Link between inflammation and mental sluggishness shown in new study - <AUTHOR> https://www.birmingham.ac.uk/news/latest/2019/11/link-between-inflammation-and-mental-sluggishness-shown-in-new-study.aspx <comment><USER3> The actual published study:

[https://www.sciencedirect.com/science/article/abs/pii/S10538...](https://www.sciencedirect.com/science/article/abs/pii/S1053811919306895)

N = 20 healthy males.

</comment><comment><USER4> I've become convinced a lot of what we now consider mental illnesses are actually symptoms caused by unknown pathogens. Inflammation plays a big part in this.

<comment><USER5> I'm also convinced of the same thing, I don't know enough about biology, but I have days where I feel like the only thing that could be causing certain emotions is an infection that I don't know about.

For example, I use to feel tired all the time, and I would get sick all the time. I swear I could "feel" that my immune system sucked and I constantly had to fight things off.

Now I feel like my immune system is stronger, and it shows because I get sick so less often. My brain fog is basically gone and my energy levels are a lot higher. Every now and then it comes back, but recently I always wondered:

Is there a set of anti-biotics, anti-parasitical, anti-viral drugs that you could take in a row to try to flush the body of any infections? There's been similar comments about HSV1, that a lot of people have, but there's also Toxoplasmosis. If you look into it, so many people have both of these infections, but what are the side effects on the body?

I think immune system is one part of the picture. I also think your bodies natural response to the environment has something to do with this. I've been way more social and have gotten WAY better social feedback from all angles in my life (positive feedback loop) and that has helped immensely with mood and feeling good all the time.

When you combine a lot of these things, such as: poor immune system, conflicted social life, bad diet, and lack of exercise, I could see how the combination could manifest its self into mental illness.

I'm still convinced pathogens have a high ranking in the cause of brain fog and emotional issues tho, social life being second, diet third and surprisingly exercise being last even though I initially thought it was number 1. It just made me feel good, but it didn't really get to the root of any issue for some reason.

<comment><USER6> >Is there a set of anti-biotics, anti-parasitical, anti-viral drugs that you could take in a row to try to flush the body of any infections?

My uninformed guess is no, they probably lower your immune systems defenses.

What you can do is work on your sleep hygiene, work out more, and eat lots of vegetables. Reduce milk, red meat, alcohol and caffeine. Basically anything that's known to cause inflammation (milk and meat) and bad sleep (alcohol and caffeine).

<comment><USER7> > Reduce milk

Have you got a source for that assertion? A brief search yields contrary evidence[1], unless you limit your audience to those allergic to bovine milk.

[1] [https://www.ncbi.nlm.nih.gov/m/pubmed/26287637/](https://www.ncbi.nlm.nih.gov/m/pubmed/26287637/)

<comment><USER6> That's true, I guess that was wrong. I remember reading something about cancer causing effects of milk, and I assumed that was due to inflammation. However it seems to be more related to the steroids in dairy.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4524299/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4524299/)

</comment></comment></comment></comment></comment><comment><USER8> Possibly dumb question: could NSAID painkiller's like ibuprofen counter this type of inflammation? Or is that unknown at this time?

<comment><USER4> An analysis of 30 studies involving 1,610 people has concluded that NSAIDS were 79 per cent more effective at fighting major depression than a placebo. [https://jnnp.bmj.com/content/early/2019/08/29/jnnp-2019-3209...](https://jnnp.bmj.com/content/early/2019/08/29/jnnp-2019-320912)

</comment></comment><comment><USER9> [https://www.medicalnewstoday.com/articles/315255.php](https://www.medicalnewstoday.com/articles/315255.php)

Good news is, just 20 minutes of exercise is enough to reduce inflammation.

<comment><USER10> Exercise might help, but a change of diet will help a lot more.

<comment><USER11> Both of these are equally important. Diet and exercise are 2 sides of the same coin. This is why they are usually mentioned together using a conjunction when one gives health advice.

Exercise has direct impact on inflammation markers (initially increases them, but suppresses them over longer timescales), and also helps substantially with nutrient uptake + digestion. You may also find that you crave healthier food options immediately after having just completed an arduous workout.

In my experience, the best approach for keeping inflammation under control and generally being in the best mental state possible is to exercise every morning while fasted, and then eat 1 big meal sometime in the afternoon. This approach ensures your body experiences a shift in metabolic modes on a daily basis, and makes it a much more seamless experience as you shift between them (assuming you stay consistent). I feel that being in a ketogenic state (i.e. right after you complete your fasted exercise session and before you eat your big meal) yields countless health benefits. And, if you can essentially guarantee that you experience this mode for 4+ hours every day, whatever benefits it may confer should be substantially realized.

<comment><USER9> Can you elaborate more on " You may also find that you crave healthier food options immediately after having just completed an arduous workout.".

I actually found myself less attracted to junk food after working out but I am not aware that there is a connection behind.

</comment></comment></comment></comment><comment><USER12> What's the solution? I've felt brain fog for 15 years.

<comment><USER13> Ketogenic (including carnivore) diet will greatly reduce inflammation. You'll also want to do an Igg food sensitivity test to see what specific foods your body is creating inflammatory markers for, and a microbiome test can also let you know if bacterial/yeast infections that could be adding to brain fog.

Fasting is useful for seeing how your mental state is while limiting external food resources (you're using internal fat reserves otherwise), otherwise intermittent fasting is the best option.

<comment><USER14> Seems like IGG doesn't have the best reputation...

<comment><USER13> Just like fat didn't have a good reputation for awhile due to X, Y, Z - <USER2> weary of your sources.

I use my own experience with Igg food sensitivity testing and removing those foods to see how I felt after. After allowing my system to calm from the foods then reintroducing just one of the foods that I was conditioned to the discomfort of, it let me see how much discomfort/pain different foods that showed up on the Igg test that make me feel horrible.

</comment></comment></comment></comment><comment><USER15> To everyone who wants to do keto - keep an eye on your renal function and acidity. Keto in general is good, but may damage your kidneys in some (uncommon) cases.

</comment><comment><USER16> What does inflammation mean in this case (i.e., what part of the body is being inflamed)?

<comment><USER17> Inflammation can occur all over the body, it's a central part of the immune response, triggered for example by pathogens, damaged cells or toxic compounds. The type of inflammation that correlates with more and more (mental) disease is usually in relation to chronic inflammation, meaning the normally healthy immune response doesn't return to baseline and starts harming the body. This can occur because of chronic stress, obesity, a dysfunctional gut microbiome, chronic infections or as side effect of medical treatments, amongst other, and probably a lot of unknown, causes.

</comment></comment><comment><USER18> "For example, people living with a medical condition or being very overweight might complain of cognitive impairment, but it's hard to tell if that's due to the inflammation associated with these conditions or if there are other reasons.""

Is this study proof inflammation is the root cause, or that it correlates with other symptom.

I can here it now, "Obesity isn't my problem, inflammation is." Or "It's not my lifestyle. I don't need to exercise and/or eat well. My problem is inflammation."

<comment><USER19> Exercise and diet are proven to reduce inflammation.

</comment></comment><comment><USER20> As someone with sinus allergies, I wonder if this could be partially attributed to things like airflow.

<comment><USER21> I felt mildly feverish and had aches. I also slept poorly because of narrow passages causing brain fog. Then I had FESS which cleared the chronic infection. Now I sleep better and almost got rid of brain fog.

</comment></comment><comment><USER22> Asian cultures have known about this link for a long time and their diets reflect that. Hot and cold foods aren't just related to temperature.

<comment><USER23> Can you clarify and quantify that statement? I'm not sure what you mean by Hot and Cold foods and temperature? And how are each integrated into the overall diet? Is there any information you could point us too?

<comment><USER24> [https://en.wikipedia.org/wiki/Chinese_food_therapy](https://en.wikipedia.org/wiki/Chinese_food_therapy)

Of course, the notion that there's a correlation between what you consume and what your body exhibits is common to pretty much _every_ culture, including modern culture. Likewise for classes of foods correlating with classes of ailments.

The devil is in the details--what's the particular effect, if any, of a particular ingredient or mix or ingredients. Rarely do the claims and the reality line up in a rigorous, medically significant manner. But like with religion, the classes of foods and ailments are susceptible to very liberal interpretation, and lend themselves to equivocation with whatever correlation may actually exist. And because foods obviously can and do have significant health effects, opportunities for coincidental relationships abound.

That said, modern food science isn't particularly rigorous either, relies on its own gross generalizations and fallacies, and even shares some with folk medicine--most infamously, the supposed relationship of salt and saturated fat consumption to hypertension and cholesterol, respectively, exhibit many of the same classic errors you see in folk medicine.

<comment><USER25> Similar concepts of hot and cold foods are widely applied in Persian and Indian cuisines.

[https://frbkrm.com/2013/02/17/139/](https://frbkrm.com/2013/02/17/139/)</comment></comment></comment></comment>


Got an I/O ticket...only to have payment gateway fail? - <AUTHOR>

<comment><USER2> Can't say I didn't see this coming. It's been the same absurd registration experience for several years now. What Google really needs to do is stop throwing all this free swag around so the conference can really find its intended purpose and audience again: developers. I've to most I/Os since its inception, and damn has the quality of the actual conference gone down since the first.

<comment><USER3> Although I don't think the free stuff helps matters, WWDC tends to be a very similar free for all - slightly less hectic, but that's only because Apple don't give notice of when the tickets are going on sale, so it's more of a mad scramble than a pre-planned thing.

Which is to say, in terms of registration issues I'm not sure making it more technical and getting rid of the free swag would alleviate matters, if you just go by what happens with WWDC.

<comment><USER2> Interesting. I've never gone to a WWDC, but I've been to the first three I/Os, and while it could be the fact that the conference has become better known since then (and increasingly at larger scales), you can definitely see the effects that the free swag have on registration demand (and the effect on the quality of the people going to the conference) over the years. It's been really disappointing to witness the change, as personally I/O was my favorite tech event back when it was true to its original purpose: a conference for developers.

<comment><USER4> Agreed. Google Ticket Plinko, followed by Google Wallet Plinko.

Google can serve mail and handle search, but online registration and payment gateways don't seem to be its strong suit.

</comment></comment></comment></comment><comment><USER5> Oh, it's I/O time again.. HN for the next few days will be nothing else than blogs crying about not getting in (and various reasons for why it is not fair). Oh well..

<comment><USER6> and about students wanting free stuff leaving the good longtime cutomers in the dust... or something like that

<comment><USER7> I would wager that a fair chunk of the demand for Google IO is people wanting to be showered in gadgets and then there are people who legitimately want to learn stuff. Maybe I'm just being cynical. I have never been to Google IO so I don't really know. Any previous attendees have impressions about this?

<comment><USER6> yeah well, my response was a little tongue in cheek. i tend to watch the videos online. people don't go there just to watch stuff. they go there to network, and get free stuff.

contrary to what the current conference/technology trend may dictate, technology is not a rockband where the live show is better than the studio recording.

<comment><USER4> Yes, I've been to several prior events and the number of folks that used to be Devs has certainly migrated to folks that are in for the free goodies.

I have to believe eliminating the "free goodies" will definitely return it to a dev conference vs. an Oprah event. Maybe this will be the year. This year the system said they found a ticket (actually several times), but apparently they were just dangling it in front of my nose, because I couldn't get through payment gateway, Google Wallet.

Each year registration is like a game of Google Plinko.

I'd be curious to know the # of user requests that brought the Wallet to its knees.

</comment></comment></comment></comment></comment><comment><AUTHOR> I now think there are actually only five tickets available, being distributed in chocolate bars around the world...

</comment><comment><USER8> Same here. Got a "ticket" 6 different times and had wallet failures til timeout. A friend of mine got his, though. I am no longer speaking to him. :)

<comment><USER8> Looks like the final attempt ended up going through just as registration closed. Confirmation e-mail received.

</comment></comment><comment><USER9> What a frustrating experience. Waited in line for an hour only to have a broken checkout screen. You think they would have their shit together by now.

</comment><comment><USER10> Searches never got anything for me. Girlfriend got to buy button which never returned from graying out after pressed. Wish I'd tried the dismiss popup and retry or check wallet in another tab tricks people mentioned working here. As it is, lost the ticket due to the 5 minute finish count. Oh, well, always next year. :)

</comment><comment><USER11> Everytime it comes up, I'm always fascinated that online checkout under demand is still unsolved, even by a giant like Google.

Obviously it's a small chunk of all online sales, but it always seems like the process fails _somewhere_

</comment><comment><USER12> This brings up a common problem I have with high demand ticket sales. Why not, for at least the first portion of tickets, us a scaling price? When sales open, the price is $10,000. Drop the cost by 1% of the starting price per minute for the first 90 minutes. Recalculate the starting price at the current price and begin again until we reach a floor.

      So if sales start at 9:00 am we have the following schedule:
      09:00 am  : $10,000
      09:01 am  : $9,990
      10:30 am  : $1,000
      12:00 noon: $100

<comment><USER13> <https://en.wikipedia.org/wiki/Dutch_auction>

Google doesn't necessarily want the richest companies/developers to attend. Nor are they interested in extracting the maximum amount of money (though of course they could do a few charity auctions). A good mix of small companies, freelancers, corporations is probably what they're aiming for.

<comment><USER12> If the goal is to spread tickets evenly over all potential attendees, then lottery style ticket sales make more sense.

Although if they want to control the composition of their audience even more, they can sell some tickets via Dutch auction and use the profit to pay for the costs for attendees are specifically invited.

</comment></comment></comment><comment><USER14> Got ticket and now counting down on the Wallet page.

Console says "Failed to load resource: the server responded wit status 401 on checkout.google.com/inapp/api/v1/purchase_options"

<comment><USER14> Timer ran out. I saw several 500 (Internal Server Error) messages in the console.

</comment></comment><comment><USER15> You made it further down the line than me. Clicked the signup within a second of going live and still loading...

</comment><comment> tjs-mn How irritating. I got as far as getting a ticket for Google I/O three times. Google Wallet failed to complete the transaction all three times, although once it got as far as creating a "pending" transaction. After the third Google Wallet failure, Google I/O was sold out.

Geez....

</comment><comment><USER16> I've got 2x $900 pending charges shown on Google wallet after attempting to purchase the ticket.

</comment><comment><USER17> Kind of happened to me. The first time, the modal didn't complete, but I received an email that the charge updated. For kicks, I jumped into the queue again and that time the page completed all the way to the reg form. I now have two pending $300 charges.

</comment><comment><USER18> I was able to get the Google Wallet options to appear and hit 'purchase', but the the 'purchase' POST request timed out.

Trying again, but now I'm seeing this: "Try again. We couldn't find you a ticket, but there still might be tickets left!"

</comment><comment><USER4> Another view of the ticketing process: [http://www.youtube.com/watch?feature=player_detailpage&v...](http://www.youtube.com/watch?feature=player_detailpage&v=4T2GmGSNvaM#t=39s)

</comment><comment><USER19> I think this is definitely not a good first impression of Google Wallet. It was my first time using Google Wallet and I think it was for many others as well.

</comment><comment><AUTHOR> GOT ONE! Try opening a new tab an logging into Google Wallet after a ticket is reserved...That might have been a coincidence, but it worked

</comment><comment><USER20> Same here :(

</comment><comment><AUTHOR> <http://imgur.com/B7xRaPZ> sold out :(

</comment><comment><USER21> Ugh.

<http://imgur.com/opR63hx>

</comment><comment><USER22> Same here. Have a pending payment in my Google Wallet account. Ah well.

</comment><comment><USER23> The site says sold out. I just got up.

I hate to be obvious, but putting registration up in the morning for a bunch of developers (most of whom are on the West Coast) isn't the best idea in the entire world. Especially when it sells out in 15 minutes.

<comment><USER3> I mentioned this in another thread: lots of engineers do live outside of California. The majority of engineers in the world are not based on Pacific Time.

Last year Apple put WWDC tickets on sale at 5:30AM PDT without notice...the rumour mill suggested this was deliberately done by Apple to ensure more attendees from outside the west coast. I heard something similar from someone at Apple as well.

Whatever time you put tickets on sale, somebody is going to complain. There are certainly two sides to the coin here...I'm not pretending to have a solution, but merely pointing out a time that's convenient to you may well not be convenient to, say, developers in Asia.

</comment></comment><comment><USER24> Happened to me twice. Trying for a third ticket now...

</comment><comment><USER25> All sold out.

</comment><comment><USER26> exactly what happened to me got ticket payment processing..... timer runs out.. WTF

</comment><comment><USER27> so I wasn't the only one...

</comment><comment><USER28> Same error. Now sold out.

</comment><comment><USER29> Same thing happened to me.

</comment><comment><USER30> same here and Google Wallet still show it is processing... :/

</comment><comment><USER31> Better than I managed.

</comment><comment><USER32> got the ticket but my wallet throw an NoFundsFound

</comment><comment><USER33> Same thing for me.</comment>


Announcing the Google Patent Purchase Promotion - <AUTHOR> http://googlepublicpolicy.blogspot.com/2015/04/announcing-patent-purchase-promotion.html <comment><USER2> Interesting. I happen to own a patent that I would be interested in licensing to Google, but I'm not willing to sell it outright, since in that case I wouldn't be able to use my own technology that I invented.

I wonder if there will be other options besides handing over all rights in exchange for some amount of money? For instance, I might be okay with selling my rights if, as a condition of the sale, Google is required to allow the patented technology to be used in any open-source application.</comment>


How many hours are you productive per week and per day? - <AUTHOR>

How many hours are you productive per week and per day ? And how many hours at a stretch?<p>For me - I have difficulty doing it more than 20-24 hours a week on an average. I'm fast at coding and problem solving - but that also means my energy wanes off faster within the first 4-5 hours and I am better off not working the rest of the time. Just in case you are wondering - I never had any problems related to productivity at my 40hr/week job except that I had to endure the additional frustrating hours. <comment><USER2> I can only do 3-4 hours in the zone per day, if i take a nap in the afternoon i'm able to get another 3 hours of the zone in the evening.Thus on a good day it adds up to 6 hours of quality coding.I try to do planning and meetings in the other hours.

</comment><comment><USER3> Most _good_ ideas I have surface after a break from coding, be it a walk, weekend, or night of sleep. Those ideas start depleting as soon my hands hit the keyboard, and once they're gone I enter full code monkey mode. When I'm conscious this transformation is taking place I usually hit up pen and paper or a white board, which can buy me extra hours. It probably comes out to about 50% of time planning, 50% coding, and as long as I don't spend too much time in the latter I can avoid getting burnt out. I figure if I have to try when coding I'm doing something wrong though it's sometimes unavoidable.

</comment><comment><USER4> This may interest you - according to a study[0] the average office worker is only productive for three hours a day.

I'm a freelancer working from home, and I find I work about 5 - 6 chargeable hours / day. Of course some of those hours are more productive than others :)

0 - [http://www.employeebenefits.co.uk/news/only-three-hours- of-p...](http://www.employeebenefits.co.uk/news/only-three-hours-of- productivity-a-day/103618.article)

</comment><comment><USER5> Interesting. I've been thinking about this recently and, yes, while I can sit in front of a computer screen for eight hours, I reckon I'm only _productive_ for six hours. So I try and work in three 2-hour bursts.

It's worth saying that my situation's slightly different in that I work for a tech company, but I'm not a coder.

</comment><comment><USER6> 30 minutes dropping kids at school & gym.

30 minutes breakfast, shower and HN.

3 hours of productive work.

Break for lunch and a hour's worth of random fun.

3 hours in the afternoon.

Done at 17h00.

Sustainable, and over a year it adds up to a frightening amount of code :)

</comment><comment><USER7> I find that my productivity goes down 90 minutes into a task. However, a 15-20 minute break does the trick and I find myself productive once again. The trick is to weed out the distractions (especially if you work from home) - TV, family, news/shopping sites, HN...

</comment><comment><USER8> Code quality falls off dramatically after 4-5 hours. Unit tests are the last line of defense in crunch mode, but even TDD doesn't prevent the bug onslaught if people are tired.

</comment><comment><USER9> At my dayjob I'm productive for around 7,5 hours per day (I work 8 hours per day) which is incredible in my opinion. Then I put in some more freelancing hours when I get home, usually around 2 hours per day.

I'm very bad at being productive when I work from home though. I could never work 8 hours per day when there are no colleagues around.

</comment><comment><USER10> 3/4 hours max per day. When I'm really interested, it tends to be a little more, but I can't hold that pace for to long.

</comment><comment><USER11> In a regular week 12 hours (7am-7pm usually) from Monday to Friday and 4 hours on Saturday; for a total of 64 weekly productive hours. I spend this hours in college stuff, gym, volunteering and off course, coding.

</comment><comment><USER12> Around 85hrs/week when I don't have anything else to do...

~5hrs/week when I do

</comment><comment><USER13> Depending on the day, 2-3hrs/project. I usually work on 3 very different projects each day.

</comment><comment><USER14> 30-35 hr/week.

</comment><comment><USER15> 4-5 hours per day.

</comment><comment><USER16> 4-5h/day.

</comment><comment><USER17> no more than 5hrs/day

</comment><comment><USER18> approx. 4 hours per day.</comment>


My brain can't handle OOP anymore - <AUTHOR> http://swizec.com/blog/my-brain-cant-handle-oop-anymore/swizec/4320 <comment><USER2> I have to say, having stared in to the abyss of large Haskell code bases, they're not necessarily easier to read than a large Java code base.

Reading bad functional code can be just as painful as bad OO code -- trying to untangle a mess of fold's that an overzealous developer who just learned of catamorphisms wrote can be painful. Even more so if that young developer is you, five months ago.

Sure, the language doesn't impose as much discipline in Python/Java/… as in Haskell(+), so it might require more of you as a developer to write clear, readable code (note: not saying that it requires more of you as a developer in general, just that it's easier to fall in to lazy anti-patterns). But if you work in a decent code base most of the pitfalls in the post are basically straw men. A well designed OO system will generally not be riddled with singletons and arbitrarily mutable state.

(+) I'm using Haskell here cause that's the only purely functional language I have any experience with. Substitute as you please.

<comment><USER3> > _I have to say, having stared in to the abyss of large Haskell code bases, > they're not necessarily easier to read than a large Java code base._

Actually a Haskell oneliner can be more challenging that a large Java code base.

<comment><USER4> And a single Java class can be more challenging than a large Haskell code base. So what?

<comment><USER3> So the first tends to happen far more often than the second.

If anything, Java code is boring and boilerplate like, not difficult to comprehend.

Haskell code on the other hand, not so.

<comment><USER4> I think we're arguing over subjectivities here -- comprehensibility is entirely dependent on the people involved as much as the language in question. If you're better at Java than Haskell, you'll find it easier to follow, and vice-versa; I know people in each category. And you can write clearly or obfuscate in either language; I've seen all the combinations.

Personally, I tend to find Haskell easier to follow. I suspect that's mostly because I've used a lot more Haskell than Java of late, but it'll also be a matter of personal taste. As you say, Java can be very boilerplate-heavy -- some may find the redundancy makes it easier to follow, as it can remind you what's what "as you go"; others may feel like they're scrolling up and down hunting for meaningful code, and find all that boilerplate a distracting waste of space.

I will admit that, on average, I'll have to spend a bit longer looking at a line of Haskell than a line of Java before I know exactly what it does -- but then again, you rarely need anywhere near as many lines of Haskell as Java to solve the same problem, so it feels like a net gain to me.

<comment><USER3> > _I think we're arguing over subjectivities here -- comprehensibility is > entirely dependent on the people involved as much as the language in > question. If you're better at Java than Haskell, you'll find it easier to > follow, and vice-versa; I know people in each category._

I maybe arguing over subjectivities, but subjectivities turn into objectivities with the tool of statistics.

And I think that in general (statistically), people find Haskell more difficult than Java.

</comment></comment></comment></comment></comment></comment><comment><USER5> Yeah I think you missed it. "Answering this simple question requires knowing everything. The whole execution history of foo. The whole codebase. You name it, you have to keep it in your head."

Here's the thing about OOADP (Note I didn't just use OOP): it gives you a simple methodology to solve problems and know where to put stuff. You don't know _everything_ , because the assumption is that the codebase is going too big to know everything. But what you _do_ know is where things go; an organization of nouns. Good large projects have a design theme that's easy to understand and gives you the mental tools to reason about _which pieces_ need your attention at any one time. OOP is all about working on little pieces at a time and not worrying about knowing everything.

It has a lot of problems, but so does every paradigm. I've become a huge functional programming fan over the last couple of years, but I can tell you very frankly that nothing beats OOAD. Nothing. It is a gift from the gods. It allows you to take any problem and make it trivial. Large amounts of wiring will be required.

The thing here is that as you start generalizing OOP, you being making this bastard thing that is part OOP and part FP. Or your codebase runs off the rails and becomes a hodgepodge of junk. Or you enter into the "Kingdom of Nouns". The ways to screw up are legion.

Dependency issues are also a freaking nightmare in OOP. That's why OOP and some sort of TDD go hand-in-hand.

I'm mostly with the author, but I don't think he understands the full extent of what he's talking about. OOP (and TDD) is a great tool for large, complex, shared codebases. Even though I'm a huge fan of FP, I remain very skeptical that it can scale well to 100+ developer efforts. I think to truly criticize something like this, you should know both how it's awesome and how it sucks, not just how it sucks.

<comment><USER6> i read your post twice because its the top comment from my view, and while I see you wrote a lot, I don't think you actually said anything. are you interested in clarifying?

<comment><USER5> Sorry about that.

Here's the underlying philosophy of OOP not covered by the original article [philosophy described]. Here are some strengths not covered by the original article [salient points covered].

Author managed to share his frustration with the structural details of the paradigm without conveying that he understood the bigger picture of its actual effective use.

That's a recap. Work any better for you now? Or did you not understand my description of how the philosophy works or what the strengths were?

<comment><USER7> dustingetz's criticism was a bit harsh, but I kind of agree with him. You aren't concretely illuminating how those qualities of OOP (or OOADP) are advantages or are unique to OO. I would really value more clarification from you on this, given your prolific HN presence and experience. I genuinely want to learn more about this (see my other comment in this thread), but I've struggled to find really good, motivating examples in the past.

> nothing beats OOAD. Nothing. It is a gift from the gods. It allows you to > take any problem and make it trivial.

I'm supremely skeptical of claims like these. I could say that same thing about... anything. But that's just not enough.

> Or your codebase runs off the rails and becomes a hodgepodge of junk. Or you > enter into the "Kingdom of Nouns". The ways to screw up are legion.

So how do you avoid this? How can I develop an intuition about good OO design?

You talk about TDD a bit, but you can do TDD with functional programming too, and in many ways it's easier (less need for mock objects and dependency injection, which are as good an example of _incidental complexity_ as I can think of).

> I think to truly criticize something like this, you should know both how > it's awesome and how it sucks, not just how it sucks.

Yes! Please, help me learn how awesome OOP can be, and get to a place where I can criticize OOP more brutally. ;) Seriously though, what open source code or books would you recommend? I looked here:

[http://hn-books.com/#BC=0&EC=0&FC=0&Q0=11&QC...](http://hn- books.com/#BC=0&EC=0&FC=0&Q0=11&QC=1)

... but it wasn't clear to me which of these books would be best. Many of them are a bit too specific.

The functional programming proponents who have convinced me most are Clojure people. Rich Hickey's simplicity talk, his talks and mini-essays on state and time, Stuart Halloway's similar talk on simplicity, the idea of values over identities, dealing with basic data structures (maps, vectors, sets) over burying data in classes and domain specific APIs, separating out OO features to get "OO a la carte" ... it's very compelling stuff, and most of it is about striving for _simplicity_ and tearing out unnecessary complexity. That's where I'm coming from in my skepticism of OOP, because most of it seems to make things more complex than they need to be, with not a lot of gain.

On the other hand, I'm pretty green, so I know that much of this could just be naive fantasy, since I've never had to deal with massive codebases being hacked on by 100+ programmers, neither in FP or OOP languages/styles.

<comment><USER5> So whenever I post on OOADP, seems like everybody gets in a bit of a snit with me :) (not you, just a small minority of the community. Perhaps these are dangerous political waters!) But I'll explain a bit more. Please remember, though, that this is long-format material. I have serious reservations about being able to explain myself or convince anyone of anything in an HN thread. But I can certainly share my perspective.

Like I said, I'm becoming a huge fan of FP -- to the point I'm really not interested in doing a lot of OOP in the future, and I did OOP for many, many years. But that's because I work with small teams mostly.

OOP is all about the organization of the ontology of the problem domain. It's about gaining a common understanding of a general organizational philosophy that then can be scaled and coded. In OOAD you start with simple conversations and slowly created complicated structure where everything has a place. It's this process of being able to take any problem and create a complicated place for everything that is both OOP's strength and weakness.

I started with the Tao of Objects <http://amzn.to/KHE5TK> and the Coad Yourdon books <http://amzn.to/IS9fqj> and <http://amzn.to/IS9oKh>. I still like these because they focus more on how to mentally approach OOAD instead of the details of coding. People get lost in the details here instead of learning the key skill: _how to think about problems_. (which is useful no matter which type of language you use)

The best way to describe OOAD is "applied philosophy". That is, you are taking a world known only to the customer and translating it into machine code. On one hand we have the slipperiness of language and the fuzziness of human thought. On the other hand we have hard science and boolean logic. OOAD gives you a game plan for making that journey in an easy-to-use manner. FP is not like that. FP is more like building a compiler for whatever the problem is. Same result, but the thinking process is completely different. OO is concerned with top-down. FP makes little blocks and then fits them together into bigger units. In OOP you might spend a lot of time on structure without ever writing any code that does anything at all. But when you _do_ write something, it's already broken down into tiny digestible pieces. In FP I always feel like I'm carrying the linker around in my head. :)

In some problems, it's more important to gain immediate functionality than it is to worry about scaling your code or development team. Startups are mostly like this, and FP and startups go very well together. In some problems, however, it's more important to have clear areas of responsibility and an overall plan for life, the universe, and everything. Large government or corporate projects are like this. The organization of the code units into something mirroring the domain model allows planning at a much larger scale.

As I get older I realize that I was a bit of an architecture astronaut in my younger years -- always creating a structure much more complex than was actually needed. But I also note that these projects usually went off without a hitch. We were able to hire "normal" programmers and we were able to hand the code off to "normal" maintenance programmers when we were done. OOP, to me at least, is much more about the people part of programming than it is the technical part. FP guys are always making these technical arguments about their language, and they miss the point entirely: the problem that OOADP solves isn't a technical one, it's an organizational one. Where does stuff go?

So if I had a large project to do, I'd start with OOAD and then when I got into later design think seriously about which parts would deploy better FP or OOP. The browser code is going to need some kind of namespace, which is usually done with objects in Javascript. Talking from the browser to the server looks entirely functional to me. The back-end gets a bit tricky. There's nothing like a normalized database model for data analysis, but creating a business and database tier looks counterproductive in some cases. It'd depend a lot on the circumstances.

<comment><USER7> > So whenever I post on OOADP, seems like everybody gets in a bit of a snit > with me :) (not you, just a small minority of the community. Perhaps these > are dangerous political waters!) But I'll explain a bit more. Please > remember, though, that this is long-format material.

I appreciate it, and I recognize that there's sometimes a bit of knee-jerk snittiness that can come across in these OOP vs FP debates, including in my post. If you've written about this in a longer format somewhere else, or plan to, I would be interested.

> FP makes little blocks and then fits them together into bigger units. In OOP > you might spend a lot of time on structure without ever writing any code > that does anything at all.

This is getting closer to the crux of things. The bottom-up FP style just fits my own workflow and habits better. Spending a lot of time building structure without writing code that does anything seems like dangerous premature design. Thinking about the problem and about problem solving ahead of time is important, but I'm not sure that building structure is.

> In FP I always feel like I'm carrying the linker around in my head. :)

I'm not really sure what you mean.

> OOP, to me at least, is much more about the people part of programming than > it is the technical part. FP guys are always making these technical > arguments about their language, and they miss the point entirely: the > problem that OOADP solves isn't a technical one, it's an organizational one. > Where does stuff go?

I think it's possible to answer this question in a functional program, as another commenter said, Clojure namespaces provide an answer to questions like "where". I think bigger picture design like MVC can be useful here, see ClojureScript One for one (relatively simplistic, but very interesting nonetheless) example.

So I guess if OOP/OOADP is about solving a nontechnical problem, my question would be if we can solve those same social problems while writing FP code? If we want to avoid object oriented hierarchies and graphs that are interconnected and _complected_ , can we still address the social and nontechnical problems you think OO solves? Surely that's possible? It seems that relying on OO to solve these problems drags in an awful lot of baggage (like introducing a lot of mutable state that is problematic for very technical reasons).

Thanks for the pointers to those books, I'll check them out.

<comment><USER5> "... can solve those same social problems while writing FP code? If we want to avoid object oriented hierarchies and graphs that are interconnected and complected, can we still address the social and nontechnical problems you think OO solves?..."

I believe that's where functional OO languages like OCAML and F# come in. Do your OOAD, then construct the code functionally. Once you realize you're not going to refactor, start grouping into classes. Your OOAD helps drive your data structures out. Actual code and functionality drive your class structure.

But what I'm finding is that both FP and OOP code evolves into a DSL; FP more directly and OOP in a more roundabout manner. If that observation holds up, then what we're really talking about with organizing code is creating layers of DSLs, not tiers of functionality. If that's the case (and it's a big "if") then something like a code budget and insistence on DSLs as a desired end- state might be the best way to balance both scalability (in terms of team size and effort) and complexity.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Ok, so there are a few comments claiming that this kind of revelation only seems valid because the author hasn't seen OO done right, or has only seen bad OO code. As someone who has gone through a similar shift and feels disenchanted with a lot of the OO code I deal with on a daily basis, but is still very much aware of my own inexperience and naivete, I'm wary of these claims but I'm curious.

So what's some really great, clean, elegant object oriented code that I could read to better understand what makes up good OO design? What are the books one should read to develop a deeper understanding of OO's qualities? It doesn't matter what language or platform they focus on, since I think the fundamentals ought to be independent, and I'm willing to work hard. Rails internals, Django internals? Some Java framework? Or is there some awesome piece of Smalltalk code out there that demonstrates the roots of OO? Is the Gang of Four book still relevant? Where do you go for getting the bigger design picture?

For context, I've done a lot of Java (Android) but I don't think I've been exposed to good large scale design in Java (I've read Effective Java and Java Concurrency in Practice, but both of those deal with the nuts and bolts of programming in the small) Most of my functional programming experience is with Clojure, which is very opinionated and takes a radical approach to OO, and I think the bar has been set kind of high by Rich Hickey.

Please don't tell me to go get a job at Google or your company where the code is beautiful all the time; that's just not fair.

<comment><USER8> _there are a few comments claiming that this kind of revelation only seems valid because the author hasn't seen OO done right, or has only seen bad OO code_

That argument is also known as, "No True Scotsman." People regularly jeer at it when process proponents defend their practices by saying "Yes, that project failed, but you weren't doing Waterfall/XP/Scrum/Spiral right." But there's no reason why we shouldn't poke it with a sharp stick when defending a technical argument. If so many people are "Doing OOP Wrong," shouldn't we have serious reservations about it?

I'm sure that if we pick any practice, we can cherry-pick and find some great code written with it. But what good is it if such examples are rare?

<comment><USER9> Just as you might dismiss the arguments as "No True Scotsman" you could dismiss the original post as anecdotal evidence. The presence of a fallacy does not directly affect the truth of the point being made.

<comment><USER8> No, but if all the arguments for and against boil down to anecdotal evidence and fallacies, why are we bothering with a discussion at all?

</comment></comment></comment></comment><comment><USER10> This seems to be yet another example of the "X sucks because you can write bad code in X" argument, which is not really that interesting.

</comment><comment><USER11> I would say OOP for OOP's sake became a lot more common with the increase in popularity of Java. The euphoria of automatic memory management vanished with the increasing complexity of design patterns.

In most of the cases they are applied for any scenario that even slightly resembles a design pattern, with most of the energy expended in fitting the scenario into a pattern than to find the correct solution.

</comment><comment><USER12> For most people OOP is basically synonymous with earlier C++ and now Java.

Now wonder people are frustrated, modifying a large project or doing any thing trivial requires the help of a IDE loaded with Intellisense goodies to help you navigate through levels and levels of abstraction, often you will have no clue what each layer does. This is good for reading but bad both for writing and maintaining code. I have often had to end scratching my head figuring out what a certain middle layer of code does. I am sure most people are generally lost figuring out the layers below AbstractClassFactoryFactoryFactoryFactory.java and can't really understand why there is method Something.SomethingElse.AbsoulutelySomethingElse.WhereAreWe.finallyWeMadeit() like that.

OOP in principle in itself is good but unfortunately the languages that it gets expressed really makes it case very weak. Every time I see a Java application with 90% of the code being try/catch statements, get/set methods and XML DSL's - I cringe. Every time I have to spend 30 mins trying to figure how to configure and use a logger I get totally lost.

When I think of OO the worst parts flash in front of my eyes.

</comment><comment><USER13> I had a very similar revelation to the OP in the article. Coincidentally, I also happened to be writing semantic analysis for a compiler using the visitor pattern.

From this I can conclude two things:

\- It's definitely the wrong choice to do abstract syntax tree traversal using the visitor pattern. But what would be a better choice? When using Java?

\- Writing a compiler can be a life changing experience.

These days I call myself a recovering object oriented programmer.

</comment><comment><USER14> A couple of excellent reads for arguments against OOP:

<http://c2.com/cgi/wiki?ArgumentsAgainstOop>

<http://c2.com/cgi/wiki?ObjectOrientationIsaHoax>

Personally, I'm on the fence, but I think as is the case with most tools, there is a right and wrong place to use them. The trick is figuring out when that is.

<comment><USER15> What I really want is to write functional code in a way that looks like OOP. OOP is so simple and straight forward in comparison, it just results in code that is not scalable or easily maintained.

</comment></comment><comment><USER16> I do think that FP IS a snake oil fad and unsuitable for 90% of all code, which is all about mutable state and IO: manipulating data bases and game worlds, writing and reading files, sending and receiving network packages, user interaction etc. all of which is awkward in FP.

Back then OOP was paraded around as the silver bullet of software engineering some people rightfully pointed out that many problems do not map cleanly to OO abstractions. People tried to force all code into that straightjacket anyway, most infamously Java, and thus we ended up with things like "Singleton"s and "AbstractFactoryFactory"s.

Yet OOP was a success, because most problems can be expressed in a decent to good way using that paradigm, and it forced some structure on bad programmers. In contrast, most problems can not be expressed in a straightforward way in FP and the advantage of forcing structure on bad programmers is mostly gone.

I think the current FP fad is actually an unfortunate side effect (pun intended) of the OOP craze. All these younger programmers who learned programming with Java, who had to write all that AbstractFactoryFactory "Enterprise Java" code, they see FP examples and think they have seen the light.

As the article almost admits, FP is basically a restricted subset of procedural programming. However, while these people were taught that "procedural programming" is an archaic evil and everything must be wrapped into classes by their Java schools, nobody told them that about FP (because the instructors probably did not even consider/know it). So now they can enjoy the simplicity and freedom of procedural code without the feeling of being "politically incorrect".

However, as I said, FP is simply unsuitable for most real world problems. The problematic thing about Haskell is not understanding monads, it's that they are necessary! They and other constructs like that are the "Singleton"s and "AbstractFactoryFactory"s of FP - what happens if you try to force something naturally "unfunctional" into a functional straightjacket.

The right solution is multi-paradigm programming. Use FP where it makes sense, don't use it where it doesn't.

<comment><USER17> Read "Tackling the Awkward Squad" paper by Peyton-Jones et al.

<comment><USER4> Link for the lazy:

[http://research.microsoft.com/en- us/um/people/simonpj/papers...](http://research.microsoft.com/en- us/um/people/simonpj/papers/marktoberdorf/mark.pdf)

It's a good bit of writing, that.

</comment></comment></comment><comment><USER18> This sounds like OOP gone horribly wrong. OOP isn't for the code's benefit; it's for _my_ benefit.

Some problems can be easily thought about in terms of independent objects; it makes it easy to work out the solution, and to code an elegant, coherent solution. Some problems just don't suit that kind of thinking. Applying OOP to something it's not suited for and then blaming OOP for the resultant mess is just silly.

</comment><comment><USER19> I prepared this whole rant about how displeased I am with your article and how it doesn't really say anything. Instead I want to recommend that you try Objective C.

You can do most of the string, dictionary, array things using immutable objects, which is nice, and the mutable things like windows are usually used to hold state like positions, colors, etc., and so it's easy to conceptualize what you are mutating:

NSRect frame = [window frame]; frame.origin.x += 5; [window setFrame:frame];

Singletons are rarely used, mostly for what is basically an event responder (called the application delegate), and objects that are basically a way to group functions (NSFileManager to do IO functions, NSNotificationCenter to send application-wide events).

They've even got a first-class function object.

I have no desire to use Java, and it seems you don't either, but I think you should consider other OOP languages. It's fine to prefer functional programming (I sure do) but if you don't get the visitor pattern, I cannot help but think you don't know enough about it to write OOP off entirely.

</comment><comment><USER20> I think part of what might be going on here is that OOP patterns incur a large upfront cost in complexity, but the hope is that it will payoff later when it comes to maintaining and extending the code. For example, the visitor pattern he talks about might seem needlessly complex. Why scatter the logic for a recursive tree traversal across several classes when I could do it here, all in this one function? The response, of course, is that once the program starts to grow, and you want to write other modules that traverse that same structure, you won't have to copy and paste that same logic everywhere. Simply write another class that conforms to your visitor's interface. So, this reduces code duplication, and decouples the operations your performing on the tree, from the way that you're traversing the tree.

Another issue is that static type systems often make OOP design patterns seem more complex than they really are. Compare, for example, Python's visitor ([http://pythonwise.blogspot.com/2006/06/visitor-design- patter...](http://pythonwise.blogspot.com/2006/06/visitor-design- pattern.html)) with Java's (<https://en.wikipedia.org/wiki/Visitor_pattern#Java_example>). Python simply uses reflection to pull out the right visit method. This is almost a one- liner. Java, on the other hand, needs a complex double-dispatch setup to please its type system. Now, I'm not saying that Python's approach is better. There's a trade off involved, and, in fact, it's the exact same trade off as before. Python's approach is simpler at first, but, once your program starts to grow, you might find that catching type errors at compile time is a very handy feature indeed.

Also note that functional programming isn't without its seemingly complex design patterns. Monads are the obvious example, but there are many more: <http://www.haskell.org/haskellwiki/Category:Idioms>

</comment><comment><USER21> Have you ever worked on a project with millions of lines of code which is supposed to work together as a single piece? That is where OO is required. OO works when you design your system to be composed of blackbox components. Right level of abstraction is the key. Facades must expose blackbox functionality to other components. You are never to look into the innards of a component (the whitebox model do not work). These days the WEB CRUD apps do not require OO as each service rarely exceeds few hundred lines and they never work as a monolithic piece. But once you put your head into a Telecom Switch, a flight control system, an MRI scanner - OO is the way to go.

I think these days exponents of so called 'Functional Programming' just oversee the importance of abstraction in OO and try to use it in CRUD apps where it is clearly not warranted and then hurl abuses. Get a Life!

<comment><USER7> Aren't some (many?) telecom switches run with Erlang? I haven't used it, but from what I understand it's more functional than OO, is it not?

<comment><USER22> Freeswitch and Asterisk are both written largely in C, although it's unclear if that's representative of industry practice.

</comment></comment></comment><comment><USER23> Surely this criticism extends to any information hiding mechanism in programming? You could do exactly the same thing using closures.

I happy to talk about the flaws of OO programming, but I'm not convinced that allowing you to have encapsulated private state is one of them.

</comment><comment><USER24> If you write classes that have methods that can change a non observable state of the class then you have followed the wrong path. Not at all sure that functional programming will prove a cure though.

</comment><comment><USER25> I love my share of anti oop rants and hoped for some functional praise.

Unfortunately I couldn't read the article on my mobile, because someone decided it would be a great idea to have floating social sharing gizmos covering the content. It's totally unreadable right now.

</comment><comment><USER17> After author graduates and writes some production code, please post a followup that shares the experience and says more than "college is harder than high school"

</comment><comment><USER26> I see OO as a way of imposing model constraints in a problem domain... there may not necessarily be a need for objects to maintain state.

</comment><comment><USER27> That can go both ways I guess. You can do OO right, you know?</comment>


Ask HN: How should I store passwords? - <AUTHOR>

I've been told to "use bcrypt", but is bcrypt really all that stronger?
All the arguments I have seen in favor of it simply argued that it is good because it's slower than crippled molasses going uphill in January, but with a well-secured NoSQL and a properly rate-limited login system, is that really necessary?
I've been looking at SHA-512 with multiple salts, but what do you use or suggest I do?
EDIT: Just an FYI, we're a startup that will be dealing mostly in accounts of the social network variety.  We will deal a bit in financial info, but mostly just user data. <comment><USER2> If you think it is unlikely that you will leak your NoSQL database, a quick mental comparison for you: how many man-years have gone to hardening the protocols for access to your NoSQL database? How many have gone into hardening the protocols for, e.g., MySQL? How many MySQL dumps made it to the Internet last year?

Use bcrypt. It upper bounds the loss of your database at somewhere below "Most of my users get their email accounts and bank accounts compromised."

<comment><AUTHOR> SQL is text-based, and therefore injections are far easier. NoSQL (specifically Mongo) does not generally just plug user-provided info into a string, and is therefore secure against injections.

Age does not matter. In many cases, youth can even be beneficial, since it can include more modern techniques.

<comment><USER2> You're being overly restrictive in thinking of the attack space. For example, do you think keys in your NoSQL engine of choice necessarily always work out well if they include malformed Unicode characters? Do you think all buffers are safe? etc, etc

Talk to tptacek about this if you think NoSQL means No SQL Injections So I'm OK.

</comment></comment></comment><comment><USER3> The mathematical strengths of bcrypt vs SHA-2 are totally irrelevant.

SHA-512 is plenty big enough to require age-of-the-universe-scale CPU-effort to crack. For what it was designed for. But it _simply wasn't designed for storing short bits of text like passwords_. Anyone using it for that is using it wrongly, and has built a system that is _far_ , _far_ more prone to cracking than the theoretical strength of SHA-512 suggests.

Once you go beyond even basically competent crypto, the _only_ thing that matters is how fast you can try likely passwords.

For passwords, SHA-512 is no better than MD5, because though MD5 has theoretical issues, no sane person will ever do a math attack on MD5 to crack your password, when they can just try all combinations of likely passwords in a few seconds or minutes.

And SHA-512 is no better than MD5 if I can try passwords at the same rate. Because I'm going to guess your password in the same amount of time. Even if you had a SHA-65536. The _only_ practical reason SHA-512 is better for passwords than MD5 is that it takes a good chunk longer to calculate (but _not_ long enough!).

So it is the _rate_ of hashing, not the 'power' of the algorithm you need to worry about. And that is why bcrypt is what you should use. It isn't that it is stronger crypto, strength is irrelevant: it is _slower_ crypto. And that's what you need when you're handling passwords.

As for 'we have a secure db and rate limited login' - why not use plaintext passwords then? SHA based hashing is only a few days CPU more secure than plaintext for short passwords. In both cases you're banking on nobody having access to the database. If you can guarantee nobody has access to the database, and you're rate limiting your logins, then why not use plaintext? No. You use password hashing explicitly because you can't guarantee db security. So use the right tool for the job.

tl;dr - Use bcrypt, it is many orders of magnitude more secure than SHA-2-based approaches.

</comment><comment><USER4> No matter you smart you think you are a bad guy might end up with your user table one day, and on that day you'll hope he can't crack your passwords easily.

You can control how slow bcrypt is by specifying the wok factor variable. In this context "slow" is maybe 100ms to check a password. This shouldn't be a problem on almost any web site.

Use bcrypt.

<comment><AUTHOR> But I'm wondering, does increasing the work factor actually make the algorithm stronger?

Am I still risking bcrypt being cryptographically broken?

<comment><USER4> Increasing the work factor makes it slower to check a password, that's all. Your home grown SHA-512 algorithm is more likely to be broken than bcrypt.

</comment></comment></comment><comment><USER5> This is generally considered the best summary of the topic and bcrypt is strongly encouraged, to say the least: <http://codahale.com/how-to-safely- store-a-password/>

I don't think the concern is so much hacking your login than it is what happens if someone grabs your user table.

That said, I suspect what you are proposing is stronger than average even among the HN crowd.

</comment><comment><USER6> May i suggest my own secure system: It is well known that the weakest part in any security system is the password, not many remember them and most of the people (especially the average ones) just hand write them and stick on the monitor. Solution- create a system of your own inside your brain to remember a password, do not use a software, application, stick note or else. use your own brain.

</comment><comment><USER7> bcrypt vs SHA-something is a cryptographic decision. You've already decided to store hashed & salted passwords, great! However now you have a decision to make about which is the better cryptographic system. Listen to what the cryptographic expects say about that. They don't say use SHA.

You site might be just a simple "social network site, nothing serious like banks", but loads of people use the same password for their email. Once you have someone's email password, you have the keys to the kingdom.

<comment><AUTHOR> The problem is, I've actually not seen anything arguing that bcrypt was cryptographically stronger, only thing arguing it was exponentially slower.

<comment><USER8> Isn't that enough of a reason to use it?

It (currently) doesn't seem likely that either bcrypt or SHA-something are going to be busted open by a flaw in the algorithm.

On the other hand, the fact that bcrypt has a large work-load makes it significantly less likely to be broken by someone running a cluster of GPU- equipped EC2 instances.

Let me ask it this way: What reason do you have for _not_ using bcrypt considering everyone seems to suggest it? Do you worry that it's too slow? Or that the implementation is weak? Or something else?

<comment><AUTHOR> I'm worried that the system is too slow for too little benefit. I'm also worried the CPU usage might also be higher than a simple SHA-2 hash.

I also worry that it's not really as "future-proof" as people seem to think. Every algorithm gets busted open eventually, given Moore's Law, they can try more ways faster. Plus, once we have quantum computing, all the cryptographic algorithms we know and love are busted wide open. Hell, AES has been busted already in quantum computing!

</comment></comment></comment></comment><comment><USER9> Don't store passwords. Use OpenID/OAuth/XAuth, etc.</comment>


I'm young, inexperienced and a perfectionist - <AUTHOR> https://medium.com/p/19784e23163b <comment><USER2> 56 instances of the word "I". That's your problem. All the rest is fluff.

OP, try rewriting this, substituting "he", "she", "they", or "you" for "I".

Funny how quickly your perceived problems melt away as soon as you stop dwelling on yourself and start focusing on others.

Edit: I realize that OP is being slightly sarcastic, but I took this as an opportunity: This is a condensed version of pretty much the same feedback I've been giving people struggling with themselves for years: It's not about you! As soon as you get that, you can move on.

A recent instance:

[https://news.ycombinator.com/item?id=5763484](https://news.ycombinator.com/item?id=5763484)

<comment><USER3> Wasn't the OP's intention to write about themselves though? Changing I to he/she etc doesn't seem like it would make much sense? Could you expand on what you mean?

<comment><USER4> It's irritating when you read a narrative that is very heavy with personal pronouns, because you generally are reading a bunch of declarations strung together. As a reader, you're stuck wading through the muck to figure out WTF is actually being said. The whole point of introspection is to examine your actions and reach conclusions. Nobody cares about the minutae. If you're describing a trip to Tahiti, don't make me read about how you fed the cats and cut your toenails before heading for the airport.

For example:

"We opted to go for a web app purely because I was the most familiar with this platform but even then I had no prior experience and my friends were aware of this. I would be balancing my time between this and a well paid part time job at a local school as a music technician."

56 words and bunch of fluff. It sounds like a deflection of guilt.

What does it actually say? "I already had experience with web apps, so we decided a webapp would get things done quickly."

<comment><USER3> Good example, my issue was really that the suggestion of changing I to he/she etc by edw519 was overly flippant and added little value to the OP; who probably liked constructive feedback - nice job on clarifying

<comment><USER4> Writing is a craft like programming in that you must learn by doing, and you need to leave rough edges behind to polish. My writing ability was "leveled up" by merciless teachers who would torture us with seemingly impossible tasks.

One of my favorite teachers ever was a History professor who taught "The History of Warfare". Writing assignments were due every week and covered a fairly substantial scope. The catch: It had to be written by hand (this was 1998) and had to fit on one side of a sheet of college-ruled loose-leaf paper. The first draft of my first paper was 6 pages long, and took about 3 days to proofread/boil down to what it needed to say. (I still remember way too much about Gustavus Adolphus because of that.) By the end of the semester, I was able to whip out a single sheet in about 45 minutes. I learned alot about the history of warfare, but learned far more about clarity of thought and getting to the root of things.

</comment></comment></comment></comment></comment><comment><USER5> Here is a td;lr.

I keep on making the mistake of throwing away what I've got and starting over because I've learned how to do things better. I've just made this mistake again, but it's better because I've learned how to do it better this time, honest.

My response to this.

Don't write the retrospective bragging about what you've learned until after you have demonstrated success in a measurable way. I've encountered the described failure mode in other people, and unwarranted optimism about recent improvement is part of the pattern, not a sign of actual progress.

(Let me throw out a long shot because it is easy to investigate, and if true would potentially let your life be changed for the better. The person that I am most specifically thinking of that fit this pattern later turned out to be manic depressive. This article describes specific events that could fit as well. So..unlikely, but with a big enough potential payoff that it is worth a visit to a competent psychiatrist.)

<comment><USER6> Also: I chose ruby on rails because it was hip. Then I chose node.js because it was hip. Now I'm evaluating those choices as mistakes because they were hip, because _that 's_ hip.

Get a job, get on a team, write code, and stop reading about writing code!

</comment></comment><comment><USER7> Jesus when i read this Article I see me... I love to start new Projects but i never finish them(only when i must because i customer is kicking my ass)... I always have a lot of motivation... but when i sit down and must read or do something i lose focus very often and maybe work on it for 30 minutes or 1 hour and then i start to watch some stupid youtube videos...

To this day i dont know how to focus... I got depression last year because... i dont know everything was not going the way i wanted but i dont changed anything... today i feel better but i still cant get things done... i was reading books/blogs/etc about how to organize/focus/motivate but nothing every really worked for me... not money/fame/etc helped to motivate...

maybe someone can help or share tips... and if you want dick around you can but i want answer or comment you...

<comment><USER3> A way I have found to get round this is to set small, achievable milestones, it sounds like you are getting caught up in the "enormity of it all" \- when we started our company the aim was "to enter competition X", then "get £5,000 in grant funding", then "3d print a prototype", then "build a test rig to test prototype", then "raise some investment", then "get a professionally designed product", the "set up 1 trial with potential customer", then "launch to public" etc.

By breaking it down into small steps and focussing on the next achievable goal (we actually went even more granular than this but you get the idea) you don't get swamped, and if it all ends and you fail to hit a mile stone then hey, at least we hit 5 out of 6 or 10 out of 11 milestones (depending on when/if you fail).

We're still going 2 years later using the same process and it works really well

<comment><USER7> thats smart ! thank you. so basically you started to plan things better before you started them

<comment><USER3> Essentially yes, but rather than plan the entire thing - just plan the next 1 or 2 steps and make sure they work toward the main objective

<comment><USER7> okay i think i got it. focus the goal. break it into milestones and break the milestones into small steps but only plan the next 1 2 steps

thank you !

</comment></comment></comment></comment></comment><comment><USER8> This is how everybody learns - you make something, see the flaws in the process or the outcome, and then iterate again to fix them. Your technical approach to it is perfect, just keep it up.

However, you've missed the key point in the game - hustling. By the sound of it, you were not picking up a paycheck while doing this for 2 years. This is a major mistake. The product itself doesn't matter - if you're inexperienced the product is going to end up pretty bad, so the exact product you're building is largely irrelevant. The key is to hustle yourself into a position where someone is giving you money for you to learn. Late stage start-ups are usually perfect for this. You've wasted two years of potential income and fancy sounding positions for your CV, don't waste a third.

<comment><USER9> I disagree with you that the product doesn't matter. I've worked at a few startups and it really matters if everyone can get on board with the vision of the company's leadership. It improves your concentration if you think you're actually making a positive difference in people's lives with every feature you develop or bug that you fix. And it improves team motivation and cohesion if you all think that what you're building is a really cool idea.

TL;DR Adding a feature to a product that you don't care about is harder that adding a feature to a product that you do care about.

<comment><USER10> It's a cost-benefit analysis. As a completely entry-level developer, I could a lot of time trying to find a company whose product I believe in that will hire more, or I could spend that same time working for whoever will cut me a paycheck, and be in a much better place to decide what I care about working on once I have a bit of actual experience and money in the bank.

It would be lovely if you could just walk into a meaningful project that you care about, but that's not how it works in the current system.

</comment></comment></comment><comment><USER11> That's why I still use vanilla PHP & Postgres for web projects. I don't use any hot new technologies, I don't use frameworks, I don't do unit testing. I try to use as little client side JS as possible. Whenever possible, I use static HTML.

The advantage is that I can create a working prototype in days. I can show something to the client very early, and I don't spend months to fulfill specifications the client didn't really understand in the first place.

When I leave the project, any PHP developer will be able to pick up and implement changes within hours. My code isn't elegant in any way, but it's simple.

<comment><USER12> I hope no one looks at this as advice... I was in this position for a long time, and looking back, it's a completely unsustainable (and, in my opinion, irresponsible) method of development.

Problems with PHP itself aside, rolling your own from scratch only ever works out well for projects that start small and _stay_ small. Even if the code is sane and readable, a developer starting with a site like this will need to understand either all of the patterns that are being used or to read and understand _all of the code_ before being able to confidently and effectively work with it.

Contrast this to a framework, where similarly-sane code will yield something anyone with experience in the framework can almost-immediately begin working with.

Both have an up-front cost; however, the first incurs that cost _every time_ any new developer starts working with _any project_ done in such a way. The second is incurred once, period, making the startup time on any project on the same framework dramatically lower.

Frameworks are by no means a silver bullet, but their utility should not be underestimated, and the very nasty maintenance cost effects of the parent's post should be similarly understood.

<comment><USER11> The most important thing about a codebase is how it is designed at a large scale, its architecture. Using a framework often dictates a specific architecture, and this might lead to more manageable code bases.

But you can come up with a clear architecture without using a framework. For example, most projects I work on are well suited for a modular design. I can build them from many small, independent parts. So I write lots of PHP scripts consisting of some SQL queries on top and some presentation logic below. Introducing an ORM and separating Model/View/Controller would just add unnecessary complexity!

In my case, modularity ensures maintainability; there's no need for anyone to _read all of the code_ before they can start working on something. Reading all of the code is only necessary if you write spaghetti code; but inexperienced developers will have no problem writing unmaintainable spaghetti code using any choice of framework!

</comment></comment></comment><comment><USER13> Sounds like you learned a lot. The only problem here is the lack of shipping—that is what made you feel like a failure. Psychologically it would have been better to have finished a crappy v1 then do a rewrite in a new language for v2, but in practice you probably learned an equal amount this way, so cut yourself some slack.

And remember, being a perfectionist is a prerequisite for being good at anything. If you aren't self-critical you won't improve, and no one comes out of the gate being good at anything. Obviously that's necessary but not sufficient since many people are disheartened by their early incompetence and give up before they've even really gotten started, but it's not a bad thing.

</comment><comment><USER14> I think coding kinda forms us to be perfectionists, because a small mistake can disable entire programs.

I'll share my epiphany that I've learned from HN that PG said...if we're not embarrassed at launch time, it's too late. Being a perfectionist my self, it's a brilliant statement.

<comment><USER15> Reid Hoffman, founder of LinkedIn, has a similar quote, "If you're not embarrassed by the first version of your product, you've launched too late." I don't know if one came before the other. Reguardless it's a good sentiment to have. The only thing that matters is launching. You can find the perfect shade of blue for that button after you launch.

<comment><USER14> Funny you mention styling, this is where a lot of my time gets consumed...CSS3 (love & hate)

</comment></comment></comment><comment><USER16> In all seriousness I believe I have pretty sharp Internet sarcasm detection skills but I can't tell without more context how much of this post is sarcasm? If others didn't see it that way, can you re-read it again through a "this is pure dripping sarcasm" lens/filter?

I read it as a sarcastic detailed break down of the excuses new developers use nowadays to justify their lack of discipline. Or.. am I wrong?

<comment><USER17> It's that even more annoying modern invention: post-irony, where the writer doesn't have any faith in their own ideas so they hedge their bets with this strange kind of noncommittal sarcasm.

It is the plague of the modern age, and the real reason why hipsterism is so hateworthy.

<comment><USER16> If possible, I tend to look up words/terms I've not heard of: [https://en.wikipedia.org/wiki/Post-irony](https://en.wikipedia.org/wiki/Post- irony)

... are you saying in my effort in sounding all serious and sincere, that I, in fact, align myself with hipster philosophy and world views?

<comment><USER17> No. Unless your sincerity is merely the surface layer below which there is sarcasm, then another layer of sincerity, then a layer of irony, then more sincerity, and so on to the point where you have absolutely no idea of what your real opinion is, because you never had one in the first place.

Notice how 5-10 years ago, people were wearing ironically bad second hand clothes from the 80s, because it was fun, and it marked them out as "in on the joke." Then over time, that became so much the fashion that the definition of "good" clothes realigned itself to cover these things, so now people are walking around with handlebar moustaches, tie-dye hotpants and wolf moon shirts thinking its completely normal. The lines have been blurred, "good" and "bad" are slowly breaking down as concepts, replaced with "in" and "out."

The only way to escape it is to simply not think about any of it, and have absolute faith in your own objective internal preferences, whatever they are. Aesthetics is the only arena of thought in which fascism is not only acceptable, but morally right. Make full use of this fact.

EDIT - see also: the rapgenius blog currently on the frontpage: [http://news.rapgenius.com/Lemon-how-rap-genius- raised-s18m-i...](http://news.rapgenius.com/Lemon-how-rap-genius- raised-s18m-in-seed-funding-without-knowing-what-we-were-doing-lyrics)

</comment></comment></comment></comment><comment><USER18> I don't remember ever being so utterly inexperienced so as to firstly adopt a platform like Ruby on Rails, and then follow it up by making an even worse mistake in adopting Node.js.

These platforms seem hip and cool but they actually need extreme levels of discipline, awareness and experience to actually use them in the correct way.

I don't think the guy is a perfectionist at all. Perfectionists deliver finished working products. Perfectionism is a state of mind of not knowing when you are actually "finished finished". Don't make the mistake of thinking your inability to deliver a product is because of some perfectionism trait. It very likely isn't. It's more likely to simply be caused by incompetence.

<comment><USER19> "These platforms seem hip and cool but they actually need extreme levels of discipline, awareness and experience to actually use them in the correct way."

Is there a platform for which this _isn 't_ true? Anyone doing anything novel spends most of their time doing things the wrong way.

And it's odd that you single out those platforms -- RoR is extraordinarily beginner friendly, and less than most other platforms helps you stop from shooting yourself in the foot. Node JS with express again is quite trivial. The platforms have literally nothing to do with their problem (the eager platform jumping is a symptom, not a cause), and they would be non- completionists in any other platform as well.

<comment><USER18> They are beginner friendly, sure. But that's almost a bad thing.

As this poor guy found out the hard way. Building what was presumably quite a large system inevitably turned into a sprawling mess that was hard to maintain and develop any further.

There is extreme levels of immaturity in the RoR and NodeJS communities (when it comes to the dissemination of good software engineering principles and practices) and unfortunately this often projects outward onto its users who don't know any better. Hell, it was only a few months ago the creator of RoR was poo-poo'ing the very concept of DI/IoC and therefore SRP. So it's no wonder the poor sods in that community that read his blog as though it's gospel end up producing unmaintainable heaps of crap that ends up having to be scrapped.

<comment><USER19> _Building what was presumably quite a large system inevitably turned into a sprawling mess that was hard to maintain and develop any further._

I'm not trying to be difficult, but for which platform isn't that just as true? I have seen disastrous spawling messes in Java, .NET, PHP, RoR, JavaScript, C++, and on and on. Platforms have a minimal ability to control self-damage, and many of the worst disasters of achieve-nothing projects are built in Java, with all of the best intentions and best practices in the world.

</comment></comment></comment></comment><comment><USER20> I've learned a few things to put a stop to this problem. I think in "engineer" mode. Engineers get things done that work. Creative perfectionists don't. I start a project making sure that I can build and deploy the simplest thing possible. I add one use case that works front-to-back. That gets me everything from the UI to the database. Get user feedback on that one thing, improve it if needed, then go on to use case two. Rinse and repeat. Don't go back and change frameworks, ORMs, languages, etc. Finish the project!

</comment><comment><USER21> When I read the title, I thought, "Hey, that sounds just like me." But after reading it, I realized that his use of "perfectionism" as an excuse is just incomplete. Perfectionism can explain underperformance, certainly. A perfectionist might write half of a timed essay, and the part that exists might be outstanding. But incomplete or slow is generally insufficient when it comes to a job. While he may suffer from a bit of perfectionism, that's not what holds him back; he's simply indecisive and using "Oh, I'm rewriting everything" as an excuse for his incompetence, uncertainty, or anxiety for solving the actual problems. "Rails vs. Node.js" is a contrived, invented problem. It's really easy to blame things on the language or framework when things are tough, but I think everyone does this to some extent; it's not a problem faced exclusively by perfectionists. Wise perfectionists understand that perfection is impossible. I think the best programmers, overall, are both pragmatic and perfectionistic. People just have to get over their overwhelming preference for one or the other and use both to their advantage.

</comment><comment><USER22> This seems so common, but few people can admit it (or even recognize it).

Congratulations on having this level of self-awareness, and I'm sure your future will be bright.

</comment><comment><USER23> It's completely normal to have to start over a few times as a beginner. Learning to code is not trivial, and since you're not going to learn everything before you start writing code, you'll inevitably run into issues that you didn't anticipate.

That said, the OP could probably benefit from planning ahead a little more. It helps to focus on core aspects of the product that are not likely to change and to anticipate things that you might want to change. At first, it may be a little hard to hold your entire project in your head at once, but once you've broken it down into a few core components, it becomes much easier to think about things going forward.

It sounds like the OP is already arriving at these realizations, so good luck to him!

</comment><comment><USER24> This is how learning works. Don't beat yourself up about it. Very few people successfully build perfect software products their first time out. A person should start out by aiming for the stars and failing -- that's how you figure out how reality works.

</comment><comment><USER25> > I am not very focused and easily distracted.

Unless you are embellishing, get checked for ADHD.

Disclaimer: I have ADHD and OCD.

<comment><USER26> I'm not ADHD. I do, however, love chasing rabbits right into their holes. And exploring the intricate network of passages they've made.

What I mean is that as I search for a solution in the API docs, I stumble across other things that look interesting. Or bits of detail that further explain how this library is built. Or explain the dependence of this function on a specific language feature. It's fascinating. And ultimately, that information makes me a better coder ... but it seldom solves the immediate problem. And now I've got all these ideas for new projects. Or ideas for future features for _this_ project. I feel _focused_ (on obtaining my goal) but distracted.

Or maybe I'm building a new system. But to support feature F, I need this library. To serve feature Q, I need that daemon. To support that daemon, I need a database engine ... but nope, it doesn't support PostgreSQL. To support the database engine, I need a logging daemon with feature L that the bleeding edge metagammalogd doesn't offer. And why am I building all this again? At this point, I'm feeling not focused and also distracted.

<comment><USER27> Are you sure? I came right into the comments and did a Command+F for "ADHD", as this is what I thought as well.

Know that all types of ADHD aren't the same, and specifically that there is ADHD without the outward hyperactivity. Look up "Inattentive ADHD" \- I am 30, and up until this past year I just thought that I had issues with procrastination, lack of follow-through, and was easily distracted.

Does this sound like you?

\- Underperformed in school, despite being incredibly bright.

\- Frequently didn't complete homework in school.

\- Easily distracted.

\- Shifts from one uncompleted task to another.

\- Frequently skips large sections of text when reading.

\- Procrastination.

\- Frequently switches jobs

<comment><USER28> That sounds exactly like me, but I don't skip large sections of text. I also read and think and talk about programming a lot more than I do it. At work I don't have this problem. The work place establishes the focus, which is hard to maintain at home.

Anyhow, why should one get a diagnosis for ADD/ADHD. What difference would it make for a 20 something?

<comment><USER27> At least for me, just understanding myself better has helped me cope with the difficulties I have.

</comment></comment></comment></comment></comment><comment><USER29> I experience this right now!

The saddest paragraphs were "Time to change" and "Learning from your mistakes", where he basically says that he is doing the same thing under a different name with the same lack of results :(

</comment><comment><USER30> Nice write up. I think many people face the same problems me included. The problem for me is that I have never had a chance working in a team with more experienced developers. Which would teach a mindset, or bring some insights, of successful developer, which is implement the feature then return and improve as needed. Also solving so called "complex" problems brings rush of pleasure. So you start solving complex problems instead of getting the stuff done.

</comment><comment><USER31> Poor guy. You are supposed to learn in your off time while taking home a cushy corporate paycheck, _then_ quit and take over the world!

</comment><comment><USER32> I saw a product idea for a product adoption platform where the end users could adopt maker's product and provide feedback along the way, no money involved as Kickstart. Human feedback is usually more motivating than self-conjecture. Thanks for the reflective piece.

</comment><comment><USER33> I like his attitude, and I think he learned something most don't ever learn. I'd hire him.

</comment><comment><USER34> Does anyone know of any good ad-dons or extensions to blocks medium.com articles from showing up on HN? By the amount of low quality articles that make it to the front page, seems like there must be some kind of voting ring for them.

</comment><comment><USER35> Sorry, but a real perfectionist wouldn't have taken a photo with his MBP screen full of smudges -- he would have wiped them first.

<comment><AUTHOR> Hahaha!

<comment><USER36> Ha.

</comment></comment></comment><comment><USER37> Experience is an excellent cure for perfectionism.

</comment><comment><USER38> about half the people in my developer peer group fit this description, especially the 'rails to node' path (well, not all 50% did rails->node, but more than a couple did, precisely because of the reasoning in the article).

</comment><comment><USER39> It worries me that so many of us want to jump to this kids defence. He's right, you shouldn't hire him because a developer who can't ship is a developer nobody needs.

<comment><USER40> He's a junior developer. Give the kid a break. You were there at some point.

<comment><USER41> For sure, we all were. I did have to chuckle at the Technical Director in the sidebar, though. I'm pretty sure the qualification for technical director [should] include shipping > 0 products.

</comment></comment></comment><comment><USER42> this is a bit of a humblebrag isn't it...

<comment><USER43> Not really, since he describes how his youth and the traits that often go along with it (exuberance, relative inexperience, idealism, desire to be hip), have been actual obstacles to his progress.

</comment></comment><comment><USER44> Dont worry I am not going to :)

</comment><comment><USER45> Cliche warning. Admitting that you have a problem is the first step.

Most young people are like this. You're not unusual. Difficulty focusing is pretty normal, but you do have to do something about it if you want to achieve anything.

I hate to break it to you, but the corporate world makes it worse. Now you're surrounded by unfocused, capricious, and disengaged people in a world where the worst people tend to have the most success. You need to take that for what it is: a motivating negative example, how not to live and what not to become.

When you're young, you wonder why most people never accomplish anything. Now you're getting older and seeing why. Lack of focus. Career incoherency. Bad management. Low drive. People let their time and energy and engagement get nickel-and-dimed by the world and soon there's nothing left.

You've learned a lot in 2 years. That's great! You've probably gotten more out of the past 2 years than 95% of people; but if you want to run with the elite (I'm not elite; I spend way too much time on activism, but that's another story) you have to up your game even further. Up it again. And again.

Perfectionism is something that comes to us from schooling, I believe. You work on something, then you "turn it in", and you get your one final, seemingly life-altering, piece of feedback: a letter grade or a score between 0 and 100. School also encourages risk aversion, in so far as tests ask easy questions where the average person gets 75-85% right, which means that 1 total failure (0%) counteracts 5 excellent projects or aced exams. (This is not universal; in the UK, exams are harder but 70% is an excellent score.) If I were to redesign the system, tests and projects would be very hard but 20% would be passing and 50% would be an A... but that's another rant. In the real world, that "work for months then 'turn it in'" strategy leads to demotivation, anxiety, and (as you've experienced) perfectionism. You need to find people you trust and link up with them to get constant feedback. This is why the REPL (interactive mode) of modern languages is so important; without interactivity, you don't learn anything and become disengaged.

You have to change yourself if you want to achieve anything. You're experiencing the processes that cause so many people not to achieve anything, but at least you're aware of it. You have to form better habits. Work, and sleep, and exercise, in the same hours every day. Have a principled schedule for taking breaks. Get up at 5:00 if that works for you. Exercise every day (it helps). Establish a routine because if your life is constantly full of injections and senseless change, you'll constantly be cleaning up your own spilled apple carts. Curtail (or cease) drinking.

You need to form better habits and establish a routine of getting stuff done. Just remember that each action counts for about 10, insofar as people are creatures of habit and what you do now also influences how you will behave when you are tired and falling into default activities (self-control is hard and limited and 70+ percent of your time will be in default activities, so _make those better_ ). What differentiates the true high-achievers from the rest of us is that they program themselves (often unconsciously) to have useful default activities, instead of watching TV or playing video games.

That's not to say there's anything wrong with TV and video games in moderation. I love _Mad Men_ and _Breaking Bad_ , and I probably play an SNES RPG (those are good because they're time-limited at about 50 hours) every year or so. You just don't want those to become your default time-filling activities. If you want to be a top-tier technologist, your default activity should be something related to technology.</comment>


Israeli startup claims it may be able to stop all viruses - <AUTHOR> http://www.timesofisrael.com/hack-this-start-up-claims-it-can-stop-all-viruses-permanently/

<comment><USER2> This will not work. This does not account for the fact that many hackers do indeed use code generation tools, macro templates, or metaprogramming. It doesn't make sense at all for other reasons as well.

For example a hacker could introduce a security vulnerabiity in the code and then exploit it with another tool, therefore changing the original code to a certain extent.</comment>


Ask HN: What are the best Big data conferences to attend? - <AUTHOR> I work as a Big data software engineer, I mostly go to AWS Summit or GCP Next. I feel like these conferences are more pushing their products (which is understandable) than giving new & interesting information about advances in the field. Any recommendations on conferences I should attend? <comment><USER2> Disclaimer: I am an oreilly author and have spoken at both hadoop summit at strata multiple times.

Generally: Your luck with the above mentioned conferences are going to be mixed. There's a ton more biased content towards machine learning now.

Spark summit and flink forward might be better for you. Those are more systems focused: [http://sf.flink-forward.org/](http://sf.flink-forward.org/) [https://spark-summit.org/](https://spark-summit.org/)

There's also kafka summit: [https://kafka-summit.org/](https://kafka- summit.org/)

</comment><comment><USER3> I had good luck with Hadoop World - [https://conferences.oreilly.com/strata/strata- ca](https://conferences.oreilly.com/strata/strata-ca) and Hadoop Summit (now branded as Dataworks Summit) - [https://dataworkssummit.com/san- jose-2017/sponsors/](https://dataworkssummit.com/san-jose-2017/sponsors/)

They're both pretty big and not as technically deep as smaller ones could be, but they make up for it with multiple tracks (ops, security, dev, business) and a breadth of technologies represented.

</comment><comment><USER4> [https://www.bigdataspain.org/](https://www.bigdataspain.org/) Madrid in November this year.

Last year's line up [https://www.bigdataspain.org/2016/program](https://www.bigdataspain.org/2016/program)

[http://apachecon.com/](http://apachecon.com/) has big data tracks but of course pushes the (many many) projects under the Apache umbrella.</comment>