TypeScript 2.3 - <AUTHOR> https://blogs.msdn.microsoft.com/typescript/2017/04/27/announcing-typescript-2-3/ <comment><USER2> Author of vetur[0] here, glad to see it getting featured :-)

Started this plugin last October to provide better editor support for Vue single file component, now vetur has support for embedded IntelliSense / error-checking / syntax-highlighting / emmet / snippet / linting / formatting. By embedded support I mean each feature is available for at least html/css/js, some features are also available for scss/less/ts/etc.

@sandersn from TS team has been really helpful in helping me integrating TS's Language Server to powers the advanced IntelliSense in vetur. As vue / vuex / vue-router now comes with type definitions, you get awesome auto completion such as [1] and [2].

Now that IntelliSense in js/ts sections is almost complete, vetur's next step is to use TS's Language Server to extract info from Vue SFC's script part to power IntelliSense in templates, such as prompting a list of `props` for `v-if`, and prompting a list of `methods` for `@click`.

Give it a try and let me know any bugs or features you want to see!

[0]: [https://github.com/octref/vetur](https://github.com/octref/vetur) [1]: [https://twitter.com/octref/status/854812632142024705](https://twitter.com/octref/status/854812632142024705) [2]: [https://twitter.com/octref/status/857350977581723648](https://twitter.com/octref/status/857350977581723648)

<comment><USER3> Vetur is awesome! Thanks octref for your continued work and support :)

The "feature" I'd like to see most is a "perfect setup" guide (or maybe auto- detecting-and-helping logic?) detailing what's required to get all the features working. Currently for example I don't get HTML/CSS formatting, even though it was featured in 0.6.0 changelog, but I have no idea why :-/ . Got this feeling a few times with vetur as well as other linters: things work, but maybe not 100%, and it can be opaque to dig deeper: is it due to vscode misconfiguration? vetur misconfiguration? missing tooling? I don't know.

EDIT: these TS-dependent auto-completions look fantastic. I'm planning to migrate my current Vue project to TS, but for now it's just JS. Do you have any recommendation for Vue2-with-TypeScript documentation? Or, even better, a JS-to-TS Vue2 migration guide?

<comment> crooked-v To go with this, I would be incredibly happy just to find a complete guide for Webpack + Babel + TS + Vue. The last time I tried I could never quite get anything put together all the way.

<comment><USER4> I used already configured template for such setup: [https://github.com/AbeHaruhiko/vue-webpack- typescript](https://github.com/AbeHaruhiko/vue-webpack-typescript)

</comment></comment></comment></comment><comment><USER5> TypeScript opening up plugin APIs is going to lead to a massive number of interesting project. I'm tracking a few of them that are done before 2.3 was out. Very interesting stuff:

* TypeScript CSS Modules plugin [1]. It allows you to type check CSS classes etc.

* TypeScript Vue plugin [2]. Type check .vue files. Competing with the one mentioned in the article

* TypeScript GraphQL plugin [3]. Type check GraphQL queries

I desperately need TypeScript React Hot Module Replacement Plugin. If someone is working on it please let me know!

[1] [https://github.com/HerringtonDarkholme/ts-css- plugin](https://github.com/HerringtonDarkholme/ts-css-plugin)

[2] [https://github.com/sandersn/vue-ts- plugin](https://github.com/sandersn/vue-ts-plugin)

[3] [https://github.com/Quramy/ts-graphql- plugin](https://github.com/Quramy/ts-graphql-plugin)

<comment><USER6> > I desperately need TypeScript React Hot Module Replacement Plugin

I worked on this for electron-compile but unfortunately React HMR itself (react-proxy) fails with actual classes (i.e. using the `class` keyword not- transpiled) or anything other than Babel's ES5 class keyword transpiler. Once they fix that, apps created via electron-forge or that use electron-compile will get TypeScript HMR automatically.

</comment></comment><comment><USER7> Since 2.1 ts is becoming a de-facto default choice for any serious JS projects I'd say. In conjunction with VSCode it really shines and makes JS sometimes even enjoyable...

But there is an issue that quirks our team almost daily: the bolted-on typesystem provides a false sense of safety. You can look at an API response, write an interface for the data structure, build functionality ontop of it, and when the API response structure changes in subtle ways over time, everything _may_ break without notice. There is no way to enforce an interface through casting anywhere, not even via some code generation or sth like that.

<comment><USER8> Use something like [https://github.com/lbovet/typson](https://github.com/lbovet/typson) to generate a JSON schema for your interfaces, then use a JSON schema validator before casting the API response to your interface.

I haven't touched TS since ~1.3, but this was all working well back then at least.

<comment><USER9> Typson hasn't been updated for a while, we use [https://github.com/YousefED/typescript-json- schema](https://github.com/YousefED/typescript-json-schema) which works with recent typescript coupled with [https://github.com/mafintosh/is-my-json- valid](https://github.com/mafintosh/is-my-json-valid)

</comment></comment></comment><comment><USER10> I'd love a pro con from someone who's really tried out both TypeScript and Flow. I tried to get either of them started last weekend and couldn't get to a good place. Flow was missing annotations for three.js and typescript didn't seem to support es6isms. I found a compiler for the typescript definitions file for threejs but also couldn't sort out how to actually import that into flow.

<comment><USER11> Ok, I've used TS while contributing to OSS written with TS and I've used Flow extensively in production settings.

The main takeaway for me is that TS is much much less sound than Flow. That means it checks less invariants which in turn makes you less trust it...

Consider the following code which is valid (!) in TS:

        let promisedString: Promise<string> = new Promise(
          resolve => {
            // Perfectly valid in TypeScript!
            resolve(42)
          }
        )

Another downside of TS is poor type inference. It requires to annotate each top level function while Flow only requires to annotate exported functions.

Even the following simple piece of code will make TS ask you to annotate doAddition function:

        export function addition(a: number, b: number) {
          return doAddition(a, b)
        }

        function doAddition(a, b) {
          return a + b
        }

I'm really glad Flow doesn't force me into it.

Edit: spelling

<comment><USER12> For your 1st example, it's failing because by explicitly annotating `promisedString` you are widening the type from the inferred `number` to `any`. If you remove the explicit annotation and let TS do its job, the code will fail (as expected) :).

For your second example - it's a divisive issue. I believe that a Hindley- Milner style type resolver (what Flow uses) is more usable, but there is a strong argument against it too [0].

[0] [https://github.com/Microsoft/TypeScript/issues/15114](https://github.com/Microsoft/TypeScript/issues/15114)

<comment><USER11> > by explicitly annotating `promisedString` you are widening the type from the > inferred `number` to `any`

That's something I don't understand. Isn't that incorrect behaviour? Shouldn't TS try unify RHS and LHS?

<comment><USER13> TS is trying to unify RHS and LHS. TS follows a somewhat complicated widening process to unify unannotated generics, somewhat leaning towards ease of use over strictness. Adding additional strictness checks like noImplicitAny can help catch these situation. (In this case, it doesn't help, because the resolve argument is inferred `resolve: (value: any) => void` rather than `resolve: any` which would give a clear implicit any error. Inferred any in generic callbacks sound like a good strictness test to add...)

In this case in Typescript it is generally more strict to add a type annotation to the generic than the LHS:

      let promise = new Promise<string>((resolve) => resolve(42)) // This won't work

This is as much because the inference here that matters isn't between LHS and RHS but between generic arguments and function return inference.

</comment></comment></comment></comment></comment><comment><USER14> Highlights / tl;dr:

\- ability to check .js files

\- default type parameters (eg; `class Component<Props, State = object> {}`)

\- generators/iterators (including async-generators, a stage 3 proposal).

\- `--strict` flag to easily give you --strictNullChecks, --noImplicitAny, --noImplicitThis, and --alwaysStrict

\- language server plugins are official (the Angular and Vue ones were promoted in particular)

<comment><USER15> I wish TS would consider the annotation-in-comments form from flow: [https://flow.org/blog/2015/02/20/Flow- Comments/](https://flow.org/blog/2015/02/20/Flow-Comments/)

For switching a large existing JS codebase, it's easy to add flow comments without changing the final minified builds, allowing you to reap the full benefits of the type check.

<comment><USER16> TypeScript allows for JSDoc Comments for types in .js files with `--allowJs`. you do not need to change your code for that.

See [https://github.com/Microsoft/TypeScript/wiki/JSDoc- support-i...](https://github.com/Microsoft/TypeScript/wiki/JSDoc-support-in- JavaScript)

<comment><USER17> Thank you! I've been trying to figure out how to get JSDoc-ed code to get appropriately typed in Visual Studio Code with Typescript files as well.

</comment></comment></comment></comment><comment><USER18> Now that typescript can compile generators down to ES5 and ES3, you could reasonably replace Babel by tsc entirely, right? I mean, with its --allowJs flag it's really just a javascript transpiler. Async/await, generators, JSX, array/object spread, destructuring.. it's all in there.

Did anyone try this? We're doing a hybrid babel/ts app and it wouldn't hurt ditching one of the two tools.

<comment><USER19> You still need to provide some polyfills

<comment><USER13> That might be a great idea for a plugin: add warnings/errors and automatic code fixes to import core-js (or similar) polyfills based on code usage.

</comment></comment></comment><comment><USER20> My personal Gem in this release: Generic parameter defaults. [0] This makes altering a generic interface or a generic type alias in a non-breaking way much easier which is very powerfull in a large code base.

[0]: [https://github.com/Microsoft/TypeScript/wiki/What's-new- in-T...](https://github.com/Microsoft/TypeScript/wiki/What's-new-in- TypeScript#generic-parameter-defaults)

</comment><comment><USER21> This is fantastic!

Allowing type checking on js files with comments will allow me to start improving our exciting hard to maintain large code base. I attempted to do this with flow as well before, and it did the job well enough (although at the beginning I ran into a number of issues), but I have a preference for TypeScript, and the next time I work on that project I will likely be doing heavy usage of this.

<comment><USER22> With VSCode 1.12 (aka the current insiders build) you can also enable JavaScript type checking without creating a jsconfig.json or even changing your source code by setting "javascript.implicitProjectConfig.checkJs":true in your workspace or user settings. This setting applies to any JavaScript file that is not part of a jsconfig or tsconfig project. Besides catching errors, checkJs also enables a number of quick fixes in JavaScript files.

Please let us know if you see any errors while trying out new TypeScript 2.3 features in VSCode or have any thoughts on how our JS/TS support could be improved: [https://github.com/Microsoft/vscode/issues/new](https://github.com/Microsoft/vscode/issues/new)

</comment></comment><comment><USER23> The language service API is huge! One of the main reasons I even bothered to learn React was because TypeScript supported type checking JSX.

Back when I picked up TS, I was using Handlebars for templating. The templates were the only part of the code that didn't type check which was really annoying when doing something like "Refactor all references". I tried to write my own templating[0] and realized I was basically reinventing JSX, so I wrote a react boilerplate[1].

The language service is going to make Vue, Angular, Svelt, and any other template syntax way more attractive.

[0]: [https://github.com/styfle/typed-tmpl](https://github.com/styfle/typed- tmpl)

[1]: [https://github.com/styfle/react-server-example- tsx](https://github.com/styfle/react-server-example-tsx)

</comment><comment><USER24> The GraphQL plugin[1] looks great. I was eagerly waiting for Flow's tooling to catch up because of their GraphQL support, but I guess TypeScript is running laps :)

[1] [https://github.com/Quramy/ts-graphql- plugin](https://github.com/Quramy/ts-graphql-plugin)

</comment><comment><USER25> I hope TS adds native Swift-style optional values and chaining, where it fails at compile time if you try to access an optional without unwrapping it first. Conversely non-optional values _cannot_ be null!

There are projects that add optional functionality ([https://www.npmjs.com/package/ts-optional](https://www.npmjs.com/package/ts- optional)), but I don't see how it prevents you from setting regular values to null.

<comment><USER26> What do you mean by "Swift-style"? TypeScript allows you to declare optional values on an object:

interface Test{

number? myOptionalNumber;

}

Is that what you mean?

<comment><USER25> It is. I guess then you have to use the --strictNullChecks compiler flag to get the rest of the benefits

</comment></comment></comment><comment><USER27> Not sure if this "type checking with comments" is a good thing or not. On one hand it might convert some hesitant users, on the other hand it will cause some code bases to stay like half assed js-with-comment-annotations forever instead of being converted to proper typescript once and for all.

It will also require extreme discipline, like a CI build machine checking each commit, because the comments allow clueless people to edit the code like plain JS and not get any compilation errors, later when the next person comes and edits it with a typescript compiler they will get a broken build. If everybody works under the same circumstances, i.e always typescript, this is less likely to happen

</comment><comment><USER28> I wonder if the plugin system will evolve into an AST-transform ecosystem like Babel's.

<comment><USER29> I hope not. Didn't we already learn this lesson from macros? Having code that appears to do one thing but actually does something very different is a maintenance nightmare. Once the people who decided to add that AST transform plugin are gone and new people take over that don't know about it, the trouble really starts.

Again, we've seen this in languages with macros. At least with macros it's part of main codebase; you usually have to include them in some way. With these AST transform systems the secret is tucked away in a build script somewhere.

<comment><USER30> I've had poor experiences with PostCSS w/ regards to AST transforms. The different plugins tend to not interact with each other at all because they're just transforms. Feels worse than something that works together all around like scss.

</comment></comment></comment><comment><USER31> for all the problems I have with Microsoft and some of their other products, I really have to say that the typescript and vscode teams are doing a phenomenal job. Every release is a vast improvement over an already great set of tools. don't think I've been as excited to see new release announcements since the early days of Firefox.

</comment><comment><USER32> Was @ts-check just added in this version? I assume so, but if not -- is it possible to use TypeScript and just @ts-check and get basically the full type- checking power (assuming the items to be checked follow the standard lib)?

<comment><USER16> you could. jsut add `@ts-check` in your .js file, open it in VSCode, or pass it to the `tsc --allowjs a.js` on the commandline.

</comment></comment><comment><USER33> >Previously, TypeScript didn't support compiling generators or working with iterators.

I had no idea. That seems like a big deal, no?

<comment><USER34> It didn't support transpiling generators to es5. Compiling to es6 would work and you could add babel to transpile down to es5 so in practice this wasn't much of a problem.

Async iterators are very exciting and builds should be faster without babel in the pipeline.

</comment></comment><comment><USER35> I just upgraded our version to TS 2.3, removed Babel (which we were using for generator support), and it cut our build time in half.

</comment><comment><USER36> Anders and team are like programmer whisperers. Every design decision has been a productivity boon.

<comment><USER37> Well they listen to their users and community. Their PMs do a fantastic job at outreach, listening and prototyping things that would make life easier for developers.

</comment></comment><comment><USER38> If only the Flow team was half as active as TS. Is there even any reason to use Flow long term or are they eventually going to tell their users to either switch to TS or that ML thing of theirs?

</comment><comment><USER37> The checkJS option is awesome. I believe a ton of opensource JS projects on the web can benefit from this. Unlike flow which is written in a different language and has little tooling, typescript can now just act as a type checker, with vscode offer great intellisense and generally play very well with existing build tools.

This is just fucking awesome. I see Types as a way of documenting your code for the other team members who will use your API.

</comment><comment><USER39> added type checking for JS files // @ts-check in similar fashion to //@flow Trying to eat up market share from Flow

<comment><USER40> It's a good thing, competition is a fuel of innovation :)

<comment><USER39> Yes, especially between two large corporations. If Flow was created entirely by open-source enthusiasts I would be worried for the project. Since it's FB vs MS, well let them bring the best of their minds.

</comment></comment></comment><comment><USER41> TypeScript, a higher level version of something that is super high level in the first place. So it's converting from one scripting language to another, not straight down to byte code. So you are developing a sitcom for the Northern American market, but decide to write it in Mexican Spanish, to be translated to American English. Great! It has the same issues as ORMs. Javascript isn't that hard. As for ORMs - How many database changes are you planing on doing? ORMs seam nice for simple stuff, but still ended up slowing stuff down just on the simple stuff (See translating to Mexican Spanish to American English). Start doing complex stuff like joins and join with extra information, then it's just that much overhead.

If you can't do JavaScript, find someone that can. Can't do query in which ever database, find someone skilled in said database. Can't do CSS... Can't do HTML, GTFO of the business.

<comment><USER42> TypeScript isn't higher level than JavaScript. It _is_ JavaScript, just with a lightweight type system. It doesn't make things "easier" than JS, it makes the process of building large JS apps less error-prone.

</comment></comment><comment><USER43> I'm curious, what frameworks are people using TypeScript with? Is it mostly Angular or are people using it with others also?

<comment><USER13> I've been using Typescript for a while and have used a lot of frameworks for it, and some lack of frameworks (one of my earliest Typescript projects was a large conversion of an enterprise JS code base consisting of a mixture of JQuery 1.x, Backbone, and Knockout code). These days I've got one big project in Aurelia (which I'm not entirely thrilled with sometimes) and another in Cycle.js (which is quite cool and I'm using TSX there even).

</comment></comment><comment><USER44> Would the plugin system allow for things like conditional compilation or closure-like optimizations?

<comment><USER45> No, to my knowledge the plugin system won't allow extending the compiler's knowledge of _new_ symbols inside a source file

</comment></comment><comment><USER46> I've been using Dart for a few months. What advantages does TypeScript have?

</comment><comment><USER47> I know MS has really changed lately and even I have taken to using their Visual Studio Code editor instead of vim. But it's kinda funny that the first link I click in this blog post is 404. :) Classic MS.</comment>


Ask HN: What's your favorite mental model / framework for self development? - <AUTHOR> <comment><USER2> Gardening.

As an engineer I like to imagine I can build and the structure stays up like a stone arch.

But a person and even a habit is not stone or silicon but _living_. So what does it even mean to "work on" something which is living?

Gardening

You absolutely _can_ build terraces and trellises. And self-help books can give you great seeds and saplings.

Yet there will always be watering and weeding to be done.

If you want your life to bear the fruit of __your __choice, it is up to you to rise __every ____morning __and tend to your garden.

<comment><USER2> There are a few places you can take this metaphor.

1\. You probably do not want to plant cotton[1] year-after-year. Know the things which sustain your soil and put in the effort to nurture them as well.

2\. Be careful of trying to regularize[2] your life too much.

[1] [https://www.vox.com/2015/7/13/8948477/george-washington- carv...](https://www.vox.com/2015/7/13/8948477/george-washington-carver) (But also be wary of letting woo keep you from doing what you need. Getting actual medication for my ADHD has been life-changing.)

[2] [https://slatestarcodex.com/2017/03/16/book-review-seeing- lik...](https://slatestarcodex.com/2017/03/16/book-review-seeing-like-a- state/)

<comment><USER3> Side Note on [2]: "slatestarcodex for now is deleted due to privacy issues with NYT and Scott...

</comment></comment></comment><comment><USER4> Compounding of continuous improvement in daily life, similar to compounding of an equity portfolio. In other words, focusing on "Aggregation of Marginal Gains" in all aspects of life [1]. [1] [https://jamesclear.com/marginal- gains](https://jamesclear.com/marginal-gains)

</comment><comment><USER5> Your natural actions are based off your identity. Your identity is based off your actions and your environment.

The most effective way to change your motivation level is to change your identity. Forcing yourself to be motivated drains your willpower and is ineffective - it's sort of like a CEO yelling at sales to sell more. The most efficient motivation programs succeed by getting you to change who you are by the end of the session. Faking it before you make it is a good way to do so, because your identity is shaped by your actions.

For example, instead of motivating yourself to exercise, you adopt the identity of an attractive person. If your body goes out of shape, your mind takes action to fix it. Instead of scheduling time for gym, you just sneak time off to go there and schedule time for other things.

</comment><comment><USER6> The reflected best self is a cool model that argues you should focus on strengthening the areas you already excel in and really leaning in on where you are at your best.

[https://hbr.org/2005/01/how-to-play-to-your- strengths](https://hbr.org/2005/01/how-to-play-to-your-strengths)

It kind of plays into other ideas / books like Cal Newport's book "So Good They Can't Ignore You" that pushes the idea of really specializing and developing skills that are a reflection of your unique talents / perspectives.

</comment><comment><USER7> Don't accept it when other people tell you that you can't do something because it's too difficult (in their opionion) or they think you're not smart enough. Sometimes people are right but often they are not, so don't get discouraged by negative feedback, keep trying.

That said, also stay humble, know your own limits and try to get a realistic view of yourself, including your flaws and limits. Then start working on them and don't get discouraged.

<comment><USER2> Also, don't blindly accept it when people tell you that you _can_ do something but "you're just overthinking things".

They might not know that you are confused about something and need clarity to succeed.

Only you can read your own mind. Telling others can you see can make it more legible.

</comment></comment><comment><USER8> There are five sources that have changed my life in the past several years:

1\. Stoicism.

2\. Atomic Habits, by James Clear.

3\. One Small Step Can Change Your Life, by Rovert Maurer

4\. How to Fail and Still Win Big, by Scott Adams (don't like the guy, but agree with this book)

5\. Rewire Your Anxious Brain, by Pittman and Karle

I can't recommend these highly enough. They've literally help me remake my life.

</comment><comment><USER9> "Love obscurity and contempt" \-- Fenelon

<comment><USER10> In that sense,

 _" the heart breaks and breaks and lives by breaking. It is necessary to go through dark and deeper dark and not to turn."_ \- Stanley Kunitz</comment></comment>


Any anecdotes about programmers? - <AUTHOR> Like this one:<p>A CS student shows his lab assignment to the professor. The code works and even produces the correct output, but the professor mutters that the code is not OK: -- You have to choose variable names wisely. Names like i, j, foo and bar make your code unreadable. By next time, please use long, mnemonic variable names. A few weeks later, the same student completes a new assignment and brings it to the professor. This time, his code is full of long_mnemonic_variable_i, long_mnemonic_variable_j, long_mneminic_variable_foo and long_mnemonic_variable_bar. <comment><USER2> I've always gotten enjoyment (and solace) from _The Codeless Code_ :

[http://thecodelesscode.com/case/1](http://thecodelesscode.com/case/1)

</comment><comment><USER3> [http://www.catb.org/jargon/html/koans.html](http://www.catb.org/jargon/html/koans.html)</comment>


Evergreen Skills and Knowledge – What's Worth Learning? - <AUTHOR> https://universeofmemory.com/evergreen-skills-knowledge-worth-learning/ <comment><USER2> I just happened to think about that since the start of this year. I would consider evergreen skills that are not industry-specific and are always relevant wherever we go. Two things immediately came to me for me: Sales & Content Creation. You always need to sell, it could be services and product, or it could just be selling an idea. I wrote an article about sales and how to do insight selling. Hope that it would be helpful for you (:

[https://blog.phuaxueyong.com/post/2020-03-24-how-to- improve-...](https://blog.phuaxueyong.com/post/2020-03-24-how-to-improve-as-a- sales-rep)</comment>


Survey thousands of SF Bay Area techies found 2 of 3 would leave if could WFH - <AUTHOR> https://www.businessinsider.com/two-thirds-tech-workers-leaving-sf-bay-area-wfh-blind-2020-5 <comment><USER2> I'm skeptical of the results here - given that the data is pulled from Blind, an app that has an inherent negative spin and is primarily populated by dissatisfied consumers. Detractors are louder than advocates.

</comment><comment><AUTHOR> [https://outline.com/uEn3b9](https://outline.com/uEn3b9)</comment>


Zidisha (YC W14) reduces interest rates for P2P lending to developing countries - <AUTHOR> http://p2p-microlending-blog.zidisha.org/2014/04/09/interest-rates-for-lenders-now-capped-at-5-flat-10-apr/ <comment><USER2> How does Zidisha handle compliance with SEC regulations around issuing securities? I know that both LendingClub and Prosper had to go through a lengthy process to offer their notes with proper documentation and disclosures.

<comment><AUTHOR> Hi elecengin,

Zidisha is registered as a 501(c)(3) nonprofit only, and does not have a securities license. For this reason, our terms of use do not offer lenders any guarantee they will be able to withdraw repaid loan funds. Legally, Zidisha lending accounts are not financial assets, and any payouts to lenders are treated as voluntary promotional payments offered at Zidisha's sole discretion. That is one more reason we try to keep the emphasis on philanthropic impact, rather than the financial aspect of the loans.

<comment><USER3> If the SEC ever decides to shut you guys down for operating without a securities license, would lenders lose their ability to withdraw their own money (i.e. to make one of those "voluntary promotional payments offered at Zidisha's sole discretion")?

<comment><AUTHOR> According to our attorney, they would not.

</comment></comment></comment></comment><comment><USER4> > We believe the reason is that, while allowing higher interest improved the > financial attraction of lending with Zidisha, it simultaneously weakened its > humanitarian appeal.

As someone who donates money to 501(c)3s that are focused on the developing world and who also dabbles in P2P lending, I see a disconnect. There's nothing magical about a 10% APR figure. Maybe it feels better to some folks, but for me personally at least, if I'm looking for "humanitarian appeal", I would far prefer to donate money than lend.

The blog states "higher interest rates do not seem to have resulted in higher levels of loan funding overall." This is an interesting statement. It could mean one of two things: Zidisha lenders are not actually interested in lending and are going to allocate capital regardless of risk, or the higher interest rates aren't high enough to attract capital to the theoretically riskiest borrowers. Without more data answering the question "Why?", it's premature to use this as justification for capping interest rates.

<comment><AUTHOR> Hi 7Figures2Commas,

It is true that the conclusion that higher interest has not led to more lending is not based on rigorous data. It is rather based on the general observation that during the past year or so, loan funding volume has not noticeably increased at times when the highest interest rates offered at Zidisha increased.

The generalization that Zidisha lenders are not primarily attracted by financial returns is likewise not based on data, but rather a subjective assessment resulting from many years of survey responses, comments posted on our website and conversations with lenders.

(An important caveat is that many of our lenders do care about preserving the value of their lending funds over time, and often try to lend at interest rates that they believe will help them achieve this goal. But this is a very different motivation than profit maximization.)

I agree with you that offering dramatically higher interest may well attract more capital, from lenders who are motivated by profit rather than philanthropy. This would not necessarily be a bad thing, but it is not our mission or core area of expertise.

It will be interesting to see if a profit-based variation of Zidisha emerges, and whether it ultimately has a greater impact on the opportunities available to entrepreneurs in developing countries than our philanthropic platform.

<comment><USER4> Thanks for the thoughtful response.

Regarding your comment that "It will be interesting to see if a profit-based variation of Zidisha emerges...": it seems to me that you have a positioning dilemma. The minute you invite someone to lend for interest, you are profit- based. The fact that you cap interest rates, perhaps requiring that lenders charge far less than risk would otherwise indicate, doesn't change this.

If your lenders aren't motivated at all by profit, don't care to allocate capital in a manner closely aligned to risk, and you don't see yourself as being profit-based, why not simply allow me to donate money to specific individuals? Being able to target small donations to a specific person for a specific has a lot of appeal. In fact, there are certain charities I'm familiar with that I know frequently get requests from donors who want to be able to trace their donations. Unfortunately, tracking individual donations to individual recipients is something that a lot of major charities cannot do efficiently at their scale. It would simply cost too much.

Obviously, the lending aspect of your platform allows me to redeploy my capital, something I wouldn't be able to do if I was simply making a donation, but as with any other P2P lending platform, my interest earned is taxable income so contributing through Zidisha is far less tax-efficient than donating to a 501(c)3.

Here's an idea which may or may not be feasible legally/logistically: I donate $50 to Zidisha, which Zidisha loans to a borrower of my choosing. When that person pays back the loan _to Zidisha_ , Zidisha allows me to direct the lending of $50 plus the interest Zidisha earned to another borrower. And so on.

<comment><AUTHOR> That is an interesting variation on our current model: allow lenders to direct loans to specific entrepreneurs, but disable withdrawals such that the funds transfers can be classified as tax-deductible donations.

We had a discussion of this idea in the Zidisha member forum some time ago, and most participants indicated they would lend less if they did not have the option of receiving their funds back.

A greater concern is that turning the loans into donations, even though the individual borrowers are expected to repay them, could change the nature of the relationship between lenders and borrowers from one of mutually beneficial partnership, to that of patron and dependent. I don't think this development would be good for borrowers or lenders.

Our current position is, as you say, somewhere between the extremes of for- profit lending and outright donations. Some would call this subsidized provision of capital or "impact investing." As a pioneer in this space, we are still adjusting our positioning as we learn with experience what works best.

</comment></comment></comment></comment><comment><USER5> There is no link to your homepage on your blog, both the logo and the "Home" link only go through your blog!

<comment><AUTHOR> Hi aw3c2, thank you for pointing that out. Our standard Wordpress account does not seem to have an option to change those links, and we've focused our web development resources so far on improving our main website rather than our blog. As a temporary measure, I've added links to our website to the blog post itself.

<comment><USER5> No problem! As a workaround you could probably add a text widget to the sidebar with the link.

<comment><AUTHOR> We'll look into that. Thanks again!

</comment></comment></comment></comment><comment><USER6> Thumbs up for clarity. There's some inherent complexity to having different rates borrows pay vs what lenders receive, but having interest broken up by both flat rate and APR and posting the registration fee in the same place makes it easier to understand.

<comment><AUTHOR> Thanks devinmontgomery. One of our greatest challenges has been striking the right balance between making detailed information available to those who seek it, and keeping our website presentation simple and easy to understand for newcomers.

Thus far, we've opted to display only one kind of interest rate (the simple flat rate upon which our website calculations are based), along with a modal box note that the equivalent APR is roughly twice this, and a prominent display of the actual dollar costs to the borrower.

</comment></comment><comment><USER7> Congratulations. Once I have a charity donation budget again I know where I'll be contributing (along with Watsi...)

<comment><AUTHOR> Thank you! Watsi was the first nonprofit at Y Combinator, and the way they have combined the best of Silicon Valley technology expertise with a charitable mission is an inspiration for all of us. Its founder, Chase, has also been incredibly generous in offering advice and help to the other YC nonprofits.

</comment></comment><comment><AUTHOR> I'm Julia, the founder of Zidisha. I'd be happy to respond to questions and comments here.</comment>


From 0 to 100k users in 72 hours: the full story behind Breakup Notifier - <AUTHOR> http://dlo.me/breakup-notifier/ <comment><USER2> Hey, thanks for the shout-out and glad I could help in some small way. Sorry about spelling your name wrong :)

It seriously doesn't matter what you do, the moment you step off the well-worn path the haters will come out in full force.

Back in 2005, I had just gotten out of the Navy and I used to be a regular on a fairly popular forum. After seeing one of those dogtag impact printers in the mall, I did some research and realized they could do photo-quality engravings on then-current iPod Nanos. Since graduation time was coming up, I had an idea to sell personalized Nanos online (this was before Apple did free engraving, and before stick-on skins hit the market).

I ordered an impact printer on eBay for about $900 and did some test runs, which turned out great on Zippo lighters and the sample dogtags, but would always screw up on the iPod Nanos (I did mine and borrowed a few from some nice friends). I realized that the machine had a bent shaft and tried to get it repaired, to no avail. A new machine would cost around $2500, and the window of opportunity for graduation was already closing, so I decided to abandon the project and get back to software consulting.

Naturally, I posted about the whole venture on the forum, and oh man did they go nuts. It was like a shark feeding frenzy. At first, I got kind of mad that they didn't understand that I felt $900 was an acceptable risk to try out this idea, and that they were trying to troll me because they thought that I was beating myself up over it. In fact, the opposite was true, I was super glad that I tried it. I was just going to spend that money on a massage chair, anyway. I did end up getting a massage chair later, which they also trolled me about because it had speakers and an iPod dock (this was before Apple products were cool). :)

Eventually, I realized that they would NEVER understand the idea of trying out ideas until something sticks, and I realized that the forum was not only a time-waster but also an unhealthy environment. I stopped posting there pretty shortly after that (partially because they started e-stalking and IRL harassing someone else and I realized I was about one step away from that happening to me), but I still go back once in a great while to see what's going on, just out of curiosity, and it's pretty funny because they still talk about it. I guess fame and fortune have gotta start somewhere. :)

<comment><USER3> Thanks for sharing your experience.

Surprisingly, perhaps, this is the first post that actually made me consider entrepreneurship. You indicated succinctly what positive and negative forces to expect -- and how to reality-check an idea (people freaking out over it ;-))

<comment><USER2> Being an entrepreneur is like periodically being dragged through Hell and loving it. :)

</comment></comment></comment><comment><USER4> Why do Facebook app developers tolerate so much abuse from Facebook? This app to me seems like a perfectly well behaved Facebook app that is within the social spirit of Facebook, and during its moment in the spotlight a Facebook bot kills the app and the author's personal account, no warning, no explanation. From a business perspective I would discount Facebook as an unstable and unsupported platform simply because any app within can get pulled any time without warning or explanation.

<comment><USER5> > Why do Facebook app developers tolerate so much abuse from Facebook?

500 million registered users.

</comment></comment><comment><USER6> Thanks for the shoutout, Daniel! Also, Stammy and I were watching Leno live when he mentioned Breakup Notifier in his monologue... it was St. Patty's Day, and I had about nine black-and-tans in me, so I went a little nuts on your behalf :)

</comment><comment><USER7> You did not tell, was ur app ban revoked? How's it going now? Great post, totally inspirational and yes, take constructive criticism and forget the ones out there to destroy anything good being done. As long as you think it's the right thing to do, it is the right thing to do.

One of the most exciting and genuine posts I've read in a long time.

<comment><AUTHOR> Thanks!

Good question, and yes, the ban was lifted.

Facebook had no issue with the actual idea--it was just the negative feedback from users on the stream stories that lead to it being banned to begin with. Problem was that Facebook didn't give me a straight answer on what I did wrong until about 5 days after I was banned, which killed any momentum I had going for me.

<comment><USER8> I'd also love a follow-up post about how Breakup Notifier and Crush Notifier are doing nowadays.

By the way, thanks a lot for the post, it was a great read. And I'll just join all the others and say: don't let the TC commenters get you down. You did something amazing.

</comment></comment></comment><comment><USER9> Nice job. It could be said that there is and always will be a huge market for Stalking apps. I remember the days of icq/msn where there were apps that shows the who was invisible, who blocked you etc... With the proliferation of API's, social and open web, there will be interesting mashups or even privacy leakages. Something like "find 15km radiuous(4sq) where status is not relationship lookup(facebook) last.fm account whom listens Jazz and employed(linkedin)". Who needs dating services where all information is available?

<comment><USER10> SQL-style queries of any social network? Where do I sign up?

<comment><USER11> Facebook has FQL and Yahoo has a YQL console that's wired up to lots of different sources: <http://developer.yahoo.com/yql/console/>

<comment><USER10> Yeah, I've diddled around with it and it's great. Would love to see it hooked up into more services though.

</comment></comment></comment></comment><comment><USER12> I read about your blog.You're something that I would want to be like.Get in and create stuff just like that.I read about the comments surrounding your TC post.Don't bother about others mate.It's not about who innovates,it's who listens first and you did a great job with your apps.BTW I don't mean to say u didn't do innovation, just the whole steal/theif concept is bullcrap.I haven't used your product as I'm not on Facebook, so why not give it a thought about making it for people who cannot login through Facebook.

<comment><USER2> It might be pretty tricky to implement for non-Facebook users, since you wouldn't be able to choose people from your friends list and the people would also have to set their relationship status to Public.

<comment><USER12> Yes totally agree with that but what if I can tell you the link of the person on Facebook.I know this is going to be difficult to implement but it would be awesome to have it

</comment></comment></comment><comment><USER13> In addition to the technical details, I'd like to know what sort of impact BN has had, particularly how things are going now. Have you been able to capitalize on BN's popularity? Is it still popular now that it's been reinstated?

Anyways, great writeup; I'm looking forward to your future posts.

<comment><USER14> I believe capitalization should follow the path of relationship automation: onBreakup(): sendFlowers(x);

You could partner with a local flower/chocolate shop and have it taken care of. Another idea is to pay for sms delivery of breakup, sort of a premium advantage.

<comment><USER15> Wouldn't that just make you seem like an uber creeper?

How would you know if the breakup was clean or messy or who initiated it? You could seriously damage your shot at the rebound by sending flowers and chocolate to a girl who's world just fell apart.

I suspect that the monetization of this will more likely be in the form of 1) a future project where the experience is applied, 2) an opportunity resulting from the reputation, or 3) advertising.

It might not be a bad idea though to add some sort of "What to do now" plan and incorporate the flowers/chocolates as options.

</comment></comment></comment><comment><USER16> I spent a whole 8 hours this weekend playing with the Facebook Graph API for iPhone. Half of that was with no progress. The documentation sucks. The forums are barren. I've read post after post about breaking changes. What am I getting myself into.

I've spent over 5 hours trying to access my friends relationship status and cant get it to work. If anyone can help I would really appreciate it. Here is a Stackoverflow question I made: [http://stackoverflow.com/questions/5373077/access-friends- fu...](http://stackoverflow.com/questions/5373077/access-friends-full-user- object-on-facebook-graph-api-for-iphone)

</comment><comment><USER17> Great share. Really interesting to see how an idea went from a simple question to someone to a viral web-app in no time at all.

Out of curiosity, how are the stats on Crush notifier holding up?

</comment><comment><USER18> Thanks for writing this up, it's interesting to see how this came to fruition.

I also can't believe all the shit in the TC comments. People really have nothing better to do with their time than rain on someone else parade, I guess.

</comment><comment><USER19> Indeed you have to have a thick skin. Whether your making a brand new idea on the net or gained success at executing an idea others have worked on people are going to be hateful.

Im glad TC implemented the Facebook commenting system, but as Ive noticed some trolls are just creating fake accounts to spew their BS. Though it does seem a lot less then before.

<comment><USER20> I'm glad TC moved away from Discus and moved to the facebook commenting system. I won't ever comment there again. I was wasting far too much time on TC comments.

</comment></comment><comment><USER21> Nice post man!! Waitng for the tech details..

</comment><comment><USER22> Great write-up, thanks for sharing Dan. Reading about your experience reminds me of threewords.me a while back, how it just blew up and spread virally through HN and the rest of the startup ecosystem. It's one of the great things about light-weight Facebook apps I guess, they naturally have mass appeal.

The Breakup Notifier also inspired me to whip something up to find out whenever someone removes you as a friend. It's my first Facebook app and I just wanted to get my feet w/ the API: <http://friendsnomore.net>

</comment><comment><USER23> Really nice post, I felt like I was re-living the week as you wrote

</comment><comment><USER24> Seems like people would be interested in knowing how many potential suitors were watching their status and waiting for them to become available. You can envision this as the new status symbol. Instead of how many friends you have, it would be how many people are on your notifier list. In fact, some of those people being followed might jump ship earlier knowing that there are plenty of others waiting in the wings.

</comment><comment><USER25> This is what HN is all about. Looking forward to more...

</comment><comment><USER26> Dan, I just read the techcrunch article about the Crush Notifier site. I hope you realize that all of the vitriolic comments were almost certainly the work of the "competitor site" that thought his ideas were ripped off of. He probably either made multiple accounts or enlisted his friends to rip into you. There is literally no other explanation for that kind of crazy response.

</comment><comment><USER27> Awesome post.I love reading these stories. Very interested in the technical details followup.

</comment><comment><USER28> What kind of app was this? I'm curious how you handled the massive traffic to the site.

</comment><comment><USER29> Great post ... wow, what a ride! Thanks for taking the time to share the story.

</comment><comment><USER30> The best part of this article, for me, was the link to letscrate.com.

</comment><comment><USER31> Lovely post. Thanks for posting this. Eagerly waiting for the technical details.

</comment><comment><USER32> Great story. Thanks for taking the time to write up the story.

</comment><comment><USER33> Interesting. Thanks for the writeup.

</comment><comment><USER34> So, let me get this straight, you wrote an app so that your sister-in-law could get set up as the rebound girl for the "perfect" guy?</comment>


C Puzzles, time to brush up on your C - <AUTHOR> http://www.gowrikumar.com/c/index.html <comment><USER2> That these puzzles exist at all is the reason I don't use C for anything unless it's absolutely neccessary, like playing with CUDA, or highly desirable, like implementing a higher level language.

I mean don't get me wrong, I love the idea of such a thin layer ontop of assembler that with experience you can more or less compile in your head, but for a production environment? No thanks.

</comment><comment><USER3> ah duff's device.</comment>


The New Kindle DX "Graphite" - <AUTHOR> http://www.amazon.com/Wireless-Reading-Graphite-Globally-Generation/dp/B002GYWHSQ/ref=amb_link_353432582_2?pf_rd_m=ATVPDKIKX0DER&pf_rd_s=center-1&pf_rd_r=07JM1BKK9EPV020XT1YD&pf_rd_t=101&pf_rd_p=1268368262&pf_rd_i=507846

<comment><USER2> I'm tempted to buy a Kindle, especially with the Woot deal on the Kindle 2. I tried a Kindle at work the other day, and I couldn't help but notice the 'flashing' of the screen when I move to a new page. I'm talking about this thing it does where the screen gets erased and redrawn, a process that seemed to take 1-2 seconds. I thought that was quite.. awkward. Kindle users: does that bother you when reading? Or is it something you don't notice at all during normal operation? (Or even non-existent on current models, maybe).

<comment><USER3> It's never bothered me. After a short while you learn to start turning the page a bit before you're done reading the current page, and the actual page turn happens just as you're ready for it.

</comment></comment><comment><USER4> I've been hoping that they would release a new version of the DX. Alas, the one feature that I want - next and previous page buttons on the left side, isn't there. I realize lefties only make up about 10% of the population or so, but that's still 30 million potential customers in the US alone that they missed a chance to make the device more attractive for.

<comment><USER5> You could turn the device by 180 degrees. The orientation flips automatically, or you can lock it that way.

It makes keyboard access very awkward, of course, but for reading it should not really matter.

<comment><USER4> That's an interesting thought. I've never considered whether or not the auto- orientation would let you flip the device 180 degrees. Have you actually tried this, or is it just a theory? :)

<comment><USER5> Just tried it with auto-orientation, and it worked. I generally keep auto- orientation off, but I knew that you can manually lock in all 4 orientation.

</comment></comment></comment></comment><comment><USER6> Amazon's definition of "global wireless" apparently doesn't include Finland. The whole country is a conspicuous patch of white on the coverage map.

This seems weird – Finland has a densely built 3G network and Amazon has coverage over practically all of Europe. The only explanation I can think of is that they couldn't make a deal with the local operators.

<comment><USER7> I believe Amazon use AT&T's roaming relationships rather than having to do deals with operators in each country, so the device is always using roaming data when it's not in the USA, thus the reason they turn off some of the features that use more bandwidth for international users.

<comment><USER6> Okay, that would explain it. Turns out that AT&T has no data roaming in Finland, at least according to this list: [http://www.wireless.att.com/learn/international/dataconnect-...](http://www.wireless.att.com/learn/international/dataconnect- global.jsp)

It's AT&T who doesn't have a deal with Finnish operators and not Amazon, then. I still have to wonder why, though.

</comment></comment></comment><comment><USER8> > _better contrast_

As a former kindle dx owner, I don't see that this changes anything. The real problem is the glacial refresh rate, which means the iPad is still a much better reader.

<comment><USER9> The kindle uses ePaper, which as you say has the disadvantage of a slow refresh rate, but the advantage that it is better visible in strong light.

Do you find that this trade-off is in the iPad's favour? i.e. that you never read in strong light, but all the books that you read require animation?

<comment><USER8> Easily in the ipad's favor, yes. You encounter problems with the refresh rate when trying to read somewhat more complex books, eg anything that requires flipping back/forth, or large scanned books. Then the kindle browser is horrible, & I've been downloading educational videos from iTunes, etc. Id go as far as to say the kindle is only good for novels.

But yeah, the iPad glare is pretty bad, I have to read indoors.

</comment></comment></comment><comment><USER10> The Kindle DX is way overpriced. It should cost $250 at most. The iPad and the coming Android tablets changed everything.

<comment><AUTHOR> My problem isn't with the initial cost. But I honestly don't see myself paying 10 dollars for _fake_ (well, you know what I mean) version of books that I can get used from the corner bookstore for a dollar or two.

Give me a selection of books older than 5-10 years at a discounted price (hint: the same cost as a new paperback at the time of release is NOT discounted), and charge me whatever you want for the Kindle itself.

</comment></comment><comment><USER11> Amazon is really aggressively pushing their Kindle platform. We've got the Android app just released, the price reduction of Kindle 2 to undercut the 3g Nook, the new improved and sleeker looking DX, and new Kindle 2's are $155 on Woot today.

That's all in about a weeks time.</comment>


Heathrow Airport fined £120K for serious failings in data protection practices - <AUTHOR> https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/10/heathrow-airport-limited-fined-120-000-for-serious-failings-in-its-data-protection-practices/ <comment><USER2> > The member of the public decided to tell The Sunday Mirror newspaper about > the find, which days later published a story claiming the loss could > potentially have compromised airport security, including putting Queen > Elizabeth II, politicians and VIPs at risk. > Yesterday, the company with > the job of looking after the data, Heathrow Airport Ltd (HAL), was fined > £120,000 ($160,000) by Britain's Information Commissioner (ICO) for allowing > this to happen.

That's a surprisingly tame fine. I would've expected a couple more zeroes.

<comment><USER3> Put into perspective — £120k isn't enough to hire two full-time people to work on this sort of problem, so why would they?

<comment><USER4> See: the infamous Pinto memo

</comment></comment></comment><comment><USER5> This is, unfortunately, not really a surprise. There are a lot of companies who, instead of analyzing what data sharing facilities their staff need, then procuring appropriate services to meet those needs, take the approach of "pretending the problem isn't really there"

This inevitably leads to people using inappropriate mechansism like USB sticks, personal cloud sharing etc to get their jobs done.

<comment><USER6> At the same time, the lack of even basic protections is alarming. Don't need software controls to lock out USB drives, when there is superglue in the ports.

<comment><USER7> A big hassle in a world of USB keyboards and mice.

<comment><USER6> In my experience, the usb ports for those were locked down by the manufacturer and would be pretty hard to get at unless you were somewhat determined. The point being that, in this scenario, it (probably) wasn't some hostile agent that exfiltrated this data, but a unknowing employee

</comment></comment></comment></comment><comment><USER8> > HAL carried out a number of remedial actions once it was informed of the > breach including reporting the matter to the police, acting to contain the > incident and engaging a third party specialist to monitor the internet and > dark web.

Ooh, did they sign up for their Free Dark Web Scan?

</comment><comment><USER9> > exposed ten individuals' details including names, dates of birth, passport > numbers, and the details of up to 50 HAL aviation security personnel

I think this is significant especially in an environment where GDPR non- compliance can penalize American companies for millions/billions. I would say compromising the identity of security personnel that could be exploited for a physical attack should deemed even more harmful and fined at a higher rate.

<comment><USER10> As is, this fine probably doesn't cover the salary of a junior security researcher for one year to discover vulnerabilities and enforce best practices that could have prevented things like this. The message seems to be don't bother actually securing your systems if you are a European outfit.

<comment><USER11> £60k is a relatively decent IT salary in the UK.

It's probably a couple of junior security researchers.

But your point is still valid.

<comment><USER12> £60k gross salary for an employee might come at a £100k cost for the company when you add in NICs, pensions, HR costs, training, provision of equipment and office space.

</comment></comment></comment></comment><comment><USER13> > Heathrow Airport seems to have been in denial that anyone might save data to > drives or, if they did, would fail to secure them properly.

Just entertaining myself here by speculating, but could it have been possible that someone attempted to steal this information from the airport with malicious intent and lost it?

<comment><USER14> The odds would be extremely low, and would fall into Schneier's 'movie plot threat' category, [https://en.wikipedia.org/wiki/Bruce_Schneier#Movie_plot_thre...](https://en.wikipedia.org/wiki/Bruce_Schneier#Movie_plot_threat)

More specifically, we know that people use USB sticks to transfer data, even across "secure" air-gapped systems. (Eg, Stuxnet.) Some organizations will even fill USB slots with glue to prevent this sort of use.

By comparison, the rate of espionage/information theft through physical access to the data is much lower.

Since you posit a rare occurrence - information theft - followed by an even more rare scenario - losing the information - I can easily conclude that it's very unlikely.

<comment><USER15> > The odds would be extremely low

That's why I have trouble believing this story really happened. Simpler explanation would be that money simply changed hands for reasons unknown (bribes, etc.)

<comment><USER14> You think it's easier to believe that The Sunday Mirror paid someone at Heathrow to deliver a USB stick than it is to believe that lots of people at Heathrow are using USB sticks and one of them dropped it?

And you think The Sunday Mirror lied to the Information Commissioner's Office about the data provenance? That is, lied that it was found by a member of the public in Kilburn, and/or lied that it was viewed by that same member of the public on a public library computer before handing it over to The Sunday Mirror?

I don't. I don't see why you do. I don't see why we should regard your interpretation as "simpler".

Especially when (according to the linked-to report), Heathrow Airport Limited's own investigation could figured out who lost the stick, concluded that the USB stick was likely lost during commute-time transit, and showed that there were serious information security problems at Heathrow, with 'limited data protecting training in place' and no technical methods in place to keep data from being transferred to unencrypted or unauthorized sticks?

The report disagrees with your doubt, saying "The Commissioner has made the above findings of fact on the balance of probabilities."

How do you end up with a different balance? What scenario are you thinking of?

</comment></comment></comment></comment><comment><USER16> My company has a policy that if you plug that usb drive into a company computer it will wipe it and encrypt the drive, if it is not already encrypted. It would have made it difficult for people to read the information once it was out, but doesn't solve the issue of someone dropping it outside.

<comment><USER17> That's rather nifty - how is it implemented?

<comment><USER16> I believe it is a McAfee product.

[https://www.mcafee.com/enterprise/en- us/products/technologie...](https://www.mcafee.com/enterprise/en- us/products/technologies/file-removable-media-protection.html)

</comment></comment></comment><comment><USER18> That's like fining me $0.25 for speeding. Very deterring...

<comment><USER13> Fun fact: For most cars the sweet spot on the speedometer is about 40 to 60 mph, and generally, doubling your speed requires more than double the horsepower. Speeders likely already spend more than $0.25 in gas per trip from lost fuel efficiency. Even more when there are stop lights and other traffic.

</comment></comment><comment><USER19> This fine is way too low to make any kind of an impact, unless some pretty serious threats were made along with it.

</comment><comment><USER20> it's 'only' a $160K fine. I'm fairly sure people lost more expensive USB sticks. Eg this story, of someone having thousands of bitcoins on a (not lost but broken) USB stick: [https://www.news.com.au/finance/money/investing/dont- tell-my...](https://www.news.com.au/finance/money/investing/dont-tell-my-wife- melbourne-man-cries-over-lost-bitcoins-as-price-surges-past-us10000/news- story/bd18b6f6aa123dca017f9cc75544fd01)

</comment><comment><USER21> We've updated the link from [https://nakedsecurity.sophos.com/2018/10/10/airport- mislays-...](https://nakedsecurity.sophos.com/2018/10/10/airport-mislays- worlds-most-expensive-usb-stick/), which points to this.

</comment><comment><USER22> This sort of data still on USB sticks?? And in 2017?? What the hell.

<comment><USER23> USB drive is not the most alarming detail. The fact that sensitive data was in a TRAINING VIDEO.</comment></comment>


China's coming Austrian collapse - <AUTHOR> https://www.tbwns.com/2018/08/13/the-bears-lair-chinas-coming-austrian-collapse/ <comment><USER2> There might be truth to this article but its bias and demeaning tone are off- putting. It makes it hard to take the author seriously.

<comment><USER3> > There might be truth to this article but its bias and demeaning tone are > off-putting. It makes it hard to take the author seriously.

What exactly about this article was "demeaning"?

The author does seem to feel that Trump is handling China well, which I'm sure brings cognitive dissonance to some...

<comment><USER4> I don't really understand how Trump could be viewed to be handling China well. One of China's big selling points as a negotiating partner is they're consistent. The US has traditionally also had this virtue. Trump isn't even consistent with his own state department. Why on earth would you rest anything on a country that might elect somebody like that? If you were Qatar, why would you agree to another US military base, knowing that the next president might say you're harbouring Al-Qaeda, because some Saudi royals told him so? If you were the Phillipines, why would you feel confident in US support?

I know some people like big tough guys in politics, and to some of those people, Trump appears big and tough. But I think even if you have this persuasion, Trump's no Kissinger, no Tito, not even a Putin.

<comment><USER5> The Chinese came back to the negotiating table (after walking out in June) [0]. Anytime the other guys walks out and then comes back, you have the upper hand.

[0] - [https://www.cnbc.com/2018/08/16/kudlow-confirms-trade- talks-...](https://www.cnbc.com/2018/08/16/kudlow-confirms-trade-talks-to- resume-with-china-later-this-month.html)

For the record, negotiations look messy while they're ongoing. I think you'll find that the negotiations end up much better than most people think.

One of the key attributes of a good negotiator is to have a BATNA (Best Alternative To a Negotiated Agreement). Without one, you're going to fail. The last few administrations have not had that when negotiating with China, and they failed (heck, they didn't really get started before they backed off).

Trump's style is certainly unorthodox, but he has several folks who actually know how to negotiate (Robert Lighthizer & Wilbur Ross among others). I wouldn't count them out just yet.

<comment><USER4> I think the US has the upper hand to a ridiculous degree with _any_ other negotiating partner. It simply has a lot more chips than anybody else.

I don't really buy the idea that the US was getting 'bad deals', as Trump puts it. To be honest, I think the only way the US _could_ get bad deals is if it undercuts its own state department, and does everything it can to project an image of instability, insanity, and dementia.

The thing is, in the normal run of things, there are no incentives for anybody who isn't totally desperate to try and screw the US over. Unless the state department is utterly braindead, they just have way more resources to screw you back. Except, in the situation where you think that jeopardizing relations with the US is acceptable, because it's a fading power, or because it forgets its friends and enemies with the election cycle. Which are all things Trump is really good at convincing people of.

<comment><USER6> As this article emphasizes, China steals an enormous amount of intellectual property from other countries, the vast majority of which is created and owned by US companies. That's a "bad deal" by any measure.

I agree that the US has ample resources to "screw you back" but as with many things, it isn't a question of capability it's a question of political will. And without a doubt Trump has the will to flex on China, consequences be damned (or so it seems).

</comment></comment></comment></comment></comment></comment><comment><USER7> When an author is so confident in their assertions, it always raises red flags. Also, the latter part of the article seems to posit that "in order for the U.S. to win, China has to lose".

<comment><USER8> This wasn't what I got from the article. I believe it posits that if China is given a paddle on the butt, it will start to behave, which will be in everyone's best interests.</comment></comment>


Ask HN: What are some successful startups/businesses that are Chrome extensions? - <AUTHOR> <comment><USER2> Loom [https://www.loom.com/](https://www.loom.com/) started as a chrome extension.

Grammarly has done really well [https://www.grammarly.com/](https://www.grammarly.com/)

</comment><comment><USER3> Streak CRM (YC S11) [[https://www.streak.com/](https://www.streak.com/)]

I think Hunter ([https://hunter.io](https://hunter.io)) started as a chrome extension

Password managers like LastPass ([https://www.lastpass.com/](https://www.lastpass.com/)) rely on their browser extensions for convenience and usability

</comment><comment><USER4> I think that Rapportive started as a Chrome extension. I don't know much about the business but I believe the founder went on to start Superhuman.

</comment><comment><USER5> Honey. [https://www.joinhoney.com/](https://www.joinhoney.com/)

</comment><comment><USER6> Moz (and friends) have a chrome extension.</comment>


Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob - <AUTHOR> https://www.esat.kuleuven.be/cosic/fast-furious-and-insecure-passive-keyless-entry-and-start-in-modern-supercars/ <comment><USER2> A couple of relevant tweets from one of the authors on twitter:

"Tesla responded to this by upgrading key fobs' encryption in June and adding an optional PIN to cars last month. If your Model S is older than June, you can get a new key fob, turn on a PIN, or disable passive (no-click) unlocking" [https://twitter.com/a_greenberg/status/1039202487822106624](https://twitter.com/a_greenberg/status/1039202487822106624)

"Just one more thing. Everybody is making fun of Tesla for using a 40-bit key (and rightly so). But Tesla at least had a mechanism we could report to and fixed the problem once informed. @McLarenAuto, @KarmaAutomotive, and @UKTriumph use the same system and ignored us." [https://twitter.com/TomerAshur/status/1039245324441792513](https://twitter.com/TomerAshur/status/1039245324441792513)

</comment><comment><USER2> Most keyless systems are insecure in several other ways to a surprising degree for this decade.

Even in more recent years, most of them seemingly do not implement

(1) Time of flight checks, e.g. that a radio relay isn't being used to get to the keyfob many more meters away in the house using a relay/amplifier. This is a commonly exploited theft method currently. The Apple watch implements this to unlock your MacBook Pro(!) This has also been shown to be a viable attack method on many contactless payment terminals.

(2) Replay protection - another possible common attack is to receive the rolling code from transmitter, jam it so the car can't hear it and wait for the remote to transmit a second one. Then you jam that also, store that code, but then re-transmit the first code and the car unlocks and now you have a second code to use to unlock the car later. It's possible to both receive and jam the code by using a very precise tuned receiver, and jam in the surrounding the frequencies which in most cases the actual receiver (e.g. car) won't have filtered out. This works particularly well on most garage doors.

(3) Let alone having some kind of recoverable/brute forcible ID scheme, which as we can see here, is also true. I'm sure these aren't the only ones.

It's kindof silly really. I'd be curious to know if any manufacturers have been fixing this in the last couple of years.

<comment><USER3> > Time of flight checks, e.g. that a radio relay isn't being used to get to > the keyfob many more meters away in the house using a relay/amplifier.

That one's surprising. What's to stop someone following you into a supermarket after you've parked your Porsche, standing next to you with a relay device transmitting via the cell network, and someone else in the car park with the equivalent receiver/relay?

</comment></comment><comment><USER4> Not just Model S:

"We have only been able to verify our attack on a Tesla Model S in practice. However, Tesla did not design this system themselves but purchased it from Pektron. ... Pektron also designed keyless entry solutions for manufacturers such as McLaren, Karma and Triumph. ... This leads us to believe that the attack described here also affects the other manufacturers."

<comment><USER5> It seems odd to make that claim about other companies without actually checking. It could be true, but it also wouldn't surprise me at all if Tesla were cutting corners here in a way that McLaren doesn't for the really obvious reason that they're selling £185k cars, not £70k cars.

</comment></comment><comment><USER6> Oh dear. Seriously, 24-bit and 40-bit crypto of any variety?

Was it really so hard in the year 2013 to put at least a 128-bit AES key in the card?

With a sufficient directional panel antenna you could impersonate a car and query pocketed fobs in whole crowds of somewhat wealthy individuals. Aim the antenna and rig at the seating area of a trade show for middle/upper management types in the technology industry, for instance.

<comment><USER7> The obvious choice is to sort of skip the crypto entirely. The key fob can hold more than enough 128-bit random numbers to last the life of the car. Think about how much we can put on a little USB device these days. Cross off codes as they are used. This only requires a 1-way signal and a transmit button.

If the car can just ask for a code, without a button being pressed, then you have the problem of a foe tunneling the keyfob signal over a long-distance repeater link. Dealing with that requires timing measurements to measure the distance that the signal has traveled.

<comment><USER8> Exactly (the last part). There's a fundamental weakness here. Fixing the obvious weakness in the single sided authentication and weak crypto isn't enough to fundamentally solve it. Not sure there's _any_ way to fully make this secure. AFAIK, Model 3 doesn't have this feature & vulnerability.

<comment><USER7> Proposal for expensive cars that don't require a button press:

The key fob and car contain identical pre-shared random data. (could be gigabytes) Each transaction uses 4 tokens, 2 going in each direction, with each token being 128 bits.

Upon a button press, the key fob selects and destroys the next 1-time-use token it contains. It begins to transmit.

First the key fob sends a token. The car must respond with the correct token, which is checked by the key fob. Failure causes radio silence. After a few padding bits to allow for that checking, the car sends another token. The key fob XORs this one with the key fob's second token, which is then transmitted. The car takes note of the latency.

Each 100 ns delay (a single bit at 10 megabit/second) is worth about 30 meters at the speed of light. The car can use this to exclude key fobs that are excessively distant.

Now consider the repeater attack. The key fob is somehow mistakenly activated. The attacker forwards the signal over a microwave relay to the car, and does likewise for the signal going back to the key fob. Responses arrive late, causing rejection.

You don't much need crypto here. It's just XOR with a 1-time pad. Cheaper cars should just to that alone, with 1-way transmission. Expensive cars should do 2-way and measure the timing, but they don't need fancier crypto.

<comment><USER6> This is not a bad idea but I can think of two problems in real world execution:

a) Car companies won't want to hand out fobs that have any sort of writable memory, takes battery, and risks write memory wearout. Never seen a fob or smartcard that has memory which is written with every individual transaction. Having the fob do a computation on every transaction means it will need a lot more battery (in Wh per year) compared to a regular remote-unlock key fob for an ordinary passenger car.

b) High precision RF travel/distance timing, onboard computer system in the car capable of reliably determining to within 100ns timing interval, taking into account randomness in the real world environment such as reflections from nearby low-e class windows, metal structures, and such, may not be cheap or easy to implement.

<comment><USER9> > Never seen a fob or smartcard that has memory which is written with every > individual transaction.

Actually every SIM card does this. At least when used by a phone to join a mobile network, a SIM writes some timestamp or counter to persistent internal memory. This caused a funny case of SIM cards with very limited lifetime for a German provider (I think it was Congstar), who had a problem in its network that caused frequent authentications of handsets, thereby having them chew through the write cycles of their SIM cards way faster than projected for normal use. The cards became "dead" afterwards.

If I remember correctly, all chip enabled payment cards also have a transaction counter that is updated on every successful transaction.

</comment></comment></comment></comment></comment></comment><comment><USER10> There's no excuse in 2018 for using a 40-bit key. Hopefully Tesla gives its customers the upgraded fobs for free.

<comment><USER11> These cars were made ~5 years ago, but there's still no excuse for using a 40-bit key (which is transformed into a 24-bit response, lol) ~5 years ago.

<comment><USER6> There was really no excuse even in 2009, nevermind 2013, if you were doing some sort of proximity card public/private key crypto...

<comment><USER12> Actually, a very good excuse was provided precisely in 2009 - [https://xkcd.com/538/](https://xkcd.com/538/)

<comment><USER6> I don't disagree with the premise of that cartoon, but it's more about the concept of putting full disk encryption on your laptop, crossing the border into Uzbekistan, and then refusing to give up the password.

By that logic, anything that is protected by crypto, if you threaten the owner with violence, it can be stolen from them. Which is just about everything on earth, if you're willing to apply sufficient violence.

<comment><USER12> I was referring mostly to the concept of "A crypto nerd's imagination".

Seriously, it is unlikely someone would put the money and R&D effort required to replicate the researcher's solution with the goal of stealing these camera systems on the wheels that can be disabled remotely.

So I'd rather advocate for Tesla to continue using inexpensive and secure enough solution to unlock doors. And focus their efforts on making the thing actually safer, like not accelerating into and colliding with concrete barriers.

<comment><USER6> I can totally see people stealing Teslas, if you bring $100 worth of jamming equipment with you, it won't be disabled remotely. The cellular frequencies that a Tesla uses for M2M connections back to the mothership are not rocket science to jam.

At least not before it's driven into a warehouse somewhere and cut apart to be cannibalized for repair parts, then parts shipped overseas.

<comment><USER12> Repair parts for what? Who will purchase these?

<comment><USER13> All the people who have been waiting for months+ for a body shop to find Tesla-approved replacement parts, presumably.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment> village-idiot I thought software was supposed to be Tesla's killer advantage. It seems like they are doing a lot of amateur hour stuff on their vehicles.

</comment><comment><USER14> Yikes!

      0xFFFFFFFFFF :: 1,099,511,627,776

A 5 character password protects these vehicles.</comment>


Parallel and Concurrent Programming in Haskell – online beta - <AUTHOR> http://chimera.labs.oreilly.com/books/1230000000929/index.html

<comment><USER2> This is a very welcome addition to my Haskell bookshelf. I bought the pdf version and it looks perfect on my ipad. I'm really glad to have the clickable version to have in a browser window as well. That seems a bit more convenient for finding stuff while coding.

<comment><USER3> Agreed; the PDF is absolutely beautiful, and a joy to read on my laptop, which is not something I can say of many of the ebooks I have bought.

<comment><USER4> O'Reilley have always been amazing when it comes to ebooks in my experience.

</comment></comment></comment><comment><USER5> I'm a little confused. Is there any ability to comment? I can see the comment toggle on the top right but nothing in the page. I've seen commenting in other O'Reilly books [1, 2] but not sure how it works with this one.

[1] [http://book.realworldhaskell.org/read/](http://book.realworldhaskell.org/read/)

[2] [https://realworldocaml.org](https://realworldocaml.org) (also in beta)

EDIT: Found this [http://chimera.labs.oreilly.com/about](http://chimera.labs.oreilly.com/about) and also realised I was getting the toggle the wrong way around. "Comments on" means they're on, not 'click to turn them on'. Then you click on a block of text to bring up a comment box.

<comment><USER6> I think the book is already being printed:

[http://shop.oreilly.com/product/0636920026365.do](http://shop.oreilly.com/product/0636920026365.do)</comment></comment>


Ask HN: What cities have the best salary / cost of living ratio? - J-dawg Globally speaking, what are the best places to live that have tech jobs and a good quality of life, without being too expensive?<p>I'm talking about places to both live and work, rather than the "digital nomad" places that are popular with remote workers. <comment><AUTHOR> Chicago. Affordable rent[1], dense, car optional, highly walkable, good transit, best biking city in the country[2], phenomenal restaurants and beer. I've met several visiting New Yorkers that refer to Chicago as a "smaller, cleaner New York." I've been here 8 years and have never had trouble finding a new programming job when I wanted one.

People will decry the violence (of which the vast majority is confined to the disadvantaged parts of the city[3]) and the weather (which you get used to and should stop being a wimp about), but I find the salary / cost of living ratio far outweighs the disadvantages.

[1] [https://www.thrillist.com/lifestyle/chicago/the-l-rent- map-w...](https://www.thrillist.com/lifestyle/chicago/the-l-rent-map-where- you-can-t-afford-to-live-in-chicago-by-stop)

[2] [http://www.chicagotribune.com/news/local/breaking/ct- bicycli...](http://www.chicagotribune.com/news/local/breaking/ct-bicycling- magazine-rating-20160917-story.html)

[3] [http://crime.chicagotribune.com/chicago/homicides](http://crime.chicagotribune.com/chicago/homicides)

<comment><USER2> Chicago culture is nothing like New York, however, so the comparison is a bit moot. Chicago is very much a Midwestern city with a Midwestern culture. And in my years living in Chicago, I didn't know a single person who didn't own a car, and most of them spent lots of time driving.

<comment><USER3> As an anecdotal retort, I live in Chicago, not the suburbs, and known of 1 person who owns a car that I work with.

Unless you need to get out of the city, public transportation is very very good.

<comment><USER2> I think part of the issue is that Chicago's downtown and inner city are small enough that you typically do want to get out of town. Compared to cities like New York where people can easily go months, even years or decades, without ever thinking about leaving the city proper. That tends to be why so many people (vast majority) in Chicago own cars. And I've heard no end to the rants about trying to park in that town.

</comment></comment></comment></comment><comment><USER4> The best area I'm familiar with is Research Triangle Park (RTP). Above average salaries and relatively low cost of living. There's a growing food scene, people are active and it's at the beginning of a cultural renewal imo. Of course, being in NC comes with some problems due to the legacy of racism that exists in some pockets of society (pretty easy to avoid, you'll know it when you see it), but I loved growing up there.

</comment><comment><USER5> If you are in tech, Seattle has high salaries and no state income tax. Housing costs are rising, but I had a nice 1BR in Capitol Hill for ~ 1700 before buying a 3 BR townhouse in West Seattle with the same monthly cost for mortgage and taxes combined. Walk scores > 90 in both neighborhoods I've lived in and have never had a car. The equivalent housing would cost at least double in the Bay Area. Unfortunately, the winter in Seattle is a downer and it's a bit weird socially.

<comment><USER6> Is 1700 for a 1BR considered "Low COL" ?

<comment><USER7> Capitol Hill is the absolute trendiest part of town. A lot of people live on the north or west sides of town. Some friends of mine split a house for $500 a piece about a single 30-45 minute bus ride from their office downtown.

</comment></comment></comment><comment><USER8> Buffalo is really up and coming. We're starving for devs here and salaries are quickly going up. The cost of living is crazy low. The real estate market has been depressed for years - my house actually appreciated during the real estate crash. Commutes are short and your options are really varied as far as what kind of community you want to live in.

</comment><comment><USER9> Depends on your goals and definition of good quality of life. I think there is no best place for a avarage developer. Every life is so unique, skills are so leveled per de developer and matching economics and jobs on these are very specific.

As a dutch man, i can tell you just my experience as a software developer that here in the big cities are enough places to get jobs. Daily mails from recruiters sesrching for new candidates to be places at all sorts of companies. Living here matched about the avarage income to live in a small home with wife and kid.

</comment><comment><USER10> Really depends on the person. There are people who think somewhere in Ohio is awesome because of the cheap houses and low COL, and there are others who would be suicidal living there.

You'll have to figure out what you want out of a place besides just low COL. You can't just mitigate your disdain for a place by looking at your savings account. That's one positive about my time in NYC, the city really forces you to figure out what you want in a place to live.

</comment><comment><USER11> Anyone else watching LeBron James' _Cleveland Hustles_ on CNBC? It's pretty great. The lesson: energy and commitment trump geography and privilege every time. And $125K goes a long way in Ohio ;)

[http://www.cnbc.com/cleveland-hustles/](http://www.cnbc.com/cleveland- hustles/)

Re-formatting mid-size post-industrial cities into thriving locally-focused entrepreneurial hubs provides an alternative to the NYC, LA, DC, SF model. Instead of seeking to re-locate, why not attempt to foster what you value in your own backyard first ;)

Small Tech Hubs: Buffalo, Pittsburgh, Nashville, and New Orleans want your startup

[http://venturebeat.com/2016/06/26/small-tech-hubs-buffalo- pi...](http://venturebeat.com/2016/06/26/small-tech-hubs-buffalo-pittsburgh- nashville-and-new-orleans-want-your-startup/)

</comment><comment><USER12> NPR had an excellent blog post about this last year: [http://www.npr.org/sections/money/2014/05/20/313131559/how-f...](http://www.npr.org/sections/money/2014/05/20/313131559/how- far-your-paycheck-goes-in-356-u-s-cities)

Doesn't show tech salaries, but instead avg income adjusted for cost of living in that city. It will help you gauge which cities are more expensive.

<comment><USER7> DC always looks good in these because they never take into account all the cheap rents are in neighborhoods your average young professional is not going to wanna live in. I don't care how progressive you are--you're not moving to Anacostia.

</comment></comment><comment><USER13> Portland, Oregon. Dense, VERY walkable/bikeable, substantial amount of tech jobs, and more affordable than other major US metros with comparable amenities.

<comment><USER14> I did a stint out there at Intel in 99. It was a really cool city. I second your suggestion.

</comment></comment><comment><USER15> I've spent some time thinking about this and while it's hard to reach a conclusive answer as a generic one I would say a second tier city in western Europe. You still get a fairly functional state, internationalism and good quality of life without having to pay first tier city prices for housing and consumables. Which city is much harder to answer of course, suggestions are welcome.

</comment><comment> punk-coder I've lived in Atlanta since 1997 and I always found the pay to be great, while the cost of living isn't all that bad.

I'm an application architect pulling in a little over $160k. I recently bought a house over in Decatur with my girlfriend. A nice 1920 craftsman, 2,400 sq ft, for $600k. Before that I rented a loft in an old converted warehouse that was a little over 2,500 sq ft, for $1,300 a month.

There is a lot of tech work here in Atlanta, and while we don't have the greatest public transportation compared to other cities, I haven't owned a car in 3 years. I take the train to work and use ZipCar/Uber when I really need a car.

If you live inside the perimeter there are great neighborhoods, great restaurants, and plenty of things to do.

</comment><comment><USER16> I live in Sunset Park, Brooklyn next to the D train (20-30 mins to Manhattan) and I've made $80-95k and live quite comfortably, so if I make it over six figures I'll be more than fine. It's fairly cheap in terms of rent and groceries and I'm near all the fun stuff in Manhattan and other parts of Brooklyn. It's not the prettiest part of New York, though, but I like it here.

I don't know what the salary/cost ratio is, but I find it a non-issue. That said, I am 22 and have no children. I agree with another commenter here to said it depends on your lifestyle and hobbies.

</comment><comment><USER17> US tech salaries still seem to be disproportionately higher than elsewhere, so perhaps places like Seattle, Austin, D.C., Raleigh NC, St. Louis.

<comment><USER18> DC has a high cost of living. Way high.

</comment></comment><comment><USER19> Berlin, Germany. It's a good place for software engineers, particularly with some experience. The rent is still pretty good although growing. The salaries for software engineers vary, and it's usually better to go with more established companies rather than with yet another startup. The city has its multicultural vibe and one can enjoy night life, culture, etc.

</comment><comment><USER20> Clearly Zurich, this can be back-checked with several studies. Of all countries, it's Switzerland that has the best ratio. Within CH, it's ZH.

</comment><comment><USER21> I work in finance but Dallas is pretty great. The job market is incredible as well.

</comment><comment><USER22> Philadelphia is pretty good.</comment>