First American Financial Corp. Leaked Hundreds of Millions of Insurance Records - <AUTHOR> https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/ <comment><USER2> I did a penetration test for $NATIONALINSURER and they had an FTP site with weak credentials where all the remote offices uploaded claims. Millions of records and scans of SSNs, home addresses, bank information, etc. Their mitigating controls were: we put it behind a firewall.

Then again I didn't expect much, their MSSQL in prod had SA/SA credentials active.

<comment><USER3> I'm currently fighting against management dragging their feet on using 2FA.

On HIPAA PHI.

(I know HIPAA doesn't actually mandate 2FA, but it's recommended by many best practices and guides.)

Apparently some tech folks don't like _the inconvenience_ of 2FA.

<comment><USER4> 2FA freaks me out. It means I'll be locked out of all my key accounts and services if ever my phone breaks or gets lost. Probably right when I need these services most.

<comment><USER5> That's why they usually have backup keys that you physically keep in a safe place.

<comment><USER4> That sounds decent but I've not seen this a lot. Its often just "give us your phone number and we'll SMS you an access key when you log in"

<comment><USER5> Unfortunately I see this all too often on systems that have enabled 2FA but not TOTP.

</comment></comment></comment></comment></comment></comment><comment><USER6> A lot of discussion on technical side, but not from organisational.

How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest integrity and tightest scrutiny. This seems an opportunity for both internal and external auditors to tighten their game.

Outside of audit, surely an employee might have noticed? Was there no formal method to speak up without fear of recrimination? According to Wikipedia [1] there are eighteen thousand employees. Someone never noticed?

This seems an organsiational failing, not a technical one.

[1] [https://en.wikipedia.org/wiki/First_American_Corporation](https://en.wikipedia.org/wiki/First_American_Corporation)

<comment><USER7> You know what's a great incentive to actually care about this stuff? Legal consequences for not caring about it.

Anyone conceivably responsible for ignoring the developer's complaint should be on trial right now.

<comment><USER8> I personally think the board and CEO should be personally criminally liable. I don't know exactly how but if I can't use ignorance of the law as a defense for shouting in public (one yell back at someone who yelled "fuck you" at me and I got a $180 fine) then the CEO and board can't use that as a defense for leaking data for SIXTEEN years.

Didn't know this was happening in your organization? Fuxk you, go to prison.

</comment></comment></comment><comment><USER9> Whenever you are compelled to upload/send a photocopy of an ID document it is sensible to write the date and purpose / file reference on it. If it appears in a document dump at some later date you know the path and date of the leak.

<comment><USER10> that is a good idea but most of the time I need to hand over my actual ID, and not just a scan of it

<comment><USER9> I'm usually an uncooperative bastard at times like this. I ask them what their purpose is in retaining a copy of my identity document, and I ask for their privacy policy. When I'm travelling for work and a hotel asks I simply say no, and remind them I can lodge a complaint with our corporate travel provider that will have them delisted for future business; usually they come to their senses. For overseas travel (where they often have to fax your passport to the police) I ask for the photocopy back when I check out; since these documents are lost/misfiled regularly the desk clerk usually complies. Always try for point-in-time ID verification rather than retention.

<comment><USER7> Where do they ask you for a copy of your ID? I've never had that happen to me at a hotel.

<comment><USER9> It's because of credit card fraud usually, they want it to prove to credit providers that the actual card holder was present, and if not, exactly who. And I've been asked in countries across the first world, though I haven't been keeping specific note of when.

</comment></comment></comment></comment></comment><comment><USER11> Yet another security vulnerability caused by:

1\. Using sequentially incremented integer sequences as object IDs, and

2\. Failing to protect sensitive data using some kind of authentication and authorization check.

This is becoming a trend with data breaches. Several of Krebs' other reports on behalf of security researchers were originally identified by (trivially) walking across object IDs on public URLs.

My cynical take is that Krebs couldn't go public before this afternoon because First American wanted it to hit the news at an opportune time, then get ahead of it with their own messaging. Krebs got in touch with First American on Monday May 19th. The story is only just breaking now on a Friday afternoon at 5 pm; markets are conveniently closed for the weekend.

I expect them to issue a hollow PR statement about valuing security despite being unable to act on security reports until an investigative journalist threatens to go public.

<comment><USER12> I once made an app not using sequential integers as object ids, as you suggest.

It was an absolute nightmare. Maintenance was a nightmare, you're constantly having to generate or replicate these things that add an extra layer of complexity to everything, and almost always unnecessarily.

It's also extremely bad for db performance, causes massive page fragmentation, indexes become useless almost straight after rebuilding them, etc.

For almost everything, sequential int IDs are fine. It's the things you expose to the users that you need to be careful with, and then don't use the primary key to access them, add another unique key to them, but keep the id in there for the db to use and for your own use.

My lesson was to go back to always using int ids, and on a few objects have a separate unique key column to expose to users for sensitive stuff.

<comment><USER13> I also don't think using UUIDs as a security (by obscurity) strategy is valid. But there are other reasons someone may choose to use UUIDs. For instance, it's convenient to generate identifiers in a decentralized manner. I want to counter your one bad experience with my (equally anecdotal) many-multiple good experiences. Databases do just fine with UUIDs. Though we may be working on different kinds of systems, and optimizing for different things. I don't frown upon using integers (well, longs) for identifiers, but I personally prefer UUIDs.

<comment><USER14> > For instance, it's convenient to generate identifiers in a decentralized > manner.

For an elegant solution to this problem, check out Twitter's Snowflake[0].

[0] [https://blog.twitter.com/engineering/en_us/a/2010/announcing...](https://blog.twitter.com/engineering/en_us/a/2010/announcing- snowflake.html)

<comment><USER15> I always wondered why databases have not implemented a scheme like Microsoft's Active Directory RID master FSMO role. One server is responsible for handing out chunks of ID's to each server. They request a new block whenever a threshold is reached (50% by default IIRC).

</comment></comment></comment></comment></comment><comment><USER16> By the sounds of it, another breach from a well-known, not new web application security vulnerability, "Insecure Direct Object Reference".

That vuln has been an explicit part of the OWASP Top 10 since 2007...

Unlike other common web app vulns (e.g. XSS SQLi) IDOR usually can't be fixed by a development framework (e.g. ASP.Net or Rails), it needs app. specific coding for proper Authentication/Authorization checks.

</comment><comment><USER17> > He said anyone who knew the URL for a valid document at the Web site could > view other documents just by modifying a single digit in the link.

Good thing he didn't post this bug online after getting no response. I remember reading about someone who did that on an AT&T website a while back and was sent to jail for simply incrementing an id number in the URL and talked about it on Twitter.

<comment><USER18> That was probably about weev, and they were after him long before that case, so it's not likely that it would get some random person (that the FBI doesn't have a file on and an interest in picking up) in the same trouble.

</comment></comment><comment><USER19> That is an incredibly low friction interface to our documents. /s

What are the odds they have access logs going back to 2003?

<comment><AUTHOR> Pretty good, everything was probably set up and configured with default settings by that unpaid intern they had running their infrastructure back in 2003.

<comment><USER20> default settings would wipe/rotate logs after some time, no?

<comment><USER21> Rotate maybe, not wipe. As far as I'm aware for most webservers you have to tell it to rotate the logs based on some criteria, otherwise it just keeps appending.

If debugging is turned off it's entirely possible that they have been appending lines to the same log file for the last 20 years and haven't run out of disk space which would cause them to notice. Say 200 bytes in the log per request, and even averaging 10000 (probably more than they get) requests per day, in 20 years that's only 13GB.

It's also entirely possible they turned logging off or redirected to /dev/null in order to "be more efficient".

</comment></comment></comment></comment><comment><USER22> I just closed on my first house this week, and First American was of course my title company. I'll be interested to see if my data is included in this breach settlement or not.

I did notice when I was reviewing my docs that they emailed links to unauthenticated copies of docs, but they were mostly public records so I didn't think twice about it.

So they have my Name, address, email, SSN, copy of ID, copy of check from my bank with account/routing on it and much more, all in the open apparently.

I just went through an SSO implementation with a small team for a large user base. It was a bigger project than we had anticipated, but nonetheless manageable. I can't fathom that a financial institution of that scale could be that lax with basic security. Wouldn't their systems be subject to some regulation and require some kind of audit on a regular basis? Is this a failure of auditing systems, as well as internal security or even basic IT?

</comment><comment><USER23> Programmers fault? Audits fault? Securities fault? Pentesters fault? It fault?

Listen until C-level funds these programs properly and security is taken seriously by all issues like this will forever be in the news.

I would be willing to bet their security like most have a long list of security gaps they cant get fixed because resource issues just hope they documented or it could fall on them.

Most coding classes just teach how to make things work in Mister Roger's world. Secure coding is an elective! Most run the DevOps model instead SecDevOps and only involve security after it is ready to go into production no matter what flaws security finds.

Why are black box pentests still taking place? Because company required to have pentest but really do not want testers to find things. Their goal is not to improve security rather check that box ... we had a pentest.

C-level, this keep the lights on budget you give Security/IT is costing you more than properly funding us! Oh yeah you put that $ into cyber insurance! Lol let's see how well that works.

<comment><USER24> If the financial penalty was high enough they would increase budgets. There is no accountability for losing customers personal information. If you can make a strong business case behind the average risk a company takes on it would help this discussion more. For each example of "company X had a major financial impact" you need to average it out against "company Y lost hundreds of millions of SSNs and had zero penalty".

</comment></comment><comment><AUTHOR> Class Action Lawsuit Filed: [https://finance.yahoo.com/news/first-class- action-lawsuit-fi...](https://finance.yahoo.com/news/first-class-action- lawsuit-filed-110000081.html)

</comment><comment><USER23> I see a lot of comments on sequential as the issue. Really is that the issue?

Not the fact that John Doe can get to John Doe2 stuff without authenticating? WTF

Sequential or not if no auth I can run a scanner and get it all so what the hell does that have to do with the price of tea in China?

</comment><comment><USER25> I like how this news was posted on Friday afternoon before the Memorial Day weekend.

<comment><USER26> Taking out the trash, as it were

</comment></comment><comment><USER27> Where does one go to learn how to not cause this one day?

<comment><USER21> OWASP Top 10 list. OWASP's website is kind of a mess in my opinion, but there are numerous external write-ups about the top vulnerability types.

[https://www.cloudflare.com/learning/security/threats/owasp-t...](https://www.cloudflare.com/learning/security/threats/owasp- top-10/)

Also this github repo maintained by OWASP seems pretty exhaustive. The cheatsheets directory has a lot of different vulnerability classes.

[https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md)

This "Insecure Direct Object Reference" was recently combined into the "Broken Access Control" category with a few others.

<comment><USER27> Thanks!

</comment></comment></comment><comment><USER23> Lol everyone fights security and it is way under funded so can only get like 1 out of 100 risks fixed but must be securities fault.

</comment><comment><USER28> "First American has learned of a design defect in an application that made possible unauthorized access to customer data. At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers' information..."

Who is coming up with these statements?

If you kept royally screwing something for years that you claimed to be your "highest priority" \- then what can one expect from your normal lines of business?

</comment><comment><USER29> >At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers' information.

is such a meme.

Things will continue this way until there are serious repercussions for entities carelessly handling data.

<comment><USER30> The next sentence too:

> We are currently evaluating what effect, if any, this had on the security of > customer information.

It's downright dishonest to even say "if any": they were presented with concrete examples of leaking customer information; they don't get to wonder whether it had an effect on their security anymore.

<comment><USER20> Yeah, considering that they have sent these URLs to at least tens of thousands of people, it would be hard to believe that nobody ever inappropriately accessed a document that didn't belong to them.

</comment></comment></comment><comment><USER31> At some point people will realise that holding large quantities of sensitive information is a liability, not an asset. Mindsets are slowly changing in this direction already.

The chickens will continue to come home to roost until people treat digital security as seriously as physical security.

<comment><AUTHOR> I wonder if we should take mandatory breach reporting a step further too and require them to list all security vendor products and services that were in place at the time of the breach.

Should security solution vendors be held to account for failing to live up to the bold claims they make?

<comment><USER32> Depends on how they sold it. Did they sell tools, or tools plus configuration services and consulting?

<comment><AUTHOR> It may not be workable, but when big businesses have invested millions in tools and services I can't help feeling there should be some vendor accountability.

</comment></comment></comment></comment><comment><USER33> It seems that the stock price (under the ticker FAF) hasn't suffered very much. This was revealed on 5/19, and the response has been tepid.There isn't likely going to be very much backlash on the stock, unfortunately.

<comment><USER16> I don't think there will be, we're well into "breach fatigue" territory now, and here there's not even currently any evidence of malicious use.

Unless/until this breach results in a large financial hit to the company (possibly via a class action suit) I doubt it'll have any impact and I'm not even sure a class action suit could show damages without evidence of misuse.

<comment><AUTHOR> Equifax's costs as a result of their breach have exceeded $1 billion now, and Moody's downgraded them a couple of days ago.

I suspect this is going to hit First American pretty hard.

<comment><USER34> Doubt it. There's no evidence yet that FA's leak was used by malicious hackers. The breach was discovered by some random other person who typed in a different parameter to a URL. Very likely that no one else would've known about it.

Whereas the Equifax situation was intentionally breached by attackers and it can be assumed that the breach was used to capture information for later sale.

I suspect that First American knew about this earlier this week and intentionally did a garbage dump on a Friday evening on Memorial Day Weekend. Maybe trade down a few tenths of a percent on Tuesday and their CISO will probably get axed. Nothing to see here, move along.</comment></comment></comment></comment>


Alaskans vote to legalize marijuana - <AUTHOR> http://www.adn.com/article/20141104/alaskans-vote-legalize-marijuana <comment><USER4> Here's an interesting piece of the Alaska marijuana legal status. We just voted to legalize recreational marijuana use, which includes growing and selling marijuana. I'm happy to see it pass because possession has been legal here for a long time, but sales and distribution has not. That's a murky legal situation, which I'm happy to see cleared up.

But last night an article ran in our local paper stating that the Coast Guard will continue to enforce federal marijuana regulations [0]. In Alaska, that's a huge asterisk next to legalization. You can't carry marijuana on a boat, which includes the ferries in southeast and throughout the Gulf of Alaska. That also impacts all of the villages throughout the state whose main access is by river. And finally, transporting marijuana by air is against federal regulations as well. That means marijuana is essentially legalized on the road system of Alaska, which leaves much of the state in another legal limbo.

I look forward to the day where the entire country has a more reasonable approach to marijuana regulation.

[0] [http://juneauempire.com/local/2014-11-03/smoke- water#.VFpFQT...](http://juneauempire.com/local/2014-11-03/smoke- water#.VFpFQTR4pcQ)

<comment><USER5> I didn't think drug enforcement was a duty of the Coast Guard. Usually anything related to cargo and crew is the CBP's responsibility, while the Coast Guard is about safety (life-jackets and -boats, certifications, search and rescue, etc.).

<comment><USER6> It's a drug and you're in or operating a vehicle I'd say it's no different than having an open bottle of alcohol.

Police in my province have been trained to spot DUI of drugs (besides alcohol) mostly pot since it seems many people think it's OK to drive stoned.

<comment><USER7> Having an open bottle of alcohol and drinking it is legal on a boat. You just can't be intoxicated.

</comment></comment></comment></comment><comment><USER8> I still find it very strange that California wasn't one of the first states to legalize marijuana. Now there are three states ahead.

EDIT: Looking at the results, these counties that voted 'No' surprised me

Los Angeles County (Los Angeles, Long Beach, Glendale, Santa Clarita, Pomona, Palmdale, Pasadena, Torrance, Inglewood, Burbank, Carson, Santa Monica etc.)

Santa Clara County (San Jose, Santa Clara, Cupertino, Gilroy, Palo Alto)

Riverside County (Riverside, Moreno Valley, Corona, Palm Springs)

Orange County (Santa Ana, Anaheim, Irvine, Huntington Beach, Laguna Beach)

<comment><USER9> I live in LA county. The reason the initiative failed in LA county is that we had a rash of fly-by-night MMJ dispensaries popping up everywhere. They looked shady: armed guards standing outside, blacked-out storefront windows, typically not run/owned by anyone identifiable in the community. The look from the street was like a massage parlor or strip club.

When cities, like LA proper, tried to regulate them by establishing a permit process, the MMJ dispensaries fought back in the courts (which is their right), and there ensued a legal cat-and-mouse game that stretched on for years. Because medical MJ is used in CA as a surrogate for legalization, it was hard to have an honest debate.

Given the failure of local regulation, there was a backlash against going farther. It'll work itself out. And then we'll see how it looks, because as with everything else under the sun, legalization won't be a panacea.

<comment><USER10> It might be helpful to note that a major reason for armed guards could be the inability to keep money in proper banks, due to federal laws. When one doesn't allow law abiding citizens to participate in a seemingly reasonable manner, I don't think it is any surprise that criminals and other societal outcasts tend to fill the void....

(As an aside, even with the change to federal regulations earlier this year, it is unclear that it even affects and allows California dispensaries to legally deposit money as they are not state regulated, which I believe was a stipulation, but someone more informed might be able to correct me.)

<comment><USER9> > ...inability to keep money in proper banks, due to federal laws...

I agree. This contradiction (partly legal, partly not) discouraged typical law-abiding citizens from entering the MMJ business.

I think there was also a tax angle, in that you had a hard time reporting the MMJ income as taxable, but if you didn't, you were evading taxes.

The operator of a dispensary up the street from me was pinched by the feds boarding a private plane with a suitcase containing about $60K in cash. (It's not like it was a flight to Mexico, it was all within CA.)

So, like it or not, because of the way we have regularized MJ, that's the type of incumbent "businesspeople" we have.

</comment></comment></comment></comment><comment><USER11> DC and Oregon too. I think DC in particular will be interesting because Congress has power over DC it does not have with states. Could be the opening for a national debate (or the newly elected Congress could simply crush it).

<comment><USER12> My understanding is that it doesn't apply to federal lands in the District, which makes for some interesting problems what with all the parks.

I don't think Congress will attempt to shut it down in the city. I don't see that being a winning move politically, for a number of reasons. But I could also see zero tolerance being stepped up on The Mall to keep the tourists from less tolerant states placated.

<comment><USER11> Correct, there are _many_ federal parks in DC where this would not apply. Even on DC land, I don't think the law permits smoking in public anyway.

I don't think Congress will veto the law (which doesn't happen often) but I think there's a good chance they kill it with a budget rider (which happens every year).

</comment></comment></comment><comment><USER13> This is very interesting considering Alaska has some strict alcohol laws. There are many areas that are completely dry, and alcohol is very expensive (black market). It's generally this way due to crime and abuse.

Will these areas kneejerk the same restrictions with marijuana, or will they wait to see how the community reacts?

/serious off

It's illegal to give a moose alcohol in Fairbanks: [http://www.legalsource360.com/index.php/strange-laws-in- alas...](http://www.legalsource360.com/index.php/strange-laws-in-alaska-438/) Hope they're not left out, again.

<comment><USER14> > It's illegal to give a moose alcohol in Fairbanks

This sounds like a perfectly reasonable law. Imagine the damage a 1500 lb drunk bull moose would do.

<comment><USER15> I guess somebody actually experienced it, so they wrote down for good that it's a Bad Idea™.

</comment></comment></comment><comment><USER16> An interesting but perhaps meaningless correlation: The areas legalizing marijuana first are all predominantly cold, mountainous states.

<comment><USER17> Except DC which was built on a swamp.

</comment></comment><comment><USER18> I'm ready for Texas to follow suite. You think corn, wheat, cotton, cows, and oil are profitable? Wait till the congressmen and farmers understand how valuable MJ is as a cash crop, I predict legalization even in our red state within a decade.

<comment><USER19> I think industrial hemp holds even more promise commercially, but I suppose the marginal profit by weight on cannabis vs. hemp is greater since it's either slated for recreational or medicinal uses rather than the generally less-sexy uses for hemp fibers and oils.

<comment><USER18> I agree regarding hemp. It's a very versatile and relatively hardy crop, and with shorter growing cycles than other crops, so the same applies to it.

</comment></comment></comment><comment><USER20> I can't help but to wonder if the tobacco lobby is somehow involved. For decades society fought against smoking and has largely won. So, what happened to all of those tobacco crops? I wonder if that industry is behind the legalize movement so they can shift their production to another crop.

Interesting historical fact is that initial tensions over marijuana came about because slaves, and later Mexican labourers were frequent users. White plantation owners (tobacco farmers) took issue with their practices. So, at least in part the banning of marijuana can be partially attributed to racism.

<comment><USER21>
      You'll also see that the history of marijuana's criminalization is filled with:

      - <USER2>
      - <USER3>
      - Protection of Corporate Profits
      - Yellow Journalism
      - Ignorant, Incompetent, and/or Corrupt Legislators
      - Personal Career Advancement and Greed

      These are the actual reasons marijuana is illegal.

Some messed up stuff right here: [http://www.drugwarrant.com/articles/why-is- marijuana-illegal...](http://www.drugwarrant.com/articles/why-is-marijuana- illegal/)

<comment><USER22> There's a lot more money to be made domestically by legalization, when it comes to corporate profits, than there is in prohibition.

The beer companies proved that the last time around.

If legalization were decided by corporate profits, the war on drugs would have ended a long time ago. Big pharma would love nothing more than to hand out all sorts of prescription drugs over the counter. Big ag farms would love nothing more than to grow and sell pot.

It's blatantly obvious that corporate profits are in fact not the issue.

Right now, a lot of that money is outside the country, in the hands of cartels, middle-men, etc. That could be mostly brought home, and it would bolster corporate profits tremendously, to the tune of billions in profit per year.

<comment><USER20> 'Big pharma' has no interest in marijuana because it's not their business model. Since there is no patent protection the generic manufacturers would squeeze out any profit to be had the medical marijuana market.

<comment><USER23> There is a reason it's called "weed", it grows like one.

</comment></comment></comment></comment></comment><comment><USER24> The Liberal Canadian government of the 90s toyed with the idea of marijuana decriminalization, but the opposing argument that was always raised was that the Americans would be so staunchly against it.

Back in the 90s I would not have expected all other "Cascadian" states would legalize marijuana before British Columbia.

<comment><USER25> Here in Vancouver, BC, it seems to be treated as being de facto legal.

You can walk into a dispensary, make an appointment with their in-house naturopath and claim to have any of a long list of medical conditions which includes insomnia, digestive problems etc. As long as the naturopath signs off on a form stating that you have told them you have a condition that is on the list - you are eligible for membership at the dispensary with no prescription necessary.

Within 5 blocks of my house there are two such dispensaries, one of with is renting a retail unit that used to belong to a high-end salon, so essentially anyone can head on in to a clean, safe store and choose from a wide variety of cannabis products.

Obviously we still have the problems caused by criminalized marijuana to some extent (criminal records preventing employment, wasted resources etc.) but it's impressive how far things have come without decriminalization actually passing into law.

</comment></comment><comment><USER26> Ah, this reminds me of this priceless video of a journalist who quits live on air to dedicate all her energy towards this end.

[http://www.youtube.com/watch?v=wBPsbgKeIFM](http://www.youtube.com/watch?v=wBPsbgKeIFM)

Hopefully all her energy was enough.

</comment><comment><USER27> Does this MJ legalization apply to the native Alaskan areas where alcohol possession is illegal?

<comment><USER28> I _think_ it's now up the local legislative.

</comment></comment><comment><USER29> At the time of this comment there are 96 comments with only 6 of them about Alaska. I find that to be an interesting commentary on HN commentaries. ;-)

</comment><comment><USER30> A lot of what can be said has already been said. However, I would like to share a piece of joy- I'm in one of the pictures in this article. It feels great.

</comment><comment><USER31> I look forward to the day they have a vote on PEDs.

</comment><comment><USER32> Gosh we're so far from it in France

</comment><comment><USER33> I live in Alaska as a high school teacher.

We lead the nation in welfare, alcohol abuse and fetal alcohol effects, suicide, sexually transmitted disease, credit card debt, number of women murdered, and domestic abuse.

Now we are all going to be high as a kite, too.

This does not make my job any easier.

<comment><USER34> So, basically every thing you listed can probably be directly related to Alcohol Abuse. Maybe, just maybe, giving people a healthier and less abusive vice will make your job easier.

<comment><USER35> I got into a lot of credit card debt once in my life. It was not related to alcohol abuse at all. That's a pretty big assumption you make there.

Thankfully none of those other items have ever been in my life.</comment></comment></comment>


JSX is no longer my friend - <AUTHOR> https://medium.com/@jador/jsx-4b978fbeb290 <comment><USER2> This needs to be prefaced: this argument is overdone. JSX is not hard to learn. It's an order of magnitude better than the hampered DSLs of handlebars or dust, and I'm concerned that any engineer is so scarred that learning it takes more than 5-10 minutes of RTFM. After all, TFM on JSX is all of 200 words or less [1].

I've been using JSX since React 0.4. React's greatest strength is its simplicity. You can read all of React's documentation in 20 minutes. There's hardly any learning curve compared to the larger JS frameworks out there. It's all just JS*--no "logic-less-ish-kinda-sorta" template for loops, or two way data bindings, or figuring out when to render.

I don't think JSX is the terrible problem the hyperscript people make it out to be, but I think it might be time for it to retire. While JSX is as mild as learning curves come, it's still a learning curve. It still requires transpilation. It requires the extra characters. To reframe the conversation, does it make sense for the learning curve to be "it's HTML-ish with caveats like camelcasing but it works like JS" or "it's a collection of functions that generate HTML that are named for the HTML tag they generate."

I'm also really interested in the "but it makes sense to designers" argument. Is that actually true? Are there designers out there who understand JSX but wouldn't understand well formatted hyperscript? I feel like that's saying "yah I get ERB but HAML doesn't make any sense."

Again, I don't think this is a big enough deal for the amount of attention it gets paid. I'd love to see the React team bring in first class hyperscript- like syntax that is 100% JS, but it's hardly a reason to not use React.

[1] [https://facebook.github.io/react/docs/jsx-in- depth.html](https://facebook.github.io/react/docs/jsx-in-depth.html)

<comment><USER3> I've also been using JSX since the good old days, when a component was just a function -- "hyperscript" (such as it is) was built right in. Notably, writing React apps in CoffeeScript was beautiful:

        div
          className: "greeting"
          "Hello, world!"

As you pointed out, the biggest problem with JSX is not that it isn't JS, it's that it isn't HTML. It's a leaky abstraction. Camel casing is only the most obvious problem, things like className and htmlFor are more insidious.

So as soon as a developer realizes that it's just sugar over JS, they are in a world of trouble, invariably trying to stick an if-else into it. If everyone had enough grounding in language theory to tell them: "JSX is just a JS primary" all would be well, but alas, that's putting the cart before the horse.

<comment><USER4> I'd like to learn enough to understand the statement "JSX is just a JS primary," and I can't find out what a "$lang primary" is in PLT. Can you point out some resources for me to figure this out?

<comment><USER5> The previous comment is trying to sound smart by using obscure terminology. I would guess they mean to say that JSX is a translated subset of JS?

<comment><USER3> Thanks for your generosity. This is what I was referring to: _JSX extends the PrimaryExpression in the ECMAScript 6th Edition (ECMA-262) grammar_.

Please take a look at the draft JSX spec [0] for details.

[0]: [https://github.com/facebook/jsx](https://github.com/facebook/jsx)

</comment></comment></comment></comment></comment><comment><USER6> So I'm the guy who wrote the post in question.

As the view counter started to exceed my expectations I thought there would be a fair amount of negative feedback. I was surprised that there wasn't much. Turns out that it's all here on HN! :P

First off, I can't believe all of you actually read that. You have both my sympathy and thanks. Even more thanks for commenting on it.

I want to address a few of the points brought up in the comments.

1| Yes the title is click bait. The title is the initial hook to the reader (and often the only thing you'll see before deciding to check it out). So by definition it is click bait lol It is also true.

2| The post wasn't intended to say JSX is bad or that you should use hyperscript (although I do think you should try it). It is an account of my decision to investigate hyperscript and some reasons why I chose to stick with it.

Each team and project is different and I am not so assured of my opinion to say that you _should_ use hyperscript. I've seen some who genuinely prefer React.createElement. I've seen react-jade also brought up today. If there is a view abstraction that you like better then you should use it.

3| Yeah, the argument I present for why I implemented hyperscript may seem rather thin. For my team, however, it was not.

4| Despite the fact that we often talk about React and JSX in the same sentence they are not synonymous (see the "use the one you like" argument above). JSX does take some setting up to use. And you'd be surprised how often I field questions about the JSX transformer even though it was deprecated nearly a year ago...

5| The RTFM argument. If you knew the developers on my team they could tell you that I tell them to RTFM several times a day. I think it is very important for them to consult the docs whenever they have a question instead of me. That being said, I'd rather them RTFM about immutable-js or functional combinators than view syntax.

If you've got more heat lay it on :)

<comment><USER7> I started reading with skepticism and you hadn't convinced me by the end that you were any more or less "correct" than my own approach. That being said, I never for a second thought you were wrong and needed correcting either. Your tone never implied to me that the you thought anything similar about the reader either. Your responses in the comments on Medium basically confirmed in my mind that you were just talking to the void about what has worked for you and your team.

1| Don't let anyone bother you about headlines that attract readers and healthy conversation. Despite the romantic notions we may harbor about writing, it is an attention game for most who do it. Good headlines are a part of that game.

Kudos on handling the unexpected attention well :).

<comment><USER6> I have to say, and I'm honestly sorry I haven't gotten around to it till now, that I genuinely appreciate your kind and rational words. ^.^

</comment></comment></comment><comment><USER8> The thing that the author misses is that JSX is very natural for designers. If you properly encapsulate any logic into methods on the component rather than having it all inline in the render return, even designers with mediocre technical skills can productively work with JSX files. This can be a huge productivity win, and beyond that honestly I don't know many engineers that enjoy translating designer mock-ups.

<comment><USER9> JSX is also very natural for people who've written HTML for years.

I wasn't a fan when I started, but now I love it to bits.

<comment><USER10> I fell in love at first sight. Since it was in wide use at Facebook I got my team to take a look at it. Now they love it. Once you start breaking up things into small mostly reusable components, the true power of JSX shines through. And since most files never end up being very large with well reasoned interfaces between components, it's much easier to reason about your user interfaces.

</comment></comment></comment><comment><USER11> My brain parses JSX way better than Hyperscript, so I will stick with it and suffer the extra keystrokes.

And the context switch has not proved to be a problem for me, but I'm sympathetic to the argument.

</2cents>

</comment><comment><USER12> I very much like how the recommended Hyperscript looks, but the package was last updated last December, and it doesn't even list React 0.14 in the compatibility list: it stops at v0.13, which was released in May 2015. Half a year _before_ the last update of Hyperscript.

It's arguably a small package that you could just rewrite if things go wrong, but is it a smart idea to base any project on semi-abandoned code?

<comment><USER13> That's what I don't like about a lot of bleeding-edge web development. You end up depending on a half-dozen abandoned pet projects. Somebody had an itch, scratched it, got bored.

I swear half of the gulp eco-system is just that - half-abandoned, half- working little cute plugins that someone did because someone else's plugin, even though 99% identical, didn't do the one thing they wanted, so they wrote their own and then abandoned it, instead of maybe contributing to the other one. Sometimes, web development frameworks and libraries just feel like a giant software ghetto - a giant web of dependencies that someone combined into something with little thought given to long-term maintainability.

One of my team members refuses to incorporate a dependency that is by "some guy" and hasn't had any commit activity in the last month.

<comment><USER14> If a major framework hasn't had commits for a month that _might_ indicate something. If it's just some random module that's small and has no major open issues, then that policy is unreasonable. Does your team regularly audit the commit streams of already-in-use dependencies so you can rip them out when the maintainers take a break?

<comment><USER13> It's more of a tongue-in-cheek thing but it was born out of real frustration. It really depends like you said - it helps to look at the source code and see if it is maintainable by our team in case it is abandoned.

</comment></comment></comment></comment><comment><USER15> This article includes a tweet which demonstrates a very contrived example of a for loop using JSX. If you're ever writing code like this, please reevaluate your career in software development.

As an aside, we recently moved from Nunjucks templates to React / JSX at work and the frontend team couldn't be more pleased. Components reflect improvements made to them across the board and provide a happy medium between designer and JS dev. I have also found a lot of power in refs by implementing superclass functions that provide reusable logic for elements based on the key of the ref when certain functions are implemented on the corresponding component. This can be used for state persistence in forms, analytics or anything else the developer imagines.

Context switching has not been an issue but all of our frontend devs also do work on the backend. This may be an issue to consider for teams that don't embrace cross disciplinary roles.

<comment><USER16> "If you're ever writing code like this, please reevaluate your career in software development."

That's a pretty nasty comment to make about anyone in this industry over a simple for loop.

<comment><USER17> Well, it is just plain wrong. Even if you wanted to do a for loop in JSX you'd do

            {for (var x=0;x<10;x++) {

            }}

Not a templated component like that. That said, I have created repeater components and the like before, largely because JSX is _so_ friendly that more design-minded people can use it very easily.

EDIT: turns out that doesn't actually work, ha. I've never written JSX that way.

            {[0,1,2,3].map((i) => {

            }}

on the other hand...

<comment><USER18> You just proved the author's point. The JSX you provided is invalid, since you can't pass `for` as a function argument (see his equivalent bit about `if`).

<comment><USER17> Huh. Well, my only defense is that I would never even try to write JSX like that anyway - the actual JS in my JSX templates is basically just Array.map calls.

</comment></comment></comment></comment></comment><comment><USER19> This person and the person he quotes seem to be quite confused about what JSX is and how it works. Hyperscript looks cool and use it if suits you but I don't think most of these reasons are valid nor actually make sense (like [https://twitter.com/andrestaltz/status/674313202197520384?re...](https://twitter.com/andrestaltz/status/674313202197520384?ref_src=twsrc%5Etfw) isn't related to JSX at all)

</comment><comment><USER20> Better markup DSLs have already been written, which "mingle" better in code: HAML and Jade. Unfortunately reactjs-jade never gained any momentum it seems.

Hyperscript seems like a "reasonable alternative" to JSX. I won't say "better" because you're trading <angle brackets> for `h([ , ])` symbols that also contribute to line noise. And other common pain points like "you can't put an `if` block inside your markup" still persists.

<comment><USER21> I disagree. I have no desire to go back to jade

</comment></comment><comment><USER22> no offense to the author, seems like hyperscript has achieved what it hopes... but the benefits of not having to learn some confusing piece of JSX-ness do not seem to outweigh the cost of h('strong','uglify')-ing everything from a legibility standpoint.

disclaimer: only read the README, didn't try actually using hyperscript.

</comment><comment><USER23> It would be nice if it had more of a Jade indentation like syntax. The angle brackets and closing tags are just syntactic noise.

If we want to go with the code route then the DOM as code is actually really clean with Coffeescript.

Elm is interesting but I don't like having to do [] (empty array) when there are no attributes or [] for the children when there are obviously no children (hr, br, img, etc).

<comment><USER24> It is an alpha-quality library, but I've been playing around with something like this, using ES2015 template strings: [https://github.com/af/slashpile](https://github.com/af/slashpile)

I've yet to figure out if the run-time performance hit is reasonable, but I vastly prefer the syntax to either JSX or hyperscript (I previously wrote a hyperscript-like library as well, and have used it for several months)

</comment></comment><comment><USER21> Notably we must first understand that there is a differemce between react as a framework and jsx. Jsx provides a means to generate ui patches which in turn resolve to html through react. What makes jsx so great is that it looks like html so you dont have to think in some special library way. Your using pre- existing technologies which is wonderful.

A more important point is the handlebars. So, handlebars implys block in javascript but what is actually happening is the context is evaluated and passed to the component. Kindof how parenthesis work

(A || b).property(array.sort(compareFactory())

The fact we use handlebars when the text inside is actually evaulated how parenthisis work probably enables this sort of confusion. The reality is handlebars is for the angular/mustache crowd and to ensure they feel at home. But in parenthisis would build on exisisting knowledge of how js works

<comment><USER25> The "handlebars" are just plain javascript syntax for a block, not template markers. You can try it in your browser console.

        { console.log(123); }

<comment><USER3> Not exactly... within JSX the handlebars signify "now I'm going back to plain JS".

compare

            console.log(123)

with

            { console.log(123) }

The first outputs a div with the text "console.log(123)" inside. The second logs "123" and outputs an empty div (since console.log returns undefined).

<comment><USER25> That's the point.

</comment></comment></comment></comment><comment><USER26> Honestly, if I thought JSX was too complicated (it lints very well with ESlint, so even if it was problematic, you can just let the tool figure it out for you), all I'd do is use destructuring with the React.DOM built in element factories and call it a day. They're fairly simple to use, and then it really is just javascript.

But I've never seen anyone, not even the most junior, backend-only developer touching React for the first time, have any issues with it for more than 4-5 minutes. ESLint catches any mistake they make.

The only real argument, and it is a valid one, is that Babel does not use shorthands in the output, so it's a trainwreck to read. If that was the primary argument, I could get it. Though then IMO the solution would just be a better Babel plugin for development.

</comment><comment><USER27> <For i={1} condition={i < 10} step={i++}>

Why would you ever do that instead of having the logic in the component itself?

</comment><comment><USER28> A long time ago I tossed together a template-language DSL of my own[1] when a bunch of my friends complained that there were "too many choices" and that "we should just use plain JS and HTML without a complicated framework" (I feel like this tagline gets used by many newer 'microframeworks').

Sometimes you just don't want to RTFM, and so you get to enjoy the standards problem[2] rather than learning someone else's tool. Sometimes you just have a lot of spare time and want to re-implement something as a learning experience. But it's a good idea to acknowledge the technical merits of those who've come before when you want to go down that route - JSX is a _well done_ project. If you don't learn from it's good parts (familiarity, ease of use, prolific tooling), as well as the bad you feel you see, you don't get anywhere. The author became familiar with JSX to the point where his perspective of its benefits and flaws shifted - after using it for a long time you can forget its benefits until you no longer have them.

For example, I would argue that the contextual switching the author complains about is a _good_ thing - I find the extra hesitation helps you create boundaries and keep unneeded code out of your views.

[1][http://ham.io/not.js/](http://ham.io/not.js/) [2][https://xkcd.com/927/](https://xkcd.com/927/)

</comment><comment><USER29> Perhaps not the best avenue for this, but I thought I'd take advantage of eyes on this discussion. How might I go about using JSX outside of React or creating something similar? I basically want to turn custom <xml-style> code into JavaScript that instantiates custom classes that have nothing to do with the DOM. I'd like to do this via a babel plugin as well.

If you can't tell, I enjoy JSX tremendously and I'd like to use it or borrow from it extensively outside of React.

<comment><USER30> It's pretty straight forward to use JSX outside of React. If you're using Babel you can simply add

        /** @jsx ExampleDOM */

As the first line in your Javascript source file. This indicates to the transpiler to convert statements of the form

        <example name="Wesley" age={15}>
            <Message text="hello"/>
            <Message text="world"/>
        </example>

into

        ExampleDOM('example', { name: 'Wesley', age: 15 },
            ExampleDOM(Message, { text: 'hello'}),
            ExampleDOM(Message, { text: 'world })
        )

where you implement ExampleDom as

        function ExampleDOM(element_or_component, attributes, ...children) {

        }

Note that because 'example' starts with a lowercase character, it is transpiled into a string first-argument to the ExampleDOM function. If it starts with an Uppercase letter (i.e. 'Message' above) it is interpreted as an in-scope Javascript variable.

We've had really good results using JSX outside of the core react library. For example, we've built a "React.js for Excel" that lets us easily create rich Excel workbooks:

          <worksheet
            clear
            protect
            flow="column"
            name={`Bespoke - ${network.shortname} - WACC`}
            tabColor={theme.bespokeBlue}
            displayGridlines={false}
            style={worksheetStyle}>
            <PageLayout
              title={`${network.name} Cost-of-Capital Worksheet`}
              lastUpdated={new Date()}>
              <UpdatedWACCEstimates network={network} determination={determination}/>
              <WACCForecast network={network} forecast={forecast}/>
            </PageLayout>
          </worksheet>

Which looks a lot like React.js and behaves almost exactly the same, but it's targeting the Excel COM Object model rather than the HTML DOM.

<comment><USER29> Fantastic. Thank you for the detailed response and examples.

</comment></comment></comment><comment><USER31> This article's direction makes sense for the task of 'writing HTML in JS'. I find that JSX true power comes when you actually start building reusable components for the many pieces of your UI.

This becomes even better when using a TypeScript capable editor with TSX, creating classes for the components and taking advantage of full autocomplete and syntax checking from your editor. Your code ends up pretty readable, composable and error free.

<comment><USER3> You can still get all of those advantages using React without JSX. Reusable components have nothing to do with JSX. Syntax checking/highlighting/etc. is arguably easier (in a global sense) without JSX since we don't need to fork acorn or esprima to get it.

</comment></comment><comment><USER32> I was nodding and agreeing right up until he got to the part where he was talking about how he's using Hyperscript as a replacement. Hyperscript's just the same problematic design with a different syntax.

Mixing HTML and server side code may let you do toy projects quickly, but in the real world it's a great recipe for building an unmaintainable, undifferentiated, monolithic mess.

<comment><USER33> The historical problem with mixing HTML and server-side code has been one of mixing responsibilities. I'd probably still recommend keeping them separate for an HTML/server-side code application, but for frontend work, it takes on a different character.

I work on very "functionality-oriented" applications; no dedicated designers here. Having a split between JS view code (example, in the form of Backbone views) and template code is just frustrating to deal with. React addresses the issue by putting the relevant pieces of view code together. The React code should be separate from other code types (whatever you would call it: models, business logic etc.), but that's just like what we are trying to solve with separating server-side + HTML.

I still think however, React is controversial. I would be considerate when deciding to use it, because I just don't think it is that important for many applications.

</comment></comment><comment><USER34> I don't have any issue with the hypersrcipt library presented here. In fact I find it interesting that, this is more or less how React used to work many versions ago. All JSX tags mapped directly to functions and there was no such thing as React.createElement. In fact I was always a little sad that React made that change, it was such a natural mapping. I understand there are under the hood implementation advantages to the move, but having the option to do React.dom.ul(...) was kinda cool.

That said I really don't find any of the authors arguments particularly persuasive. I work with many inexperienced JS devs and haven't seen them struggle with these issues in JSX. Not to discount the authors experiences, it just seems this article could have been more about highlighting the library, rather than creating highly contrived seeming examples of why JSX is bad. I also agree with some of the others, that the advantage of JSX mostly comes in working with designers and people more familiar with HTML than JS.

<comment><USER35> > React.dom.ul(...) was kinda cool

React.DOM.ul() works as it always did. Even if we change that (since it's kinda silly to ship down a big list of tags that we don't otherwise need), you can also do

var ul = React.createFactory('ul');

and then ul(). No big deal.

<comment><USER36> It's not that simple, and hyperscript [A] is much more practical than createFactory [B].

[B] requires the first argument always to be props, so most of the time for empty props, people end up always giving `{}` or `null` as the first arg. In [A] they are optional. In JSX if you don't have props you don't need to provide any "empty props" object.

In [A], children are always an array, while in [B] sometimes a single-child parent only accepts that child as last argument, instead of an array with one child. Otherwise it's a runtime error or warning. This special case treatment is only visible when using [B], but transparent when using JSX.

In [A], the first (optional) argument can be a CSS selector to declare the classnames and id. In [B] you have to give it explicitly as props.

All this indicates that while React supports a non-JSX workflow, [B] is way less practical than JSX, probably because Facebook itself uses JSX extensively, and supporting non-JSX workflow was an afterthought when releasing React to the public.

</comment></comment></comment><comment><USER37> Since about December 2015 I have been learning React-native for my android needs. While I had programmed extensively in Javascript in 2008 (dojo) -- I have forgotten number of things, and just essentially re-learning (and I had never done a production mobile app before).

I find JSX, at least within context of react-native is very useful.

I specifically like being able to have this 'duality' of a view for a Component.

JSX allows a custom component to viewed by outside as first-class citizen of an HTML mark up. But within the component -- it is a class with members, Eiffel-like preconditions for construction, and explicitly managed state.

I think React-folks got the separation between Presenters and Interactors exactly right.

I would not mind even more features where the state management relies on channels that are can contain Parent, children, and may be even 'peer' events. (something like clojurescript's CoreAsynch for the above 3 categories of events affecting states for a given component).

</comment><comment><USER38> In my opinion JSX is usable, and gets the job done. I have used it, and enjoyed it. However, my personal preference to write html is one that I think looks beautiful in comparison to template engines. Nicely enhanced by syntax highlighting, and perfectly pure in its structure. And with the most known syntax. It is the most simple and productive. It is: writing html in html itself. (I am describing my personal favorite, not saying that it should be the right way for everyone). I prefer frameworks that let me structure the html views of my projects, using declarative html.

In the same line, breaking things into components is best achieved, in my opinion, using web components. The syntax is a little muddy, due to all the html legacy cruft. But I find it better than the alternatives, for example react components. With web components, the great thing is that any styles and javascript functionality is scoped to the component. That allows for better separation of concerns in separated components. This is specially useful when you have components with functional styles: animations, transitions, etc.

After componetization is solved by web components, the problems with html in html boils down to mostly two things: generating multiple elements from some data, or setting data in elements based on some other data. For these things I prefer the syntax style of data binding and "repeaters". My favorite is polymer([https://www.polymer-project.org/1.0/](https://www.polymer- project.org/1.0/)). Example:

      <el-container id="listbox">
        <el-list-items itemsdata="{{model.itemlist}}"></el-list-items>
      </el-container>

And the concern of repeating multiple elements is trapped in a component. In the example above, in <el-list-items>. In general, when using this technique, data binding must not be abused, or the view becomes a mess.

<comment><USER39> have you tried vue? it has similar syntax but does not require polyfills.

</comment></comment><comment><USER40> I think the issue here is one of perspective. My thought would be that removing JSX and replacing it with other JS conventions _may_ make it easier for new devs but I'm quite certain that now you've made your code base highly inaccessible for front end designers who just want to find the HTML hidden amongst all this code.

</comment><comment><USER41> The decision to use JSX or not is really one of the least important decisions you need to make when writing a React application. It's essentially a style preference.

Personally I like JSX. It's nice having a special syntax that your editor and linter [1] can understand. And if you are part of the stateless/minimal-logic component camp then most of your components will look more like HTML/JSX with a little bit of JS interspersed than vice-versa.

[1] [https://github.com/yannickcr/eslint-plugin-react#jsx- specifi...](https://github.com/yannickcr/eslint-plugin-react#jsx-specific- rules)

</comment><comment><USER42> After many Medium posts of uninformed, not very insightful complaints about react and the state of JavaScript I am becoming inclined to just avoid Medium posts about JavaScript in general.

Medium has become the analog to Tumblr posts for opinionated engineers to whine about things that don't really impact development in ways that matter.

Really all this developer had to do was talk about Hyperscript in a positive way and I would have found this post interesting instead of rolling my eyes paragraph after paragraph. Oh poor you and your angle brackets, such a burden! Putting HTML directly into my JavaScript is awesome and I never want to go back to separate template files ever again. It's wonderful and results in great code that works well, is readable, and is easy to test.

<comment><USER43> I think his points about new developers having to learn JS, React, and JSX all at the same time and then context switch between them in ways that aren't entirely clear was pretty spot on. I don't know how you draw that comparison without mentioning the shortcomings of JSX. Also with Hyperscript you're still building your markup directly in your Javascript, just using JS for it instead of JSX, not templates. Not sure if that's what you meant with your "separate template pages" statement.

<comment><USER44> But optimizing for those with no development experience isn't one of the goals of React. From the "thinking in react" page in the docs,

"React is, in my opinion, the premier way to build big, fast Web apps with JavaScript."

Nowhere in the documentation does it stress that it's easy to learn or ideal for beginners. If you don't know Javascript, writing React applications (or any application, really) is going to be painful. Full stop. JSX adds cognitive load when writing code, but reduces cognitive load when comparing the DOM to the component that created it. Given the amount of time I spent debugging and refactoring, I'm happy to use JSX.

<comment><USER43> Whether or not React's goal is to cater to beginners doesn't make the argument any less valid. Also React doesn't equal JSX. The React docs also mention how to do things _without_ JSX.

Maybe it's the article's title that has understandably rankled some people by seemingly maligning JSX. However, I think it's a very valid concern to have when ramping up a team that's unfamiliar with JS and React.

<comment><USER44> It doesn't make it less valid, but "is JSX bad" has been done to death. It's been the subject of Medium posts like OP since I started using it in 2014. If you're "ramping up a team that's unfamiliar with JS and React," maybe you should be deciding whether to hire somebody experienced with JS and React instead of deciding whether or not to use JSX.

<comment><USER43> Agreed, the title was link bait done to death.

I'm not in the situation of ramping up a team unfamiliar as the author was. But it sounds like he was experienced with JS and React himself. Or are you suggesting he should replace his team with people more familiar with JS+React?

</comment></comment></comment></comment></comment></comment><comment><USER45> If anyone was curious about other alternatives, we use r-dom at work. I am personally happy with it as an alternative to JSX.

[https://www.npmjs.com/package/r-dom](https://www.npmjs.com/package/r-dom)

</comment><comment><USER46> JSX is the template layer not tied to React.

I think of it as a child of - XML + JS.

I am waiting for JSS - CSS + JS, for the styling part.

Radium [1] is a promising start.

[1] [http://stack.formidable.com/radium/](http://stack.formidable.com/radium/)

<comment><USER47> I find tachyons css the best complement for react

</comment></comment><comment><USER48> this might be the wrong place to ask this, but i've been noting a few trends over the last 20 years or so...

why are web-developers so damned clever? do we really need to do all of this to ourselves?

the web is just a port, a protocol, and a model for interaction, underneath it all.

why on earth can we not live with the existing web, and move on towards inventing other spaces?

a browser is just a shitty sandboxed OS with a declarative markup renderer. there's nothing to stop anyone from making a different client-side x-terminal... (as that's what people are trying to turn the web into, apparently)

</comment><comment><USER49> [https://discuss.reactjs.org/t/jsx-or-pure- js/3496](https://discuss.reactjs.org/t/jsx-or-pure-js/3496) yes, fuck jsx

</comment><comment><USER50> should we write {0x68, 0x65, 0x6c, 0x6c, 0x6f} instead of "hello"?

joke aside, I think JSX does a great job to reduce the cognitive load, bridging codes as representation and its result.

</comment><comment><USER51> I'm wondering what the advantages of JSX are now in a world with ES6 template strings?

This seems plenty easy to read and write and has the benefit that it's pure JS and doesn't need to be compiled during development:

      const listItem = item => `<li><a href="${item.link}">${item.name}</a></li>`
      const listComponent = items => `<ul>${items.map(listItem).join("")}</ul>`

<comment><USER44> It was discussed a long time ago. Some googling found this very old link

[http://facebook.github.io/jsx/#why-not-template- literals](http://facebook.github.io/jsx/#why-not-template-literals)

<comment><USER51> Thanks for the link! This makes my case stronger as their example for why not to use literals is weak. Box should be a component that takes param(s), not a var for a tag name.

</comment></comment></comment><comment><USER52> In my experience, if JSX becomes too complex to read/write, then that just means I need to break down my components.

</comment><comment><USER53> And here it comes reinventing JSX under different name :)

</comment><comment><USER54> JSX is little verbose but CJSX is a bliss.

</comment><comment><USER55> I dont like JSX either. just a hype...

</comment><comment><USER56> The author might like RiotJS instead.

</comment><comment><USER57> And so the wheel turns...

</comment><comment><USER58> JSX was never my friend. Compiling is so 20th century.

</comment><comment><USER59> as much as people bash Angular, it was a relief just being able to take HTML code from a designer, sprinkle some ng- attributes and watch it come alive. I didn't even need to learn anything, it just made intuitive sense.

Unfortunately, as much as I want to learn React.js, there was too much context switching.

The only reason I'm persisting is because of react native. As soon as somebody comes up with a better way I'm ditching react

back to my good ol' jQuery

</comment><comment><USER60> JSX strikes me as inelegant and I don't care for it, but I don't think I agree with some of these arguments here. If JSX is honestly giving you trouble or confusing you in some way you should take some time to practice, I think.

</comment><comment><USER19> You really should edit your blog posts before releasing them. This is very clearly a one-take ramble and the quality suffers from it.

</comment><comment><USER55> I don't like JSX also... Totally agree with the author... JSX is just a hype, as I feel...

</comment><comment><USER61> Finally, somebody said it. I thought we abandoned that garbage when we left PHP, and now all of a sudden everybody wants to start mixing markup and code again?

<comment><USER62> Exactly this. Can someone explain to me what do people see in JSX way of creating components? What happened to good ol' code vs template separation and what's now wrong with having two separate files - .html (or jade, or whatever) and .js?

<comment><USER2> What does code/template separation actually achieve? Ignoring JSX for a moment, why are templates a good thing? Are you actually simplifying something by using {{#each}} instead of .map()? Is {{#if}} really better than if()? Seems to me like templates don't actually decouple code.

</comment></comment></comment><comment><USER63> JSX always looked like an abomination to me. Don't know a single person who uses it

<comment><USER17> I assure you, plenty do. Including myself. I had a very negative reaction when I first read about it (much like the article author) after 5 minutes it started to make a lot of sense to me.

<comment><USER63> I know that many people use React and JSX. anecdotally, I don't know any of them personally</comment></comment></comment>


Calling Apple out - Make dev material free. - <AUTHOR>

I'm a windows developer and I'd just like to call out the recent evilness coming from Apple. I received an email encouraging me to watch the WWDC08 session videos. I excitedly clicked the link^ where they attempted to charge me for the video sessions.
Microsoft doesn't charge for this type of material now-a-days and I was expecting the same from Apple. Big conferences like the PDC2008 are free^^. And of course there are plenty of free conference materials in other domains (Java, python and ruby).
So what's up with Apple being evil recently? It's been my opinion that one of the few things Microsoft does right is keeping it's developers happy. I would think this would be common sense to a company like Apple.
Has anyone spent 500-1000 to buy the WWDC sessions and was it worth it? Is it that different from material like PDC2008 that it's worth 500-1000 bucks?
^ http://developer.apple.com/products/video/wwdc08/index.html
^^ https://sessions.microsoftpdc.com/public/timeline.aspx <comment><USER2> I spent last weekend watching ton's of PDC2008 Videos on-line, checking out the power points and source code that was made available of the sessions. Then I a email from apple telling me that the WWDC08 video are available for purchase.

As much as I love my Mac, in this regard Microsoft come out tops.

<comment><USER3> I'm uneasy with this development too. But, if the WWDC presentations were freely available it would be one less reason to go. Also, Apple give me Xcode and supporting tools for free - Microsoft charge lots for Visual Studio.

<comment><USER4> Microsoft charges a lot for the Visual Studio with various enterprise/team/automation extensions, but the free version is sufficient for writing and compiling most -- if not all -- Windows programs.

</comment></comment></comment><comment><USER5> Charging money != evil

Nevertheless, I agree that asking people to pay for this kind of material is going to get them nowhere. If you want developers to develop for your platform, shutting the door on a large proportion of them is not the way to achieve that.

</comment><comment><USER6> It doesn't seem evil so much as misguided - isn't it best for Apple to encourage as many developers to use their platform as possible? I can't imagine the money they make off this sort of thing amounts to more than a drop in the bucket overall.

<comment><USER7> It's almost like there are three important groups of people: developers! developers! developers!

Ahem.

</comment></comment><comment><USER8> Why do people care what Apple does? They do what they do -- if you don't like it, don't use their stuff. Apple thrives on control; if you don't want to be controlled, use a Free OS.

<comment><USER9> Thats like saying why does rest of the world care what US does? I think it would be in Apple's best interest to make those videos available for the community. This would directly benefit them. You don't want people to complain, especially the people who contribute to your product that is making you tons of money. Just my thoughts.

<comment><USER8> I agree with you completely, but Apple wants people to pay money to be in The Club. They think that this will work for them.

If you disagree, develop for the competition :)

<comment><AUTHOR> I do.

</comment></comment></comment></comment><comment><USER10> As a contrast, Apple gives you Xcode and all of the _tools_ for free. Microsoft charges how much for a full Visual Studio kit?

<comment><USER11> It is a rather large download, but you can get basically all of Microsoft's development tools for free from this download:

[http://www.microsoft.com/downloads/details.aspx?FamilyID=c7a...](http://www.microsoft.com/downloads/details.aspx?FamilyID=c7a809d8-8c9f-439f-8147-948bc6957812&displaylang=en)

The image expires at the end of this year, but expect a newly updated image to become available shortly after.

<comment><USER12> You can also download free Visual Studio Express editions of VB, C#, C++, and Web Developer that have like 90% of the features of the full blown versions: <http://www.microsoft.com/express/>

And SDKs have been free forever if you just want the basics (docs, headers, tools): <http://msdn.microsoft.com/en-us/windowsvista/bb980924.aspx>

</comment></comment></comment><comment><USER13> I don't know if it's worth it. I attended WWDC and by far the more interesting and educational experience were the labs and networking, and the videos are close to bordering on "meh". Useful if I want to learn something but I don't know if I'd pay up to $1000 for them, and I most likely could just live without it and asking questions on forums/mailing lists/irc.

I do believe there _are_ some sessions available on ADC on iTunes from older WWDCs that you can watch, as well as some iPhone videos one may find handy that are all free.

</comment><comment><USER14> "So what's up with Apple being evil recently?"

The WWDC videos are nothing new and Apple has charged for them for the last couple of years, if not longer.

<comment><AUTHOR> I agree. Apple hasn't done anything new. While the rest of the industry has noticeably opened up.

</comment></comment><comment><USER15> One supposed explanation is that Apple only provides beta stuff (and docs for betas) to paying developers to weed out people who aren't serious developers.

<comment><USER16> I would argue that it's not Apple's role to weed out subpar developers. It's the market's role to do that.

<comment><USER17> Strategically, Apple doesn't want anything on their platform that doesn't fit in. Nintendo and Sony are exactly the same with their consoles.

<comment><USER18> Nintendo and Sony have formal, up-front approvals processes for their respective consoles, which - if controlling what goes on/does not go on the platform is the goal - seems a better way of going about it.

Incidentally, SCEE has quietly dropped the approvals process for PS2 games in Europe.

</comment></comment></comment></comment><comment><USER18> Apple may perceive a cost in supporting developers who may be less likely (or unlikely) to contribute to their platforms. Inasmuch as charging a fee for WWDC videos, or the iPhone program (or whatever), would deter such developers, not only would it save Apple this cost but it would allow them to focus their support on those who are more likely to contribute to their platforms.

</comment><comment><USER19> I'm speechless. I thought the age of video-sharing has lowered the cost of watching videos!</comment>


Why have so many coronavirus patients died in Italy? - <AUTHOR> https://www.telegraph.co.uk/global-health/science-and-disease/have-many-coronavirus-patients-died-italy/ <comment><USER3> "But there are other factors that may have contributed to Italy's fatality rates, experts say. This includes a high rate of smoking and pollution - <USER2> majority of deaths have been in the northern region Lombardy region, which is notorious for poor air quality."

This was also the case in china, but the age structure is different:

"A study in JAMA this week found that almost 40 per cent of infections and 87 per cent of deaths in the country have been in patients over 70 years old."

"An older population skew within the infected population explains most of the disparity in fatality rates between high and low countries. According to a study of the fatalities of COVID-19 cases in Italy, 99% of all deaths had an underlying pathology. Only 0.8% had no underlying condition."

Seems like a perfect storm for the elderly in italy who smoke a lot and most of them having an underlying condition like cardiovascular disease or diabetes II.

<comment><USER4> Lots of people over 40 have at last some mild health issues, over 60 almost everyone. Even younger people often enough have conditions they're not even aware of. So just wanted to say, don't get overly relaxed by these stats.

<comment><USER5> > Even younger people often enough have conditions they're not even aware of.

True and more complicated than that sounds. I was diagnosed with asthma at 28. A year and a half ago, at age 39, a pulmonary specialist rated my lung capacity at 115% compared to other males of my age and height likely due to exercising through unmedicated asthma. Undiagnosed underlying conditions shouldn't prevent intentional efforts to be continuously healthy.

</comment></comment></comment><comment><USER6> No, no, no, the main factor that they do not speak about is testing, simple as that.

If you do proper testing, like in South Korea, you detect everybody or almost everybody that has coronavirus, even when they don't have symptoms of the illness. That is 7 to 10 times more people detected(and controlled), that can actually transmit the virus.

In a country like UK, Portugal or Germany they had copied lots of things that worked in Taiwan, South Korea, Singapur or Japan.

Germany could have as many detected cases as Spain, but that will make only 1/10 of the real illnesses cases of Spain.

In a country like Spain or Italy people in charge are so incompetent that they have only reacted when it was too late.

That at the same time forces the entire's population to follow quarantine, because without tests you are blind to the people that has the virus without symptoms.

Spain's Government is today promising a million test kits(broken promises is the seal of Mr Sanchez), in the future, but as of now there are not enough test just for testing all people with symptoms, unless you are a politician or family member of a politician of course.

That is the result of not getting preventive stocks early on. They simply could not imagine(and hence prepare) what has happened and just took zero anticipative actions like buying face masks.

Those politicians have zero scientific or technical preparation, so they could not understand something as simple as an exponential function.

In the case of Spain, they have very well prepared people down the command chain. But the people that takes the decisions are just scientific illiterate.

<comment><USER7> This. It is highly irritating to me that all the popular maps and comparison sites don't use metrics like "coronavirus deaths per 1M population" (or similar) that are more comparable across areas.

<comment><USER3> For that information see this:

[https://ourworldindata.org/coronavirus](https://ourworldindata.org/coronavirus)

and they have very good information about testing in each country.

<comment><USER7> Reasonably chosen metrics, and explanatory context too. Thank you.

</comment></comment></comment></comment><comment><USER8> > "The way in which we code deaths in our country is very generous in the > sense that all the people who die in hospitals with the coronavirus are > deemed to be dying of the coronavirus.

How else could deaths be recorded? It would seem negligent to not record someone who died with coronavirus as dying of coronavirus.

<comment><USER9> If 5000 people die a day in average before the virus and 6000 people die a day on average after the virus would you say that the death toll is 1000/day or would you test all 5000 and say that any who had the virus were included in the virus death toll?

<comment><USER10> Do we have these numbers to compare? How much has the _overall_ death rate increased by?

<comment><USER11> There is an official European organisation trying to track mortality:

[https://www.euromomo.eu/](https://www.euromomo.eu/)

So far nothing suspicious, but they are always a few weeks behind.

<comment><USER11> Also note that you can look at subpopulations, e.g. people in Italy of age >= 65

[https://www.euromomo.eu/outputs/zscore_country65.html](https://www.euromomo.eu/outputs/zscore_country65.html)

</comment></comment></comment></comment></comment><comment><USER12> > Of the 47,000 people confirmed coronavirus patients in Italy, 4,032 so far > have died - with a record increase of 627 in the last 24 hours. By contrast > China has almost twice as many cases, 81,250, but 3,253 fatalities.

One major problem with this is China's reporting and actual figures.

<comment><USER13> How about the differences with Germany?

<comment><USER14> Could you formulate your question in a more precise fashion?

Here are some stats for Germany [1] as of yesterday:

      cases         deaths
      16,662(+19%)  47(+52%)

I have a contact high up in a Gesundheitsamt. While I can not give out any information I was asked not to divulge, I am happy to answer any questions. Please note that top level decisions are decided in small rooms and acted upon very quickly (Federal->Land, 2 hours lead time), so no way I can know anything time critical before everyone knows it.

[1] [https://en.wikipedia.org/wiki/2020_coronavirus_pandemic_in_G...](https://en.wikipedia.org/wiki/2020_coronavirus_pandemic_in_Germany)

<comment><USER15> The RKI statistics are not complete because the electronic submission is not done by everybody (allegedly NRW is particularly bad and has high numbers). I guess the system is new and the federal organizations are too busy to use it properly?

This is sad because RKI is the official authority.

<comment><USER14> The efforts to compile good numbers are a difficult task indeed. This is, after all, the first pandemic that hits the country for a long time. Not sure what happens at the interface RKI/Bunderland, but it seems the problem does not start with electronic submission, but from the intelligence generating and patient tracking in the field. While doctors in the 'Gesundheitsaemter' (federal and local public health organisation of the goverment) are on the phone the whole day, tracking and advising people (testing, quarantine protocols) that had contact with Corona patients, the foreign office (Auswaertiges Amt) allows 30000+ people come in from vacation destinations like Egypt without any testing or quarantine, mixing people in planes, and just letting them spread in Germany - effectively sabotaging the the entire process. Moreover, it seems that it is difficult to track infection cascades in high contact places such as hospitals (especially with staff): It is not clear how and when infections are taking place.

As far as I know, they were on the limit of tracking existing cascades in southern Germany last week, and word was that they realized that it was out of hand. Carneval, public gatherings, and failing personal hygiene and isolation, plus our tourists from Tirol and Egypt made tracking measures obsolete. Before that, so my source said, they had a very good overview of the number of infected (minus those without symptoms).

<comment><USER15> Taiwan and Singapur seem to have learned their lessons from SARS-CoV-1 but it did not hit us enough to act back then.

</comment></comment></comment></comment></comment></comment><comment><USER16> It is the level of testing isn't it?

Death pr. infected goes from 0.4% (Germany) to 1% (Diamond Princess) to 7.8% (Iran) to 9% (Italy).

If you have plenty of resources and you do contact tracing you are going to find many cases and the denominator will be high. If you are pressed on ressources and only test people admitted to hospitals with obvious symptions then the denominator will be low.

Demographics, overall population health, polution explains some of it but not a difference of factor 20.

<comment><USER17> Although an important thing to consider, I'm not sure how much it contributes. Look at:

[https://www.worldometers.info/coronavirus/#countries](https://www.worldometers.info/coronavirus/#countries)

Italy has one of the highest rate of cases per capita and the highest CFR.

</comment></comment><comment><USER18> > with a record increase of 627 in the last 24 hours.

Worth pointing out that the record increase in 630 deaths was the number of two days ago... Yesterday, the increase in deaths was even bigger: 790 (from 4035 to 4825 total casualties).

Source: [https://github.com/pcm-dpc/COVID-19](https://github.com/pcm- dpc/COVID-19)

</comment><comment><USER19> It depends how a country classifies casualties outside those confirmed cases. Autopsy usually would not be viable given the scarcity of health care staff.

</comment><comment><USER20> I find this article disingenuous and misleading to readers. Yes, there are cultural and demographic differences between Italy, China and Germany, but the subtitle claims a level of certainty that the experts interviewed in the piece do not support.

> "The country's high death toll is due to an ageing population, overstretched > health system and the way fatalities are reported"

This can be read with a level certainty that minimizes the seriousness of this virus for English speaking readers that may be faced with making life saving choices over the next week.

Further, the Italian expert interviewed __in the article__ underlines the importance of not searching for explanations, because right now it is hard to be certain.

> "It's too early to make a comparison across Europe," he says. "We do not > have detailed sero-surveillance of the population and we do not know how > many asymptomatic people are spreading it."

Unfortunately the author chooses to make exactly such a comparison in the fourth paragraph!

> In very crude terms, this means that around eight per cent of confirmed > coronavirus patients have died in Italy, compared to four per cent in China. > By this measure Germany, which has so far identified 13,000 cases and 42 > deaths, has a fatality rate of just 0.3 per cent.

This is a moment where we need very concise and accurate information. Even if this article comes from a reputable source, I find it misses that mark.

I find significantly more enlightening the ISS's (Istituto di Sanità Superiore) info-graphics which are prepared quasi-daily. [1] They are translated into english. [2]

Stay safe out there.

[1]: [https://www.epicentro.iss.it/coronavirus/sars- cov-2-sorvegli...](https://www.epicentro.iss.it/coronavirus/sars- cov-2-sorveglianza-dati) [2]: [https://www.epicentro.iss.it/coronavirus/bollettino/Infograf...](https://www.epicentro.iss.it/coronavirus/bollettino/Infografica_21marzo%20ENG.pdf)

</comment><comment> giovan-ni It is very hard not to think that also the number of deaths (not only that of cases) is under-reported. For instance, the Major of Bergamo, one of the few not entirely rotten politicians, claims that actual deaths in the Province in the last days have been 4 times the reported deaths. He verified the figures with the other majors. Who died at home, and there have been many, has not been tested.

Here the interview:

[https://www.huffingtonpost.it/entry/giorgio-gori-chiudete- tu...](https://www.huffingtonpost.it/entry/giorgio-gori-chiudete-tutto-anche- le-fabbriche_it_5e74ad81c5b63c3b648e6263?utm_hp_ref=it-giorgio-gori)

And it is very hard not to think that the most plausible explanation for the anomaly is shortage in ICUs.

</comment><comment><USER21> > The way in which we code deaths in our country is very generous in the sense > that all the people who die in hospitals with the coronavirus are deemed to > be dying of the coronavirus.

But people who died without a diagnose for the Coronavirus are deemed to be dead not because of it.

From [https://www.reuters.com/article/us-health-coronavirus- italy-...](https://www.reuters.com/article/us-health-coronavirus-italy-homes- insigh/uncounted-among-coronavirus-victims-deaths-sweep-through-italys- nursing-homes-idUSKBN2152V0)

> in the city of Bergamo, there were 108 more deaths in the first 15 days of > March this year compared to 2019 (164 deaths in 2020 vs. 56 deaths in 2019) > according to the mayor of the city Giorgio Gori. During this period, 31 > deaths were attributed to the coronavirus (less than 30% of the additional > deaths this year)

> "There are significant numbers of people who have died but whose death > hasn't been attributed to the coronavirus because they died at home or in a > nursing home and so they weren't swabbed," said the mayor

Granted, the sample and time interval is small to draw conclusions. But we'll know (perhaps when it's too late) what's the real death-toll of the coronavirus is.

tl;dr: The death count is not generous; probably the other way around. By, perhaps, a very big margin.</comment>


"So, Where Else Are You Applying?" - <AUTHOR> http://insights.dice.com/2015/06/29/so-where-else-are-you-applying/

<comment><USER2> Sometimes I feel like I'm part of a very tiny minority that prefers honesty in most situations. If I don't like a question at an interview, I say that I don't like the question. Or just answer the question. Giving vague answers or even lying at a job interview seems like a good way to get a job I'll not like.

<comment><USER3> This is sort of the same line of reasoning that people use to justify wearing jeans and a t-shirt to a job interview. The "should I be my everyday self" vs. "should I be a slightly-better (better dressed, more diplomatic, etc) version of my everyday self" has probably been around since the first formal job interview.

I tend to err on the side of "be slightly better, because they'll assume I'm doing that anyway, and what will they assume if I'm just my everyday self?" but whatever works for you :)

</comment></comment><comment><USER4> Just like compensation, I give vague answers until I have an offer. A lot of small companies have insecurities.</comment>


Twelve Views of Mark Jason Dominus (2003) - <AUTHOR> http://perl.plover.com/yak/12views/samples/notes.html <comment><USER2> Interesting and amusing. Thank you for posting this.

</comment><comment><USER3> I can't be the only one who remembers the Perl Quiz of The Week.

</comment><comment><USER4> Oof, the part about the message to aliens was pretty interesting.</comment>


How to build a user authentication system, from scratch - <AUTHOR> https://gist.github.com/siscia/5ed3277551370df3eb8b1063923621d4 <comment><USER2> Thanks for posting such a thorough guide in plain, easy to understand English ... it's great :)

</comment><comment><USER3> Step 1: don't.

<comment><USER2> Any particular frameworks/libraries you recommend instead?</comment></comment>


NodeChat: Android client for Node.js chat rooms - <AUTHOR> https://github.com/loganlinn/nodechat-android

<comment><AUTHOR> I've been visiting HN for a while now, but have yet to submit anything until now. I've seen some node.js chat rooms floating around lately, so I decided to share one of my Android side projects!</comment>


Why RIM is no Nortel - <AUTHOR> http://www.markevanstech.com/2011/06/23/six-reasony-why-rim-is-no-nortel/

<comment><USER2> "With the right strategic execution, significant improvements in the half- baked Playbook and a big dose of luck, RIM could keep its status as a tier-one smartphone maker."

I really take issue with this statement. First, what evidence is there that RIM's management are capable of "the right strategic execution"? They've had no credible response to the iPhone in the 4 years since it was released, and to Android in the 3 years since it's first hardware release. A new entrant came into a market that RIM essentially created, and they did nothing for 4 years. I don't think it's valid to use the company's performance in the time leading up to the iPhone, when RIM had no credible competition, as a predictor of future success. The moment a credible competitor began to encroach on their market, they had no response. IMO this is a much better indicator of future performance in the face of dominant competition.

"significant improvements in the half-baked Playbook"

Again, what evidence is there that this will happen. The first Storm was, by all accounts, a massive failure. The Storm 2 was too little, too late. The current management was responsible for both. People love to talk about how Apple came back from the dead, but what they forget is that Apple was driven to the brink of death by someone other than Steve Jobs. Steve Jobs came back and brought Apple to where it is today. Had the existing management remained in place, they would have undoubtedly gone bankrupt. RIM desperately needs a change of management.

"a big dose of luck"

With a big dose of luck, the 6/49 could make me millionaire. But you can be sure I'm not making investment decisions based on those odds.

</comment><comment><USER3> The Blackberry does have some advantages over other consumer smart phones. RIM's built a lot of infrastructure for dealing with corporate clients and security. It's probably going to be a long time before the president of the United States switches from a Blackberry.

</comment><comment><USER4> "RIM is highly profitable with lots of cash, which should provide it with a healthy financial cushion to figure out how to ride out the storm."

I don't think this is a storm. This is more like armageddon for RIM.

They have a clunky product that people don't _want_. People want iPhones and Android devices. People ask for them by name.

<comment><USER5> See, not everyone wants the latest iWhatever. I quite like the BlackBerry, actually - it's not flashy, gets far more battery life than nearly any other mobile device, has BBM (which is still, in my opinion, one of the best mobile chat platforms out there), and can do email/web browsing.

Yeah, there's not as many apps, and yeah, it's not all shiny like the iWhatever, or quite as open and easy to develop for as Android, but it's _very_ stable and reliable. And there's something to be said for that.

<comment><USER6> Blackberry has few years of profitability at their disposal. Consider the Indian market. Blackberry is spreading here almost like a wildfire. The reason is that it is an incredible smartphone at very affordable price. iPhone is almost thrice costlier than BB and the data plans double the cost of BB data plans.

In my opinion QNX holds key to BB's future. I had opportunity to work with QNX and I know it as a very powerful operating system that can run metro rails and nuclear reactors. I feel BB should relax and take their time to build the next OS based on QNX.

<comment><USER2> I think that pegging RIM's future to QNX is a mistake. There is no single technology that will return RIM to it's former status. iOS isn't the reason Apple is succeeding, it's simply one piece of the puzzle.

I keep hearing the same thing you wrote, that QNX runs nuclear reactors so it must inherently be good as a smartphone OS. I fail to see the connection between the two.

</comment></comment></comment></comment><comment><USER7> No Not Nortel but from a corporate perspective a little bit like Sun maybe. Making Outdated Phones for an enterprise market that has move on, relying on an humongous installed user baser, making weird technology bets, and half- hearted attempts at emerging markets like Tablets. Sound almost like Sun with Solaris, Java, MySQL and VirtualBox. I think Microsoft will play the Role of Oracle as the last act :)

</comment><comment><USER8> There is a surprising fact I stumbled upon when i visited Panama couple of weeks back. Blackberries rule in Latin America (at least from what i saw in Panama and heard)

Maybe Blackberry is losing out in states but is still going strong in other places.

</comment><comment><USER9> Interesting insight into RIM and Nortel. It's rather refreshing to read this compared to the sensationalistic articles written by other tech blogs and the media who don't really understand either RIM nor Nortel.

</comment><comment><USER10> RIM was caught off guard. They were hiring many new positions here in Ottawa (home of Nortel) and even others they own like QNX were hiring. RIM has now in fact announced they will be making layoffs instead. This doesn't help for confidence in the leadership if they didn't see this coming.

</comment><comment><USER11> RIM seems worse off than nortel. Individuals can change mobile phones much faster than companies can change telephony infrastructures.</comment>


Fair: An app that lets you get a car and return it whenever you want - <AUTHOR> https://www.fair.com/ <comment><USER2> This site needs to be transparent about what I can get _now_ and where I can get it. I can't even tell if they've launched yet.</comment>


What should a Front End Developer know in 2017? - <AUTHOR> Considering I am a fresh developer. What should be my skill set? <comment><USER2> The article "A Study Plan to Cure Javascript Fatigue" ( [https://medium.freecodecamp.com/a-study-plan-to-cure- javascr...](https://medium.freecodecamp.com/a-study-plan-to-cure-javascript- fatigue-8ad3a54f2eb1) ) is a great place to start. It gives an excellent series of steps for tackling modern Javascript concepts one piece at a time: Javascript, React, ES6, and state management. There's also a "Front-End Study Guide" based on that article that's very good, at [https://github.com/grab/front-end-guide](https://github.com/grab/front-end- guide) .</comment>


Ask HN: Does anyone actually like autoplaying of videos on websites? - <AUTHOR> Genuinely curious about this.  Just to be clear -
 I'm referring to the autoplaying of videos on services like Netflix, Amazon Video, Udemy, and YouTube, as well as news sites and sports sites.
As a user, there are very few situations I can conceive of where autoplaying of videos would be useful/desired.  Even if I was in such a situation, I would much prefer the option to toggle autoplay on and off myself as needed.
Anyone out there genuinely like these default autoplaying settings?  If so, why? <comment><USER2> I think it makes sense for Youtube at least because most of the times when people click to visit, they're there to watch the video. (I guess you could technically be there to only read the comments and not watch the video but that's very rare)

On the other hand, on sites like Udemy it makes less sense since there are other contents people want to interact with on the page. I think they're just employing a bad ux.

And once we get into spam territory like some shitty sites where most people visit expecting textual content and they just throw an autoplay video at you (which in many cases follow you around even if you scroll away), that's completely different from above two. These guys do this to make ad money.

</comment><comment><USER3> If you're in the kitchen cooking and your hands are covered with flour and chicken, then it's handy to leave youtube on autoplay so that it can play back all your favourite Billy Idol songs without having to clean off your hands to adjust what it's playing. The problem is that if you leave Billy Idol on autoplay for too long, it then takes you to things like A-Ha and before too long you have Morten Harket screaming about "Take on me" when all you wanted was more sneering.

</comment><comment><USER4> Yep, the ones making money with views.</comment>