CSS Variables landing in Chrome 49 - <AUTHOR> https://developers.google.com/web/updates/2016/02/css-variables-why-should-you-care <comment><USER2> For those commenting about SASS having this forever etc, note that this goes a step further:

        :root { --color: blue; }
        div { --color: green; }
        #alert { --color: red; }
        * { color: var(--color); }

You can't accomplish that with SASS today. More info [0].

In fact, this feature isn't even covered with cssnext:

        The current transformation for custom properties aims to provide a future-proof way of using a limited subset (to top-level :root selector) ... [1]

I'm very curious whether or not this paradigm will be accepted as "best practice", or how it will be used.

[0] [https://developers.google.com/web/updates/2016/02/css- variab...](https://developers.google.com/web/updates/2016/02/css-variables- why-should-you-care#the-cascade)

[1] [http://cssnext.io/features/#custom-properties- var](http://cssnext.io/features/#custom-properties-var)

<comment><AUTHOR> Don't forget that CSS Variables can also be used within media queries.

<comment><USER3> And if you change a CSS variable in JS, it will recompute all of its uses.

</comment></comment></comment><comment><USER4> They're already enabled in Firefox, and they'll also be supported in the next version of Safari.

I'm going to use these to allow changing the appearance of my app, which has a Windows 95-style UI. 95 has many customisable values that determine how the UI looks (fonts, font sizes, font styles, foreground and background colours, UI element sizes, etc.) that it stores in certain registry keys and that the user can change from the Display control panel applet. In my app, I'll be using CSS variables in place of registry keys.

<comment><USER5> you are using reg keys to store properties? is it a chromium app?

<comment><USER6> He was just explaining how it worked in Windows 95, he will be using CSS variables instead.

<comment><USER4> She, and yes, that's the idea. I couldn't explain it very clearly.

<comment><USER6> Sorry, I always default to the male form for some reason.

</comment></comment></comment></comment></comment><comment><USER7> I've wondered for years why we're using pre-processing to get variables into CSS. Given that there hasn't been a commonly advocated workflow that didn't include some sort of CSS processor (like LESS or SASS) in about a decade, it seems like somebody working on the standards would have realized that CSS needed variables, at the very least. So, it's cool that it's coming, though it's taken a lot longer than I reckon it probably should have.

I would normally say, "But, at least there's been time to work out the syntax in non-core projects, so things are probably nice now." But, this syntax and behavior doesn't even resemble SASS or LESS. Is there some other tool out there that provides variables in CSS that this is modeled after? Why reinvent the wheel when so many people are already familiar with and have worked out the quirks in SASS or LESS?

Reading the explanation for why they went this way (in short, because these are nothing like SASS variables, in the sense that SASS is more like a macro): [http://www.xanthir.com/blog/b4KT0](http://www.xanthir.com/blog/b4KT0)

Is somewhat unconvincing. Why not implement what's already working for people in SASS/LESS (in the way it's already working), and then move on to whatever it is they've implemented here later once it is clear it's something people want/need and once it's been worked out in pre-processors? (I don't think I quite grasp the entirety of the difference, either...is it merely a matter of scope and composability?).

Actually, someone in the comments maybe sums it up:

 _" In fact, let me see if I've got this straight in my head:

CSS preprocessors added a feature called variables, but which would more accurately be described as macros.

Browser vendors and the working group worked sporadically on an in-browser implementation and standardisation of this macro feature, and they also called it CSS variables.

The WG's focus shifted to a feature more akin to custom properties, but which retained the name CSS variables.

So, right now we have CSS variables in preprocessors, which are macros, CSS variables in browsers, which are custom properties, and maybe at some point in the future, macros in the browser, and actual variables in the browser."_ (Source: [http://www.xanthir.com/b4KT0#4KT0-13](http://www.xanthir.com/b4KT0#4KT0-13) )

<comment><USER8> The CSS team has people like this, who no longer make websites: [https://www.w3.org/People/Bos/CSS- variables](https://www.w3.org/People/Bos/CSS-variables) Thus they're disconnected from current web developers.

Meanwhile Smashing says something like 77% of audience uses SASS.

<comment><USER9> Ah, Bert Bos, the W3C's "style activity lead". What a joke.

He's the guy who wasted a decade writing an ASCII-art based "template layout module"[1], which he was never able to persuade a single browser vendor to implement. It eventually got demoted from a working draft to a "note", which is the W3C's polite term for standards fanfiction.

His other major achievement is putting his own photo on every one of the CSS working group's web pages. I'm not joking: [https://www.w3.org/Style/CSS/#endmatter](https://www.w3.org/Style/CSS/#endmatter) .

And let me tell you tale of that photo/byline. It originally appeared on the working group's crappy 1990s site, which persisted until the late 2000s (because that's how fast things move at the W3C), and you could kinda forgive it as one of the dumb things people put on dumb 1990s websites.

Anyway, eventually it became too embarrassing that the working group responsible for CSS had such a shitty site, and some other members of the group took it upon themselves to produce a shiny new design with useful content, but sans Bos' photo. This done, they submitted what they'd come up to the W3C. Eventually, it showed up on the W3C's servers but, surprise, surprise, it had been rather mangled, and Bos' photo was back, clumsily shoved into a footer where it hadn't originally been.

It's a small, petty thing, but all the more hilarious for it. God knows how that guy still has a job at the W3C. Maybe he's best friends with Tim Berners- Lee, or something?

[1] [https://www.w3.org/TR/css-template-3/](https://www.w3.org/TR/css- template-3/)

<comment><USER9> To be fair though, I should also say that nowadays the CSS working group has a lot of very smart people who absolutely understand the needs of web developers/designers, and have been tireless in getting things like Flexbox specced and implemented across different browsers.

CSS is about a decade behind where it should be, but that's not the fault of the people working on it now. And I think its future is actually comparatively bright, especially with the Houdini project taking off.

</comment></comment></comment></comment><comment><USER10> custom props beginning with 2 dashes is slightly annoying given the BEM syntax has already grabbed that as Modifier...

      .foo {
        &--bar {
          --bar: 0;
        }
      }

It's a pretty contrived example, but akward to comprehend at first glance.

</comment><comment><USER11> The syntax is verbose and ugly compared to SASS

<comment><USER12> I think a lot of people agree with you but there is a reason:

[http://www.xanthir.com/blog/b4KT0](http://www.xanthir.com/blog/b4KT0)

<comment><USER13> Stupid decision, the should have used $foo (dollar sign for variables) like in Perl and PHP. It remind me decisions of standards based on XML (XLST, XML- Schema, RDF, etc).

<comment><USER14> Read the linked post. Css variables are nothing like macros like sass's `$foo` and css might support macros with sass's `$foo` syntax in future.

<comment><USER13> I _read_ the article, that's why I commented because "might support something in future" that probably never happens, is what I related to XML based formats design decisions go wrong. Argh, but thanks for misunderstanding and downvotings.

</comment></comment></comment></comment></comment><comment><USER15> Ok, that's cool. How long until we're able to use this and not have to worry about browser incompatibilities?

<comment><USER16> You can use it today with the help of [http://cssnext.io](http://cssnext.io)

<comment><USER17> You can use a limited subset. cssnext isn't magic, it's purely a source transformation, there's no runtime. It can't handle the dynamic part of css variables.

<comment><USER18> Yeah, CSSNext here is basically the intersection of CSS variables and Sass variables - you can only use them in property values (like CSS), and you can only declare them at top-level (like Sass).

It's nice if you really want to utilize the current syntax, but it's less powerful than either option it's derived from.

</comment></comment></comment></comment><comment><USER19> Well, that was a long time coming. I was playing with a beta version of CSS Vars 4+ years ago, which was then removed and eventually replaced with this.

</comment><comment><USER20> I'm not a fan of this...

/* JS */ var styles = getComputedStyle(document.documentElement); var value = String(styles.getPropertyValue('\--primary-color')).trim(); // value = 'red'

Rather than calling '\--primary-color', you should really be able to call 'color' which points to the variable and will still return red. Otherwise you'll have to know the name of each variable being used, which is much more difficult than knowing the property.

<comment><USER21> Variables are ultimately used somewhere to set a property, with something like

        color: var(--primary-color);

If care about that property, and not the variable, then get it as usual:

        let value = styles['color']; // 'red'

</comment></comment><comment><USER22> Is there a way to access it from javaScript? Can JS code set CSS --color and make it change.

<comment><USER23> It looks like this can be changed with `setProperty`. There's a demo[1] that works on Firefox 31+ and Chrome 49+

[1] [https://www.broken-links.com/2014/08/28/css-variables- updati...](https://www.broken-links.com/2014/08/28/css-variables-updating- custom-properties-javascript/)

<comment><USER22> Thanks. I wonder if it could be creatively misused to act as a database.

</comment></comment></comment><comment><USER24> Why don't they just natively support realtime compilation of SASS/LESS?

<comment><USER10> the performance would be horrible.

</comment></comment><comment><USER25> Just add native support for Sass and call it a day.

<comment><USER26> SASS encourage developers to build long chains of selectors and it makes them brittle and non-reusable.

<comment><USER10> Yeah, it's easily abused and trivial errors of judgement create non-trivial problems later down the line.

IMO part of the problem is that nested LESS/SASS looks _just enough_ like JSON to mislead inexperienced devs, who often try to treat the nested structure as an object, rather than thinking of it as a string-builder.

It invariably ends up creating huge swarths of pointless specificity and stylesheet bloat.</comment></comment></comment>


Is sugar the world's most popular drug? - <AUTHOR> https://www.theguardian.com/society/2017/jan/05/is-sugar-worlds-most-popular-drug <comment><USER2> Totally anecdotal: I tried quitting sugar for three months (keto, 20g carb limit daily) and had sugar withdrawals for about two weeks.

After that, much more consistent energy and no cravings whatsoever.</comment>


Ask HN: Which Companies Give Their Employees Private or Team Offices? - <AUTHOR>

Here on HN there are so many people that loathe open office layouts, and it seems like there is a lot of energy spent yearning for privacy, but I don't think I can name any companies other than Fog Creek Software that actually give employees a private office or small team office.
I run an office design website and want to write an article about it, but it also seemed like it would be nice way to see who is bucking the trend of the open office plan.
Which companies give their employees private offices or small team offices? <comment><USER2> Google has team offices for some teams. My first year here my team was split in two 5-person offices with doors. For the last year we were in an open office space. Soon we're moving again and some of us will be in team offices again of 3-4 people. I don't know the percentage of team offices vs open offices across the company though.

Also, since moving into our current building they've added sound-resistant walls and barriers in various places which has helped significantly.

(Speaking for myself, as a happy employee.)

</comment><comment><USER3> Microsoft has private offices with doors, or did when I was there. Some offices were shared with two desks on opposite walls. On the other coast, I had an office at DuPont too.

<comment><AUTHOR> Ah interesting. I've published a number of MS offices and from what IC an tell from the images, many staff work in open plan layouts. I wonder if higher up staff receive private offices?

<comment><USER4> MS likes to talk about the fancy new offices they're building, but all the old building, e.g. where Windows, office, etc are all private offices with 1-2 people in them.

Contractors get screwed though and stuck in much larger shared offices.

<comment><USER5> I thought MS was planning to phase out private offices and go open office for everyone?

</comment></comment></comment></comment><comment><USER6> Most places utilize cubicles. The open floor plan eliminates those cubicle walls and re-arranges the desks to face each other (or replacing several desks with larger conference tables).

<comment><USER5> I haven't seen cubicles in awhile. It's been all open offices, every place I interviewed in the past several years.

</comment></comment><comment><USER7> Epic Systems (healthcare software, epic.com) does.

</comment><comment><USER8> When i consulted for microsoft i expected an office with a door i could shut. what i got was quite literally called the boiler room. it was worse than the open plan in that the other consultants were all on unrelated projects so we had little we could talk to each other about.

there were no windows, and so many computers that it was very noisy and hot.

Now when i interview i ask to be shown where i would sit.</comment>


Ask HN: Cities underserved by tech jobs? (Europe Edition) - <AUTHOR> This question was asked last week and basically asked, which tech cities in the US are hidden gems and often overlooked. Atlanta and a number of other cities were posted and at least how the commenters described them, they sounded like very liveable places.
Which got me thinking, are there overlooked tech cities with good pay, affordable living etc. in Europe?
tldr: Cheap, good tech cities to live in Europe? <comment> a-saleh I live in Brno, Czech Republic. It is ~400k city, that grows by another ~100k when students return :-)

Tech scene: * We have Red Hat, Net Suite/Oracle, GoodData, Seznam (local search portal, still somehow competing with google), and few smaller startups and local it shops. * I did work at Red Hat for 6 years here, and the office was nice :-) * You would find expats in larger corporations, you can get by speaking mostly english in larger corps (i.e. I had a manager who relocated from New Castle to Brno)

Salary:

From what I heard, based on your role, seniority and skill in salary negotiation, you get between 1000 and 4000 eur/month pre-taxes. So far I don't know many friends that would make more, but I have met few people that do consulting/own small game companies, that make N-times more. Cost of employment (social security, medical insurance, taxes) are around 40%, and as an employee you don't have many ways to lower that. Some companies allow to have you work as a contractor. Beware that being a contractor that is effectively an employee is illegal ;)

Cost of living: * it is a student city. If you are content with single room in a shared flat,that would cost you ~200Eur/month, a two/three bedroom flat, depending on location, 500-700Eur/month.

* lunch during lunchtime costs you around 4Eur. Dining around 5-10. Loaf of bread costs ~1Eur.

* There is decent public transport, year-pass for the whole city costs between 100 and 200 Eur.

* I use Eur for the sake of comparability, Czechs still have their own Crown as currency.

Entertainment:

I don't really go out much these days, but Brno has good beer, and cheap if you like lagers (0.5l around 1E). There is several tearooms with high quality tea, some serve sheesha as well. Coffe snobs can find their coffe. There is board-gaming scene. There is climbing scene with several clibming/bouldering clubs. Rest I don't really know, but most of the things you'd imagine some subgroup of those ~100k students might want in the city, you can find here :)

</comment><comment><USER2> Bristol is probably the biggest tech hub in the UK outside of London. It's considered an expensive place to live, but you can find affordable housing if you're willing to live on the outskirts in a less desirable place, with the added benefit of house prices continuing to rise in those areas.

I've never lived there, but I've worked with Serbian developers that say that Serbia is fantastically cheap, and has a number of tech jobs available due to outsourcing to the country.

</comment><comment><USER3> I moved to Barcelona after finishing University in the UK, the pay is pretty good in multinationals taking into account the cost of living but the rent has been soaring recently. The weather is nice too.

I used to live in Edinburgh and that is also an excellent city with a much better cost of living than London and still pretty good companies and salaries (including the financial sector). Doesn't have such great weather unfortunately.

<comment><USER4> What's the higher range of the salaries in Barcelona. I work in USA, east coast and with 10+ years of experience, salaries can go as high as 200K+. How does this compare to Barcelona or other European tech cities? I am curious.

<comment> a-saleh In your case I would try to relocate. I worked at Red Hat and from what I heard you could relocate from i.e. US to Czech republic and retain your salary. This was rare and I am not certain about the specifics, but I have seen it happen several times.

<comment><USER4> Unfortunately, I don't work for a multinational.

</comment></comment></comment></comment><comment><USER5> Bucharest, Timisioara, Belgrade, Zagreb, Osijek, Sofia, Madrid, Barcelona, are fairly livable, yet they all boast a decent tech scene.

I can provide intel on Bucharest, Timisoara, Belgrade, Zagreb and Osijek.

<comment><AUTHOR> Would love intel on Bucharest. I visited last year and was positively overwhelmed with how friendly the people were and how cool the cafes and restaurants were. How is the tech scene and daily life there?

<comment><USER5> I can provide on Timisoara. My experience with Bucharest was rather limited while very positive.

Most tech scene in Romania is outsourcing and there is some R&D for major players.

Romanians are by and large friendliest Eastern Europeans.

Timisoara is a nice second tier city. Many low cost flights across Europe and Middle East. Many places are also reachable overland (I'm closer to Timisoara than I'm to Zagreb, my country's capital). Food is brilliant. So are the coffee and the wine. Dating scene is also great. Music scene is amazing as well. If you go entrepreneurial, or just wanna outsource, the talent pool is exceptional.

</comment></comment></comment><comment><USER6> In Germany I'd say Cologne.

</comment><comment><USER7> Can you post a link to the US thread?

<comment><AUTHOR> Yes sure, my mistake I should have included it in the original post. Here it is: [https://news.ycombinator.com/item?id=17729579](https://news.ycombinator.com/item?id=17729579)</comment></comment>


Enums as configuration: the anti-pattern - <AUTHOR> http://www.jessesquires.com/enums-as-configs/ <comment><USER2> The proliferation of enums limits vision; you tend to produce toasters rather than "breakfast food cookers".

[http://scienceagainstevolution.info/dwj/toaster.htm](http://scienceagainstevolution.info/dwj/toaster.htm)</comment>


Ask HN: Which advertising networks would you like to see benchmarked? - <AUTHOR>

After some talk in another thread about making money using small sites I've decided I'm going to spend the next couple of months comparing the various advertising networks and write up my experience.
Which advertising networks would you like to see benchmarked?
I have enough inventory that I think that I can run a bunch of them in parallel. <comment><USER2> adbrite, especially where you can find good advertisers through there with all your traffic or whther you get the same ads as smaller fish

</comment><comment><USER3> tribal fusion, also adbrite(I know they suck, but as long as we are doing benchmarks, worth adding them), also adroll

</comment><comment><USER4> Six Apart Media,Technorati,BlogAds,BlogHer Ad Network ( despite name, is not just on "women's" blogs)

<comment><USER4> (also, thanks for putting this thread together)

</comment></comment><comment><USER5> You can also report the variation of CPC if you can access that data, would be interesting.

</comment><comment><USER6> federated media, netshelter, advertising.com, burstmedia</comment>


Pitching your early-stage startup - <AUTHOR> https://stripe.com/atlas/guide/pitching <comment><USER2> Also worth checking out Patrick's tweet storm following his tweet about this new resource -> [https://twitter.com/patio11/status/909800194509758464](https://twitter.com/patio11/status/909800194509758464)

</comment><comment><USER3> Since the guide is partly focused on the YC application process, I have one thought (potentially misconception) that I would like others to weigh in on. For context : I'm working on a Disqus alternative with a focus on privacy, so no ads, no tracking scripts ( [https://www.indiehackers.com/@ploggingdev/building-my- first-...](https://www.indiehackers.com/@ploggingdev/building-my-first-saas-a- disqus-alternative---the-research-baa806bdfd) ). I started working on it a little over two weeks ago and am a few days away from launching. So by the application deadline, I would have only onboarded beta users. Being a single founder who has been working on a product for less than 3 weeks, even if I follow all the advice and craft a well written YC application, I just don't see why YC would consider funding me instead of the numerous other applicants with serious revenue and something that might resemble product-market fit. In other words, I think when talking about crafting a YC application, it's important to discuss that there exists a certain baseline above which such guides really make sense. Sure, I could apply the actionable advice to my application, but will it move the needle at all when I'm a single founder with an MVP? On the other hand the only impressive part about the application might be that I built it in under 3 weeks and onboarded beta users. Thoughts?

<comment><USER4> We need your product: email me at email@example.com

Your solving a big problem: having commenting that protects user privacy. We are happy to pay if the product works in our use case.

Totally off the parent topic, but you do seem to be building something that is incredibly useful, at least for us.

<comment><USER5> This is a great example of a company with a "hair on fire" problem that needs a solution - his first words are "We need your product" and a solicitation to a custom email address. And this is based on a one sentence description and a link to a blog post.

This is the kind of reaction you want to see in your customers.

</comment></comment></comment><comment><USER6> Great writeup, though I have to be completely honest here and say that I love Patrick's writeups for independent hackers, makers, micropreneurs, bootstrappers etc. His writings and practical case studies gave me the power, as a nobody, to make tens of thousands of dollars in order to be more with my wife and child, while doing the work I love. I kind of miss those essays.

<comment><USER7> Really happy to have helped. That kind of company is pretty near and dear to my heart, for all the obvious reasons, and it is very, very in scope for us at Stripe Atlas. Not everything we publish will be laser-targeted to the needs of the Italian diner on the Internet, just like not everything will be appropriate for the want-to-ride-a-rocket-ship folks, but I hope you like some of the stuff coming down the pipe over the next few months.

</comment></comment><comment><USER8> I'm a VC, and this list is great. At a high level, VCs care about three things: team, product/idea, and market. Every VC cares about all of these things, but their prioritizations vary.

Most of Patrick's excellent advice can be lumped into these three buckets. Specifically:

1) You have to establish the credibility of the team: you've done impressive things before; you have a deep understanding of what you're working on now; you can read your audience and know how to communicate effectively; you can get a strong intro (nice-to-have); etc.

2) You have to establish the viability of the market: it's big; it has a real problem; the existing competitors are not doing a good job in a clear way; etc.

3) You have to establish the quality of the idea/product: you have a unique insight or approach relative to competitors; the prototype/early validation is strong; etc.

A lot of the pitches become mediocre when founders are handwavy in one or more of these areas. For example, if the founder spends a lot of time talking about the market and the product idea, but not enough time explaining why the team is uniquely/extremely qualified to succeed. Or the founder has good answers to product/team/market questions, but their answers show they don't know how to read the audience or explain their idea. (Example of not reading the audience: the investor is non-technical and the founder, who is productizing their PhD thesis, spends 90% of the pitch geeking out about technical details.)

Also, I'll add a few tips:

\- Don't exaggerate or mislead. An investor will pass if they doubt one of your statements ("silverware is a $150 billion dollar market!") or realize that you're spinning facts (e.g. you say Dropbox is a customer, but later it turns out you meant that one of your free users has an @dropbox.com email). If it turns out that one statement you made is false, then investors will assume there might be more.

\- Understanding risks is better than sweeping them under the rug. If your competitor landscape is missing key companies (mentioned in Patrick's post) or you dismiss some $1b+ company as a competitor without any rationale, your audience will become very skeptical. Admitting something is a problem and explaining how you will address is it much more compelling.

\- Really know the ins and outs of everything about your company -- at least relative to the audience. If I ask a question or make a product suggestion that the founder hasn't considered, that's a yellow flag. Someone who has been living and breathing their startup for several months should have a much, much deeper knowledge of their domain than an investor who is hearing about it for the first time.

<comment><USER9> From the OP, by the time my solo, sole founder startup has $10,000+ a month in revenue, my startup will have plenty of cash for very rapid growth; cash for growth will not be a tight constraint; and no VC need call!

The OP is significantly about applying to YC: From what I've heard, YC doesn't much like sole, solo founder startups!

Why should no VC need call? For my startup, a PC server from $1500 in parts kept on average half busy 24 x 7 should generate well over $200,000 a month in revenue. Thus there would be plenty of cash for more PCs at $1500 each. Even $10,000 a month in revenue would yield plenty of cash for more servers.

SUSA Ventures claims to want "technical founders". Alas, it doesn't look like the SUSA partners are very technical!

"Warm introductions"? SUSA and many want "warm introductions": But VCs and I do not have associates in common. So, I can't get a "warm introduction" to a VC, and no VC can get such an introduction to me. E.g., I might be able to get a "warm introduction" from one of my Ph.D. dissertation advisers, at one time President of one of the world's best known research universities especially famous for their STEM field graduate programs, including computer science and AI. However I doubt that that person knows any information technology VCs. E.g., recently Tom Magnanti, Dean of Science at MIT, gave a technical lecture on the foundation of the Internet at a lecture series named for Professor X. Well, Professor X was the Chair of my Ph.D. orals committee; maybe I could get a warm introduction from him; but likely he knows no information technology VCs. Net, my background is technical, but VCs are not qualified to be my technical colleagues or associates -- VCs don't _measure up_.

For the people I know, the best form of an introduction is a good peer- reviewed paper of original research in a STEM field, preferably applied math complete with significant theorems and proofs. It appears that there are few or no such information technology VCs anywhere in the US and similarly few who could accurately evaluate such a paper.

SUSA Ventures claims:

"We seek out highly defensible companies that leverage data, economies of scale, or network effects to build value and achieve longevity."

"Seek out"? My experience is that SUSA ignores such things even when they land in their e-mail inbox.

IMHO, for the OP again, all the advice on pitching information technology VCs is noise and filler and useless except just one word, "traction", preferably in the form of after-tax earnings significantly high and growing rapidly. But for a sole, solo founder startup, by the time the business has traction enough for a VC to write a check, the founder likely will no longer accept such a check.

<comment><USER8> Not sure where you're getting your data, but:

1) $10k/mo is not even close to enough for most US companies that want to grow quickly. If it were enough, then way fewer founders would want to fundraise.

2) I'm a partner at Susa and I'm technical. And even if I weren't, being technical has little to do with being a good partner to technical founders. Most basketball coaches can't dunk, but they are still good coaches. Furthermore, if a founder is technical, then a non-technical VC/advisor/mentor/friend that can help in other areas can be more useful than someone who is technical. Most technical founders I work with have no problem with building tech, but many struggle with the business side.

3) Our website says we prefer warm intros. We don't require them, we just prefer them. I reply to cold emails frequently and often meet people after they cold email me. But the cold emails should be good/well-targeted, and unfortunately most are not.

4) Traction is not the only thing that matters. For example, I just did a quick calculation, and over half of our investments in the last 12 months had $0 revenue when we invested. Many of those investments hadn't even launched yet.

<comment><USER9> > $10k/mo is not even close to enough for most companies that want to grow > quickly.

I got the $10,000 a month from the OP.

I'm a sole, solo founder. So, right, my startup doesn't have five founders, each with credit cards maxed out, each with a pregnant wife about due.

And, right, my startup has no co-founder disputes. And since I'm 100% owner, I have no BoD disputes and spend no time reporting to a BoD.

Since I'm technical, I have no need to search for a technical co-founder.

To me, $10,000 a month revenue is a LOT of money for growth.

E.g., for my startup, the main opex is just my monthly ISP bill. From my ISP, my upload data rate is 20+ million bits per second (Mbps), which for my startup is a LOT (if on average half filled would amount to ballpark $4 million a month in revenue), and when I go live the only difference will be a static IP address instead of a dynamic one (from DHCP or some such). The ISP bill is less than $100 a month.

For now and well into a quite successful business, my main capex is just servers, and there, again, for my startup $1500 in parts for a server kept half busy 24 x 7 should generate $200,000+ a month in revenue.

My first server will go at my left knee. When that fills up, I will be awash ($200,000+ a month) in revenue for more and I can put a second one beside the first one. Then I can start putting servers and higher end Cisco boxes (LAN and/or router with whatever network security Cisco recommends) on shelves and/or standard racks in any of three empty bedrooms. If I fill up those servers in all three bedrooms, then it's millions a month in revenue, all still from just one employee, me. Then, sure, go rent some space, say, much of a closed factory, warehouse, or shopping mall, and start slowly hiring, first, a good office manager to interface with the lawyers, accountants, auditors, bankers, real estate people, security guard company, janitorial company, business insurance agency, payroll firm, HR consulting company, interior renovation contractor, ..., etc.

I'm "technical"? I saw the market need, designed the first good solution, an excellent one, did the crucial, core, technological advantage, barrier to entry, proprietary original applied math research, designed, wrote, ran, timed, documented, and debugged the code. Some of the AI people would call my applied math AI; to me, calling my applied math AI would be a gross insult.

To the users, the solution is just a Web site. I used Microsoft's .NET with ASP.NET (for building Web pages) and ADO.NET (for access to SQL Server). I wrote the code in Visual Basic .NET (as far as I can tell, compared with C#, essentially a nicer form of syntactic sugar and otherwise close enough to apparently Microsoft's most important language C#).

I've done serious software, mostly scientific and engineering, for a long time, but this is my first Web site. My first code for my startup is also my first production code (no throwaway prototype code), and, from the user interface to the back end servers, it all looks fine -- no need for _refactoring_. The code as is should be good for a major business, but then I should likely put in some code for good real time system monitoring, sharding, etc. The server farm and software architecture were designed to be scalable, e.g., via simple sharding, and some of the sharding logic is running in the code now. If the site gets north of, say, 10,000 users a second, then likely will need some more work on architecture and some more code. Then maybe, as a good Microsoft customer (Windows Server, SQL Server), I'll call Microsoft for some high end consulting -- Microsoft has lots of people who long since have been there and done that.

The code is only 24,000 programming language statements in 100,000 lines of typing (lots of in-line documentation). I wrote the code with just a good text editor (KEdit), and there have a lot of macros that help the work. E.g., in my code, at a use of something tricky from, say, ASP.NET, one keystroke opens the relevant Microsoft MSDN Web page of documentation (from pages on my disks). And the code has lots of other references to my documentation outside the code. And the code has cross-references in the code -- for a _key_ of such a reference, I use just time and date; since I'm the only one typing the code, those keys are unique. Then I have some macros that, given a key, will go to the location with that key. Simple. So, I never used Visual Studio or any other integrated development environment. I didn't need on-line debugging -- my bugs were too few and too simple.

The server farm architecture has a Web server (sure, using Microsoft's IIS), a Web session state server (my own code, TCP/IP sockets, object instance de/serialization, and two instances of a standard, likely at most O(n ln(n)), collection class), soon to have (instead of Microsoft's solution I'm using now) a Web log server, SQL Server, and two specialized applied math servers.

All the communications among the servers are just simple TCP/IP sockets. Right, each of these _servers_ is just software and, thus, can run on anything from one to several physical servers or virtual machines. So, sure, will get to do some load balancing and resource allocation. Likely just use the bottleneck principle: Find the main bottleneck and open up that one. Else could do some applied math optimization, likely not necessary.

All the four servers from my coding are single threaded, and the queuing is just from the TCP/IP stack -- if occasionally that doesn't work, say, from just TCP/IP input queue stack overflow or a dropped packet from a TCP error, then I'll see the evidence in the Web site log file and tweak the logic a little.

In production the main data will be read as fast as possible but written only once a week or so so can make great use of the solid state disk (SSD) drives. Originally my back of the envelope arithmetic indicated that I could provide a mature solution for the work for the world with about 150 TB of such data, and now that much data can be in maybe just one server. Then one nice, easy, simple approach to scaling is just to have multiple copies of the 150 TB.

Business experience? Done that at GE, two small companies near DC, FedEx, IBM, and some consulting. Been a B-school prof -- so, can claim to have taught business.

The problem I'm solving? Pressing for nearly every user of the Internet in the world. Fully safe for work. Squeaky clean. Culturally uplifting. Can contribute significantly to better government, alleviation of human suffering, and world peace.

Initial users, likely the Chablis-Brie, BMW, opera-going, ski challet set. So, right, good ad demographics. Later may do own especially effective ad targeting (from the unique data from the site and some of my original applied math).

For the problem, currently there is no good solution deployed. My guess is that my first good, really, excellent, solution will be a "must have", for nearly everyone on the Internet -- smartphone, ..., desktop, workstation.

For the revenue, initially all just from ads just in standard sizes, initially likely just from ad networks, I'm starting with focus just on the US. Eventually I'll go international but, to get good ad rates, likely only in the more advanced countries.

So, sure, get good usage from a large fraction of all the Internet users in the world and will have a company worth from a few old peanuts up to $1 T or so, somewhere in there.

Users need only a Web browser up to date as of, say, 10 years ago. For JavaScript, I have yet to write a single line of it; Microsoft's ASP.NET writes a few lines of JavaScript for me apparently for some usage I've made of ASP.NET; but users need not have JavaScript enabled. My site has only two main Web pages, and they send for about 400,000 bits each (with the JavaScript). The page layouts are simple -- just tables with everything positioned to the last pixel -- so, no HTML div tags. The pages use just a few, standard HTML _controls_ and are easy to read from large fonts and high contrast. Some of the colors have been borrowed from some famous, very successful Web sites. So, the pages load very quickly and don't jump around during loading. A user doesn't need a fast connection to the Internet. The pages are simple with no icons, pull-downs, pop-ups, roll-overs, or overlays. Simple.

My site makes no use of cookies, and there are no user IDs, passwords, or logins. User privacy is very well protected.

Net, for users, it's simple, dirt simple. It's so simple a child of about seven who knows no English should be able to learn to use the only version of the site, in English, in about three minutes of tutoring or just figure it out in about 15 minutes.

But, from all I've seen, VCs and YC don't like solo founders. And by the time my traction is $10,000 a month, no way will I get a Delaware C-corporation, a BoD, a term sheet, and an equity check.

By $10,000 a month, my startup is already well up in the air and climbing rapidly when it's too late to buy a ticket.

Besides, when I wrote SUSA all this stuff in an e-mail message, it was totally ignored.

I have to conclude, VCs including SUSA (A) ignore their e-mail and (B) really want to see traction, i.e., notice the startup from the traction, not a contact from the startup.

The OP mentions accomplishments: Sure, I've got a bunch. E.g., I can literally claim to have saved FedEx from going out of business twice, once from some software with a little math and once from some math with just some calculator arithmetic. Yes, my office was next to that of FedEx founder, COB, CEO, F. Smith who remembers me; but I doubt that now he knows any VCs!

Do big stuff really fast? Been there, done that lots of times: (A) In grad school, I took a one semester reading course to study a question; in two weeks I had a solid answer to the question, with some nice, new results, that I later published. One of my results solved a problem in the famous Arrow, Hurwicz, Uzawa paper in mathematical economics -- of course, Arrow won his prize long ago and Hurwicz got his a few years ago. IIRC Uzawa has yet to win his! So, one semester, in two weeks, and didn't just study the problem but solved it with a publishable solution. Strictly, my solution would have been a Ph.D. dissertation -- two weeks, no faculty direction, maybe a record? (B) Some engineers for the US Navy were processing some ocean wave data and were confused about some points in stochastic processes. So, I got out Blackman and Tukey, got smart in a day or two, and for the rest of the week wrote illustrative software. On Friday evening I called in one of the engineers, ..., presto, bingo, our software house got sole-source on a nice development project. (C) The Navy wanted an evaluation of the survivability of the US SSBN fleet under a special scenario of global nuclear war but limited to sea, in two weeks. I saw a continuous time Markov process subordinated to a Poisson process, designed, wrote, and ran the code, had my code pass technical review by a famous prof, and the Navy got their results on time. Ah, that prof likely doesn't know any VCs either! (D) I've learned and used calculus and advanced calculus, taught calculus in a university, and published peer-reviewed original research that used calculus, but I never took freshman calculus and, instead, taught it to myself. (E) For my Ph.D. dissertation, I identified the problem before I went to grad school and worked out an intuitive solution in my head on an airplane flight. I did the solid, original applied math independently in my first summer in grad school. Then I designed, wrote, debugged, ran, and carefully timed the software -- with some stuff I did to make the software fast, it ran in about 100 seconds instead of about 64 years; otherwise I'd still be in grad school. I never really had any faculty dissertation direction. I wrote the software in two months, heavily during Christmas at my wife's family farm, and wrote and typed the dissertation in six weeks. I stood for my oral exam, and graduated. (F) As a ugrad math major, I wanted to learn general topology, got the leading book, advanced, not easy, got a reading course, taught the material to myself, and gave lectures to a prof. One week I covered a chapter, and the next week, the exercises. The prof taught me nothing. (G) From doing such math as an ugrad, my math GRE score was 800. (H) I've taught computer science to ugrads at Georgetown U and to grad students at Ohio State, but I never really took a course in computer science. (I) A computer sciences prof had written a statistics package but during testing got poor accuracy from his polynomial curve fitting code. Well, he was using the normal equations which for polynomial curve fitting are numerically unstable. So, I wrote some code using orthogonal polynomials that gave very accurate results.

Do those accomplishments count?

I still have some interest in communicating with VCs if only to get their feedback. But the main feedback I get is just silence. Again, I don't have $10,000 a month in revenue, and, again, when I do it will be too late for me to accept an equity check.

Again, I wrote something like the above to SUSA, and it was all just ignored. Totally ignored. Sorry for no "warm introduction" \-- we don't know the same people.

<comment><USER10> Sorry but if you cold emailed this to a VC, it makes sense that you didn't receive an answer. It's a rambling wall of text packed with irrelevant technical information. I now know your tech stack, infrastructure and the text editor you use, but I still have no idea which problem you are trying to solve. All I know is that you're doing some kind of applied math that you don't want people to call AI.

Instead try to look at your cold email like a pitch. If you apply the advice from OP, I'm sure this post will be much shorter and actually explain the product you are building and who the customers are.

Also, a pitch is two minutes. This post took me forever to read.

<comment><USER9> I start e-mail messages to VCs with a very short _pitch_ that explains the problem I'm solving, the _market_ it is in, why there's a good shot at 1 billion devoted users, why my work is the first good solution, etc. Darned short.

I've never explained the problem I'm solving in public -- not yet. When I have an open beta, then it will be obvious, but I want to keep that much detail non-public until my beta and going live.

Sometimes I stop there. Sometimes I include some more of what I gave above. I never include as much technical information as above -- that is for an HN audience.

I wrote the above for the HN audience to explain what I can that HN could understand.

For the list of "accomplishments", some VCs, including SUSA, claim that they like to see such.

My main point is, in conflict with the OP and with SUSA's remarks on their Web site and in this thread, VCs including SUSA don't respond anything like they claim to. I wasted HUGE time contacting VCs, sent them dozens of highly polished e-mail messages, e.g., including very carefully written PDF _foil decks_ , some with only 10 or so foils and only 250 words in total, and the response was essentially always the same -- silence. Could call, get an assistant, give her (always a female) a _heads up_ about the e-mail, could leave phone messages, could send e-mail follow ups, etc., and in all cases, nothing significant.

My conclusions: Flatly, VCs essentially never take unsolicited e-mail messages seriously, no matter what the content, short, medium, long, highly polished, formal, informal, technical, non-technical, etc. Nothing, not even zip, zilch, zero -- phone calls, e-mail -- unsolicited counts.

Point: Don't waste your time. About all that counts is traction and publicity enough that VCs hear about the company NOT from the company. Maybe "warm introductions" count, but an entrepreneur like me just doesn't know the same people as VCs. We just don't know the same people. I know some very high up people that know me well, but those people don't know VCs.

The "warm introduction" idea is a bad joke on the VCs because the people they would really like to meet don't have the same associates as VCs.

To VCs, everything from the company unsolicited is "from over the transom" and regarded with contempt.

Now with the much lower prices of computing and Internet data rate and lots of free infrastructure software, etc., it's a new day: A sole, solo founder can bring the company to good traction alone. Then a solo founder can have such a low _burn rate_ that by the time a VC firm wants to write a check, the founder will no longer need or want the check -- because such a check has the BoD with all the power in the company and has the founder essentially again an at-will employee.

I can rewrite my pitch anyway I want, and I can promise you that from the 100 top US information technology VCs, an unsolicited, "over the transom" e-mail contact will get a significant response from at most 2 firms but very likely none. It's just an unspoken secret of Sand Hill Road: VCs ignore unsolicited e-mail messages, no matter what is in them.

</comment></comment></comment></comment></comment></comment><comment><USER9> The OP is from Stripe, and their Stripe Atlas program seems to want to have a startup pay $500 and, thus, have Stripe get the startup a Delaware C-corporation.

Good grief: Why would a startup, prior to equity funding, want to be a Delaware C-corporation instead of just an LLC?

<comment><USER11> If you are planning to do equity funding, the $500 to Atlas is cheaper than the $4000 to a lawyer to convert your LLC to a C-corp later.

Disclaimer: happy Atlas user who did previous C-corps the old-fashioned way and did not enjoy doing that.

<comment><USER9> Then start with an LLC and, when have an equity check in hand, don't count those chickens before they hatch, use Atlas to convert the LLC to a C-corp or, simpler, just use Atlas to form a C-corp and f'get, or some such, about the LLC.

<comment><USER11> Often, that LLC will have important IP that isn't trivial to convert. (Hence paying the lawyers way more than $500 to fix it).

What's the advantage of doing it in 2 (expensive!) steps if you know the plan already?

<comment><USER9> > convert?

I'd wonder about that. But, all the IP is on just a little portable, USB interface, hard drive I own, so I bring a copy with me when the C-corp is formed? Shhh, don't tell anyone!

For two steps, easy: For a solo founder and 100% owner, an LLC is a total sweetheart and a C-corp. with a BoD is a forever continuing total pain in the back side. So, very much do not want a C-corp until need it for equity funding where the founder is no longer 100% owner, and such equity funding is chancy. Equity funding is not easy to get.

I'm not counting on equity funding and, really, have given up on it -- by the time VCs will write me a check, I will long since have not been willing to accept it. My startup is deliberately designed to get to plenty of money for growth with just my labor and my thin checkbook. And, I'd greatly prefer to remain 100% owner of an LLC.

<comment><USER12> You seem to be complaining about a product that you are not the target market for. The people who setup a C-Corp from day 1 are interested in raising funds, potentially multiple funds; and later exiting. (or IPOing if they are lucky).

<comment><USER9> They should have the equity check in the bank before they setup a C-corp.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> > Do not cite gross merchandise volume (GMV) as revenue; if you facilitate a > transaction between two parties and collect a fee then the total transaction > is GMV but only your cut is revenue.

I thought revenue was a "protected" term, like how it's described in the books. In that case isn't GMV the same as revenue? Since that's the money you actually invoice. And your cut is "net revenue", profit or something instead.

<comment><USER14> Uber deals with this by calling their topline "Gross Bookings" (which includes the driver portion of each ride) and then starting a new P&L below that with Revenue as the new topline.

The GAAP guidance instructs companies to make the determination whether they're the principal or the agent with the following criteria:

 _1\. You are the primary obligor in the sales transaction. This means, are you responsible for providing the product or service, or is the supplier? If you're doing the work or shipping the product, you can probably record at gross._

 _2\. You have general inventory risk. If you take title to the inventory before you sell it to the customer, and you take title to any returns from customers, you can probably record revenue at gross._

 _3\. You can select suppliers. This one is important, since it implies that there isn't some key supplier operating in the background who's actually running the transaction._

 _4\. You have credit risk. This means that if the customer does not pay, then you absorb the loss, and not a supplier. However, if you're only at risk for losing a commission if the customer doesn't pay, then you're probably looking at recording the revenue at net._

 _5\. If you get to set the price, then you probably have control over the entire transaction, and you can record the revenue at gross._

 _6\. The amount you earn is fixed. This indicates a commission structure, which is sometimes set up as a fixed payment per customer transaction. If you earn a percentage of what the customer pays, this is also an indicator that you report revenue at net. In either case, you're really just an agent for someone else._

 _7\. The other two guidelines for reporting at net are just the reverse side of some earlier guidelines. If a supplier has credit risk, or if a supplier is responsible for providing products or services to the customer, then you're probably looking at reporting revenue at net._

There's a pretty comprehensive document from the 'Emerging Issues Task Force' of the FASB here:

[http://www.fasb.org/jsp/FASB/Document_C/DocumentPage?cid=121...](http://www.fasb.org/jsp/FASB/Document_C/DocumentPage?cid=1218220143525&acceptedDisclaimer=true)

</comment></comment><comment><USER15> Great stuff!

It isn't mindblowing, but insightful enough to take a look. "Focus on nascent greatness" is particularly a great section, because tries to solve some misconception about bizplan and ideas</comment>


Controlling vehicle features of Nissan LEAFs remotely via vulnerable APIs - <AUTHOR> http://www.troyhunt.com/2016/02/controlling-vehicle-features-of-nissan.html <comment><USER2> Anyone who has been cursed with using anything related to CarWings might not be surprised by this. I swear their backend is running on some intern's personal laptop. That feature where you can preheat your car from your phone? Be sure to allow a few minutes to do that. Start the app, wait 30 seconds for it to log in. Go to "Climate". Oh, shoot, it thinks the heat's still on (the app does a pathetic job of managing state). Click "Turn Off". Wait another 30 seconds (or more) while it round-trips to the car. Click "Turn On". Wait another 30 seconds. Go to car, expecting it to be warm. Open car door to discover that it's stone cold.

That's just one example. Nissan said they'd charge for CarWings after three years. Going on almost five years later, we've yet to receive a bill. Nissan knows if they tried to charge for CarWings, they'd have three paying customers because no one else would pay for that crap.

With all its warts, I would have said nothing much would surprise me were a security hole were found. But this is just astounding. The prior API at least required creds. So they took an API that had some modicum of security, discarded that and just use a string that's visible from the outside of every vehicle? Picture me with my lower jaw hanging between my knee caps.

<comment><USER3> > Nissan knows if they tried to charge for CarWings, they'd have three paying > customers because no one else would pay for that crap.

That and the service is going to break this year anyway.

AT&T is sunsetting its 2G network on December 31, 2016. It's already dismantled it (to reallocate the spectrum to 3G/4G/LTE) in some regions.

Most Leafs on the road only have 2G AT&T modems. I'm pretty sure Nissan was still selling them new in 2015 with 2G modems, despite knowing AT&T's plans. There won't be any CarWings service, or charging location updates, or anything else that needs internet on those cars once the 2G network goes away.

<comment><USER4> Thats not going to help leaf residual values coming off lease at all.

<comment><USER5> >3 year old leaves are already surprisingly cheap, I was considering getting one.

<comment><USER4> Might want to wait until March 31st to see what the Tesla Model 3 looks like.

<comment><USER6> Why would a 35k+ car that's not going into production until 2017 be a suitable alternative for someone who's looking at 10-15k 3 year old Leafs today?

</comment></comment></comment></comment></comment></comment><comment><USER7> No authentication. The only sort of authentication token is linearly predictable and printed in plain text on the outside of the car.

No rate limiting. They successfully used the linear nature to collect a list of valid VINs and validate them.

No apparent intrusion detection.

Bad response to security disclosure. They didn't fix the problem when it was reported, they still haven't addressed the researcher properly.

I'm not sure these are the right people to write life critical software (which admittedly, this vuln. does not appear to relate to life critical systems; just privacy and comfort).

<comment> c-slice And add on personal info release - the API will provide a username if queried with a VIN.

<comment><USER8> Car companies are terrible at making software. I'm not surprised that they want to lock down the ECU code, since it's probably awful and full of subtle bugs as well, and they don't want to get hit with tons of lawsuits when people find a bug in the firmware.

Really wish they'd just use CarPlay / Android and go back to analog knobs to control HVAC stuff. Opening a modal dialog to adjust fan speed (in a 2015 MDX I've been in) is terrible UX and very distracting to do while driving. The 2nd gen Prius is no better, and the control panel UI in it looks like something from Windows 3.1.

</comment></comment></comment><comment><USER9> It's genuinely scary to see how trivial these attacks often are. Who on earth wrote these API endpoints and thought they were acceptably secure?

If the car companies can't write software that would withstand hacking skills roughly equivalent to a curious teenager, what hope do they have against criminal organisations or nation states? I don't really want to think about it...

<comment><USER10> Bad stuff happens - I think it's a pretty safe assumption. What is worse is that there was some PM out there who didn't want to immediately disable the whole service until the issue was fixed. So I think this disclosure is a fair thing to do - when they choose between PR image or security, they must understand that both can get dragged through the mud.

<comment><USER11> Who will you trust to make your next car, a car company or a software company with a record of good security?

<comment><USER12> Ideally a car company with a record of good manufacturing partnered with a software company with a record for good security. But I don't see that kind of partnership happening with the likely players we're talking about in the space.

</comment></comment></comment></comment><comment><USER13> What's the developer ecosystem around car software like these days? I mean, in an industry in which mechanical/aerodynamic engineering is so paramount, what is the rigor of the mindset and culture among the groups that build the network and user-interface software? I'd have to guess that it'd be an emerging field, with the IoT being relatively new, even if it were heavily populated by programmers who worked on the more traditional aspects of vehicle operation (engines, etc)...and with the overall high demand for skilled developers in all the other parts of software industry.

I'm being biased here because I recently bought a vehicle which charges some non-significant amount of money ($50, or maybe $99?) to just buy an iPhone app that connects to the vehicle's dashboard, then an HDMI cable if I want to connect the phone's video to the screen to watch my phone's movies, and then a subscription fee afterwards to do GPS and other on-demand services. Not saying that that's a shortsighted business model -- maybe car customers are paying for it in the droves -- just that it's one that naturally attracts fewer scrutinizing eyes, which can non-directly impact the attitudes and culture of the development team. Also, I guess I just don't see many auto software developers talking/showing their trade, as opposed to dev teams from other traditional behemoths -- such as Best Buy and Walmart -- who despite not working for their tech-focused disruptive competitors, still produce and share software that is public-facing.

<comment><USER5> So far as I can tell, it combines the rigor of the Toyota unintended acceleration code with a zillion global variables with the Volkswagen approach to regulatory compliance with the IoT approach to security and vendor lockin. By the sounds of it they're discovering the mobile industry's approach to extra charges.

<comment><USER8> Sounds like a "greatest hits of terrible development practices". Hey, at least everyone won't have to bring their vehicle in to a stealership to get it updates if they ever release a fix. Wait.

</comment></comment></comment><comment><USER14> How does the Leaf connect to the servers to receive commands? How secure is this link? It would be easy to speculate that after breaking into the link between Nissan servers and the car you'd be able to do rather more mischief and likely exploit vulnerabilities in the software itself to do things not exposed in the API. Its easy to imagine that there isn't even a firewall between the remotely-accessible system and the engine control system. Its also easy to imagine that the data being uploaded to Nissan is rather more privacy- invading than the travel log exposed by the public API. We want someone to hack into the Leaf and expose it wide open.

<comment><USER15> I've been wondering this too. Tesla does it as well. It makes me feel "bad" on the inside from a security perspective.

Can I turn this feature off? How does it communicate?

<comment><USER16> > Can I turn this feature off?

The article says that you can, by disabling CarWings/NissanConnect. Which you should probably do if you're a connected Leaf owner, as it lets anyone control AC/heating _and_ gives them historic driving information (date, distance and "driving efficiency").

> How does it communicate?

Lost the source (maybe one of the forums linked from [http://www.troyhunt.com/2016/02/controlling-vehicle- features...](http://www.troyhunt.com/2016/02/controlling-vehicle-features-of- nissan.html?)) but I read the CarWings service sends an SMS to the car, which contacts the webservice to return its information.

<comment><USER14> Turning off the web API stops people communicating with Nissan's webservice; it doesn't stop the car communicating with Nissan's webservice.

<comment><USER17> The car actually randomly asks you permission to do this. You will start the car up and there will be a dialog asking you to continue to allow the computer to communicate with Nissan. If I recall, you also need to enter in some credentials into the car's computer for it to communicate with Nissan.

<comment><USER2> _The car actually randomly asks you permission to do this._

No, it asks you every...friggin'...time you start the car, with no way to say "you have my permission from now on". I _wish_ it were random, at least that way there be times I don't have to punch the "OK" button.

<comment><USER3> Only the 2011 and 2012 model years worked like that. Newer Leafs only require you to acknowledge the agreement every few months.

<comment><USER18> Is there an upgrade ? This is an unbearable nag screen.

<comment><USER3> No. And even better, when CarWings stops working at the end of the year because there's no AT&T 2G network for it to connect to, you'll still be pressing "OK" twice a day for no reason at all.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> There's no actual way of fixing this, if it ultimately relies on VINs. You can however mitigate it.

Let's say you required an account and utilised authentication tokens, sure, that will stop unauthenticated requests. But what is stopping someone else from stealing your VIN and registering an account themselves? If you only allow a single account registration per VIN then what happens if the vehicle changes ownership?

VINs aren't a "shared secret." They're a public fact. Instead Nissan should be utilising a secret number stored in the vehicle entertainment unit and user accessible, and they should add a button to change it when the vehicle changes ownership. Heck they could even do a QR code if they really wanted registration to be as painless as possible.

<comment><AUTHOR> They definitely need to figure out something to mitigate the public information bit. Aside from (presumably) a cost associated with it, there isn't anything stopping someone from going to the DMV and getting the info they need about a target.

Further, they also really need to change the HTTP method for the endpoints that change state.

Nothing's stopping someone from putting up an image tag on a well-trafficked website (or buying display ads on a network) with the src set as the endpoint that turns on the AC. Turns into a real-world DoS when the battery is dead.

<comment><USER17> There is no danger of this. The endpoints are so slow that the ad network / site would drop it in minutes :)

<comment><AUTHOR> If the AC stays on for X minutes, you only need to occasionally redirect an actual advertisement image to the endpoint to be effective.

<comment><USER20> It's 15 minutes[1] by default, I believe.

[1][http://www.mynissanleaf.com/viewtopic.php?p=363558&sid=1dec9...](http://www.mynissanleaf.com/viewtopic.php?p=363558&sid=1dec91ee04d72012cb9ea1c0fd078353#p363558)

</comment></comment></comment></comment></comment><comment><USER21> >Mr Hunt said the root of the problem was that the firm's NissanConnect app needed only a car's vehicle identification number (Vin) to take control.

And only the last 5 digits vary on these VINs, so you can just run through them all with a simple script in no time. They're using VIN as the unique key on these things and with no other authentication? Wow. Just wow.

I really think we've reached that point with IoT that its time to start proposing HIPAA-like regulation on this stuff. Its endless amateur hour out there.

<comment><USER22> This is unbelievable. Any decent API would have the client authenticate via user credentials over an encrypted channel to obtain a temporary token (that's only valid for a short time period), and all subsequent command requests would require the token to successfully proceed.

</comment></comment><comment><USER23> Oy wow, that's bad.

I've poked around in the Tesla API and it's much better, based on OAUTH and an account registered to the specific owner.

<comment><USER24> Yeah this is where Tesla's software/silicon valley background starts to look like a real advantage

<comment><USER25> What would prevent the auto companies from hiring someone with a clearer idea of how securely architect these things?

There are things like insider bias to overcome, but if the older auto companies see Tesla eating their lunch over software, they will go ahead and overcome it.

<comment><USER24> I heard that the car dealers won't allow car manufacturers to apply over-the- air updates (for example) because it breaks the agreement between dealers and manufacturers (all maintenance and service must go through dealers). I'm not sure if thats true but its pretty hilarious if it is.

<comment><USER26> That's... really reassuring, actually, because it means there will still be OTA-free vehicles available on the used market for years to come.

</comment></comment></comment></comment></comment><comment><USER27> So does every leaf come with life-time connection to the internet over cellular?

Like my Kindle keyboard 3G?

<comment><USER15> The keyboard comes with free 3G? I'd love to see if someone could pull that out and do something cool with it.

<comment><USER11> Someone published how to use it as a proxy, and then amazon restricted its usage massively, obviously. Sigh.

Also each newer kindle had a greater price difference between wifi and 3g, and more restrictions

<comment><USER15> Do the really old ones still work with little restrictions?

<comment><USER11> My Kindle 3 Keyboard 3G just has the 50MB/month limit, but everywhere has wifi now anyway, so I rarely use it.

</comment></comment></comment></comment></comment><comment><USER24> Was just arranging to go and look at used Leafs tomorrow : (

If I don't register my car with the app, does that protect me?

edit: yep sounds like it does.

<comment><USER28> Do they disconnect/unregister the previous owner when you buy the car second hand?

<comment><USER29> I bought a used Leaf two weeks ago from a dealer. From the dash computer, I saw the previous owner's CarWings username and password, as well as his address book, Bluetooth details, and lots of other history. I called Nissan to register the car with the Owner's portal ([https://owners.nissanusa.com](https://owners.nissanusa.com)) and remember being surprised that I didn't have to give Nissan anything that proved I owned the car.

</comment></comment></comment><comment><USER30> This is borderline negligence for the lack of authentication and security of the app. I suppose it may just be a matter of time until someone figures out how to get access to other more critical systems in the vehicle, similar to the Tesla vulnerability from last year. It took the Tesla security researchers less than a year from when they found they could access the sound and climate systems (over similar cellular networks) to being able to flash custom firmware on-the-fly and take control of steering and acceleration / braking.

<comment><USER31> Are you confusing the relatively minor Tesla hack with the spectacularly serious Jeep hack?

</comment></comment><comment><USER32> This may be a stretch, but this vulnerability could be used to kill a child or pet left in a car on a mild to hot day. Turn on heat, crank to 100+.

</comment><comment><USER33> Does this mean that used Nissan Leaves will become even cheaper? They're already about $9k used with not many miles (20k).

<comment><USER34> We bought a loaded one (leather, premium stereo) used with 11k miles for not much more than that. Best value around if the range works for your driving requirements.

</comment></comment><comment><USER35> Clarification: this is a vulnerability in the Internet of Things component attached to the car. The car itself fine, and the vulnerability is only in devices with the silly and expensive IoT upgrade package.

<comment><USER16> > The car itself fine

Well to an extent, if you've enabled the service any third party can remotely enable, disable or reconfigure AC and heating (which is pretty problematic for an EV), and the service also provides limited travel information (no GPS location, but travel times and distances)

<comment><USER36> Just a nitpick: being able to remotely turn on climate control in a non-EV would be much worse, as it could be life threatening if the car is in a garage. With an EV the worst case is you need to tow it to a charger.

</comment></comment></comment><comment><USER37> It doesn't look like this affects any systems used to move the car. Still, will I need to start asking if my next automobile is air-gapped at this rate?

<comment><USER3> Since A/C and heat run off the same battery pack that moves the car, compromising remote climate control can be more than just a nuisance. Someone can ensure that you wake up, or leave work, to find your battery has no charge left and you can't get where you need to go. It's like being able to siphon your neighbor's gas tank, while their car is parked in their garage, via an app.

</comment></comment><comment><USER38> Reposting my comment from netsec.

I'm not sure why Troy can't just refer to others public research directly instead of repackaging it and using "responsible disclosure" as a cover for not sharing his (public) sources.

It seems sketchy at best, dishonest at worst.

>A GitHub repository documenting the API including the observation that "All other operations take the DCMID and the VIN of your vehicle as parameters for authorizing the requested operation" (although the DCMID value is not actually required and is empty in many of the examples above)

[https://gist.github.com/joshperry/15eadc2a63b22632d6ae](https://gist.github.com/joshperry/15eadc2a63b22632d6ae)

>Another GitHub repository, this time a Python script to connect to and manage vehicle features via the API (also includes region codes for managing vehicles in other parts of the world)

[https://github.com/jdhorne/pycarwings2](https://github.com/jdhorne/pycarwings2)

>Yet another GitHub repository built to target an earlier generation of the service and referenced as inspiration for the previously mentioned project

probably [https://github.com/haykinson/pycarwings](https://github.com/haykinson/pycarwings)

>A blog post on reverse engineering the API which observes that "curiously, it seems like you just need the constant DCMID and VIN fields" (again, the DCMID parameter wasn't actually used in our tests)

[http://virantha.com/2016/01/12/reverse-engineering-nissan- co...](http://virantha.com/2016/01/12/reverse-engineering-nissan-connect-ev- protocol/)

>A forum post on integrating the data into Domoticz (a home automation system) which makes this observation: "No other authentication necessary!"

[http://www.domoticz.com/forum/posting.php?mode=quote&f=31&p=...](http://www.domoticz.com/forum/posting.php?mode=quote&f=31&p=74015&sid=da7f9475540847278474d2dd29baf039)

IMO, his behaviour is straight up despicable. This stuff isn't hard to find, but he still refuses to give proper credit because of "responsible disclosure". Yet, anyone interested in attacking the API can and will find this stuff on google.

Also, another example of Troy BS:

[https://twitter.com/troyhunt/status/701733562253336576](https://twitter.com/troyhunt/status/701733562253336576)

Trying to publicly shame vkontakte for a nonexistent SQLi (this is a wiki page that anyone can edit, here's a wikipedia example demonstrating the same "vulnerability" [https://en.wikipedia.org/w/index.php?title=%27&diff=70631701...](https://en.wikipedia.org/w/index.php?title=%27&diff=706317017&oldid=646978585))</comment>


Behavioral Programming (2012) [pdf] - <AUTHOR> http://www.wisdom.weizmann.ac.il/~harel/papers/Behavioral%20programming%20.pdf <comment><USER2> > The work on behavioral programming began with scenario-based programming, a > way to create executable specifications of reactive systems

Is this sort of what BPMs does ? is a better or worse approach ?

Related links about BPM and reactive programming:

[https://github.com/rht-labs/reactive-bpm](https://github.com/rht- labs/reactive-bpm) [https://www.slideshare.net/JustinHolmes2/visualizing-your- ev...](https://www.slideshare.net/JustinHolmes2/visualizing-your-event-storm- in-new-ways)

</comment><comment><USER3> thanks akkartik, just what I was seeking to explain the differences between reactive and what came before

<comment><USER4> Sounds like you believe there's a progression from BP to reactive programming. I think it's the other way around.

</comment></comment><comment><USER5> This is exactly like the Actor Model and what Erlang seems to do.

<comment><USER6> [http://www.wisdom.weizmann.ac.il/~bprogram/pres/bp- sigerl201...](http://www.wisdom.weizmann.ac.il/~bprogram/pres/bp- sigerl2010.pdf)

They actually have a program porting the idea to Erlang. I think it also helps to clarify where the two models differ. Behavioral Programming seems to throw a bunch of possible actions and controls into the world, and lets whichever actions are both desired and not blocked execute (only one of them?). It's straightforward to implement in Erlang (or not too hard), but it's not precisely what Erlang does. There's no message passing (per se), but rather a shared space of knowledge (events) which is controlled by some manager that can permit actors to act or not act.

So, related, but not quite the same. From reading it, it seems to have perhaps more in common with tuple spaces and job control languages. Registering what sort of tuple (event) a process can respond to and waiting for work to become available and then acting on it once it's available. Then the process can produce new tuples/events or simply consume them.

<comment><USER5> This seems very similar to request/reply pattern. Erlang + RabbitMQ should be enough to do Behavioral Programming.

Now showing a live sequence diagram is another thing altogether.</comment></comment></comment>


Facebook sees ad potential bigger than Google search ads - <AUTHOR> http://uk.reuters.com/article/idUKTRE59F15K20091016 <comment><USER2> Their still missing the best revenue model; Google's own.

All this fancy pages nonsense is all very well but I bet a system for keyword tagged ads, the same as adsense, for those box adverts on the right of pages would go down a storm.

Currently most of those are junk (and for me, as I am single, mostly involving women of salubrious intentions). If they could get good contextual adverts going they should..</comment>


Fuchsia Friday: 'Machina' brings support for running Linux on top of Fuchsia - <AUTHOR> https://9to5google.com/2018/06/15/fuchsia-friday-machina-brings-support-for-running-linux-on-top-of-fuchsia/ <comment><AUTHOR> Reminds me in a way of Apple's transition to MacOS X: OS9 apps were supported through emulation for a while before that was dropped in a later version (because Apple deemed enough apps had been written for the native platform). I'm guessing the same could happen here.</comment>


Java Optimizations and the JMM - <AUTHOR> http://playingwithpointers.com/optimizations-and-the-jmm.html

<comment><USER2> Let me try to break this down.

This is a wrong transformation:

      void writer(Tuple tuple) {
        tuple.nonVolatileF = 5;
        tuple.volatileF = 1;
      }
      void reader(Tuple tuple) {
        int regNV = 0;
        int cache = tuple.nonVolatileF;
        int regV = tuple.volatileF;
        if (regV == 1) { regNV = cache; }
        // computation that uses both of the above
      }

because `cache` might get assigned before `tuple.nonVolatileF` is set. (The same is true of regV, but I guess the untransformed program had that, so you don't bother). But you said that the JMM guarantees that all reads in C_i - C_(i-1) will see writes in C_(i-1); this means that C_3 which reads `tuple.nonVolatileF` will see the write to that variable in C_2, no? Since you're constructing an execution, why didn't you interleave the execution to make this trivially true? Also, can't you wrap the writer in an atomic block during transformation?

<comment><AUTHOR> Thank you for taking time out to comment! :)

> But you said that the JMM guarantees that all reads in C_i - C_(i-1) > will > see writes in C_(i-1); this means that C_3 which reads > > `tuple.nonVolatileF` will see the write to that variable in C_2, no?

Talking about such things in English is ambiguous. The formal statement is

"For any read r ∈ C_i −C_(i−1), we have W_i(r) ∈ C_(i−1) and W(r) ∈ C_(i−1)".

A clearer way to state the clause in English is "writes seen by reads in C_i - C_(i-1) belong to C_(i-1);". I can justify an execution as long as reads (ultimately) seen _any_ write in the commit previous to the one it is in, subject to happens before consistency. To prevent causality loops, the JMM allows a read to see a write that happened before it in the commit that introduces it. Then, to allow certain interesting optimizations, the JMM allows us the bait-and-switch the write a read saw -- "Each read r in C_i − C_(i−1) must see writes in C_(i−1) in both E_i and E, but may see a different write in E_i from the one it sees in E.".

The non-volatile read is _allowed_ to see the non-volatile write (i.e. such an execution exists, this is the question I ask in the exercise), but it doesn't have to. The transform in question is illegal because the transformed program allows behavior that the untransformed program didn't allow -- the transform breaks semantics.

> Since you're constructing an execution, why didn't you interleave > the > execution to make this trivially true?

I don't understand this, make /what/ trivially true? In any case, the transformed program has a data race, and so observationally it doesn't need to have a sequentially consistent execution. Specifically, it is allowed to show behavior that cannot be described by _any_ interleaving of the instructions streams of the individual threads.

> Also, can't you wrap the writer in an atomic block during > transformation?

What purpose would that serve?

<comment><USER3> > The non-volatile read is _allowed_ to see the non-volatile write (i.e. such > an execution exists, this is the question I ask in the exercise), but it > doesn't have to.

And this is why debugging this kind of issue in practice is fun: You have very little or non-obvious guarantees here.

If you think about constructing adversary proofs or decided that your program is a little gnome bound to make you insane, this can be rephrased as: In this example, the nonvolatile read can _choose any value of any write as long as it is in a happened before relationship to the nv-read_. It might pick every value, every second value, or just that one troublesome valu and never change again.

</comment></comment></comment><comment><USER4> Thanks for posting this, this looks really interesting.

one note: >This blog post tries to show how some re-orderings (that may be done in as part of optimizing a Java program for performance) that intuitively seem _illegal_ are, in fact, _illegal_ , by deriving that _illegality_ from directly the JMM spec.

Should the first 'illegal' read legal?

<comment><AUTHOR> > Should the first 'illegal' read legal?

Well it depends. :) I did mean "illegal", though there certainly are many _illegal_ transforms that look legal and vice versa.</comment></comment>


Does poor coding ever sink a startup? - <AUTHOR>

I was curious if there are any stories of a startup failing due to poorly built software. <comment><USER2> I'm positive that more than a few startups have been sunk by poor code, however I don't have any examples.

I worked on a Big oil company IT project that had failed twice due to bad code. As the business guy I figured out that the system would round round down the final non zero digit of any value stored in the system to either zero or five. Usually this would make the report numbers slightly off, but sometimes it could be massive. Say you bought 1,000 $9.00 parts the system would show $5,000 in cost instead of $9,000, but if you paid $9.26 for the parts it would show $9,250 in cost.

The root cause of this error was the IT team had one guy who was crazy smart and had a bucketfull of assumptions about what the problem was that couldn't imagine that the issue was one baked into some of the first code he had written.

In a nutshell, this was a reporting package that sat ontop of SAP that was supposed to be actually useable by field managers and guys who turned wrenches so they could keep track of their budgets and spending. Of course this was needed because SAP had been implemented with very little training and no helpdesk for users.

The project had been rolled out twice to the field and just rejected flat out because the numbers didn't match, million had been spent building it and there was a 3rd try before the entire system was scrapped and a few million spent on an off the shelf piece of software.

It took a while to find the root cause of the totals being off because I'd always get these great complex explinations as to why the data was off an they had project change orders in to fix it. Finally I just pulled data to find out what was going on, and saw this weird pattern of the data being off in specific places but it took a day before I had the insight that the same thing was changing $140.00 into $100.00 as $0.79 into $0.75 i.e. the final nonzero digit of any stored value was being rounded down to the either 0 or 5.

</comment><comment><USER3> I know a startup who spent 18 months and all their investment capital on outsourced development. When the code wasn't up to standards they used expensive consultants to fix the code. They ultimately decided to hire development staff but couldn't add new features without breaking the existing product.

It is a good little business but failed because of bad management decisions and poorly built software.

Contact me if you want more details.

</comment><comment><USER4> Yes and probably more often than you think but it can quite difficult to diagnose from a top down perspective. It usually materializes in costs becoming too great but the underlying cause frequently is a rushed product that eventually costs too much to iterate on because of sloppy underpinnings. Its a delicate balance - you've got to get stuff out quick enough but also stable enough to make sure the next iterations wont become exponentially longer and more costly.

Outsourcing, high turnover, constantly changing requirements with unreasonable schedules all can lead to codebases that become too expensive to iterate on when the market demands more. Sometimes the only way out is to approach a complete rewrite which is usually a risky proposition.

Many times poorly coded products from the outside can have correlated symptoms of poor performance, bugginess, and slow feature development which are the cited reasons users may abandon the product.

<comment><AUTHOR> Do you think "over-engineering" could be a contributor to an unmaintainable code base? Also, do you think TDD is key to faster/cleaner iterations?

<comment><USER5> Yes, absolutely. I had an experience where the design was dictated by an architect who cared more about the theoretical and having UML diagrams looking nice than about actual business requirements and having the code be lean, clean, simple and efficient.

TDD and also code analysis tools can help highlight what you actually need and what you don't.

The converse is true too, if you under-engineer you run the risk of not easily being able to scale up to new requirements.

Over-engineering creates an albatross where you'll fall under your own weight (too much code, slows down development, possibly bad performance, harder to debug). Under-engineering creates a house of cards that is fragile (more buggy, code gets duplicated and patched on, frustrating to work on, hard to refactor).

</comment></comment></comment><comment><USER6> One issue that I have seen is that many people will confuse anything more than slapping together code and checking it in as "premature optimization." Many of the same people believe that the value of their code scales proportionately with its size. More code is always better, right?

Poor code leads to technical debt, startup or not. Like all debts, if you don't bite the bullet and repay it, you will eventually be consumed by it.

</comment><comment><USER7> They may not completely fail due to bad code but it does incur a huge hit in pockets. Bad code results in high maintenance cost of the project and could take eventually kill it. Hence there is need for application and solution architects in any software development project.

</comment><comment><USER8> I've experienced more startup failures due to over engineering and premature optimization (and thus late to market) than bad code.

You can fix the code after you launch, or you can just never launch.

</comment><comment><USER9> One that springs to mind is Friendster. I seem to remember there were lots of stories about it running like a dog when converted to run on Java (and I'm not knocking Java).</comment>


React community accused of being pro-toxic masculinity - <AUTHOR> https://hub.packtpub.com/react-accused-of-being-pro-toxic-masculinity-tatiana-mac-quits-industry/ <comment><USER2> This whole debacle makes me feel uncomfortable as a Trump supporter working on a startup.</comment>


How to Turn a Bad Idea into a $320M Startup - <AUTHOR> http://www.haaretz.com/israel-news/business/.premium-1.684557 <comment><USER2> I'd love to read this article... If it weren't for the paywall.</comment>


The Nexus 6:hands-on with Google's phablet - <AUTHOR> http://www.theverge.com/2014/10/21/7025853/google-nexus-6-hands-on-photos-video-android-phablet

<comment><USER2> Not an overly informative. I'm assuming they got a pre-prod device since they haven't done any conclusive tests with it.

<comment><USER3> they had just 15 minutes with the devices, plus a scripted demo from a sales person.</comment></comment>


MySQL InnoDB Cluster GA - <AUTHOR> http://mysqlserverteam.com/mysql-innodb-cluster-ga/ <comment><USER2> Hi! I'm a Product Manager for the MySQL Server. I don't specifically work on InnoDB Cluster, but am happy to answer questions.

Let me start of by describing how the clustering works:

\- A cluster is 3+ nodes in a group, each with a complete set of data

\- When you say 'COMMIT' the server you are connected to certifies your write- set with its peers (i.e. has anyone else tried to modify the same data). Once the majority agree, the transaction is considered successful.

\- The distributing and certification of the transaction is synchronous, but the applying of the transaction is asynchronous. Thus you actually retain pretty good performance if the network latency is reasonable.

The performance question comes up a bit, so here's another post for more context:

[http://mysqlhighavailability.com/an-overview-of-the-group- re...](http://mysqlhighavailability.com/an-overview-of-the-group-replication- performance/)

<comment><USER3> Is it possible to get stale reads from non-primary nodes in a single-primary setup?

<comment><USER2> In single primary the other nodes are put in a read-only mode so they can not accept writes. So stale reads can not happen.

To expand on your question a little - the MySQL router currently works better for single primary (it supports multi-primary but does not prevent stale reads). If you go third party, ProxySQL also supports Group Replication natively with multi-primary:

[http://lefred.be/content/mysql-group-replication-native- supp...](http://lefred.be/content/mysql-group-replication-native-support-in- proxysql/)

I was chatting to the author about this at FOSDEM - since it is possible to keep track of nodes state by following GTIDs executed in the binary log stream. I believe this is how ProxySQL is doing it, but it's possible the final implementation differs :-)

</comment></comment></comment><comment><USER4> A relevant read for those who are considering this vs a Galera based solution: [https://www.percona.com/blog/2017/02/24/battle-for- synchrono...](https://www.percona.com/blog/2017/02/24/battle-for-synchronous- replication-in-mysql-galera-vs-group-replication/)

</comment><comment><AUTHOR> A fully automated HA solution is yet missing for PostgreSQL.

<comment><USER5> [https://www.postgresql.org/docs/9.5/static/high- availability...](https://www.postgresql.org/docs/9.5/static/high- availability.html)

[https://www.citusdata.com/solutions/infrastructure/high- avai...](https://www.citusdata.com/solutions/infrastructure/high-availability- postgresql)

Edit: And before someone mentions "Citus" being "third-party" or "closed" or some such: [https://www.citusdata.com/blog/2016/03/24/citus-unforks- goes...](https://www.citusdata.com/blog/2016/03/24/citus-unforks-goes-open- source/)

<comment><USER6> There's also CockroachDB, which is wire-compatible with Postgres. Of course, there are also some performance trade-offs to consider, and it is currently missing many SQL and data type features available in Postgres and others.

<comment><USER7> It's a completely different database, it just happens to support the postgres binary protocol.

<comment><USER6> Yes, it is. However when I went looking for a "HA Postgres" solution I found it to be a viable alternative for my use case.

<comment><USER8> CockroachDB employee here - Yes, CockroachDB is a completely different database from PostgreSQL. CockroachDB supports HA from the bottom up with data broken up into ranges that are consistently replicated using Raft. As mentioned earlier in the thread, it uses the PostgreSQL wire protocol and supports a good amount of SQL (but not all since the dialect is quite large if you include extensions). If you are looking for HA with SQL compatibility, it would be worth taking a look at CockroachDB.

</comment></comment></comment></comment></comment></comment><comment> forgot-my-pw How does this differ from Galera Cluster / mysql-wsrep? [https://mariadb.com/kb/en/mariadb/what-is-mariadb-galera- clu...](https://mariadb.com/kb/en/mariadb/what-is-mariadb-galera-cluster/)

<comment><USER2> (See my other reply)

</comment></comment><comment><USER9> Is there any support for sharding?

<comment><USER2> Nope, it's planned though.

In the mean time, I recommend using something like ProxySQL to route based on schema to shard between multiple instances of MySQL.

<comment><USER10> InnoDB Cluster includes MySQL Router, but you recommend using ProxySQL?

<comment><USER2> For this use case, yes. ProxySQL also natively supports Group Replication though so you are free to chose either.</comment></comment></comment></comment>


Dial-up modem noises explained - <AUTHOR> https://twitter.com/zhirzh/status/835285957263794176 <comment><USER2> For those who feel their memory tickled: Yes, this ultimately links to windytan's (Oona Räisänen) blog entry and poster from 2012.

[http://oona.windytan.com/posters/dialup- final.png](http://oona.windytan.com/posters/dialup-final.png)

</comment><comment><USER3> Well that's a poster I'm ordering for my wall.</comment>


Coronavirus Death in California Came Weeks Before First Known U.S. Death - <AUTHOR> https://www.nytimes.com/2020/04/22/us/coronavirus-first-united-states-death.html <comment><USER2> my wife went to a Montessori teacher training event in Houston last fall which included someone from China. A few weeks later between Christmas and New Years the whole family became sick with something like the flu however all our flu tests came back negative. I'm beginning to wonder.

</comment><comment><USER3> I don't even know what to say about the naivete of our officials.

Corona has been circulating world-wide since mid-Dec. at the latest. It has certainly been in California since then.

Both Wuhan and Shanghai have international airports, and Disneyworld Shanghai was closed Jan. 24 after corona spread across China.

</comment><comment><AUTHOR> I was super sick in 2nd week of January. Worst dry cough I have ever had and it lasted 3 weeks. Chills, headaches, loss of appetite. Felt run down for weeks afterwards. Threw up a few times. Now pretty sure it was this.

<comment><USER4> I came back from a trip to Thailand, India and had a 12-hour layover in Hong Kong. Even during the flight from HK back to SF, I started feeling a bit sick. That night I went to bed with a 103 fever which lasted for a couple of days. Picked up a severe dry cough that last for 4-5 weeks. A week later, news about coronavirus had started to spread, so I went to see the doctor. After testing a cheek swab sample, he said I didn't have corona but I also didn't have the flu. He said I had some sort of virus which wasn't reassuring. I felt extremely tired and cold for weeks after coming back from my trip. Pretty sure I had the virus especially since it wasn't diagnosed as the flu.

<comment><AUTHOR> What time frame was this?</comment></comment></comment>