HNHacker News
TopNewBestAskShowJobs

glimcat

1,720 karma · joined July 15, 2011

submissionscomments
glimcat··on When Science Becomes News, The Facts Can Go Up In Smoke
The problem with graduation rates is that we then optimize to increase that KPI as much as possible, at the expense of median education quality (which is nominally the social good we're trying to support). You do get more people with "the credential" - which you could also get by handing them out for a buck fifty at Walgreens, if that's what you really wanted to maximize.

It's almost impossible to give politicians a hot-button campaign topic without them over-reducing the problem to a counter-productive KPI, which they will then tie funding to.

glimcat··on Ask HN: Promoted beyond my level of competence?
Do you want to keep doing the job if they get the CTO so you're not overloaded? Or do you want to get out of management?

There's nothing wrong with deciding you don't want to climb the management ladder, but getting "un-promoted" is something where you'll probably want to find a new job. Fortunately, almost everyone is trying to hire competent senior developers, so you should be able to find a new gig before too long - and probably get yet another pay raise to go with it.

glimcat··on Ask HN: How do you approach salary negotiation when you know the upper range?
"Really? That's well below the market average of X for similar positions, and from what we were discussing I'm not sure that the market average skill set is going to cut it here.

Take specific_problem we were just discussing, you really don't want to slot in a generic developer there because Y. Whereas I've dealt with that problem before and would instead do Z for you, saving you much time and profit.

Because of this, the low end of the range we should talk about is really more like $N > market average. Why don't we come back to that, and talk more about the problems your team is going to face this year..."

glimcat··on Ask fullstack software engineers
I haven't actually messed with the Postgres JSON type much. IMO it makes more sense to use straight-up dict() within Python and when stored to the database, then let Flask jsonify the dict() if it needs to leave the server context.

Usage:

You have to tell Postgres to use the HSTORE extension for your database. It's shipped with 9.3 but not active by default.

Then for SQLAlchemy you'd add something like this in your models.py:

    from sqlalchemy.dialects.postgresql import HSTORE
    from sqlalchemy.ext.mutable import MutableDict
    
    class Widget(db.Model):
        id = db.Column(db.Integer, primary_key=True)
        data = db.Column(MutableDict.as_mutable(HSTORE))
You don't technically have to do the MutableDict stuff to use HSTORE, but it's handy. They're mutable on the Python side already, so why not be consistent. With the rest of the model as appropriate (init, repr), and I'm using Flask-SQLAlchemy which makes the contexts line up and such.

It's nice because it's an RDB field so you can do all the usual Postgres love when you're not wanting to store a dict(). Or you can just do a table with id, data, and id can even be a kv-style key if you want some sort of meaning attached to the primkey. Plus it's dicts, and Python is heavy on the dicts, and it's a quick leap from there to JSON.

glimcat··on Ask fullstack software engineers
Flask, AngularJS, Celery, Postgres with HSTORE via SQLAlchemy, Redis, RabbitMQ.

Not the only one I can use, but I prefer working in Python. You could also count tools like scikit-learn and NLTK as part of my "stack" although they're usually not called in direct response to an HTTP request.

glimcat··on Ask HN: What are some must-see talks for new SAAS entrepreneurs?
"The Long, Slow, SaaS Ramp of Death" (Gail Goodman, Constant Contact) http://player.vimeo.com/video/54076835

Really, most talks from Business of Software & MicroConf.

glimcat··on Ask HN: Post-Mortem for "Who wants to be hired"
Yeah, I think that's most of how it could generate benefit, i.e. companies often don't want to post in much the same way that applicants often don't want to pitch. It's easy to find plausible excuses.

Highly-sorted posts are almost certainly an edge case, but convolved against other factors (e.g. relative popularity of C#, how well post resonated with the subset of hiring viewers who ended up seeing it). Whoever ended up with post #70 likely got far fewer views relative to post quality & desirability factors, and thus fewer responses.

But at the same time, "uncommon yet high-demand" keywords probably got a Ctrl+F bonus. It's an SEO problem as much as a pitching problem, and more so if you're not favored by HN's comment sorting.

glimcat··on Ask HN: Post-Mortem for "Who wants to be hired"
The existing "employees choose which companies to respond to" approach is probably most in line with the realities of the tech labor market, and it gives companies a smaller pool of respondents to look at which have (nominally) read and been interested by their most recent job post. And for applicants, you get more leverage if you judge which positions are potentially relevant, then tailor a response for each company. The thread was fairly popular - but I don't think it really improves on the status quo, for either player.

But, I can see it helping for people who are less experienced or confident or whatever and likely to take job posts at face value instead of as a signal of the problems the company is trying to solve through hiring. It would be better to get past that obstacle, but pragmatically it may have its uses.

glimcat··on How Many People Are Wrongly Convicted? Researchers Do the Math
The criminal population as a whole is:

* subject to far less stringent controls

* much less likely to be participating in a lengthy appeals process

* subject to corrupting influences such as for-profit prisons

* vastly dominated by "plea agreements" in which people are convicted via coercive influence rather than any evidentiary process (and far worse if socioeconomically disadvantaged or non-white).

If 4% only refers to death row errors, the overall error rate for wrongful convictions is likely in the double digits.

Also, the error rate probably goes up again for non-incarceration results which let the system "slap people on the wrist" since that is seen as less serious (despite high incidental cost to life, career, mental & physical health). It's the legal system's equivalent of closing a support ticket.

And this is only classifying "correct judgement" vs. "wrongfully convicted." It fails to model cases where a criminal conviction was a really stupid way to deal with the problem, which could have been addressed via non-criminal means.

glimcat··on Ask HN: Why use MongoDB?
I use Postgres HSTORE via Flask-SQLAlchemy. As far as my code knows, it's dict() all the way down.

And if I want to attach non-kv data like last_updated, or have foreign key relationships between one dict() and some other stuff like the corresponding user record's primary key - it's already in an RDB.

glimcat··on Ask HN: Would turning down equity offend recruiters?
"If you really want stability and a paycheck, why not go work for Google?"

Because you can often get a less corporate job doing work you enjoy more with people you enjoy more while still having manageable risk and progressing your career. That goes triple for software engineers in the Bay Area, for whom "out of a job" is a minimal risk that frequently results in a pay raise.

People mostly don't work for startups for the lottery ticket. Equity isn't really compensation, or shouldn't be taken as compensation, so much as it's a social signal. And even then, equity is more about investors than employees. Equity only evaluates to any sort of compensation at all in the event of an exit, in which case they want the senior staff to have some degree of additional incentive not to immediately leave for a new gig.

glimcat··on Ask HN: Would turning down equity offend recruiters?
As a counter-example:

Buffer offers a choice between extra salary or extra equity. Every single one of their engineers is taking the salary election, while it's mixed for other roles.

Want good people? Don't undermine your ability to attract people who are investing in themselves as much as in you, or who have families and mortgages to worry about.

glimcat··on Heartbleed Update v3
Also: the way this played out makes an awesome story for the next time Akamai experiences internal pushback against participating in open source. "Remember that one time it saved our bacon" is a political goldmine.
glimcat··on 3 SSL vulnerability discovered in 3 months, anything wrong?
Security vulnerabilities are often found in clusters, whether because of heightened attention or simply because coincidence & cognitive bias.
glimcat··on Cult Creation: How to hire your startup team [pdf]
I doubt it would help your competitors much, it's not like they lack for opportunity with any of the other times you've talked about Matasano's hiring practices.

It might help a few young engineers who have only ever seen toxic hiring practices and assume that's how it ought to go.

glimcat··on Unpythonic Python
This way's easier to read:

    ['FizzBuzz' if 0 == n % 15 else 'Fizz' if 0 == n % 3
        else 'Buzz' if 0 == n % 5 else str(n) for n in range(1,101)]
glimcat··on Ask HN: SSL Certs need to be revoked, right?
Anything that was in memory was potentially leaked in a way that can't be traced. Certs, SSH keys, user passwords, database passwords...

Oh, and if an admin logged in at any time during the window in which you were vulnerable to Heartbleed, or if any similar credential ended up in memory in any way during that period - consider yourself rooted.

Heartbleed is a "burn down the server, redeploy, restore database backups, expire all credentials" event, not just an "apt-get update, done" problem. And it hit over 2/3rds of HTTPS websites (ideally: anything with passwords, then some).

glimcat··on Ask HN: Why do open source projects attract more coders than designers?
With code, there's a certain attitude of "I need this, so I'm going to make it, but I have no intention of ever productizing it so why not share it?" It's a massive "give a penny, take a penny" jar that enriches the entire software ecosystem.

The analogous situation for graphics design would be something like textures & Photoshop filters. Or icon packs. Or fonts. Which you can find lots of for free (sometimes even with useful licensing attached).

But who the heck is going to come do free graphics work for my new Flask extension when they don't even use Flask, or understand what it is, or have any motivation beyond "hey come do free work for me"?

On the other hand, you have cases like the current mpld3 logo update. The project's author asked for help with the logo on Twitter, and got 6+ solid responses back. People are glad to help if they have the skills to do so and if they're part of the project's community. Design vs. development is not relevant, only relevance is relevant.

https://github.com/jakevdp/mpld3/wiki/Logo-Proposals

glimcat··on Ask HN: Do you prefer to work for socially conscientious employers?
Do you prefer to work for socially conscientious employers?

Sure. But there's always the competing option of "work for a socially ambivalent megacorp which pays more, then donate the delta to your cause of choice." Or more commonly, "I have three kids and medical bills, and am not free to arbitrarily take substantial pay cuts."

glimcat··on Ask HN: How would you handle items' IDs beyond 2^64 (18.4 quintillion)?
The solution to this problem is as old as Lucretius.

Go to the edge, then add a bit.

Or, whatever, get two computers. Or twenty, they're cheap.

glimcat··on Ask HN: My boss just got fired
It's SF, the company is hemorrhaging staff, your job description is constantly mutating...and you can code well.

It sounds like time to get a better job, with a healthier employer, working on something more interesting, and making at least 20% more. Or take a run at building your own ship if that interests you and if you have the financial padding.

glimcat··on Stop commenting your code just to say you did
My experience as a TA:

I never counted students off for comments, although I also never worked with a professor who had a policy of "All Code Must Be Commented Or Else." I don't think many professors did, at least not for upper-division classes. Perhaps related - most students didn't comment at all (I largely dealt with CS seniors).

Then we had a bunch of students get counted off for bugs, unimplemented features, or general weirdness in their code.

As a rule of thumb, the very few people who did comment got much better grades simply because I was allowed to give partial credit. If they at least commented what the heck they were trying to do and how, and why they thought it advanced the project - I could probably figure out what went wrong and award points accordingly.

You know that Tolstoy quote, "Happy families are all alike; every unhappy family is unhappy in its own way"?

It applies perfectly to bad code. Whether we're talking university or industry, having SOMETHING there so that your teammates or the senior developer on the team can figure out what you were TRYING to do is an enormous help.

Going comment-light is fine in a perfect world where you have concise, elegant code that works perfectly and is absolutely clear when you come back in six months and try to figure out how you structured the program and what role any particular snippet serves within the greater whole.

It's not a perfect world.

(At the same time - readability functions such that if you put a bunch of trash comments in, people reading your code will assume that most of the comments are trash. You can't just tick the box and expect that to be enough.)

glimcat··on Stop commenting your code just to say you did
TODO statements should be conserved to actual pending tasks.

Code in this pattern is often a compromise, and may be found as contributory to future issues, but it probably didn't merit a follow-up task at the time of writing.

glimcat··on Stop commenting your code just to say you did
> That comment, however, is a good example of a bad comment.

Yes, assuming there's not some contextual reason why hardware acceleration is obviously inappropriate. But even then, it would be much better to err on the side of "assume the next person to read it hasn't had their coffee yet."

Even something like "don't use hardware acceleration because compatibility issues" would be a better comment. You don't need an essay. But it should be both concise AND descriptive of the issue, not just normative or prescriptive.

glimcat··on Stop commenting your code just to say you did
I'm of the philosophy that code should be readable, reasonably self-documenting, and remind you of relevant external material - whether that be your state of mind at the time, or reference material you drew on, or whatever.

Not everything needs an open issue, but the knowledge should be recorded somewhere. I know for a fact I won't remember it in six months, and likely not in a week either.

(I also write a large amount of utility code that's below the "project" scale and will probably never see a PM tool, but which is nonetheless part of a heavy reuse ecosystem.)

glimcat··on Stop commenting your code just to say you did
Almost every time I've done this, that pattern means "I really shouldn't be doing it this way, but we'll do it this way for now because getting it done is more important. Improve it if emergent bugs or profiler results ever indicate it's worth messing with again, but I'll probably get back to it never."

It's not a TODO or a BUG, but it's helpful to make note of for future code review or reuse.

glimcat··on My website was stolen by a hacker and I got it back
I use Namesilo with Google Authenticator.

(Probably other registrars support it as well, that's just the data point I have first-hand knowledge of.)

glimcat··on Ask HN: How much would you pay monthly for an unlimited tier to a task mgmt s/w?
"Unlimited" isn't a key value point. What matters is if it works and how well. Limits are just there to facilitate the creation of pricing tiers, and only work if the pricing tier you're trying to push them to lines up with the value delivered.
glimcat··on DuckDuckGo tracks you
Also, leaving the clean link isn't trickery. It's usability.

I can do "right click + copy link" on DuckDuckGo and get a clean copy of the link. That isn't the case on Google.

glimcat··on Ask HN: How do you build the marketing site for your SaaS app?
Step one, have the app on a separate subdomain from your marketing site.

Initial version, use Unbounce or Squarespace or whatever gets you moving with the least wasted effort.

Later on, you probably want a CMS so it's easy for non-technical users to update. WordPress is happy because of adoption levels, then throw money at WPEngine to handle many of the more common issues for you.

You could use Drupal or some custom thing if you WANT...but make sure you have a benefit equation that justifies it. The more custom your solution is, the more maintenance overhead you commit yourself to.

For stuff like landing pages, set up a site style guide. It may also be helpful to standardize on a style library like Bootstrap or Bourbon Neat. Don't make people reinvent the wheel every time.

Then add tools like Optimizely, Woopra, Kissmetrics, Intercom, Snappy. Your major bases to cover are generally testing, tracking, and customer interaction.

It may also be helpful to add a content management tool like GatherContent. WordPress may be easy to update but planning what to update and aggregating assets for it is a completely different problem.

← PreviousPage 2 of 27Next →