Ask HN: Starting a project today, which web framework would you use? - <AUTHOR> If you will start your project today (medium to large application) which web framework technology would you pick: - Asp.Net Core
- Node + Angular - Node + React - Django or Flask - Rails - Laravel or Zend
- Play Framework - Other <comment><USER4> My usecase is mostly side-projects that I want to take to the market. So I stick to Django.

Why?

* I am already familiar with it's advantages and quirks. So I can get running faster. The knowledge that I have accumulated in my previous projects will be handy to get going. Time to market is important for both validating the product and avoiding a burnout.

* There is a well defined way to do most common stuff. So you need not experiment and reinvent the most basic stuff. All those get out of the way and I can concentrate on the meat of the problem.

* Many libraries like auth, rest framework are battle tested and most likely tested for security vulnerabilities. if you are taking something to market, it is in everybody's best interest to ensure security is taken care of by the pros. Django is solid in that aspect.

* Though python may not be the most performant language (I have been bit by that a lot in data processing) it is still fast enough for websites with normal loads (which is 99.999% of today's websites).

* If I do have a performance bottleneck, there are lessons from pioneers on how to optimize it.

For me, django fits all these needs. For you it might be Rails, Node, Play or Phoenix. I used to want to learn Phoenix and Play.

But I realized it is a no-win situation when you mix a brand new tech with brand new product.

Now I reach out to new tech only if it fixes a sore need that my existing toolkit cannot handle.

For example, I am looking into webpack and purifycss, because django does not have the necessary functionality to trim the fat in bloated CSS, while Node stack excels.

If I work on a interaction heavy front-end, I might reach for vue or react, and that too only if I really need it.

Else, I am quite happy with django/vanilla-javascript/sass/bootstrap(for prototyping)

<comment><USER5> This is really solid advice, I think.

Either you are building something for learning, or you are building something to ship it, and it's better not to mix the two. If you are building something to learn new technology, then use whatever that excites you to make something that you won't feel guilty throwing away.

If you are building something to ship, then you should preferably use nothing that you haven't already used before. You'll still improve as a developer, because you will get better at technology that you have already invested in.

</comment></comment><comment><USER6> Frontend: Elm

Backend: Rails|Phoenix

Database: PostgreSQL

I don't understand why people still write javascript except legacy codebase maintenance although I respect everyone's freedom. Especially, sorry, React/Redux why? Yet, people are obsessed managing state on client (browser), that's the bad days of whatever framework including Elm. 90' Game developers would wonder too since they often prevent corrupt states from bad people was trying hard to mess (cheat) game states, thus source of truth and constraints must only live on server. States on front-end must be just something only for sake of displaying.

<comment><USER7> You are conflating two ideas.

Game developers protect state to prevent cheating. For example, allowing a player to update his location could allow teleporting or spawning tons of bullets\projectiles

If a web developer creates an IM webapp, why should they care if you modify your local copy of the message data? It only affects your session and the next time you get a copy of the message it will be the original. All other users are still seeing the original

<comment><USER6> I don't see any of what you said is opposite to what I said (Local message is just for sake of displaying)

I think we meant the same thing.

<comment><USER8> "Global" state should live on server. Only local state lives on client. I'm not sure how you are against react, angular, etc, since they only manage "local" state.

<comment><USER6> I know any framework or any single line of code on client is all about "local" state. But when people lost focus they _potentially_ couple business logics, local truth and constraints with "Global" state from servers, and trust wrong source of truth. And that might end up with next corrupted, e.g. POST, requests.

<comment><USER9> But then you're essentially talking about BAD code.

Bad code is bad; in any language or framework.

Don't blame the knife (in this case React/Redux or w/e), blame the person wielding it.

<comment><USER10> If the knife has a sharp handle, it _is_ to blame. Many frameworks have common pitfalls. I've got no opinion where these are in React/Redux though.

<comment><USER6> > If the knife has a sharp handle, it is to blame

Agreed, this is a good example.

I am trying to avoid blaming React/Redux specifically because it's going to end up with a blog post. Tree nodes communication, composition and state.

Imagine you have a 5-height tree, each node is an object that can receive properties from its parent (hell yeah, lightly inheritance smell), that's not that bad until all objects' methods (components' callbacks) execution orders come together (hell yeah, lightly recursion smell in _imperative ways_ while a normal recursion can be done in declarative way of thinking). Next turn, Redux. Connect a store to any level of tree you want, ahh that sounds handy but I have no ideas who setState, when and where. Saga|Thunk hmm this is slightly better since it is a separate middleware but wait, it's not completely isolated, anything _available_ for you there; Dispatch, Store, setState etc. Finally, all these built on top javascript ahhhh I personally suck at orchestrating these things.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Everyone is posting layers upon layers of components and frameworks. It just seems so bloated, so hostile towards the developer.

From my experience, the more independent projects you include, the harder an application will be to maintain, let alone configure and build. Am I just old and cranky? Or is there reasonable justification to do this?

<comment><USER12> If you're unfamiliar with a framework -- whether it's Django, Rails, Express, Angular, or React -- much of the structure it imposes on your code feels tedious, over-architected, bloated, or just plain silly.

Once you've built a couple applications from scratch without using a framework, you begin to realize just how boring and error-prone things can get when you do them by hand. I want to get to the good stuff, the meat of my application, as quickly as possible. Knowing a framework inside-out lets me do just that.

Maybe the next time you're forced into using a framework, start looking at how it's put together under the hood. It's educational and a lot of fun. And you realize just how much accumulated knowledge these frameworks contain :)

</comment></comment><comment><USER13> 1\. Django 2\. Pryamid 3\. Flask

I used to use Pyramid for everything unless I needed forms and UI then Django is a no brainer choice. But I stopped wanting to setup SQLAlchemy and writing bootstrap codes for managing test states etc. I still love Pyramid because of its flexibility, but perhaps I need to invest time in the plugins to see if there's anything quality to support SQLAlchemy integration much like Django's ORM out of the box, and whether there's quality test integration out of the box much like django test command. Flask I have a love & hate relationship too. I feel like the community is too lose. I used to write Flask apps but back then half of the recommended libraries/projects would not have updates for months. I can't trust code that isn't widely adopted and widely used, because I don't want to be the only one filing bugs. At least Pyramid has built-in Authentication modules that you can use, but Flask I'd have to rely on the community project which to be really honest, I am not sure if I want to trust it in the long run. So these days, I fall back to Django first, Pryamid second, then Flask finally (especially convenient for quick projects).

I don't really do any front-end development because I totally not good at it, so I gave up ~3 years now. But I would look at EmberJS and React.

</comment><comment><USER14> * What I would _not_ use is any language that is not statically typed. The compiler can catch an entire class of errors and there are great tools for automated refactors. For me this narrows down my choice of languages to C#, TypeScript (Node), and if really necessary Java. But today I would probably use Kotlin instead of Java if possible.

* Technology is a means to and end for me - to get stuff done and to remain marketable. So I would probably choose the front end framework that is the most marketable. Which seems to still be Angular. Two advantages - when it's time to switch jobs I have more choices and when I'm looking for contractors to come on to projects that I'm over, Angular coders are a dime a dozen.

That being said, I'm really finding the combination of Bootstrap + JQuery + Handlebars to be refreshing for non-SPA websites.

* Databases. If I'm spending other people's money, I prefer SQL Server/Entity Framework as an MS person. When NoSql is the right choice, SQL Server has pretty good support for JSON. It really is the best of both worlds.

If I'm spending my own money or don't have a budget, I would probably choose either MySQL (relational) or MongoDB (NoSql)

* I know this wasn't part of the question, but for hosting, AWS all of the way and I would use as many of their services as possible except for DynamoDB. It just feels a little odd.

* And to go even more down the rabbit hole. I would hate coding without my JetBrains subscription. Right now, I just have Resharper. But if I were doing this as a side project I would have the subscription that included everything.

<comment><USER15> If you're a MS/.NET leaning person, why not F#?

<comment><USER14> Because:

 _Technology is a means to and end for me - to get stuff done and to remain marketable._

I have never seen a job listing that wants someone who can do a web backend with F#.

<comment><USER16> Fascinating, You'll use Kotlin but not F#.

</comment></comment></comment></comment><comment><USER17> Rails. No question.

In my 7 years of using this framework I have come across nothing that comes even close to in terms of LOC, ease of pickup and quality of the end product.

</comment><comment><USER18> Rails + JQuery + Postgres + Heroku

Why? It works. It's not gonna have crazy changes. It's simple. There are a million relevant resources to help learn how to do x, or help you if you get stuck. It's easy to hire skilled people that know this stuff back to front.

btw - you don't start a medium to large project. You start a small one, build incrementally, and see what happens. If you have success, then you can spend money building in whatever you like.

</comment><comment><USER19> Depends on the project, but most likely just Node + express + TypeScript on the backend (so no "framework" in the traditional sense).

On the frontend, React + MobX + TypeScript.

This of course means it would be a single-page application.

Benefit of using TypeScript on both client and server is that you get to automatically share the schema of the data they're exchanging (and maybe some more code as well, like validation). For free. And when you change the structure of something - and you will - you get immediately alerted to any issues on both sides (e.g. this property is now required, and you omitted it in this function!). This is huge because maintenance is often more difficult than writing the initial version - and I don't even mean the initial _released_ version.

Also you get to potentially reuse some of the code in the future for a React Native based mobile app.

I'm also eyeing GraphQL and Apollo a bit, but I don't have enough experience with them to use them in a "real" project just yet.

<comment><USER12> > Benefit of using TypeScript on both client and server is that you get to > automatically share the schema of the data they're exchanging (and maybe > some more code as well, like validation). For free.

How do you do this? Do you have a separate NPM package that just contains your schema/validation code? Or do you keep your backend and frontend code in the same repository?

<comment><USER19> Same repository, 3 different directories (client, server, shared). This also makes it easy to have shared docs, dockerfiles, and other things needed for the complete setup on any machine.

But you can also just do this with a git submodule for example, or any other method that will physically get you the shared files there.

<comment><USER12> Thanks for answering.

I've always wanted to try breaking projects down into separate NPM packages, but I usually end up using git submodules. Path of least resistance and all.

<comment><USER19> Not sure what you mean by NPM packages, but I don't publish anything to NPM (not even a local repository).

On the other hand, the client and the server obviously each have their own package.json, with their own dependencies, etc.

<comment><USER12> > Not sure what you mean by NPM packages, but I don't publish anything to NPM > (not even a local repository).

Break your applications into separate Node modules and publish them to a private NPM.

Now that I type it out, it sounds like more trouble than it's worth.

</comment></comment></comment></comment></comment></comment><comment><USER20> Mojolicious (Perl), Spring Boot (Java / Kotlin) or plain Go. Depending on productivity, performance and hardware constrains.

If it's the typical CRUD site I'd use Django (Python) if I worried about finding developers, otherwise sticking to good old Catalyst (Perl) or perhaps giving Phoenix (Elixir) a try.

<comment><USER21> Why Spring Boot? Just curious. I work with it daily and have grown to detest it.

<comment><USER22> > I work with it daily and have grown to detest it.

What exactly do you hate? (I feel weird liking Spring quite a bit, and would like to get in on the hatin' ...)

<comment><USER21> To be as concise as I can, I would say that Spring Boot is a framework which minimizes the amount of "code" you have to write at the cost of everything else.

And this means that it's hard to understand what is going on under the covers, hard to debug (partly due to metaprogramming bananza), slow to start, uses too much CPU, uses huge amounts of stack, has all bells and whistles turned on by default etc etc. It gives you all errors at runtime. Encourages you to make your app too configurable (hard to test all configs). Reimplements a bunch of tools and libs badly (like one-jar). Its also intrusive like all frameworks. Requiring a custom test runner is not a feature, Spring! For these type of reasons you cannot easily integrate it with other frameworks.

And that is just from the top of my head.

<comment><USER23> > "all bells and whistles turned on by default etc"

Arguably a little unfair? Spring boot makes it pretty trivial to just pick and choose the components you need for a project, especially with the [https://start.spring.io/](https://start.spring.io/) tool.

> Requiring a custom test runner is not a feature, Spring!

I'm guessing this is a reference to using Spring's test runner to support Spring's dependency injection mechanism? No one forces you to use this so it's a stretch to say its 'required', but for certain tests it will save time over manually mocking etc, and often only applies to integration tests anyway. You can absolutely unit test without it.

> "It gives you all errors at runtime."

I'm sure it does, if you have errors.

> "Encourages you to make your app too configurable"

Spring boot apps are only as configurable as you make them, much like any other application. At least Spring tries to provide a standardized methodology/pattern for externalizing configuration parameters. I fail to see the 'encouragement'.

> you cannot easily integrate it with other frameworks.

It's java at the end of the day - there's a ludicrous number of third party frameworks it will play nicely with.

> slow to start, uses too much CPU

Sure JVM applications rarely have 'instant' startup for various reasons, but is a handful of seconds really a problem? 'Uses too much CPU' \- I don't really think this is fair either - Spring Boot applications can deliver very efficient solutions.

Not going to argue it's the perfect choice for every project, but no framework is.

<comment><USER24> Isn't spring boot "thread-per-request"? Some people care about that kind of performance-related stuff.

Also, I think "It gives you all errors at runtime.", should have been "It doesn't give you the errors other frameworks are able to give you at compile time." -and I kind of agree, if memory serves "Spring" is sort of synonymous with "reflection", which isn't exactly performant either.

EDIT: Wow, just read my comment and realized it comes across like I really hate Spring. I don't, I think it's nice. It's great for web apps that have human users; for services that are consumed by other services, I would probably go for something else.

<comment><USER25> Spring? If you need Java DI you will find Guice fixed the warts.

<comment><USER26> Does it have Auth and so much more Spring has to offer?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Phoenix (Elixir) for the backend because I started with Elixir this year and really enjoy it. If the app was simple enough and I was feeling up for a challenge than maybe just Erlang directly with Cowboy (so no real framework).

For the front end: Elm or maybe Ember.js. I started learning Elm this year too and like it but I possibly would go Ember because it seems interesting and since I have a membership to Daily Drip I have free tutorials on Ember (as well as Elm and Elixir)

</comment><comment><USER28> Django if front end is complex (lots of forms, complicated templating, need to have a free admin interface for out of the box).

Or if the front end is simple, I'd just write it in Go using core net/http library.

To make it more maintainable, I'd probably split the application into two components, so backend could be API written in Go and front end a Django app.

</comment><comment><USER29> Node + Koa + React (server side rendering) + ReactRouter + Redux + TypeScript + Postgres

Not because they are so great but because everything else is even worse.

After significant React experience I can no longer tolerate send-html- template-sprinkle-javascript stacks.

The downside is that the amount of boilerplate is unbearable. There's significant friction in the tooling because of transpiling, sourcemaps, multiple layers of sourcemaps, file watching, having to produce multiple different bundles for server side rendering, client-side bundle and so on, testing with transpiling is a pain, test coverage with transpiling is at times borderline impossible, proper isomorphic data-loading is difficult and the list goes on. Still prefer it to the other stuff.

<comment><USER30> > The downside is that the amount of boilerplate is unbearable.

This is often a deal-breaker for smaller projects where the whole team is not used to all the tooling.

<comment><USER29> Even if they are extremely familiar with the tooling it's still a huge problem.

People get seduced by unrealistic examples online and think "oh easy just drop this little config thing here and done".

The problem is the little things pile up on top of each other before you know for a production app you are deep into plugins and transpilers and configs to your knees and you have to make them all play with each other.

Just some examples of difficulties of this architecture,

\- You must have an API for doing anything because the client-side needs the API, but on the server you also have to use the same code for server side rendering. It gets more fun because you have to deal with authentication as well on both sides. So you will have to "proxy" the cookies from the client on the server side to the API to load initial data for server side rendering. This is full of gotchas and largely undocumented it will take you at least multiple days to get right.

\- Data loading for client-side navigation is tricky. At what point do you fire ajax calls to load data for the destination? Sometimes multiple calls are needed. With react router you'll need a custom "Link" component with data loading functions that produce promises then you can do Promise.all on them and transition when ready. For a good experience you have to incorporate timeouts. In my case I immediately start loading target data upon link click for navigation, wait up to 100ms ("navigation wait tolerance") and if things are not done by then I navigate to the target in a loading state and the page re-renders when data is loaded or error happens and error is displayed. Again, full of gotchas.

\- Need an admin panel? well you better not have any potentially sensitive text on your admin pages because guess what that ASCII text is going right into your javascript bundle. This is a minefield if you don't want to be leaking your admin UI and capabilities. At this point you will need to have a separate admin bundle that is not given to normal users. Good luck with that. You can't just "add" it on top of the normal bundle (too hard to explain, try it and you'll find out). So it needs to be a complete application bundle that is built for admins. But well if you want the admins to go through the normal login page like all the other users ... gotta switch somewhere in there.

\- Testing? Forget about all the usual CLI tools like mocha/jasmine/ava/jest/etc... they will all blow up one way or another when facing a sufficiently complex application with webpack/jsx/transpiling/etc. So you have to have another "test" bundle that imports all the tests, you have to transpile and build that bundle then execute it with a test runner. At this point all the usual tools for test coverage become nearly unusable.

\- Server side rendering: since your client-side stuff like React components are also needed on the server now you need to be building a server side rendering bundle and then you have to constantly keep running the output of that build so your server-side-rendering during development works correctly.

These problems will interact with each other in complex ways you can't just solve them separately one by one. Each one you try to fix will create other compromises or problems in another area.

In summary, it's an absolute cluster fuck and I challenge anyone who think it's easy to do a non-trivial project complete with user signup/login/logout/admin panel/authentication/authorization/roles/server side rendering/tests and come back.

And with all of this bullshit I still prefer this to the old(er) way of jQuery event handlers and so on.

At some point I got so fed up with the problems I described earlier I tried to go back to the old stuff but I couldn't tolerate it anymore so I came back and accepted the new nonsense.

Mind you it has improved a lot since the last year as well. Especially with the newer versions of React Router.

<comment><USER31> Sounds like you might like Clojurescript + Reagent which is based on React but with much simpler tooling (Leiningen). You can also run Clojurescript on Node now with Macchiato ([https://macchiato-framework.github.io](https://macchiato- framework.github.io)). If you need something CPU-heavy you can hook it up to a backend API written in Clojure. Turtles all the way down :)

</comment></comment></comment></comment><comment><USER32> I think there is just one sane choice: I'd use the one that I know best, and the one that has huge number of users (which means it's more battle tested).

In my case it would be Django + PostgreSQL.

</comment><comment><USER33> There are pros and cons for each.

React: once you get the framework down, it's a lot easier to build a native mobile app with React Native. There's no Angular Native.

Angular: powerful and abundant. A little different, but flexible. Answers on SO for every little thing that will come up to ask. Not sure if newer frameworks will have that same luxury.

Rails: a lot of convention. But once you get it down, you'll be able to build complex apps in little time. Also a lot of community support and search engine presence.

If it helps, I've open-sourced all code around Standard Notes. It's mostly a Rails/Angular stack.

[https://github.com/standardnotes/](https://github.com/standardnotes/)

<comment><USER34> I agree with what you've written, but just wanted to note that Nativescript provides a React Native equivalent for Angular 2/4+.

I still prefer React Native overall as more people are using it and the ecosystem is bigger, but using Nativescript with Angular was surprisingly pleasant when I first tried it out a few weeks ago.

</comment></comment><comment><USER35> If I was to start a project today it would be Elixir using cowboy and plug. I like to keep things simple. If I thought the project was more on the medium size I would probably use Asp.Net Core. For the frontend I like to stay vanilla and use bare bone so html/sass/typescript with maybe jquery if needs be. Postgres for my database needs.

</comment><comment><USER36> Frameworks? none.

Technologies? node.js + express; postgres; react + redux

Why? Speed and flexibility of development (although tbh this is just about what you're used to), using the same language on both ends, and I really like js.

<comment><USER37> Help me understand why react+redux would not be considered a framework?

<comment><USER36> See this comment: [https://news.ycombinator.com/item?id=14422926](https://news.ycombinator.com/item?id=14422926)

</comment></comment></comment><comment><USER38> Backend: Django as soon as you want an admin interface for your models. It just saves so much time, and nobody enjoys writing those dumb CRUD routes. If you don't need an admin interface and want to stay in Python, I'd recommend Flask. Else I'm also enjoying Node.js.

Frontend: Vue.js or React.

</comment><comment><USER39> Backend: Django (Python 3.5+). Yes flask might be lighter etc, but at the end of the day, when you need to do things quick, batteries included approach goes a long way. Also, it will be easier to find developers who can hit the ground running. Most of the time, I would use it for an API layer coupled with Django Rest Framework.

Database: PostgreSQL 9.6. That's easy. You get the best of all worlds here. RDBMS with indexable JSON document store. Stable, fast. There is no other choice for me.

Front end: Depends. React/Redux works for me 80% of the time. I prefer to use Semantic-UI (the React port is excellent) for the presentation. The other 20% are simple admin only apps where plain old html would do just fine. I now try to avoid all-in frameworks which tie you in like a Catholic marriage.

Async: Celery + RabbitMQ. It works, and works very very well as a background task/job runner.

Source control and Project Management: Git and Github.

Specialised system apps - Go(lang). For fast specialised servers, websockets, etc.

Deployment/Provisioning: Ansible.

Bonus points: Personal Development: Learn a new language every year. Do a little project in it.

</comment><comment><USER40> Rails: stable ecosystem, just heroku it

<comment><AUTHOR> The selection is because of rails or heroku?

<comment><USER40> Both. It's easy to develop and also to deploy, which is something you want in a project.

</comment></comment></comment><comment><USER41> Django has a lot of nice things that come with it and you can get a project setup in a flash using CookieCutter-Django: [https://github.com/pydanny/cookiecutter- django](https://github.com/pydanny/cookiecutter-django)

</comment><comment><USER42> Other: the one you're most familiar with

If you're starting up a new project, choosing the "best" framework vs the one you're most familiar with is going to make everything that much more difficult. You're going to learn something before you can build something? And build something more slowly because you're trying to learn something?

My untrendy answer:

       Frontend: Backbone/Bootstrap
       Backend: Node
       DB: Postgres or Mongo

If you don't know those things, then this isn't the right answer for you, but whenever I start up a new little project in my spare time and utilize Backbone, it's like a breath of fresh air, compared to most of the current popular frameworks and what we have to use at work.

</comment><comment><USER43> My current stack:

Backend: Go (standard library mostly, httprouter, and some homegrown libraries for stuff like dependency injection, configuration etc.)

Frontend: TypeScript (with React and Redux/mobx)

Other than that, I think using something like Kotlin, Swift or Elixir could be interesting in the backend, too.

<comment><USER44> I really like Elixir. Learning to write & test concurrent code has certainly been adventure! It's probably been a good warmup for testing microservices.

</comment></comment><comment><USER45> I've created a list of every technology (language, framework, DB, etc) posted as of 0913 May 22: (This list may contain some overlap, since I don't recognize like 75% of these names)

Elm, Rails, Phoenix, Postgres, React, MobX, Typescript, GraphQL, Apollo, Kotlin, Mojolicious, Sprint Boot, Go, Django, Catalyst, Node, Koa, ReactRouter, Redux, C#, Bootstrap, JQuery, MongoDB, Express, Vuejs, Flask, Swift, Elixir, Cowboy, Plug, Asp.Net, Heroku, Tornado, SQLAlchemy, Celery, Clojure, Ring, Compojure, ClojureScript, Reagent, Knockout, Meteor, Haskell, VanillaJS, ReasonML, Tachyons, Flow, Redis, EventStore, Suave, Python Bottle, Preact, Play (Scala), Sanic, Loopback, Werkzeug, Laravel, AngularJS, EF Core, Dapper, Vert.x

</comment><comment><USER46> Try lightweight. Flask, Skeleton, and sqlite. Don't use SQLalchemy until you need it. (Hint: you probably won't need it.)

</comment><comment><USER47> After years working in an Angular 1.x stack, I took a long, hard look at Angular 4 and decided to make the switch to Vue.js (with firebase on the back end). I'm happier and more productive with this combination than I have been with any web development setup in literally decades.

Vue does everything Angular did for me without nearly as much cognitive overhead. Working in Angular just felt like an endless stream of hidden gotchas and idiosyncratic jargon; for the year or so it took me to really start to feel like I had a handle on the framework it seemed like the answer to "How do I do foo in Angular?" was always "Don't do foo; do bar, baz and bat instead, but make sure you don't quux, that'd be really bad". And even after I'd more or less gotten used to the Angular Way To Do Things it always felt like I was fighting against the framework instead of depending on it.

Vue just works. The component structure is really developer-friendly, it's much easier to incorporate non-Vue code when you need to, and it all just pretty much DWIM without you having to think about what's going on in the guts of the framework. It took maybe two weeks of practice before I felt totally comfortable with the system. Clientside performance is a zillion times better than Angular; you don't have to pick through an entire freaking ecosystem of secondary frameworks just to get started like you do in React; vue-cli gives you sensible scaffolding and you don't have to spend much time fiddling around with webpack and build configuration. Yeah. Good stuff.

Firebase I'm a tiny bit less unreservedly enthusiastic about -- don't get me wrong, it's super convenient, and it's nice not having to spend much attention on the network layer of my apps, but there are times I wish it were a little bit less magic than it is: I can't always tell whether I'm using it efficiently or not. And the tree data structure isn't appropriate for every project; I kinda wish there were an equivalent with the same websocket live data updates but backed by a boring old RDBMS instead of a JSON store. Plus, you know, vendor lock-in is always a concern. For a mostly-front-end guy who just wants to be able to store and retrieve data without thinking too much about it, it's fine; I'm not ready to evangelize for it quite as much as I am Vue though.

</comment><comment><USER48> Clojure + Ring + Compojure on the server, ClojureScript + Reagent on the client. Because I don't know any better, and want to be punished the moment I have to hire anybody.

<comment><USER31> Another server-side option is Macchiato ([https://macchiato- framework.github.io](https://macchiato-framework.github.io)), ie. Clojurescript on Node.js. The whole Clojure/script stack really deserves wider adoption given that it arguably enhances React while reducing the insane amount of JS tooling.

</comment></comment><comment><USER16> PostgRest with Mithril.js or Elm on the front end. Keep it simple. Or WebSharper with SQL Server for a more integrated feel with static typing all the way from the database all the way down to the front end. Studies have shown static typing to be extremely important for removing bugs and programmer productivity, and from what I've seen WebSharper would give the best experience for that.

I've only used Mithril.js in those technologies though.

</comment><comment><USER49> Django for the backend with a postgres database. Just use django - I am using it for around 7 years: never regretted it, always happy with my choice. This is important to me and has not happened with other things I've used (like spring mvc, jsf, angular.js, android dev etc).

I generally try to avoid complex front end stuff, in most cases a little jquery and a datepicker are enough. If I need something more client heavy then I'll always try the least complex solution - if jquery isn't enough then knockout.js would suffice most of the time.

On extreme cases (UI heavy SPAs) I'd use react+redux with a django rest framework backend. But only if it is absolutely required. I have measured that using pure django (and friends like django filters, django tables etc) is like 5 times productive and 10 times more DRay than if you add client side/ajax stuff to the mix (along with the required bloat like client side tooling/weback, apis, auth, routing, client side models and forms etc).

</comment><comment><USER50> I may use many languages and frameworks in one project if needed. I will start with Django because I'm good in that skill set.

</comment><comment><USER51> Play Framework with Scala. Very simple and super scalable.

</comment><comment><USER52> It's nice to see all the love for django here. I've been developing with django for many years now and I feel like more and more developers are finally picking it up for various projects. It's remained very popular for quite some time now. I especially love the django developers, as they really seem to put out high quality releases that make updating to the latest version fairly painless.

I would also opt for django, postures and react+redux on the front for any complex hi needs. With django rest framework powering an API, building complex ui's becomes less painful. I've yet to find something quite as powerful as DRF.

Recently started a large commercial project 4 months ago and I'm seriously glad I went with django.

</comment><comment><USER53> Backend: Elixir, Phoenix, Postgres, Redis (All components proved to be rock stable for me)

Frontend: Vue.js, ?, ?

</comment><comment><USER54> Go (stdlib + gorilla/mux) + Postgres + React/Vue/Vanilla depending on need

</comment><comment><USER55> It feels like the constraints/expectations we face building in 2017 are different from those of 2004 (when Rails was created) or 2005 (when Django was created). Both of these predate the iphone (launched in 2007) and the dominance of mobile, as well as stuff like Websockets (2011), 12 factor, immutable infrastructure, distributed systems...

It feels extremely unlikely that that if we decided to design a framework with these things in mind we would end up with something that looks like Rails or Django (or some other RESTish/MVC thing), and yet somehow these are the things we overwhelmingly use and recommend.

</comment><comment><USER56> For projects I will maintain for the foreseeable future: Rails, Reason-React in ReasonML, CSS-in-JS, and Postgres.

For clients: Rails, React+immutability-helper in Javascript, Tachyons+BEM combo, and Postgres. Possibly Flow or TypeScript.

</comment><comment><USER57> Definitely pick Python and Django or Flask for your server side.

Python is a super easy language to work with and if you combine with heroku for hosting it's a no brainer.

Now if you want to develop something more front end heavy maybe Flask to quickly layout your API endpoints.

I would suggest learning react redux if you want to get into JavaScript as you come out the other side with a better understanding of functional programming and a pathway into modern Webdev in terms of componentisation and progressive web apps.

The tool chain for React has been simplified to regular human levels of patience now through create-react-app

</comment><comment><USER58> Depends.

Tiny project, Python Bottle.

Flask if project isn't complicated or not expected to grow much or I don't care about model admin. (and maybe even Flask if project is expected to grow... Flask really is a pleasure to work with).

Otherwise Django.

<comment><AUTHOR> What about for a public web app ?

<comment><USER58> Any of the above would work.

I prefer Flask of the three because I don't like a lot of built in extras, but prefer a larger plugin ecosystem than Bottle has. But Django isn't a bad choice either and maybe a better choice for organization.

</comment></comment></comment><comment><USER59> A web user interface is just a user interface to the actual program, which I always construct as a commandline (cli) program. It should also be easy (or at least doable) to build a mobile and/or desktop user interface for the same backend cli program. All of that should naturally be able to run as docker microservices. In other words, web "frameworks" are just a pile of retarded crap that is totally incapable of doing any of the aforementioned.

</comment><comment><USER60> Buffalo - [http://gobuffalo.io/docs/getting- started](http://gobuffalo.io/docs/getting-started)

</comment><comment><USER61> EventStore + Suave + React + RX

I'd be really tempted to use Fable's F# -> javascript for the frontend, but I don't know the ins and outs of that yet.

</comment><comment><USER62> None. Plain Javascript and static pages. CGI for APIs.

<comment><USER63> Any specifics on why you choose this approach vs a framework?

</comment></comment><comment><USER64> For the backend, Kotlin on Intellij. It's crazy awesome and you can use it now for android clients as well.

The Javascript transpiler is probably not ready yet (in beta) so I would use a Bootstrap and/or Material Design library with lots of components and tie it together with javascript.

Database Postgres. You can go hard relational if that's appropriate or use the Json support like a better Mongo.

</comment><comment><USER65> Asp.Net Core or Flask.. why? Becuase I know them.

</comment><comment><USER66> If it's a small project / defined REST api - <USER2>

If it's a big project / still not sure of the requirements - <USER3>

For the frontend: React

</comment><comment><USER67> Meteor with React: [https://www.meteor.com/](https://www.meteor.com/)

<comment><USER68> I am making a website based on this and the experience is amazing. I literally started learning a week back, pivoted from firebase (after 7000% fiasco), and have been kicking myself, why I wasn't aware of this before.

Meteor is smooth. And react makes me feel good.

<comment><AUTHOR> You moved away from firebase?

</comment></comment></comment><comment><USER69> Node.JS + Express + Vue.js

</comment><comment><USER70> Pure Go on the back plus jQuery on the front.

<comment><AUTHOR> even a complex app, large web app?

<comment><USER70> Facebook is a large web app, Google Docs is a large web app, but the projects I have been working on - not so much.

</comment></comment></comment><comment><USER71> Ruby on rails Here is my experience: [https://hackernoon.com/ruby-on-rails-is- more-productive-even...](https://hackernoon.com/ruby-on-rails-is-more- productive-even-after-learning-from-scratch-for-your-new-web-app-3cb22a06fa8a)

</comment><comment><USER72> For the server-side, definitely Tornado + SQLAlchemy + PostgreSQL. This is the core, with a likely addition of things like Celery depending on how large the system gets.

The client side would depend on the complexity of the user interaction, but the Web part would probably involve React.

</comment><comment><USER73> For larger apps I'd use Grails (think Rails on Spring Boot) with Postgres. Depending on the app I'd either use the built-in Hibernate offspring or the awesome jOOQ library to access the database. No freaking idea about the frontend, so much choice..

</comment><comment><USER74> Serverless Framework + Phenomic (React static site). No servers to worry about, no OS maintenance, out-of-the-box scalability (using AWS API Gateway / Lambda / S3). All development in JavaScript, so no need to context-switch for client/server.

</comment><comment><USER75> Depends on the case:

\- Do I want to use the latest technology?

\- Do I want to bootstrap fast?

\- Do I want to experiment/learn or do I want to build a business?

Depending on these questions, everyone has to decide on their own. If it would be me, I would take MERN stack (MongoDB, Express, React and Node).

<comment><AUTHOR> Yes, latest technologies. I started this thread because almost all web frameworks had a big improvement year and they're somehow converging in a lot of features and concepts.

</comment></comment><comment><USER76> Angular + Flask is my go to. Still haven't jumped to Angular2 though.

</comment><comment><USER77> FAM stack; firebase + angular + material design. Get anything up and running in hours. With cloud functions you can set up server side code with minimal effort.

</comment><comment><USER78> The choices presented make my head hurt... A simple stack is a happy life. Spend time on the business problem and choose the most boring technology available.

</comment><comment><USER79> Werkzeug + Postgresql

</comment><comment><USER80> Django!

</comment><comment><USER81> Having experience with Node, Rails, Go I would choose Rails for backend and Vue or Backbone (for full control) on the front.

</comment><comment><USER82> ITT: Postgres is a lot more popular that MySQL

</comment><comment><USER83> For Python I'd use Sanic. Database depends on your needs, but for me it is MySQL mostly. Cloud Hosting from Google.

</comment><comment><USER84> Rails. For frontend: depending on need. Maybe jQuery, maybe intercooler, maybe vue, maybe react. No Angular for sure.

</comment><comment><USER85> Frontend: definitively Elm.

Backend: Node for popularity, Elixir or Haskell to try something new, or Python Flask which I already know.

</comment><comment><USER86> I will write an API using ASP.NET MVC framework using C#.NET. Front-end I will use HTML5, CSS3 and jQuery.

</comment><comment><USER87> The answer to "Do I need a framework?" will inherently include "which" one to use.

</comment><comment><USER88> Node.js + Loopback + Angular2 + MySQL

<comment><USER89> This is identical to my stack. Never thought I'de see loopback and angular 2 here, they're rather unpopular from experience.

</comment></comment><comment><USER90> I would go safe and use PHP(laravel)

<comment><USER91> It gives you so much out of the box. Easy choice for the backend. Second choice node/express for games.

Front end would depend on the project. JQuery for simple things, Vue for website components or single page apps and react for games.

</comment></comment><comment><USER92> [https://crocodilejs.com](https://crocodilejs.com)

</comment><comment><USER93> ASP.NET Core + Angular probably

<comment><USER48> I'd love to be able to recommend ASP.NET Core, but there have just been too many changes and U-turns. I have spent too many hours shaving the yaks of changing project formats, features missing from the old ASP.NET stack, warring dependencies, and half-finished implementations of related projects like Entity Framework Core.

I _do_ believe they'll get there, but it's been painful maintaining apps built with these technologies over the past couple of years.

<comment><USER94> Which issues did you run into with EF Core? I've been dipping my toes in the water and was on the fence about investing time in their offering after seeing their long-ish roadmap or just switching to Dapper.

<comment><USER48> My knowledge of the state of the art in *Core is likely out of date, partly because I have stopped trying to keep up. But last I checked, lazy loading wasn't supported, it lacked a find-by-pk method, seemingly with the knock-on effect that it didn't have any sort of identity map or anything resembling real object-graph management. I have live apps running on it, it's mostly fine, but the overriding sense I have of this stuff since the great open sourcing is of barely contained chaos. Starting from scratch today, the feeling might be different, I don't know.

</comment></comment></comment></comment><comment><USER95> Choose technologies you are the most comfortable with. I would go with MEAN stack.

</comment><comment><USER96> Definitely Elixir/Phoenix. Front-end it really depends on the type of app.

</comment><comment><USER97> Node + Vue

</comment><comment><USER98> Scala Play backend (because i know it most), ScalaJs and ScalaReact

</comment><comment><USER99> I started one recently with Preact + Mobx. Very happy with it

</comment><comment><USER100> Yii2. React on the front if the UX really requires it.

</comment><comment><USER101> Backend: Vert.x (Java) Frontend: Angular 2 or React

</comment><comment><USER102> Spring Boot with spring-data + MySQL + vue.js

</comment><comment><USER103> Rails + Postgres

</comment><comment><USER104> I would go definitely with Ruby on Rails.

</comment><comment><USER105> Backend: laravel

Frontend: vuejs or react with ssr on both

</comment><comment><USER106> Backend: .NET Core

Db: Postgres

Frontend: jQuery and Bootstrap

</comment><comment><USER107> Go + MySQL + Angular JS

</comment><comment><USER108> Aurelia + TypeScript for the front-end and C# on .NET Core for the back-end.

</comment><comment><USER109> Haskell + GHCJS

</comment><comment> UK-AL asp.net core + c#, typescript + react

</comment><comment><USER110> Laravel 5.4

<comment><USER91> 5.4? I'm loving dusk.

</comment></comment><comment><USER111> Ember.js

</comment><comment><USER112> Django

</comment><comment><USER113> I'd use what I'm familiar with. That's be asp.net and knockout</comment>


Sen. Wyden proposes bill that could jail executives who mishandle consumer data - <AUTHOR> https://www.theverge.com/2018/11/1/18052254/ron-wyden-privacy-bill-draft-consumer-tracking <comment><USER2> Wyden has been doing a great job lately keeping current with changing technology:

[https://gizmodo.com/sen-wyden-urges-dhs-to-adopt-new- encrypt...](https://gizmodo.com/sen-wyden-urges-dhs-to-adopt-new-encryption- tech-to-pr-1830001179)

</comment><comment> joatmon-snoo Official press release: [https://www.wyden.senate.gov/news/press- releases/wyden-relea...](https://www.wyden.senate.gov/news/press- releases/wyden-releases-discussion-draft-of-legislation-to-provide-real- protections-for-americans-privacy)

Links below are from the above

Text of the draft: [https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2...](https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%20Bill%20Discussion%20Draft%20Nov%201.pdf)

Official sparknotes: [https://www.wyden.senate.gov/imo/media/doc/Consumer%20Data%2...](https://www.wyden.senate.gov/imo/media/doc/Consumer%20Data%20Protection%20Act%20section%20by%20section.pdf)

Official 1-pager: [https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2...](https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%20Bill%20one%20pager%20Nov%201.pdf)

<comment> joatmon-snoo Super nice to see legislation being proposed about this. Miscellaneous thoughts:

\- S7.b.1.D seems nice, but I can't help but wonder what it means to "verify" a consumer, and the potential for breaches that this poses.

\- S7.b.1.A "establish and implement reasonable cyber security and privacy policies, practices, and procedure" devil is in the details here, particularly what "reasonable" is defined to be

\- S6.b.1.B (paraphrasing, because the original text is a clusterfuck to comprehend, and I think I've got it right) companies must respect a consumer's opt-out, unless they allow a consumer to pay a fee, capped at the estimated value that the company would get out of said consumer's data

I have no idea how S6.a.1 is going to go: "implement and maintain a ''Do Not Track'' data sharing opt-out website— (A) that allows consumers to opt-out of data sharing, view their opt-out status, and change their opt-out status; "

No policy expertise here, sadly, so I have no idea how this will fare. As a techie, good first step.

</comment></comment><comment><USER3> Seems to be the only solution in the USA. Throw people in jail. Both parties seem to agree on this, they just argue who specifically should get sent.

<comment><USER4> Sending rich people to jail is the only real punishment, because fines don't matter for rich people and large corporations.

ING was fined almost a billion euros in the Netherlands for willfully and knowingly laundering money for many years. A month after paying the fine they already made enough profit to have earned back that money. So who cares about the fine? It's just the price of doing things.

Same with fines for rich persons. Who cares about a fine for parking in the wrong spot if it is the equivalent of 10 minutes work. But if you're poor that fine represents perhaps a whole working day, which is a lot, and thus fines work for poor people.

The solution is of course to make fines depend on your income and wealth. So Jeff Bezos will pay 10 million for a traffic ticket, and Joe Schmoe who earns minimum wage perhaps 50 dollar.

<comment><USER5> It depends if the fine is commensurate with the damage done and goes toward correcting it. That may arguably be the case for parking tickets. It could just as well act as a convenience fee for rich people.

</comment></comment></comment><comment><USER6> Not gonna work. The CEO can't know everything, and unless people testify against him (they'll avoid paper /email trail) he'll plead ignorance. It's 38 pages and if it passes it will 380, everyone will want their 2 cents in it.

Hold companies responsible with 10% of their revenue as fines--for first time violation. In cases of absolute negligence and or malice jail C level execs. But just because Google gets hacked, we can't jail their CEO.

<comment><USER7> Nah, lock up the CEO. Who cares if they can't know everything, that's not a good excuse. If the company is so big that the executive team can't keep a firm grasp on what's going on, then maybe it's too big to exist.

Locking up executives (a risk for which they are richly rewarded already) puts a natural cap on how large a corp can get.

</comment></comment><comment><USER8> I'm a bit unclear on the criminal penalties section. (I'm using the draft linked in joatmon-snoo's comment)

There is an annual report that the company must file with the FTC. That report must be accompanied by a written statement from the CEO, the chief privacy officer, and the chief information security officer certifying that the report fully complies with section 5(a) of the Consumer Data Protection Act.

The criminal penalties for those three officers arises if they so certify the report knowing that the report does not comply.

What confuses me is that there are two levels of possible penalties.

The first level is if one of those officers "certifies any statement as set forth in subsections (b) and (c) of this section knowing that the annual report accompanying the statement does not comport with all the requirements set forth in this section".

That can subject them to up $1 million or 5% of their largest annual compensation of the past 3 years (whichever is bigger) and/or up to 10 years in jail.

The second level ups those limits to $5 million, 25%, and 20 years. The conditions for the second are word for word the same as the first level except the word "intentionally" is inserted before "certifies" so it becomes "intentionally certifies any statement..." instead of "certifies any statement...".

I'm having trouble seeing how an officer could run afoul of the first without running afoul of the second. How do you certify the report without intentionally certifying it?

At first I thought the distinction was going to be whether or not the officer knew the report was bad, but no, both cases require that the officer knows that the report is bad. The lower penalties are for certifying a report you know is bad. The higher penalties are for intentionally certifying a report you know is bad, so the distinction is whether or not the certification is intentional.

<comment><USER9> Negligence. Well-written law always includes the notion of _mens rea_ : did you do it on purpose, or just do it? As an analog consider the difference between manslaughter & murder.

<comment><USER8> What's confusing me here is that I'm having trouble seeing how it is possible for a CEO or other officer to _unintentionally_ produce a statement certifying that the annual privacy report meets the legal requirements.

Suppose Alice is the CEO and Bob is the CPO. Their minions produce the annual privacy report, and give it to Alice and Bob to certify and send to the FTC.

Alice and Bob both know that the report does not meet the legal requirements.

Alice and Bob nevertheless both certify it and it is sent to the FTC.

I don't see what Alice and Bob could do different from each other that could lead to one of them being liable for "intentionally certifying" the bad report and the other being liable for merely "certifying" it.

Compare to, say, killing a pedestrian by driving through a crosswalk that you know is occupied. It would then make sense to distinguish between

• driving through a crosswalk that you knew to be occupied, and

• _intentionally_ driving through a crosswalk that you knew to be occupied.

You could do the former by seeing that the crosswalk is occupied, intending to stop when you got closer, getting distracted by something, and losing track of where you are.

The intentionally modifier makes sense there because you can unintentionally drive through a crosswalk that you know is occupied.

With certifying a report...what? You were not planning on signing the certification, but your secretary accidentally put it in a pile of things awaiting your routine signature and you signed it without realizing what it was?

</comment></comment></comment><comment><USER10> I think you need a few prongs, but not keen on CEO jail time. CEOs likely don't have enough visibility into day-to-day to have an impact on data security. They set the tone, but they won't have time to personally validate the work is being done to proper security standards.

Few ideas, to be used in conjunction:

1) Fine the shit out of violating companies. Base fines with the same aggressive tactics they use to compute fines for piracy -- leak 1M records, pay $100 x 1M in files. And have to set up identity protection for your consumers -- all that good stuff.

2) Reward good behaviour. Set a third-party standards, if a company submits to that, and passes, give them 1 strike per year where they don't have to pay the files. Worried about how to set these? Don't me, EY or Accenture or Deloitte will set fairly comprehensive standards, as long as they are allowed to charge for the audits.

3) Protect whistle blowers and offer rewards. If you go through proper channels, you won't be fired. And if your company fails to act, and then you narc on them, you should get a bonus. A massive fucking bonus. You see shady, you report shady, you get a hero's bounty.

<comment><USER8> The jail time is only for people who know that the required annual data protection report the company files with the FTC does not comply with the requirements of the law, but certify to the FTC that it does.

</comment></comment><comment><USER11> Jail seems a little extreme, the punishment doesn't fit the crime here.

<comment><USER12> Powerful corporate elites need a deterrent. If only more financial evildoers had joined Bernie Madoff in prison after 2008.

<comment><USER13> There are two outcomes to this:

1, where quality executives say "fuck this" and the only people who hold the roles are fall men for invisible puppet masters.

or 2, the role is split up over a bunch of departments so nobody can be held responsible. The side effect of this is that the products the company produces become much more expensive.

<comment><USER12> 1\. The law, and its enforcers, are presumably flexible enough to not simply prosecute the figureheads, but any accompanying accomplices as well. Puppets can be made to accept plea bargains and squeal.

2\. Corporations are people, my friend, and should be punished accordingly as persons, if there isn't an actual human that can be made liable.

And given the current fracases over outsourcing, immigration, big box chain stores, vertical integration, monopolies, ad-funded tech, etc., etc., it isn't simply to shoot down a proposal simply because "the products become much more expensive." Not even the public is as simply mollified by cheaper goods as they were a decade or two ago.

</comment></comment></comment></comment><comment><USER14> This effort is welcomed! Sen. Wyden is doing a great job pushing this.

</comment><comment><USER15> In other news, Mark Zuckerberg just resigned as Facebook CEO.

For companies whose shareholders are not executives the executives will now have an incentive not to mess up. The problem is that executives rarely have enough overview over what is happening at the lowest layers of a company to ensure that data leaks could not happen, they might want to set the tone and environment but that by itself is absolutely no guarantee.

Though it is good - and probably effective - that it isn't just the shareholders of a company that are punished (they have even less insight!) through fines, I highly doubt that jailtime is the right solution.

Personally I'd rather work with the carrot than the stick:

Any employee that comes forward with reports of mishandling of consumer data or the failure to report a data leak should be awarded a %age of the fines levied. That way there is a much bigger chance at actually learning about these things happening, where they happen and companies with a sick culture would still end up being reported on.

<comment><USER16> >The problem is that executives rarely have enough overview over what is happening at the lowest layers of a company to ensure that data leaks could not happen, they might want to set the tone and environment but that by itself is absolutely no guarantee.

But given the law and personal risk, they're now incentivized to find a solution to that problem (in the same fashion that employee coming forward creates a PR risk). If this weren't a possibility, and a viable one at that, then data leaks would be an inevitability, and it wouldn't be sensible to fine the company (they can't get insight into the matter, so they can't do much to stop it from occurring; you're going to fine them for succumbing to a natural disaster?)

If you don't expect top-down insight to be possible, then I'm not sure how your carrot would plug the leak. It would announce it and let people prepare for the damage, but not stop it fron occurring again (the only people with insight are middle and lower; the lower you go, the less affected by the fine).

But ofc it is possible, and it is sensible to fine the company, and I don't see why it wouldn't be sensible to expect a c_o to have some insight into the matter. Ofc such a strong punishment as jailtime, on _any_ data loss is too much, but data loss after not reaching some defined minimum standard of protection (essentially leaving it in a state where loss is _expected_ ) for the type of data? It seems reasonable to enforce larger punishments against the people in charge of ensuring that those minimums are met. Eg if security audits aren't ever done, its negligence. If the data is important or even just large enough, its criminal negligence.

tldr; your carrot has the same dependency as the stick: if one can hope to effect change, the other should too. (which is more fair/effective is a different matter)

<comment><USER15> > But given the law and personal risk, they're now incentivized to find a > solution to that problem

The only thing an executive can really do is issue a directive along the lines of 'we will do things this way', and then leave the interpretation of that directive to the lower ranks. Any mistakes in the implementation - even if all the interests are aligned - could lead to later accusations of mishandling of data.

I think that by now we can conclude that security is a hard problem, and that even companies that do their best (not EquiFax) are at risk.

Criminal negligence for executives is going to be very hard to prove, especially when a CEO could point to some directive that had the right intentions.

Also great to see a 'defined minimum standard of protection', but that definition had better be ironclad if you expect people to serve jailtime when those standards are violated.

I see another company every week and it is quite surprising how wide the range of security implementations is, from 'perfect' to 'incredibly sloppy', and I've yet to meet an executive that understood things well enough to know what risk exposure they had. Jailing such a CEO would just be petty revenge, and would not have the desired effect as an outcome.

If you are going to enforce jailtime then punishing the CTO/CISO/CCO would be more effective, at least they have the relevant knowledge, and would be far better placed to effect meaningful change.

We already have similar mechanisms for lower level employees violating various reporting laws regarding suspicious transactions (notaries, accountants, bank employees).

<comment><USER17> > The only thing an executive can really do is issue a directive along the > lines of 'we will do things this way', and then leave the interpretation of > that directive to the lower ranks.

That is not really true.

1) Executives can allocate sufficient resources to data protection.

2) Executives can set up a data protection committee that has similar powers to the audit committee. In the UK this would normally be placed under the non- exec chairman's control.

3) Executives can insist on an external audit

Corporate governance is complicated, but not impossible. Executives manage to keep control off the shareholders money, despite never touching it themselves. They can learn to do the same with data.</comment></comment></comment></comment>


Ask HN: Best Books on the DotCom Bubble? - <AUTHOR> Looking like something like 'Disrupted' or 'Bad Blood' for the DotCom era; I've always been interested in the story of products/companies like Pets.com, etc. <comment><USER2> Totally Wired, by Andrew Smith, is a pretty interesting read.

[https://www.amazon.com/Totally-Wired-Harris-Dotcom- Swindle/d...](https://www.amazon.com/Totally-Wired-Harris-Dotcom- Swindle/dp/080212934X/)

</comment><comment><USER3> Not a book, but here's an inside story from a developper in a DotCom era web company:

[https://www.shamusyoung.com/twentysidedtale/?p=35194](https://www.shamusyoung.com/twentysidedtale/?p=35194)

But he's also explaining a lot of entrepreneur/technical details, since most of his usual audience is not familiar with those, unlike HN.

</comment><comment><USER4> Not a book, but a good documentary:

Startup.com

[https://youtu.be/ibuiUXOTE4M](https://youtu.be/ibuiUXOTE4M)

</comment><comment><USER5> Try the first $20 million is the hardest, ir the nudist un the night shift by PO Bronson.

They are both about the dotxom boom: the first one is a novel about java. The second is journalism (if I remember well).

</comment><comment><USER6> I have a copy of _After the Gold Rush_ on a bookshelf somewhere. I don't remember much about it, other than I liked it at the time :-)</comment>


Human intelligence and AI are vastly different – so let's stop comparing them - <AUTHOR> https://thenextweb.com/syndication/2018/09/01/human-intelligence-and-ai-are-vastly-different-so-lets-stop-comparing-them/ <comment><USER2> When we get real AI, then we can talk about comparisons.</comment>


Ask HN: Girlfriend is being shown ads depending on what we do together. How? - <AUTHOR> My girlfriend came to check out some open houses with me yesterday after work. By 10 PM, she was seeing ads on Instagram for new houses. She hasn't shopped for a house before, or even done any searches on Google on that topic. I simply invited her to come with me and she did.
Similarly, we were at her place the other day and watched a kung fu movie on my laptop (connected to her wifi), and then went to bed. The next morning she started seeing ads for martial arts schools in the area.
What is happening?
She doesn't have an Amazon Echo or anything else that might be listening, although she does have an Android phone. She most likely has the default (stock) settings and apps. Regardless, I want to help her improve her privacy. What steps should I take (other than installing ad-blockers on her phone)?
Corollary: Is this what the Internet is like for "regular" people? If so, holy shit. I'm glad I use uBlock Origin on my computers and an iPhone. <comment><USER2> I have worked for a number of ad tech companies over the years.

If this really is happening (and it seems possible it could be coincidence) the most likely explanation is cross device targeting using IP address.

So, most ad tech companies do cross device targeting, using device maps bought from other companies (Drawbridge being one). These companies attempt to assign a variety of devices from the same person to a single advertising profile. The simplest way they do this is by IP address. So if they have an IP address with a small number of devices, they decide it is probably a household and assign all those devices to the same advertising profile.

So, by being on the same wifi together (either at your place or hers) they will show ads on her devices based on your behavior (and vice versa).

The other explanations are possible, but I think this is the most likely

<comment><USER3> This is the correct answer. We noticed this happening in our small lab and decided to run some tests and in fact if one person searched for something odd like 'Swedish fish' then visited sites selling Swedish fish, everyone in the lab would start to get ads for candy and snack food. Similarly, searching for "mountain bike" would result in everyone else seeing ads for bikes and bike accessories. It sort of became a game to figure out what the test search term of the day was.

<comment><USER4> Many would probably hear of experiences like that and think 'hey that sounds unintentional or like behavior the advertiser wouldn't want' but it actually sounds brilliant from a pure effectiveness point of view. You don't just show an ad to an interested person.... you increase the chance that the person will hear about the thing from people in their immediate vicinity. And what's the best advertising in the universe that no one can buy? Word of mouth.

Advertisers had better be paying through the nose for this sort of access, because it's insanely valuable.

</comment></comment></comment><comment><USER5> A totally plausible explanation for this (as plausible as any Amazon Echo passive speech recognition ad targeting theory) is that she's been seeing these ads for weeks, but they were completely irrelevant and her mind filtered them out until she happened to have house hunting / martial arts movies on her mind after these events.

<comment><USER6> Nice try Mark.

Jokes aside, these issues are happening way too often for it to just be a coincidence. I've seen multiple friends and strangers, as well as myself, reporting that they were talking about something and then an ad shows up about that.

EDIT: typo

<comment><USER7> Nice try? Read this first: [https://rationalwiki.org/wiki/Frequency_illusion](https://rationalwiki.org/wiki/Frequency_illusion)

<comment><USER6> No. You read this first: [https://en.wikipedia.org/wiki/Joke](https://en.wikipedia.org/wiki/Joke)

<comment><USER8> So what you wrote after "Jokes aside," was also a joke?

</comment></comment></comment></comment></comment><comment><USER9> I am not in this field and I believe some guys here already explained it much clearly than me.

1\. Checking Open houses: Many apps are authorized by most users to access their location. Ads space providers qualify their data, that is the way they earn their life. Then if one Ad client works in real estate, the Ads space, sorry your girlfriend phone screen, is a nice target for real estate Ads.

2\. Kung fu ads: A Ads space provider for some of the ads may have noticed that several different user agents come from the same IP adress, so it inferred incorrectly that they belong to the same person.

<comment><USER10> ^ Probably correct, +1.

I'd like to add that Android by default tracks your location constantly [1]. I recently got a Pixel and was staying in a hotel. Every night I came back to the hotel room it would ask me to rate it or upload pictures of it to Google Maps. It can be disabled in Settings, iirc.

[1]: [https://www.google.com/maps/timeline?pb](https://www.google.com/maps/timeline?pb)

</comment></comment><comment><USER11> My guess would be:

1) Facebook (ie instagram) knows you are in a relationship

2) Facebook knows girlfriend's location from being signed in (on Instagram)

3) Facebook knows locations are at open houses from data gathered from other users or around the web. Or maybe Facebook knows that going to a few totally new random residential locations in a short period of time, combined with girlfriend's other engagement activities means user is looking for a new place to live.

<comment><USER12> Also the fact that both of them are in the same physical location frequently, at key times, even if your hadn't set your relationship status it might figure it out.

</comment></comment><comment><USER13> > Is this what the Internet is like for "regular" people? If so, holy shit. > I'm glad I use uBlock Origin on my computers and an iPhone.

Somewhere, in a dark corner in a AWS datacenter in Oregon, some third-party tracking software records "Hey, the only user within five-mile radius that blocks our ad links just finished watching a kung fu movie."

<comment><USER14> If you're going to get fingerprinted anyway, might as well save the bandwidth.

<comment><USER13> Of course, I have nothing against saving bandwidth. I just didn't expect to see an iPhone user non-ironically calling Android users as "regular people" these days. What year is it now? :P

<comment><USER15> i don't think it was because of the phone but because enraged_camel takes preventative measures to block tracking tools and "normal people" do not. note that it's "on my computers and...." not just "iphone"

</comment></comment></comment></comment><comment><USER16> > Is this what the Internet is like for "regular" people? If so, holy shit.

Presumably. Even with the best precautions (ad blocking, etc) some tracking still slips through the cracks. I don't want to imagine what it's like for the average idiot who installs every single crappy app, gives it all the permissions and logs in with their Facebook account into them.

</comment><comment><USER17> I work in advertising (check my post history).

Likely this is just "household extension". How it works:

1\. You visit my website on your phone 2\. I can now send ads to your phone, but not your desktop 3\. I enable cross-device targeting 4\. I can now send ads to your phone, laptop, and work computer 5\. I enable household extension 6\. I can now send ads to any device associated with your household (your girlfriend's phone and laptop, your son's tablet, etc.)

The more likely explanation (for the kung fu stuff) is just random chance. You get like 500 ads a day, so some of those will coincidentally line up with things you've recently done.

But your behavior (watching a kung fu movie) might have gotten you or your household added to a 3rd party audience for interest in karate, and then you get karate ads. Same for open houses - there are data providers who sell the audience "user has been to an open house recently" or more likely just "in- market for real estate services"

</comment><comment><USER18> Suppose I operate a small general practitioner healthcare facility that often has only two patients at the same time. If I offer free Wi-Fi in the waiting area, should I consider that a HIPAA violation, because I'm reasonably confident that one patient will see ads related to the other patient's medical condition?

<comment><USER19> Disclaimer: IANAL. But, probably: no. The ad company is the one at fault, as _it_ is showing a patient an ad related to someone else's condition. You're not the one showing the ad,

</comment></comment><comment><USER16> Start by switching to iOS, then for each app she installs make sure location permissions are denied. On the laptop, make sure uBlock Origin is installed.

<comment><USER20> Start by buying an expensive piece of hardware running a different operating system? Why not just use the app permissions built into Android 6.0+?

<comment><USER16> An expensive piece of hardware _from a company that has no interest in spying on you_.

The Android permissions are still not enough; there is a lot of nasty stuff you can do on Android (get low-level cell tower information, WiFi, Bluetooth, etc) that is outright impossible on iOS.

<comment><USER21> > that is outright impossible on iOS

As far as you know.

Since their OS is proprietary, security research is severely hindered, and they are inherently incentivized to hide security flaws.

<comment><USER16> > As far as you know.

Still better than leaving the capability right there in the open, no?

Also you do understand critical parts of Android like Google Play Services are closed source, and also outright malicious when it comes to a privacy standpoint (it's right there in the name - _Google_ Play Services).

Sure, you can build a privacy-conscious Android from scratch if you're tech- savvy and have lots of free time and courage. We're not talking about a tech person here, we're talking about someone who just wants to sort this problem out and get on with their life. Buying an iPhone solves that problem easily and in little time.

</comment></comment></comment></comment></comment><comment><USER22> Last Summer, I was on a Boy Scout trip and opened Facebook Messenger and it had PRE-FILLED the text of a message with "At terminal w/ Bobby waiting to board." The spooky thing is that it somehow knew:

1) I was at the airport (OK, not so hard, maybe using WiFi or GPS). 2) So was my friend's son, Bobby (who I wasn't directly FB friends with). 3) We were at a gate waiting for our plane..

Here's the thing: I hadn't posted any kind of itinerary or booked the flights myself. So, if FB was just "guessing" and did this every time a friend-of-a- friend was at the same place, you'd constantly be paired up with relative strangers crossing paths nearby.

</comment><comment><USER23> It could just be targeting. While it's possible something nefarious is going on, advertisers are really good at using available data to predict information that was never provided. In the case of the kung fu movie, it's possible IP address was used. For the open house, there could be some location correlation, but I would bet it's more than that (age, financial profile, relationship status). You can feed a bunch of data about someone to an algorithm and predict these things with pretty high confidence.

The way to avoid this is to opt out of interest based ads. iOS and Android both have options for this.

</comment><comment><USER24> Since the video of the guy talking about dog toys with chrome closed, and then seeing dog toy ads shortly after, I've become skeptical of this. So, I've begun testing it myself. I thought of something somewhat specific but random, unrelated to me, unlikely for me to see regular ads for, and now from time to time I talk about that thing. Until maybe a few weeks from now when I stop doing this, I will not be typing the thing, or anything too closely related, into any kind of text field.

I've been doing it a few days so far and nothing yet.

<comment><USER25> Antiquing?

</comment></comment><comment><USER26> The Facebook app tracks location and _other_ peoples' locations, and makes assumptions based on people being at the same place at the same time. If Facebook (or whoever) knows that several other people are all interested in new houses, and all those people + your girlfriend go to the same place(s), Facebook decides that your girlfriend might have the same interest as all those other people.

</comment><comment><USER27> This kind of "air-gap join" definitely happens based on my own experience. e.g. I get shown ads for products my kids are interested in, where I am sure I never interacted in any way online with the vendor. Also I had a /24 IP block and used some addresses for my neighbors' connections (different to our IP but within the same block). Neighbors reported seeing ads for products we bought. In fact we would joke about it, ask each other why we were seeing ads for xxx weird and unusual thing.

I'll guess that the following join keys could be used:

IP address or IP address subnet Physical location / postal address Known family or romantic relationship Offline key match such as use of the same credit card

</comment><comment><USER28> Besides ad-blockers, turn off location tracking in apps. I forgot how it is for Android, but in iOS you can disable location tracking on an app-by-app basis. And you can also partially disable it -- only allow it when the app is active, as opposed to background tracking.

</comment><comment><USER29> If you have enough data point for enough people in a large enough area, well machine learning will do the trick[1].

[1]: [https://idiallo.com/blog/machine-learning- ads](https://idiallo.com/blog/machine-learning-ads)

</comment><comment><USER25> The brilliance and scariness of the possibility that this may be where advertising technology is at reminds me of this sentiment that I can't remember the source of:

"All the brightest human minds in the world are working for advertising companies"

</comment><comment><USER30> Did either one of you login to amazon, Facebook, google, etc on one of the other persons device? If so there is likely still a tracking cookie associating you with her device. And your searches are causing her device to be targeted.

<comment><USER31> You are logged in to Android phones all the time. Not that it matters since they know who owns the phone.

</comment></comment><comment><USER32> Note that this is not data leaking from one person to the other. Here the ad networks know specifically that the two people are doing stuff together, but that they are not the same person.

</comment><comment><USER33> 1\. Did she discuss looking at houses with you or anybody in emails or social media messages?

2\. Did her smartphone location ever correspond with a house that is listed on the MLS in the past week?

</comment><comment><USER34> Does she leave WiFi, Bluetooth, NFC, or other non-phone communications active on her phone all the time?

</comment><comment> j-c-hewitt Did you guys use zillow/trulia to look up listings?

</comment><comment><USER35> did you invite her to come see the open house by texting her "hey, wanna come see an open house"?

<comment><USER36> if you mean whatsapp, the content of messages is not available to whatsapp/facebook systems (it's end-to-end encrypted).

<comment><USER16> They could still extract keywords on the sender or recipient device and send them independently of the message; the message is still encrypted but keywords such as "buy" and "house" were submitted to Facebook anyway.

I don't buy the "end to end encryption" argument. If the app used encryption for the benefit of their users it would absolutely make no sense for Facebook to buy them for billions. The reason FB did so anyway is that they have a workaround the E2E encryption like described above.

</comment></comment></comment><comment><USER37> I don't know how this is happening exactly, but I want to add that it has also been happening to myself and to my friends for quite some time.

</comment><comment><USER38> This is the result of all the years of data mining and tracking. Now they can see your phone is at an open house and make an educated guess (which is all it is), that you're interested in buying homes.

All your web traffic is tracked too, unless you only use sources that explicitly do not track, such as duckduckgo.com. Check out [https://ssd.eff.org](https://ssd.eff.org), you might find it helpful.

</comment><comment><USER39> This was happening to me until I removed Facebook and Facebook Messenger from my phone. I believe these apps listen to conversations even when you aren't using them. I am not alone in believing this.

<comment><USER40> > _I believe these apps listen to conversations even when you aren't using > them. I am not alone in believing this._

I have evidence of same and it may not be just FB and Messanger

Last week a co-worker engaged me in a discussion concerning her father-in-laws diagnosis of prostate cancer. This lasted about 20 or 30 minutes. I had my cell phone on me. I do not have FB or Messanger.

I _do not_ deal with cancer cases at work. I _did not_ google any information on prostate cancer. I _did not_ send any mails pertaining to prostate cancer or any other form of cancer.

Two days later I start getting ads and suggestions for prostate cancer treatment options. How unlikely should that be?

I am trying to reproduce the effect by talking about other rare disease conditions with my phone switched on.

If the bugger is spying on me I'd like to know.

<comment><USER41> What kind of phone? The rest of us might want to get in on this test too.

<comment><USER40> Motorola running the latest version of Android; but I suspect it is the google search feature that is doing the snooping.

</comment></comment></comment></comment><comment><USER42> It seems to me as though this is the exact reason that Zuck was called in to testify. We have a reasonable understanding and can at least comment intelligently, but the public sees this, and clearly calls fowl. Being unable to stop it, they demand action from their senators. There's a reckoning coming I reckon --- it reminds me of GDPR in Europe.</comment>


Ask HN: API for restaurant reservation? - <AUTHOR> Is there an API for doing restaurant/bar reservations? Something like OpenTable that can be accessed programmatically? <comment><USER2> I doubt you're going to find one, it's easily abused and lets you intermediate what should be their users.

</comment><comment><USER3> I'm not sure if you can still access Resy's API but you can try [http://resy.github.io](http://resy.github.io).</comment>


India blocks Colgate patents for spices - <AUTHOR> http://www.deccanherald.com/content/490282/india-blocks-colgate-patents-spices.html <comment><USER2> Imagine all the countless hour of pointless human labor that could be saved if we simply abolished patents. How many man hours has been wasted in these thousands of cases? And for what? How is patenting combination of spices going to increase innovation?

But then again I suppose this "solves" the problem that there's not enough productive work to go around.

In a 100 years perhaps all human endeavor will be about fighting over imaginary monopolies.

<comment><USER3> > abolished patents

> How is patenting combination of spices going to increase innovation?

I'm sorry, but you seem to have jumped from "patents" to "patenting combinations of spices" here. I don't think that you did this intentionally, but you replaced the topic in between; first, you formulate your thesis as "we should abolishing patents", and later, you seem to be proving it, but you really only prove a different thesis, "we should abolish patenting combination of spices".

Don't you see the difference between these two?

<comment><USER4> Err, this is called exemplification. It is a common rhetorical device. Really this could have done with any patent, which all need to go.

<comment><USER3> With any? Really?

</comment></comment></comment></comment><comment><USER5> Some background on the TKDL: [http://www.independent.co.uk/news/world/asia/the-battle- for-...](http://www.independent.co.uk/news/world/asia/the-battle-for-ayurveda- india-is-racing-to-record-the-details-of-its-traditional-medicine-760086.html)

Kudos to the Indian government for coming up with an effective way to combat these bogus patents.

</comment><comment><USER6> OT but this is not the first comment to I don't think I am hijacking.

Page loads fine (Actually started reading the article) then goes to [http://www.deccanherald.com/enable_javascript.html](http://www.deccanherald.com/enable_javascript.html)

How retro (Plus the fact that the page actually DOES work without JS...)

</comment><comment><USER7> the "prior art" for this is ancient Indian textbooks of medicine - [http://www.tkdl.res.in/tkdl/langdefault/common/SourceInfo.as...](http://www.tkdl.res.in/tkdl/langdefault/common/SourceInfo.asp?GL=Eng)

The TKDL (Traditional Knowledge Digital Library) interface really sucks.. but still has useful info.

Ayurveda - [http://tkdl.res.in/tkdl/langdefault/Ayurveda/Ayu_Advancesear...](http://tkdl.res.in/tkdl/langdefault/Ayurveda/Ayu_Advancesearch.asp?GL=Eng)

Unani (Islamic Indian medicine) -[http://tkdl.res.in/tkdl/langdefault/Unani/Una_Advancesearch....](http://tkdl.res.in/tkdl/langdefault/Unani/Una_Advancesearch.asp?GL=Eng)

Siddha (South Indian medicine) - [http://tkdl.res.in/tkdl/langdefault/siddha/Sid_Advancesearch...](http://tkdl.res.in/tkdl/langdefault/siddha/Sid_Advancesearch.asp?GL=Eng)

Try searching for something like "basil". you get comprehensive formulae for ancient indian recipes, methods of application,etc.

</comment><comment><USER4> "Dalchini", BTW, is literally "lentil sugar". Put some in your lentils for added yum.

<comment><USER8> This is probably a misspelling for darchini, i.e. cinnamon

<comment><USER9> It's not a misspelling: the Hindi word is _dalchini_ , and the Bengali word is _darchini_.

<comment><USER8> That's interesting, because my Urdu speaking family in Karachi always says darchini for some reason.

cf. [http://dsalsrv02.uchicago.edu/cgi- bin/philologic/getobject.p...](http://dsalsrv02.uchicago.edu/cgi- bin/philologic/getobject.pl?c.3:1:5612.platts)

</comment></comment></comment></comment><comment><USER10> "You know what they call alternative medicine that's been proved to work? - Medicine." \- Tim Minchin

This quote used to really sum up my opinion, but the more time I've spent growing and eating and researching a variety of plants/herbs/spices, it's quite clear that many of them do have quite a lot of beneficial health effects, often unique in being more effective or having less side-effects than western medicine. Plants have chemical-producing machinery that is in many ways far more advanced than what humans have developed.

And many of them have been under-researched, I think both because of 20th century biases and the regulatory/patent environment, so in fact there's quite a gap between what we call medicine and treatments in alternative medicine which could be reasonably considered likely beneficial/effective.

Just as an example, go read the Wikipedia pages and some assorted Googled info on what was listed in the article: nutmeg, ginger, "Bakul" tree, camphor, cinnamon, turmeric, Indian banyan, black pepper, long pepper, Neem and clove.

<comment><USER11> absolutely.

so please, once you have a serious condition only take your spices.

no penicilin (or does it count as mold?), no insulin, no aneasthesia for you. just a little cinnamon.

wear glasses or contacts? away with them! a little pepper in your eyes works wonders.

and they wonder why seattle has lower polio vaccines rates than kazakhstan or tchad.

<comment><USER12> English is not my first language, but I kinda read the OP's post as "Guys, we should throw some money in investigating some natural remedies, using the scientific method and stripping them of bullshit, to see what works, why and how"

</comment></comment></comment><comment><USER13> Javascript required.

<comment><USER14> In firefox: Preferences -> Advanced -> enable "Warn me when websites try to redirect or reload the page".

Other browsers will probably have similar options.

<comment><USER15> How to activate this on Firefox on Android? Do you know the name of the corresponding entry in about:config?</comment></comment></comment>


Pigeon transfers data faster than South Africa's Telkom - <AUTHOR> http://www.news.com.au/technology/story/0,28348,26053119-5014239,00.html

<comment><USER2> See <http://news.ycombinator.com/item?id=813313></comment>


Just give the One Finger Salute and Keep Going - <AUTHOR> http://feeds.feedburner.com/~r/oreilly/radar/atom/~3/117863584/just_give_the_o.html <comment><USER2> Looks like the man actually gave two middle fingers.</comment>


A major new Intel processor flaw could defeat encryption and DRM protections - <AUTHOR> https://www.theverge.com/2020/3/6/21167782/intel-processor-flaw-root-of-trust-csme-security-vulnerability <comment><USER2> [https://en.wikipedia.org/wiki/RDRAND#Reception](https://en.wikipedia.org/wiki/RDRAND#Reception)

I'm inclined to believe this wasn't a "flaw" and was intentional design.</comment>


Tracked calories and macros for a year – analysis suggestions? - <AUTHOR> https://nutritionize.co/analysis/guan/ <comment><AUTHOR> I've put together a simple moving average analysis that lets me analyse my nutrition/bodyweight history in two things I find useful:

1\. measuring how consistent I've been with my calories/macros (blue line), compared to the targets I've set (white line),

2\. extract my averaged bodyweight values so that I don't get hung up on singular ups and downs.

I'd love to pick your brains and hear suggestions on what other types of data analysis might be useful here.</comment>


Bitcoin price is crashing - <AUTHOR> https://www.cnbc.com/quotes/?symbol=BTC= <comment><USER2> Not just bitcoin, its all going down. Total crypto market cap has dropped from $650B yesterday to $477B now and dropping still.

<comment><USER3> Most of the altcoin market caps you'll see are calculated by their exchange rate to BTC, which is then converted to USD based on the BTC/USD exchange rate.

</comment></comment><comment><USER4> Just as how bitcoin grew (network effects), it will crash just as hard (network effects). I sold it all, yesterday :-) I think it will stabilize around some point and then grow again. I'm waiting until it stabilizes.

<comment><USER5> Yeah, was a good point for selling. I suggest the price will continue to drop.

</comment></comment><comment><USER6> Note that, with the BTC/USD seeming to have stabilized at around 13,000 for the moment, for everyone that got in by Dec. 6 (two weeks ago), this is still a win.

As long as there are still that many winners, I don't think the number of losers (ie, people that got in during the past two weeks) are sufficient to panic those winners.

To really trigger a fire sale, I believe you'd need a larger number of losers.

<comment><USER6> OK, it's _rapidly_ falling now. Perhaps we get to see a fire sale today, after all!

</comment></comment><comment><USER7> Whee, the fifth crash this year. That was a rather short one.

<comment><USER7> Oh, it wasn't over yet. 11 days of gains lost...

</comment></comment><comment><USER8> All the more reason to do your christmas shopping early. Lol. I take the total crypto market cap more seriously though.

</comment><comment><USER9> ETH is crashing too.

<comment><USER3> I haven't even received my ETH from coinbase yet and it's still worth about 25% more than I paid for it. I wouldn't call that a crash.</comment></comment>


Registering to vote can allow re-identification of your anonymized data - <AUTHOR> https://medium.com/swlh/the-privacy-cost-of-voting-1907d0c9c6df <comment><USER2> There is a whole field of research called Differential Privacy that deals with, basically, how much and what data you can release and what information can be deduced from that. It is fascinating and has many applications from advertising (FB demographics...) to medical research.

</comment><comment><USER3> Not sure if "another reason not to vote" is what we need right now</comment>


Ask HN: How hard is it to find meaningful work? - <AUTHOR> Hey HackerNews,
A bit about me, I've been programming since 11, I started with Pascal and have dealt in many varieties of programming (game programming, backend, frontend, kernel, low level systems, you name it and I probably have messed around with it).
I graduated HS, I got enough marks that I had choice of any college and any degree in my country. I finished my degree last year, and I have been working since the start of this year.
What I have found is that, the joy that I found in programming doesn't really exist at work.
I'm largely just moving JSON around, I'm not really working on any unsolved problems, just adapting existing ones to specific business cases. And not many people care about quality software, they just want software out fast, so they have insane deadlines. (I am outputting 200-400 LOC of garbage code a day at the moment on average)
I feel like I've been fed a lie somewhat, "Do what you love and you will never have to work another day in your life". I am somewhat regretting majoring in CS, maybe I should have majored in something that makes more money, maybe I should've become a Mechanical Engineer, I love math, so solving math heavy problems at work sounds fun.
Its thrown me into a bit of an existential crisis, is this my life for the next 40 years or so? <comment><USER2> It will help if you find meaning in the work that you are doing than finding a meaningful work.

When I graduated, I had similar experience. I was deep into cs and loved the art of programming. But then I was writing SQL queries for most of my day. I was upset but during this time I also spent incredible amount of time learning how databases work internally, optimising SQL and Db through low level traces. Another really useful thing I learnt in this job is users. My users were financial controllers, warehouse managers. The job gave me a deeper understanding of how users think, what they know and what matters for them.

Over the years I worked with many tech and product shops but the amount of insights and learning at that job are incomparable. I just had so much tim to learn things I would otherwise not spend time on.

A software problem is intriguing and fun to work on but it's not always meaningful to others.</comment>


Japanese bookshop stocks only one book at a time - <AUTHOR> https://www.theguardian.com/books/2015/dec/23/japanese-bookshop-stocks-only-one-book-at-a-time <comment><USER2> This works because a bookseller can return unsold books. So, he is not stuck with unsold stock that accumulates.

Other kinds of products may be more difficult to fit into this scheme.</comment>


Philosophers using science and data points to test theories of morality - <AUTHOR> http://qz.com/648407/philosophers-are-increasingly-using-empirical-data-to-test-theories-of-morality/ <comment><USER2> That Knobe effect that was mentioned sounds like people weighting negative effects more than positive ones. People often take things for granted until there's a problem. It's possible troublemakers are judged more harshly than problem solvers.

<comment><USER3> From what I just read, it doesn't even sound that deep. If you ask me whether a good act was "intentional", I'd assume you mean whether the good effect was the purpose of the act. But if you ask whether a bad act was "intentional", I'd assume you wanted to know whether the bad effect was known in advance. That is, there seems to be different connotations for "intention" in relation to good and bad intents.</comment></comment>