Hacker News Reader

Comment by mseebach | Hacker News Reader

Hmm, it seems to me that for any task small enough to be appropriate for this site, it will be more work to describe the task and verify the result than to just perform the task.

This leads us to those who don't have the capabilities to do the task: They will risk asking for the impossible (the syllable counting task[1]) or accepting the unacceptable (the ZIP-code form solution includes a PHP script with a gaping security hole).

1: So this task has been requested by 'bevan' who appears to be the founder of the site, and in a comment dumbed down to only having to work for the given set of tests - the given solution will be little better than just manually counting the syllables.

View on HN

There are two related cases I can think of where a task is easy to describe and reasonably easy to do, but tedious enough that I'd consider paying someone. One is 'port functions x,y and z from library A to language B' and the other is 'implement algorithm X as described in paper Y using language Z'.

Basically cases where the description bit is already done by someone else and a reference implementation to test against already exists. In fact I have just such a task that I've been putting off (I have a paper and a matlab implementation, and really want a python/numpy version), that I might throw up on the site to see what happens.

You're right that users will ask the impossible, and accept the unacceptable, but I think that a good enough feedback mechanism could over-come this, and sites such as Stackoverflow have implemented feedback mechanisms that could work.

Eg. by allowing comments on answers, the glaring security hold in the ZIP-code form answer could be raised, addressed, and fixed.

Allow moderators to say 'this task is too big/the bounty is too small', while simultaneously limiting the maximum bounty to something small.

IMO, the 'right' solution is for libraries to be more easily broken in to pieces while simultaneously easier to use together so that just the form part of the 'big ZIP-code PHP library' could be used in this case, but barring that, this is a neat attempt at code-by-documentation, given that most of the problems I saw were easier than homework problems.

> but I think that a good enough feedback mechanism could over-come this, and sites such as Stackoverflow have implemented feedback mechanisms that could work

But people are on SO out of a desire to help other people, and SO specifically encourages general problems - so saying "that's not possible" is the right answer to the syllables problem instead of some messy thrown together code that doesn't actually work.

By introducing the financial reward system, this goes out the window. I get nothing out of commenting on bounties, explaining why answers are wrong or requests impossible because I'm not contributing to a community of being helpful to future people running into a problem.

> IMO, the 'right' solution is for libraries to be more easily broken in to pieces while simultaneously easier to use together

Sounds good, but that's not how software development works. The cognitive skills required to break down a problem into such pieces is significantly higher that those required to write code that performs the task.

> I get nothing out of commenting on bounties,

The system could easily pay a pittance for commenting, and then more for distinguished answer; and hell, a monetary penalty for poor answers/spam.

Also, correct me if I'm wrong, but it seemed like the accepted answer, along with its code, was freely available, so future people do get the benefit of your insight.

> The cognitive skills required to break down a problem into such pieces is significantly higher

...so why should they waste their valuable time doing both the documentation and implementation?

I like the idea of being able to nitpick someone's code for credits. I also like the idea of being able to take [some of] their $ if I can prove their method is wrong within a certain amount of time of being accepted, or possibly all of the $ if they really screwed the pooch.

Thanks for the feedback. I agree that not all coding tasks are appropriate for Bountify, and that there'll always be potential pitfalls whenever you outsource bits of work. But I'm hopeful coders will recognize those pitfalls and learn to use the tool effectively. Let me know if you have any ideas on how to mitigate those risks you mentioned.

By the way, if there's a security hole in the accepted solution to https://bountify.co/B, you should post a better one or even just mention it- I might tip you for it! :)

That's another problem - I'll help you for free because I'm nice and this is HN, but if I'm to consider money as a motivator, $5 (or a tip which must be assumed to be less) is downright offensive.

The problem is this PHP:

<?php echo @file_get_contents($_GET['url']);?>

It does nothing to validate the request, and will trivially proxy any request to not just any webpage in the world, but any file readable to your webserver.

What you want is something like:

  <?php 
  $zip = $_GET['zip'];
  if (preg_match("/^(^\d{5}$)|(^\d{5}-\d{4}$)$/", $zip)) {
    echo @file_get_contents("http://www.webservicex.net/uszip.asmx/GetInfoByZIP?USZip=".$zip);
  }
  ?>

Not tested, but that's the general idea.

Thanks for the explanation, no offense intended. My point was that there's a mechanism (imperfect though it may be) to help catch flawed solutions.

BTW, the winning solution doesn't appear to have the security flaw you pointed out.

I like this site's idea, but I'd still place my tasks on http://freedomsponsors.org. Disclaimer: I'm FS's founder. I think the "pre-paid" bounty system makes users feel uneasy about whether they'll get something for their money or not.

I believe that the "pay what you promised, after you've gotten it" model works best.

Reply on news.ycombinator.com