Cloudflare data still in Bing caches - <AUTHOR> https://news.ycombinator.com/item?id=13727279 <comment><USER3> From the parent thread:

      The caches other than Google were quick to clear and we've not been able to find active data on them any longer.
      ...
      I agree it's troubling that Google is taking so long.

That's really the core issue here - the Cloudflare CEO singled out Google as almost being complicit in making their problem worse whilst that exact issue is prevalent amongst other indexes too.

The leaked information is hard to pinpoint in general, let alone amongst indexes containing billions of pages.

I can understand the frustration - this is a major issue for Cloudflare and it's in everyone's best interests for the cached data to disappear - but it's not easy, and they shouldn't say as such (or incorrectly claim that "The leaked memory has been purged with the help of the search engines" on their blog post).

This is a burden that Cloudflare has placed on the internet community. Each of those indexes - Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, ... - <USER2> to fix a complicated problem not of their creation. They don't really have a choice either given that the leak contains personally identifiable information - it really is a special sort of hell they've unleashed.

Having previously been part of Common Crawl and knowing many people at Internet Archive, I'm personally slighted. I'm sure it's hellish for the commercial indexes above to properly handle this let alone for non-profits with limited resources.

Flushing everything from a domain isn't a solution - that'd mean _deleting history_. For Common Crawl or Internet Archive, that's directly against their fundamental purpose.

<comment><USER4> If Google hadn't noticed and saved them from this bug, who can say how long they might have continued spraying private data into the world's caches? Apparently, this had been going on for months prior. Heartbleed was exposed for years. This could have been too. Worse: malicious attackers could have discovered and quietly exploited it. _For years_.

The very last people in the universe Cloudflare should be criticizing right now are the Google security team.

<comment><USER5> The comment from eastdakota seems to be political in nature; some on here have suggested he has an axe to grind with Google.

Why do humans politicize so much? That's one thing I'll never understand, and one of the reasons why I refuse to become a manager.

<comment><USER6> Any talk that is about Google's systemic influence or role is political by definition, nothing wrong with political. People and companies have political ideologies and it's good to discuss them.

<comment><USER5> Discuss them, sure.

But what does it really matter?

<comment><USER7> Well, it's easy to ignore politics until you're personally affected by it.

</comment></comment></comment></comment></comment></comment><comment><USER8> I've had a fairly high opinion of CF, apart from their Tor handling and bad defaults (Trump's website requires a captcha to view static content.) Yeah I'm uncomfortable with them having so much power, but they seemed like a decent company.

But their response here is embarassingly bad. They're blaming Google? And totally downplaying the issue. I really didn't expect this from them. Zero self awareness- or they believe they can just pretend it's not real and it'll go away.

<comment><USER9> Agree that it's a shame that it doesn't really feel like they're owning up to how bad it was.

But I wonder if it will just mostly go away. Luckily for cloudflare this is a pretty random sampling of people around the country and world. Unless someone has put together a big data set from the caches and decides to leak it or inform the victims, it seems like most people whose accounts do get taken over from this will have no way to trace it back to this bug.

<comment><USER10> For sure, there are assholes compiling cache data :(

</comment></comment></comment><comment><USER11> It's been pretty entertaining watching taviso's attitude towards CF go from "we trust them" to "dude, you're a tool".

I kind of understand what CF is doing here: they've screwed up, there's no way for them to clean it up, so all they can do now is deflect attention from the magnitude of their screw up by blaming others for not working fast enough in the hope that their fake paper multibillion dollar valuation doesn't take too big a hit.

Still a dick move though. Maybe next time don't use a language without memory safety to parse untrusted input.

<comment><USER12> > Maybe next time don't use a language without memory safety to parse > untrusted input.

Untrusted input is safely parsed by programs written in languages without memory safety all the time. In fact, most language runtimes with memory safety are implemented in languages _without_ memory safety.

What's to criticize here is parsing untrusted input _in the same memory space_ as sensitive information.

<comment><USER13> How would you rewrite websites to optimize them without parsing untrusted input in the same memory space as sensitive information? The thing you're trying to change (the HTML) can have PII or be otherwise sensitive.

(I used to work on Google's PageSpeed Service, and if it had had the same bug I think we would have been in the same situation as CF is now.)

<comment><USER12> > The thing you're trying to change (the HTML) can have PII or be otherwise > sensitive.

Sure it can. But leaking PII from the thing you're parsing and leaking PII from any other random request isn't the same thing.

I understand the performance implications (and the added effort) of sandboxing the parser, but I'm arguing for it anyway. The mere presence of a man-in-the- middle decrypting HTTPS and pooling cleartext data from many disparate services in a single memory space is already questionable (something for Cloudflare customers - and not Cloudflare itself - to think about) but adding risky features into the mix shouldn't be done without as much isolation as possible.

Let's face it: parsers are about the most likely place for this sort of leakage to happen...

<comment><USER14> Actually, thinking more, we designed PSS to run in a sandbox specifically because we were parsing untrusted input. But leaking content from one site into responses from other sites would still be possible, because I think we didn't reinitialize the sandbox on every request (way expensive) and each server process handled many sites. Fix that, and then there's still the risk of leaking things between sites via the cache.

It's definitely possible to fix this (new sandbox per request, cache is fragmented by something outside of sandbox control) but I'm not sure the service would make sense economically.

</comment></comment></comment></comment></comment><comment><USER15> Why is Cloudflare underplaying this issue? All data that transited through Cloudflare from 2016-09-22 to 2017-02-18 should be considered compromised and companies should act accordingly.

<comment><USER16> >Why is Cloudflare underplaying the issue?

I suspect the random nature of the overflow plaintext spewed out into caches will be difficult to leverage into a statistically significant attack against any particular customer. If CF's bottom line is unlikely to be impacted, why not downplay the issue and refer to it in the past tense?

There may be significant long lasting damage to CF's reputation amongst vulnerability researchers, but that's a tiny subset of the population and statistically insignificant to a company that ~10% of internet traffic flows through.

<comment><USER17> This all is assuming that no-one has found the vulnerability before. My understanding is that, once you figure out what kind of request causes the overflow, you can pretty much just spam CF with it, getting new garbage data every time. If someone was deliberately doing that, they could have more data than all the indexes combined. And the worst part is that we'll never know.

<comment><USER18> Does CF redirect all non-HTTP traffic to HTTPS? If not, NSA could have passively intercepted tons of leaked data, and all it would take is for one of their analysts - people paid to find stuff like this - to notice a single out- of-place leaked secret and trace it back to CF.

</comment></comment></comment></comment><comment><USER19> Rule #1 of breaches: you can't unbreach

At this point if you don't consider all data that was sent or received by CloudFlare during the "weaponized" window compromised, you're lying to yourself.

</comment><comment><USER20> I briefly touched base with Cloudflare's Product Management and my impression was that they were overconfident and snobbish in every aspect, which is kind of opposite to what I'd expect from the company like this. Being humble never hurts.

</comment><comment><USER21> Does Cloudflare have complete logs to rule out that someone noticed this before taviso and used it to massively exfiltrate data by visiting one of the vulnerable sites repeatedly?

If they can't tell, someone may now be sitting on a lot of very juicy data, far beyond what may be left in these caches.

<comment><USER22> I haven't seen an attempt by Cloudflare at claiming that this definitely didn't happen. They may still be working on it. It's possible that the question is basically unanswerable even with logs.

As you say, in the presence of uncertainty it's most prudent to assume that this actually happened.

<comment><USER17> They seem to be presenting some dubious calculations made to imply that it was highly unlikely to happen.

The reason why I consider them dubious is that anyone simply searching the name of some HTTP headers in Google et all could have stumbled into this. I don't find it at all unlikely to happen in a timespan of 5 months.

<comment><USER23> The odds that Google had the first team of researchers to trip over the bug is low. But we know that they were the first team to disclose the vulnerability, and the only reason not to disclose it is if you wanted to exploit it.

So the key question really isn't "how likely was someone to find this", but "how likely is it that Project Zero was the first". I think it's hard to estimate odds, but I'd be surprised if it was even as high as 50%; there's too many teams, individuals, freelancers, state actors, etc. actively engaged in looking for this kind of thing.

<comment><USER24> Many people probably tripped over the bug but didn't know what it was.

The data it reveals isn't guaranteed to be obviously private and exploitable. It can just look like a valid but useless response, or a invalid and corrupted response depending on what you were looking for in the first place.

</comment></comment></comment></comment></comment><comment><USER25> I really hope people don't lose sight of how helpful Project Zero has been in finding ongoing vulnerabilities and making the Internet a better place.

There is a bit of tension between cloudflare and taviso over the timing of notification, but that is vanishingly insignificant overall.

</comment><comment><USER26> Just please tell me the people who found the issue got their free t-shirts.

<comment><USER27> T-shirts. He only got one.

<comment><USER28> ...and it had half of a customer logo on it, along the bottom edge.

</comment></comment></comment><comment><USER28> Cloudflare's email to customers has been calling this a "memory leak", which means something entirely different than a "secret data disclosure".

One causes swapping. The other causes a month of extra work.

</comment><comment><USER29> I'm compiling a list of affected domains (with data found in the wild): [http://doma.io/2017/02/24/list-of-affected-cloudbleed- domain...](http://doma.io/2017/02/24/list-of-affected-cloudbleed-domains.html)

If you find some samples with domain names / unique identifiers of domains (e.g. X-Uber-...) you are welcome to contribute to the list: [https://github.com/Dorian/doma/blob/master/_data/cloudbleed....](https://github.com/Dorian/doma/blob/master/_data/cloudbleed.yml)

<comment><USER30> See also: [https://github.com/pirate/sites-using- cloudflare](https://github.com/pirate/sites-using-cloudflare)

<comment><USER31> That's beyond flawed because he assumes any site that uses cloudflare's NS is using the proxied services. Which is 100% utterly _wrong_.

<comment><USER32> What is the correct way?

Honest question...

Out of hundreds of passwords I potentially need to reset, I'd like to prioritize.

<comment><USER33> You have resolve the DNS and see if it points to one of Cloudflare's reverse proxies.

<comment><USER34> And even then, no guarantee. One could host a static shopwindow site on his own, and use CF for the actual backend of a mobile app under a different domain that nobody knows about.

There is no real way to know what has leaked and from whom. The only ones with real info are CF and it's clear from the amount of sites they've missed in their purge-requests that even them don't really know.

</comment></comment></comment></comment></comment></comment><comment><USER35> It seems that, due to the Cloudflare's confusing disclosure, it's still not clear what and how is leaked. What I personally observed, just by following the discussion and the links to some examples:

\- there is a smaller number of sites that used some of the special features of Cloudflare that allowed leakage for some months, according to what Cloudflare said.

\- it seems the number of the sites was much bigger for some days, according to what Cloudflare said.

\- the data leaked are the data passed through the Cloudflare TLS man-in-the- middle servers -- specifically not only the data from the companies, but the data from the users, and not only the data related to the sites through which the leak happened, but also other sites that just happened to pass through these servers. Again, also the visitor's data, both directions are leaked. From the visitors, their location data, their login data etc. As an example: if you imagine the bank which used Cloudflare TLS, in the caches could be both the reports of the money in the accounts (sent from the bank to the customers) and the login data of the customers (sent by the customers to the bank), even if the bank site hasn't had the "special features" turned on. That's what I was able to see myself in the caches (not for any bank, at least, but the equivalent traffic).

<comment><USER36> This is a good reading of it.

To be clear, the SSL and caches are isolated from the process that handles transformations of web pages and neither of those leaked anything.

All traffic that is "orange clouded" passes through the transformation layer and _may_ have leaked by any of the pages on the sites that had this unique set of features enabled (the cause) and also had broken HTML (the trigger) if they happened to be in the memory immediately after the broken HTML.

Which means that a small number of sites (3,438 domains - cite jgc) were able to leak the first bit of memory for requests located in memory after the page request of a broken page on one of those small number of sites... and this other memory could have been any other page that is proxied by Cloudflare.

Is it huge? Absolutely, because the leaked pages could have contained anything, especially in the headers which will have been included.

Is it a lot of pages? The scale of Cloudflare means no matter how small the fraction affected it adds up, so yes. The sum of pages that will have leaked data is horrifying because even a single page is a page too many to leak.

Are you a customer, are you paranoid and want to know what to do? OK, then change your origin server IP addresses, and expire your user sessions/cookies. Beyond this, you will need to look at your own web application to determine whether in the first bit of a response from your origin servers you include sensitive data, and from that what you feel is an appropriate action.

The only thing I'm doing to my sites is working through an expiry of user sessions. Even then, I think the chances that I was affected remain vanishingly small but expiring sessions is the responsible thing for me to do.

Note: I work at Cloudflare but wasn't involved in this security incident beyond helping to find data in caches. Additionally I run 300+ websites that are all behind Cloudflare web proxy so I understand that perspective extremely well.

<comment><USER35> > were able to leak the first bit of memory for requests

It's some _kilobytes_ of browser _requests or_ server _responses_ that are leaked in the samples I have seen, if I remember correctly. Much more than "the first bit."

Just to be clear.

<comment><USER36> Yes, apologies for my phrasing... the first bit didn't mean "computer bit" meant "human description for the first part of a web response (headers and body)".

To be very precise, I think jgc mentioned that up to 4KB from the bounds of the initial request could have been leaked, where a good section of that was the internal server-to-server communication certs, the raw headers as visible during the internal processing of the request, and then part of the response body that follows... this may have been encrypted or compressed and could appear as garbage.

The focus for site owners on Cloudflare should be on "What do I put in headers that may be sensitive?" or "What URLs do I regard as being secret/unadvertised?".

Typically that will be session cookies and access_tokens. Hence my advice, expire and roll all sessions.

Headers include the Cloudflare internal headers, and so includes origin IP addresses too, so if those are secret for you (i.e. you have previously been the target of a DoS and are using Cloudflare to hide those IPs) then you'll want to change your origin IP addresses too. Though if you have been the target of a DoS then you probably should use iptables to only allow web traffic from Cloudflare IP addresses.

</comment></comment></comment></comment><comment><USER37> Millions of domains are on Cloudflare. We can't tell how many of them were affected.

Either we can search for obvious strings like X-Uber-* and try to scrub them one by one, or we can just nuke the caches for all the domains that turned on the problematic features (Scrape Shield, etc.) anytime between last September and last weekend. Cloudflare should supply the full list to all the known search engines including the Internet Archive. Anything less than that is gross negligence.

If Cloudflare doesn't want to (or cannot) supply the full list of affected domains, an alternative would be to nuke the caches for all the domains that resolved to a Cloudflare IP [1] anytime between last September and last weekend. I'm pretty sure that Google and Bing can compile this information from their records. They might also be able to tell, even without Cloudflare's cooperation, which of those websites used the problematic features.

[1] [https://www.cloudflare.com/ips/](https://www.cloudflare.com/ips/)

<comment><USER38> Nuking the caches is one thing, but what about services like the Internet Archive whose job it is to hang on to these pages? Pages with leaked data are clearly difficult to identify; removing the leaked data without nuking the document may be impossible, at least in an automated fashion. Are we supposed to erase five months of history from the affected domains?

This CloudFlare breach seems to have put a lot of people in a tough spot, but it feels like it's put archivists in an impossible position.

<comment><USER37> I agree that nuking entire domains would be bad for the Internet Archive. But I don't think it would be overwhelmingly difficult, nor controversial, to identify and remove the vast majority of "contaminated" documents. This applies to the Internet Archive as well as major search engines.

First, we're talking about raw memory pages, not merely malformed HTML. Those memory pages might contain valid HTML, but most of the sensitive information is in the headers, not HTML markup. It won't be very difficult to write a script to identify documents where random headers and POST data have been inserted where they don't belong, or where the markup is so obviously invalid (even compared to similar documents from the same site) that there is a high probability of contamination. Having a full list of contaminated domains would obviously help a lot, because we'll only have to deal with thousands of domains instead of millions.

Second, contaminated documents by definition contain information that is NOT what the publisher intended to be crawled, indexed, or archived. So there should be less resistance to removing them.

Finally, most of the contaminated domains used features such as Scrape Shield that were intended to deter archival. It's as if the domain had a robots.txt that said "User-agent:* Disallow:/". I'm not sure whether it's even possible for the Internet Archive to archive such domains. If they can, maybe they've been doing it against the publisher's wishes. If they can't, well, there's no problem to begin with.

<comment><USER39> Archives don't delete stuff, nor do they have much capacity to do much computation on their archived data. Whereas if blekko still existed as a search engine, I'd just push code to refuse to show cached pages or snippets containing text that likely means the CloudFlare problem. 15 minutes work, and the underlying data would expire fully in a couple of months.

So I would completely disagree with your speculation about what's easy or hard. (Note that I've worked at a search engine and an archive.)

</comment></comment></comment></comment><comment><USER40> After reading this, I'm considering switching from cloudflare for my DNS servers. Recommend a similar free service?

<comment><USER36> DNS only customers were totally unaffected by this web proxy bug.

<comment><USER41> Sure, but maybe he doesn't want to do business with Cloudfare anymore?

<comment><USER40> Right. The bug doesn't affect me, but I don't like how they responded to this.

</comment></comment></comment></comment><comment><USER42> IANAL --- what, if any, legal precedent/structure is there for what will happen to CF if, say, 1.5billion users are hacked and money shifts dramatically as a result or some other reasonably thinkable "hypothetical" situation that we, the Internet-At-Large, at this point, have no certain idea if the incident in question has or has not happened ... I'm saying, there's got to be negligence charges or something if there is money lost, that's how capitalism in America works... but this is a Global problem.

If this is how 2017 is pacing, we've got a long year ahead. This is an insanely interesting time to be alive, let alone at the forefront of the INTERNET.

Fellow Hackers, I wish you all the best 2017 possible.

</comment><comment><USER43> I lost all respect for Cloudflare

</comment><comment><USER44> eastdakota 19 hours ago [-] (Cloudflare CEO)

>Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team.

>I agree it's troubling that Google is taking so long. We were working with them to coordinate disclosure after their caches were cleared. While I am thankful to the Project Zero team for their informing us of the issue quickly, I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. We have continued to escalate this within Google to get the crawl team to prioritize the clearing of their caches as that is the highest priority remaining remediation step. reply

taviso 6 hours ago [-] Tavis Ormandy

>Matthew, with all due respect, you don't know what you're talking about.

>[Bunch of Bing Links]

>Not as simple as you thought?

<comment><USER45> Cloud Flares judgement of the situation is obviously compromised. I'm not saying this much thought went into Google's disclosure but they were 100℅ on point in disclosing. There is no way to purge this data from the entire net; it was important for everyone to know what happened as soon as the leak was plugged.

</comment></comment><comment><USER46> If anyone wants to, they can access (cached/archived) pages from any number of services listed here: [https://en.wikipedia.org/wiki/List_of_Web_archiving_initiati...](https://en.wikipedia.org/wiki/List_of_Web_archiving_initiatives#References)

My personal favorites are:

\- [https://archive.fo](https://archive.fo)

\- [https://archive.org/web/web.php](https://archive.org/web/web.php)

\- [https://historio.us](https://historio.us)

\- [https://timetravel.mementoweb.org](https://timetravel.mementoweb.org)

</comment><comment><USER47> I have a question which might be stupid.

What happens for sites using Full SSL (a certificate between cloudflare and the user and a certificate between cloudflare and the server), could any information from ssl pages have been leaked?

<comment><USER48> My understanding is yes - if the https page was in CF memory (for decrypting from server and encrypting for user) its contents could have been dumped to a cache of one of the affected sites.

<comment><USER49> According to CF, they store certificates and cached content separately, so they were not exposed.

<comment><USER50> Right. Clear text data was exposed, not the certificate itself. But who needs a certificate when you have the cleartext?

</comment></comment></comment></comment><comment><USER51> Also still in Yahoo caches with the same leaks found in both Yahoo and Bing. I posted the URLs to the linked thread.

</comment><comment><USER52> Can someone explain why Cloudflare parse the HTML in the first place.

Is there some sort of information extraction feature service or something they offer? I don't get it.

<comment><USER53> HTML, CSS, JS optimization service. Also email obfuscation and scraping shield.

</comment></comment><comment><USER45> As much as CF would like people to believe otherwise (oh and look at our awesome response time and automation!) this cat can't go back in the bag. They should step away from the mic and contact a PR firm that specializes in salvage jobs.

If I were google I would hit back hard. They prob won't just stop, but I would not bother trying to even clean up the data unless under legal pressure. It out there, it's too late.

</comment><comment><USER54> And the "irony" is that some of the data may leaked only to "bad bots" and "IP has a poor reputation (i.e. it does not work for most visitors)."

From their blog: [https://blog.cloudflare.com/incident-report-on-memory- leak-c...](https://blog.cloudflare.com/incident-report-on-memory-leak-caused- by-cloudflare-parser-bug/)

</comment><comment><USER55> Any word on the possibility of credit card numbers having been exposed?

<comment><USER56> Yes, it's possible. Any data that passed througb Cloudflare was possibly exposed.

</comment></comment><comment><USER57> How are people finding this info?

Is it possible to find if anything leaked from my site behind Cloudflare is in the caches?

</comment><comment><USER58> To help with this, I made [https://bleed.cloud/index.html](https://bleed.cloud/index.html)

It lets you run domains quickly without downloading and grepping.

</comment><comment><USER59> Folks, can we please stop downvoting the parent of the linked comment? It's of no use when it disappears from HN.

<comment><USER60> For those who don't know, to read a greyed-out comment you can click on its timestamp to go to its page.

</comment></comment><comment><USER61> This is already a comment on the site, in the relevant thread. Seems a little meta as a post.

<comment><USER4> For what it's worth, in the general case, I think you're right. The only thing that makes this case different to me is that the one comment CF's CEO has decided to make on HN takes a potshot at Google, which is newsworthy --- but if we took every notable comment on HN and put it on the front page, that's all the front page would be.

<comment><USER61> Right, I'm mostly whining about the method - link to grumpy mid-thread comment, title that misleads about the intent of the post, etc.

The thing itself seems somewhat newsworthy but personally, I'd rather hear the CF people defend the TLS-MITM-as-service idea itself and get yelled at for that. The fact they're being weaselly and insufficiently contrite seems secondary.

<comment><USER4> That makes sense. I'm much less interested in the phenomenon of CF-as-global- TLS-MITM than I am in how responsible they are being with the position they've accrued, and handling vulnerabilities like this is a big part of that. So the fact that CF is in a spat with Google is a big deal to me, but I understand that's not the case for everyone.

</comment></comment></comment></comment><comment><USER62> Company engaging in practices that undermine internet security and MITM their users found to be doing stupid shit.

Not exactly breaking news. At some point, maybe people will realise that CF is actively making internet worse and less secure, and that it should be treated as nothing more than a wart to be removed.

<comment><USER63> Every CDN that handles TLS traffic is a MITM.

<comment><USER64> What other CDN makes it easy to use plaintext between the CDN and origin, yet use a secure connection between the CDN and the end user, and has the nerve to market this as a feature called "Flexible SSL"?

Edit: I wasn't very clear. GP is wrong saying MITM is "wrong" for its own sake. I think Cloudflare is harmful for other reasons though.

<comment><USER63> That does seem to be an accurate name, it _is_ a feature that's offered and up to the site operator to enable, and yes it's unfortunate that it potentially gives a false sense of security to end users. However in almost every case, it's still better than both sides of the connection being unsecured.

I'm not sure what this has to do with all CDNs being MITM operators when caching secure content.

<comment><USER64> At the very least, Cloudflare should do a better job of discouraging use of Flexible SSL. People that opt in to Flexible SSL should know what they are doing.

I edited my comment.

</comment></comment></comment></comment></comment><comment><USER65> I just wonder when we can stop beating this dead horse here...</comment>


How the Czechia through community effort got to 100% mask usage in 10 days - <AUTHOR> https://twitter.com/jeremyphoward/status/1242572288962240517 <comment><USER2> I want to go agro on US govt liars who damage trust, try to manipulate people and don't promote honest information.

This wouldn't happen in the US because the prevailing attitude is "everyone for themselves; working together is communism." Oddly enough, parts of the Bay Area experienced "panic buying" of masks in early January: I was at a Walgreens on El Camino in Palo Alto when people were buzzing like bees around masks like they were toilet paper at Costco nowadays. IIRC, it was mostly persons of Asian ancestry because they follow the news and have friends and family overseas; a few globally-aware Caucasians did as well.</comment>


Launch HN: Voodoo Manufacturing (YC W17) – AWS for Manufacturing - <AUTHOR> https://voodoomfg.com/?utm_source=hn <comment><AUTHOR> Hi Hacker News! I'm one of the co-founders of Voodoo Manufacturing ([https://voodoomfg.com/](https://voodoomfg.com/)) in the current YC W17 batch. Voodoo Manufacturing is an automated 3D printing factory capable of producing anywhere from 1-10,000 plastic parts in 2 weeks or less, at injection molding prices. The difference between us and other 3D printing services is that we use lower-end commoditized 3D printers rather than commercial or industrial machines. Today we have 160 MakerBot Replicator 2s. We started Voodoo because we believed these machines were capable of making high-enough quality parts and products for various use cases. Obviously we're not (yet) producing any high-performance parts for airplanes, etc., but we can make cost-competitive hardware components, and surprisingly we make a lot of promotional products (event swag, trophies, memorabilia, etc.)

Since launching Voodoo we've come to realize that traditional manufacturing is still really hard for most people and companies, and definitely falls short when you're producing parts in runs of less than 10,000 units. More than 3D printing, we're excited about the future of fully digital manufacturing -- going from a digital design to physical parts with virtually no upfront costs or overhead. Today we're cost-competitive with injection molding for runs of 1-10k units (the exact cross-over point depends on the part), but our goal is to reduce costs by 90% over the next 5 years, and thus become competitive for runs of up to 100k units. We also believe that 3D printing and other digital manufacturing technologies will continue to improve, from materials to machines, and so over time we'll become capable of producing high-quality and high-performance parts that can be used for more applications.

A couple of projects we've worked on include this current marketing campaign with Dixie ([http://www.crushtomizer.com/](http://www.crushtomizer.com/)) where they're using our API to submit orders to be manufactured and drop- shipped on-demand, and a pet-project where we printed a life-size body model in less than 24 hours ([http://blog.voodoomfg.com/2016/06/10/a-life-size- human-model...](http://blog.voodoomfg.com/2016/06/10/a-life-size-human- model-3d-printed-on-88-printers-in-under-24-hours/)). Today, we've worked with over 1,200 customers, from large brands to small startups, to help people make things that wouldn't be possible or economical with other manufacturing methods. We're excited about all the things currently happening within manufacturing, and are proud to be one of the companies trying to push forward and build a new type of factory, right here in the US.

We'd love to hear your thoughts on what we're doing, what you might want that we don't currently offer, or help you out if you have a project in mind. Thanks so much!

</comment><comment><USER2> How many hours do you have on your Makerbots? I've worn two into the ground, and at around 500 hours things start to "go wrong". Air prints, printer head misalignment, more frequent clogged nozzles, a variety of things. At 1000 hours, belts start to show wear, build plates have noticeable warpage, extruder gears need replaced.

If you can, could you speak to your long term maintenance plan? I was swamped keeping two Rep 2s running consistently, I can't imagine managing a fleet of 160.

In a similar vein, it would be really cool if in a year or so a blog post showed up showing statistically significant numbers about wear on the MBs, percentages of successful prints, why prints failed, etc.

<comment><USER3> I also have had really bad experiences with Makerbots after a few months of moderate daily use. But Makergear and a few others around the same price point have been pretty great so far.

That said, my organization moved on from the consumer tier printers to a few of the higher end ones, so I likely won't have the best input on those anymore.

</comment></comment><comment><USER4> Are you just doing FDM printing or can you also do milling?

I'm very very interested in multiple possible $300-$1000 budget things for both. Edit: Looking at the other comments (I haven't priced anything out using the site yet, scared to do so b/c i don't like drip campaigns), some of my projects might be below this budget using you! Wow!

Is the goal that I use this service to make beautiful enclosures for my projects, or to do all the hardware needs for my project from design to complete?

I've mostly used Oshpark/Shapeways. I was looking into getting a desktop milling machine like an Othermill or Shapeoko, but from my testing they're still way too loud to have in my home office.

Do you cater to one-off things from people like me, or is the hope to be doing mostly B2B?

<comment><AUTHOR> We're just doing FDM today, but in the future we plan on expanding to other 3D printing technologies (i.e. SLA, SLS, etc), and eventually even non 3D printing tech like milling or laser cutting.

If you don't want to submit a form on our website, feel free to either email me at firstname.lastname@example.com.

Exactly, today's cine we'r eonly manufacturing plastic parts, most hardware companies use us to make enclosures, brackets, and other internal and external components. And then prototypes of course as well.

We definitely do one off projects. If you want, you can just upload files to our website Direct Print service and checkout. Those orders leave our factory next business day: [https://voodoomfg.com/direct- print](https://voodoomfg.com/direct-print)

<comment><USER4> Oh this is fantastic. I have a few ESP8266s sitting around bare / in tiny ugly plastic containers, I'd love to finally get them nice enclosures. I'll definitely check out the direct print / your site!

<comment><USER5> Would you mind sharing your schematics for these? Would like to get some nice enclosures for mine too

<comment><USER4> The only schematics I have right now are for an external project from years ago with specific slots for sensors/cables. I haven't made anything for my own projects yet since I considered the enclosure part too expensive and not worth the time, I'm going to rethink that now though.

</comment></comment></comment></comment></comment><comment><USER6> Good to see a manufacturing startup in YC! I'm currently a grad student in industrial engineering and have been working with geometric analysis for manufacturability for around 2 years now.

What types of analysis are you doing on the parts to determine cost? Slicing, orientation optimization, volume analysis, full toolpaths with estimated time?

Does your analysis automatically look at the tradeoff between injection molding and 3d printing for a particular design which was uploaded?

I noticed the current interface requires all parts to be in the same unit. Any chance of a per-part unit selection (while keeping the batch)?

<comment><AUTHOR> We look at object SA, V, and geometry and without slicing estimate print time and material usage. From there we factor in other costs such as machine time, labor, and packing and shipping.

We don't compare to injection molding to calculate price. When we say price competitive between 1 and 10k units, it's based on avg IM mold and units costs. It's pretty hard to find data on that though.

Yeah, good point. We don't yet let users assign different units to different models in the same purchase on our website, but can add that feature!

<comment><USER6> Oh, I follow now. I was going to mention that your site doesn't advertise PIM at all if that's a service offered! I really wish there were readily accessible data sources with pricing in the manufacturing field. Trying to estimate impact and cost savings is a mess without the data.

What kind of internal fill patterns are you using? What are some of the tests which get run in the machines? Do you have any numbers on how accurate the printers are compared to Joe Schmo who just bought his first $1,000 3d printer?

<comment><AUTHOR> I agree, but at the end of the day you need some estimate of what's being manufactured to produce a price. Otherwise, we'd only be able to give you some rough prices per g of material, print hr, and labor...

We very our infill depending on the part, but usually just standard hex. We did have some factory-wide precision numbers which I'd have to dig up. If you interested in learning more feel free to shoot me an email at email@example.com!

</comment></comment></comment></comment><comment><USER7> What made you choose to go through YC a second time after your startup Layer By Layer? Isn't the network there for you after the program?

<comment><AUTHOR> Great question. It was for a few reasons. A lot of YC is still what happens during the batch (Tuesday dinners, office hours, demo day, etc), and we felt those were things that could benefit us. As well, a lot of VCs aren't used to "manufacturing" startups, so we felt that having the YC stamp would provide some nice validation and hopefully make conversations with investors better. Also, YC just naturally pushes you to work so hard for the 3 months your in it that we felt it would also be a net positive. At the end of the day, we determined that if we went through YC and continue to do well, it would be worth it, and if we end up failing, YC won't be the reason.

</comment></comment><comment><USER8> I did a price comparison vs Shapeways of the direct print which was 20 units.

Total cost was $158 for Voodoo and Total cost was $332 for Shapeways.

Is it true that you guys are cheaper and any reason why?

<comment><AUTHOR> We are definitely cheaper! I don't know if you compared to the Shapeways PLA option, but that's actually us doing the fulfillment ;)

We're cheaper than other 3D printing services because we took a different approach and use lower-end commoditized 3D printers, rather than commercial or industrial machines. The machines we use are cheaper, and use cheaper (open) materials, and require cheaper maintenance and repairs. We're also optimized for volume and cost-reduction as a company, where as Shapeways is more optimized for variety and low-volume orders.

</comment></comment><comment><USER9> "we make a lot of promotional products (event swag, trophies, memorabilia, etc.)"

Is there a gallery of products you've made? Also, do you do your own drop- shipping?

Looks cool!

<comment><AUTHOR> Thanks! You can check out some case studies on our website ([https://voodoomfg.com/case-studies](https://voodoomfg.com/case-studies)). Also, our Instagram account has a bunch of product photos ([https://www.instagram.com/voodoomfg/?hl=en](https://www.instagram.com/voodoomfg/?hl=en)).

And yes! We drop-ship right from our factory in Brooklyn.

</comment></comment><comment><USER10> We use 3D printing extensively, for large sized parts, and there are very few options out there.

Consider buying a few machines that can do very large parts. We would use you literally today if you could do that. It's a very underserved part of the market.

I'm talking apx 700mm x 400mm x 300mm

<comment><USER6> Does it have to be a single piece, or is partitioning it into smaller chunks an option? There are a number of academic papers on cutting models to fit inside the build box constraint of 3d printers, though I'm not aware of any nice, automatic, commercial options right now.

<comment><AUTHOR> Thats' a great point. We've actually done a handful of projects like that. Here's an example: [http://blog.voodoomfg.com/2016/06/10/a-life-size-human- model...](http://blog.voodoomfg.com/2016/06/10/a-life-size-human- model-3d-printed-on-88-printers-in-under-24-hours/)

In many cases, when you cut up a model like that you can actually print it faster and cheaper than on a large format machine.

</comment></comment></comment><comment><USER11> I just got one of the Voodoo manufactured "coffee stoppers" from [http://www.crushtomizer.com/](http://www.crushtomizer.com/) in the mail!

<comment><USER11> We also use them to print keychains [http://imgur.com/a/yGbFv](http://imgur.com/a/yGbFv)

</comment></comment><comment><USER12> I noticed you guys don't ship to Canada - any specific reason why? Also your user edit page appears to be broken - [https://voodoomfg.com/users/edit](https://voodoomfg.com/users/edit), click update, drops to a blank white page

</comment><comment><USER13> This looks great! I myself just bought a chinese 3d printer to prototype some parts. One thing I noticed was QA was difficult. If I did a run of 10k parts, how would you QA them?

<comment><AUTHOR> We are able to get more consistent prints than a lot of people using their own printer, mostly because we've been able to build a lot of process around maintain and operation. So, for a given part, we'd make a sample for you to get approval, and then use that as spec. We regularly test printers to make sure they're operating normally.

<comment><USER13> Great! Sorry I didn't know whether or not to post to the root. I noticed you only had PLA and TPU materials. Is ABS in the works? My project required waterproofing and more strength than PLA.

<comment><AUTHOR> Definitely in our roadmap! Until then, we can also print with PLA++ (a stronger PLA), and have done some projects in nylon if that would work for you.

</comment></comment></comment></comment><comment><USER14> This is a really cool approach to make 3d printing affordable! I'm one of the cofounders of Rolling Cube (rollingcube.in), an Indian startup in the digital manufacturing space. We're trying to make traditional manufacturing convenient and accessible to everyone, starting with laser cutting, and would love your feedback on the concept.

<comment><USER15> If it meets the guidelines, this may be better submitted as a "Show HN".

[https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

</comment></comment><comment><USER16> I bought $50 in prints from you last spring! Everything went very smoothly. Good luck!

I own a Taz2, but it's nice to have somebody else handle the printing every once in a while.

</comment><comment><USER17> What's the pricing like? Or is it quoted per order?

<comment><AUTHOR> Quotes are based on the specific model. You can upload a STL or OBJ to our site to see what the price is for our Direct Print service (low volume). For high volume orders, sometimes the price is slightly different since we quote more accurately and can sometimes make optimizations. Generally things can cost as little as $0.25 and pretty much go up from there.

</comment></comment><comment><USER18> Really cool! I signed up for your mailing list, eagerly awaiting when you can offer materials other than plastic.

<comment><AUTHOR> Thanks! What type of materials do you want or need?

<comment><USER18> I know this is a huge stretch, but I would love to prototype some shapes out of... mycelium: [https://3dprint.com/7279/3d-print-fungus- mycelium/](https://3dprint.com/7279/3d-print-fungus-mycelium/)

<comment><AUTHOR> haha, definitely exotic, but we've actually printed with an algae filament before. It smelled kind of weird printing!

What are you interested in making? Feel free to shoot me an email at firstname.lastname@example.com if you want to discuss further.

<comment><USER18> Hey Jonathan, I'm interested exploring making mycelium media modules (how's that for alliteration?) for aquaponics. I've blogged about it here: [https://blog.automicrofarm.com/mushroom-media- adventures-2e2...](https://blog.automicrofarm.com/mushroom-media- adventures-2e2cb388c670#.uxqxg4fr3)

I'll email you later today to discuss further details. Thanks!

<comment><AUTHOR> Looking forward to hearing more!

</comment></comment></comment></comment></comment></comment><comment><USER19> Did anyone else think of 'OMFG' in the URL? I.e. I read it as 'Voodoo OMFG'

<comment><USER20> Yep, we definitely saw that about 4 months after founding the company!

</comment></comment><comment><USER21> How do you compare to protomold?

<comment><USER20> We can make plastic parts at the same volumes but without the mold startup cost (that is how we are cost competitive). Because we don't need to machine a mold out of aluminum, we can get started immediately from your digital file.

Because we work from digital files, we can do a lot of other fun things like customize every object to be slightly different! It's all about zero spin-up cost and time!

</comment></comment><comment><USER22> Please consider adding support for international shipping.

</comment><comment><USER23> Why no .SLDPRT support?

<comment><AUTHOR> Our quoting engine needs a mesh file to estimate price from. As well, all of the 3D printer compiles need the same... It should be easy to export your model as a STL or OBJ though!

</comment></comment><comment><USER24> Please develop a different, self-degrading material - we already have too many plastic material in the ocean and it _is_ a major problem - you certainly did read about it, this is commonly known nowadays. I wonder how anybody would build a new business on the idea of flooding the world with even more poison.

<comment><AUTHOR> The material we use, PLA, is actually biodegradable! It would take a while naturally, but can be done easily with industrial equipment. We also recycle all of our scrap material back into filament :)

<comment><USER24> Sorry, but that is just greenwashing.

[http://www.mnn.com/lifestyle/responsible- living/stories/biod...](http://www.mnn.com/lifestyle/responsible- living/stories/biodegradable-plastic-what-you-need-to-know)

Here is a german study you might be interested in (needs to be translated):

[http://www.umweltbundesamt.de/presse/pressemitteilungen/biok...](http://www.umweltbundesamt.de/presse/pressemitteilungen/biokunststoffe- nicht-besser)

Conclusion: "bio" plastics are not better in any way.

Especially PLA from genetically modified corn is not a good solution, sorry.

To reduce the amount of harm you are doing to the planet with that mass production facility should build a safe recycling chain for your customers until you find some less destructive way to make money.

To the HN techno-blinded crowd: downvoting these facts does not produce a better health for your children.

Growing up and becoming an adult also means being able to take responsibility for the future. But, yeah, Trump on, Amerrica!

<comment><USER25> Please don't post like this here.</comment></comment></comment></comment>


Show HN: Microquest – CLI to gamify anything - <AUTHOR> https://github.com/trqx/microquest <comment><USER2> Neat I guess, but doing it all manually seems to be the only option? Feels like a chore just looking at it.

How about wrapping each PS1 (?) in the "mq" command and automatically look for stuff?

Or even just running some "mq auto" after each command that looks at the previous command - and if it hits certain things like "git commit" or whatever it would automatically complete that quest or however it works.

<comment><AUTHOR> > How about wrapping each PS1 (?) in the "mq" command and automatically look > for stuff?

see an example here: [https://github.com/trqx/microquest/tree/master/contrib/bash-...](https://github.com/trqx/microquest/tree/master/contrib/bash- quest)

it is not pretty, and slows down the prompt but it shows it's doable with a wrapper.</comment></comment>


Winners of HTML5 Gamejam - tomh- http://googlecode.blogspot.com/2010/11/html5-games-jammed.html

<comment><AUTHOR> I click on the HTML5 winner and I am presented with a Flash square. How is that HTML5?</comment>


ECMAScript 6 - <AUTHOR> http://rauchg.com/2015/ecmascript-6/ <comment><USER2> You can't deny that ECMAScript 6 has given some much needed CPR to the Javascript language, but I think we have yet to see the true potential of Javascript discovered. I love the addition of modules, classes and all of the other new additions to the spec including my favourite => arrow functions. Small steps towards being a half-decent language.

I am already thinking ahead, ES7 is definitely going to be the pinnacle of the language I think. The implementation of a native Object.observe() means we will not have to worry about poor implementations in SPA frameworks like Angular that currently use dirty checking and other hacks to make up for the lack of native object observing. Lets hope the yearly release cycle proposed for Javascript specifications means ES7 happens sooner rather than later.

We have classes in ES6 (which is great), but they are currently nothing more than syntactic sugar over the old tried and tested prototypical inheritance. There are plans to add statics, private/public variables and classes to further extend them beyond just eye candy which they currently are. Plus Async/Await, Typed Objects, etc. There are also plans to better supported multithreading without the need to use WebWorkers which are pretty limited in their use.

Get excited. ES6 is only the beginning of a great suite of changes coming to Javascript. We'll eventually weed out the hacks and non-pretty parts of Javascript one specification at a time.

<comment><USER3> The changes you're hoping for sound like turning js into a java/c# kind of language

<comment><USER4> JS5 was nice, but the ES6 direction is increasingly driven by people who come from the C#/Typescript and Java compiler front. Was it really necessary to add "class" syntactic sugar? Some of the new ES6 and new Rust1.0 syntax additions seem to be driven by the Ruby/Python/Scala front and don't look like proper C/C++/JS/PHP syntax. Hopefully ES7 doesn't get the verbose syntax of Java/C#. If people want syntax XY they should use a transpiler to JS or emscripten & asm.js.

A good example is Facebook's Hack language that improve PHP in a sensible way and adds optional typing - something that would be great for ES6/7.

<comment><USER5> > _Was it really necessary to add "class" syntactic sugar?_

Yes. Now your editor/IDE knows that that _thing_ is supposed to be a class. The doc generator also knows that it's a class. Furthermore, this makes things more compatible since framework A and library B use the same kind of classes.

Finally, it means that you won't have to waste time with evaluating a dozen semi-popular options to handle classes/inheritance.

It does of course also make your code a lot easier to read and it makes it easier for new developers who used some other language with classes before.

> _Hopefully ES7 doesn 't get the verbose syntax of Java/C#._

I recommend to take a look at TypeScript and Dart. Optional types aren't verbose. You just add some types to the surface area, which, compared to JSDoc, is _drastically_ less verbose. Inside functions, you can generally omit the types.

<comment><USER4> It's a pity that optional types are still missing in ES6. As I wrote:

 _A good example is Facebook 's Hack language that improve PHP in a sensible way and adds optional typing - something that would be great for ES6/7._

In comparision the Java/C# type is static at compile time. Newer C# version have like e.g. Visual Basic 6 a variant type that is a tradeoff (as wasteful as a "union struct" in C).

The class syntax in ES6 is just syntactic sugar. JS IDEs like WebStorm/PHPStorm/IDEA already can parse "classes" with JS5 syntax .

But what about the _arrow syntax_ :

      var odds = evens.map(v => v + 1);

Or the iterator syntax that ES6 got from TypeScript:

      interface Iterable {
        [Symbol.iterator](): Iterator
      }

</comment></comment></comment></comment></comment><comment><USER6> ES6 is especially nice with D3.js:

        .attr('transform', function(d) { return "translate(" + (d.x + 1) + " 0)"; })

becomes:

        .attr('transform', d => `translate(${d.x + 1} 0)`)

And:

        .attr({x:x, y:y, width:width, height:height})

        .attr({x, y, width, height})

<comment><USER7> I've been writing TypeScript exclusively for so long, I forget most devs are still using the old syntax.

<comment><USER8> Same here, except with CoffeeScript.

<comment><USER9> But coffeescript doesn't even look like JavaScript. How could you confuse them?

<comment><USER8> Several ES6 features very much resemble the few ways coffeescript syntax differs from older versions of ecmascript. Arrow functions, destructured assignment, string templates.

In context, we were commenting on this:

        .attr('transform', d => `translate(${d.x + 1} 0)`)

which looks pretty similar to the coffeescript counterpart:

        .attr 'transform', (d) -> "translate(#{d.x + 1} 0)"

Five subtle differences, but it shows how the things that are new/different about ES6 are more similar to typescript and coffeescript than ES5.

</comment></comment></comment></comment></comment><comment><USER10> I'd just like to point out this is like the fourth post in the last 24 hours in the front page to mention the babeljs transpiler.

While transpilation was possible with Traceur before - babel has made it really easy and the fact issues are addressed within a day and the author is an overall great guy really helps.

I've never been able to fully switch to Traceur - but ever since babel (used to be 6to5) came along I've made the switch and never looked back.

<comment><USER11> I like Traceur (at least with tools like System.js & jspm), especially with its support for optional typing and annotations, but for some apps, Babel makes a lot more sense.

I came across the difficulty of using jspm on the server and client for an isomorphic React app I am building for an online community I run, and I was advised to just use npm (& naturally Babel). Integrating browserify with babelify into the build process was a far easier task.

<comment><USER12> OT, but I have to ask, do you use the flux pattern and if yes, any helper implementation?

<comment><USER11> A bit OT response here.

I do not use the Flux pattern currently, but I am only in the beginning stages of building out this app & am inexperienced with React, and I have to coordinate getting others in this community involved too (two beginner/junior developers & a mid-level/senior developer, and 2-3 artists/designers, none with web designing experience). I have not evaluated how I want to handle state changes yet - I may just go with the Flux pattern for practicality for the beginner/junior developers' benefit career-wise.

This app is being built on io.js with Sails.js, isomorphic React, and ES6 (server and client) - I went with React because of its ability to do client- side and server-side rendering for SEO purposes. I have a working isomorphic React foundation, and working testing solution for the React code, but I still have to get a server-side testing solution up, integrating optional Steam authentication via OpenID, and figuring out build & deploy tooling into separate environments. This is on top of gathering requirements from the community & organizing it into a nice functional spec for developers to consume...it is almost like creating a startup except that it will never be for money, only for the love of the community I created ~7 years ago as a part of a larger one.

<comment><USER12> Thank you very much for the detailed explanation. I once tried Sails and didn't find it easy (or was it even not possible at all) to configure relations for my models found on a PostgreSQL db. Do you have any plans to open-source the "foundation"? I'd be interested to see how you structured it.

<comment><USER11> Honestly, it wasn't all that bad - I had to do a little customization in the app.js script that gets generated on creation of a new Sails.js scaffold (added require('babel/register') before var sails = require('sails') ), and then created a simple browserify grunt task & inserted it into the pipeline. I hijacked the views folder for all of my React code, and exposed every React component via a top level script, including the router, so I could make use of all of them for custom code in both the server and client.

For the models with Sails, I haven't touched that yet - the plus side for me is that there is no schema yet, so I am still free to set everything up in the database as I wish. If you need to configure relations, there are details listed here: [http://sailsjs.org/#!/documentation/concepts/ORM/Association...](http://sailsjs.org/#!/documentation/concepts/ORM/Associations) (check the types of associations listed in the sidebar on the left)

</comment></comment></comment></comment></comment></comment><comment><USER3> Can anyone explain the forwards compatibility plan for es6? I get we can transpile, but that's not a gradual strategy for converting code. Since you can't polyfill syntax, are we just supposed to all transpile until some far flung day when browsers without es6 support finally reach some tiny percentage?

Is the assumption now that browsers largely auto-update that it won't be so long before that happens? Why are breaking syntax changes not a big deal, whereas "use strict" was done as a string so older browsers would ignore it?

Edit: backwards compatibility -> forwards

<comment><USER13> The only backwards compatibility breaking change I know of is that function declarations are scoped block level in EcmaScript 6 (which I think has been renamed to EcmaScript 2015), not function scope which is what they have been since the beginning, but they're only block level if you use "use strict"; for the foreseeable future and if this change breaks things for you you were writing really terrible JavaScript to begin with.

<comment><USER3> Sorry, I meant forwards compatibility

</comment></comment></comment><comment><USER14> I really like destructuring, but I worry about arrays becoming popular for multiple returns. If I'm using some other module, I _really_ don't want to have to remember the order in which the parameters come, or be forced to check documentation or implementation to know for sure.

With an object, I can use a console log or a debug break point and immediately see the key value pairs (hopefully well-named) without having to check the function implementation or docs to see in which order the authors decided to return (or yield, etc.) values.

Can we just agree now not to use array destructuring as an excuse for returning multiple disparate values in an array? Or at least in only some idiomatic form? [error, value] would actually make sense to me, as it follows popular Node conventions.

<comment><USER6> It's not a problem if you use objects, and the syntax is essentially the same:

        const {error, value} = (function(){
            return {value, error};
        })();

<comment><USER15> What, seriously, the names of your variables matter? And this is seen as a good thing?

<comment><USER14> Absolutely they do. That's the major benefit of object orientation: named properties and methods.

Otherwise, we fall into exactly the "boolean trap" that the author links away to. [1]

[1] [http://ariya.ofilabs.com/2011/08/hall-of-api-shame- boolean-t...](http://ariya.ofilabs.com/2011/08/hall-of-api-shame-boolean- trap.html)

<comment><USER15> properties and methods, yes. But I am not familiar with any other object- oriented language (is JS one now?) where the names of local variables matter. I mean, is 'local' even the right word, when the names chosen as references have semantic impact outside the local scope?

<comment><USER16> I'm not sure why you think local variable names are mattering here...

What's happening is that this expresion:

        const { error, value } = obj;

where obj is an object will assign obj.error to error and obj.value to value.

You could name your locals something else if you wanted, of course:

        const { error: myError, value: myValue } = obj;

will assign obj.error to myError and obj.value to myValue. There just happens to be a shorter syntax for the common

       const { error: error, value: value } = obj;

case.

<comment><USER15> Ah, it's a slice, I get it now, thanks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> For those of you who want some longer read on ES6 there's a work-in-progress (but already quite informative) book from Nicholas C. Zakas, available for free on github:

[https://github.com/nzakas/understandinges6](https://github.com/nzakas/understandinges6)

</comment><comment><USER18> I think that it's outlandish and silly that ES6 doesn't have a safer, more sound philosophy about type systems, e.g. like the elegant and rational one in TypeScript today.

The web needs increased consistency and cohesion in the HTML/CSS/JS triumvirate.

ES6 seems like a grab-bag of neat and fun new features that end up doing a whole lot of nothing for large projects that have to care about more tangible concerns than nicer ways to create anonymous objects.

Some of the new features of ES6 - Symbols, proxies, Object.observe, et cetera - seem to make it downright easier to write even more confusing code. Instead of increased rigor and tools for building better software, we get stuff like this:

      let obj = {
          ["h"+"ello"]() {
              return "hi";
          }
      };

      obj.hello();

While I think it makes sense to stick with TypeScript for the foreseeable future, I do look forward to The Next JavaScript.

However, I can't help but wonder if that's due to a mild case of Stockholm Syndrome setting in.

<comment> vertex-four > Some of the new features of ES6 - Symbols, proxies, Object.observe, et > cetera - seem to make it downright easier to write even more confusing code.

Actually, they're things that actual users of javascript have been asking for (and implementing hacked-up solutions for) for a long time. There's a reason Coffeescript is often referred to as "a better javascript" and Typescript is considered its own thing.

Javascript is a dynamic language, and will never make the transition to a static one. Its users don't want a static language - the people who want a static language are using things like TypeScript.

<comment><USER19> I somewhat agree and consider moving to TypeScript a bit risky as it seems like it'll end up a niche but I do think sensibly added typing code improve JavaScript. I want better tooling support, refactoring support, intellisense...and languages like Dart/TS seem to me to have shown its possible to do this without throwing out the dynamic aspects.

</comment></comment></comment><comment><USER20> I've been writing most of my Javascript in ES6 recently and I agree that it's simply fantastic and still has a lot of potential to be explored when it comes to creating modern apps and frameworks. My main problem is that we're going to be stuck using transpilers for quite a while as by the time all of the browsers finally[1] catch up to ES6, ES7 will be released. Unfortunately, there's not much we can do about slow vendors.

1 - [http://kangax.github.io/compat- table/es6/](http://kangax.github.io/compat-table/es6/) (Note: Opera, Safari, and iOS8)

<comment><USER21> I wouldn't be quite so pessimistic. ES6 isn't finished yet- and I'd say it would be expected for some vendors to take another 6-12 months to add all new features after a finished spec is published.

This is pretty much what happened with ES5, right?

<comment><USER22> > and I'd say it would be expected for some vendors to take another 6-12 > months to add all new features after a finished spec is published.

And what happens with browsers on older mobile phones that cant be upgraded ? you let your scripts stop working ?

If you think you can switch to ES6 in 6 month without any kind of transpilation, while keeping a good browser compatibility good luck ...

> This is pretty much what happened with ES5, right?

No,5 years after the launch of ES5 some browsers like Safari still didn't support some ES5 features. And some browsers on handsets will never support ES6.

<comment><USER21> 6-12 months was a bit optimistic (I thought ES5 was released in 2011, in fact ES5 was released in 2009 and ES5.1 in 2001) for vendor adoption I'll admit. Still, I can't imagine waiting more than 2-2.5 years for perhaps 80-90% of browsers supporting virtually all of ES6.

> And what happens with browsers on older mobile phones that cant be upgraded > ? you let your scripts stop working ?

If I was absolutely worried about browser support on older mobile phones, I'd be still writing vanilla JavaScript with no features that aren't in Ecmascript 3. You'll have to drop support eventually. Plus, it's very likely a good chunk of the ES6 I'll be writing will only ever be intended for running in browsers that support other cutting-edge features like WebGL, Web Workers and WebRTC, or on a fairly up to date environment like iojs or node.js.

> No,5 years after the launch of ES5 some browsers like Safari still didn't > support some ES5 features.

I'm not sure which features Safari is missing that you're referring to. Safari on both iOS and OS X are missing a lot of Javascript APIs, but both have fully supported ES5 since at least 2011 [0], and my old Macbook with Safari 5.1 has no problems running modern websites.

> If you think you can switch to ES6 in 6 month without any kind of > transpilation, while keeping a good browser compatibility good luck ...

A lot of ES6 features are already being polyfilled (Typed Arrays have been polyfilled for years), plus you can use try/catch to support new syntax whilst also supplying some sort of fallback.

[0] [http://kangax.github.io/compat- table/es5/](http://kangax.github.io/compat-table/es5/)

</comment></comment></comment></comment><comment><USER23> That view counter is too distracting.

<comment><USER22> noscript and it's gone.The most annoying thing however is the monospace and serif font which makes the page painful to read.

<comment><USER24> I find monospace fonts easy to read. I write code all day using a monospace font.

</comment></comment></comment><comment><USER25> If you want a more extended summary of ES6 features, Axel Rauschmayer's "Using ECMAScript 6 today" is pretty good: [https://speakerdeck.com/rauschma/using- ecmascript-6-today](https://speakerdeck.com/rauschma/using-ecmascript-6-today)

</comment><comment><USER26> _"...we must embrace the moving target..."_

...or use a better language.</comment>


Wall Street is insane: Idle TV chatter leads to 11 percent Netflix stock surge - <AUTHOR> http://www.itworld.com/mobile-wireless/238071/netflix-shares-soar-because-analyst-floated-yahoo-buyout-idea-tv-seriously

<comment><USER2> glad I'm not in the market</comment>


What Happens to Markets When You Print Trillions of Dollars - <AUTHOR> https://medium.com/concoda/this-is-what-happens-to-markets-when-you-print-trillions-of-dollars-615574dac796 <comment><USER2> The economics field is not very well developed. It's a social science where experiments can't be reproduced.

The intuitive answer to the title is that the PRICE of dollars goes down. But that may not be the case. It depends on where the money goes. Perhaps it all goes into securitites or btc thus increase the price of those assets.

</comment><comment><USER3> Sooner or later you find yourself too far down the Zimbabwe Highway to do a U-turn.</comment>


Why use REST? - <AUTHOR>

I'm building an app in rails for a niche market. I don't plan on offering any kind of API or support content types other than html (no demand for them).<p>I've read several articles on REST and can see how they would be of benefit to larger web apps with APIs, but as a sole developer working on a small project, is there any point in me using a RESTful approach? <comment><USER2> If your project stays as you describe it, REST isn't crucial. Given that you're using Rails, though, it's just as easy to do it as not do it, as idiomatic Rails automatically enforces that architecture and gives you API support "for free." Why fight against the framework?</comment>


J for C Programmers - <AUTHOR> http://www.jsoftware.com/help/jforc/contents.htm <comment><USER3> I'm sorry, as someone who used APL professionally for about ten years J simply fills me with an urge to defecate. It is an absolute abomination. It left behind the power of notation as a tool for thought and turnd the concept of APL into a pile of giberish on a page.

[http://www.eecg.toronto.edu/~jzhu/csc326/readings/iverson.pd...](http://www.eecg.toronto.edu/~jzhu/csc326/readings/iverson.pdf) Where are APL and J? For the most part, dead. Sure there are people using them. If someone like me who used the language almost exclusively for ten years hasn't touched it for two decades I think it is safe to say: Great language to learn. Powerful and fantastic concepts. But, no thanks. Happy with C, C++ and Python.

The failure to open source a good APL didn't help either.

If J-Software wants to make a last valiant effort to bring this back my opinion is simple: Read the paper linked above and go back to the roots. Extend the language to make it object oriented and create interfaces to C, C++ and Python. That's a start. I could write a paper on how to improve APL. It has to start with a commitment to moving software engineering into the realm of communicating through notation rather than cryptic text.

<comment><USER4> What's interesting to me is how, as I've started to really look into things like J or K, I've begun to appreciate the whole "cryptic text" side of programming while rebelling against the more verbose OOP/whitespace delimited code. Sure, initially it might look like some C code started printing out random data beyond the end of an array, but as I've started to study it, it really has started to make more sense to me to use this highly condensed form of programming. I've even begun to toy with the idea that the original creator of K uses wherein he hates scrolling, so all his code is organized into a few small files so that he doesn't have to scroll any of them. At least one of the benefits of this kind of coding are that you can easily see and reference everything that is used, since your eyes only have to move a small distance and you don't have to scroll 500 lines to see the definition of whatever you're trying to look up. I also feel like it promotes a simplicity, due to it promoting dense, terse code, you really need to make sure what you're writing is the simplest possible to fit into a small amount of text.

Anyway, I'm not saying you have to personally like something such as J. If you're productive in C/C++ and Python, by all means create things in those languages. But please don't call J an absolute abomination, as I believe it merely calls coders with a different mindset/aesthetic desire to code in it.

<comment><USER5> After reading a lot of K code I had the same experience, where word-based programs now read like someone from the Slow Talkers of America.

Learning APL, I was skeptical of its symbolry. But, by avoiding (verbal) mnemonics the symbol becomes its own thing, it has very specific meaning that is unique to APL. I can see the value in manipulating those very precisely understood symbols once a person knows the language cold.

J however remains above my pay grade.

<comment><USER4> Out of curiosity, what are you doing that you end up reading a lot of K code?

</comment></comment></comment></comment><comment><USER5> I've been struggling to learn J for a few weeks, and there are several things that make it difficult.

1) Lack of spaces in the majority of code make it difficult to lex let alone parse, meaning I can't tell what the operators are. When people use spaces it makes a difference.

2) Every operator has at least two meanings. Some have three meanings. That's more than 100 operators to memorize and 50 share the same spelling as the other 50.

3) The parsing rules as described strike me as extraordinarily complicated.

The ideas in APL are worth learning. For example striping objects and using grade up to make a concordance or annotate any other data structure. Another example is having the primitives auto-sort collections when searching to get nlogn complexity. Almost any language can use these ideas. If Python is one step up from Standard ML because of dicts and out-of-the-box primitives, then APL is one step up from Python.

If anyone who knows APL well is around, can I ask some simple questions?

1) Do user functions and if statements vectorize? Meaning, if I write a recursive function to implement Euclid's GCD and then pass it two arrays, will it give an array of pairwise GCDs?

gcd(a,b) = if b=0 then a else gcd(b,a mod b)

where = and mod are both vectorized APL primitives.

2) Why do I see so few user functions being used? I would expect application code to consist mostly of specific functions but instead I see line after line of unbroken primitive operators.

(EDIT: fixed formatting.)

<comment><USER6> _Do user functions and if statements vectorize?_

In J, user-written verbs have rank _ _ _ (infinite for both unary and binary cases) by default, but you can rerank them with the " operator just like any built-in verb.

 _Why do I see so few user functions being used? I would expect application code to consist mostly of specific functions but instead I see line after line of unbroken primitive operators._

Lots of purpose-specific functions can be built using composition forms on built-in verbs. The resistance to naming sub-pieces of these compositions is largely a cultural thing but still a point of dispute within the community -- some are very much in favor of giving descriptive names to intermediate results.

<comment><USER5> I imagine that making user functions would require leaving the one-symbol-one- function spelling system that J programmers are accustomed to, and that spelling system is part of the appeal. Also, if the idiomatic form with primitives is shorter than the name, it's tough to consider the name an improvement. :)

Thanks for your response.

<comment><USER6> Yeah, some things are so common and small as to not merit their own name except in a tutorial. It might be fun to try using those to construct really garden-pathy code. Stick the fork `+/%#` (average when used on its own) somewhere in a train, but use the dyadic case, or position it so that parsing splits it up.

<comment><USER7> I found that it quickly becomes a mess with tens of parens when you try to do this. Parsing rules of J are complex and the same sequence of symbols can be parsed in a couple of different ways depending on the context - it's good to keep expressions very short to avoid this.

</comment></comment></comment></comment></comment><comment><USER8> This is what Fibonacci looks like, apparently

        f1a=: 3 : 0
         {. y f1a 0 1x
        :
         if. *x do. (x-1) f1a +/\|.y else. y end.
        )

        f1b=: {.@($:&0 1x) : ((<:@[ $: +/\@|.@])^:(*@[))

I think I have PTSD already just from reading this stuff.

<comment><USER9> Hmm, that is pretty ugly compared to its APL derived cousins in Q/K/KDB...

      /first n+2 numbers of fibonacci sequence

      fibonacci:{{x,sum -2#x}/[x;0 1]};

And then...

      q) fibonacci[10]

      0 1 1 2 3 5 8 13 21 34 55 89

I haven't seen much J before, is that really the best implementation?

<comment><USER7> There are some other example implementations here:

[http://www.jsoftware.com/jwiki/Essays/Fibonacci%20Sequence](http://www.jsoftware.com/jwiki/Essays/Fibonacci%20Sequence)

This:

f0b=: (-&2 +&$: -&1) ^: (1&<) M.

is probably the most elegant solution. It's recursive ($: stands for "self- reference"), memoized, and it works:

f0b&.> i.20

│0│1│1│2│3│5│8│13│21│34│55│89│144│233│377│610│987│1597│2584│4181│

</comment></comment></comment><comment><USER10> I think the key idea behind APL and J is that they take one fundamental data structure, namely arrays of arbitrary rank containing characters, numbers or boxes, and define a number of operations on them, each of which has a natural mathematical definition and satisfies a number of laws. For example APL has at its core combinators ι ρ φ ⊤ , . \ / and a number of binary and unary operators.

To give an example, / is like fold in a functional programming language, so +/ would be fold (+) in Haskell, there fold (+) :: Foldable t, Monoid m => m t -> t. However you would have a hard time implementing J like arbitrary rank arrays in Haskell efficiently and supporting all the operations it does.

The philosophy of J and K is to isolate the essential operations and laws the data structure you are trying to manipulate has and to implement an interpreter for those operations that is as efficient as possible. This is in contrast to a conventional general purpose language that tries to implement a sufficiently smart compiler and primitives to create new data types from a set of primitives ones. The problem is that it is quite hard and sometimes impossible to teach the compiler retroactively about all the nice properties your newly defined data structure has.

I believe several such domain specific interpreters/compilers could be "stitched together" into a general purpose language, maybe integrated by a system specialised in symbolic computation. Instead of compilation to machine code the top level system would compile down to the base operations for each data structure and simplify according to the laws the base operations satisfy. Haskell and many other do that by compiling down to a Core language and then applying a huge number of simplification passes on that intermediate language.

</comment><comment><USER11> Now I've gone and installed J and started playing around. I'm doomed.

Just the most basic stuff is pretty nifty: [http://www.jsoftware.com/help/learning/01.htm](http://www.jsoftware.com/help/learning/01.htm)

</comment><comment><USER12> Perhaps the hope with J was that symbols could create a grammar for concepts. In maths we use intuition to define an integral as a certain kind of summation, a progressive difference as a certain kind of derivative, and so on. I was thinking that perhaps J symbols could create some form of grammar that suggest new concepts from primitive ones. But the language for me don't provide me with that kind of thinking and at the end is simply a way of writing code that is cryptic and difficult to understand. The idea of using a language with automatic vectorization is orthogonal to the syntax of J.

Haskell is different, the concepts of monad, category and so on allow you to obtain a higher order view of your ideas, to frame them in a different concept, that is experience that expand your concept of programming, I don't experiment that feeling with J, I paid the price to learn the vocabulary and grammar, but I don't think the language is worth the effort.

<comment><USER13> Thanks for sharing your experience!

</comment></comment><comment><USER14> A question. I've played with J a bit, but I haven't had the "burst of enlightenment" that some suggest will come (ala lisp/haskell/etc).

My hypothesis based on a few conversations: the "burst of enlightenment" is treating problems like "applied math" rather than computer science. I.e., "first represent as a vector, then do linear algebra, iterate this process until < epsilon". Since I already do this in Python/Julia/Mathematica, J just feels like a variant with esoteric syntax.

Possibly my problem is that I'm simply programming Python in J. Can anyone with deeper knowledge of J confirm/deny this?

<comment><USER15> Can you rephrase your question? What you want to confirm or deny?

<comment><USER14> Is the "enlightenment" one gets from using J based on vectorization and linear algebra as everyday tools (much like numpy) or something else?

<comment><USER15> Linear algebra - I wouldn't say so. Vectorization - yes, to a certain extent; whenever you'd have a loop, you have to remind your self that it's implicit - and that forces you to think about the collection as a whole instead of a single element of the collection. Sometimes there is apparently no collection to begin with. That, in turn, makes you think why - is it actually correct, do you have a good design?

In J it's much more natural to load a whole dataset into memory and then work with it as a whole. To make it easier, you're strongly nudged to design your data structure simply and uniformly. Thinking about clarity of data structures has many advantages - e.g., clearly seeing the algorithm as a whole, being able to pinpoint (and question) exceptions, optimize on the high(est) level...

That doesn't mean J can't do sequential processing - but if you choose that, you want to understand why: is it the nature of the problem or is it a (questionable) implementation detail?

Some start learning J by using it as a calculator. Indeed, what could be easier in the beginning - typing 2 + 2 <Enter> produces expected result, same for 3 * 4 and 5 - 1, then you have built-in exponent (^3 produces 20.0855), logarithm (^. 20.0855 - kinda easy to remember, an inverse function), factorial (!6 makes 720)... Gradually it becomes less conventional - order of operations is always right-to-left (as in sqrt(sqrt(sqrt 2))) - that would be %: %: %: 2), negative numbers look like _1, _2, _3, sine and cosine are in the family of o. functions - 1 o. 1.5 gives 0.997495, 2 o. is 0.0707372 - <USER2> you're also allowed something like 5 + 1 2 3 which returns 6 7 8. A few more iterations - and you can use moderately complex expressions with infix notation, typing quite economically. Then vectorization gradually grows in more complex expressions...

<comment><USER14> So concretely, consider the following problem. I'll tell you the python way, maybe you could tell me the J way. I want to simulate a random walk, run a statistical test on it at each time, then find the first time when the test returns positive.

In numpy:

        data = cumsum(bernoulli(p).rvs(1024*16))
        test_statistic = special.xlogy(data, p) * ... other stuff...
        first_pos = where(test_statistic > b)[0][0]

bernoulli(p).rvs(1024*16) generates a random array of the form [0,1,0,0,1,0,1], and where(...) returns an array of places where the condition is true.

If we translated this code to J, would it be idiomatic?

(Incidentally it does happen to be wildly inefficient - a simple for loop (in C) with no arrays is about 100x faster.)

</comment></comment></comment></comment></comment><comment><USER16> I am convinced that the J programming language is an elaborate hoax. I just don't understand how anyone is falling for it.

<comment><USER17> I feel the same way about Haskell and Monads.

<comment><USER18> It's true: everything you don't already intuitively understand is just a prank, and everyone who claims to get it is either a trickster or a mark. Isn't it fortunate that you already know everything worth knowing!

How are your Blub projects going these days?

<comment><USER17> That's ... quite the interpretation and projection from one throwaway line.

</comment></comment></comment></comment><comment> ryan-c As someone who likes perl, this frightens me. It seems like an esolang, is it really intended for productivity?

<comment><USER19> When I look at APL, it seems a bit clearer where this all is coming from. After all, we're perfectly fine with using an asterisk as infix notation for multiplication, even if all the rest is done with functions, methods etc.. This isn't just the case because we've learned mathematical notation in school and thus "x <asterisk> y" seems natural enough (as opposed to e.g. multiply(x,y)), but also that we learned to accept the "asterisk" as a substitute for the middle position dot or the cross. The same is true for division or especially weird stuff like logical-or...

J works along the same lines: First, you had to accept a "widened" set of mathematical operators with arrays as the core. Which is APL with its funky fonts and keyboards. And J then takes away your more readable, but inconvenient to type notation and replaces it with ASCII. It's a bit like learning calculus with lisp as your first notation...

That's the syntactical hurdle. Then you've also got to get used to the array- centric programming model. Just like stacks for forth, functions for functional programming or lists and recursion for lisp.

As opposed to lisp, I think the syntax is the bigger issue here for a change. You don't just have to change the order in which you read things and ignore some parens, you've got to get over some very deeply ingrained habits, not just from other programming languages, but from normal writing itself. No scanning, neither horizontally nor vertically. The closest analogy for me were regexes, where you can't just skip ahead, either.

Take that with a grain of salt, I'm just trying to get into it myself. Two things that I might want to try out to really _grok_ it are programming in that style in other languages (like the infamous Whitney C example) to adjust my reading style without having to adjust to other paradigms at the same time, and to edit APL with _ed_ , so that focusing on a single line becomes potentially easier.

edit: replaced asterisk with, well, "asterisk". How does one escape that in HNews? backslash didn't work.

</comment></comment><comment><USER20> I thought it was a J library for C when I saw this title. Anyway, I think APL/J/K is the real geek code (and its syntax will be forgotten sooner than Perl syntax if you don't use it often. ;)

</comment><comment><USER21> Greg Wilson (from the 'Making Software' book) has been claiming the cost of building software is rather constant, regardless the programming language. The formula seems to be "one can build and maintain 10 lines of code per hour".

If this holds for J, K, APL we should all be doing that.

</comment><comment><USER22> > Writing code in a scalar language makes you rather like a general who gives > orders to his troops by visiting each one and whispering in his ear.

Well, actually, I use for-loops for that, thank you :)

<comment><USER7> ...which is exactly the same as "visiting each one and whispering in his ear"! With a for loop you still need to know how many "troops" you have and then go and do something with every one of them, one by one.

"foreach"-style loops with iterators in many languages eliminate the need for knowing how many element you exactly have, but you _still_ have the code for explicit "take the next element" operation.

Vectorized operations are the next logical step, where the code for iteration ("visiting each one") is completely hidden. So instead of explicit for-loop, or equally explicit map function, you just apply the operation directly to the list and get a list as a result. This is nice, because it eliminates A LOT of syntactic and semantic noise from the code which mainly works with collections.

Such vectorization is available in many languages as a library - for example in Python via NumPy, where you can say "numpy.array([9,6,7]) + 4" and get "array([13, 10, 11])" as a result. In J and APL support for this is built in.

<comment><USER22> You are implying that if there are N troops, then I need to do O(N) amount of work to give them instructions.

Not so.

I only need to write down 2 lines of code: one line for the for-loop, and one line for the actual instruction(s).

Personally, I prefer explicitness instead of increasing the amount of overloaded meaning of existing operators.

<comment><USER7> > Personally, I prefer explicitness

Of course, that's one way to look at it, and a valid one. Most of the time I do too, but I can accept some degree if implicit behaviour if it's consistent and (conceptually) simple enough.

> the amount of overloaded meaning of existing operators

But this is not true in regards to J. In J and other array-based languages the number of overloaded meanings for operators is actually less than in "normal" languages. That's because in J all the operators work on arrays and only on arrays. No operator ever deals with things other than arrays, and in basic J there's just one thing other than array anyway (a box).

In Python this:

2 + 2

and this:

[1, 2, 3] + [1, 2, 3]

are two different operators, but in J (ignore syntactic differences) this:

2 + 2

and this:

1 2 3 + 1 2 3 NB. resulting in 2 4 6

are both applications of the same operator.

There is a certain appeal to languages built on "turtles all the way down" principle - one of the benefits is that they tend to be compact, simple and consistent. On the other hand, when you're not dealing with turtles, they tend to be irritating at best and completely unusable at worst.

Anyway, I'm not trying to convince you to adopt J right now and start using it for writing web apps, I just want to say there are some interesting concepts in J which, while being unfamiliar, are not necessarily worse than the things we're used to. And they're not useless either: a week of learning J made my NumPy code much better, for example.

</comment></comment></comment></comment><comment><USER23> Interestingly, we just had an article on HN that complained about the amount of mental RAM that C++ takes nowadays. I can't imagine that J takes less.

</comment><comment><USER24> I find this hilarious.

<comment><USER7> What exactly and why?</comment></comment>


Going for the Gold: The Economics of the Olympics - <AUTHOR> http://pubs.aeaweb.org/doi/pdfplus/10.1257/jep.30.2.201 <comment><USER2> > Since that time, however, over half of all bids have come from this group, > including applications by Istanbul, Bangkok, Havana, Doha, and Cape Town, as > well as the successful bids from Beijing and Rio de Janiero

Well, it's a good thing Istanbul didn't get it... that would have been a security disaster given recent events.

> The true final cost of the 1998 Nagano Winter Olympics will never be known, > because the host committee ordered a portion of the event's financial > records to be burned (Jordan and Sullivan 1999).

What rational reason could there be to do this? Unless it's to hide something.

> From 1968 to 2012, every single Olympic Games ended up costing more than > originally estimated. The median Games were 150 percent over the original > budget, with the worst offenders—Montreal 1976 and Sarajevo 1984—exceeding > initial estimates by more than ten-fold (Flyvbjerg and Stewart 2012).

I'm curious if estimates get adjusted for this reason (to be higher) that they still end up exceeding the new estimates. It might be best to low-ball the estimate but have good contingency plans that aren't made public.

One thing I've learned from making more money over the years is that financial budgets have a way of becoming self-realizing, always growing to fill capacity. It takes quite a bit of constraint and learning to address this - something these Olympic host countries don't have the ability to do, as they are always hosting it for the first time. They have no local experience to draw from.

<comment><USER3> [https://en.m.wikipedia.org/wiki/2002_Winter_Olympic_bid_scan...](https://en.m.wikipedia.org/wiki/2002_Winter_Olympic_bid_scandal#Winning_bid):

 _" A Salt Lake Olympic Bid Committee member complained about competing with the Japanese bid committee for the 1998 Olympic Winter Games: "We were giving out saltwater taffy and cowboy hats, and they were giving out computers. IOC members who came to inspect Nagano were put up in ritzy hotspring resorts, where they washed down expensive sushi with sake poured by kimono-clad geisha. They went home laden with souvenir gifts and expensive paintings." A senior member of the Japanese bid committee, Sumikazu Yamaguchi, ordered that accounting documents for the Nagano bid be burned because they "could cause unpleasantness to [IOC members]." The Melbourne bid committee for the 1996 Summer Olympics discovered the quid pro quo expectations of IOC delegates when they received requests from six African IOC delegates for new cars and sexual favors from local brothels. They denied the requests and the 1996 Summer Olympics went to Atlanta."_

</comment></comment><comment><USER4> I've reduced this problem to one personal choice: Boycott.

There's a bunch of cognitive overload I can now instead devote to something else.

If they ever return from money to sportsmanship -- maybe also just parking the thing back in Greece, permanently -- maybe I'll give it another look.

Sports are for doing. If you're watching, and spending, more than you're doing, you're doing it wrong. You've gone from entertainment, to distraction from and substitution for better things. IMHO.

</comment><comment><USER5> its seems a bit like an agency problem. there is a lot of benefits from being the person who 'wins' the olympics or having political power while construction and planning for the olympics is going on. so it is not surprising that lots of cities will aggressively bid for the olympics even if it is not necessarily in the general interest. and this intense competition makes it even worse for the winning city :( do you think cities bidding for the olympics understand winners curse?

<comment><USER6> The article mentions both aspects. Boston's retracted bid was spearheaded by the construction and hospitality industries before being retracted after public outcry. Autocratic regimes are more likely to subvert the overall good and ignore or suppress this outcry for their own private good.

And as far as the winner's curse goes:

> it is possible to ascribe a portion of the economic failings of the Olympics > to the "winner's curse," the result in auction theory that when parties are > bidding on an asset of uncertain value (like rights to offshore oil leasing > tracts), the winner will tend to be the bidder who is most prone to > overestimating the value of the asset—which means that the winner is likely > to be systematically disappointed (for an overview of the "winner's curse," > see Thaler 1988).

Or see Wikipedia: [https://en.wikipedia.org/wiki/Winner%27s_curse](https://en.wikipedia.org/wiki/Winner%27s_curse)

To state it differently, the winner of a contracting project which was awarded to the lowest quote, assuming equal labor costs, is the one who most underestimated its difficulty and scope creep. That helps me understand a few projects I have been involved in.

</comment></comment><comment><USER7> How about a warning that this is a PDF?

<comment><USER6> The good news is it's just a text document, which appears to have been generated in LaTeX, and it weighs in at 256 kB. That's less than most HTML pages!

So if you clicked it on mobile, and your device didn't handle it gracefully for some reason (are there still some which don't?), you didn't waste much data.</comment></comment>


Chinese cyberspies breached TeamViewer in 2016 - <AUTHOR> https://www.zdnet.com/article/chinese-cyberspies-breached-teamviewer-in-2016/ <comment><USER2> Imagine a situation where an APT has been around your network for 3 years without your single, old and crusty "security guy" noticing a thing, and is only detected after they cause excessive CPU load on a database server whilst running a bad query.

Would you be keeping the appropriate logs to know for sure if they had accessed customer information? Couldn't you say to yourselves "well we have no proof that they accessed any customer information, because we have no logs at all!" and therefore not need to contact the German authorities?

They where all over the network for _years_. What do you think they accessed? Just a thought.</comment>


How To Obtain Seed/Rounds To get Apps Out? - <AUTHOR>

Corp has three new app concepts to devel, Need Seed and/or venture cap  or partnership - located in Chicago (CHIVALLEY).Otherwise will donate to Universities for Entrepreneur Centers. @TableandBoard <comment><USER2> There are a number of resources in Chicago that might be able to help you, but may I make a couple of suggestions?

1) When you ask for something, you need to be clear. Please use full sentences and complete thoughts.

2) Give a brief overview of what the app concepts are and what the business around them will be.</comment>