love it when take something and muck around with our expectations of it. Isn't that one thing art is supposed to do?</comment>


Show HN: Top Facebook Friends Graph - <AUTHOR> https://jacobwg.com/facebook-friends/

<comment><AUTHOR> This is a fairly fun tool I wrote to visualize the "friend score" that Facebook computes (to build search autocomplete). It works best in any modern browser except for Internet Explorer.</comment>


Ask HN: Could AI make a comic book if it scanned enough comic books? - <AUTHOR> <comment><USER2> Why not? They have done it for movie scripts - [https://en.wikipedia.org/wiki/Sunspring](https://en.wikipedia.org/wiki/Sunspring)

It would be interesting to see what it generates from a Moebius or Miyazaki Corpus

</comment><comment><USER3> I have wondered for a while now if an AI could write something like a Barbara Cartland novel.</comment>


How I created a $980-per-post social network in just 2 days for $10 - <AUTHOR> https://medium.com/@affluentconfidante/how-i-created-a-980-per-post-social-network-in-just-2-days-for-10-17c8e84f4601 <comment><USER2> Let's wait:

[https://affluentconfidante.com/posts](https://affluentconfidante.com/posts)

>Public access is scheduled for Monday, July 17th at 10am EST.

>Until then, access to all anonymous statements is restricted to members only.

Surely there will be by then hundreds or thousands of interesting/ispirational posts to read.

<comment><AUTHOR> Very good point.

</comment></comment><comment><USER3> I can understand why someone would pay to use this service. Not clear on why anyone would read it. Vanity twitter?

<comment><USER2> Usually vanity does not go hand in hand with anonimity, and - casually - anonimity rarely goes hand in hand with authoritativeness when we are talking of posting on the internet.

The assurance (given by the rather high entry ticket) is only that the Author of each post is so rich that it can afford to pay a pretty hefty sum (and is willing to do that).

From the little experience I have with the ones belonging to the 1% I would say that most of them are in the 1% (and remain there) _exactly because_ they are very attentive to where and how they spend their money, but of course I may well be proved wrong.

But if all goes well, a lot of people may be interested about what the people with the big money think and write, hoping to catch something of use to become as rich as the poster.

On the other hand, with anonimity and without access to the bank account of the site (or other proof that actually the US$ 980/post were actually paid) the owner of the site could well post any kind of anonymous crap pretending that it came from high paying customers....

<comment><USER3> Perhaps 'vanity' is not quite the right word (except in the meaning of 'vanity publishing'\--paying a publisher to publish your crap that no one else wants). But certainly the wealthy like the exclusivity--only someone who can throw away a buck a character can use the service. But that doesn't really explain why anyone would go out of their way to read the product.

<comment><USER2> Yep, but essentially "vanity publishing" is about managing - through money - to have something published that you weren't able to be paid for AND that you weren't able to publish even for free.

Essentially, crap.

BUT since you are spending money, you want your name in BIG BOLD letters on the cover, because you believe it isn't crap and you are only misunderstood by editors and publishers.

</comment></comment></comment></comment><comment><USER4> Does the author say anywhere whether anyone has actually given him $980 yet?

</comment><comment><USER5> Lmao, if you paid $10 you got ripped off.</comment>


How to make a movement. Lessons learned from dancing guy. - <AUTHOR> http://sivers.org/dance-lessons

<comment><USER2> This video is great.

So my startup is a social news site for Chicago over at WindyCitizen.com

I worked on this thing for 8 months with interns, recruited writers with fancy titles etc. And traffic went nowhere.

Around the New Year, I decided to "fire" most of my volunteer "editors" and resolved to just start posting tons of links myself every morning from 8-noon and adding context to them in the comments. When I had something that was interesting, I'd e-mail it to local bloggers and invite them to add their thoughts.

Five months later we're picking up about 20 new members a day and every blogger and professional web editor in Chicago is posting stories and commenting on them. I don't know that we've hit critical mass just yet, but we're getting awfully close.

The key was for me to just give up trying to be cool and to start doing something simple and easy to join in on. People saw that I was posting up links every morning and they started joining in.

Good submit!

<comment><USER3> speaking of which, the WindyCitizen.com front page is giving me a binary dump right now, starting with the message, "Notice: Undefined index: q"

<comment><USER2> ha. That'll teach me to turn on error reporting at 3am...

</comment></comment></comment><comment><USER4> Of course, that same dude probably did that a dozen times and got less positive reactions. Being a leader means having the guts to get rejected. If you carry on after rejection because you are driven by your own joy and not social feedback, you may start a movement. Don't expect this to happen on your first try.

<comment><USER5> If you search YouTube for 'Sasquatch Dancing Guy', you'll see that the same guy in black shorts in several different instances of dancing (other times/songs) like he is the lord of the dance. Other video segments of the same Santogold song show he was dancing all the time.

But does that invalidate the mob/snowball/inspiration-to-act effect captured so well here?

<comment><USER4> To answer your question, no, that doesn't invalidate the effect captured here. However, if you are trying to duplicate this effect, you should realize that these things are probabilistic, and not deterministic, like so many phenomena in human society.

<comment><USER5> I didn't think it invalidated the effect. I guess I wasn't clear.

Contrast with this staged dance at the Antwerp Train terminal:

<http://www.youtube.com/watch?v=7EYAUazLI9k>

</comment></comment></comment></comment><comment><USER6> A pastor friend of mine twittered a similar link a few days ago. I didn't post it b/c I thought the source might overshadow the content, but I quite like the "Seven Keys to Starting a Movement". All relevant to the startup world with the possible exception of #6.

> 1\. One man can start a movement.

> 2\. A movement need not be started by the most skilled member of the > movement.

> 3\. When beginning your movement and you look around and no one else is > joining the dance, just keep dancing.

> 4\. When the one guy who joins your movement slowly fades away, keep going.

> 5\. Before you know it, the people joining your movement won't even know you > started it.

> 6\. When your movement takes a life of it's own, just let go. There will be > no stopping it.

> 7\. The very people who are staring at you like your nuts as you movement > alone, will be the very same people dancing the hardest in the end.

Edit: Here is the link [http://www.ragamuffinsoul.com/2009/06/youre-bad-idea- may-sta...](http://www.ragamuffinsoul.com/2009/06/youre-bad-idea-may-start-a- movement/)

<comment><USER7> Reminds me of Arlo Guthrie's tale of woe at an induction center: "And friends, somewhere in Washington enshrined in some little folder, is a study in black and white of my fingerprints. And the only reason I'm singing you this song now is cause you may know somebody in a similar situation, or you may be in a similar situation, and if your in a situation like that there's only one thing you can do and that's walk into the shrink wherever you are ,just walk in say "Shrink, You can get anything you want, at Alice's restaurant.". And walk out. You know, if one person, just one person does it they may think he's really sick and they won't take him. And if two people, two people do it, in harmony, they may think they're both faggots and they won't take either of them. And three people do it, three, can you imagine, three people walking in singin a bar of Alice's Restaurant and walking out. They may think it's an organization. And can you, can you imagine fifty people a day,I said fifty people a day walking in singin a bar of Alice's Restaurant and walking out. And friends they may thinks it's a movement."

</comment></comment><comment><USER8> This is a great metaphor for the infamous chicken/egg problem. To have a dance party, you obviously need a lot of dancers. Typically, however, nobody wants to join a dance party unless its already packed full of people. Just like this party snowballed from one extremely devoted dancer(user), a site relying on UGC can do the same.

With that being said--hundreds of onlookers and the presence of mind-altering substances surely didn't hurt the situation.

</comment><comment><USER9> Amazing video. Some guy just became a prophet while tripping balls.

</comment><comment><USER10> Some comments ::

.

I'm glad no-one had a camera on me when I was at Glastonbury or Gatecrasher. It may have been called "How to make an Exodus"

.

This "lone-dancer-inspires-group-love" is the wet dream of mobile phone advertising companies and will quickly be perverted to their promotional ends.

</comment><comment><USER11> I hesitate to generalize from this, but it seemed to reach critical mass (and hockey stick like growth) when the first girl arrived.

<comment><USER12> In other words:

 _Your "use case" should be, there's a 22 year old college student living in the dorms. How will this software get him laid?_ \- <http://www.jwz.org/doc/groupware.html>

</comment></comment><comment><USER13> I'd never heard this song. I can't help but wonder if the lyrics were part of the motivation behind the followers. The guy himself was "unstoppable" and he had to be unstoppable!

Full song, better quality: <http://www.youtube.com/watch?v=8SIRpKa5ZMA>

</comment><comment><USER14> The critical mass was three people.

Inspirational.

</comment><comment><USER15> Most important thing to me is that you better start dancing in the right environment. If you start doing that in the middle of the street, rather than in a music festival, people will call the cops.

</comment><comment><USER16> I want to do a table of time between joins.

<comment><USER16>
        0:00 first dude is already dancing
        0:19 green shirt
        0:53 black shirt
        1:13 2 more
        1:17 6 more
        1:26 1 more
        1:30 4 more
        1:40 dozens</comment></comment>


Client Side Cryptography - Should You Hash Passwords on the Client - <AUTHOR> http://checkthelog.com/2013/05/client-side-cryptography-should-you-hash-passwords-on-the-client/

<comment><USER2> Errr... you missed the main point!

If you hash passwords on the client, you aren't doing hashing right! If you hash passwords on the client, all an attacker needs is a user's hash, and then he can send it to you and get logged in _without ever knowing the user's password_.

The point of doing hashing is that a compromised database doesn't allow the attacker to login as arbitrary users. If you do the hashing on the client side you completely obliterate that as there is no way for the server to know if the hashing was _really_ done on the client side, or if a hash was blindly replayed.

EDIT: Fortunately, you got the right answer (which is "no, you shouldn't hash passwords on the client"), even if you're reasoning is... a little off :)

EDIT2: See <http://en.wikipedia.org/wiki/Digest_access_authentication> for a way to do client-side hashing securely.

<comment><USER3> > If you hash passwords on the client, you aren't doing hashing right! If you > hash passwords on the client, all an attacker needs is a user's hash, and > then he can send it to you and get logged in without ever knowing the user's > password.

It doesn't matter if the server gets a password or a digest, as long as it can verify it. Hashing on the client side is obviously superior to hashing on the server side, since the original password is never transmitted over the wire. It is for the same reason protocols like SRP exist. (If you're worried about somebody compromising your digest database and logging in with those digests, you can just hash them with a cheap function like SHA-256 on the server side. There is no reason for the server to use an expensive function since the client has already stretched the input.)

Unfortunately, SRP doesn't do key stretching, so it is trivial to brute-force the original input if you get a hold of the verifiers. But there'd be nothing wrong with e.g. a client-side scrypt mechanism that uses TLS for the transport, or even SRP/TLS-SRP (although you would need your server to manage/sync the salt.) It just hasn't been feasible so far since no efficient implementations have been available to web applications.

What you should take away from password hashing is that it exists primarily to protect users from themselves. If everyone used unique passwords with 256 bits of entropy for everything, we wouldn't need it. We need it because they use weak passwords, and they use the same ones in many different places. If your server gets owned, it likely doesn't matter whether they can log in with contents of the database or not--they're already inside, and can probably easily find another way. What matters is that by making it expensive to brute- force the original input of possibly thousands of your users' passwords, you make it very hard/cost-ineffective (if you do it properly) for an attacker to compromise many/all of their other online accounts.

PS: Digest auth as it exists today is a joke. It uses no stretching whatsoever, and is thus trivial to brute-force, whether by a MITM or an attacker who has gained access to the server's digest database.

<comment><USER2> > Hashing on the client side is obviously superior to hashing on the server > side, since the original password is never transmitted over the wire.

Can you elaborate on this? All client-side hashing does is replace the user's password with some hash, which now effectively becomes their password.

I don't see how this buys you any security. The user's password is irrelevant if all the server ever sees is a hash of that password.

<comment><USER3> You're thinking about this the wrong way. It's not supposed to buy _you_ security. It's supposed to protect the user. (Yes, in the narrow case where an attacker has access only to your accounts table, and you want to prevent them from being able to log in as a user, hashing helps, but that can be separate from the stretching--a normal hash function will do just fine to prevent someone from simply presenting a digest to your login mechanism.)

As you just said, there is no difference between using a password or a hash digest, since the server just needs to verify either of them. So, using a hash digest from the client (generated by a strong password hash function) is superior since an attacker, whether a MITM or somebody who has compromised your servers, will have to spend a lot of time and money extracting the original password if they get a hold of the digest. The reason we currently generate these on the server side is not that it is more secure--in fact it is terribly insecure if somebody compromises the communications channel or the server itself, since they will be able to read the original, plain-text password--but rather that it is cumbersome, for now, to do it on the client side.</comment></comment></comment></comment>


BootyLog: The Overshare App - <AUTHOR> http://bedsider.org/bootylog

<comment><AUTHOR> An anonymous microblogging app of sexual activities, developed by a non-profit advocating safe sex. Just downloaded and took a look, and it seems like a really interesting and progressive way to educate people about sex. Thoughts?

<comment><USER2> Shame on you for not disclosing your association with the BootyLog, keywonc! BAD!

<comment><AUTHOR> Not associated with BootyLog or Bedsider.org, I've downloaded and tried the app.

</comment></comment></comment><comment><USER3> Your site automatically played audio that was sexual in nature without any warning or indication.

Why do you think this is a good idea?

<comment><AUTHOR> It links to a landing page with a video that requires you press a play button. No automatic playback.

<comment><USER3> The video started playing automatically for me, no interaction required.

 _shrug_

<comment><AUTHOR> yikes, perhaps the besider folks should know about this.

</comment></comment></comment></comment><comment><USER4> Beautiful visual execution. Looking forward to seeing how people may re- purpose its intended use.</comment>


Signs You're a Crappy Programmer (and don't know it) - <AUTHOR> http://damienkatz.net/2006/05/signs_youre_a_c.html <comment><USER2> I think it should have been "Signs you are a day coder (and don't know it)"

I am amazed how many programmers I have worked with who are not up to date and just do their job and are not interested in it.

</comment><comment><USER3> "You are adamantly opposed to function/methods over 20 lines of code."

There are (at least) 2 problems with long funtions/methods: 1) They typically lead to more duplicated (and less reusable) code, e.g. repeated blocks of code between functions that could have been replaced with to-the-point short functions. A typical sign of where to extract a function is when you see a long block with a comment above it inside an even longer function, then replace the block with a function with a name inspired by the comment.

2) The methods becomes harder to test, and possibly even more important, the test code becomes harder to maintain (and untested code of some complexity usually doesn't work), e.g. what happens to your existing tests if you add some new conditions at the top of a long method?

<comment><USER4> A good argument might be chunking: the (average) human brain can keep only about six or seven chunks of information in short term memory.

A method with 20 lines of codes is roughly 20 chunks. Move some parts of those 20 lines into other functions, and you have created more effective chunks. Presumably, the brain has a much easier time understanding things it can actually keep in memory.

One idea is to create functions instead of comments, that is instead of writing "compute the rank" followed by some code, create and call a method computeRank().

</comment></comment><comment><USER5> 10 Real Signs You're a Crappy Programmer:

10\. The exact same code is in multiple places because you didn't bother to put in into a common function.

9\. You have error codes in functions, but never bother to look at them (a sure sign that testing was never finished).

8\. You have early exits from loops because you don't know how to properly code a recursion.

7\. You execute too much code because you don't know the difference between "if" and "case".

6\. You use 10 lines of code when 1 line would do because you don't know any better.

5\. You need to run batch jobs from time to time to clean up your data base because you don't know how to debug well enough to find what's messing it up.

4\. A third grader doesn't know what your variable names mean.

3\. You think "Third Normal Form" is paperwork you need to fill out for one of your 8 bosses.

2\. No programmer who has to maintain your code would ever want to work with you.

1\. Any programmer that has to maintain your code would be more than happy to accept the consequences of first degree murder.

<comment><USER6> (6) Happens even when you know better.

(10) Good programmers don't repeat themselves, true, and to continually improve as a programmer it is important to patiently do everything correctly the first time. However, obsessing over a few bits of code duplication is often a complete waste of time.

<comment><USER5> "...obsessing over a few bits of code duplication is often a complete waste of time."

For you, maybe. But what about the guy who applies enhancements 3 years later and has trouble getting through testing because the exact same code was somewhere else and difficult to find because of the 67 mods since then.

Minutes "obsessing" today usually saves hours testing tomorrow.

<comment><USER6> "Minutes "obsessing" today usually saves hours testing tomorrow."

True, but the app has to make it to tomorrow for testing to matter at all. It's better to be in the championship trying to figure out how to manage a tired team, than it is to conserve energy during the semifinals and wind up sitting in the bleachers.

<comment><USER5> Where'd you ever get the idea that there is any trade-off between "quick" and "right"?

Doing things according to effective established principles saves a little time today and a lot of time tomorrow.

Quick and dirty usually ends up being neither.

<comment><USER6> _Where'd you ever get the idea that there is any trade-off between "quick" and "right"?_

I don't have that idea. There is sometimes, though, a tradeoff between current needs and future needs; and that tradeoff can not always be predicted. When that happens, it's logical to give current demands priority.

I can't for example, predict whether a future maintainer of my code would prefer code written with multiple returns, or code that sets temporary values, or code that uses a set of nested ifs, or code that assigns function pointers to a matrix and calls code based on the indices. Each technique has potential drawbackss in terms of future maintainability, likelihood of errors, and speed of immediate implementation. Trying to guess what a future coder (other than myself) will think is just not important in that case.

Effective Principles can only be Established based on a given development environment, and it's the responsibility of those in charge of the environment to make sure the established principles are effective and followed by the developers.

</comment></comment></comment></comment></comment></comment><comment><USER5> "...and it often simplifies the code to have multiple returns."

Today. And what happens after 10 other programmers modify your slick little multi-return function? Nobody will ever be able to modify it again because the entries and exits are lost among the garbage. This is the ongoing debate I've had for years with "clever programmers". They're missing one critical point: the guidelines of structured programming are not meant to make your life easier; they're meant to keep the code alive longer by making life easier for the poor schmuck who has maintain it (usually me).

Another Sign You're a Crappy Programmer:

You make your own rules in direct violation of effective established principles because you think you know better.

<comment><USER7> The number one sign you're a crappy programmer:

1\. You foist idiocy upon others and refuse to listen when they point it out as such, because someone told you that the idiocy was "effective established principles".

Your "effective established principles" seem to be neither effective, nor established, nor principled.

<comment><USER5> "neither effective, nor established, nor principled"

<http://en.wikipedia.org/wiki/Structured_programming>

Isaac Newton "stood upon the shoulders of giants." Interesting to see that you know better.

\</comment></comment></comment><comment></comment><comment></comment><comment>-----

"...someone told you..."

Actually, I learned what I'm sharing in this thread (and much, much more) from MANY excellent mentors. I hope you find some, too.

\</comment><comment></comment><comment></comment><comment>----

"The number one sign you're a crappy programmer"

I have hundreds of (well paying) clients that would disagree with you.

\</comment><comment></comment><comment></comment><comment>----

I "foist" standards only upon those who work for me. You won't ever have to worry about that.

</comment><comment><USER8> You know that you are a lousy programmer (and also lousy at doing other things) if you start to make rules although smart people know:

\- rules are for people who cannot think

\- every rule has a context where it fits perfectly, but

\- every rule has many contexts where it doesn't fit at all

Rules only reflect your current knowledge and your current working situation. This is subject to change.

</comment><comment><USER9> Oh, well I'm not crappy then. Neither I'm a good one though...

</comment><comment><USER7> I expected this list to be written by a crappy programmer who didn't know it... but it turns out it isn't.

I'll add two items to this list:

1\. You believe anyone who doesn't write unit tests is a crappy programmer. (I'm done trying to explain this to carppy programmers- not only are they crappy they think that unit tests make them not crappy, and so they can't concieve of the reason unit tests are bad (and often they are...) If you want to write unit tests for yourself, that's fine, but if you've ever told someone else that they should write unit tests, you're a crappy programmer.

2\. You believe in Scrum. Like global warming, Scrum is a religion... back in the old days, when programmers had to actually program, we used to use the "daily status meeting" as an example of the height of absurdity that pointy- haired-bosses could achieve. Now crappy programmers think that it makes them less crappy. (No, it doesn't, it actually means your code is crappy... especially if you think scum is an improvement.)

Really.

I know I am speaking crazy talk-- at least most programmers under 30 seem to think its crazy talk-- but it isn't.

The reason we have crappy programmers now? I think its cause they are going to colleges and getting CS degrees. Back in the "old days" when you had to write code to become a programmer, when you had to learn and you cared about getting things done well, we had to self teach and the learning curve was higher.... nowadays really crappy programmers train crappy programmers by the ten-score at universities who's primary goal is separating fools from their money (and I mean any university other than maybe caltech and MIT this applies to.) and they just teach really crappy programming practics. Those that can do, you know.

Speaking of which, you gotta be poor at math to go to univeristy in the first place-- teach yourself and start working right out of high school, after 4 years you're senior software developer, you're much better than the people who have been taught bad practices at university, and instead of being up to your armpits in debt, you'll have a good job and a great income... and four years later- a8 years into your career and 4 years after your friends got out of college, they might have paid off their student loans but you'll still be making twice what they were.

But then, I'm expecting to get pounced on because this is a site full of university grads. :-) Sorry, this has been my experience, and I've interviewed a LOT of programmers in my time.

In fact, I've found that PhDs in CS are useless, Masters in MS are good for grunt work, if you watch them close but generally shouldnt' be hired, and people with jsut a BS degree can usually be retrained if you can get them focused... if they get a job at a big corp right out of school, though, they are lost forever. (Most of them anyway.)

All the really brilliant programmers I've known didn't go to college. (BTW, I did, so I know first hand it was a waste of time.)

Anyway.....here's a bonus "how to know you're a crappy programmer":

You're a crappy programmer if you think while (foo) { stuff }

is wrong because the curly brace goes on the same line as the while. Generally ,the sloppy programmers who think they are really productive but produce nothing but shite are adamant about that... the ones who think about what they are writing and are useful, put the brace on the next line.

Really should use that as an interview question.

<comment><USER10> I think it's about time somebody stood up for the "curly braces stand alone" school.

I mean, we can debate silly stuff all day, like LISP versus C, Firefox vs. IE, Mac vs. PC, web 1.0 vs web 2.0, etc. But these "braces on the same line" guys are just completely out of their minds. :) <\-- Smiley face means humor was used in this comment.

<comment><USER4> I've seen whole projects fail over that discussion.

Maybe it really should be used as an interview question. There is no point in mixing same-liners and new-liners together.

Only remedy might be to use a programming language without curly braces.

<comment><USER10> I have to admit it's a pet peeve for me -- even more than choice of languages, oddly enough. When scanning code, I just like the ability to see my control blocks clearly. Simply because you can do something like this

     if (a==b) { doStuff(); } else doOtherStuff();

Doesn't mean you should.

I would consider this a little bit of a hangup on my part, though, as it seems other programmers go the other way. An interesting topic for a book is all the weird things programmers get hung up about. Variable naming comes to mind, as does error handling strategies. And when we get hung up, usually we're not too shy about explaining why everybody else is wrong!

<comment><USER4> I would not put everything on the same line, but I admit to putting the opening bracket on the same line. In fact, I consider the other variant extremely ugly. Just consider

      if(...)
      {
        ...
      }
      else
      {
      ...
      }

vs

      if(...) {
        ...
      } else {
        ...
      }

I can't for the life of me understand why someone would want to move the bracket to the new line ;-) It's just empty (wasted) space without any meaning. I can see the control blocks with the tighter version just fine, plus, it's the Sun Coding Convention for Java. But it's really a fruitless discussion...

<comment><USER11> I on the other hand find this quite elegant

(...) ? $doThis : $doThat;

</comment></comment></comment></comment></comment></comment><comment><USER5> My follow-up thread:

<http://news.ycombinator.com/item?id=83196></comment>


Blippy users' credit card info exposed on Google - <AUTHOR> http://news.cnet.com/8301-27080_3-20003283-245.html

<comment><USER2> $11.2 million in funding down the drain</comment>


Disney's Choice - <AUTHOR> https://stratechery.com/2017/disneys-choice/ <comment><USER2> I wonder if assumptions about horizontal vs vertical content hold. Disney put the first episodes of their Ducktales reboot on youtube, and a week later it has... 1.6m views. On youtube? That doesn't pay _one_ hobbyist minimum wage for the month much less a best in class animation studio.

On one hand, yeah, its targeted at kids. They probably aren't savvy at online content discovery. They almost certainly aren't subscribed to the Disney XD Youtube channel when there are Spiderman vs Pregnant Elsa videos to watch.

On the other hand, they put it out for free, to anyone in the US with an Internet connection, and they got 1.6m hits.

I don't think horizontal works as a business strategy. It relies entirely on memetic effects to propagate your content because the advertising budget required to reach an entire demographic to get ubiquity is magnitudes larger than the cost of actually making the thing. There is too much content inundating people - _especially children_. It makes your success completely random. Did your "meme" scenes go viral? Did your intricately designed quotable character take off? Did you have those, and just get overshadowed by some other meme at the time?

We won't see the consequences for a while. It will be 10 years before the cablecutters who dropped Disney have children at a critical enough mass to dramatically limit the number of young faces in front of non-interactive screens. But when that comes, it will have consequences none of these companies traditionally built on tv viewership are ready for. And I don't even know if they can prepare.

I feel like the only real end-game solution is to cultivate a fanbase, and use them as your revenue stream - much like how music has become today. Artists don't make anything off trying to sell their music anymore, because not being on spotify and pandora is a death sentence to your relevance. You need the audience, even if they aren't paying you anything, to attract fans that want mech you can profit from.

It would be really weird to see Ducktales as a Patreon project that is getting paid by 100k supporters several millions a month, but it seems to me that is the endgame for original creative media in the long run.

<comment><USER3> I doubt they put up Ducktales content on Youtube expecting hundreds of millions of view and a ton of advertising money. It's more to have the IP consumed and fresh in kids' and parents' minds for when a new Ducktales movie or toy comes out to support the reboot. The reboot is more of an ad for future monetizable products than anything else.

<comment><USER4> Which is one of the reasons to make free or essentially free content available these days. The flipside is that, when there are free or essentially free distribution channels, there's a lot to be said for making some content freely available rather than making an inconsequential amount of money off it, if it's tied to other things you can monetize more effectively.

<comment><USER5> That may explain why Disney put so much high-value content on Netflix recently ... and then announced they're going to yank it all to a new & devoted streaming service. Bait viewers to the near-free content, then tell them "it moved over there" where it can be far better monetized.

</comment></comment></comment></comment><comment><USER6> It's not entirely binary and I think Ben underestimates the power that content creators have in this country. Some content is simply classic, and will have value 30 years from now. Disney is amazing at making it. Disney is also amazing at lobbying Congress, along with other traditional media content providers to entrench their copyrights beyond the pale: [https://www.theverge.com/2017/4/3/15161522/mpaa-riaa- copyrig...](https://www.theverge.com/2017/4/3/15161522/mpaa-riaa-copyright- office-library-of-congress-dmca-infringement)

Netflix has been _forced_ to create it's own content because old media wants to charge Reed an arm and a leg for anything distributed online that they don't have control over. Old media always raises the asking price for anyone who comes to them requesting to redistribute content. They are scared to alienate the cable providers, the advertisers, and of losing even more control of distribution with these new consumer-centric on-demand business models. This is why despite years of hype, Google and Apple haven't gotten far with their TV bundles so far.

I do think the Netflix - Disney love/hate is over-hyped. Both can exist. Disney can keep crafting great stories and Netflix can keep targeting customer groups across the globe with affordable content that scratches their niche itch. Amazon has been more willing to pay the piper, but has also had to resort to in-house content. The great thing about good TV/movie content is it tends to retain value. Good luck to Disney creating as seamless a distribution platform as Netflix though...

I think Viacom is going to be the real loser here, to YouTube and Netflix. Most of their MTV, Comedy Central stuff has no replay value. Music videos in particular have been completely absorbed by YouTube. Meanwhile Netflix is doing great comedy specials. Years of family in-fighting has only further weakened Viacom's position and they are likely to be forced into tiered packaging deals by even their traditional cable and satellite partners.

</comment><comment><USER7> I have a 2- and 3-year-old. Give me all the Disney things at $10/mo and we're good. I'd prefer they be included in Netflix, but Netflix+Disney and I'm still better off than cable, and hopefully there is some better curated content as a result.

<comment><USER8> One thing I noticed with my kid (5 yrs old) is they enjoy repeatedly watching the same show. Even if the whole Disney catalog was available they'd probably watch the same move for days on end. At first I was encouraging trying new shows but apparently it is normal for kids to act that way. So what we ended up doing was just purchasing the movies. The trick is figure out if they'd like it. But so far we've had a good track record at guessing.

$10/month would be worth it for me but it's probably not realistic. A single movie usually costs more than that. With this plan they'd cannibalize their own media market.

<comment><USER9> > $10/month would be worth it for me but it's probably not realistic. A single > movie usually costs more than that. With this plan they'd cannibalize their > own media market.

Another way of being 'realistic' (not moral) is to see that 1TB hard drive is 100 bucks and can contain a thousands of Disney movies, which can be obtained fairly easily online.

They can't charge too much for something that people essentially buy out of good will rather than necessity.

</comment></comment></comment><comment><USER10> There's a risk that Disney will screw this up, but personally it looks like something hard to get wrong. Disney has a huge library of unique, high-quality content people really want to watch. If they can put all of it — not artificially limiting the selection too much — on one service and set the price right, they should do well.

<comment><USER11> They bought their minority stake in BAMTech (the streaming spinoff of MLBAM) earlier this year. There's no way they're going to mess this up from a tech standpoint either.

<comment><USER12> HBO Go was totally redone from the ground up by the MLB team I believe and there were some hickups at the start but it has been pretty good since then.

<comment><USER13> Minor correction - HBO Go is still in-house at HBO. BAM runs HBO Now, the OTT service.

Source: I work at BAMTech.

</comment></comment></comment></comment><comment><USER14> Splitting from Netflix would've been genius if the idea were that they'd partner with a competitor to challenge Netflix, namely someone like Hulu or, better yet, Amazon.

Going off on their own without being part of a larger more diverse set of content could deal a serious blow to Disney. I for one would not ever pay Disney through a Disney-specific service just for streaming Disney content, as much as I like Disney movies.

<comment><USER3> What's the difference at that point if Disney's content is on Amazon rather than Netflix. They are betting that their entire catalog (ABC, Marvel, Star Wars, ESPN, etc) is worth more direct to consumer than whatever small fraction they are getting of every subscriber fee.

<comment><USER15> I don't think Disney produces enough content that could justify such a service, they have a diverse catalog but it really doesn't have the depth.

Maybe I'm weird, but I get my fix of Disney IP's by purchasing a Blu-Ray once or twice a year - I can't stand the garbage Disney puts on their cable channels (seriously, to hell with the Disney Channel and Disney Jr.), their classic movie library I won't let my daughter near, I couldn't care less about anything on ESPN and ABC. That basically leaves Pixar, Star Wars, (sometimes) Marvel and on (rare) occasion their newer films and licensed content. Why on earth would I pay $5-10/mo ($60-120/yr) when I can spend $20-40/yr on a disc or two?

<comment><USER16> Right, but you are weird, just like many of us here. Hannah Montana had an average viewership of 4-5M people. In comparison, Breaking Bad only surpassed the 2M in the last season, and Mad Men never hit 3M. And while HM is a peak, all their Disney Channel live-action show are in the 1-2M zone.

</comment></comment></comment></comment><comment><USER17> _The antenna is mounting a quiet comeback_

People are getting antennas but a large reason is that most cable and network providers switched to digital only and turned off analog in the last year or two. Digital antennas are quite nice for live not avail on streaming or something like Vue.

I cut the cord in 2015 for a Vue/antenna/Hulu/Netflix alternative and Cox cable in Arizona turned off analog in 2016[1] in my area on the default wire so a digital antenna was needed. The cord cutter movement pared with providers turning off analog, and cord cutters missing live/local channels on services like Vue/Sling etc spiked the sales in antennas. Haven't used an antenna in ages and digital antennas are actually quite nice, full HD or no channel, tv static snow is dead.

[1] [http://www.azcentral.com/story/money/business/consumers/2016...](http://www.azcentral.com/story/money/business/consumers/2016/04/21/some- cox-cable-customers-need-mini-boxes/83249038/)

</comment><comment><USER18> One question is what happens over the long term to Netflix' Marvel shows. They're still owned by Disney, but are some of the most popular Netflix "originals."

Pulling those—or their followup seasons—over to the Disney streaming service would have to hurt Netflix.

<comment><USER19> I've watched those shows and enjoyed them but I feel like they're becoming redundant so it would probably be a good thing if netflix was forced to do truly original content. The whole superhero thing is growing stale for me anyway, and I suspect for a lot of others as well.

<comment><USER20> I have an solid antipathy against the superhero movies and I dislike that Netflix offers so many of those that it's hard to browse their non-superhero offers.

Please Disney, be greedy here, I know you can and I know you want to :)

</comment></comment></comment><comment><USER21> I would love to see the books for [https://www.warnerarchive.com/](https://www.warnerarchive.com/)

$10/mo for 40+ year old TV shows and obscure films that only people over 70 would be aware of.

</comment><comment><USER22> This transcript of a Steve Jobs interview linked from the article seems still very relevant:

[https://stratechery.com/2013/steve-jobs-on- television/](https://stratechery.com/2013/steve-jobs-on-television/)

Seems like Netflix is slowly chiseling a way at the TV go-to-market strategy. Also seems like there is still a lot of resistance to the single-integrated-UI problem. Still lots of paradigms, apps, and devices competing to be the accepted way to find and watch video on your big living room screen.

</comment><comment><USER23> Distribution should be decoupled for content creation, then there is true competition and everyone wants to sell everywhere, instead of pulling content from everywhere, which only hurts end users.

<comment><USER24> That would be nice, but it's not how the world works.

I even doubt you'd be able to regulate it well. It would mean forbidding Netflix Originals, for example. Netflix would just start a legally independent production company called Fletnix and get global exclusive licenses on all content it produces.

<comment><USER23> So exclusive licenses should be forbidden by antitrust law. Something should make it work.

</comment></comment></comment><comment><USER25> > Netflix wasn't simply a customer for Disney's content, the company was also > a competitor for Disney's far more important and lucrative customer — cable > TV

Remember when Sony Electronics tried to play the game Sony content companies wanted it to?

Yeah, that worked out just fine. NOT

<comment><USER5> As a former Sony fanboy, Sony Electronics makes the systemic mistake of completely forgetting the customer the moment the hardware is sold (as contrasted with Apple, providing ongoing quality services that encourage more hardware purchases).

My last straw was buying a Blu-ray player that claimed glorious high quality video and lots of apps/software/content: with anticipation I had it play the included trailer for then-coming-soon movie "Salt", expecting the very best of my then-new 1080p system ... and was dismayed by a horribly grainy 320x240 video. Sony Electronics didn't give a ---- about content, even though the whole point of buying the products was experiencing content.

</comment></comment><comment><USER26> Aren't they basically incentivizing Netflix to enhance they own catalog? They are already on it and they certainly got my attention for getting some pretty good content out. Netflix can basically just head hunt great content creators and producers which are left out of the industry altogether.

Unless they offer their content for a fraction of Netflix subscription (which I doubt), I'm not up for supporting this disaggregation of content by each producer. Netflix already has the tech, the infrastructure, the apps, which I'm already paying for. Do I have to pay for it 2x, 3x, 4x?

<comment><USER27> Seems like the company they bought has the tech, infrastructure and apps. [1]

I'm sure it will provide value to some and not others. Overall I believe it's smart move for Disney.

[1] [https://www.forbes.com/sites/maurybrown/2014/07/07/the- bigge...](https://www.forbes.com/sites/maurybrown/2014/07/07/the-biggest- media-company-youve-never-heard-of/)

<comment><USER28> Isn't solving the Live Streaming issue different that the VOD issue? I mean, I know there is a large amount of overlap, but live streaming benefits greatly from what is basically multicasting. With VOD you may have every single person watching the same thing, but at different points. I think I read that HBO also uses the company that Disney bought, so they must be able to handle VOD in some form because the weekly surge of GoT watchers is likely massive.

</comment></comment></comment><comment><USER29> Why don't Disney and Netflix come to an agreement where Netflix offers a Disney-only channel? Each company can then concentrate on their core competencies: Disney can focus on creating content, and Netflix can focus on displaying it to people.

<comment><USER30> why should Disney make Netflix richer?

Netflix for Hollywood was just a middleman that siphoned away their profits. Disney is just removing them from the equation because they feel they can run their own streaming service and capture more value than they provide. You only use middlemen when you have to, and they decided they don't have to any longer. And this lets them charge more and give customers more value too. A $30 a month sub with access to everything makes more sense than slowly rotating old shows for a $10 sub.

<comment><USER29> Disney should make Netflix richer because they have no reason to believe they can do the following things better than Netflix: streaming gigabytes of data over the internet to millions of users, collecting payment and handling customer support.

It's the same reason that Disney doesn't operate its own movie theatres: it doesn't have any competitive advantage in this area.

Disney can offer "a $30 a month sub with access to everything" through Netflix. That is, Netflix would offer a 'Netflix channel' for $10 per month or a 'Disney Channel' for $30 per month.

Keep in mind that Netflix doesn't have much bargaining power - if they ask for more than say a 7% cut of that $30, Disney can just build their own streaming service for around 7%. Therefore it's in Netflix's interest to offer to host the Disney streaming channel for a percentage that is just a bit less than would cost Disney to build their own streaming service.

<comment><USER31> When Disney bought BAMtech (which was part of that announcement), they got just that: a battle-tested, state-of-the-art content delivery platform capable of streaming of millions of simultaneous viewers.

As for customer support, Disney has always been excellent at that. Go into a Disney store or theme park sometime for an example. Heck, they invented the "customer is a guest" service concept (outside the hotel context).

</comment></comment></comment></comment><comment><USER32> How does Disney's income break down in terms of merchandise/parks/cruises vs. eyeballs paying to look at moving pictures? If most of their income is the former, why does Disney care where or how people are exposed to their brand?

<comment><USER33> Their wiki page has some numbers for the last few years. Parks/Resorts (incl. cruises) made $3.3B in 2016; Studio Entertainment made $2.7B; Disney Media Networks (ABC/etc) made $7.8B. So if you put the TV and films together, that's roughly triple their parks & resorts.

(Edit: changing revenue to income.)

<comment><USER34> What about merchandising?

[edit] about 1/3 of the parks:

Studio: 9,441

Consumer Products: 5,528

Parks/Resorts: 16,974

Media Networks: 23,689

<comment><USER35> You need to cater to eyeballs so that people keeps buying the merchandise. Disney, together with Coca Cola, are the world leaders of creating a brand that feels like an essential part of your life; and it all depends on keeping the core product relevant.</comment></comment></comment></comment>


Peter Thiel Shuns Hot Idea for Bigger Picture - <AUTHOR> http://dealbook.nytimes.com/2011/05/19/contrarian-investor-shuns-hot-idea-for-bigger-picture/ <comment><USER2> Peter Thiel in regards to Twitter - "The broader question is, Is it going to help people have a much higher quality of living? And I think on that score, its benefit is a lot less." - I think the people of emerging revolutions might disagree. Or wait, maybe only Facebook can help improve quality of life?

<comment><USER3> Come on, Twitter is a _tiny_ part of the Arab uprisings. (Yes, good communications help, but SMS works fine.)

</comment></comment><comment><USER4> With respect to the performance of Clarium, I am reminded of a quote: Markets can remain irrational longer than you can stay solvent.

<comment><USER5> when you lose money, the market is rational. when you make money, you can say it was because of the market's inefficiency or irrationality. or maybe it is irrational to construct a trading strategy that relies so much on luck, with a few large trades that cannot be sufficiently characterized statistically. how can you know what your edge is, in terms of probabilities, on your long-term macro calls on oil or the dollar?</comment></comment>