pak

Both the webserver (Apache) and PHP are off by default and have to be enabled separately, the latter by editing a config file.

Essentially, only Mac-owning web developers who enable these things (and serve PHP from their box to the world) are affected by any security problems in PHP. I imagine that most such web developers actually only dev locally and push the code to another server. It's nice that they updated them anyway.

This article's title echoes a paper which continues to influence the medical research and bioinformatics community, "Why Most Published Research Findings Are False" by JPA Ioannidis.

http://www.plosmedicine.org/article/info%3Adoi%2F10.1371%2Fj...

While the OP's article targets some low-hanging fruit, like halting criteria, multiple hypotheses, etc. which should be familiar to anyone serious about bioinformatics and statistics, Ioannidis takes these things a little farther and comes up with a number of corollaries that apply equally well to A/B testing.

After all, the randomized controlled trials that the FDA uses to approve new drugs are essentially identical to what would be called an A/B test on Hacker News.

Yup, I've switched over my Chrome extension [1] to use Algolia's API instead of HNSearch (which is shutting down), and so far, it seems to be working peachy.

[1]: https://chrome.google.com/webstore/detail/hacker-news-sideba...

Your hypothesis and the one I floated aren't mutually exclusive.

My idea doesn't necessitate a conspiracy or playing with the points/ranking, which PG is rather quick to deny in his reply to me. It could have just been a plan for Sam to release blog posts over a period of time and try to get them read. I'm curious if this was a conscious effort to build something akin to http://www.paulgraham.com/articles.html given the role he was being groomed for. Of course, I'm also always curious about the way this site really works on the inside.

I do find it ironic that the piece that got the most upvotes (AI, with ~570) was one that Sam admitted he hardly worked on: https://news.ycombinator.com/item?id=7268247

In that comment, he claims he is simply blogging to "practice writing." From the vantage point of this announcement two days later, that sounds coy, even obtuse.

Is this the reason that so many of his recent posts were promoted on here? Was the intention to build the cachet of some widely read essays so he could credibly step in for PG?

HN stories for his blog start about a year ago, a little after this article says the idea originally was floated (mid-2012), and they have pretty consistently frontpaged: http://hn.algolia.com/#!/story/sort_by_date/prefix/0/blog.sa...

It makes me wonder if it was a coordinated, planned effort.

You're confusing Ruby and Rails. Ruby is also a general purpose scripting language. The OP was careful to only compare Rails with Django, Ruby with Python.

As you read all these many lines of code to simply find the largest file in a directory, recall that in any language with friendlier blocking/non-blocking semantics, it could be as simple as (e.g. in Ruby)

    Dir.glob('*').select{|f| File.file?(f) }.max_by{|f| File.size(f) }

Plus, the error semantics of this code are sane: if something goes wrong I get an exception I can rescue. If there were no files in the directory, I get nil.

Statting a bunch of files is rarely so costly that parallelism is warranted, unless it is impressed upon you as in Node. The cost in readability and dreaming up generators and promises to solve such a mundane problem is likely much worse. Before you charge headlong into building your next webapp with Node, consider this article food for thought.

The more that I use Python in the context of other languages, the more the "there should only be one [obvious] way to do it" mantra irks me.

First of all, there's the cases in which reality fails to live up to expectations, like this packaging debacle. If there was an obvious and best way to do everything, we wouldn't need to spend so much money and time engineering software. We wouldn't spend so much time arguing about distributed vs. centralized, OOP vs. declarative vs. functional, type systems, build/test systems, etc. The mantra is arrogant on its face.

Secondly, it flies in the face of innovation. It works against building a creative community of users. So often, when Python users point out the holes in the ecosystem, they are simply told "well the long and outdated PEP 5991834 already establishes the obvious way to do it" or "just shim it on top of this inadequate corner of the standard lib" or the use case itself is questioned, which patronizes the criticizer. The mantra becomes an excuse for reinforcing a hive mind philosophy.

In this case, I wonder if it has subtly undermined the development of a diverse and widely supported package index. The whole point of such a package system is to support the belief that there are actually many ways to do the same thing, and some may be better for certain styles/teams/circumstances. Having the opposite outlook as a design principle for a language will attract users less inclined to contribute to or build such a diverse packaging system. I wonder this particularly because the more "laissez-faire" languages like Perl, Ruby, and JavaScript are precisely the ones that have such great packaging systems and ecosystems.

Yes, it is. Coming to this mess from the joy of bundler/gems, npm, or hell, even CPAN will ruin your afternoon.

It is just an unfortunate circumstance of the community not efficiently converging on well designed standards quickly enough, and so, the rocky soil has sprouted strange twisty crops. There are articles on how the setuptools/distutils frankenhack pretty much set off the whole trainwreck that you see today, e.g.: http://blog.startifact.com/posts/older/a-history-of-python-p...

Armin (the OP) has also written about this sad history previously: http://lucumr.pocoo.org/2012/6/22/hate-hate-hate-everywhere/

Re: strings, I was referring to what I said already and you quoted only part of it:

> It's odd to me that they were willing to break so much code with 3.0 (by "fixing" strings and Unicode) but a couple decorators held this one back.

>@classmethod and @staticmethod are somewhat important language features

And strings aren't? Whatever, I understand that there are tradeoffs and to people that only use Python, the aesthetic blemishes tend to matter less. To people that use it in the context of other languages, it sticks out like a bad paint job or a prominent stain. This, and many more opinions than I could express succinctly, are on the reddit thread for GVR's post.

http://www.reddit.com/r/programming/comments/79h9y/guido_van...

@redditrasberry: To make a bad analogy, it's like a stain on your carpet in your front hallway. If you live with it for long enough you won't even see it any more. But to visitors coming to your house it's the most obvious thing. And it's particularly noticeable because the rest of Python is so nice - it's like I'm visiting an art gallery and everything is beautiful and pristine, but there on the carpet at the entrance is this huge stain that nobody has ever cleaned up.

It's not flamewar material. GVR himself has acknowledged everything (edit in response to @EdwardDiego: most of what) I said. (http://neopythonic.blogspot.com/2008/10/why-explicit-self-ha...) The main contention holding back GVR and 3.1 from fixing this once and for all is that decorators currently need to manipulate the explicit self. From my perspective, it seems like Python decorators are [ab]used to reimplement basic features in other OOP systems, like class methods, and there are elegant ways of getting around this given a shift in certain concepts (like class << self in Ruby). It's odd to me that they were willing to break so much code with 3.0 (by "fixing" strings and Unicode) but a couple decorators held this one back.

>I hate implicit hidden defaults and assumptions.

Your implicit hidden default is my handy abbreviation.

Imagine if we didn't have contractions in English.

For that previous sentence, is it really at all frightening that the "didn't" meant "did not" but we haven't (ha) written it out? Could it possibly mean anything else? Wouldn't English be all the more stilted and ugly if there were only one explicit and verbose way (a Python design principle) of negating verbs?

If I redefined the "self" as any other name Pythonistas would hate on me for being unidiomatic. Most editors highlight "self" in anticipation of what it means. In fact, I have never seen code where specifying another name would be justifiable. The only conclusion from this situation is that it is a de facto keyword and re-specifying it every. single. time. is a waste of programmatic breath.

And for this reason, every time I tab between languages and get my favorite "function takes 1 argument (2 given)" error, (by the way: a completely bewildering message for a programmer from every other language, rereading the method definition and wondering where the second argument is coming from [1]), I mutter curses at my terminal for Python relentlessly carrying this wart into its third decade.

Implicit and explicit are relative to expectations. Python moves the implicitness into the way arguments are passed to methods. It is not any more explicit when placed in the context of all other OOP languages, but rather an eccentric convention.

[1]: 800 results on SO. Read them and weep. http://stackoverflow.com/search?q=Python+takes+arguments+giv...

> a default GUI framework

Tkinter is Python's "default GUI framework". At least, that's what they continue to claim (https://wiki.python.org/moin/TkInter), and it's the GUI library I ran into first when I first learned Python.

How does it look and feel once you get started? Well, let's just say it's a bad sign if a GUI framework website has no screenshots. Even with increasingly hacky theming engines layered on top, it still is hard to get anything feeling close to native: http://tktable.sourceforge.net/tile/screenshots/macosx.html

Go ahead, you can start laughing...

(for anybody that is saddened by the above, there are thankfully binding libraries for Qt and Wx, both of which do get you fairly decent cross-platform widgets from within Python, and either of which would be better default GUI libraries in 2014.)

>The idea to allow one project to switch between Python 2 and 3 for individual files

Yes, I believe key parts of the standard object model changed between the two (e.g. strings vs bytes, many of the magic methods and operators) making this nearly impossible. Every time objects would pass back and forth, they'd have to be converted, which is wasteful and bug-prone (and this is a whole mess of library code that the python3 guys probably did not want to write). You'd also need to load two different standard libraries, which would waste memory.

You only need to scan through the upgrade feature list to see how hard intercompatibility would have been. http://docs.python.org/3.0/whatsnew/3.0.html

Although I totally agree with Aaron that this would have allowed people to actually use Python 3 without fear, anything short of forcing the entire program and all of its modules to run in v3 mode as opposed to v2 mode would have been a disaster from a reliability and technical design standpoint. And that's closer to how things actually went down with 2to3, etc.

If you're on Chrome (in which case there will be no lasting victories, only small ones), there's this extension: https://chrome.google.com/webstore/detail/iba-opt-out-by-goo...

This looks like it does the same thing for Firefox: https://addons.mozilla.org/en-US/firefox/addon/targeted-adve...

There may be IBA opt-out extensions for other browsers. AFAICT all they do is permanently block the DoubleClick and related cookies.

This, in combination with Adblock Plus, seems to do the job for me. There are a lot of people complaining that the extensions don't work, but they probably do not realize that these only block the collection of new data tied to your browsing history, and not the display of the ads themselves, which is what you need Adblock Plus for.

I remapped my Caps Lock key to switch into a "Greek" mode for typing, since I frequently need to type Greek letters interspersed with English. (Anybody in STEM classes should know how awkward it is to do this normally.) If you have a Mac, you can do this with Ukelele, a free key remapping tool. You can even set up and add "dead key" modes (e.g. the way opt+E allows you to add a diacritic to the next letter typed). There are some really advanced configurations possible. Ukelele even still works on Mavericks.

http://scripts.sil.org/cms/scripts/page.php?site_id=nrsi&id=...

You are right that no biotech is required to find terrible viruses from history. Access to those viruses is pretty well controlled though: you can get a stern letter from the CDC if you try to order DNA that looks like smallpox or RNA that looks like the 1918 Spanish flu. It's happened to my roommate during his virology research--they do monitor these things[1].

BUT, more importantly--you don't even need fancy biotech to engineer a terrible virus. No sequencing, recombinant DNA, fancy BSL-4 labs, well-educated virologists, none of that. All you need is a captive population, something any self-respecting evil warlord should be able to get. (Certainly the North Koreans, the Taliban, etc. have access to plenty of prisoners.)

The same simple mechanism used by Fouchier (the guy who created the controversial bird/ferret superflu) can be applied to humans: serial passage. Put any moderately bad flu virus in a certain number of prisoners, then expose them via air circulation to other prisoners. Take the sickest people from the second group and expose them to another uninfected group via air circulation. After five or six passages the virus in the last group will show extraordinary virulence and transmissive capabilities because you've applied artificial selection.

To seed the virus and start an attack, you take a few of these prisoners, expose them to the worst virus, and put them on planes to your target country while they are still in the incubation/transmissive period.

Obviously, this is a nightmare scenario that I hope never happens, but the idea that terrorists or evil dictators need fancy science to engineer superbugs is false. The same methods farmers have used for centuries to grow taller corn and leafier lettuce can be applied to viruses by anybody with enough prisoners and moral depravity.

[1]: It should be noted that in-house synthesizing costs are coming down, though, and we won't be able to rely on the safeguard of companies automatically BLASTing ordered sequences against a CDC blacklist for much longer.

Viruses are only one potential cause of cancer, and there are several known tumorigenic viruses (HPV, adenovirus, EBV, polyomavirus, etc.). There are still researchers that believe that all remaining cancers are caused by yet undiscovered viruses (the "viral hypothesis"), but these researchers are becoming scarce.

It seems more likely that cancer can also be a disease of aging and degeneration. As we get older, things break. Cellular division is liable to be one of those things. There are identified mutations that dramatically predispose people to cancer, because one of the genes controlling cellular division is already broken (the "Knudson hypothesis").

Some researchers do prefer to use the viral cancers as a model for studying the others, because they luckily have a singularly identifiable cause, and therefore seem more likely to point to the causative mutations behind cancer as a general process. This is the premise for a paper that I helped author: http://www.nature.com/nature/journal/v487/n7408/full/nature1...

Nitpick: in the same vein, not all gastric ulcers are caused by H. pylori. Another common cause is chronic NSAID (e.g. ibuprofen) use.

You realize that SNPedia is basically the equivalent of Wikipedia for SNPs, and I can edit it to say whatever I want?

Would you want a physician picking your drug regimen based off of what Wikipedia says on some particular day? Would you like your implanted defibrillator to change its algorithm based on something Wikipedia says?

If not, then you've discovered the crux of the issue. There's a bright line between "data that someone put online yesterday" and "rigorously tested and proven effective". That's the whole point of FDA regulation on what gets to be marketed as a medical device, or what drugs can be prescribed for an indication.

If Valley folks created this, it would be the holy grail that NIH-funded bioinformatics researchers have been pursuing for the last 20 years. I wish them the best!

In all seriousness, this is exactly the point of most federally funded research in genomics, including the projects of the institute I work for. http://icahn.mssm.edu/genomics

If you think 23andMe is getting singled out in comparison to homeopathy, that's not correct. The FDA has long considered how to handle homeopathic remedies, and they do regulate them and the conditions under which they can be marketed.

For more information, visit the NIH website: http://nccam.nih.gov/health/homeopathy#hed6

Note that homeopathic medicines cannot be sold over the counter if they claim to treat a serious disease (something that wouldn't resolve on its own, like a cold or a headache). They must be prescribed!

> the risk of people maybe finding out something inaccurate and going crazy with it is higher than the reward of people finding out something accurate and taking action to preserve their health based on this information

I don't think this balance is as cut and dry as you claim it to be. There are very few "actionable" results that you can get from a 23andMe test right now, whatever they say to the contrary. The meat of the report that they currently provide is a list of alleles and associations to various properties, but there are thousands of alleles (and likely millions more not tested for lack of known associations) that sum to your particular phenotype. The math and science behind that summing process is severely lacking at this point, simply because we have not characterized the billions of interactions between them.

The FDA's problem with 23andMe is that they are not properly communicating this uncertainty in their marketing. Relevant to this issue is whether the reports can be called "medical" information or not. In order for things to live up to the standard of "medical" devices or therapies in the US, they have to pass a certain measure of QC, accuracy, and demonstrated efficacy. 23andMe hasn't done the legwork for any such tests, and from most accounts, it seems like the FDA has given ample effort to accommodate them so far.

This is not about hiding data from ignorant people. 23andMe will likely go on testing and providing reports. It just can't advertise it as "medical" until it passes the same standards as other medical products, just the same way I can't sell "Grade A" Beef unless it passes certain standards, or sell "bourbon" in the US unless it's aged in a charred-oak barrel. That is because we've decided as a society to link certain labels with standards, and the label would be pointless if it weren't applied consistently.

To which I say, what is the point of words like "only" and "all", if they do not mean what they are supposed to?

I'm not trying to be a stickler. Granted, I work mostly in science research, where broad claims are discouraged and quantifying confidence in a hypothesis is expected. Extraordinary claims require extraordinary evidence.

At best, I think this rule could apply to (maybe) 80% of "huge" tech companies. 80% is a disingenuously long distance from "all companies".

The controversy penalty would be perfect for an article like this that features and builds off a linkbait title, which I now feel a little duped for reacting to.

But after finding out Sam Altman is a YC partner, and reading more about how the controversy penalty and other arbitrary penalties actually work, I don't really buy into anything scoring equitably on this site (https://news.ycombinator.com/item?id=6844169) in the long term...

> In this case the most common misunderstanding seems to be not to realize that present day big companies were once small. You could have pre-empted that by reminding readers that once companies reach a certain size they don't have to rely on making something great to grow bigger, but that if you look back at the earliest history of those companies, you'll find most did. (emphasis mine)

It's hard to call it a misunderstanding when the title of the post starts boldly with "The Only" and the first paragraph starts with "All companies". The premise of there being some universal rule for growth is absurd and requires only a few counterexamples, of which there are certainly many to consider (this page now contains dozens), to be demonstrably false.

By reinterpreting the author's argument with a requalification of most, you've already reached a much more sane argument. But you know as well as I do that this post would never frontpage if it had been called "The Best Way to Get Huge" or "The Way Most Companies Become Huge".

Edit: Or maybe it would have anyway? Sam Altman is a partner at YC [1] and I can't help but wonder if such content gets a boost to frontpage no matter what. After all, people have shown that penalties are applied to a hidden list of phrases and domains which boots them off the frontpage [2], so the same principle might be applied in reverse to certain things. For example, the controversy penalty might be removed for certain domains. I'm sorry, but after reading [2] my faith in the scoring system here is at an all-time low.

[1]: http://en.wikipedia.org/wiki/Sam_Altman

[2]: http://www.righto.com/2013/11/how-hacker-news-ranking-really...

> All companies that grow really big do so in only one way: people recommend the product or service to other people.

This is a bad opening premise. Time Warner and Comcast are huge and they don't seem like word of mouth companies to me. Boeing is pretty huge and they don't sell anything directly to ordinary consumers. I would never run around marketing Pfizer products to my friends.

Take a scan down the Fortune 500 and "viral" growth companies are in the minority.

Even limiting yourself to tech companies, which I presume is all that the author was thinking of, the principle is no less general. Epic is a gargantuan EHR vendor and they grew via acquisition of other vendors, not word of mouth. Cisco did much of the same, and consider Oracle. The list goes on and on.

It draws my interest because of the obvious parallels to the millions of backscatter pictures taken by the TSA over the past decade, many of which are naked pictures of children and the elderly. The overwhelming majority of Americans consent to having these pictures taken before getting on a plane.

The sort of group psychology and doublethink that allows us to ridicule this dated pseudoscience on one hand, while walking right into a similar situation in every American airport today, is inherently fascinating.

So the machine takes the same picture, but simply pre-processes it into a cartoon image using "Advanced Imaging Technology" (now there's a hilarious non-description) before throwing it up on the monitor? Where do the originals go? Do they ever get audited or offloaded for quality control purposes--how else can they expect to be sure the algorithm works?

The news reports on this switch are all over the place in terms of quality, and you happened to pick one of the worse ones. I'm not the only one asking these questions: http://www.cnn.com/2013/05/29/travel/tsa-backscatter

"We'd like to see clearer rules about the collection of the images," Rotenberg said. "Are they deleted? Are they saved? Is some analysis being done and can they be linked to passengers?"

Not to mention the enormous waste of money it must have been to install and then remove the old machines. And what now happens to all the pictures they took, which are probably accumulating dust on some DHS subcontractor's hard disk somewhere in America?

Whoa old man quarterto, who said the word ever belonged to math people in the first place? I could argue that math people have a bad habit of squeezing English words into strange contexts that corrupt the original meaning. Take "manifold" for instance, or "curl", or even something as harmless as "mode". They all meant perfectly fine things until the math people claimed them as their own.

According to M-W "isomorphic" has pre-existing definitions from medicine and chemistry that could align better with what OP is trying to say. http://www.merriam-webster.com/dictionary/isomorphic

Good day quarterto! I shall now leave to take a smooth ride in my compact car.