Ask HN: Cookies vs. JWT vs. OAuth - <AUTHOR> I'm using passport.js with a local strategy for authentication, and I'm using sessions/cookies for keeping state and keeping the user logged in.
I'm not very knowledgeable in security (that's why I'm asking here), but will using JWT (with the token stored in the cookie) to keep the user logged in  instead of sessions/cookies make my application more secure when the passport middleware executes req.isAuthenticated? I thiiink somewhere in that call it checks cookies or jwt, depending on implementation.
Also, I do not plan on opening the API to other sites, so OAuth is unnecessary. Is my understanding correct? <comment><USER2> No, using JWT will not make your application more secure. Continue using cookies. Don't buy into the JWT hype. You'll probably want to add a CSRF token.

You're correct in stating that implementing an OAuth provider is unnecessary.

I suggest reading the OWASP security guides. Start with Session Management Cheat Sheet [0], and after that Cross-Site Request Forgery (CSRF) [1].

Don't fear the cookies, all their gotchas are well documented and understood. There's lots of valid use-cases for stuff like JWT and OAuth, but I wouldn't bother with it at all until you're more comfortable with digging into the AuthN/AuthZ minefield. I'd consider understanding session management with cookies a precursor to trying to do anything fancier.

[0] [https://www.owasp.org/index.php/Session_Management_Cheat_She...](https://www.owasp.org/index.php/Session_Management_Cheat_Sheet)

[1] [https://www.owasp.org/index.php/Cross- Site_Request_Forgery_(...](https://www.owasp.org/index.php/Cross- Site_Request_Forgery_\(CSRF\))

<comment><USER3> > "No, using JWT will not make your application more secure. Continue using > cookies"

Cookies vs JWT makes no sense. You can put the JWT in a cookie if you want to.. apples and oranges.

<comment><USER4> Absolutely. Though, when people say cookies vs JWT, what they mean is:

Cookies: a simple session ID, a random number, stored in a cookie.

JWT: a JSON object stored in local storage that specifies authorization of some user that is authenticated by public key cryptography. JWTs can be configured in many ways, but this is what people usually mean because they want their sessions to be "stateless."

Way way more often than not, the "cookie" solution is better because it's far simpler. JWTs come with a tremendous amount of complexity with few benefits.

<comment><USER5> My big issue with JWTs: securing images. With cookies, a browser attaches the cookie on the image request. With JWT, a browser does not send it with the request. Cookies are far easier in this case.

<comment><USER6> JWTs are small enough that they can fit in a URL most of the time. So there's always that option.

<comment><USER2> I believe it is generally considered unwise to attach your authentication token to the URL, as it's highly likely to end up in a bunch of access logs.

<comment><USER7> If the token is only good for one use or for a short period of time (minutes not hours) it's probably fine. I've used them in URL's for invite links. One time use that expire after a short amount of time. Probably not perfect for high security applications like banks or health care but for most applications it's fine.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> To answer as best as possible given the vagueness:

Cookies: Highly compatible with most if not all browsers (and even headless tools). Lends themselves to having an expiry date and generally best when used with time sort of short-lived expiring session.

JWT: Everyone tends to use these in a stateless manner which means once issued, somewhat impossible to revoke without invalidating all JWTs or having a blacklist (and we're back at stateful). Plus some implementations had issues with downgrade attacks I think it was...

OAuth 1: Fine assuming you could keep clocks in sync and guarantee the secure storage of the keys/secrets. Good in that it didn't rely on HTTPS but if the secrets ever got compromised then the attacker would have free reign of that account until detected.

OAuth 2: Basically a complicated way to get short lived session tokens, potentially from a 3rd party API/auth source. Relies entirely on HTTPS to keep data secure in-transit and less of an issue if the session token gets compromised since its ideally short lived (because most want it to be stateless - those who keep a valid list of tokens sometimes skip the token expiry).

<comment><USER9> Before going all the way on cookies, make sure to consider whether you're creating a mobile app, as mobile apps usually don't handle cookies for you automatically. In my experience, OAuth is a bit easier in mobile. If you support cookies for browsers and OAuth for mobile, your API will have to support both authentication methods.

<comment><USER10> Why not tokens? They're easy and work well with an Authorization header on mobile.

<comment><USER11> I'd argue that they can also be implemented in a much more lightweight fashion than having to go through a whole OAuth flow just for a mobile app that hits an API that you control completely.

<comment><USER12> Then you have to deal with password resets and account creation, which if you know how those work, don't really sound all that lightweight compared to OAuth 2.

</comment></comment></comment></comment></comment><comment><USER13> Every time I looked at OAuth I found it overly complex for what I wanted to do. Thus, never actually implemented that, maybe I am missing something on that, though.

JWT is great until you get to the point where you want to have things like token revocation.

A simple session mechanism we use for our apps:

\- Upon sign in, generate a session token, e.g. 32 characters. Session tokens are unique and fully random, not derived from any actual data

\- In our scenario, a user can have multiple session at a time. We store two mappings in a Redis database; user-id=>user-object (for caching purposes, serialized JSON) and session-id=>user-id

\- The second mapping has an expiration time which is the session length eventually, e.g. 30 minutes

\- Upon every request, we take the session id from the request (header or cookie, cascadingly) and look for the session-id in Redis. If found, we prolong the time to live of that entry. From Redis, we got the user-id (because of the mapping) and thus we can retrieve the cached user object, too.

So we have a meaningless token (at least externally), our backend is still stateless (at least the application itself, Redis is stateful in nature) and we don't have to reinvent any wheels for automatically terminating sessions. In addition, it's easy to cancel session on demand and build a blacklist.

We wrote the handling ourselves (except for the crypto of course), because no express.js related library/middleware was flexible enough. And eventually we kind of trusted nobody.

<comment><USER14> > JWT is great until you get to the point where you want to have things like > token revocation.

What a flawed argument, there are techniques that allows for session revocation, even in an async stateless jwt context, i.e. By blacklisting, which will work great, and give you some nice properties, depending on your infrastructure and design.

Sadly, some appear to assume jwt is some special solution that does X right and y wrong.. but its really nothing other than a structured format in the end. But surely a lot of people do a lot of wrong stuff when deploying their stuff on top of jwt.

<comment><USER13> > What a flawed argument,

Touché!

> session revocation, even in an async stateless jwt context

> blacklisting

But isn't blacklisting stateful in its nature and thus achieving the opposit of what JWTs are for? Am I missing something obvious?

<comment><USER15> I think you have this right. This was also my experience with JWTs - go far enough down the revocation rabbit hole and it seems you just end up with a stateful solution again, but just with a more complex and expensive token verification mechanism (compared to just equality checking the token value). At that point, it really seems pointless.

<comment><USER16> >you just end up with a stateful solution again

It checks the "stateful" box in a nominal way, but it does not have the drawback of stateful session cookies that "stateless" defines itself in comparison to: in the backend, the session is still not in-memory or in-db on a single machine.

So you don't really go back to "stateful" except nominally; a very large part of the scaling benefit remains.

<comment><USER15> Let me be more concrete, maybe it will illustrate the point I'm trying to make better and/or highlight some aspects I'm wrong about.

I'm aware of broadly two schemes for revocation support with JWT:

1) _Immediate_ revocation - keep a blacklist in state on a single machine. On verification of the JWT, check the blacklist and only succeed if it is not present.

2) _Eventual_ revocation - keep a renewal token in state on a single machine, and give your JWTs an expiry time T. On verification of the JWT, if verification fails due to expiry then try to renew the JWT using the renewal token, and if successful then succeed the verification and also return the new JWT to the client. To revoke the JWT, just revoke the stateful renewal token. The JWTs can therefore be revoked eventually within a max time of T.

\--

So, the above Vs the classical stateful session token (from here SST) approach:

Both 1) and 2) contain the same 'single stateful machine' limitation as SST, yet are more complex to understand, reason about and maintain.

In 1) you get no additional benefits over SST, and you have completely nullified the statelessness and therefore scalability of JWT. You also get the additional downside of a more computationally expensive token verification than just a simple equality check.

Conclusion - it seems irrational to use 1) over SST in all cases.

\--

In 2) you get precisely one potential benefit for scalability - that for a time (max T) you get a stateless 'cache' for the verification of the JWT, which will horizontally scale to infinity. This MAY give you some practical benefit at massive scale, but there are two significant downsides:

A) You have a max lag T on revocation of the JWT, which is a security hole if the JWT is stolen. So you'd like to minimise T - but not so much that you lose the benefit of the 'cache' \- otherwise the whole thing is pointless. You have to literally trade off security for scalability! Where do you draw that line?

B) The whole system is very much more complex to operate, debug, and reason about, than SST. You have verification logic that is split across 1 central stateful renewal token server & n JWT verification servers.

Conclusion - the scalability gain of 2) comes only as a trade off against security. Even assuming you are able to accept this trade off _at all_ it is really unclear to what extent you should do so, and indeed if the whole complexity of the thing is even worth it after all that.

\--

Perhaps there is another way to do revocation of JWTs that I've missed that is clearly superior to SST, maintaining stateless verification without any clear security trade offs. If so please educate me - I would love to discover it!

Otherwise, I concede that scheme 2) _might_ be a better option than SST in some very rare and special cases, but in general if revocation is needed, then JWT does not make sense in place of SST.

<comment><USER17> I'm using JWT for auth on a microservice so that it doesn't have to phone home to authorize requests. For revocation, the user service pushes the revocation to the microservice, which maintains its own blacklist. JWT works great for us because it contains all of the identity necessary for auth decisions on the microservice. An opaque token would require the microservice to phone home to get a user's identity data.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Cookies are a mechanism to store data in the client. Jwt token will still need to be stored somewhere (for example in a cookie).

To me, saying Cookies vs JWT doesn't really make any sense. It's like asking what is more secure, JSON or MySql?

<comment><AUTHOR> I just updated my question, as it was vague. I'd appreciate your input!

</comment></comment><comment><USER19> First of all, that question is kinda weird as those three are not of equal type. For example, OAuth uses JWT and JWTs can be stored in cookies, but as far as I know they aren't normally.

The differences between classic a session ID in a cookie vs. JWT is more or less, that JWTs often hold encrypted session information (stored on the client), while the session ID is just a random identifier and the session data is stored on some server (so its easier to build scaleable solutions with JWT). Security wise you might be interested, that cookies are sent automatically while JWTs are not (unless they are saved within a cookie).

You might wanna read: [https://stackoverflow.com/questions/37582444/jwt-vs- cookies-...](https://stackoverflow.com/questions/37582444/jwt-vs-cookies-for- token-based-authentication)

<comment><USER9> Just to be clear, JWTs may be encrypted (JWE), but are almost always just signed (JWS). Don't store data you don't mind exposing in a signed JWT.

<comment><USER20> since i was looking into GDPR, a JWT token containing signed data may potentially be a source of private data (i.e., you store the username there), and therefore, have to have a way to clear it, and/or ensure that it is encrypted in transit.

</comment></comment></comment><comment><USER21> Make sure you set HttpOnly for session cookies to eliminate XSS token stealing. If you use localStorage in an SPA for tokens make sure you set up the scope such a way to minimize XSS token stealing. Not sure how the rest of your app works but make sure you use some anti-CSRF library.

</comment><comment><USER22> This kind of question appears often here. I found the following discussion very informative: [https://news.ycombinator.com/item?id=16157002](https://news.ycombinator.com/item?id=16157002) (as you can see, there are very different and conflicting opinions about what are the best practices).

I'd find it very helpful if somebody can recommend a resource, like some book, course or blog post that thoroughly explains the best practices and recommended strategies about authentication for APIs, websites and mobile apps in client/server and server/server communication.

</comment><comment><USER23> These are three different things.

Cookies: a storage mechanism. If you use simple cookies (session GUID) for authentication, you must maintain state in some persistent storage to tell if a session ID is valid or not. httpOnly, secure cookies and CSRF protection are also required.

JWT: a digitally signed document containing claims about a user. Can be stored in a cookie or in localStorage or in your mobile app's memory/temp storage. You can be stateless as the validity of the token is protected by its digital signature.

Oauth: a protocol for authorization. Can embed the authorization claims in a JWT token among other ways.

</comment><comment><USER24> Haha, oh man I've spent a lot of time thinking about exactly this. I don't think I've got much to add that anyone else hasn't already said, but:

Cookies - well known, hard to footgun yourself

JWT - new, complicated to implement, easy to footgun yourself

OAuth - generally only works in certain security models. You're probably still going to end up using cookies or JWTs as part of your OAuth state management anyways.

Personally, I use cookies for all "apps" and I'll use JWTs when I need authn/authz in a more complicated microservice architecture where the "clients" aren't browsers.

</comment><comment><USER25> This is such a vaguely worded question and spec that I doubt you'll get anything out of it. All three are fine in the right context and not even mutually exclusive.

Maybe do some basic research first, then ask with more details on your setup and what is important vs not important.

<comment><AUTHOR> I just updated my question, as it was vague. I'd appreciate your input!

</comment></comment><comment><USER26> I just use sessions, backed by cookies.

I find with JWTs you end up dealing with cookies in the end, because on browsers you're definitely going to want to persist the token in a cookie so the user can have access in between requests.

Also, for the apps I develop, I often need to request the current user from a persisted database, so I'm doing a DB lookup on every request no matter what. Sure, I could cache this request in Redis but even on apps that have had to do this hundreds of thousands of times a month, it never caused any performance issues reading it directly from Postgres.

</comment><comment><USER27> I found this to be a great resource when groking your question recently

[http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt- fo...](http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for- sessions/)

Also this previous HN thread [https://news.ycombinator.com/item?id=13865459](https://news.ycombinator.com/item?id=13865459)

</comment><comment><USER28> I've never thought of JWT as being something you would want to use in a unified application, it tends to shine in situations where one application is the authorizing agent for another application not totally in its control (e.g. private Docker registry auth). You can set expiry fields in JWT, so revocation isn't the concern everyone is saying it is. Also, just because a form of auth is out in the open it doesn't mean it's less secure (TLS, anyone?).

<comment><USER7> > You can set expiry fields in JWT, so revocation isn't the concern everyone > is saying it is.

The issue with JWT revocation is if someone has a JWT that says they are an admin and then you make them not an admin or if an admin (or any for that matter) account is breached it's difficult to remove access from the attacker. With a session you just change the password and kill the session. This can be mitigated by short expiry times but a lot of damage can be done in a short amount of time by a determined attacker.

</comment></comment><comment><USER29> If you needed to auth users on both a mobile app across platforms, and a browser, it makes sense to store and xmit user session information in a JWS or JWE, using it as an abstraction which you can serve as a cookie to the browser, and handle consistently across apps. If you get into multifactor auth, implementing it in JWT becomes more useful. A full OAuth provider seems heavy for what you've described.

</comment><comment><USER30> There are a few benefits of using something like OAuth even if you don't plan to open your API to third parties.

1\. You may decide you want to have multiple first-party clients to your API. Examples would be a web site, a native client, a command-line app. OAuth lets all of these different applications call the same API once they get a token.

2\. There could be security value in segmenting the user authentication into an entirely separate app with its own database - it greatly reduces the attack surface which could be leveraged to get your user credentials to attacks against your user authentication (and likely registration) app, vs your entire website and all your APIs.

3\. If you decide to open up your API in the future, you have already done a significant amount of the architectural legwork.

4\. If you decide to support social logins (Facebook or Google for instance) in the future, you can do so just at your personal OAuth authorization service. Your apps don't care how they get an access token, and your APIs are still getting a local access token that they understand (rather than trying to understand Google or Facebook tokens).

</comment><comment><USER31> Don't use JWT or local storage for storing sessions. It's pointless/potentially less secure. Just use sessions and cookies.

Here are some good blog posts that explain this better than I can (the flow chart in 3 is particularly illuminating):

[1] [https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is- ba...](https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard- that-everyone-should-avoid)

[2] [http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt- fo...](http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for- sessions/)

[3] [http://cryto.net/%7Ejoepie91/blog/2016/06/19/stop-using- jwt-...](http://cryto.net/%7Ejoepie91/blog/2016/06/19/stop-using-jwt-for- sessions-part-2-why-your-solution-doesnt-work/)

</comment><comment><USER32> > I'm using sessions/cookies for keeping state and keeping the user logged in

Good. Sessions are the standard for a reason, and it's currently considered best practice. And if you've got a session ID, and your clients support cookies, then sure, use cookies for storing them.

> will using JWT (with the token stored in the cookie) to keep the user logged > in instead of sessions/cookies make my application more secure

No. Probably less secure, although if you know what you're doing you can mitigate the issues. But certainly not _more_ secure.

</comment><comment><USER33> There are situations where you can't use cookies like when developing mobile apps [0]

[0] [https://stackoverflow.com/questions/31139365/can-you-use- coo...](https://stackoverflow.com/questions/31139365/can-you-use-cookies-in-a- cordova-application)

We only stoped using cookies because of that since we wanted a more universal implementation so minimal changes had to be done between a web app and a mobile app implementation.

Other than that we would keep using session cookies.

<comment><USER34> Not familiar with the framework referenced in your link, but if you are doing truly native development on iOS, the URL loading supports cookies [0]

[0] [https://developer.apple.com/library/content/documentation/Co...](https://developer.apple.com/library/content/documentation/Cocoa/Conceptual/URLLoadingSystem/CookiesandCustomProtocols/CookiesandCustomProtocols.html#//apple_ref/doc/uid/10000165i-CH10-SW1)

<comment><USER35> Cordova wraps a web app into a native container. I've never used it, but i guess it doesn't use (or expose?) the native loading API…

</comment></comment></comment><comment><USER36> For your case, you do not need JWT.

Stateless JWT is useful in the scenario where one server is capable of authenticating a user (through password, social login, one-time password, etc.), and a different server holds resources that the user is trying to access.

The server doing the authentication will issue a stateless JWT with all the user credentials cryptographically signed, so that the user can pass the JWT to the server holding the resource to be granted access, assuming that server trusts the authentication server to perform authentication correctly.

Stateless JWT is useful here because the server holding the resources can verify the credentials of the user without contacting the authentication server.

Regarding OAuth, there are 2 sides to it. You can become an OAuth provider, which I reckon you are not interested to be. What you may be interested is to use OAuth to enable users of OAuth providers like Facebook, Twitter, .etc, to access your service, so that you minimize what you have to develop in terms of user management, i.e., you don't have to worry about user creation, email verification, password resets, etc., because all those have been performed by the OAuth providers.

I believe passport.js allows you to use OAuth to allow OAuth providers' users to access your service. passport.js may be a backend-base solution so you have to be somewhat familiar with OAuth to get started.

Alternatively take a look a [https://oauth.io](https://oauth.io), which has a front-end based solution; I am not saying a front-end based solution is better, but rather it's easier to understand for someone starting out. Moreover they have JS fiddles that you can instantly play around with.

Check out the JS fiddle for creating a 'Login with Github' for your website here in just a couple of lines of Javascript: [https://jsfiddle.net/dg9h7dse/1/](https://jsfiddle.net/dg9h7dse/1/)

There is a full explanation of what the code is doing here: [https://coderwall.com/p/sjbwcq/javascript-github-social- logi...](https://coderwall.com/p/sjbwcq/javascript-github-social-login-button- for-oauth)

</comment><comment><USER37> Cookies have some excellent security features ("secure" flag, "http" flag to prevent javascript from acesssing it, and "same-site" flag for CSRF prevention on modern browsers).

Don't use other storage mechanisms for storing anything secret. Nothing beats cookies today.

</comment><comment><USER38> A related topic that you might find interesting:

[https://air.mozilla.org/macaroons-cookies-with-contextual- ca...](https://air.mozilla.org/macaroons-cookies-with-contextual-caveats-for- decentralized-authorization-in-the-cloud/)

<comment><USER39> I've worked with Macaroons (writing custom tools and libraries) and Macaroons are definitely more complex than JWTs. Don't be fooled with one signature algorithm, there are more things hidden under the surface (e.g.validation of a set of Macaroons requires finding cycles in a graph and symmetric decryption of data). If you really need tokens use constrained JWTs. Better: just use random strings.

</comment></comment><comment><USER40> Some thoughts on when it's ok to use JWT [https://techblog.bozho.net/using- jwt-sessions/](https://techblog.bozho.net/using-jwt-sessions/)

</comment><comment><USER41> JWT's are stateless and cookies are not, you can achieve the same thing with cookies as with JWT if you store your sessions in redis etc.. for api's I'd recommend JWT's.

<comment><AUTHOR> I just updated my question, as it was vague. I'd appreciate your input!

</comment></comment><comment><USER42> As long as you protect against CSRF attacks (I do not know anything about passport.js), cookie authentication is okay provided the API is not going to be consumed by external sites.

</comment><comment><USER43> Using cookies with Domain option allows you to share a cookie between `api.site.com` and `www.site.com`.

You can combine that with a `Authentication Bearer` for releasing a public API access.

</comment><comment><USER44> JWT is more a "lingua franca" token since it is not binded to a "http context", but in the end, cookies and jwt tokens or any other kind of authorization tokens are simply a way to identify a user. As i told you before JWT tokens are more loosely coupled to http request than cookies so they may be a best choice, especially if you plan to build stateless apis. The only strictly important rule is: do not store any sensitive informations on client side data structure since you can't trust the client side.

<comment><USER45> > do not store any sensitive informations on client side data structure since > you can't trust the client side

Except that the tokens are cryptographically signed, so as long as you verify them, you can trust them.

</comment></comment><comment><USER30> These three concepts are largely orthogonal, but pair well.

Cookies are a state management system for HTTP, which is normally stateless. Rather than representing state via data embedded in the URL or requiring intelligence in the HTTP stack to represent that state in application-specific headers, Cookies allow the server to set state on a response which will be returned on subsequent requests. The browser doesn't need any special rules behind the generic cookie retention rules.

Cookies can be used for any sort of state, but in this context you probably care about authentication/authorization state. Nearly every website which uses a web-based authentication flow (including OAuth and OpenID Connect) winds up using cookies to track authentication state.

OAuth is a HTTP-based framework for providing delegated authorization. Rather than sharing user credentials with every piece of code which may want to access resources associated with a user, the Authorization Service handles authentication as well as user consent to let a client act on their behalf. While there are several flows to account for different application requirements, this eventually results in an access token, a usually time- limited value which represents access to just the capabilities the user consented.

Facebook, Microsoft, and Google all use variants of OAuth to share user authentication as well as provide access to user information and API access to user accounts. There are challenges to OAuth interoperability, with many deployments adding additional capabilities outside the specification (such as representing user authentication). Facebook has their own extensions, while Microsoft and Google support the more standardized OpenID Connect as a interoperable profile.

Since the access token is state, there is nothing forbidding it from being set as a cookie. However, anyone who can get this token can perform actions as the user (bad) as your application (from a purely selfish perspective, worse). Many server-side web applications which store access tokens will either store them in a database and reference the row in a cookie, or store them in an encrypted cookie to prevent them from being extracted and used externally. One way to store such data in an encrypted cookie is via a JWT.

A JSON Web Token is a data format defined by the OAuth working group. Access tokens are really messages for the "Protected Resources" in OAuth parlance - typically API endpoints. However, the core specification did not define any format for these values, leaving them deployment-specific. JWT was an attempt to provide a good recommendation for the format, and was also designed to be leveraged by OpenID Connect (which both extend core OAuth with new functionality and provide an interoperable profile of usage).

It is typical that since security is hard, formats that take security into account (such as JWT) wind up getting both overused and oversold. People want to be able to say things like "our authentication is secure because we use JWTs", but instead statements like that are usually a red flag that the system was implemented by people who did not understand the overall security requirements.

</comment><comment><USER46> No, it won't be more secure, just less standard and possibly more difficult to work with.

</comment><comment><USER47> If I am implementing just a backend API, what security strategy should I follow?

</comment><comment><USER12> > but will using JWT to keep the user logged in instead of sessions/cookies

You can't use JWT without cookies, or local storage (which is effectively the same here), so that makes no sense.

> Also, I do not plan on opening the API to other sites, so OAuth is > unnecessary. Is my understanding correct?

You're still so vague that it's hard to answer. If you want to authenticate them, you can use OAuth. But no, it's not necessary to authenticate them with any one auth service...

<comment><AUTHOR> I updated my question so it's more clear. The update is relavent to your first point.

By local storage do you mean storage on the client or server? I thought a benefit of jwt is not having to store anything on the server, is this correct?

<comment><USER48> "Local storage" is the name of something most web browsers implement [https://www.w3schools.com/html/html5_webstorage.asp](https://www.w3schools.com/html/html5_webstorage.asp)</comment></comment></comment>


Tell HN: Firefox got slower after new update? - <AUTHOR> I have updated to Firefox 57, I don't know what is working behind the scenes, but it got a lot slower in my ubuntu machine. Before there were some incremental page loading while downloading other assets, but now, some of the sites are loading slower than before.
some of them are:
http://store.steampowered.com/
https://gist.github.com/
maybe my configs are not correct or I should switch off something, but Firefox got worse <comment><USER2> I've experienced improvements on AntergOS with Firefox 57, also tried those pages.</comment>


What I Learned About Sales (Or "How to 4x Revenue in One Year") - <AUTHOR> https://remo.org/2020/05/21/what-i-learned-about-sales/ <comment><AUTHOR> My startup Trigami was leading nowhere. We basically had two options: (1) go out of business, (2) learn how to sell.

We chose option two, and quadrupled our revenue in 12 months, and achieved $1 million in revenue after two years.

The post above is a summary of what I have learned in the process.</comment>


The urge for a collaborative, citizen fact-checking platform - <AUTHOR> https://medium.com/captainfact/the-urge-for-a-collaborative-citizen-fact-checking-platform-a0ce035bc608 <comment><USER2> The website [https://captainfact.io](https://captainfact.io) and the browser extension are very useful! It would be nice to see more content in English on it.</comment>


The Nimble Cargo Scooter: A Kick-Powered Hauler - <AUTHOR> http://online.wsj.com/news/articles/SB10001424052702303480304579575900158337912

<comment><AUTHOR> [Disclaimer I'm a father of one of the founders].

This device enables you to transport heavy goods down a road, over a sidewalk and through buildings.

In the process, you can kick your way into being healthy.

All the while riding through life in a way that is simply exhilarating...

<comment><USER2> I want one!</comment></comment>


An in-depth look at Pixar's creative process - <AUTHOR> http://www.siliconprairienews.com/2010/10/josh-cooley-gives-an-in-depth-look-at-pixar-s-creative-process

<comment><USER2> A couple things I think can be taken from this for startups: \- Pixar Invests in its employees, especially through education. \- Mistakes are part of the process.

I do think you learn a lot from mistakes, but sometimes when coding I am very hesitant to make them which slows me down quite a bit.</comment>


Why Windows 10 is the 'last' version of Windows - <AUTHOR> http://mashable.com/2015/05/08/windows-10-last/ <comment><USER2> As the journalist explains, the omission of qualifier words to clarify " _last_ " makes Microsoft's message confusing.

It's the "last" in the sense that it's the "last big-tent event version of Windows that was delineated by multi-year development & release milestones." No more big-tent releases like Windows 95. The new release model may also remove the idea of waiting a year or more for a Service Pack.

Basically, it looks like Windows release cadence will be more like Adobe Creative Cloud model: continuous incremental improvements separated by months

<comment><USER3> > Basically, it looks like Windows release cadence will be more like Adobe > Creative Cloud model: continuous incremental improvements separated by > months

And will it end up with a subscription based model too? that's the issue here.

<comment><USER4> I suspect the core OS won't. There are always lots of reasons to run a machine that isn't online all the time.

What I do expect is features and applications linked to be dependent and associated with a subscription.

Couple that with improved security to discourage and outright prevent applications from being loaded outside of approved channels, similar to what Apple is doing* with it's security settings now, and it may become easier to just pay monthly than do your own thing.

*Preferences, security, "allow apps downloaded from..."

</comment></comment></comment><comment><USER5> _With that membership, you 'll get keep getting upgrades as long as your hardware supports them. This is just like Chrome, your apps, and other operating systems like iOS operate._

So, just like Apple and Android phones, Macbooks, and I presume Chromebooks and Surface devices, OS updates will keep getting pushed to your device until your device can no longer function acceptably, and you'll be forced to upgrade the hardware.

This is the OS software industry's solution to the "problem" that the hardware became good enough for most people and new sales dropped.

<comment><USER6> Hasn't windows been dropping in hardware requirements since vista?</comment></comment>


Apply to AlphaLab:  $25K and 5mo free office space - <AUTHOR> http://www.alphalab.org/about.aspx

<comment><USER2> It's nice to see more programs like these starting up, even if they do feel a little derivative of YC. They seem like good catalysts for cities that want to get new businesses operating in them.

The challenge, in my opinion, is that although they can be great for the communities, I think they come at a cost for entrepreneurs.

I've done a lot of things from a distance. After art school I moved away from the city to paint. I reasoned that doing so cut costs and that I could paint well anywhere. Years later I partnered in an interaction design firm in a small town employing a similar rationale. Most recently, we've been working on our startup from Vancouver, which is beautiful and a nice place to raise a family.

In each of these instances, the logic for being away from a center (be it art, design or startup) has been sound. Additionally, there are always strong proponents in these communities to keep people doing "great things close to home." No matter how strong the logic is though, it simply doesn't hold up. There are greater opportunities for those who put themselves at the heart of the "action".

You could likely start a great company in Pennsylvania, but even with low rent and more equity, you'd still have a weaker "deal". The appeal of YC, in my opinion, is that it's so close to where people think in startup-terms and is run by people who actually live in that world.

Although some will bemoan my saying so, the closer you can get to the action, the better. There are probably some great actors in Helsinki, but I bet you'll never hear anything about them.

<comment><USER3> Well unfortunately not everyone can get into YC or save up enough money to go move to the bay area to fund themselves while developing connections.

If Google had been started in Pittsburgh, they still would have been successful. I heard about Google through IRC back in the late 90s and immediately switched from Altavista because Google was so damn good.

Incidentally, AlphaLab is new, but Pittsburgh/PA has had seed funding through InnovationWorks and IdeaFoundry for some time. It used to be more like "here's $100,000 and you are on your own." AlphaLab is _trying_ to develop a community. Again, I think it remains to be seen how these seed funding ventures turn out. Admitting SV is the only logical choice is premature. Give it time.

<comment><USER4> > If Google had been started in Pittsburgh, they still would have been > successful.

I'm not a huge Silicon Valley booster (I like MA, thankyouverymuch), but I think the idea that Google would have been able to hire as much top notch talent, as quickly as they did, in PA is nonsense.

The only way that Google could have started in PA and been as successful as they have been is if they very quickly moved to Silicon Valley (or - maybe - MA).

<comment><USER5> I'm not sure that's true. Microsoft and Amazon, for instance, did pretty well in Seattle. And Pittsburg does have CMU, whose CS program comes in right after MIT, Stanford and Berkeley's. It was probably easier for Google in the Valley. How much easier is hard to say.

<comment><USER6> It was only easy for Google because the had tons of cash to hire people when everyone was getting laid off in the tech bust. They owned the market for top people because of the rare event that many top people were on the market.

</comment></comment></comment></comment></comment><comment><AUTHOR> We applied to both YC and AlphaLab last year. We ended up being a part of AlphaLab, and I'm so glad that we did. It's been a great experience so far-- lots of great advisors and contacts (who knew that Pittsburgh had so many tech companies?) Also, the terms are considerably better than YC. :)

AlphaLab is now accepting applications for the next cycle and they are very similar to the YC applications, so I thought I'd mention this to everyone. Let me know if you have questions!

<comment><USER7> did you get _accepted_ into YC and went for AlphaLab instead?

<comment><AUTHOR> Nope, but I'm glad that it worked out the way that it did. AlphaLab has been a really great program so far, and the benefits of YCombinator over AlphaLab (ie, exposure to Silicon Valley folk) are not really that important to us. Pittsburgh has a surprisingly strong tech and entrepreneurial community.

<comment><USER7> whats your startup?

<comment><USER3> Apparently <http://www.innomi.net>

</comment></comment></comment></comment></comment><comment><USER7> oh and hurrah: "As Innovation Works utilizes funds from the Commonwealth of Pennsylvania, _each company receiving funding is expected to maintain a significant presence in Pennsylvania after the program_ "

<comment><AUTHOR> Yep, that's the one downside. It's the price you pay for keeping significantly more equity (AlphaLab only takes 3%) in exchange for more funding ($25K).

Pittsburgh's a great place to do a startup though. It's a great city, and really cheap as cities go. Whatever money you have for starting up goes a lot farther than it would in some other places.

<comment><USER3> It's only a downside if you think you need the connections. Other than that I fail to see the downside.

</comment></comment></comment><comment><USER8> From their FAQ:

"14) Do we have to stay in Pittsburgh after the program ends?

Companies are expected to remain in Pittsburgh after the end of the AlphaLab program. Our goal is to help you build a successful technology company and to add to the critical mass of flourishing tech companies in the Pittsburgh region. We believe that Pittsburgh is a great place to build a company and after your experience at AlphaLab we are confident that you will agree."

Is this a legal agreement? It is still a bit surprising to me that you are still "expected" to tie down your company to a specific location. Maybe some ex-AlphaLab-er can shine in some light here.

<comment><AUTHOR> Basically, if after signing the agreement and being part of the program, if your company decides that it needs to go somewhere else and have no presence in PA within the next few years, you have to give back the $25K. That's it.

It's not that bad if you think about it--if you get any later-stage funding, $25K is a small price to pay to allow you to move somewhere else.

<comment><USER9> How about equity, do you get equity back too?

<comment><USER10> I'd sure hope not - it would make the program far too easy to screw over.

</comment></comment></comment></comment><comment><USER11> alphalab looks pretty cool, hate that it's in pittsburgh but worth applying.</comment>


Crypto Market Crash Leaving Bankrupt Startups in Its Wake - <AUTHOR> https://www.bloomberg.com/news/articles/2018-12-06/crypto-market-crash-is-causing-startups-to-shutter-operations <comment><USER2> > Many of the companies are suffering because they kept a portion of their > funds in digital assets

Lol that makes it sound like they had a choice. Because essentially none of the ICOs did KYC/AML, none of them were allowed to create bank accounts anywhere worldwide so they had to keep their money in ETH.

That's why they're just starting to go bankrupt and will mostly all go bankrupt in 2019. If you think it's a bear market now, the real crash hasn't even started yet.

If you want to see something typical, here is what Jez, the founder of FunFair, wrote one year ago on Reddit:

"in the august company announcement we said we were holding more than a year's running cost in cash and thats still the case. our holdings are approx $6m in cash (dollars), and several million in bitcoin (which keeps going up in value!) and a lot more in eth. in short, we have capital of more than $30m, at current valuations. we're not going to starve in 2019, unless bitcoin and eth values plummet which seems unlikely. bitcoin is more than double the price of the time of our token sale in june."

<comment><USER3> > Lol that makes it sound like they had a choice.

They could have simply kept their assets in stable coins, like Dai, Tether, etc..They could also sell into USD on exchanges that allow you to trade USD (e.g. Kraken). Another option would have been to open a hedging short position on say, Bitmex. There's lots of ways they could have cashed out, effectively.

<comment><USER4> >They could have simply kept their assets in stable coins, like Dai, Tether, etc..

To turn into dust?

>They could also sell into USD on exchanges that allow you to trade USD (e.g. Kraken).

And trust Kraken then.

>Another option would have been to open a hedging short position on say, Bitmex.

and trust bitmex then.

There are no scalable options to cash out $10m to a bank and sleep well. You could cash out into some "stable coin" only to wake up to it costing $0.04 (hello nubits). Tether is no safer in that matter.

<comment><USER3> > To turn into dust?

Oh, you mean the 'dust' that is worth exactly $1 at this moment, where Ethereum has lost 90% of its value? That dust?

> And trust Kraken then.

Yep, the exchange that's been trustworthy and operated seamlessly since its inception, sure. And still does.

> There are no scalable options to cash out $10m to a bank and sleep well. You > could cash out into some "stable coin" only to wake up to it costing $0.04 > (hello nubits). Tether is no safer in that matter.

You may not sleep perfectly, but you'll sleep a lot better than if you're holding it in crypto. And that is my point. And if you wanted to use Dai, you could actually sleep perfectly. Dai has held up perfectly well, and you can hold it off-exchange.

<comment><USER5> _Past performance does not indicate future results._

The most common disclaimer in finance, but equally applicable to all things in life.

<comment><USER3> That's a cute saying, but let me know when you park your money in a bank that opened yesterday.

<comment><USER5> I don't see your point. It's a common legal statement to explain that there are no guarantees. Are you arguing that you can in fact guarantee what the market is going to do?

<comment><USER3> No, i'm arguing that you are not making any kind of point by saying that. What is your statement intended to prove?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> This is what efficient markets do according to theory: capital deployed in areas not as productive relative to another move to the more productive one. Wait or is that just crazy investors hoping to get into the next bubble? Either way good. All these alt-coin save-the-world businesses can go the way of the do-do, I still need tools to help make Ansible not suck and learning K8s and figuring out how to scale MySQL. I'd rather see money and talent go into making tools that are actually useful even more useful than creating self directed businesses etc.

<comment><USER7> It's a very good point. A lot of smart people jumped into an area that if I'm feeling very generous I would call "unproven". And I'm all for startups trying new things, but we could have learned just as much about the possible utility of cryptocurrencies with 100x less resources.

My main worry now is that some of the people will have been damaged by this. Some of the interest we can write off as irrational exuberance; hopefully some will have gotten their fingers usefully burned and will be more careful choosing what they work on next time. But a lot of the field was somewhere between chasing a bubble and outright scammy.

It reminds me of people I've seen burned by MLM schemes. Some say, "never again!" But some really buy into the get-rich-quick thinking and will keep on making the same mistake in different forms. "This time it will be different!" But it never is.

<comment><USER8> >I would call "unproven".

Why wouldn't you call it novel? It's only 10 year old technology at this stage.

<comment><USER9> What other ten year old technologies, that went on to be successful, were as useless for their stated purpose as crypto?

If crypto is money, can I:

Spend it at Amazon? My grocery store? My corner deli? Pay my rent? Pay my employees?

If crypto is a store of value can I trust it will have any rational storage value over any time period?

<comment><USER10> Digital cameras, when invented back in the 70s. It took decades until they were usable, and still another decade until they started to approach the quality of nondigital.

<comment><USER7> It's not a very good example, in that the barrier there was physical development of hardware. This is purely a software problem.

Another obvious difference is that from the first moment they were on the market, they had some practical use, and the amount of use grew quickly. If we count from the Kodak DCS 100 introduced in 1991 at a price of $20,000, then ten years later we see that they were being bought at the rate of 18 million units a year and rapidly rising. [1]

Bitcoin, in contrast, has very little practical use 10 years after introduction. Its merchant adoption peaked years ago. That's far short of what an actually useful digital payments product can do. Look at M-Pesa [2] for contrast. It was introduced only a year early than Bitcoin. It has tens of millions of active users, and processes up to 900 transactions per second, with an average of 160 per second. [3] A huge success compared with Bitcoin's average of 3-4 transactions per second, most of which are speculative rather than practical. [4]

[1] [https://www.dpreview.com/articles/5474101424/pmaresearch2003...](https://www.dpreview.com/articles/5474101424/pmaresearch2003sales)

[2] [https://en.wikipedia.org/wiki/M-Pesa](https://en.wikipedia.org/wiki/M-Pesa)

[3] [https://www.nation.co.ke/news/MPesa-transactions-rise-to- Sh1...](https://www.nation.co.ke/news/MPesa-transactions-rise-to-Sh15bn-after- systems-upgrade/1056-3194774-llu8yjz/index.html)

[4] [https://www.blockchain.com/en/charts/transactions-per- second](https://www.blockchain.com/en/charts/transactions-per-second)

<comment><USER10> > If we count from the Kodak DCS 100 introduced in 1991

Kodak invented digital cameras in 1975.

<comment><USER11> >> If we count from the Kodak DCS 100 introduced in 1991

> Kodak invented digital cameras in 1975.

DigiCash was founded in 1990 based on a paper from 1983.

<comment><USER7> Exactly. I think the fair place to start counting with both Bitcoin and digital cameras is first consumer launch.

And with M-Pesa versus Bitcoin, they're both digital cash, so I think it's even easier to see how badly Bitcoin has done.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> >Sirin Labs, for example, raised $158 million last year to create a mobile phone that allows consumers to trade and use crypto. The company, which will ship its first batch of a few thousand phones in December, is now considering abandoning hardware altogether and refocusing on shipping software for other phone makers to use, Chief Executive Moshe Hogeg said in an interview. Sirin now only has enough funds for six to 12 months of operations, he said.

Uh. Glad this bubble has popped. Of all the things I want in a phone, "trade and use crypto" isn't quite a requirement. Besides existing phones trade and use crypto quite well

<comment><USER13> Which phone (secure computing platform) do you trust to securely store your wallet key? All it takes to lose is an update to the wallet app that sends the key to a server.

<comment><USER12> You can install from an apk and not get updates.

Besides, if all you're doing is some kind of chain of authority you could do it through fdroid which enforces a constant key. No need for a standalone phone which will anyway have the same components as any other phone.

<comment><USER13> That sounds very reasonable, is there an equivalent chain of authority possible on iOS?

</comment></comment></comment></comment><comment><USER8> I was watching something on youtube recently that brought back memories of the early days of the internet and the campaign to discredit it (it will bring smut directly into your home... it will be all over in 5 years..) and now I see HN users glee with the failure of fellow engineers and entrepreneurs and the same campaign (it's a scam, it will bring drugs directly into your home...).

The bear market has been brutal and some very good teams were caught off guard because they lack to experience and know-how to balance a treasury or keep a startup alive. Many of us here are also equally unqualified to succeed though.

In the aftermath of the 99 crash, Amazon shares were trading for a few dollars and so were many other companies that today are huge monopolies. I believe that many of the blockchain native companies that survive this crash likely have the same growth.

<comment> jf- The problem with your argument is that blockchain isn't comparable to the internet. It's an energy inefficient immutable public ledger. There just aren't many, if any, applications that require an immutable public ledger, or that derive any benefit from using one.

Some blockchains allow smart contracts. Smart contracts sound like a nice idea, but when you think about potential use cases, you quickly realise they actually have no utility. Any application for a smart contract requires information from outside the blockchain which must be supplied by a trusted authority. This being the case, why bother with blockchain at all?

<comment><USER14> "Ledger" was just the first app we worked out how to do as a blockchain.

There will be more, but the design process is hard. The reason Ledger was cracked first is because ledgers are pretty simple.

Saying blockchain is "just a ledger" is like saying the web is "just a bunch of nerds uploading documents about their hobbies". That's where it started but after many years we learned to solve other problems with the same ideas.

<comment><USER15> Your argument doesn't even make sense. The blockchain is just a ledger. A really inefficient one, at that. It has to be inefficient because otherwise it loses all the attributes that make it desirable to certain markets. Take that inefficiency and you lose all that "trustless" "byzantine generals whatever" crap and you are left with git or hell, a real database.

Face it. Blockchain is going nowhere. It was stillborn the day it was created. It's had 10 years and nothing about it has fundamentally changed (as many bitcoin advocates love to point out as if it was a positive thing).

Normal people who say "yeah, blockchain might have a use" are just being polite. They don't want to state the obvious. Beyond its current use case as a magnet for scams, fraud, pump & dumps and get rich quick schemes there is no use for the blockchain at all.

<comment><USER16> > It's had 10 years and nothing about it has fundamentally changed

The usecase is censorship resistant financial transactions.

It is working right now, for people in Venezuela, for example. It is working for people who are attempting to make financial transactions, across the world, quickly and cheaply.

Tell me a better way to make censorship resistant financial transactions, over the internet, if you think this is useless.

</comment></comment></comment></comment></comment><comment><USER17> I think everyone can agree that cryptocurrency got way ahead of itself but HN almost seems Luddite in it's treatment of the underlying technology to the point that we are going to have our own "No wireless. Less space than a nomad. Lame." moment that people will link to for years to come.

The underlying technology is actually pretty worthwhile. Ethereum is providing a base layer protocol for apps that never go down, never fail, and are fully trusted. That's something that future generations will take for granted but HN is largely ignoring right now. Even Google goes down (sometimes once or twice a month). Take a moment to imagine a few of the things you could do better if you had 100% reliable hosting that was safe and private. And basically free. (Either the user pays a penny or two when using your app or you pay a penny or two for each user).

You wouldn't look at the internet in the early 90s and say it was useless because all it does is carry short messages on Usenet which take a while to appear. The tech was being improved. Those short pieces of messages evolved into images and then later video and now we have the internet of today. This isn't going to happen overnight but it's going to happen faster than the improvement of the internet since Ethereum is just software and no hardware needs to be rolled out.

Go ahead and ignore it right now. It's still building time. But don't assume it's useless or beanie babies. In a few years the layer 1 protocols will be good enough for something useful and I would bet that we see something truly unique come out of the blockchain space that we never before knew we needed.

<comment><USER18> >Ethereum is providing a base layer protocol for apps that never go down, never fail, and are fully trusted.

Are you suggesting that Ethereum apps can have 100% uptime (never go down, never fail), and are completely secure (fully trusted)?

Because if so I've got some shares of a bridge to sell you.

<comment><USER19> I don't even understand the benefit of 100.00% uptime, over 99.99% anyway? I mean, I probably spend more time in a parking garage with no internet available to me at all, than google spends being down in any given month.

I mean, I understand the idea that Google wants to increase their uptime because every lost query is lost revenue, but OP seemed to imply there's some intrinsic benefit that's more than just the incremental benefit...

<comment><USER20> Regardless of the marginal benefits of 100% uptime vs 99.99...the entire point of ETH is that once the contract is posted to the block chain, it continues to operate in perpetuity...and no centralized service provider or government can take it down. That's powerful, and in our age of creeping power consolidation by big tech cos and overreaching governments, I applaud the development of censorship-resistant tech.

</comment></comment></comment></comment><comment><USER21> Good riddance. Hopefully this will serve as a reality check for regular people who are tempted by the siren song of quick riches. Crypto never provided any real economic value, so this was bound to happen sooner or later. With a bit of luck crypto will stay dead this time. Fingers crossed.

<comment><USER22> I do agree that most have been trying to solve the wrong problems with blockchains, but to write off the technology in it's entirety seems rather ridiculous...

Is immutability not a powerful programming concept? Is it not valuable to be able to prove that a piece of data is exactly how it was years ago? Or to be able to prove that a given signature was created before the corresponding private key was lost/compromised?

<comment><USER23> This doesn't need cryptocurrencies, a centralized public ledger applying hashes/signatures with something like a Merkle tree can do the same while avoiding the necessity to constantly burn proof-of-work proportional to how valuable your data integrity is.

</comment></comment></comment><comment><USER24> This is why SEC Reg D exists and is important.

Most of the money wiped out during the last few years is not coming from wealthy "smart money" investors.

The money has come from the middle class and mom and pop investors.

<comment><USER25> There's a flip side to this.

When something goes well but mom and pop are excluded, the rich get richer.

<comment><USER26> If something is going really well, they don't need or want investment from mom and pop. The only people who sell investments to mom-and-pop are ripoff artists. Why else would you chase nickels and dimes from people who don't understand your business?

<comment><USER27> Exactly! It's much more efficient to chase millions of dollars from people who don't understand your business.

</comment></comment></comment></comment><comment><USER28> Does this mean that the price of video cards will fall ? or RAM ? I had to buy a video card 2-3 months ago and the prices were so high with the only explanation being "the coin miners".

<comment><USER29> They've been low for months, with nvidia sitting on a huge amount of unsold inventory.

[https://www.techspot.com/news/77566-nvidia-share-price- plumm...](https://www.techspot.com/news/77566-nvidia-share-price-plummets- wake-cryptocurrency-crash.html)

<comment><USER30> Indeed, there's a lot of talk that the new RTX 2080i have issues too so the backlog of 1080i is there and cheaper.

</comment></comment></comment><comment><USER31> What's interesting is that even though the value of for example Ethereum is going down, the usage statistics seem to be much healthier, specifically transaction volume [1] and address growth [2].

[0] [https://etherscan.io/charts](https://etherscan.io/charts)

[1] [https://etherscan.io/chart/tx](https://etherscan.io/chart/tx)

[2] [https://etherscan.io/chart/address](https://etherscan.io/chart/address)

</comment><comment><USER32> Funny how companies can go bust after getting millions from these token sales. Quite clearly they weren't on Ramen Noodle start up mode. Okay offices need to be paid for as do staff but it is not like they had to buy raw materials, build steel foundries, invest in a distribution chain or anything else capital intensive.

If they had been promising to make regular products and didn't ship then there would be front page scandals and outrage on consumer rights TV shows. But nobody cares, cryptocurrency has become a dirty word, normal people reading cryptocurrency stories don't get past the headline as they know the story already.

It will probably take a few years before documentary film makers make sense of the shenanigans that has gone on. There are no good stories though, at least with the dot.com crash you could tell the story through the lens of a company that was there at the time for it to have storytelling value. Shame Tom Wolfe is no longer with us, the crypto experiment needs someone of his character to do the story justice.

<comment><USER26> The millions they got from token sales were demoninated in cryptocurrency. All of them trying to cash out at once and you see what happened. A run on the bank.

</comment></comment><comment><USER33> People here saying the underlying concept is worth a allot. I don't see the use cases for a distributed consensus algorithm outside of coins. Even a distributed ledger shared by multiple companies is probably not useful compared to the status quo. You can always shove a square peg into a round hole, it could go in but is it making the situation better?

</comment><comment><USER34> I keep asking for one cryptocurrency based application or service with a lot of users that is not directly related to cryptocurrency itself and that is not illegal.

I keep getting nil. I keep searching independently and getting nil.

The closest I've found is the Sia storage network but it's hard to set up and not competitive with cloud storage. If I want privacy I can just encrypt locally before using S3, Backblaze, etc. If I want redundancy I can use two cloud storage services in parallel.

<comment><USER35> Sia is actually, at least in theory, cheaper. Long term Sia or something like it will dominate cloud storage. Right now though, it is not big enough for large enterprise investors, nor user-friendly enough for small scale/individual use.

</comment></comment><comment><USER36> Emotional video of a mining startup shutting down posted a few days ago. [https://youtube.com/watch?v=kxbCHlXZ-0U](https://youtube.com/watch?v=kxbCHlXZ-0U)

<comment><USER37> To me that video evoked zero sympathetic emotions from me, perhaps it's the GoFundMe right before the #bitcoinboom hashtag, or the name "Digie Gold", or the electricity that was just getting burned off for nothing...

</comment></comment><comment><USER38> Good. 99% of it was utter bullshit and any worthwhile research was getting drowned out.

Regardless of whether or not blockchian and cryptocurrencies end up being pivotal technologies in future, one positive fallout is that we are asking "how can we do this better" of some very traditional and established industries.

</comment><comment><USER39> Assholes and idiots, as usual, fuelled the crypto craze. They ruined a reasonable, although flawed, means of exchange with their greed and stupidity.

There's no value in a currency that is unstable either up or down because it's not possible for those who wish to use it for its intended purpose to keep track of the fluctuations.

Plus, it was another way for monsters to destroy the planet, as if we needed another one of those.

When will you self-centred fucks understand that your personal profit does not justify destroying the planet?

<comment><USER40> But Fiat currencies also inflate/deflate. Just that that rate is slower comparatively that's why it is reasonable to rely on them in short span of time.

In long run if you aren't accounting for inflation/deflation then you are on losing end. For example, how often we hear that $10000 for that period..buy much more in today's world.

PS: I am not trying to argue but putting across a counter point. I am not an expert niether in crypto or in economics.

</comment></comment><comment><USER41> I'm sure I'll get buried for this, but it's a shame that as a whole, we've spent billions of dollars, created tons of carbon, and wasted untold man hours on this blockchain and digital coin fad. At least nobody can say the concept wasn't fully explored.

<comment><USER42> It was more useful than gaming.

<comment><USER43> Not sure if this is a joke or not, but the parallel is not even close.

<comment><USER44> I actually think he might be right, so I'd like to hear more from your side of things.

As far as I'm concerned, gaming is a drain on human productivity, often a drain on long term happiness, and provides little economic utility.

<comment><USER41> I mean, video games are about as useful as a summer swim, a piece of music, fine art, and fictional literature. Sometimes they're also educational.

<comment><USER44> I think the discussion was about energy consumption.

</comment></comment></comment></comment></comment></comment><comment><USER45> In other words, lots of great tech available at a very good price. If anyone know of a company with a good crypto trading platform who are looking to sell don't hesitate sending them my way.

This was just the crypto version of the dotcom bubble. The webvans and pet.com mistakes needs to be done.

Next generation crypto startups will bring more value because the infrastructure is going to be much further. Give it a couple of years and we will start seeing companies build on top of blockchain rather than building blockchain companies.

<comment><USER46> Great tech?

<comment><USER45> There are definitely companies who have been working on some great tech either in the security token space or in the exchange space and I would love to be able to acquire some of that.

Some of the types of industries we believe are going to be is anything in "digitally created" i.e. things that are born digital and thus can be born on the blockchain (think game assets, images, text, art, code) and then infrastructure technologies such as security tokens which can be used to validate inter-businesses data relationships.

But the infrastructure is still being built.

</comment></comment></comment><comment><USER47> The biggest takeaway for me is how important stability and deleveraging is. In the regular stock market such price action would more likely be thought of as crazy volatility rather than a bubble-crash situation. Before the sudden appreciation there was a lot of optimism at similar prices. If it never happened many of these companies wouldn't go bankrupt. Volatility killed them.

</comment><comment><USER48> I have the feeling this thread will be interesting to read in 20 years. __Not __in the same we read Krugman 's 1998 [paraphrase] "the internet is dumb" statement but instead from a post-truth post-hypernormalization world were capital and code are closely entwined. You can already partially see in this thread a technical community that would like to, but can not quite, separate their personal bottom line from some pseudo-scientific idea of right/wrong. I would guess 20 years from now that falsehood will have faded and this thread will look interestingly passé.

1\. web.archive.org/web/19980610100009/www.redherring.com/mag/issue55/economics.html

</comment><comment><USER49> "I am sure if that happened a year ago, that wouldn't be a problem at all, a year ago there was a lot of free money in the market. But in a bear market there's a change."

Ends up it's hard to run a business when you no longer have 'free money'.

</comment><comment><USER50> I used to work at ConsenSys which recently laid off 13% of their workforce and I can tell you first hand they are a mess internally with senior leadership burning through cash. The company has zero management and favorites are left to do what ever they want. No wonder there is a crash, it was all one big ponzi scheme.

<comment><USER51> Comments like this are interesting to me. I can see from your comment history here that you are pretty negative in what you have to say. I can see that you're also on a HB1 and a self taught engineer without a lot of experience. My advice to you is to take a step back and reflect on why you were let go.

Regardless of the internal structure of Consensys, I don't think that blaming it on them or the big ponzi scheme of crypto is the answer. Reductions happen all the time across many different industries. Especially in technology. If anything, Consensys is doing the responsible thing and 'trimming the fat' when times get lean. Remember, there is still >1000 people that were not affected by the reduction.

Look inwards before blaming outwards.

<comment><USER50> You can look inwards as much as you would like but isn't it impossible to not see this entire industry as a ponzi scheme?

<comment><USER51> Sorry, I do not see the entire cryptocurrency industry as a ponzi scheme. That said, I've been in it for a long time, for other reasons that have affected me personally [1].

[1] [https://www.youtube.com/watch?v=LgI0liAee4s](https://www.youtube.com/watch?v=LgI0liAee4s)

</comment></comment></comment></comment><comment><USER52> Hopefully, the capital will not end up wasted, and at least some of these companies can gather the resources that they have and create something of value. If not, we will look at this speculative craze as a remarkable waste of resources.

</comment><comment><USER53> Given that the biggest threat humanity faces is climate change, support for crypto currencies in their current form is morally corrupt. Also I don't see a reason why I should buy into some scheme that disproportionately benefits early adopters. I'm already forced to participate in one tilted economic playing field, why expose myself to another one.

<comment><USER44> _If_ the promise of crypto plays out, it will have a huge positive impact on climate change.

What a lot of people forget to realize when they talk about how much energy crypto uses is how much energy the systems that are currently in place are already using, which crypto has the potential to replace.

One such example might be property ownership and title companies. Title companies are big business. They have large buildings, they have many employees. The sum total of the resources being used by title companies have a _huge_ carbon footprint.

Crypto could eliminate title companies. A blockchain is the perfect solution for storing records of property ownership in a way that is incredibly well- suited for the mostly digital age we find ourselves in, and would be vastly more efficient than the way we currently manage property ownership and transfer.

If blockchain tech becomes relevant to the point where we should be concerned about its carbon footprint, that means it's replacing things which currently exist which already have a huge carbon footprint.

<comment><USER54> > Crypto could eliminate title companies. A blockchain is the perfect solution

Ah yes, nothing like losing the title to your house because you can't remember the password to decrypt your private key.

<comment><USER44> Why do you think you would need to maintain 100% ownership of your private key?

The more relevant aspect of blockchain in this example is the hashed distributed ledger, not the transactional nature of it. In fact, there is no reason you'd need to use PKC type transactions at all.

</comment></comment></comment></comment><comment><USER55> No surprise here, same thing that happened last crash. Any crypto company that doesn't plan for the busts with the boom is going to meet this fate.

<comment><USER56> Is there precedent in the last crash? I wasn't receiving recruiter emails from crypto companies before the 20k crash. I think the blast radius here is much bigger.

</comment></comment><comment><USER57> The problem is that most of the software engineers here don't have a strong liberal education in the classics to understand the societal implications of a decentralized money supply.

Bitcoin is not meant to be used by the people in p2p exchanges. It is meant for large institutions. If country A wants to send country B, 5 billion, are they going to just wire it to them??? No that's very difficult to do and Bitcoin solves that problem.

Historically kings were the ones that controlled the money supply, but now that has fundamentally changed.

</comment><comment><USER58> I think crypto is like VR. It's a great idea built by smart people but it's a solution looking for a problem. It never got the mass adoption that justified it's early price jumps. I genuinely hope some day someone needs it but for now I don't think venmo and dumb contracts are expensive enough or risky enough to incentivize the masses to adopt.

</comment><comment><USER59> The best use case for Blockchain is for internet money. Many seem to forget that a majority of the world has limited access to banking resources. Platforms like Ethereum will allow for marketplaces that cannot be manipulated by the ones operating them, though, it will always be subject to manipulation by the actors on the network.

</comment><comment><USER60> I remember friends and collegues who were all crazed when the bubble started. They were buying, spamming on facebook about how cryptocurrency was the way to go and how they have a high R.O.I etc.

But I knew and just like physics, all increasing bubbles eventually burst. Afterwards it was the bankers fault. All various conspiracy theories etc...

<comment><USER61> There is the theory that the bear market is just the FED trying to buy all Bitcoin at low price.

</comment></comment><comment><USER62> How's chain.com doing? Anyone use their APIs?

<comment><USER63> They were acquired by Stellar's commercial division, Lightyear and merged to form a new entity/brand called Interstellar. It's now an enterprise consulting company with the aim of getting Stellar used in production and deployed more widely.

</comment></comment><comment><USER64> And nothing of value was lost.

</comment><comment><USER65> Not more dubious than traditionally funded tech ventures we've all worked at till our 1 year cliff.

Just more liquid!

So therefore I'm not sure why an article that mentions 2 downsizing companies, and 2 discontinued companies, amongst 1,180, is treated as validation amongst the hackernews crowd.

I think its really strange how separately this particular buzzword sector is treated here.

</comment><comment><USER66> Play stupid games, win stupid prizes.

</comment><comment><USER67> Let's all wait and see what Craig Wright is building with SPV ;)

</comment><comment><USER68> Gosh.. This foreshadowing the upcoming recession.

<comment><USER69> What are you seeing that indicates an upcoming recession? Economic data looks solid currently.

<comment><USER70> Inversion of US treasury yield curve, 52 week lows in the tech sector, dissolve of NAFTA, trade wars with Asia. Excess money poured into failed tech. Oil+Gas at years low with excess supply. The death of Coal. Big banks in decline.

</comment></comment></comment><comment><USER71> Best time to build a crypto company. It almost seems like too many people in the HN filter forgot about how closely this resembles the dotcom boom and bust.

<comment><USER72> Of course. In 2002 you'd probably be laughed at. You also could no longer just stick "e" at the front of your company name, or ".com" at the end, and get instant riches. (Just like "blockchain" today)

It'll require a different class of entrepreneur, one who is patient, has a longer vision, and is willing to build boring companies. (Look at the companies that survived the dotcom bust)

<comment><USER71> Precisely.

</comment></comment></comment><comment><USER73> While bitcoin can crash, like a cockroach it can hardly die. So if the tech is better than visa, it should prevail eventually.

<comment><USER74> Bitcoin is not better than MasterCard/Visa for the majority of day to day transactions.

<comment><USER75> Just 1000x slower.

</comment></comment></comment><comment><USER76> I'm about to go live with my crypto startup[1] (it's a SaaS version of my open source app[2] on Github since 2013, with a market place and other premium features). I bootstrapped the whole thing, but the tech is 90% my open source app that already existed.

My app relies on people being interested in trading. Right now there is a lot of volatility in the markets (which means people are watching them). But most people have gotten burned hard in the last few weeks, it's not looking great if the markets keep going down like this.

[1]: [https://gekkoplus.com](https://gekkoplus.com)

[2]: [https://gekko.wizb.it](https://gekko.wizb.it)

</comment><comment><USER42> Bitcoin largely was born as a response to financial crisis that nearly wiped out worldwide financial system 10 years ago.

With the leveraging currently going on, albeit at government level, i wonder how long it will be before next financial mess happens that would resurrect these deflationary, government currency decoupled instruments.

<comment><USER77> > Bitcoin largely was born as a response to financial crisis that nearly wiped > out worldwide financial system 10 years ago.

I'm by no means an expert here but this seems... very not true.

<comment><USER78> It's not, it's just a popular and appealing narrative. Bitcoin was in development for at least a few years before the financial crisis, but its developer's own admission.

<comment><USER79> It was in development before, but the at least philosophical ties to the troubles of the classic economic systems are right there in the Genesis block of Bitcoin, persisted forever by Satoshi Nakamoto:

[https://en.bitcoin.it/wiki/Genesis_block](https://en.bitcoin.it/wiki/Genesis_block)

Scroll to "Coinbase".

<comment><USER80> Exactly. The very first block in the very first blockchain directly referenced classic economic systems' instability.</comment></comment></comment></comment></comment>


Tech overkill destroyed the loveliest, liveliest city on the West Coast - <AUTHOR> http://www.independent.ie/business/technology/news/tech-overkill-destroyed-the-loveliest-liveliest-city-on-the-west-coast-31541735.html <comment><USER2> I am a fifth generation Californian, I was born there, my Dad was born there, my Mom and her mom were born in Oakland.. I don't live in San Francisco anymore, although my sister still does.

There was something really special about San Francisco, that I imagine was like New Orleans, that has kind of just gone away. It is still very pretty and a nice place to live.

I am glad the tech industry is so successful. I encourage everyone on this forum to move to California and do really well. Let's make it the richest, most forward thinking, most progressive place on the planet. Things change and I can accept that.

</comment><comment><USER3> You could write the same thing about Deadheads fifty years ago, or gold miners a century ago.

</comment><comment><USER4> Making room for newcomers is what made cities in the first place. This situation is an unexpected problem and we need to fix this.</comment>


Machine Learning and Cyber Security Resources - <AUTHOR> http://fsecurify.com/machine-learning-and-cyber-security/ <comment><USER2> More: [http://www.covert.io/the-definitive-security-datascience- and...](http://www.covert.io/the-definitive-security-datascience-and- machinelearning-guide/)

<comment><AUTHOR> Thanks.

</comment></comment><comment><USER3> Mandatory viewing for anybody considering messing with ML + infosec ... [https://www.blackhat.com/html/webcast/02192015-secure- becaus...](https://www.blackhat.com/html/webcast/02192015-secure-because- math.html)

</comment><comment><AUTHOR> Source: [http://fsecurify.com/machine-learning-and-cyber- security/](http://fsecurify.com/machine-learning-and-cyber-security/)

<comment><USER4> Thanks, we've updated the link from [http://www.kdnuggets.com/2017/01/machine- learning-cyber-secu...](http://www.kdnuggets.com/2017/01/machine-learning- cyber-security.html).

<comment><AUTHOR> Thanks a lot.

</comment></comment></comment><comment><USER5> VDiscover, a tool to predict vulnerable test cases using program traces, is missing: [https://github.com/CIFASIS/VDiscover/](https://github.com/CIFASIS/VDiscover/)

Full disclosure: I am one of the authors of "Toward large-scale vulnerability discovery using Machine Learning", where this tool was presented.

<comment><AUTHOR> Seems good. I'll add it.

</comment></comment><comment><USER6> I have a feeling that the inscrutability of deep learning models is going to provide a playground for fraud. There are some papers that I cannot find at the moment (Deep Flaws?) related to detection of model and input fouling via adversarial inputs.

I'm approaching ML from 20 years in infosec and am a bit undecided where I should focus my efforts. Using ML as a tool or defending ML against threats. Ultimately both will be applicable.

</comment><comment><USER7> I wondered about this topic last week! Whether it was possible to use ML/DL to model and predict cyber-attacks?

<comment><AUTHOR> I hope you are not wondering now. :D

<comment><USER7> Thanks for sharing, fascinating stuff in your link! :D</comment></comment></comment>


Ask HN: Why is it hard to find a wife now-a-days? - <AUTHOR> It's a bit odd to ask this question on a tech forum but I will give it a try. I am from India. I work for a company in US and live in PNW region. I am almost 32. I am finding it very hard to marry. I dont have six packs but I would say I am in shape. I have accepted my baldness and I don't think much of it now. Although, it bothers me sometime when I am lonely.
I am trying to find Indian woman I can marry. Recently, I met 5 Indian women. Despite what is being said in the media, I felt that cards are stacked against men. I don't believe in caste or religion and my parents are cool with any girl I marry to.
When I met these women, all of them have had at least 1 or 2 boyfriends. I dont expect my wife to be a virgin, but I am expecting someone with no relationship experience. That's because I never had girlfriend or I never was in a relationship. All these women said they drink alcohol quite often. I would be okay with drinking alcohol once in a while but daily/weekly is definitely no.
I have had same experience with dating women in US. I went on quite a few dates but never turned into anything serious.
Throughout my 20s I focused on studies, building career and now I am finding that I missed in dating/relationships area. Working hard was the only choice I had. I grew up in lower middle class family so study and work were only things known to me.
I maintain good hygiene and can converse well. I dont have specific hobby as such but I like reading, soccer and hiking.
I feel my life is incomplete without a woman on my side. I see so many couples and honestly I feel jealous.
I am a bit concerned if I can ever find a decent woman to marry who doesn't drink and haven't gone partying throughout her 20s.
Is this a midlife crisis? What can I do? I don't think I will be ever able to accept a girl who is just marrying me for the resources. <comment><USER2> As a married male software engineer in his 20s: the problem here is you. Your expectations are ridiculous and if you continue to seek a woman who meets them you will likely die alone.

You want an Indian woman living in the PNW, roughly your age (I assume) yet without any relationship experience, limited alcohol consumption and didn't party in her 20s?

I'm sure many people here would like a rich supermodel scientist who can cook a beautiful meal too. Would you say their inability to marry one is because of some change in society?

Drop your insane criteria entirely. You need to be meeting as many people as you can and _really_ getting to know them. For all you know, your perfect wife is a fun-loving African-American who's been in a few relationships and loves partying but right now, if you ran into her at a conference or something, you'd dismiss her instantly because she doesn't meet your silly criteria.

Also, don't be laser focused on marriage. If you go into all your relationships looking only for a wife, you're near certain to fail. Finding a wife (for me at least) is about getting to know someone first and deciding you want to spend your life with them second. It normally takes years for people to decide they're willing to make a commitment like marriage.

</comment><comment><USER3> You said it yourself. You expect a woman in her 30s with no relationship experience who hardly ever drinks alcohol. Without saying anything about those preferences, it's only a small number of women who fit that requirement.

Do you have the same requirements for male friends? If not, why does a relationship like marriage need to be different? I understand that you want someone who shares your experience in not having had a relationship, but consider that you are in an increasingly small group as you get older and the type of people in that group probably tend to be reclusive and not meet each other anyway. I would encourage you to consider if sharing that experience is really so important in the bigger picture.

</comment><comment><USER4> You want to find a girl who is:

1\. ready for marriage 2\. has had NO previous boyfriends 3\. doesn't drink more than twice a month 4\. said girl should not value money at all 5\. this girl should be ok a guy who has poor social skills 6\. should not have an arbitrary set of rules that excludes nearly 100% of the dating pool

If you find this girl, I guarantee you she is messed up in the head.

Bonus question: How come you said a women "on my side" rather than "by my side"? (is she a gun or a partner?)

<comment><USER5> > How come you said a women "on my side" rather than "by my side"? (is she a > gun or a partner?)

I think this is just an honest mistake as a result of bad English rather than a reflection of his attitude towards women.

<comment><USER4> I could totally see that. However, too many "misspeaks" like this could come across as telegraphing your true feelings.

Sometimes how people say things is even more important than WHAT they say. (other case in point: "Decent" is a highly charged, loaded VALUE JUDGEMENT. I wonder if the Op is "decent"?)

</comment></comment></comment><comment><USER6> I can understand not wanting someone who drinks regularly.

I can understand wanting to find an Indian girl -especially if you're Indian.

I can understand not wanting to date someone who has slept with too many men, especially because it sounds like you haven't?

You clearly wrote this looking for feedback, so let me speak about what sticks out to me about your comments. I think it's a bit odd that you want them to have "no relationship experience". So they need to be 18, socially awkward, or career driven. If they're 18 or Career driven, they may not be interested in you. That just leaves "socially awkward".

I think you should reconsider that qualification and should be open to having a relationship with a woman who has had a few (not hundreds) of relationships before. It's my opinion - and experience - that women need a few relationships to really find themselves.

I hope that helps.

</comment><comment><USER7> Just a few idle observations...

Women are sexually attracted to confidence and charisma the way men are sexually attracted to youth and beauty. Attraction is not negotiable, so if you have neither confidence nor charisma, you need to learn them. I hear toastmasters is good for this.

If you're looking to attract a traditional woman, then you need to be a traditional man. Dress well, have a good job and make enough money to support a household and kids.

Where do you meet women? Most of the US dating scene is focused around alcohol (bars, clubs, etc). If you want to meet someone who doesn't drink, then stay away from places where alcohol is consumed. Church (or a hindu temple) is still a good place to meet traditional women, as are book groups, hiking groups, soccer groups, stand-up paddle board classes, etc. Also, any group that meets at the crack of dawn for some sort of physical activity. Anybody who shows up to that sort of event will more than likely be in shape and not drink a lot.

Expecting somebody to have no relationship experience isn't realistic. If you want any hope of finding a wife, you need to let go of that one.

</comment><comment><USER8> What about an Indian dating site or app? I met my now wife through okcupid a few years ago and we couldn't be a better match. My dating life before okcupid was non existent. I also had a hard time online and took a lot of work but I don't think I would have went on as many dates with people that matched the attributes I was looking for without using a website that filtered out a lot of that. You can easily exclude the drinkers, smokers, etc. There will be disappointments but it's a numbers game and you'll find someone if you keep at it. There's a lid for every pot as they say.

If that doesn't work maybe ask your parents to do a traditional Indian wedding where they do match you with someone. But I'd go the online route first if your family isn't traditional.

Good luck!

[https://www.quora.com/Which-are-the-best-online-dating- sites...](https://www.quora.com/Which-are-the-best-online-dating-sites-for- Indians)

</comment><comment><USER9> The problem is that you are expecting too many things from women and why this word "marry" comes many times?

My advice now is not looking for a wife but for a girlfriend, make sure this is the right person before thinking about getting married.

From my own experience, I work in an IT company in China and most of my Chinese colleagues look socially awkward. They don't take care of themselves (wear the same t-shirt for 1 week or 2), they can't look at a girl in the eyes without blushing and so on. I am small compared to my friends and colleagues, I don't have the 6 pack either but I have learned to feel comfortable with women.

Don't blame on the society, only blame on yourself. I think your requirements are quite outdated and if you can't accept it, just go back to India.

</comment><comment><USER10> What sticks out like a sore thumb in this post is that you're approaching this like a candidate selection process. The most horrifying thing of all is that you're enumerating a list of criteria you _want_ and nowhere do you even remotely mention human emotion. It's about finding somebody you love and not about satisficing bullet points.

Any woman who by sheer chance satisfied all those criteria and wasn't fucked in the head would probably be utterly uninterested in the idea of spending the rest of her life in a loveless marriage.

</comment><comment> super-serial Sounds like you like traditional women. If a girl like that didn't drink in her twenties and focused on her studies or career like you, why shouldn't she expect a guy with resources? She's a good catch. Traditional girls want to focus on family life and their kids so money ensures they could be free to do that.

Since you want good catches don't accept being bald. You can get hair transplants if needed. You should take a realistic look at yourself and think if being bald makes you look like the Indian Jason Stathom or if it makes you look less appealing. My guess is the latter because most under 40 yr old guys can't pull it off. After fixing the bald issue look for other ways to improve yourself.

Finally start meeting the right women. Go to traditional Indian supermarkets. Find meetups for Indian professionals. If dating sites aren't working you might need to try harder to meet the traditional types you like. If you can't find that in America take some trips to India. Don't care what other people say... go somewhere that you can meet the women you want.

<comment><USER11> The real cures for bald are "funny" or "confident". Those are attributes women REALLY want. And if your sense of humor is only ok, try "being a caring, active listener" (amazingly almost no one does this).

The asker didn't want to be wanted for their money, but to be wanted for your hair? Think about it. That's even MORE shallow.

</comment></comment><comment><USER12> Besides some of the other good observations nearby, I wanted to add that you should admit you are deficient in relationship experience. You should change your attitude, and be thankful that you might meet someone who has had more experience, and perhaps her superiority in this regard could complement your ignorance.

In other words, you might learn something.

</comment><comment><USER13> The crux of your question revolves around loneliness and your desire for companionship, but I think you're focusing instead on a list of inflexible requirements that you're imposing upon a person you have yet to meet. Are all of these expectations really what you need from another person in your life, or do they stem from fear of women, relationships, and trust? If it's the latter, insecurity is getting in the way of your happiness, and that's not healthy.

Also, I'm bothered by a lot of your wording. Some things to consider, that only you can really answer:

Why are you afraid that women are hunting you down for your "resources?" What is this presumed power/resource imbalance and what does that say about your opinion of women in general?

Why do you expect someone to have no relationship experience? You stated that you feel like you've missed out on building your own experiences. Why do you wish this mistake on someone else? Do you also expect your male friends to never have been in a relationship? What does that say about your respect for the experiences and agency of half the world's people?

What are the social norms around alcohol consumption in your city. If it's normal for people to drink socially once or more a week, how might your alcohol rules affect a person's other social relationships. It's this really about alcohol or is it about control or fear of the other relationships in a woman's life? Are you hoping to change someone? What's does this say about your own insecurities and ability to trust?

Finally, what do you imagine is a "decent woman?" Does she need to be Indian? Can she be more successful than you? Make more money? Hack better code? Have more friends? Is a woman with relationship experience not decent? Can a decent woman impress you? Can you work under a decent woman? What age is a decent woman? Are most women you meet decent? Does your definition of a "decent man" differ?

</comment><comment><USER14> 5 isn't very many at all. Try harder. It may take 10 or 100 more. Social activities, sports, churches, universities or interest groups are the best places.

I wouldn't rush into marriage, because it's the best way to rush into divorce.

[https://video.vice.com/en_us/video/inside- america39s-billion...](https://video.vice.com/en_us/video/inside- america39s-billion-dollar-divorce-industry/559fdff16e523e627f051280)

</comment><comment><USER15> > What can I do? I don't think I will be ever able to accept a girl who is > just marrying me for the resources.

Well then, what are you contributing to the relationship?

</comment><comment><USER16> Why does she have to be Indian?

</comment><comment><USER17> I've been hearing a lot of this from people in tech and I think I know the reason why this happens to guys like you.

Here are some of my observations:

\- You are in tech, so you are possibly an introverted nerd. Which means, you feel drained with social interaction. Unfortunately, women won't come without interaction

\- You are in tech, so your profession requires constant studying and updating skills, which means less time outside, meeting and interacting with women

\- You are in tech, you allowed companies to make your life miserable with stupid interview processes, perf reviews, PIPs etc. Ever occurred to you how much you are compromising in your life to "win" at these stupid artificial processes?

\- You are an Indian in the US. I'm guessing on H1b. Which means you are basically a modern day slave unfortunately. Do you realize how much freer people are back in India? If real life is more important to you than substandard life in US, go back to India. Seriously, life in India is FREEDOM. Live in some nice cities, meet people, meet neighbors, celebrate festivals

\- You are in tech, so you are more comfortable with computers than with people. Women are not computers

\- Your go-to place to ask such an issue is HN? Perhaps cut down time in front of the screen and meet real people. This action of yours gives a clue as to how unhealthy your relationship with computers is

\- You are seriously behind socially. There's no other way to put this. Women are humans, they have social and emotional needs. A healthy woman will have had some relationships. You haven't had a relationship before? Guess what, most healthy people in their 20s do. You are the odd man out, nothing changed with women

Now you know why so many people choose not to do STEM?

<comment><USER18> Agree with you on "tech persons are more comfortable with computers than woman"</comment></comment>