Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone - <AUTHOR> https://www.forbes.com/sites/thomasbrewster/2019/08/08/apple-confirms-1-million-reward-for-hackers-who-find-serious-iphone-vulnerabilities/#7b31cc2d3948 <comment><USER2> What Apple is doing here is really smart. An under-appreciated wrinkle is that grey-market sales are valued on continuous access; you get paid over a period of time, and if the bug you sold dies, you stop getting paid. Apple isn't just bidding against the brokers and IC in lump-sum payments, but also encouraging people to submit bugs early, before they're operationally valuable for bad actors.

<comment><USER3> Is not Apple's move mostly a PR stunt? Standard people will read "The iPhone is so secure that Apple is willing to pays $1M for somebody that find a security vulnerability."

The reality is that they only pay that much for bugs in the kernel that do not require a user interaction.

Other bugs that use a common action on an app that everybody uses, for example opening the stock mail application, may be enough in order to compromise almost all iPhones. Apple seems to pay "only" $100k for those problems.

I just scanned through the comments and clicked on some links so correct me if what I wrote is not accurate.

<comment><USER4> I'd imagine this is to combat marketplaces like zerodium and the deep web. Traditionally grey hat hackers don't always go through bug bounty programs because the pay is awful compared to what you can get through less ethical sources. By flexing that much cash at bug hunters, they are potentially now offering even more than what you could get on the mentioned markets. The only reason people go underground to sell exploits is for the money. Take away that variable and suddenly there's no reason to sell exploits to bad actors, just sell them straight to the source at Apple and get a fat paycheck.

<comment> xkcd-sucks On these marketplaces, how do people demonstrate PoC without giving away the intellectual property? Or is it unproven and completely reputation based

<comment><USER5> Reputation plays a big part in it on both sides. Most buys are not Zerodium and putting themselves out there as buyers. So, there is a certain degree of vouching that happens as someone introduces a buyer to a seller.

So, when either party violates the agreement, it reflects poorly on that person who made the introduction, making it harder for them to make those connections in the future. And, these introductions matters, most sellers don't want to just sell to anyone, there needs to be some trust that who you're selling to will be selling it to friendly governments or whatever. Its not like a craigslist ad where you sell to just anyone who answers.

So that acts as a deterrent on the buyer side. It'll be harder to get new sellers if you have a poor, or no reputation.

On the seller side, you're not going to get too many people willing to vouch for you as you start burning bridges by selling non-working exploits.

And on that, the payment scheme acts as a deterrent, like teh great- grandparent said:

> grey-market sales are valued on continuous access; you get paid over a > period of time, and if the bug you sold dies, you stop getting paid.

That is, you might get XX Thousand upfront, and then an agreed upon XXX thousand based on the exploit surviving XX days.

So trying to scam the buyer will net you a small amount of the total at best, but I mean, often times they'll hold payment until its confirmed and contracts are written and signed over these sales too, its not under the table payments or anything for the most part. Legitimate business transactions.

So, I guess to sum it up, reputation and a demonstrated, or atleast vouched for past record. There is a lot of trust on both sides.

<comment><USER2> What's interesting to me about this --- and I've got no firsthand knowledge of the markets --- is that Apple doesn't have to outbid brokers; a broker could offer 50% more than Apple, but that comes with an X% uncertainty penalty. You can sell to Apple and pocket $1MM, or try to structure a deal for $1.5MM and gamble that the bug will survive. I'm betting that's often not a good deal; the lump sum payment is the better option.

<comment><USER5> I completely agree, it i an enticing offer from Apple for the reason you lay out.

Not all brokers are alike though, exploit survival is a gamble, but sensible end-buyers usually don't want to burn the exploits either so will use them sensibly. There are some brokers that don't sell exclusively (despite their claims), they have a reputation for exploits getting burned early.

I have not been involved with any iOS exploits, not really my area of interest, but lets say I was. Would I consider selling it off to Apple, yeah, it would be something to consider. I'd consider the market rates too of course, 1MM vs 1.5MM, sure Apple is enticing, 1MM vs 2MM, maybe not. Not sure where I would actually draw a line, but you are right that Apple doesn't need to compete directly with the market rate, just close enough.

I'm sure there are those that would rather just go for the bigger profits regardless.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Apple salaries aren't much of a secret, see: levels.fyi.

1M is a lot of money to me, a regular person, but when you consider that top security engineering talent could be making north of 500k in total compensation, 1M suddenly doesn't seem all that impressive.

It's a good bet to make on their risk. Imagine paying a mere 1M to avoid a public fiasco where all of your users get owned.

This just seems like good business. They could make it 5M, and it would still be worth it to them in the medium to long term.

<comment><USER7> I'm surprised by how cheap the vulnerabilities market is. A good exploit, against a popular product like Chrome, selling for 100k or even $1M may sound like a lot, but it's really pennies for any top software firm. And $1M is still a lot for a vulnerability by market prices.

You can do so much damage/return with an exploit that affects > 30% of the population. Get 5 of those and sky is the limit.

<comment><USER8> Out of interest how do you get to know the market price or the market in general for this sort of thing?

If I were to discover a vulnerability is there a legal way I could cash in on it (aside from this case with Apple)?

<comment><USER7> Some stuff on the internet: [https://zerodium.com/program.html](https://zerodium.com/program.html)

Also I heard in person, so I cannot quote.

Not sure how legal this is, but there are even vulnerabilities brokers, who set you up with buyers.

<comment><USER3> Interesting... they do not seem to be interested to processors exploits.

<comment><USER7> Well it doesn't cost much to put it up there (among the list of things they seek), now that we know it's feasible even against big players.

</comment></comment></comment></comment></comment></comment><comment><USER9> >Forbes also revealed on Monday that Apple was to give bug bounty participants "developer devices" \- iPhones that let hackers dive further into iOS. They can, for instance, pause the processor to look at what's happening with data in memory. Krstić confirmed the iOS Security Research Device program would be by application only. It will arrive next year.

I wonder how they're going to manage this. I could easily see some less than ethical researchers applying for this program and selling all the 0 days they find to the usual suspects rather than informing Apple.

<comment><USER10> Isn't the idea of a bug bounty at this scale that the monetary reward (especially combined with the lowered legal risk, but also when considered in isolation) is higher from reporting it to the vendor than from selling it on the black market? I.E. presumably Apple has done their research and one million dollars is more than they believe you'd getting selling a zero day to somebody else.

I don't work in the security field nor am I a business number cruncher, but that was the gist I had of what these programs achieved.

Edit: see Despegar's reply, I should have RTFA! However worth pointing out that there would be some incentive for researchers to go to Apple instead of a third party, which might tip the scales in their favour.

<comment><USER9> From the article:

>Previously, a company called Zerodium was vocal about how much it will pay researchers, before handing them to its unknown government customers. In January, the secretive company announced it was offering $2 million for a remote hack of an iPhone.

So that's already more than what Apple offers. I tend to think they'll always be outbid.

<comment><USER2> I don't know many people here who believe Zerodium's price list, and while I can't speak to Zerodium's payment terms, the norm appears to be tranched payments, apparently ofter over a year; selling the same bug on the grey market for "more" money (whatever it is brokers _actually_ pay) is a gamble that the bug you've sold isn't going to die.

<comment><USER11> With those terms, they can buy a bug, report it to Apple, collect the $1m, and be off the hook to pay out the remaining payments. It seems to me this makes it much riskier to go to the black market than people here realize.

<comment><USER12> Yes, because that is exactly the sort of behavior that a business would engage in. Screwing over their suppliers and demonstrating that they offer no value whatsoever.

How would that make any sense? It is ludicrous.

<comment><USER13> Would be a nice pivot for patent troll companies. In a world where profit is king the question is not why, but when?

<comment><USER2> A nice pivot for patent companies would be somehow generating the connections and reputation to participate as brokers in this super-insular and highly technical marketplace, and then burn all that work down to fuck over an individual researcher for pocket change?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER3> For the naive guy that do not know how the trade of exploits really works and keep hearing of "black markets," do you care to explain in realistic terms how these things work?

Where are the trades happening? Is it the exploiter putting out something like "kernel exploit for iOS xx.x" ? Or the exploiter bids on people offering money? How is the seeker of exploits going to be sure that the exploit is working? How do the people keep their anonimity? And how does the money is exchanged? Crypto currencies? And how was it working before crypto?

Are governments bidding but they also want to convict the exploiter so they get the exploit for free? I remember watching one or two movies where the hacker was caught and was sentenced to jail. Government stepped in and said: "You can either be in jail for n years or work with the good guys for n/2 years" Is it just science fiction?

<comment><USER12> It is not illegal to sell that type of software. It is not a black market, it is a grey market.

There is no way you will ever hear authentic answers to your questions. The only time anyone tried to explain that the resulting article backfired on the interviewee. (Disclaimer, it was me)

Governments do not buy from developers. The paperwork would be insane. They buy from businesses like Raytheon. How Raytheon gets them is opaque. But they do employ hundreds of exploit developers. Read the r/netsec job postings and notice how many require having a TS clearance. Every interesting job that says "work on vulnerability discovery and exploit development" requires TS.

Governments generally speaking do not cheat on business deals where they want to continue having access to that market. It is like stiffing the company that sells you replacement parts for your government vehicles. You save money now, but in the future your planes can't fly and no one will do business with you.

All of this I explained during the interview, but the objective of the article was not what I assumed it would be, which was to address the dynamics of how the market works. I was naive to think that, but in my defense I was genuinely shocked that people were unaware of the market (it has existed forever). Literally everyone who is an infosec rockstar has been involved with exploit sales [0]. Many still are because It allows them to work on what they enjoy — bugs and exploits — and remunerates for their expertise. They get paid a living wage to do what they want. Like any freelance developer. They are just smart enough to keep their mouths shut.

I haven't been involved with the market for almost a decade now but you'll still hear people saying shit like "how does it feel to sell weapons to dictators??" (Even On here there are a number of such comments.) I can truthfully answer that I have no idea. I only ever sold software to western governments who had a hard on for terrorists.

I'm still angry about it, but I have no one but myself to blame. You can't unfuck the goat. C'est la vie. People want sensational stories about evil people, they don't want stories about the dynamics of a grey market software industry. No one will ever speak about it again (lessons learned analysis! Protip, don't be the lesson others learn from).

The market has changed massively over the years. It is nothing like the one I was involved in back then. However, as I said, no one will ever discuss it again. They saw what happened and they won't speak in public about it.

What was, is, and will continue to be, the legitimate sale of vulnerabilities is now closed forever.

As a thought experiment, think of this. Let's take it for granted that the IC counter terrorist units and the legal authorities hunting for child abusers are acting in good faith. That is, not every single person at NSA is desperate to see what you are doing on the Internet (literally, you are noise obscuring their signal). There are people who are going after child sex abusers, do you want them to have the capability to exploit a web browser or do you want web browsers to be safe tools for child abusers. This is not hypothetical [1].

There cannot be a discussion about a market where there is so much hysteria about fringe cases of abuse. Rather than trying to find ways of mitigating against abuse, the reaction has been to advocate for prohibition. Prohibition does not work, it simply drives reputable operators out of the market.

The conversation about vulnerability sales has been as even handed and rational as the conversation about marijuana in the 50s. Instead of marijuana madness you get "the FBI can hack your computer!!" ...I guess the upside is that at least this time the topic is not a proxy for racism [edit: I retract that statement. Pretty much every rationalization about banning vulnerability sales talks about African or Arabian buyers.]

And again, I have said too much. Try to explain something, get called a baby killer. I'll bet there will be accusations of enabling dictators to spy on civil rights activists. To preempt the "you don't know what happens after you sell it!" I say simply this — the point of having a middleman to handle the transaction is to ensure that you sell to the right end users. Exploit developers don't want to sell to dictators, they find someone who can get them access to a market where their work will be used ethically. That can't be said for all, of course. The jailbreak community in particular is essentially a vendor to the Chinese government.

But there you go. The most you'll hear about it from someone that actually knows what they're talking about.

[edit: haha, see? It was brought up before I even posted a response! [2] There is no accurate information. Literally every single paper on the topic cites newspaper articles rather than academic research. This is actually unique. It is the outlier case. Mara did a review of the literature and found that the majority of citations were to articles, far in excess of other topics)

[0] [https://www.econinfosec.org/archive/weis2007/papers/29.pdf](https://www.econinfosec.org/archive/weis2007/papers/29.pdf) [PDF] — a paper from Charlie Miller talking about how difficult it was for him to sell exploits without a trusted third party to act as an impartial party to the sale. That TTP is called an "exploit broker" because that sounds far scarier than "trusted third party." Incidentally, this is the environment I was operating in, and it was clear that no one involved in security considered it abnormal.

[1]: [https://www.wired.com/2014/01/tormail/](https://www.wired.com/2014/01/tormail/) ... look at the framing of the article. It is not "FBI screws up their operation and mistakenly collects data that is irrelevant to their investigation." It is "if you used this secure email provider [hosted on the same infrastructure as a massive child sex abuse web site] the FBI has _your_ inbox!!!!"

[2] [https://news.ycombinator.com/item?id=20651348](https://news.ycombinator.com/item?id=20651348) .. feel free to read the article and think what you like. Andy Greenberg is a good journalist. I was an idiot. ¯\\_(ツ)_/¯

<comment><USER3> > What was, is, and will continue to be, the legitimate sale of > vulnerabilities is now closed forever.

So in past, present and future, the legitimate sale of vulnerabilities is now closed forever. When was legitimate?

Are you saying that since it is not legit, exploits should never be sold? What are you advocating for ?

<comment><USER14> I think (though I can't be sure), what they're trying to say is that it's still legitimate, but it's opaque, because nobody wants to talk about it. Because of that, it seems, to outsiders, like it's an evil black market, even though many people involved in it, believe that they're doing the right thing.

<comment><USER12> Exactly so.

</comment></comment></comment></comment></comment><comment><USER15> OT, but if you have showdead on, you can see beeschlenker's weird comment. It seems that he hears "things" in his own security cameras, and also thinks he is in a "Truman show" setup. Just a heads up if someone in the area could possibly help him.

[https://www.gofundme.com/f/to-keep-brian-schlenker- alive](https://www.gofundme.com/f/to-keep-brian-schlenker-alive)

<comment><USER16> Can you contact gofundme. He probably needs help and some of these larger companies have ways of informing local authorities if someone is at risk of harming themselves or others.

<comment><USER15> I sent a report to GoFund.

</comment></comment></comment><comment><USER17> This is great. Every company should be responsible for paying market price for security vulnerabilities in their own products. If you make something that carries significant market value, you should be paying the security tax in the form of a security team or bug bounties.

<comment><USER18> So who will be responsible for all the open source software security vulnerabilities?

<comment><USER19> End users. Integrators. Developers in terms of reputation. Thanks to disclaimers not at all too different from closed source software.

</comment></comment></comment><comment><USER20> Does anyone know if these types of bug bounties are negotiable?

As several people have mentioned, hackers can sell to the highest bidder and having proof that you have an exploit is probably sufficient, but what if Apple was willing to pay as much as the highest bidder?

This may also likely convince people who have sold bugs to reach out to Apple.

It probably costs them a fraction of the PR spend or risk of data breach/user exposure etc.

<comment><USER21> The press release specifies that the $1000000 quoted figures are minimum payments for the given category of bug, so the actual amount paid could be anywhere upwards from that.

</comment></comment><comment><USER22> How feasible would it be to find bugs in the iPhone kernel's network stack? I imagine this is pretty battle-tested stuff, but it would tick all the boxes for remote and no interaction.

Edit: Since it's XNU, and it's open-source, and it's been around for a really long time, this seems unlikely. But if something was found in here, for instance, everything would be practically compromised: [https://github.com/apple/darwin- xnu/blob/master/bsd/netinet/...](https://github.com/apple/darwin- xnu/blob/master/bsd/netinet/ip_input.c)

<comment><USER23> Here's one in the Multipath TCP component: [https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2018-4241](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2018-4241). I don't think this is remotely exploitable, though.

</comment></comment><comment><USER24> Why aren't Apple worried that this'll incentivise employees to leak insider information to grey-hackers who'll share a cut of the reward?

<comment><USER25> I'm not sure how that would work. Apple isn't just sitting on exploits.

</comment></comment><comment><USER26> I think it's a cheap offer. If you are a professional well introduced in the business of selling 0days, for a gem like that, you can charge even a single customer of the same amount. Indeed there are private companies offering even more ([https://www.securityweek.com/zerodium-offers-2-million- ios-h...](https://www.securityweek.com/zerodium-offers-2-million-ios- hacks-1-million-chat-app-exploits) )! Ok, companies involved in this business have some "safeguard" clauses in case the hole is discovered too soon (see for example the Hacking Team e-mails), but you can sell this kind of vulnerability practically to everyone. So the offer IMHO is a public relation move.

</comment><comment><USER12> Unregulated markets are not black markets. They are grey markets.

</comment><comment><USER27> This is fantastic news from Apple! I use an iPhone and I can sleep a little better at night knowing that someone would now have to risk burning a $1Million exploit if they wanted to hack me! I'm not worth near that much yet so I'm probably not worth spending $1M on.

I remember the days of jailbreak-me.org when you could just visit that website, your iDevice would be rooted, and Cydia would be installed on your iDevice. You could install all sorts of tweaks, mods, and apps through Cydia. I remember installing a Pandora tweak that gave unlimited skips, gave it a black theme, and removed ads (because I was a poor student) and got freaked out because if tweaks could modify apps like that, then they could probably phish banking passwords. Anyone else remember those days?

</comment><comment><USER28> This is an area that's always been fascinating to me, but that I've never dived into. I'm not overly interested in this particular program, just exploits in general and perhaps examples of how and why they work. Anyone have any resources that they've found useful?

<comment><USER29> There's a ton of info out there in various websites and blogs. I like the RPISEC Modern Binary Exploitation class as a great introduction. The lectures and materials (and a VM!) are on github: [https://github.com/RPISEC/MBE](https://github.com/RPISEC/MBE)

<comment><USER30> This is awesome. Thanks for the resource.

</comment></comment></comment><comment><USER31> 1 million vs one or two sellings for 1.5m hmmm...

I think Apple could do better and has the resources to do so. Why not incentivize enough so the people that profit from this kind of business don't even have to ponder the decision?

</comment><comment><USER32> Given I know "stuff" but compared to anybody who really "knows" I am a noob in exploit engineering. I just know basic inner workings of a computer and a little reverse engineering.

Would it even make sense for me to try? It seems like the probability I find something, especially without user interaction, seems so far off that it would be hard for me to find a constant motivation.

Imagine one year where I dedicate two days a week learning, understanding and trying. Do I would have any chance at all to find something worth the $1M?

Thank you!

<comment><USER33> > Imagine one year where I dedicate two days a week learning, understanding > and trying. Do I would have any chance at all to find something worth the > $1M?

Yes...but probably not the way you're thinking.

Most issues are discovered these days through fuzzing first. So there is always a chance your fuzzer will find an issue worth $1M, its much less likely that you'll realize its worth or be able to demonstrate and begin to weaponize the exploit to prove its worth.

Lets rephrase the question a little bit though:

Instead of "Do I would have any chance at all to find something worth the $1M?" lets ask "Would I have any chance of learning this level of exploit development"

Two days a week, lets just round to 50 weeks a year, give you a bit of a break during the year and say 100 days of effort.

So, in a 100 days would you have any chance of reaching the level of being able to atleast write an iOS exploit, ignoring the discovery aspect? Unfortunately, the answer is still no.

But, you would make some serious progress!

A modern iOS zero-click exploit isn't just one issue, in a worst-case (okay there are worse than this, but this is a poor case) scenario you might need the following issues

\- Memory Leak + Entry Point service exploit \- Sandbox Escape to low priv user \- Privilege escalation to higher priv user \- Kernel memory leak + Kernel exploit to finally get root privs

This even for someone with experience, going from fuzz result to exploit can take months. So in a 100 days of spread out effort, you won't be doing that, but you might be able to begin approach that first stage, a memory leak and an exploit in a user-land service.

I do only say might because 100 days is a really short time when you think about how technical your knowledge of this stuff needs to be, but I'd like to think that with some real determination, in 100 days at least foundations of modern software exploits should be approachable.

As for would it make sense for you to even try, the best time to start was 20 years ago, its been getting increasingly more difficult. The longer you wait the higher the barrier to entry gets.

</comment></comment><comment><USER34> Given the "kernel" requirement coupled with the design of these devices in general, any real non-interactive RCE will be claimed to not be "in the kernel"... it was a Qualcomm or ARM binary blob not the kernel!, It was the Baseband firmware not the kernel! It was libXYZ not the kernel! etc.

</comment><comment><USER35> Can she claim it: [https://googleprojectzero.blogspot.com/2019/08/the-fully- rem...](https://googleprojectzero.blogspot.com/2019/08/the-fully-remote- attack-surface-of.html) ?

<comment><USER36> From the article:

      > The full $1 million will go to researchers who can find a
      > hack of the kernel—the core of iOS—with zero clicks required
      > by the iPhone owner.

Which one of the vulnerabilities discovered met that criteria?

<comment><USER37> She has a list at [https://twitter.com/natashenka/status/1155940732084973568](https://twitter.com/natashenka/status/1155940732084973568) (recall that "remote, interaction-less" means "do not require any physical interaction from the target to be exploited, and work in real time", according to the Project Zero blog post).

Edit: As the posters below said, those aren't kernel bugs. Thanks for the correction!

<comment><USER36> I do not believe a springboard crash counts as a hack of the kernel.

</comment></comment></comment></comment><comment><USER38> Didn't Google just publish an article where their researchers pwned iPhone 10 different ways? Now granted, those bugs are all patched now, but who's to say they were the last ones?

</comment><comment><USER39> Good news, but Zerodium is paying $2M (and probably $3M from tomorrow)

</comment><comment><USER40> I'd like to see what what prevents double dipping, first report to unethical places, wait a bit, then report to Apple.

<comment><USER41> I think that's why the amount is so high. If you sell it for less to bad guys, someone else might find the same exploit (or a connected one) and swoop in and claim the big amount from Apple, and you lose out.

</comment></comment><comment><USER42> NSO Group monetises iPhone vulnerabilities for a lot more than a million dollars.

</comment><comment><USER43> So, the goverments will have to pay the hackers more, right?

</comment><comment><USER44> Hasn't NSA already got that title?

</comment><comment><USER45> *$1M reward for highest vulnerability

</comment><comment><USER46> Will this be the end of rooted iPhones?

<comment><USER23> This looks to _be_ a rooted iPhone.

<comment><USER46> Yes, but immediately patched by Apple. It seems to me that in the future you simply can't own a rooted iPhone, because Apple put a $1M bounty on making that impossible.

(If you don't see where this is going: after a while all the security holes will be patched, and thus no more rooted iPhones.)

</comment></comment></comment><comment><USER47> what does IC stand for??

<comment><USER48> Intelligence Community

<comment><USER47> Thanks man, appreciated it. Now i can read the comments here with some context

</comment></comment></comment><comment><USER49> not true false pr, they do this when there is a mass shooting to show there phones are secure. ive contacted apple many times on hacks. mo response. iphones are hackable i can show you

</comment><comment><USER50> Love the push Apple is doing for privacy.

</comment><comment><USER51> How about $1M for a working keyboard on a Macbook?

</comment><comment><USER52> Just noting:

This isn't nearly enough money to stop North Korea, Israel, Russia, US, UK, France etc. Pretty sure a zero-day would be 10-100x more valuable to them than this $1 million reward. (Why is this even controversial?)

<comment><USER53> Cool... Go negotiate with one of those entities if you have a death wish. I'd rather hand over to Apple, make a name for myself and get clean cash then deal with the underbelly of the modern world.

</comment></comment><comment><USER54> "The full $1 million will go to researchers who can find a hack of the kernel—the core of iOS—with zero clicks required by the iPhone owner. Another $500,000 will be given to those who can find a "network attack requiring no user interaction." Ehhh, whats the point in this exactly? Apple only considers bugs to be significant if the penetration can happen without help from the end user? Thats not how this works in the real world Apple.

<comment><USER55> Nothing wrong with this in itself. A zero-interaction attack - like being able to get root on everyone who even walks past your WiFi hotstop with their phone switched on, even if it's in their pocket not being used - IS more valuable than one that requires user interaction, and it's quite right for rewards to reflect that with higher rewards.

</comment></comment><comment><USER56> Soon apple will be paying $1M to anyone who can work out how to change the battery.

</comment><comment><USER57> Is this a marketing strategy aka [https://en.wikipedia.org/wiki/Streisand_effect](https://en.wikipedia.org/wiki/Streisand_effect) to counter Android [https://www.bloomberg.com/graphics/2019-android-global- smart...](https://www.bloomberg.com/graphics/2019-android-global-smartphone- growth/) or [https://en.wikipedia.org/wiki/Illusory_superiority](https://en.wikipedia.org/wiki/Illusory_superiority)

</comment><comment><USER58> "Another $500,000 will be given to those who can find a "network attack requiring no user interaction.""

The implication of this conditional reward is that interactive use presents more/easier attack opportunities than non-interactive use. To clarify terminology, it is arguable that "non-interactive" can be a synonym for "automated" in this context.

Further, we might argue that canonical examples of "interactive" use are clicks, drags, taps or swipes. In other words, the prevailing "UI" for many users and the one promoted by many developers.

Now, if you agree these are fair statements then it is also arguable that from the user's persepctive it could be useful to engage in non- interactive/automated use not only for reasons of efficiency or convenience but also for reasons of "security".

Finally, given these propositions, the question I ask is why website and app users are continually faced with "terms and conditions" that seek to prohibit non-interactive use. Interactive use benefits those running a website or app server in at least one obvious and significant way: _more interaction means more data to collect_. But if we accept the implication of this bug bounty it also means greater risk to the user.

Regulators need to protect the user's right to use her computer, including a "smartphone", in a non-interactive manner. This right is constantly under attack (no pun intended) by those who are in the business of collecting user data. Interactive use can result in less data privacy and more/easier attack opportunities.

<comment><USER59> This seems backwards.... they are offering more money for attacks that don't require user interaction because they are HARDER, not easier, to accomplish.

<comment><USER60> Exactly. I seem to remember an app a while back that was billed as a heartbeat reader and it would have you repeatedly press and release the fingerprint sensor. After a delay it would flash some sort of in-app purchase authorization. Pwnage that relies on some sort of user interaction is worth 50% less, and rightly so.</comment></comment></comment>


Using Go at The New York Times [video] - <AUTHOR> https://www.youtube.com/watch?v=bAQ9ShmXYLY <comment><USER2> Slides: [https://speakerdeck.com/nytdevs/using-go-at-the-new-york- tim...](https://speakerdeck.com/nytdevs/using-go-at-the-new-york-times)

</comment><comment><USER3> Sometimes I really wonder if the choice of the language is just a way to filter out 'boring' engineers. It doesn't seem like they particularly needed to use Go, but look at the attention it gets them for being 'cutting edge'.

<comment><USER4> Could you elaborate on what you mean by "boring engineers"?

<comment><USER5> The ones who actually know their history and consequently, when they hear "NoSQL," they think of IBM's IMS and run as fast as they can in the opposite direction.

</comment></comment></comment><comment><USER6> Are Go servers at New York Times or other companies impacted by the Golang GC pause? I am learning Golang and want to know if Golang GC pause is a significant issue in production.

<comment><USER7> We're doing RTB with Google DoubleClick AdX, and our bidder (written in Go) can easily handle 4000 QPS per server with only a 0.3 % error rate.

<comment><USER6> Is 0.3% error rate caused by GC pause?

<comment><USER7> From what we can tell, yes. But, according to our Google contacts, we're among the top performers, most parties taking part in RTB perform a lot worse.

</comment></comment></comment></comment><comment><USER8> It's a relief to see post-redesign diagrams. But at the same time I have tiny 'bus factor' fear by relying on a single language, is it (that) absurd ?

</comment><comment><USER9> Can we change the title to "Golang"?</comment>


UTorrent / BitTorrent Sued For Patent Infringement - <AUTHOR> http://torrentfreak.com/utorrent-bittorrent-sued-for-patent-infringement-110619/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Torrentfreak+%28Torrentfreak%29 <comment><USER2> It is not possible to write any software without infringing one or more software patents. This is getting truly absurd.

<comment><USER3> Not only that, but it's ironically in your best interest not to even read others' patents lest you be subject to treble damages. So the original purpose of the patent system (trading temporarily monopoly for disclosure) seems almost moot.

</comment></comment><comment><USER4> One more reason why the patent system is severely abused. Whoever is behind this probably looked specifically for something they can use against BitTorrent in the patent database.

This reminds me why you should never trust politicians when they say about a new bill: "Oh, but the law is not intended to be used like that", but then don't specifically add in the bill how it can and can't be used, and prefer it leave it more generic.

It's something they said about the new streaming bill that can criminalize lone bloggers the put embedded Youtube videos that violate copyright on their sites.

</comment><comment><USER5> Now I may be missing a crucial bit of information, but I never got it why one wouldn't rather create a company and/or host the web site servers in some country with less ridiculous patent laws... Just move the servers to Sweden, problem solved. Now, I'm not sure what would happen to the U.S. developers that would contribute infringing code, so to make them safe, you would simply need to erase the records of who contributed what, or keep a system of anonymous nicknames...

<comment><USER6> In short - you violate a patent if you use, sell or offer to sell something that violates the patent.

So if you moved the company abroad (or were a non US entity in the first place) then you're fine, providing you never wanted to sell to US customers.

The issue is that in reality, few companies (wherever they are domiciled) want to exclude themselves from the US market place. Which despite being not that big in terms of people (Europe, China, India, SE Asia are individually all bigger) it is hugely significant in terms of advertising spend, technology adoption, and funding.

<comment><USER7> This is what I expect will finally bring some sanity to the American system. After the Americans have the door slammed in their face on a few must-have new technologies because they've become an "intellectual property" banana republic, the public might start thinking about demanding some change.

</comment></comment></comment><comment><USER8> I wouldn't be surprised at all if this "Tranz-Send Broadcasting Network" would turn out to be owned by a number of holding companies eventually leading to MAFIAA. Maybe they just bought a company with a remotely applicable generic patent merely to attack BitTorrent. It would fit in the style and civility of actions they've exhibited in the last decade.

</comment><comment><USER9> It's so generic, it pretty much describes every protocol out there which streams media on a network: 1) Flash players - check 2) HTTP streaming on ios using m3u8 files - check .. ..

</comment><comment><USER10> I'm sure Adobe will be happy to hear about this patent as well. It pretty much describes adaptive encoding in media streaming applications... and it is ridiculously generic.

<comment><USER11> Where in the claims did you see adaptive encoding? It seems to be describing any sort of load balancing of media servers based on network throughput to the client. Do bit-torrent clients do that? Or do they just throttle their own response to a peer based on the p2p throughput? In any case claim 1 is overly broad and is obvious. I hope someone digs up prior art and gets it invalidated.

<comment><USER12> IANAL, and (especially) IANA[Patent]Lawyer, but, BitTorrent is such a precise design, I imagine all they would have to do is file a patent for the more specific nature of their work, much like how the mp3 format is patented.

That said, .... wow @ that patent.

</comment></comment></comment><comment><USER3> This isn't a bad time to catch up on the patent-related bills being circulated in Congress:

<http://en.wikipedia.org/wiki/America_Invents_Act>

<http://news.ycombinator.com/item?id=2288359>

I'd be interested to know how the proposed legislation might affect, if at all, this particular case.

</comment><comment><USER13> Doesn't the internet then violate this patent?

</comment><comment><USER14> This is only for the transfer of media files. Isn't it up to the end-user to decide what type of files to transfer?

Would this apply to seeding or downloading an open source OS?

</comment><comment><USER15> Damn patents again. How can a p2p network infringe on a server-client patent? In addition, uTorrent is free, how could it cause any financial losses?

<comment><USER16> You could argue that offering a competing product for free is "anti- competitive" behaviour.

Then again, looking at the Wikipedia page for anti-competitive practices, it ironically includes:

"Patent misuse and copyright misuse, such as fraudulently obtaining a patent, copyright, or other form of intellectual property; or using such legal devices to gain advantage in an unrelated market."

<http://en.wikipedia.org/wiki/Anti-competitive_practices>

</comment></comment><comment><USER17> Why would this change anything?

Most people using Bittorrent are already violating copyright law. Why should they care about patent law?

<comment><USER18> Where does this "statistic" come from? What is the basis of your accusation? Do your "facts" include the tens of millions of people that use bittorrent technology for legitimate uses? There are dozens of legal torrent sites, software/OS distros, and even World of Warcraft that use the technology legitimately, you know.

<comment><USER17> Are you really trying to tell me that you don't believe that the majority of BitTorrent traffic is pirated material? (I nver said all)

<comment><USER19> Two points which render this claim moot:

1\. The decision on whether a piece of technology is legal is not based on its majority use, but on whether there are substantial non-infringing uses. (first Google result, didn't follow link: [http://www.justice.gov/criminal/cybercrime/ipmanual/05ipma.h...](http://www.justice.gov/criminal/cybercrime/ipmanual/05ipma.html) "Indeed, it need merely be capable of substantial noninfringing uses.")

2\. The vast majority of freeway traffic is in excess of the posted speed limit. You don't hear many arguments to shut down the freeways as a result. [Yes, I know proof by analogy is weak.]</comment></comment></comment></comment>


Tracking the S&P 500 using ETFs holdings - <AUTHOR> https://claisne.io/tracking-sp <comment><USER2> Misleading title. The author is just web scraping ETF holdings and running some analysis on it. ETFs are required to publish daily holdings, so there's no secret there.

The best way to track the sp500 is with an ETF.

Interesting subjects would be figuring out proxy baskets using, let's say 100 components of the sp500 or sector SPDRs to track the sp500.</comment>


DHS to start DNA testing to establish family relationships on the border - <AUTHOR> https://www.cnn.com/2019/04/30/politics/homeland-security-dna-testing-immigration/index.html <comment><USER2> Those who do genetic testing in the clinic know that, far more frequently than expected, family relations do not line up exactly as the genetic inheritance happens. Clinicians go to great lengths to avoid damaging families with these revelations. I have a feeling that such ethics will not be brought to these situations by DHS.

<comment><USER3> this has nothing to do with being correct.

there's a rush by law enforcement to create a DNA database.

and if you did at a clinic or 23and me et al, be sure that your dna plus some metadata (if not from you, from your payment or from the lab, anything that goes around hippa is game) is already cataloged there.

couple months ago a newspaper shown how cheap private investigators paid for this data to narrow down location of people they were paid to locate.

<comment><USER4> > there's a rush by law enforcement to create a DNA database. True, But this > has nothing to do with that (at least at this point). TFA specifically > stated that no data would be retained, they are just looking for results in > 90 minutes, evidently to verify if someone claims parenthood of a child, > they really are the parent.

If it is actually used to make human trafficing more difficult, it is a good thing.

(Don't ask me whether I trust this administration to do anything good, for the right reasons, within reasonable bounds, with proper controls, or merely act with sanity and respect -- that is a whole other conversation likely unsuitable for this forum)

<comment><USER5> "If <policy> makes <bad thing> harder, it is a good thing" is the wax on the runners of the sled flying down the slippery slope.

It's fallacious to frame handing more power to centralizing entities solely in terms of the good they may (possibly) do. There are always downsides, even in addition to direct misuse - eg 1000 lifetimes lost every year to the TSA alone.

It's always a trade off, and politics (aka willful ignorance) practically guarantees it won't be made for the right reasons.

<comment><USER4> True.

Which is why I put the disclaimers in the last two paragraphs ("If it is actually used" and "Don't ... trust this administration...")

The restricting scope, application purpose, and effective oversight are the anchor points and crampons that enable us to not slide down the slippery slope, but get to the top.

</comment></comment></comment></comment></comment><comment><USER6> Because I guess adoptions, or family relationships a little more complicated than the nuclear family don't exist.

</comment><comment><USER7> > From October 2017 to February 2018, there was a 315 percent increase in the > number of cases of adults with minors fraudulently posing as "family units" > to gain entry.

Gotta wonder what that comes out to as a percentage of all people trying to gain entry.

The statement also implies that DHS is already determining what is a "family unit" without DNA. Gotta wonder what their algorithm is there too...

<comment><USER8> Separate 'parents' from children, ask children if those are really their parents?

</comment></comment><comment><USER9> So no children from prior relationships, no adoptions, no same sex couples, ...

</comment><comment><USER10> What will happen to adopted children?

<comment><USER11> Hopefully their guardians won't cross the border illegally and put them in that situation.

<comment><USER9> The comment you replied to is asking "what happens to adopted children". Strangely enough crossing the border legally doesn't magically result in your adopted children getting new DNA. So claiming that "illegal immigrants" won't put their children in that position is beyond stupid. The question is how does this impact _legal_ immigrants.

This is sampling at actual border crossing. So all the actual families crossing are victimized in order to punish brown people. Because none of this is being done on the northern border, despite Canadians living illegally in the US generally taking higher paying jobs than migrant workers from Mexico and Central America

<comment><USER11> From the article: "DHS has repeatedly warned that children are being exploited by traffickers to skirt the nation's immigration laws."

So it seems to me that it has to do with people skirting the law and exploiting children, not to "punish brown people".

> Because none of this is being done on the northern border, despite Canadians > living illegally in the US generally taking higher paying jobs than migrant > workers from Mexico and Central America.

Have stats on the number of Candadian's crossing the border illegally each year? I'd bet its an order of magnitude less than our southern border.

> And then we get to the real crux: as numerous people have said, this > incorrectly classifies normal families as not being families.

Which is a problem, but this should be used as a tool in conjunction with other records and interviews of the family crossing.

Think of it this way, if a family crosses with children, takes the DNA test and everything is confirmed then the process may go much faster as additional investigation would not be needed.

</comment></comment></comment></comment><comment> xkcd-sucks A vacation to the USA could get French people around the paternity test ban

</comment><comment><USER12> Living in a cyberpunk dystopia is much less pleasant than reading about fictional ones.

</comment><comment><USER13> What CNN conveniently didn't tell you was that this kind of screening was all planned under the Obama administration. It's so convenient to post a picture of Trump at the top of the article to suggest it was all his idea.

Fuck CNN, it is a shitty fake news site.

Why is this even news since it started under the Obama administration?

Center for Immigration Studies article below.

[https://cis.org/Rush/Expanded-Central-American-Refugee- Progr...](https://cis.org/Rush/Expanded-Central-American-Refugee-Program- Bring-Whole-Family)

>The program's numerous conditions ( __DNA tests __, background checks, medical clearance, etc.) dissuaded some from applying. More importantly, the majority of the Salvadoran, Guatemalan, and Honduran immigrants present in the U.S. are here illegally, which makes them ineligible to participate. This explains why, since the CAM program started almost three years ago, the U.S. received only 9,500 applications.

Some more news with statistics.

[https://www.cbp.gov/newsroom/stats/sw-border- migration](https://www.cbp.gov/newsroom/stats/sw-border-migration)

<comment><USER14> Reading your links, I couldn't find any numbers for how many children were DNA tested while Obama was in office? How many was it? or did this launch under the Trump administration?

I'm unclear about what's "fake news"

that dna testing children is bad? From your comment, it sounds like you think Obama is infallible, and so anything he did must have been the best, most moral option possible.

or that the blame should be on Obama? but that doesn't make sense, because Trump held all the branches of government for 2 years, and didn't rescind this, when most of his presidency has been about undoing everything Obama did.</comment></comment>


Cash not always welcome at Apple stores - <AUTHOR> http://abclocal.go.com/kgo/story?section=news/7_on_your_side&id=7447037&rss=rss-kgo-article-7447037

<comment><USER2> So you can have a Theft policy that says don't pursue or prosecute but you can't pay for one in cash? That seems crazy. Of course using an ipad as your only computer is probably not a good idea either.

<comment><USER3> > Of course using an ipad as _my_ only computer is probably not a good idea > either.

Fixed that for you.

 _This user_ is precisely who the iPad was made for and she can't get one because of heavy handed anti-piracy policies.</comment></comment>


Accepting Payments with Stripe, Vue.js, and Flask - <AUTHOR> https://testdriven.io/accepting-payments-with-stripe-vuejs-and-flask#.Wx5x0wvNEnE.hackernews <comment><USER2> Great! I always wanted a subscription management tool which let's me add bitcoin, manual payments and stripe/paypal.

Surprisingly, there aren't any options for that.</comment>


Show HN: a tool for app store seo/marketing - <AUTHOR>

Hi, I premiered today, a tool for promoting iPhone apps.
- App Store SEO - Competitor Tracking - Promo code dispensing
You can get an overview of the app here: http://www.slideshare.net/kolinko/appcodes-app-store-marketing-toolbox-11535165
It still looks ugly, but hopefully it works :)
Aand.. if you use a promo code «Chopin», you'll get a free month :)
Feedback?
The address: http://appcod.es . <comment><AUTHOR> This is my first paid webapp, so I'd appreciate especially feedback about the sales process, and the generic app usability.

</comment><comment><USER2> Out of curiosity, how are you getting all of the content from the App Store?

</comment><comment><USER3> Would like to test it out -- do you have a free trial?

<comment><AUTHOR> Use a code "Cheap" for first month for $1.</comment></comment>


Silicon Valley tech bubble is larger than it was in 2000, and the end is coming - <AUTHOR> https://www.cnbc.com/2018/05/22/tech-bubble-is-larger-than-in-2000-and-the-end-is-coming.html <comment><USER2> I'm happy as the next person to eye roll a lot of the stuff that gets funded but the world is just fundamentally different compared to 2000. The average time an internet user spent online at home was ~3 hours in 2000 and is about 18 now.[0] People are just so much more willing, and able, to spend time and money online now days I would be surprised if there was 2000 style crash.

[0][http://www.digitalcenter.org/wp- content/uploads/2013/10/2017...](http://www.digitalcenter.org/wp- content/uploads/2013/10/2017-Digital-Future-Report.pdf)

<comment><USER3> Crashes are a phenomenon of investor mass hysteria I don't think they are correlated with metrics of the companies they have invested in. When enough people belive they have been throwing money at a hype, panic will ensue and a crash will happen.

<comment><USER4> I don't think it will effect the industry nearly as much as it did in the past. Tech is simply more integrated into society now, the fundamental thesis is proven in a way that it wasn't in the 2000s. Its akin to the early days of TV when it was a luxury to the 70s-00s where it was where the average american spent most of their free time (and note that its dominance has been supplanted by the internet).

</comment></comment></comment><comment><USER5> Depends on the company. Google has a forward P/E of 24 and last quarter grew 26% yoy.

That is anything but expensive.

<comment><USER6> And they are producing what exactly? "Better ads"?

Google's contribution to society (if I may be bold) are products that they are not selling directly - search, maps, and gmail. Maps and gmail are replaceable, search is not yet. Their influence on how we are consuming information is nothing short of amazing and incredible, and it has long- lasting effect on all levels of current (western?) life.

But... is it something "sellable" to a consumer? Not as third eye to a big organizations/governments, or tensor-something-analytics to a research tank, but something to an everyday Joe and Marta?

<comment><USER7> Are you trying to argue that google products are not profitable?

<comment><USER6> No, that's not what I am saying.

Profitable today != profitable tomorrow. They have "the power" now, I am not sure they will have the same endless income tomorrow. I am of the opinion that unless you sell something to a wider public, you will exhaust that niche supply chain eventually [1]. This will first limit, and then end an expansion sooner or later, and since niches tend to collapse more often than wast "general public", and you run out of income. How soon that will happen, and in what form will it ends is a totally different question. BTW, becoming evil is one sad, but valid outcome.

[1] Of course unless you make this "niche" bigger through different means, be that by making product more accessible for wider audience, or making changes that your product becomes a "must have" in societal terms, thus growing the audience instead of your specialization niche.

<comment><USER5> Just Waymo will likely be more valuable down the road than all of Google today. Just all their AI stuff even more so. SDC is just one application. A big one but just one.

Self driving vehicles is over a trillion a year opportunity.

But the benefits to people is so much bigger. Less traffic deaths. Make it possible for people to get to places that could not before.

A big one is drunk driving could become a think of the pass.

</comment></comment></comment></comment></comment><comment><USER8> "Dropbox also went public. It had a first-day pop of 36 percent; however, with only 200,000 paying customers compared to its 500 million users, I would be hesitant to rush in to buy, even as it comes off that year-to-date high considerably."

Um, really? I think the number is closer to 11M.

</comment><comment><USER9> Don't immanentize the eschaton, bro.

<comment><USER10> > eschaton

> n. last thing; used in theology to refer to the climax of history, > culminating in the Last Judgement.

<comment><USER11> [https://en.wikipedia.org/wiki/Immanentize_the_eschaton](https://en.wikipedia.org/wiki/Immanentize_the_eschaton)

</comment></comment></comment><comment><USER12> It's amusing that the image attached to the article is of a company neither in Silicon Valley, nor in tech.

<comment><USER13> All companies are tech companies now. Didn't you know?</comment></comment>


Ask HN: What Kinds of Comments Should Be Upvoted? - <AUTHOR>

We continue to see metadiscussion about comments and voting rules here on HN. Let's emphasize the positive by discussing what kinds of comments deserve upvotes as positive contributions to the community. Here are some suggestions:
1) Comments that link out to research sources to verify disputed facts, or that cite sources that aren't posted on the Web.
2) Comments that ask for sources to back up statements made in previous comments, which ask for comments in category 1.
3) Comments that respond to name-calling or ad hominem comments of the kind identified in pg's article "How to Disagree" by refuting the central point politely and thoughtfully, and not being drawn into the same tone as more argumentative and less informative comments (in other words, comments that raise the tone of a thread).
What other kinds of comments do you think should generally be upvoted? What kinds of comments are unexpected, pleasant surprises in how they contribute to the community? <comment><USER2> Comments which you disagree with, are factually wrong, or are refuting your point, provided they are relevant to the discussion. My reasoning here is that these types of comments provide discussion points, which is why this sort of linksite exists. upvote == agreement can lead to boring groupthink, instead of interesting and informative communities.

</comment><comment><USER3> Comments that set a positive example for how to discuss things without necessarily agreeing. Most online disagreements get pretty acrimonious, which isn't really necessary.</comment>


Ask HN: Node vs. .NET Core - <AUTHOR> For a medium-size web SaaS project with a roughly equal mix of computation and IO demands, which of these would you recommend?
A bit of my background as it relates to the question: I was an MS Web Stack guy for years and years, but I have spent the last few years getting a solid grasp of Node, and I use ES6 and a lot of third-party and custom npm packages and tool-chains. So I have a basic understanding of the pros and cons of the two platforms.
However, .NET core seems to be a game changer, and I wonder of anyone with relevant experience can help me update my understanding of the relative strengths and weakness of the platforms <comment><USER2> .NET core, no question. NodeJS ecosystem is brittle. Yes there are a lot of libraries ... mostly unmaintained and low quality. Quantity isn't quality. .NET core is moving extremely fast and is backed by Microsoft. There is no debate here. And frankly , do you really want to use a language that is as weakly typed as Javascript to write mission critical code ? That's madness. The JS ecosystem is nowhere near .NET's. And C# is way more enjoyable as you can benefit from static typing and way less verbose than Java.

EDIT: A great thing is that you can directly interact with .NET core maintainers, which is definitely a plus. They are paid to write the framework so they are doing this fulltime, unlike people who maintain this or that nodejs library. Just look at the state of Express for instance... it's just rotting since TJ abandoned ship. no, NodeJS ecosystem is definitely a mess.

<comment><USER3> I'm a .NET developer, but I think you're missing the point.

JS, while having a (huge) amount of issues documented to death on HN, also has a huge momentum and community behind it.

It's going to take a while for that to happen for .NET Core. Most people are are still skeptical of "M$", regardless of how it is now cross platform and pretty fast.

<comment><USER4> I wish people would stop it with this M$ nonsense. It's pretty juvenile, and worse, every time I read it my brain tries to pronounce it. How the hell am I supposed ot pronounce M$?

</comment></comment></comment><comment><USER5> I think they each have their place. More and more of what I do involves rich client work and so I often need Node just to build the client.

For API work, I think .NET is just getting better and better. Now that it's cross platform with Core, there are fewer impediments to choosing the right tool for the job.

With my projects it comes down to whether I use MVC for a more server-focused app or Node for one that's more client-focused. If you do use Node, you have the option of building universal/isomorphic apps. Of course, it mainly comes down to how you like to build your server side pieces, and which environment and ecosystem you prefer.

My current project is mostly MVC (we haven't moved to Core, yet) with a WebAPI piece, but I still use Node to build our rich client pieces. They're built with React and TypeScript. This allows us to continue building primarily a server-side app, while gradually migrating to more of a rich client approach.

The downside with Core is that it's still a work in progress. They've just released 1.1 but tooling is still not quite there. It might be closer when VS 15/2017 is released. One big piece is their move away from JSON project files back to a more flexible XML-based csproj model. They should be there soon. It's just indicative of growing pains.

The other big thing for me is EF7/Core, which is a rewrite of Entity Framework. There's a lot to look forward to here, but it's not at parity with EF6. If you're starting a new project, it's probably OK. If you have to migrate, it could present serious pain. It's the primary reason we haven't been able to migrate to Core, yet.

Regardless, if you used to use .NET and you haven't tried Core, you absolutely should. You don't even need VS. You can run VS Code and you can develop on Win/Mac/Linux/\+ and you have the same choices for deployment. Also, as others have mentioned, their new Web server, Kestrel is also getting very fast.

<comment><USER6> With the aspnet JavaScriptServices package [1], you can have universal apps on aspnet core. It runs javascript packages from the aspnet runtime, and this works very well.

There is a yeoman scaffolder that sets up your aspnet core projects with React, React/Redux, Angular 2 or Knockout, complete with typescript, babel and webpack hotloading on the frontend. Just do a "dotnet migrate" to migrate to the project to the new csproj format.

[1] [https://github.com/aspnet/JavaScriptServices](https://github.com/aspnet/JavaScriptServices)

</comment></comment><comment><USER7> It all depends (as usual). For professional projects I would choose .NET Core over Node.js, however, this is mostly due to the language preference (in my opinion C#/.NET is much better to scale and test).

That being said I find it troubling that many things are moving and that so many libraries are yet unported. I wanted to do something with Azure Media Services - nope; does not work with .NET Core yet. Wanted to do some simple image manipulation - out of luck again! The search for libraries was a huge PITA as most of the times when something seemed to be a true fit the support for .NET Standard was simple not existing.

Plus the most lightweight buildpack still adds 300 MB with a compile time of some minutes - whereas Node.js only used 50 MB and took 10 seconds. The startup of a .NET Core application also takes some time. The initial request is in the seconds range, subsequent requests are, however, faster than with Node.js.

So even though I would love to use .NET Core for most projects, I can only recommend it partially right now. Node.js may be better to just spawn some micro services, where you can easily change to something else once needed.

</comment><comment><USER8> Look at the libraries available on either stack covering your project's domain, and any other scenarios involved.

And I don't just mean look at what's there! Look at how long it has been there, its version history (stability, major breaking changes etc). What kind of user feedback there is - look at their bug tracker etc, and search for it on Stack Overflow. Maybe even skim through their code, and think about what your attitude towards it would be if it was a PR for _your_ project.

Then decide.

(This approach is generally applicable for any kind of "which language/framework do I use for X - Y or Z?" question.)

</comment><comment><USER9> I am managing (as a tech lead) a couple of node projects, ranging from small apps to projects being developed for more than a year. And although I always liked node and although I kinda live in JavaScript every day, I am looking forward to replacing the backend in new projects with something different (going to use Clojure).

The reason is that the whole JavaScript eco system can be extremely frustrating. Here a couple of examples:

\- If you install dependencies with npm there's a good chance you have minor version changes - which would be okay according to semver, but we have two challenges there: (a) even minor updates can introduce bugs and (b) a lot of JavaScript developers don't really care about breaking changes that much.

\- Documentation is huge problem. Even good libraries/frameworks often have an awful documentation and I often have to spend time in third party code finding out how things should be used

\- Many libraries get abandoned because the developers moved on. That's very sad. Especially, if there are bug reports pending, open pull requests from volunteers and so on.

Maybe other eco systems have the same challenges, but that's my current feeling about node.

</comment><comment><USER10> What is your goal, investment or bootstrapping?

If you're trying to make a POC as fast as possible to get investment, use whichever language you are fastest in, even if it's not perfect. Be OK with the idea of throwing it away when you write a better V2 after investment.

If you're planning to bootstrap and need to rely on stability with a very small team for a long time, choose whichever lang you know best how to make repeatable success, even if it takes longer.

There's also no reason everything has to be written in the same lang. I'm NOT saying go full tiny microservices, but use what is efficient where it makes sense.

E.g. I run a TLS terminator in C (bud), it's one binary and one config file. My service discovery is Golang (consul), again one binary one config. Think Unix philosophy, one tool for one job. And if you're using an automatic services router like Fabio, Envoy, or Traefik, it's super easy to connect these services regardless of lang. (There really is no equivalent for these in Node, especially not up to my production standards.)

This pattern has served me well across three startups (inc. medium SaaS) and countless projects. I'm primarily Node but I would definitely recommend using .NET where you see it providing a clear solution for one of your concerns.

</comment><comment><USER11> It really depends on what devs are you looking for, location, etc. Some places have lots of node devs doing freelance, others are more of a Java culture, etc. Node shines on hitting the ground running, assuming you don't have strong CPU requirements. Don't know much about .NET Core, but I assume its ecosystem is like Java but 10-50x smaller, which means you would be treading unfamiliar terrain some times.

I guess .NET is enjoying its 15 mins of fame because it targets Linux now, but they will eventually have to catch up with the competition (debugging, build tools, etc).

If you have legroom, .NET can be fun (I think the language is great), but if its a "serious" project I'd go with the JVM. You will waste less time with all the stuff around deploying an app and focus more on business.

</comment><comment><USER12> Interesting how little love there is for JS here. Is this a trend or a case of a vocal (large) minority vs a quiet majority? It's a genuine question because most of my choices are based on the level of support and popularity a language/ecosystem is likely to have over the next 5 years.

Given that basis and given that JS is in the browser, it always seemed to me that there couldn't be a safer choice.

<comment><USER13> JS is the lowest-common-denominator. Everybody at least kind of knows it, because you don't have any better option if you want to do anything in a browser (Even if you transpile, you end up having to know JS to figure out how to configure your transpilers and build process, and drop down to debug the emitted code). So there's a lot bigger pool of people that "understand" and can do JS than for possibly any other language these days. Maybe Java is bigger still, but I wouldn't be surprised if it's not.

That doesn't mean it's good, or that you'd want to use it if you didn't have to and had other options.

</comment></comment><comment><USER14> "For a medium-size web SaaS project with a roughly equal mix of computation and IO demands"...if you aren't forced to choose between these two, try Golang.

<comment><USER15> Or Haskell.

</comment></comment><comment><USER16> Do you "enjoy" one more than the other?

(I recently realised how important that is to me, so I'd posit that it may not be worth underestimating as part of the equation :-) )

<comment><USER17> I tried learning PHP some time ago, back when it was pretty much the only choice for cheap web-hosts. I stopped when I realized that life is way too short for PHP.

</comment></comment><comment><USER18> I would bet all my money on .NET Core. I'm also .net dev with many years of experience and was quite skeptical about the platform last years, but since birth .NET Core, since they bought Xamarin and Mono, went from closed source to open source model, went to Linux, did amazing job on performance and stability of .NET Core I see that the future of the core is very bright. It's not mature now but good enough for many project, IMO.

</comment><comment><USER19> I'm curious why you think .NET core is a "game changer". I used to be a .net guy for years as well but I haven't been keeping up as of late.

<comment><USER20> Also according to some benchmarks net core os the fastest "mainstream framework" beating node 4x.

<comment> ryan-allen Without even looking at benchmarks it'd have to be faster because it's compiled, right?

<comment><USER21> its mostly web server benchmark (Kestrel in .net case). So receiving bytes by OS kernel driver, passing them to http server, then to the app, app replies with simple response. Not so relevant to most of us IMHO, since our app code is like 10000x slower than web server can handle, but nice to see .net in first 10:) By looking at computation speed (chess engine?), i would say c# beats Js easily there (should be on-par with Java, but Java has some neat tricks in JIT and can be faster in same cases).

But definitely new .net core feels so much snappier than full fx. Im currently porting few apps (they are simple, no big libs), and so far everything works fine. It took me awhile to catch up with MS changes, since they're iterating little bit to fast... Using full vs 2015 update 2 + r#, and little bit of vs code on ubuntu (r# is still huge productivity booster, i can't switch to vs code yet). Also waiting for Jetbrains Rider, which will bring r# to all platforms!

</comment></comment></comment></comment><comment><USER22> Sorry for the hijack, but what's the state of .NET Core development on Linux? I'm dominantly a Java/Scala dev (although using other langauges) and I'm kinda used to working on Linux...

<comment><USER23> It should work with VS Code, if you use a supported distro. Having tried dotnet on Fedora (unsupported) it did not work. It works OK in docker containers, but then you don't have debugging... I think the next stable release iwth new tooling and more supported distros will improve it greatly.

<comment><USER24> It's supported now [0]

If you're used to JetBrains tools, there's also their Rider EAP [1]

[0] [https://www.microsoft.com/net/core#linuxfedora](https://www.microsoft.com/net/core#linuxfedora) [1] [https://www.jetbrains.com/rider/](https://www.jetbrains.com/rider/)

</comment></comment></comment><comment><USER25> From those two I would rather go for .NET core. But as this still is a work in progress and much more brittle than the .NET world was before you might also look into a more stable ecosystem if your projects and time planning require that. JVM based stuff or even Go might fulfill that. I think .NET core will be great in a year, but up to then still some work needs to be done which might cause some trouble for early adopters: The tooling story needs to be finished. Currently .NET core is somehow in a transition phase from old (msbuild old) to intermediate (project.json) to new (msbuild new) tooling, which means several .NET projects all use different tooling. Additionally lots of libraries on the .NET ecosystem might not yet be compatible with .NET core. But I guess most are moving in that direction and will be there sooner or later.

I worked a little bit with node.js and got the following impressions: The node.js core libraries work well and are mostly good to work with. If you use typescript on top the language is actually really good - I even prefer some things to C#. Tooling is so-so. There are lots of good tools, but there are also dozens of them. It takes quite some time to discover which ones work for you and your team. Most other ecosystems provide much more streamlined solutions for builds and other tasks. The reason why I would personally not favor node is it's ecosystem. It's gigantic and consists of lots of very small modules. You often end up with dozens of dependencies in a project for even the smallest things. Lots of libraries on the ecosystem are of poor quality - however this is nothing special to node but it's the general case for free or non-maintained libraries than float on the internet. However in an ecosystem of lots of tiny libraries it's much more likely that one of those things accidentally slips into your product and will cause you headaches. If you build an end product you also often want to have a good overview on what libraries end up in your product, and what is their version, quality and licensing situation. You might even want to have a self-hosted or forked version of those to guarantee long-life support. This gets much harder the more libraries you have. In the .NET or Java ecosystems you can rely on a bigger and well maintained standard library as well as on more defacto standards (like ASP.NET), which will make this job easier. But they might also get in your way as soon as you want something from which they don't natively support.

</comment><comment><USER26> The correct answer might be _both_.

There's a really nice ASP.NET Core SPA Service plugin[1]. Basically, it handles integration between ASP.NET Core and Node/Webpack/React or Angular 2 so that when you run your application from Visual Studio or the .NET CLI, you also get React/Angular server side pre-rendering, hot module reloading, and server/client side route syncing that mostly just works.

[1][https://github.com/aspnet/JavaScriptServices/tree/dev/src/Mi...](https://github.com/aspnet/JavaScriptServices/tree/dev/src/Microsoft.AspNetCore.SpaServices)

</comment><comment><USER27> I would pick node simply because it is more mature. How good is the Postgres .NET Core package for example? Last I checked it was still being worked on (with good progress though).

For me it's not about .NET Core vs node but how good is it on the platform I use. I'm still not seeing any real evidence that people are using .NET on Linux with non SQL Serer databases for moderate trafficked sites. I need to see proof that the new .NET stuff is on par with the JVM or node for stability on other platforms than Windows. (been down the mono/xsp path before)

</comment><comment><USER28> Personally I find Node easier to move fast with, so for me it can be a good fit in immature markets before product-market fit. On the other hand it can be a pain to deal with memory leaks & handling errors cleanly and in isolation, so maintenance can be a pain. In more mature markets with less product churn required to reach stability .NET might work better

Another thing to take into account is how likely you are to hire a team around it, and what skills are more easily available where you are (or remotely if you like)

</comment><comment><USER29> If the computation-part should run server-side, definitely use .net

</comment><comment><USER30> I would recommend Golang. It is faster than Node.js and lighter on the memory footprint than C#. Easy to learn, with types and good documentation. And it has the libraries for a medium size project. Actually on my projects I use only 3 languages. Golang, Python(Django) for server side stuff and Javascript for front-end.

<comment><USER3> It's easy to learn, but coming from C# it's painful. You're constantly Googling where is X and Y in Golang. Eventually I think you either gel with it or become frustrated and ditch it.

</comment></comment><comment><USER31> When I learn node, it looks strange in many aspect. I always wander why not using then in browsers, leaving only the IO part on the server?

BTW,I'm asking a question, not providing advice. I know there are APIs and Copyright Protection issue and so on. But when comes to general,they are just javascript, even with the same engine.

</comment><comment><USER32> I'd go for a Java based language in the first place. It's been available on all the major platforms for years, and the community is huge. Dot net core isn't. That said, I would probably avoid Node because I tend to dislike coding in JS. But that's a personal preference, of course.

</comment><comment><USER33> Full disclosure: We [0] have been a .NET/Windows house since the product was launched 8 years ago.

When RC1 of .NET core was announced, we jumped on it (in spite of all the limitations that it came with) and haven't been disappointed. We've been working on a product whose pilot version handled to the tune of 40K requests in a day on a 1GB/1Core Linode box

\---

As far as choice of platform goes, it all comes down to a few factors for me

1\. What the team is comfortable with:

        This is *crucial* and in retrospect it is the biggest contributing factor
        that helped us take our next product to production -- fast. If you have a
        team that is comfortable with .NET then just go for it. Everything else can
        be figured out later.

2\. What the ecosystem is like:

        If you have a fair idea of what you're building out, scout the ecosystem
        and see if it offers everything that you need. We more or less found
        everything that we needed except a good Excel wrangling library.

\---

Also I feel the .NET core VS Node question is skewed because comparatively, Node is a platform that has been around for _much_ longer and has _much_ bigger adoption.

Keeping this in mind, there will definitely be problems with .NET Core. Eg: If you're looking to reference a class library that is running with the full framework then you'll be hitting a few hurdles and stoppers.

The good part however is that it is constantly under work and we're able to actually see the performance improvements. [1][2]

The bad part however is that it is constantly under work so expect flux. [3][4]

\---

Experience wise, its been great working with .NET Core. Projects like VS Code make it a breeze. To me, C# has always been a well architected, beautiful language and now I'm able to write it in the way I want to -- without using a bloated IDE like Visual Studio and run it where I want to -- On cheap linux boxes without worrying about licensing costing.

For us at Logic Soft, .NET core really was a lifesaver when our next logical transition was the web and we were a .NET house shipping software on windows :)

Footnotes: [0]: [http://logicsoft.co.in](http://logicsoft.co.in) [1]: [https://www.techempower.com/blog/2016/11/16/framework- benchm...](https://www.techempower.com/blog/2016/11/16/framework-benchmarks- round-13/) [2]: [https://github.com/aspnet/KestrelHttpServer/pull/1138](https://github.com/aspnet/KestrelHttpServer/pull/1138) [3]: [https://blogs.msdn.microsoft.com/dotnet/2016/05/23/changes-t...](https://blogs.msdn.microsoft.com/dotnet/2016/05/23/changes- to-project-json/) [4]: [http://ivanz.com/2016/05/17/farewell-project-json- hello-msbu...](http://ivanz.com/2016/05/17/farewell-project-json-hello- msbuild-and-csproj)

</comment><comment><USER34> .NET of course.

I don't see a use for JavaScript outside the browser, unless forced to do so.

</comment><comment><USER35> .NET. Also take a look at Spring-Boot, recent releases made me feel like whole new Java came out.

<comment><USER36> Spring-Boot as long as you don't mind the required voodoo necessary for stack traces for when things go wrong ;)

</comment></comment><comment><USER23> I'm working on a .Net Core project currently. I'd definitely go with .Net Core, but it has quite some problems currently.

We do integration tests with mocha/chai on node and that is just about as much untyped js as a project can take imho. For node there are a gazillion of libraries (i mean frameworks ) but so many are lacking in quality for so simple stuff what you take for granted in the .net world that choosing the right one slows us down.

On the other hand for .net core many libraries simply do not exist (yet). Regular .net stuff wasn't ported, and imho it won't be done until the next tooling arrives. The tooling is the second con, and will be until 2017q2. The project.json is a terrible format, the visual studio tooling is lacking, incompatible, and is slowing ua down. The tooling has some nice ideas but is too rough around the edges. Debuggning has some inconveniences sometimes, but generally works. Clean does not clean the solution properly. No complaints when a file was open and could not be replaced, shows build as success, then you hunt phantom bugs because of this... Not as mature development experience as with java/full .net 4.5

We have bet on core getting there, but expect inconveniences until then.

<comment><USER37> > many are lacking in quality for so simple stuff what you take for granted in > the .net world that choosing the right one slows us down

Do you have some examples? I was under the impression that the JavaScript/Node.js ecosystem was bigger, but maybe that's the HN bubble.

<comment><USER23> The ecosystem is big. Too big, you spend almost as much time trying to find the right tool as it takes to do it from ground up.

My example: I needed to work with dates. Under .Net the DateTime and TimeSpan types do this pretty well, and under Java 8 it is also well solved.

Under JavaScript this is not so clean. I found the moments library to work well, but had some tries before. With one when I tried the example code from the homepage I received Nan/NaN/NaN NaN:NaN:NaN as a string representation for a valid date :D This is a thing which is "trivial" (you expect it to be there, and be solved) and you expect it to just work if not socialized in the JS world. Surely I'll encounter other such things, even as we use JS only for integration tests.

Also the Java/.Net ecosystem is also big, but does not completely overlap with the JS world, and stuff doesn't get reimplemented so often. (JS attiute in the HN bubble: This library had no release and no tweets in 2 weeks. The project is dead! have to rewrite from ground up!)

</comment></comment></comment><comment><USER13> Given the option, I would pick .NET in a heartbeat. Of course, I am a .NET guy anyway, and generally loathe JavaScript and the whole Node clusterfuck to start with.

I really like having a static type system, that assists my static analysis and refactoring tools like those built into VS or ReSharper's. Even better when I can use F#, so I have access to an even stronger type system. I get so irritated when a stupid typo that would be caught by the compiler, results, in JS, in trying to access something undefined and crashing. Consequently, I am much more productive and faster working in C# than JS.

In general, I find the situation with NuGet packages vs Node packages far more sane. .NET has a workable standard library built in, and has not really embraced the idea of micro-assemblies containing a single type or function, and so typically .NET assemblies encompass a larger scope, and have less version churn, and more backwards compatibility. In a typical .NET project, I might reference a dozen NuGet packages. In a typical Node project, NPM pulls down hundreds of megabytes of slightly different versions of 100 different micro-libraries, nested dozens of layers deep in the filesystem - usually I'll have four or five different point releases of lodash or underscore as dependencies of dependencies of dependencies. Not to mention all of the things on the order of left-pad.

<comment><USER38> I'm mainly a Java programmer here but I like F# a lot. Are there any problems using only F# with .NET Core apps? Do you really _need_ to use C#?

</comment></comment><comment><USER39> Why do .NET Core seems to be a game changer? M$ is nowhere near to be a game changer in anything, imo.

EDIT: no reply, a lot of downvotes. A lot of people love it, nobody use?

<comment><USER40> I think nobody replied because it was a low content critique without any explanation. Keep in mind your assumptions aren't other people's, so you might need to explain why you think M$ is nowhere near to being a game changer in anything. If you don't explain yourself I don't see why anyone should try to explain why they think .NET Core seems to be a game changer.

</comment></comment><comment><USER41> Node is for hipsters and JavaScript is a terrible language even now. Exception handling, threading, build tooling, modularity, debugging, profiling, standard library support.... Almost every metric I can think of is awful in js compared to .NET and Java world. Most of the devs saying how great js is don't know many other languages.

Rant aside, if you have any computational demand stay far away from js. Lack of threading support absolutely kills performance. The hacky alternatives are terribly slow, like using redis to share state between processes. Js is also still about ~10x slower than .Net or Java (and runs a single thread) which matters in hardware cost at scale. The only strength of node is the ability to run pages on the server. Great for server side rendering and testing, a step backwards for everything else.

That said, I would avoid .net core for now as well. We tried using it but it required us to abandon too many of our mainstay libraries and tools to be productive. Many parts of the standard libraries that you and other libraries rely on no longer exist. MS is working on this but for now I would definitely stick with regular .net.

Arguably best stacks for most use cases are Java (Spring boot or Jersey) and .net MVC using WebAPI. Plus Angular or whatever crazy shit you want for the frontend. Not exciting but extremely practical, well tested, well understood.</comment>


Ask HN: How much savings did you have when you started? - <AUTHOR>

As I've detailed in a previous post, I'm planning on quitting my job in a few months and moving to SF to join the start-up scene with my friend / prospective co-founder. However, I've only got about $18k saved up. How does this compare to other people who have taken the leap? <comment><USER2> $18k - is not that much at all, and it will disappear fast. If you don't have any family to back you up with some reserve/emergency cash when you ran out, i would be really careful.

You will use it within 5 - 7 months. Keep in mind, that just even for renting, you will have to give a first, deposit, (and sometimes last month). Assuming you are going to have roommates, if your rent is 1k (can be more, can be a bit less in crappy area), + moving costs, you could see easy 4k gone, just when you land there.

The chances to get funding, or any revenue within that time are pretty much 0, unless you have a solid prototype already build, do you?

My advice, is move to SF, find a job (hopefully one that will pay relocating costs), or maybe even a contracting one, and then develop your product on the side. When it is at least 60% done, and you have a bit more savings, go full swing into it.

The rule of thumb, you should have at least 1.5 years of savings. If you have parents that lend 20k extra when things go sour, then 9-1yr would be good enough.

In SF that would be at least 30k. add about 10k you will need for the business (servers and such, depends on what you are doing, then 40k is minimum.

If you are working as an engineer, and are smart with money, you should be able to save at least 20k-30k a year.

<comment><USER3> >My advice, is move to SF, find a job (hopefully one that will pay relocating costs), or maybe even a contracting one, and then develop your product on the side. When it is at least 60% done, and you have a bit more savings, go full swing into it.

overall, sound advice, I think.

Note: if you move to silicon valley rather than SF, you can get a room in the lower-end but perfectly safe areas of Santa Clara or Sunnyvale for $600/month or so. $800-$1000 will get you a nice room that's near to the y combinator offices. If you are renting a room, you often can get away with first and deposit, especially for lower end stuff. Look around.

As for savings, well, that depends on your risk tolerance. A year and a half seems pretty excessive to me, but then I personally co-sign business loans and leases, so if the company craters, any personal money I had is gone anyhow.

If you are in a capital intensive space (e.g. you have to buy lots of servers like I do) contracting while you are starting up (if you can talk people into going corp to corp) can have some tax advantages, too.

</comment></comment><comment><USER4> I did it with exactly 0, but I did have a lot of luck and plenty of people that wanted to see me succeed so they threw me jobs, contacts and so on. That helped tremendously.

Conservatively, I'd say you need about 6 to 9 months living expenses in the bank and if that ever goes below 2 months remaining it might be time to see if you can land a job somewhere again.

The safe way to do this is to try out your consulting next to your regular employment.

That might take longer but the chances of failure are dramatically less.

</comment><comment><USER5> About 100k when I started Shopify, that meant I didn't have to take a salary until we had enough revenue 2 1/2 years later. Urg, don't do it like that.

<comment><USER6> You mean that you shouldnt use your own money?

<comment><USER4> I think he meant don't take 2 1/2 year to build up your revenues to the point where you can take a salary.

<comment><USER7> Does it also mean you might get too comfortable sitting on a large saving. So, do it with just enough cash to put up some pressure for early delivery. .

</comment></comment></comment></comment><comment><USER8> I started my first startup with $600 in credit card debt.

I had a product idea that I wanted to work on. So, I started doing consultancy to make some cash and bootstrap my way. Then I found a biz co-founder, hired a designer and two programmers to take care of the consultancy business. Our team size quickly grew to 20 programmers and designers, and we had several paying clients.

Most programmers we hired were average, but not great. This team could make websites, but not products. We hired this team to do work clients projects, so I can focus on building our product.

Since our team and clients were in different time zones, I had to deal with clients in night and development team during day. This setup kept me engaged and busy with client's projects. Therefore, we were unable to work on our product and we missed the boat.

Recently, I decided to quit the company and move on to work on my new product startup.

</comment><comment><USER9> It's completely feasible if you move to SF with a job in hand.

Spend a year working, networking and getting the lay of the land, and then jump off and do your own thing. There's tons of companies that are hiring right now.

Aside from that, $18k really isn't much at all in SF or SV. Spend part of the $18k in coming out here for a visit for a month or so, do some networking land a job and then move out. Think of doing startups as a more long term plan rather than a short term leap to SF to see how far you can get by living on ramen noodles.

</comment><comment><USER10> Technically I started before I quit ... something that I highly recommend any other entrepreneur to do. However you could definitely pull it off with 6 months money although 12 months would be better :) A few months after going on my own I also landed a contract dev job that helped me make it an additional 6 - 8 months and attend some events I wanted to. I did the dev work at night and then just worked on my project during the day.

If you are all-in on your new project though, you should be able to make it though. Just make sure you already have that new computer or whatever tools you'll need to get started. I've found a nice computer always boosted my productivity and made me feel better :)

</comment><comment><USER11> I really think you would be better to get the bare minimum product out the door, so you are not burning money while you are in product development. It takes dedication and a lot of nights and weekends, but it really is the best course of action to give yourself the best chances of success, with the funds that you have available.

This way you can dedicate the 18k to marketing once the product is completed. Contrary to the dream stories of everything going just right, not many products go grass roots or viral or whatever we are calling it these days. Many of them require good old fashion marketing to get the word out.

18k still does not give you a whole lot of runway especially if you have rent, electricity, food and the other life necessities. Postpone spending cash as long as possible and when you do make sure that that cash is going into something that will convert back into revenue.

If you don't understand marketing, start learning about it now. Buy some books read some blogs of industry leaders. You will have to become an effective marketer if you want your product to succeed. Contrary to popular belief even some great products don't sell themselves and require good marketing.

</comment><comment><USER12> From friends in SF, the rent is similar to that of NYC where I live so I'm happy to share my experiences to see if it's similar to yours.

When both my co-founder (formerly in Investment Banking) and me (previously in Public Relations) left our jobs, we split our savings of $70k where the majority went to rent, food and other necessities living in a big city like New York. We also began to set up the necessities of the business, i.e. legal entity, website development, etc. and then went into product mode. We managed to start the company and live off our savings for thirteen months before we took outside funding.

The biggest thing to think through regarding savings, like cpercviva mentioned, is figuring out where the largest amount of your money needs to go. For us, and any other person thinking about taking the leap in New York, is usually rent.

I'd map every single expense you've had in the last year in a Google Spreadsheet so you can trim any "financial fat".

</comment><comment><USER13> Depends on your expenses. How long do you anticipate that amount would last? And, would you be totally doomed if after X months, your startup isn't making any money and you run out of savings?

I think $18k is plenty fine, (but that's just me). I'm planning to do a similar thing and my savings are less than that.

<comment><USER14> _I think $18k is plenty fine, (but that's just me)._

Not for San Francisco.

</comment></comment><comment><USER15> I had 20k, but I also had no rent (very advantageous). SF is going to be really expensive — what about moving to cheaper Mountain View which still right in the middle of the startup scene (location of YC), and a train ride to SF?

</comment><comment><USER16> How much money you need depends on how much time you need. I had more savings than you when I started working on Tarsnap, but a secure backup system isn't something you can throw out in a few months, so I needed a longer runway.

</comment><comment><USER3> When I started my current company, I had a full time job. I've had a job on and off for most of the time I had the company. This (5 years in on this company) is the first year I've been full-time for the whole year, actually working on the company (rather than consulting, etc...)

If you've got eighteen grand, well, you are going to have to start making money quick. Living around here is pretty expensive. Be prepared to get a contract gig, because for most product businesses, ramping up as fast as you will have to ramp up with that runway will be quite difficult.

</comment><comment><USER17> $400. Had over $3500 in living expenses to meet the month I got fired (at beginning of month). Been finding novel and intriguing ways to do so for 35 months now, though the expenses are bigger these days.

</comment><comment><USER18> It fully depends what are you going to do and how much are you spending.

To get a baseline of what you need, calculate your living expensed plus do the worst-case calculations for a year.

Expect that your currently fully-working laptop and mobile phone are both going to break and you have to buy new ones. (sudden hw costs can be easily a couple of grands). Ditto for cars etc.

If you have a spouse, don't expect that working from home for a year is such a great idea, thus plan some money for renting a space.

</comment><comment><USER19> I'm guessing you're moving to get investors?

If you are planning on self funding wouldn't it be much better to bootstrap in a lower-cost location?</comment>