TikTok curbed reach for people with disabilities - <AUTHOR> https://netzpolitik.org/2019/discrimination-tiktok-curbed-reach-for-people-with-disabilities/ <comment><USER3> The "only visible in home country" clause does seem to support TikTok's claim that they were doing it for the hidden users benefit. It's hard to say whether or not the policy has a net positive or negative effect.

If you browse the recommended posts page on the app, it's pretty much guaranteed that you'll see someone who falls under the named categories from the article (queer, fat, disabled). They're almost always showered with support and positivity in the comment sections.

<comment><USER4> I've found the comments on TikTok quite positive in general. Especially with these "vulnerable" groups of people. I think it is due to the younger user base. It seems that people that have grown up with social media nearly their entire lives know how to be more polite, and just handle it better all around.

<comment><USER5> It feels like social media breeds you to know that anything you say or do can come back to you as a "viral" moment, whether it be on sites like Twitter or Reddit (r/IdiotsInCars has surged in popularity) or in real life since it's as hard as ever to separate your online presence from your regular life.

</comment></comment></comment><comment><USER6> I've never met anyone in real life with Tourette's, just as characters in a TV show that's trying to be edgy.

But in browsing TikTok I've met several people with Tourette's and learned about their lives. The majority of them whistle and don't use many profanities and this was a revelation to me. Also a fair number of BBW women who are both sexy and hilarious. But what I haven't seen at all are overweight men come to think of it.

I think that if TikTok wants to protect those under 18 from bullying it's a less than perfect solution. Perhaps they should target the bullies for banning instead?

But for adults it's clearly discrimination and they should stop. Can you imagine TV never airing Jackie Gleason, Benny Hill or Chris Farrelly?

<comment><USER7> My first wife had mild Tourette's. In public she could hide it; in private it manifested itself in the form of twitching. The only time she uttered obscenities was when I did something stupid.

<comment><USER8> My wife utters obscenities when I do something stupid, but there is no Tourette's involved!

</comment></comment></comment><comment><USER9> Is this article pushing for getting quirky viral clips of folks with down syndrome etc pushed more broadly into the feed?

Tiktok is very viral oriented - and the net is not that friendly - I hope netzpolitik are willing to provide support for folks facing attack and/or ridicule as a result of going viral - not everyone is in a good place for that (even youtube stars going through crazy burnout / meltdown cycles).

<comment><USER10> > not everyone is in a good place for that (even youtube stars going through > crazy burnout / meltdown cycles).

Then these platforms should actually punish the people attacking, not the victims. Why is it the victim's fault that people around them aren't mature enough to treat them like a human being? Why is it their fault that they're being attacked for being themselves? Why should they be the ones that are being punished for being different?

What TikTok is doing is literally victim-blaming, and it's not ok.

<comment><USER9> Not every child (of any type) is helped by a global audience.

So we are clear - these are for profit platforms exploiting / providing a free service depending on your perspective for content providers and users -> usually with the goal of marketing to them or otherwise monetizing them.

Now mix in folks with development disabilities and a history of exploitation / abuse in this area generally. That down kid gyrating so you can laugh and show your co-workers is not an adult making a fully informed decision.

What these for profit platforms are doing is in many cases literally exploitative -> with the rights to monetize the content held by the platform, so you can laugh in the morning - and it's not OK.

<comment><USER10> Who said this was limited to children, anyway? You have to be 13+ to join as per COPPA, and age is never a part of their own equation as to whether a user is vulnerable or not. Everyone in the article is over 18, so this is clearly being applied to adults.

In any case, none of what you said actually responds to my questions -- why are the victims the ones being punished here? What did they do to deserve being silenced other than being themselves?

Yes, what these platforms are doing _is_ exploitative, and that's a real separate issue that needs to be solved. But the right solution isn't this victim-blaming discrimination.

It's far easier to argue that TikTok et al are exploitative, it's much harder to discuss the proper solution to the issue that the thread is talking about. Let's keep it to that.

<comment><USER9> Let's keep this very focused on this issue.

Someone with down syndrome at 13 or even 21 is in a different place than an adult without down.

We probably disagree somewhat on whether exposure to a global audience as a child is healthy, even if it is 99% supportive. I'd be curious how star wars kid, and other young stars are doing - kids / disabled are CONSTANTLY being exploited, particularly if there is a financial angle to it.

We ALREADY see this on youtube where streamers absolutely do crazy stuff with their kids for views.

I'm sure we'll have some funny down syndrome tiktok stars, most likely ones with support staff / agents etc able to keep a good pace of content coming.

I think we are in total agreement - folks making nasty comments should be consequenced. That's the easy part.

But I'll be curious what stories we hear in 5 - 10 years about whatever tiktok stars end up making it big by being themselves. Who gobbled up the money, how happy were they etc. I say this because fully mature adults struggle with this terribly on these platforms already. The history here is not great BTW.

And where you and the rest are reading the since changed guidelines as "victim blaming discrimination" by an evil corporation - another possibility is that they used a guideline (potentially from an education setting) and applied it in a setting that it wasn't considered for.

I say this because in an ed setting with down / disabled kids you really don't (even with their permission or their parents) video and promote the "funny" things they do.

<comment><USER10> I was trying to very politely tell you you're arguing a strawman. This thread is not about the exploitation of people on social media, whether by the companies running them, or others (ie. their parents). This thread is not about who will make it big and who won't on TikTok or whatever other platform.

While a lot of what you are saying is important and something that should be talked about, this thread is not the right place for this discussion. This discussion is specifically about "TikTok [curbing] reach for people with disabilities".

I will comment on two things:

> And where you and the rest are reading the since changed guidelines as > "victim blaming discrimination" by an evil corporation

Intentions don't really matter if the act comes off as "victim blaming discrimination" to everyone. If everyone (or, more specifically, "you and the rest") sees it as that, then that's what it is. The duck test very much applies.

> I say this because in an ed setting with down / disabled kids you really > don't (even with their permission or their parents) video and promote the > "funny" things they do.

Once again, we're not talking about kids. And we're not specifically talking about people with Down's. Those are two very specific instances you cherrypicked, but are not the only cases of "disabilities" used by TikTok in this instance, or in previous instances of censorship. Setting aside the Down's adult argument, where intelligence and ability consent vary _wildly_ between people, it's not nearly as clear cut as you make it seem, are adults with facial disfigurements suddenly not able to decide for themselves? What about members of the LGBTQI+ community (who have been known to be censored on this specific platform)? Amputees? Paraplegics? People with a "birthmark or slight squint"? All of these groups of people, and more, would be "Auto R"ed or given a higher risk category which would prevent their content-- content that they explicitly and willingly uploaded and wanted to make public-- from being seen by others. This is like the textbook definition of censorship, discrimination, and victim blaming.

If you're willing to engage in an actual discussion on this topic, I'm happy to do so, but so far I've been saying things that you're either willingly or unwillingly completely dismissing in lieu of your arguments on a completely different topic.

<comment><USER9> In your case you have constructed a narrative that this company is out to victim blame and discriminate against the disabled. You've then constructed an elaborate - and very harshly worded set of arguments around this.

Their guidelines "literally" (to use a word you keep on misusing) say this is about cyberbulling - the fault lies with the bullies in cyberbulling if you use that term.

Despite your use of the world "literally" the guidelines do not say this risk marking is designed to "victim blame" and "discriminate against the handicapped".

If you read the guidelines and have a background in this space (I can tell you do not) you may recognize some of these elements from guidelines used in educational and other setting for folks who have a mental handicap. Whether it's proper to bring them over is debatable, but you ascribe a lot of intent to tiktoc and seem unwilling to consider any other perspective than your own.

Content moderation is generally a cost center for platforms. They do it not because they want to, but because they HAVE to. They have links to suicide hotlines, ways to block and report followers. Your premise - that a for-profit company set out to incur costs to discriminate and victim blame (and you've done no analysis of steps they've taken around bullying on the platform). In fact - why was my account suspended is a very common question around tictok - in many cases exactly because of their steps here - they've constructed a reasonably positive community.

Suicide is I believe the second cause of death up to 30 or so (someone correct me) - so focus on questions of cyber-bullying is not unwanted. And yes - <USER2> lies with the bullies - just the way it lies with the criminals who would abuse a child on the street in a city at 2AM. But you still might tell that child to be home while its light out to reduce the risks to them if they were vulnerable - and your intent may not be discriminate against your child's chance to do what they want but to protect them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Sounds like how social media works in general: highlight what is most aspired; tuck away what deviates from these ideals.

<comment> ctrl-j > TikTok, the fast-growing social network from China, has used unusual > measures to protect supposedly vulnerable users. The platform instructed its > moderators to mark videos of people with disabilities and limit their reach. > Queer and fat people also ended up on a list of "special users" whose videos > were regarded as a bullying risk by default and capped in their reach – > regardless of the content.

I'm certainly not privy to all the inner workings of other platforms, but this doesn't sound like what happens on other social media sites...

</comment></comment><comment><USER12> Interesting because there is a recent tiktok meme going around about being socially accepted (people coming out to their parents, romantic insecurities, teenage pregnancy, etc.) and its really heartwarming and endearing. One thing I've noticed about the younger generation is they definitely seem less harsh when it comes to bullying in general then my generation (I'm 28) at the same age. Although the individual cases of bullying seem more intense.

</comment><comment><USER13> Nothing about this sounds like it is to protect people, and everything about it sounds to me that they are just trying to minimize the selected groups.

</comment><comment><USER14> Seems to use the German way to punctuate quotations even though it's an English article :)

</comment><comment><USER15> TikTok went the wrong way about preventing cyber bullying against the disabled. In this situation it would have been better to do nothing at all. If they had just let disabled individuals get cyber bullied they could have avoided this negative press altogether.

<comment><USER16> Yes, but then the disabled individuals would have been mentally traumatized. Companies shouldn't avoid doing things just to avoid negative press. They're providing a service for the people.

<comment><USER17> > Yes, but then the disabled individuals would have been mentally traumatized.

This is absolutely backwards, as it is based upon the presumption that disabled individuals are so fragile that they cannot face any adversity or be "traumatized."

That's just reverse-discrimination, and it's just as damaging as outright discrimination.

> Companies shouldn't avoid doing things just to avoid negative press.

Companies aren't going to arrange themselves along moral lines, we've seen this failure too many times to think it's a possible or even desirable goal. Negative press is a useful tool and is simply reflective of our societies attitudes and morals.

I'm perfectly fine with companies using "negative press" as a bellwether for internal policy.

> They're providing a service for the people.

...and those people _willingly_ decide if they want to use it or not.

<comment><USER18> > the presumption that disabled individuals are so fragile

No such presumption. Lots of people, especially kids, can become traumatised by bullying. This argument seems like concern trolling to be honest.

> and those people _willingly_ decide if they want to use it or not.

Children can willingly decide to gamble or buy a beer but we as a society don't let them. And we don't just leave it up to the parents in those situations either.

<comment><USER19> > _And we don 't just leave it up to the parents in those situations either._

...well, with beer we often do, in the US, at least: [https://www.alcohol.org/laws/underage- drinking/](https://www.alcohol.org/laws/underage-drinking/)

</comment></comment></comment></comment></comment><comment><USER20> Relevant XKCD - [https://xkcd.com/1357/](https://xkcd.com/1357/)

<comment><USER21> Actually it's illegal in the U.S. and Europe to "show people the door" because of a medical disability.

<comment><USER22> Although the original xkcd is simply wrong, it's possible that parent post is irony in order to illustrate that?

<comment><USER23> I don't know what the original intent may have been, but this is the only reading that makes sense.

</comment></comment></comment></comment><comment><USER24> Finally a company that is sensible and free from virtue signalling bs from silicon valley who in fact end up doing more social damage contrary to what they claim!</comment>


An interesting take on email - <AUTHOR> http://www.susanblackmore.co.uk/2015email.htm

<comment><USER2> _" My email is monitored by others from time to time and they will let me know if I need to respond. For anything really urgent please contact <address> at gmail.com"_

It's easy to avoid e-mail when you have an administrative assistant to handle it for you. Most of us don't have that luxury.</comment>


New Hitchhiker's author announced - <AUTHOR> http://news.bbc.co.uk/1/hi/entertainment/7619828.stm

<comment><USER2> One of the salutary effects of watching open media in action is that I've become quite fond of the idea of new authors reworking the characters and stories of old authors. I'm tired of proprietary "canons". Particularly when it becomes apparent that the guy running the canon has much less talent than his fans. ( _Cough_ George Lucas _cough_.)

Though I think Douglas Adams is bound to be a tough act to follow. It does help that the last _Hitchhiker's_ book is not the best work in the series. I tend to read only the parts of that book with Ford in them (which are great) and just skip all the existential despair that rounds out the book. I mean, the _Hitchhiker's_ series is all about the existential despair, but you can have too much of a bad thing.

What I really want to see, though, is more Dirk Gently stories.

<comment><USER3> Except that I think I read Hitchhiker Guide books more because I find Douglas Adams' writing a delight to read than because I like the particular characters and story.

Which means I should be ashamed of myself for not reading any Dirk Gently books yet.

<comment><USER2> You are one of the luckiest humans on the face of the earth: You have Douglas Adams prose to look forward to.

And I agree: Nobody is going to _replace_ Douglas Adams, nor are the characters or the plot the important part of Douglas Adams' writing. But that doesn't mean the characters and plot are _entirely worthless_ as test vehicles for other people's prose styles. Just because it isn't Shakespeare doesn't mean that _West Side Story_ is a bad thing.

<comment><USER3> True on both counts.

</comment></comment></comment></comment><comment><USER4> I think that if they really wanted to end the series, Colfer is the best man for the job. He's no Adams by any means, but he's certainly good, and hopefully he'll at least give us a feel for what Adams wanted.

Gaiman would have been an excellent pick, too: Good Omens, with Terry Pratchett, is as close to Adams' humor as I've found. But Colfer has a much finer sense of whimsy.

</comment><comment><USER5> An audio response 'from' Arthur Dent about the new book: [http://eoincolfer.com/news/wp-content/uploads/2008/09/and- an...](http://eoincolfer.com/news/wp-content/uploads/2008/09/and-another- thing.mp3)

(portrayed by the original BBC voice actor of Arthur Dent)</comment>


EU data protection law after the Safe Harbour judgment - <AUTHOR> http://eulawanalysis.blogspot.com/2015/10/the-partys-over-eu-data-protection-law.html <comment><USER2> Interesting tidbit: If you try to refer to this article with a link on Facebook, they will block you from posting it.

<comment><USER3> Very intresting. This is what I've got when trying to post it on facebook:

You can't post this because it has a blocked link The content you're trying to share includes a link that our security systems detected to be unsafe:

[http://eulawanalysis.blogspot.com/2015/10/the-partys-over- eu...](http://eulawanalysis.blogspot.com/2015/10/the-partys-over-eu-data- protection-law.html)

Please remove this link to continue. If you think you're seeing this by mistake, please let us know.

<comment><USER4> And other entries from the same guy can be posted without any problems. FB is saying that their "security systems" detected the link "to be unsafe", but comparing source of that particular post with other posts, I don't see any significant difference (except for the text, of course). Sounds like the text itself contains information which is unsafe (for FB).

<comment><USER5> > And other entries from the same guy can be posted without any problems.

Well, other entries don't bad-mouth Facebook.

</comment></comment></comment></comment><comment><USER6> In general, this is a very good thing. The main outcome will be that more engineers will be needed to do more work to ensure that data is handled more carefully. The cost will be slightly reduced profits at companies that handle large volumes of data globally. What's bad about that?

<comment><USER7> > The main outcome will be that more engineers will be needed to do more work

[https://en.wikipedia.org/wiki/Parable_of_the_broken_window](https://en.wikipedia.org/wiki/Parable_of_the_broken_window)

Artificially creating additional work by imposing additional requirements does not necessarily improve the situation just because it employs people to do that work, whether you personally like those requirements or not.

<comment><USER8> The parable of the broken window weighs what is seen (the payment to the glazier) with what is not seen (the missed payments to other things that could've been purchased had the window not been broken).

In the case of safe harbour, _the window was already broken_. Data being passed from Europe to the US was not being handled correctly, despite the promises inherent in Safe Harbor.

If protections had already been in place (i.e. if data service providers were actually adhering to the promises of safe harbour) then service providers _have already fixed the window_. Those that were safeguarding data correctly have no further engineering work to do (although there might be further regulatory/compliance effort to prove it depending on how individual nations implement the stopgap safeguard laws to replace Safe Harbor).

The only engineering work required to "fix the window" is work that should already have been done according to the safe harbour agreements, and threads like this prove how broken Safe Harbor was to begin with.

</comment></comment></comment><comment><USER9> There is one key issue that is routinely ignored. The US and other countries have two sets of data protection rules that govern police and security services. One set of rules for residents of that country (e.g. US persons) or domestic data and another much less stringent set or rules for everyone else.

So even if data protection rules were perfectly adequate in every single country on this planet, there would still be justified concern about transferring data across borders.

That's a situation that must change, and it can change without taking away the bowl of sweets from security agencies altogether (which will never happen).

<comment><USER10> > The US and other countries have two sets of data protection rules that > govern police and security services. One set of rules for residents of that > country (e.g. US persons) or domestic data and another much less stringent > set or rules for everyone else.

This is going to be generally true of most countries. If it weren't the case, most forms of espionage would be subject to prosecution in the spy's home state.

</comment></comment><comment><USER11> I think there's a bit of a rush to panic about data balkanisation here; remember, this is not a ruling that applies directly to Facebook, but to the information commissioner of Ireland.

There's no new policy and no court orders to do particular things. What's likely to happen is an extensive legal limbo. We may even end up with a special Snowden version of the cookie warning: "Data stored on this system is subject to mass surveillance and may be accessed by the security services without a warrant or due process".

<comment><USER12> > We may even end up with a special Snowden version of the cookie warning

Depends. The courts might rule that that sort of "click-through" agreement is invalid and doesn't count as consent.

 _Update_ : Already happening. DPA of Schleswig Holstein: Transfer on the basis of Model Clauses unlawful. from [https://twitter.com/CarloPiltz/status/654214641975984128](https://twitter.com/CarloPiltz/status/654214641975984128)

<comment><USER13> I don't believe such a ruling will be allowed to stand for long, if it really is effectively a blanket ban that can't be overridden by reasonable consent. Enforcing something like that really would have the potential to block international trade on an economy-damaging scale.

<comment><USER12> The party who broke the deal was the USA, with it's unrelentent mass spying of as many people as possible. If you want change, start there.

<comment><USER14> That doesn't change the issue of data transfers to third countries that are not approved though.

</comment></comment></comment></comment></comment><comment><USER15> > Since the Court refers frequently to the primary law rules in the Charter, > there's no real chance to escape what it says by signing new treaties (even > the planned TTIP or TiSA)

Oh good, I was worried a little about that one.

> Undoubtedly (as the CJEU accepted) national security interests are > legitimate, but in the context of defining adequacy, they do not justify > mass surveillance or insufficient safeguards.

Another good thing. I wasn't sure if this ruling affects spy agencies, too, or just companies.

</comment><comment><USER16> Question: If Facebook manages data within Europe, what are the safeguards in place to ensure that there won't be mass surveillance, e.g. face recognition, shadow profiles, friend graph browsing?

<comment><USER11> That's use of the data to which you've "consented" by their EULA. "Mass surveillance" specifically refers to warrantless bulk access to that data by security agencies.

(Shadow profiles are plainly a violation of data protection law; do they exist for EU users?)

<comment><USER17> Yes they do.

<comment><USER11> Hmm. It seems that a process is ongoing about this, since 2011: [http://europe-v-facebook.org/EN/Complaints/complaints.html](http://europe-v- facebook.org/EN/Complaints/complaints.html)

(Irish Data Protection Commissioner is clearly running this at the slowest speed they can get away with)</comment></comment></comment></comment>


Everybody thinks SQL joins are slow-is it because MySQL doesn't have hash joins? - <AUTHOR> http://use-the-index-luke.com/sql/join/hash-join-partial-objects

<comment><USER2> No, the author has misunderstood "joins are slow." (Edit: not the post author, but the HN submitter. This reaction made more sense before the submission title was changed.)

The point is that joins are slow _when you scale past one machine_ because the data you are joining will be on different nodes.

(Yes, I'm familiar with pk-based sharding or entity groups, or even more sophisticated partitioning like volt's. None of these can always always be made to fit your data; I'm talking about the general case here.)

<comment><USER3> I think the author's point is that MySQL JOINs are slow if you are joining more than 2 tables.

More mature databases like Oracle or PostgreSQL can eat 4 or 5 way JOINs for breakfast.

<comment><USER4> I definitely don't have trouble finding queries that are 50x slower on PgSQL than MySQL so I don't think it's as simple as saying one is more mature than the other in all ways.

That said, if you're doing N-way joins with N big you probably want bitmap index support too, which is another thing missing in MySQL, although I've written libraries that, for certain specialized cases, can fake it.

<comment><USER5> Postgres has bitmap index support baked in as well and it works really well. I'd be awfully interested in knowing where MySQL beats it by 50x at anything.

<comment><USER6> Some MySQL vs PG tests done by Domas (of Facebook & Wikipedia fame) show some interesting differences between MySQL and PG for an in-memory read only test. I don't think there are any 50x differences though.

<http://dom.as/2010/11/08/random-poking/>

<comment><USER5> The tough thing about comparing these two is that it is hard to find a benchmark (I don't know of one) that works similarly with them both. Sysbench is somewhat of a standard for testing MySQL configs but Postgres does not handle it well.

Though I tend to prefer Postgres don't get me wrong - MySQL has some advantages.

For raw pkey lookups, especially range selects against pkeys with lower amounts of concurrency InnoDB's speed is unmatched. It should be given that it is completely laid out on disk specifically for that to the detriment of other features.

MySQL's replication is extremely sturdy. On paper the older method (statement- based) sounds incredibly fragile but in practice it works extremely well and has been proven on countless projects. mmm makes it almost too easy to setup replication and failover.

I feel that MySQL stalled out for several years in the 5.0-5.1 period where poorly engineered features were bolted on to create a product with too many pathological cases that destroyed performance to keep track of. All these features were available but experience taught you to avoid most joins, avoid most subselects, avoid most usages of views, etc.

That said, v5.5 has a lot of nice improvements and can actually scale up to more than 8 cores (I've gotten linear improvement up to about 32 cores and that is what Oracle puts in their white papers as well). Percona and Facebook are releasing nice patches and branches, and forks like Drizzle are reaching GA and doing good things as well. So I think it is headed in the right direction again.

</comment></comment></comment></comment></comment></comment><comment><USER7> I recently had a similar problem. Users wanted to export a highly normalized structure to a csv file for munging in a spreadsheet. They were limited to 200 rows, because a thousand rows would bring everything to its knees. My first cut was to move from Hibernate to pure SQL, but if I tried 1000 rows it went away for a long time. I dont know how long because I killed it after 15 minutes. The real killers seemed to be lef outer joins.

I then split the query into several temporary tables. The first table contained all the rows that I was interested in. The other tables replaced the left outer joins and nasty beasts like group concatenates and queries that turned aggregate results into separate fields. The temp tables were used to update the first table. Runtime went from a significant part of an hour to under 5 seconds.

</comment><comment><USER8> Based on the majority (since the title is going for "everybody") of people who drop into #mysql on any given day to ask about slow queries, I'd argue that the majority of people who thinks MySQL joins are slow still don't have proper indexes and are still using their un-tuned, distro-provided my.cnf

</comment><comment><USER9> It's worth mentioning that MySQL (iirc) _does_ support sort-merge joins, which aren't mentioned by this article. So it's not a case of (index) nested loops joins or nothing. While hash joins are usually significantly faster than sort- merge, they have a variety of similar characteristics, and don't suffer from the mash-the-b-tree issue that index nested loops do. Overall this makes me doubt that the lack of hash joins is the fundamental reason some people think joins are slow.

<comment><USER10> MySQL only supports nested inner loop joins.

<comment><USER9> ...ah, I just bothered to check it out in more detail, and you're kind-of right. MyISAM only supports nested loops (which I have to say surprised me), but InnoDB (which, let's face it, is the backing store that allows mysql to qualify as a 'real' RDBMS) supports hash joins.

</comment></comment></comment><comment><USER11> Not directly related, but this is a great site to peruse. Great code examples and a great perspective on database performance.

</comment><comment><USER12> Is the answer in the domain name?</comment>


Qualities Your Best Employees Should Have - <AUTHOR> http://www.inc.com/jeff-haden/the-8-qualities-of-remarkable-employees.html?utm_source=twitter&utm_medium=socialmedia&utm_campaign=button

<comment><USER2> It's funny: I could make a list titled "8 Qualities That Will Keep You From Getting Promoted at Most Companies," and the bullet points would be roughly the same. These may be great qualities for employees to have, but a lot of them are likely to be seen as liabilities. Employers may say they want free- thinking, mild eccentrics, but they create pretty much the opposite incentive structures. (Conversely, nothing gets people promoted faster than being a corporate cheerleader).

Perhaps this is at the heart of what's wrong with most big firms. I don't know. But I think articles like this one need to reconcile the gaping disparity between what people _say_ they want and what they _actually_ seem to reward.

<comment><USER3> "Perhaps this is at the heart of what's wrong with most big firms."

I think the list makes a lot more sense if you apply it to small companies. Not necessarily startups, but companies of less than, say, 30 or 40 people.

Big companies seem to need to protect themselves against incompetence in ways that small companies do not. So they create more tightly defined roles and Procedures Which Must Be Adhered To, which preclude employees ignoring job descriptions, grate against eccentricities, and are not amenable to fiddling.

If you have a significant fraction of these 8 qualities, I suspect you'll be happier at a small company.

</comment></comment><comment><USER4> Amazing. Now, let's all fantasize about bosses who don't suffer from personal insecurities, incompetence and fleeing responsibility that could deal with such an employee.

These articles always sound like the employers are all Gandalfs and all the employees are all the novices.

</comment><comment><USER5> It's funny, when peoples talks about what they want but don't mention anything about what they ready to give. I think it's easy for "the MBAs".

</comment><comment><USER6> One question: how many such employees exist? This is one huge "wish for" list. You have to be great at what you do, and the social stuff? You have to be great at that too. Can every company expect to get such employees?

</comment><comment><USER7> "When a key customer's project is in jeopardy, remarkable employees know without being told there's a problem and jump in without being asked—even if it's not their job."

While this may be true, you're not going to get it often unless you compensate them for it. Most competent engineers will only do the late night/unpaid overtime a few times before they realize it's not getting them anything extra.

</comment><comment><USER8> Good list. I would add accountability to that.

<comment><USER9> Accountability is huge trait for employees and it seems compatible with, "They speak when others won't." Often a team is faced with err and the best employees speak up, take responsibility and discuss solutions from the lessons learned. In the face of failure too many employees pass the blame or simply remain silent.

</comment></comment><comment><USER10> "They like to prove others wrong"

...what utter shit!

</comment><comment><USER11> This is a horoscope-quality feel-good list for incompetent middle managers to read and misunderstand.

<comment><USER12> I was just about to write this exact same comment. Most people will claim 7 or 8 of these points.</comment></comment>


Ask HN: Know any good iOS onboarding/tutorial libraries? - <AUTHOR> Know any good iOS onboarding/tutorial libraries? Specifically one that highlights the element, provides a tooltip overlay, and does state tracking (checking if it has been already been shown). Thanks! <comment><USER2> Did you check here ?

[https://github.com/cjwirth/awesome-ios- ui](https://github.com/cjwirth/awesome-ios-ui)

<comment><AUTHOR> Thanks!</comment></comment>


Harvesting rare-earth metals from the moon will happen this century, NASA chief - <AUTHOR> https://www.cnbc.com/2019/07/18/nasa-chief-bridenstine-on-harvesting-rare-earth-metals-from-the-moon.html <comment><USER2> Earth: Dig a hole in Australia/China and process it to get rare-earth metals.

Moon: Use multiple rocket launches to boost equipment and people to the Moon. Dig a hole and process it to get rare-earth metals. Send people and metals back to earth.

Hard to see how the Moon version could ever be price competitive. Even if you could pick up rocks of pure rare-earths I do not think it would be cheaper. Still, makes for an easy headline for a NASA chief I suppose.</comment>


Twitter profiles being blocked in Google Chrome - <AUTHOR> http://rmbls.net/post/39238521544/twitter-has-malware-or-not

<comment><USER2> not for me.</comment>


Ask HN: A good way to support SSO in bootstrapped SaaS? - <AUTHOR> I'm looking for an identity solution that allows me to offer SSO in a typical SAAS scenario:<p>-Multitenant support where tenants can be created in an automated fashion<p>-Allows SSO to be setup back to a tenant's own identity provider (saml2)<p>-There could be between 2 and 300 users per tenant. I'd be happy to have 3 tenants with 20 users each to begin with.<p>-No real need for logins to link to multiple tenants<p>Auth0 is expensive for this relative to where I am at. I'm on the .net core stack where identityserver4 is often used, but some of the (java) based offerings appear to come with more out of the box (for free). In saying that, integration with SAAS of this nature looks to complicate things. So I'd appreciate any advice from HN's experience on the options available. <comment><USER2> I rolled my own at work based on [https://github.com/displayr/AspNetSaml](https://github.com/displayr/AspNetSaml) which I forked from [https://github.com/jitbit/AspNetSaml](https://github.com/jitbit/AspNetSaml)

There is a PR to make it work with .NET core at the moment.

Once you understand the protocol it's a case of storing some fields relating to the IdP in your database, for each tenant. Redirect to the IdP website and they'll redirect back to you and post a signed XML doc to daub Joe is authenticated and belongs to these groups.

<comment><USER3> I gave this code a quick skim and it seems reasonably well thought out and I wish I'd seen it before I rolled my own at work. There are numerous security flaws that one can accidentally introduce with SAML and it seems you've avoided the obvious ones at the very least (i.e. not checking there's only a single assertion, etc).

Just in case you weren't aware of it, I found this page very helpful when developing mine: [https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md)

<comment><USER2> Thanks. I can't take too much credit: Jitbit did most of that work, I added some integration testing and added a couple of methods.

</comment></comment></comment><comment><USER4> Unless I'm misunderstanding your needs, why wouldn't [http://www.passportjs.org/](http://www.passportjs.org/) work? I've used it successfully for Google & Facebook signup/signin.

It has SAML support and I guess one of these packages could be customized to your needs? [http://www.passportjs.org/packages/](http://www.passportjs.org/packages/)

</comment><comment><USER5> I highly recommend ComponentSpace SAML SSO. There is a cost, but well worth it, imo. It's well maintained, support and forum available, fast responses, etc. I tried a few OSS, but they had some limitations that I couldn't get around in a short timeframe.

</comment><comment><USER6> Used Auth0 before with great success. They support SSO and everything you need.

[edit] The right name this time</comment>


Attunity Data Leak: Vendor for half the Fortune 100 exposed terabyte of backups - <AUTHOR> https://www.upguard.com/breaches/attunity-data-leak <comment><USER2> I mean, it's the usual story with these things — "accidentally stored internal data — including other companies' security sensitive data — in a public file share" (or in this case, S3). Not much to learn from the story that we don't already know about IT security. Bottom line, it's bad to trust vendors that are not trustworthy, and this can expose other kinds of lazy/bad practices in your organization.

For a company that had thousands of clients, I didn't think 1TB was an especially large amount of data, all things considered.

<comment><USER3> > or in this case, S3

S3 is very common when it comes to leaks for some reason

<comment><USER4> I'd say one big reason would be because so many people use it.

<comment><USER5> Despite recent improvements, it's still pretty easy to accidentally make a bucket public that you meant to keep private.

<comment><USER6> Yep. As a bigger org you want automatic compliance checks that verify that all buckets are not publically accessible.

<comment><USER7> They have explicit public access blocks at both the bucket and _account_ level now. These override any permissions granted via IAM or bucket policy.

<comment><USER6> That's why you still want explicit automatic audits.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> This one is a double whammy not only because there's not only data on those companies, but it can be extrapolated that many of those companies are relatively new to the cloud (and possibly which cloud service is available as well), making them also ripe for targeting.

One of Attunity's bigger sales deals is making their data migration tools free for a long period to help organizations migrate to cloud. This is essentially a list of "Hey, these other orgs might also be open to hacking as they haven't learned yet."

</comment><comment><AUTHOR> not to mention attunity is the preferred vendor for data integration by microsoft and amazon...so its not just non-tech fortune 100 companies that use them.

</comment><comment><USER9> How much business will they lose?

This is a measure of market efficiency. In an efficient market they would lose absolutely all of it.

Bet you they lose almost none of it. Manipulating old idiots on boards of directors is _much_ more important than quality, which is what the word "enterprise" means.

Enterprise IT (noun): Awful quality product that would get zero traction without a massive con of ignorant boards and senior management.

<comment><USER10> If you know a way to reduce the cost of moving data to zero, could you share it with the class?

<comment><USER9> Flip it around. How high does that cost have to be before it stops being _excellent_ value in this case? Why would you assume zero is the only cost that makes sense here, that's insane!

edit: On reflection I think you've got a meaning from what I said that isn't quite right. The cost of moving is one of the things that might make this market inefficient. Anything that is a barrier to entry, a barrier to switching provider contributes to market inefficiency. It's an economic term worth knowing as people bandy it about here a bit. Barriers to entry, imperfect information, market power of suppliers (here), nonzero selling costs, nonzero switching costs all contribute. The question in most markets is to what extent do they contribute? How inefficient is it? Here paying money for gross incompetence when you found that out you'd be pretty determined to dump the supplier because you've been conned, and conned badly. Now you are aware of being exposed to a large risk, ever increasing legally once you do nothing when you clearly know the risk exists. So it's a good measure of how efficient _this_ market is because nobody of any competence or sanity _wants_ to stay with this supplier anymore.

<comment><USER10> The dominant cost here is switching cost. Data has mass-like characteristics. It exhibits inertia, momentum and gravity.

To move data from one to another requires three terms: you need to be moving at least as fast as the production rate, you need to be accelerating at least fast as the production rate is and then, on top of those, you need additional movement speed to be able to move the original accumulation.

For the market to be perfectly competitive in an economic sense, switching costs would have to be zero. Hence my original smartarsery.

I think it's more likely that they'll call their lawyers and haggle for a few bucks off the next renewal.

<comment><USER9> You wanted service, you got a punch in the face. So negotiate a small discount while leaving yourself wide open for being sued? Crazy! These guys are a huge risk of not being around in a year.

That's some kind of market inefficiency right there. How bad would this service have to be to dump the supplier? It's actually kind of hard to imagine this being worse, don't you think?

It's not my area but I'm pretty sure I can design a parallel solution to get away from the vampires relatively quickly. Start collecting current data somewhere else in parallel to the existing. Move all the existing data, take as as long as that takes. Switch of the tap to the legacy vampires when it's done and the new, up-to-date collection has full history. Pay to get it done. Sue your former suppliers for the entire cost on account of them being fundamentally incompetent and dishonest. Dare them to fight it. Tell them just how much you're looking forward to discovery which by necessity will _not_ be confidential. "How famous do you want to be?" Give interviews about how you don't put up with this kind of standover nonsense. Seriously you can't have these idiots as suppliers. You really can't. We can't have them survive in the industry and simultaneously have self-respect, surely. Airlines with planes that crash that aren't their fault go broke. These guys surviving this, just no. They need to die and be condemned to the hell of writing blog posts on medium about what they learned from their total abject and utter failure. Attunity customers who stick with them should be sued for treating their own customers health, safety and wellbeing with contempt. No fortune 100 customer agreed to that risk. A few bucks off the renewal? Just no.

<comment><USER10> I'm not Attunity and I'm not defending them. I'm explaining why some companies will have different preferences from yours (and, to some degree, mine).

</comment></comment></comment></comment></comment></comment><comment><USER11> You don't just guess the full oath of such a file.

Sounds like a data breach, either on the server or in the ops code / config.

When will data ownership be a thing? No need for ANY company to store my data if I can have it one my phone, which is on 24/7 and connected.

</comment><comment><USER12> the real story is, if these were sensitive why wasn't the data encrypted?

<comment><USER13> You could reasonably write it off as not being a best practice in 2014 (although that doesn't explain the current backups being unencrypted). Also it's a terrible excuse.

</comment></comment><comment><USER14> Is it responsible for Upguard to have waited two days to try and contact Attunity?

*edit - I'm not trying to be smarmy - its a genuine question

<comment><USER15> You have to verify and internally coordinate a disclosure of this size. The article also mentions that they were unclear about a point of contact due to a recent merger and that they are in a different time zone. Two days sounds completely reasonable for all of that.

</comment></comment><comment><USER12> a terabyte? cue dr evil: one _million_ dollars.

what's that, one email signature?</comment>


Show HN: My new JavaScript MVC framework - <AUTHOR> http://lhorie.github.io/mithril/ <comment><USER2> I've become a huge fan of simple things. When I was just starting out developing software, I was a big fan of huge integrated solutions. But as the years went on I loved well scoped, lean options.

This is the reason why I like Backbone.JS instead of Angular. The reason why I like Go instead of Java.

Mithril looks really promising! Don't let feature creep turn it into a behemoth! Keep it lean and mean, and excel at the one thing it was made to do!

<comment><USER3> I think this is the same taste-maturation that many woodworkers experience. At first, you salivate over these crazy, overly specific, over engineered power tools. Over time, you start to really love things that are stupidly simple instead, like a card scraper, or a hand plane.

<comment><USER4> Cooking is the same way.

A few, simple, fresh ingredients prepared quickly and correctly can be much more amazing than a complicated 20 ingredient recipe that takes 2 hours to prepare.

</comment></comment></comment><comment><AUTHOR> Hi, Mithril's author here. I'll just put a big comment here, and hopefully everyone can see it.

@stronglikedan: I don't have plans for extending the core (in fact, keeping it small and modular is a major focus point for me). I do have a list of things I want to tackle next (see the roadmap page), but I'll most likely release them separately from core.

@hcho: re: integrating w/ jQuery: see the integrating w/ other libraries page in the guide section. There's a simple example w/ select2 there.

@abjorn: those are excellent points. Re: turing completeness: my take is that things like good error messages in the view layer are more important than trying to prevent people from doing stupid things (that's what code reviews are for). Re: Bindings: I'm most familiar w/ Angular ones and yes, their bidi- bindings are really convenient, but they fail in some 5-10% of the use cases for me (either by being too aggressive or not expressive enough). So, that's a conciseness vs power trade-off in design from my personal experience. Re: templating, you can take the model-level utilities and integrate w/ other templating libraries. I do provide some comparisons w/ React and a few other frameworks in the misc section of the guide, as well as design rationales in the main guide page. TL;DR I use other frameworks full-time and I've done homework before I settled on the current implementation :)

@hanburglar I do provide a tool to convert HTML to Mithril (although not automated yet), see the "useful tools" page.

@timmiwil: you're right, jQuery is not MVC (I mention this in the comparisons page). The point is that with idiomatic jQuery, the app developer is responsible for knowing when to use .text() instead of .html(), whereas with, say, idiomatic Angular, that's not a concern, ever. jQuery "templating" tends to get pretty hard to audit as widgets become more complex (see select2 source code, for example)

@tzaman: I do contribute to Angular and other projects that I use as time permits (mostly bug reports)

@BaconJuice: it's a side project, but a scratch-an-itch one that I work on pretty much every night. Planning on continuing work on it for the foreseable future. I'm also considering introducing it at my day job as well.

@all: thank you for the feedback, I really appreciate :)

<comment><USER5> _> thank you for the feedback, I really appreciate :)_

Well, thanks for the framework :)

Apparently, you missed my (now deleted) question:

_> It would be nice if you could document the browser requirements._

We're even, since I had missed the answer, which lies at the very end of the misc section of the documentation:

_> Mithril allows developers to support browsers all the way back to IE6 and Blackberry._

Wow! This should IMO be on the home page.

        ----    ----    ----

_Edit: Is it possible, for SEO, to load Mithril with a pre-rendered page and have it take over like React?_

<comment><USER6> >> Mithril allows developers to support browsers all the way back to IE6 and Blackberry. > Wow! This should IMO be on the home page.

Agreed! I'm in!

</comment></comment></comment><comment><USER7> Author of Vue.js here, I'm glad you included Vue in your framework comparisons. Here's some thoughts regarding your comments on Vue.js: the reason Vue chose to use ES5-only features is that it enables Vue to provide plain POJO syntax without having to resort to dirty checking or virtual DOM diffing. Granted the auto-magical POJO syntax is a somewhat leaky abstraction, but I'd argue that not all leaky abstractions are bad (since by definition any non-trivial abstractions are leaky) - it all depends on its leakiness vs. the benefits provided by the abstraction. TCP is the canonical example of a leaky abstraction in Spolsky's original post yet it has been the foundation of everything we build on the web all along. In fact, even the concept of virtual DOM is a leaky abstraction in itself. My point is, I don't think the leaky abstraction argument raises anything inherently problematic about Vue.js.

That said, I really like the project because I'm also a big fan of simplicity. Curious to see if there will be a TodoMVC implementation with Mithril for easier horizontal comparisons of actual code.

<comment><USER8> There is a partial TodoMVC implementation available here - [https://github.com/jpmonette/todomvc- mithril](https://github.com/jpmonette/todomvc-mithril)

</comment></comment><comment><USER9> Have you successfully tried this out in a real app? Why would you want to structure your dom inside an array? Seem pretty crazy, my dude.

todo.view = function(ctrl) { return m("html", [ m("body", [ m("input"), m("button", "Add"), m("table", [ m("tr", [ m("td", [ m("input[type=checkbox]") ]), m("td", "task description"), ]) ]) ]) ]); };

<comment><USER10> I think the idea is that it's simple — it's just a basic data structure in the language and can be generated or manipulated with just simple JavaScript. This is similar to why Lisp programs being Lisp data structures is interesting. Intriguingly, it looks like the API is compatible with React's JSX. With that, you could write this as:

      @jsx m
      todo.view = function(ctrl) {
          return (

                <input/>
                <button>Add</button>

                    <input type="checkbox"/>
                    Desk description

          );
      }

<comment><USER9> Adding some more css declarations, id, data-hooks, etc., and make it span 100+ lines, like in real life. Scares me just thinking about it.

<comment><USER10> Are those things you wouldn't have to do under any other system, or which would be significantly simpler there? Because I'm not seeing it. You seem to be saying "This involves building a web page" — which is true, but would be regardless.

<comment><USER9> Yes, it would be simplificantly simpler to edit html if it wasn't stuck in between two strings, for one, let alone inside an array.

todo.view = function(ctrl) { return m("html", [ m("body class='application", [ m("input class='add input input-sm input-md"), m("button class='btn btn- success button-green", "Add"), m("table class='table table-strped table-row", [ m("tr class='tr'", [ m("td", [ m("input[type=checkbox] class='checkbox input input-sm' id=firstName name=firstName") ]), m("td class='td", "task description"), ]) ]) ]) ]); };

I honestly can't tell you what the hell that is supposed to be anymore. Also, you guys are using invalid html for everything. Your example is not going to validate on anything.

<comment><AUTHOR> I think you're too caught up on syntax and missing the big picture. The m() method is simply a helper utility that returns a POJO. You can write the code in coffeescript if js syntax bother you, or you can go nuclear and implement a frontend or a preprocessor that take some popular templating syntax and spit out the appropriate data structure. The conversion tool I provide is a small step in that direction, but, with Mithril being at a mere v0.1, it still needs more work done to be fully automated.

Also, just FYI, the selector syntax follows CSS rules, so you'd write m("body.application"), not m("body class='application'")

<comment><USER9> Programs are for humans to read and only incidentally for computers to execute. Syntax is the whole picture.

<comment><AUTHOR> Well, I already told you which directions Mithril can go in terms of making syntax more to your liking. If you're too put off by js templates and not willing to spend time helping push the project in a direction you like, you can always try other frameworks or come back later when I have a more HTMLy frontend option available.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Overall I like it, except for the templates.

It's perfectly possible to not have FOUC with traditional template languages like mustache, and I don't think having "turing completeness" in your templates is a good thing. Frameworks like Ember.js have also shown that you don't need to manually write bindings to handle when your models change.

That being said, I do see the advantage gained with the virtual DOM you generate from the templates. I'd be interested to see if it was possible to integrate other templating languages in via plugin.

<comment><USER12> Entirely agreed, this is what I was about to say as well. Being able to use html templates for me makes apps much less confusing and much more organized. Moving your html into your javascript just doesn't seem right. If there was a way that it would accept a mustache/underscore/other precompiled template I'd be all about it. But constructing html out of javascript functions and objects just doesn't sit right with me.

<comment><USER13> I actually had the same thought, but I also get that some people don't like HTML-based templates for various reasons. My next thought was whether or not you could just augment this framework by providing a utility that converts an HTML-based template into the view that mithril expects and make both camps happy. As an optional contrib module, of course -- I'm not suggesting he start heaping on additional framework features already. :)

edit: I just wanted to add that I read through the guide expecting to find yet another half-baked framework but the whole thing seems well thought out and I like the philosophy alluded to in the guide. I'm definitely going to try this for my next mini-project.

<comment><USER11> Well, there is such a tool, actually. [http://lhorie.github.io/mithril/tools/template- converter.htm...](http://lhorie.github.io/mithril/tools/template- converter.html)

But while me and my coworker have been trying it out there seem to be quite a few bugs with it, and I'd much rather have it done at runtime (precompiled for production build) then have to translate it from my HTML-based template every time I make a change.

<comment><AUTHOR> Can you file an issue on Github? I still need to make an automated version of this tool (and eventually be able to import from something like Mustache), and I want to make sure it's rock solid.

</comment></comment></comment></comment></comment><comment><USER14> The tests don't make sense. jQuery is not an MVC framework and should not be tested as if it were. It's worth noting that both Backbone and Angular use some version of jQuery (lite or otherwise), so comparing that to your own way of using jQuery doesn't correlate. I could use jQuery to append elements in a way that was much faster than and just as short as what you've done in your test. Also, did you know you can append image elements with events using document.appendChild? It must be a security issue! But seriously, don't even include it in the tests. It is a JavaScript library that serves a lower-level purpose than MVC frameworks.

<comment><USER15> It has reached the point where Javascript Framework coders don't know Javascript.

Looks like Javascript IS the Assembly of the Web.

<comment><USER16> But DOM is separate from JavaScript.

<comment><USER17> DOM is separate from Ecmascript, but is actually one of the 3 components of Javascript (along with Ecmascript and the BOM). This is at least according to _Professional Javascript for Web Developers_ (you can see it on 'page 3' in the Amazon preview).

<comment><USER16> The sources I've read (Douglas Crockford or Wikipedia) clearly state that DOM is separate from JavaScript.

</comment></comment></comment></comment></comment><comment><USER18> The approach we've taken in our anti-framework is that the model is your data (and the code you use to manipulate the data), the view is your HTML/CSS ( _not_ a special templating language -- actual HTML), and the controller is automatic for simple stuff and custom for complex stuff.

So the big example at the end of Mithril would, for us, be something like (we implement binding as a jQuery extension)

$('.display').bind(data);

Where .display selects the root node of the bound UI, and data is our object.

Which is simpler and less code, I think. (Oh and our binding library has jQuery as a dependency, but is sub 3kB minified and gzipped.)

That said, we haven't put our libraries on github yet :-(

<comment><USER19> Sounds a bit like the pure js library but with jquery.

[http://beebole.com/pure/](http://beebole.com/pure/)

<comment><USER18> Ours is a fair bit more elegant and works both ways. It's also being used for multiple pretty complex projects so it's reasonably "battle-tested" (although nothing is in production yet, so not as battle-tested as it needs to be).

We also do not bind by class because that's a really bad idea. (Actually the way we bind is a lot like Angular, but without being a templating language.)

A key design requirement is that the model does not get polluted with special methods and properties to support the binding -- so (for example) if you have nice RESTful services, you can GET, bind, edit, POST/PUT and everything just works. For moderately complex cases we support "decorators" that live "off to the side" (i.e. do not pollute the model). Again, you _can_ stick getters and setters in your model if you want to, you just don't need to.

</comment></comment></comment><comment><USER20> your "getting started" page is like a crash course in building websites with javascript - just forwarded it to a bunch of friends

it felt like you were giving a smart person a crash course in javascript

wish more apps sturctured their tutorials like this

great job!

One thing: it feels like it's aimed at people who are already competent at javascript

but your tutorial isn't too many steps away from a being solid "javascript for absolute beginners" guide

So would be cool if you made it slightly more beginner friendly, like I'm sure you're losing a lot of engagment and users because they read the first line of your guide and immediately think it's too complicated

"Mithril is a client-side Javascript MVC framework, i.e. it's a tool to make application code divided into a data layer (called "Model"), a UI layer (called View), and a glue layer (called Controller)"

Like I'd suggest adding a VERY simple sentence about why you'd want to use javascript AT ALL

both on the guide and the start page

like if someone landed on your page and they were good at HTML and css but never really programmed, they could probably use your framework to build their first programming project if you made it a little more beginner-friendly

great work! :)

<comment><USER21> why don't you

use some punctuation and

not separate your thoughts out on different lines?

Not trying to be mean, this is just hard(er) to read!

<comment><USER20> Sorry - hadn't planned on making my comment that long but will definitely keep your feedback in mind next time I reply to a comment.

</comment></comment></comment><comment><USER22> I am really interested in this, and am going to give it a go on my next project. Its areas of responsibility are contained and well-defined, the syntax is nicely concise, and it really feels like plain old javascript, which gives me the comfort I can get under the hood if I need to, without massive conceptual/abstraction overload.

If I am iffy on anything, it would be the templating language, but I suppose a React-type HTML syntax could be optionally layered over top without interfering with anything else. And there is something secure about javascript-rendered HTML in that you are much less likely to have unclosed tag issues, etc.

But for me, having experimented with some of the slower performers like angular, performance is a huge draw, and I am willing to write my templates in js if that's what it takes to get it.

</comment><comment><USER23> Here are my thoughts, but you won't like them. Stop with the frameworks. Learn Javascript. Learn CSS. Learn HTML. You'll find pretty quickly that what you need are _libraries_ , not frameworks. Things like jQuery, underscore, etc...

<comment><USER24> That's similar to my viewpoint. Stop with all the frameworks - what new, powerful functionality will it provide your users that existing things can't do (ie JQuery, raw JS)?

<comment><USER25> the point of a framework is speedy development. less lines of code for results. the tradeoff is often bloat, which one should (ideally) refactor out later. Angular can get overwhelmingly slow if you're not careful with your code, but gosh dang, you sure can whip an app up pretty fast

<comment><USER26> For most apps, I've found that slowness is not a problem with Angular. You can do some nasty things though if you're not careful though, definitely agree with that. If you have flaws elsewhere in your codebase, including the backend, it may be possible that in practice, the effects may trickle down to your frontend code with Angular - it has happened in an app I've worked on with a couple of other developers, in which flaws with the api performance caused us to implement some subpar workarounds that triggered many $digests & forced us to spend a day or two on just optimization.

Angular can be quite fast compared to jQuery in an app of substance. It is not constantly reading/writing to the DOM in most cases, which saves a lot on the performance front. It is also a smaller library than jQuery, and you're not naively applying global or complicated selectors. Plugins rewritten to be pure javascript + Angular also can have a much smaller footprint & be more powerful to boot, such as the Angular UI Bootstrap project (5 KB minified & gzipped as opposed to 15-35 KB? I forget Bootstrap's js size) & contains all of the power of Angular to modify your functionality with them & more.

</comment></comment></comment></comment><comment><USER27> First impression after reading across the docs: Compact, fast, seems to contain most important things. I like it.

<comment><USER28> Unfortunately, they all start out this way it seems. Hopefully, this one will remain this way.

<comment><USER29> The way to keep it that way is to never add even 1 new feature and only fix bugs. That's not a bad idea actually; if you don't, it'll end up like _every_ other framework on earth. So it's a good niche to say 'this is it' and keep it exactly like that even though it 'lacks features'.

<comment><USER28> I like that idea. Keep the core frozen. With a good API, users can extend it to their liking, and complicate it all they want.

<comment><USER30> Sorta like Backbone... People definitely love adding plugins and definitely don't count it as a negative when comparing to other JS MVC frameworks......

</comment></comment></comment></comment></comment><comment><USER31> Looks very clean. Especially having just tried a read through the angular docs. Bleurgh. Take the advice of the others in this thread and avoid bloating this and maybe it will take off!

</comment><comment><USER32> Hi lhorie, I like this. I want to use this. How long will this supported is my concern. Or is this a fun side hobby you worked on and plan on moving on to the next with no future updates?

Cheers.

<comment><USER33> It's open source. You provide the support and updates.

</comment></comment><comment><USER34> I've been using the dform library [link] to create my DOM. I'm creating an input form used to query a database with PHP and generate a chart from the data using FusionCharts. I've been considering utilizing frameworks to help with form creation, manipulation, and query generation/execution/processing, but I've decided to stick with just these two libraries for the former and raw PHP for the latter. I also use PHP to enable/disable parts of my form via if's and file includes.

I really like dform's flexibility. I have been able to add every HTML elements that I've needed with the same syntax for every one, making it very simple to stick them into PHP loops to generate the elements based on the query results. I've learned a lot about writing jQuery functions while using it.

FusionCharts is very specific in what it does, and is compatible with many languages. I have actually learned to use it's classes in both PHP and JavaScript so that I can create any part of the chart I please in either language, and it is capable of transmitting data in both JSON and XML even though it uses XML internally. I've briefly taught myself the differences between the formats and have gone from manually creating XML, to learning that JSON is way better, to automatically converting my arrays into JSON data.

I feel that I've kept my project quite lean indeed, and was actually worried about not accomplishing a lot, not being complex enough. But I have intentionally been trying to avoid complexities so that I can make it easy to pick up and use, just include jquery, dform, and the FusionCharts.js/.php (and source code).

[link] [https://github.com/daffl/jquery.dform](https://github.com/daffl/jquery.dform)

</comment><comment><USER35> The templating language reminds me a little of what spacebars (htmljs) probably looks like if a nice mustache facade wasn't put in front of it. (which goes back to Gee's comment about react... but I guess anything these days that promotes a 'virtual dom' will probably be tarnished with that brush from first glance)

I love the simplicity and independent direction this micro-framework provides. It's very 'non-magical' which I think makes it far more appealing.

If you end up solving the HATEOAS/ember-data sideloading/'embedded foreign key data loading' problem I think this will be my goto library (though this probably falls out of the microframework requirements also ;)

</comment><comment><USER36> tiny, small, idiomatic javascript;

uses POJOs; has just enough 'binding'; uses routing and basic promise/A+ implementation.

I'd say this is good and as high level as one should go if they want to churn really good performance out of an app.

Keep it coming mate, and link with me on Twitter. I used a number of micro frameworks and my own glue to make my own mini-framework using much of the same concepts, only I used a templating engine called doT instead of declaring my HTML structure in JS (although I know it is easily possible to generate view code with a tool/script with HTML as input).

@matthiasak mkeas dot org

</comment><comment><USER37> Aside from templates, this is the same as [https://github.com/moot/riotjs](https://github.com/moot/riotjs)

<comment><USER38> I thought riot relied on jQuery and was basically decreed to be more marketing than substance. This seems to have a lot of substance.

</comment></comment><comment><USER39> I like the small, unmagical, well-defined API.

That strength is also a weakness though. Particularly because for coffeescript (or my favourite, the related LiveScript) it doesn't result in the super-cute syntax of e.g. TeaCup[1][2].

[1] [https://github.com/goodeggs/teacup](https://github.com/goodeggs/teacup)

[2] Markaby begat CoffeeKup begat CoffeeCup and DryKup which begat Teacup

</comment><comment><USER40> It's pretty, I like the rendering. A more complex example in the docs could probably be useful though, something like a bootstrap form.

</comment><comment><USER41> This actually fills a good niche, if i'm looking for a monolithic framework that trys to do a bunch of things, angular fits the bill. I like that this does one thing, and seems to do it exceedingly well (fast). I'm not in the market for a new framework right now, but the next time I am... i'd consider it, if it stays small and compact like it is today.

</comment><comment><USER42> I know react is not an MVC framework, but I think you should add it in for comparisons since it uses similar rendering concepts

<comment><USER43> The author comments on react here: [http://lhorie.github.io/mithril/comparison.html](http://lhorie.github.io/mithril/comparison.html)

</comment></comment><comment><USER44> Thanks for making this, this looks really really good!

I'm a backend guy beginning to venture into front-end stuff (recently picked up JS for a Node project at work), and the extensive documentation is incredibly helpful for newcomers like myself.

PS: I'd be very interested in some performance comparisons with Om and Vue.

</comment><comment><USER39> I think the m.prop getter/setter creation is a good compromise between the "magical" creation of properties employed by Vue and Ractive and the cumbersome use of SomeFramework.set("propertyname", value) employed by other MV* frameworks.

I can't think of a good argument against it.

</comment><comment><USER45> I like the license, I like the level and style of documentation, I like the lean scope, and I like the timing as I've just started looking into an MVC framework to learn. I was going to choose react over angular but now I'm going to choose this over either.

</comment><comment><USER22> I just came back to say that the documentation really is beyond excellent.

</comment><comment><USER46> Off-topic: how do you apply animation to your logo on activation of the browser tab? I loaded your page in a new tab, but the logo animation didn't fire until I viewed that specific tab.

<comment><USER2> The three rings are in a span. So it's content 'o' in span, the 'o' in :before and 'o' in :after.

Then he uses a -webkit-animation to translate the positions of each ring.

        @keyframes logo {
        	from {opacity:0;transform:scale(2) rotate(359deg);}
        	to {opacity:1;transform:scale(1) rotate(0deg);}
        }
        @-webkit-keyframes logo {
        	from {opacity:0;-webkit-transform:scale(2) rotate(359deg);}
        	to {opacity:1;-webkit-transform:scale(1) rotate(0deg);}
        }

<comment><USER47> But does that explain how it's not triggered until you click the tab?

<comment><USER48> This is browser specific to trigger animations on tab open

</comment></comment></comment></comment><comment><USER49> just a bit of a nitpick, but your getting started page uses the word "performant" [http://english.stackexchange.com/questions/38945/what-is- wro...](http://english.stackexchange.com/questions/38945/what-is-wrong-with- the-word-performant)

the debate around the word just leaves a bad taste in my mouth. after reading arguments from both sides I would tend to agree: until the word is a word, it just sounds like marketing buzzword garbage.

<comment><USER50> > ... until the word is a word, it just sounds like marketing buzzword > garbage.

Fair enough, but remember that a word becomes a word simply by usage, not by edict. The old Webster's rule was that, if a word appeared in ten recognized publications with a consistent meaning, it (the word and the definition) would be included in the next edition of the dictionary. I'm sure there's a similar rule in play today.

The fluid and pragmatic nature of words and their meanings can be gauged by noting that "literally" and "figuratively" now mean the same thing:

Link: [http://www.merriam- webster.com/dictionary/literally](http://www.merriam- webster.com/dictionary/literally)

Quote:

1 : in a literal sense or manner : actually <took the remark literally> <was literally insane>

2 : in effect : virtually <will literally turn the world upside down to combat cruelty or injustice — Norman Cousins>

</comment></comment><comment><USER51> This is very promising. I like the philosophies underpinning this framework, and once it is in a mature state, I could certainly see myself using it in a production environment.

</comment><comment><USER52> This is some pretty amazing code, actually. An MVC in 400 lines? Awesome. I could learn from this for days, lack of semicolons and one-line loops notwithstanding.

</comment><comment><USER53> So, how do I integrate existing JQuery plugins? In most real life scenarios there will be a few plugins which one would like to bring in.

</comment><comment><USER54> With that style of view, I suppose it's probably pretty easy to adapt Mithril to support server-side rendering.

</comment><comment><USER55> This is the kind of simplicity that brought me to Clojure for the past couple years.

</comment><comment><USER56> I would love to see a comparasion with knockoutjs/durandal too...

</comment><comment><USER57> Quite similar to React? Probably about the same performance?

<comment><USER58> I was actually wondering why this wouldn't just use React for the view. Then it could leverage all of the work going on with React (server-side rendering, possibly rendering from within a Web Worker, etc.)

<comment><USER59> Given the philosophy leo outlines, I'd guess he's going for something slimmer. This is 3k vs react's 29k. I am curious to know how it's achieving the same thing in so much less code, or rather, what react can do that mithril can't.

</comment></comment></comment><comment><USER60> I don't mean this in a bad way, but do we really need another Javascript framework? Wouldn't author's energy be more useful when contributing to one of the existing ones?

<comment><USER60> Not sure why I'm getting downvoted, it was a serious concern I expressed, with 0 intent of insulting anyone

<comment><USER13> You're getting downvoted because this guy thought it was an interesting problem to think about, sat down and put some effort in, came up with something he liked (and which appears to be very good) and wanted other people to see it, and your input was, "isn't this a waste of time? People have done this before!"

The fact that frameworks are appearing at a ridiculous rate is also the _reason_ people still feel compelled to make their own: the existing ones sometimes feel thrown together and flawed in obvious ways, so people automatically think about ways they could be better and try those things out. The result is progress (edit: sometimes the result is a bag of crap, but that's beside the point).

No, we don't need more frameworks. And yet that still isn't a good reason to stop building them, if for no other reason than to explore for yourself what goes into building one (if that's your interest).

</comment></comment></comment><comment><USER61> seems a lot like React. I haven't used it, but isn't it also built around the idea of Shadow Doms?

</comment><comment><USER62> new function(window){}(this) is kinda weird to me. Sorry that's nothing valuable to add to your code.

<comment><USER13> Correct me if I'm wrong, but what this does is: 1) allows the code to be run in an environment where 'window' is not the global object (perhaps for testing), and 2) in a browser, gives the caller the option to isolate the module code so it's not allowed to touch 'window'.

</comment></comment><comment><USER63> do you have a todomvc example :)

<comment><USER64> The guide is based off the building of a TODO app. [http://lhorie.github.io/mithril/getting- started.html](http://lhorie.github.io/mithril/getting-started.html)

</comment></comment><comment><USER65> nice and clean

</comment><comment><USER66> Why?</comment>


Ask HN: How would you build a Excel file uploader with inline preview? - <AUTHOR> I like the file uploader of Dataiku DSS[1] wich allows you to upload Excel/csv files and edit them in the previewer befor commoting them in the db. My question is this: is there any Js open-source library like that one with inline preview and editing of spreadsheets? If it doesn't exist, I would like to have an idea how I could build one with available tools.<p>[1]: https://www.dataiku.com/dss/editions/ <comment><USER2> Good question. To expose data processing/Modelling to the masses we need an easy interface for the average user to upload data and maybe do some basic editing online.

</comment><comment><USER3> Openrefine

<comment><AUTHOR> Openrefine is for data wrangling. I want js library like filepond [1].

[1]: [https://pqina.nl/filepond/](https://pqina.nl/filepond/)</comment></comment>


Do most HN readers enjoy their jobs? - <AUTHOR> I graduated in 2011, I currently work as a java developer for an investment bank, and I find myself spiralling into a work induced depression. Skills-wise I'm not progressing at the rate I would like; the hours are pretty long so I have minimal time for coding outside of work, no one on my team cares at all for best practices or improving their craft, technology is seen as a secondary concern, and any enjoyment I used to experience from coding is gradually diminishing.
I'm interested in hearing whether or not the majority of HN readers enjoy their job, and if anyone has been in a similar situation how did they go about rediscovering their passions?
I kind of feel like I have no right to complain and that this is a complete first world problem (I'm pretty comfortable financially, living in london which is a great city, working with fairly agreeable people etc etc) but I'm completely unfulfilled by the work I'm doing on daily basis - any advice at all would be very greatly appreciated!
So to sum up: 1) Is it normal to dislike your day job? 2) If not, do people have strategies for finding jobs which they are strongly passionate about? <comment><USER2> I have been working at a newspaper for the past 8 years (I'm 27). At first I loved my job, it was all new to me. I started off as a graphic artist building print ads for local businesses, I then moved departments to IT/WEB where I've been for the past 5 years. My job description has been butchered over and over due to people being laid off.

I now build web ads (banners), maintain 5 newspaper sites, provide tech support to 3 offices, book online ads, run Advertiser Reports, run page view reports, move furniture, work on door locks, etc...

I have grown to hate my job. No one in my office can program other than myself, which sucks. I have no one to bounce ideas off of, too busy for side projects. The pay is shit, the people are nice. The publisher is clueless and is not held accountable by our parent company, but then again the newspaper industry as a whole is clueless.

My skills have not improved much, but I've learned a little bit of everything. Some people take the phrase "Jack of all trades, master of none" as a compliment, I'm starting to take it as an insult. I am OK at a lot of stuff, but not great at anything.

I've tried getting out but my location does not help me much.

I would love to have job satisfaction and not have to worry about money so much.

Find a job that you love.

</comment><comment><USER3> Just to add my two cents :

\- If you like switching context, consider finding a small company. You'll have to do way more stuff and get out of your comfort zone more often.

\- I think it is normal to prefer side-projects than daily job. Simply because spending 60 hours a week on the same thing makes it less sexy (even though it can be really cool).

\- If your collegues don't care about good practise, then put them up by yourself. Force things to change. You'll become more experienced and will develop new skills (mostly human related though).

\- I never spend a day without thinking that I suck at my job. Use it as a strength, read books and code to get better.

This is 2013 : Change job if you think the grass is greener somewhere else ! Just keep good relations with your old collegues even though you didn't enjoy them :)

I graduated late 2010, if you want to have a chat about experience, feel free to PM :).

</comment><comment><USER4> Surely I don't have as much industry coding experience as many people around here, but during and for a while after my undergraduate education I worked a couple different programming positions - mostly web development.

What I saw was stark difference between the environments not from the type of work, but simply the people and the general attitude of the administration. One job was a very small web dev startup and it was a fantastic experience. I worked there for about two and half years, getting more solid in both server and client-side programming. Of course after the first six months, I hit the so-called intellectual wall, but I was lucky enough that I was allowed to work on internal R&D with one of the other programmers. That was probably where I had the most fun at that particular job.

Another job I had, though, was quite similar to what you describe. I was consulting for a company who had a couple of their own programmers who refused to learn anything, just coded like monkeys locked in a cage and the people in charge didn't care because they really couldn't tell the difference.

My suggestion would be that it's not typical to find poeple that dissatisfied in a place like this, where startup job postings are everywhere and we obviously have enough time and energy to keep up with all the posts :D

If you aren't terribly concerned about lots of cash, check out a university and find a startup or two. They are using fast-moving and energetic. Once they get the tech base going, they'll definitely bring in more and you can make sure to keep the vibe going, etc.

If changing jobs isn't possible, I'd say find some user a user group - I hear about a lot in London - and network with them. It can help just to have some facetime with others who share your passions.

Good Luck!

</comment><comment><USER5> Between high school and my early college days, I must have held at least three dozen jobs. Some lasted no more than a week or two (in one instance I think it was two days) and at most never more than six months. In hindsight I think I made a pretty shitty employee and was never satisfied. As such, I always ended up doing my own business and for roughly a decade now, haven't had to work for others (including stuff like never have done consulting work). I just can't seem to fit in but I chalk that up to my own fault for not being motivated to do better at finding the right fit early on. However things still worked out for the best.

</comment><comment><USER6> If it was fantastic fun, they wouldn't need to pay people to do it :-)

From 15+ years working in IT in Investment Banks, I would say that the culture and ethos varies greatly from team to team, even inside the same bank.

If you don't like the team you're in, try networking internally to see what other opportunities there are. Also, if you get the team to adopt some best practises, then you get something good to talk about at appraisal and bonus time.

</comment><comment><USER7> Working in the financial industry as a developer is terrible. The stars are the investors/bankers, not the developers. IT projects are all subject to federal control/regulation. Do you know why you hate your project managers? It's because they run projects in a way to make them accountable to federal audit. Know why you hate your ancient/odd systems? Any new technology must be proven to the feds to be safe for users.

Stay out of finance. Prefer working for software companies. They understand how to build software which will make you happy. Many on this site will push you toward startups. Personally, startups bring their own bag of problems. So do big comapnies, granted. At least at the large companies you (generally) get better pay and less working hours. Startups leave little room for personality differences (nowhere to run) or advancement. Regardless, the source of you pain is the finance/banking industry. Steer clear. In addition, a lot of people will be prejudiced against you with IT finance experience.

<comment><USER8> I've worked at a global investment bank in the past and have a somewhat different view. We had control over what language/tools to use per project (as much freedom as any startup) and it was definitely not subject to fed regulation. During my time there I was frequently contacted by recruiters from great tech firms such as google. Any company that knows how to recruit will look at what you've learned and what you've accomplished and not prejudice you simply for having worked at a financial firm.

If you feel you're not progressing as much skill-wise (which can happen at any job/industry), you can try to move to a different team within the company as many people do. The important thing is to keep learning so you can find things you are interested in.

</comment></comment><comment><USER9> Try contracting for awhile, do a few six or twelve month contracts. Get as much variation in type of work as you can find, to your taste.</comment>


Day 8 Rejection Therapy: Get Number One Spot in Best Buy's Thanksgiving Line - <AUTHOR> http://www.entresting.com/blog/2012/11/23/day-8-rejection-therapy-get-number-one-spot-in-best-buys-thanksgiving-line/

<comment><USER2> "The more willing you are to have awkward conversations and put yourself in awkward positions, the more successful you will be" is the one statement every single one of my entrepreneur friends or mentors have all agreed on. This seems like an exercise to put yourself in the MOST awkward position so much that it will cease to matter entirely. Brilliant. STICK WITH IT!

</comment><comment><USER3> Love what you're doing with the 100 Days of Rejection Therapy. Your blog is my home page until you've finished your quest!

</comment><comment><USER2> On the front page of Reddit I see....

</comment><comment><USER4> Would be more interesting to negotiate something possble, like asking to buy something at a premium from the #1 guy. This was asking people to hand over something valuable for no reason.

<comment><AUTHOR> I am constantly walking on a fine line between asking for something completely impossible (can I get your house for free?) and asking something too easy for a yes (can I give you $5?). The whole idea is that there is a 95% chance I get a no, so I can expect it and be genuinely surprised if I get a yes.</comment></comment>