5 ms·

Hmm, it seems to me that for any task small enough to be appropriate for this site, it will be more work to describe the task and verify the result than to just

Hmm, it seems to me that for any task small enough to be appropriate for this site, it will be more work to describe the task and verify the result than to just perform the task. This leads us to those who don't have the capabilities to do the task: They will risk asking for the impossible (the syllable counting task[1]) or accepting the unacceptable (the ZIP-code form solution includes a PHP script with a gaping security hole). 1: So this task has been requested by 'bevan' who appears to be the founder of the site, and in a comment dumbed down to only having to work for the given set of tests - the given solution will be little better than just manually counting the syllables.

bevan 14y ago
Thanks for the feedback. I agree that not all coding tasks are appropriate for Bountify, and that there'll always be potential pitfalls whenever you outsource bits of work. But I'm hopeful coders will recognize those pitfalls and learn to use the tool effectively. Let me know if you have any ideas on how to mitigate those risks you mentioned. By the way, if there's a security hole in the accepted solution to https://bountify.co/B https://bountify.co/B, you should post a better one or even just mention it- I might tip you for it! :)
- mseebach 14y ago
  That's another problem - I'll help you for free because I'm nice and this is HN, but if I'm to consider money as a motivator, $5 (or a tip which must be assumed to be less) is downright offensive. The problem is this PHP: <?php echo @file_get_contents($_GET['url']);?> It does nothing to validate the request, and will trivially proxy any request to not just any webpage in the world, but any file readable to your webserver. What you want is something like: <?php $zip = $_GET['zip']; if (preg_match("/^(^\d{5}$)|(^\d{5}-\d{4}$)$/", $zip)) { echo @file_get_contents("http://www.webservicex.net/uszip.asmx/GetInfoByZIP?USZip=".$zip); } ?> Not tested, but that's the general idea.
  - bevan 14y ago
    Thanks for the explanation, no offense intended. My point was that there's a mechanism (imperfect though it may be) to help catch flawed solutions. BTW, the winning solution doesn't appear to have the security flaw you pointed out.
fragmede 14y ago
You're right that users will ask the impossible, and accept the unacceptable, but I think that a good enough feedback mechanism could over-come this, and sites such as Stackoverflow have implemented feedback mechanisms that could work. Eg. by allowing comments on answers, the glaring security hold in the ZIP-code form answer could be raised, addressed, and fixed. Allow moderators to say 'this task is too big/the bounty is too small', while simultaneously limiting the maximum bounty to something small. IMO, the 'right' solution is for libraries to be more easily broken in to pieces while simultaneously easier to use together so that just the form part of the 'big ZIP-code PHP library' could be used in this case, but barring that, this is a neat attempt at code-by-documentation, given that most of the problems I saw were easier than homework problems.
- mseebach 14y ago
  > but I think that a good enough feedback mechanism could over-come this, and sites such as Stackoverflow have implemented feedback mechanisms that could work But people are on SO out of a desire to help other people, and SO specifically encourages general problems - so saying "that's not possible" is the right answer to the syllables problem instead of some messy thrown together code that doesn't actually work. By introducing the financial reward system, this goes out the window. I get nothing out of commenting on bounties, explaining why answers are wrong or requests impossible because I'm not contributing to a community of being helpful to future people running into a problem. > IMO, the 'right' solution is for libraries to be more easily broken in to pieces while simultaneously easier to use together Sounds good, but that's not how software development works. The cognitive skills required to break down a problem into such pieces is significantly higher that those required to write code that performs the task.
  - fragmede 14y ago
    > I get nothing out of commenting on bounties, The system could easily pay a pittance for commenting, and then more for distinguished answer; and hell, a monetary penalty for poor answers/spam. Also, correct me if I'm wrong, but it seemed like the accepted answer, along with its code, was freely available, so future people do get the benefit of your insight. > The cognitive skills required to break down a problem into such pieces is significantly higher ...so why should they waste their valuable time doing both the documentation and implementation?
tonylampada 14y ago
I like this site's idea, but I'd still place my tasks on http://freedomsponsors.org http://freedomsponsors.org. Disclaimer: I'm FS's founder. I think the "pre-paid" bounty system makes users feel uneasy about whether they'll get something for their money or not. I believe that the "pay what you promised, after you've gotten it" model works best.
dagw 14y ago
There are two related cases I can think of where a task is easy to describe and reasonably easy to do, but tedious enough that I'd consider paying someone. One is 'port functions x,y and z from library A to language B' and the other is 'implement algorithm X as described in paper Y using language Z'. Basically cases where the description bit is already done by someone else and a reference implementation to test against already exists. In fact I have just such a task that I've been putting off (I have a paper and a matlab implementation, and really want a python/numpy version), that I might throw up on the site to see what happens.

bevan 14y ago

Thanks for the feedback. I agree that not all coding tasks are appropriate for Bountify, and that there'll always be potential pitfalls whenever you outsource bits of work. But I'm hopeful coders will recognize those pitfalls and learn to use the tool effectively. Let me know if you have any ideas on how to mitigate those risks you mentioned. By the way, if there's a security hole in the accepted solution to https://bountify.co/B https://bountify.co/B, you should post a better one or even just mention it- I might tip you for it! :)

mseebach 14y ago
That's another problem - I'll help you for free because I'm nice and this is HN, but if I'm to consider money as a motivator, $5 (or a tip which must be assumed to be less) is downright offensive. The problem is this PHP: <?php echo @file_get_contents($_GET['url']);?> It does nothing to validate the request, and will trivially proxy any request to not just any webpage in the world, but any file readable to your webserver. What you want is something like: <?php $zip = $_GET['zip']; if (preg_match("/^(^\d{5}$)|(^\d{5}-\d{4}$)$/", $zip)) { echo @file_get_contents("http://www.webservicex.net/uszip.asmx/GetInfoByZIP?USZip=".$zip); } ?> Not tested, but that's the general idea.
- bevan 14y ago
  Thanks for the explanation, no offense intended. My point was that there's a mechanism (imperfect though it may be) to help catch flawed solutions. BTW, the winning solution doesn't appear to have the security flaw you pointed out.

fragmede 14y ago

You're right that users will ask the impossible, and accept the unacceptable, but I think that a good enough feedback mechanism could over-come this, and sites such as Stackoverflow have implemented feedback mechanisms that could work. Eg. by allowing comments on answers, the glaring security hold in the ZIP-code form answer could be raised, addressed, and fixed. Allow moderators to say 'this task is too big/the bounty is too small', while simultaneously limiting the maximum bounty to something small. IMO, the 'right' solution is for libraries to be more easily broken in to pieces while simultaneously easier to use together so that just the form part of the 'big ZIP-code PHP library' could be used in this case, but barring that, this is a neat attempt at code-by-documentation, given that most of the problems I saw were easier than homework problems.

mseebach 14y ago
> but I think that a good enough feedback mechanism could over-come this, and sites such as Stackoverflow have implemented feedback mechanisms that could work But people are on SO out of a desire to help other people, and SO specifically encourages general problems - so saying "that's not possible" is the right answer to the syllables problem instead of some messy thrown together code that doesn't actually work. By introducing the financial reward system, this goes out the window. I get nothing out of commenting on bounties, explaining why answers are wrong or requests impossible because I'm not contributing to a community of being helpful to future people running into a problem. > IMO, the 'right' solution is for libraries to be more easily broken in to pieces while simultaneously easier to use together Sounds good, but that's not how software development works. The cognitive skills required to break down a problem into such pieces is significantly higher that those required to write code that performs the task.
- fragmede 14y ago
  > I get nothing out of commenting on bounties, The system could easily pay a pittance for commenting, and then more for distinguished answer; and hell, a monetary penalty for poor answers/spam. Also, correct me if I'm wrong, but it seemed like the accepted answer, along with its code, was freely available, so future people do get the benefit of your insight. > The cognitive skills required to break down a problem into such pieces is significantly higher ...so why should they waste their valuable time doing both the documentation and implementation?

tonylampada 14y ago

I like this site's idea, but I'd still place my tasks on http://freedomsponsors.org http://freedomsponsors.org. Disclaimer: I'm FS's founder. I think the "pre-paid" bounty system makes users feel uneasy about whether they'll get something for their money or not. I believe that the "pay what you promised, after you've gotten it" model works best.

dagw 14y ago

There are two related cases I can think of where a task is easy to describe and reasonably easy to do, but tedious enough that I'd consider paying someone. One is 'port functions x,y and z from library A to language B' and the other is 'implement algorithm X as described in paper Y using language Z'. Basically cases where the description bit is already done by someone else and a reference implementation to test against already exists. In fact I have just such a task that I've been putting off (I have a paper and a matlab implementation, and really want a python/numpy version), that I might throw up on the site to see what happens.