Google Chief Architect: we only respond to specific orders about individuals - <AUTHOR> https://plus.google.com/u/0/103389452828130864950/posts/huwQsphBron <comment><USER2> His comments are actually the most insightful points I've seen about the discussion regarding PRISM:

 _I have my own suspicions -- which I won 't go into here -- about what PRISM was actually about. I'll just say that there are ways to intercept people's Google, Facebook, etc., traffic in bulk without sticking any moles into the org -- or directly tapping their lines. You may find some interesting hints in the leaked PRISM slides [1], especially the second and fourth ones shown there. The subtleties of phrasing are important, I suspect, not because they were trying to be elliptical but because they reveal what was obvious to the people who were giving that presentation._

 _And like I said, I have both some reason to believe that there aren 't such devices inside Google, and that the PRISM slides are actually talking about a somewhat different kind of data collection -- one that's done from outside the companies._

Any ideas what he could be thinking?

1\. [http://www.washingtonpost.com/wp- srv/special/politics/prism-...](http://www.washingtonpost.com/wp- srv/special/politics/prism-collection-documents/m)

<comment><USER3> Beam splitters (prisms?) inside the backbone providers. All traffic goes to its destination unharmed, but the NSA gets all the packets. SSL is harder, but all you need is the private keys. Those are hard to get but not impossible for someone with the resources of the government. This is the only scalable way to do what they are supposed to be doing and not involve lots of outsiders. Note that the people who have really clammed up the past few days are the telecoms in all this.

<comment><USER4> This is exactly the conclusion I came to. My guess is they have the SSL/TLS keys.

That being said, tptacek thinks we are wrong, and he is a subject matter expert, so I am not sure.

<comment><USER5> The linked quora answer (from the co-author of Firesheep) says that even in that case one can't launch a passive man in the middle attack if perfect forward secrecy is used. Google.com uses Diffie–Hellman key exchange which provides perfect forward secrecy.

So... If I understand everything correctly, it should be impossible to decrypt passively captured HTTPS traffic to/from google.com.

[http://www.quora.com/SSL-Secure-Sockets-Layer/Is-it-ever- pos...](http://www.quora.com/SSL-Secure-Sockets-Layer/Is-it-ever-possible-to- decrypt-passively-sniffed-SSL-TLS-traffic/answer/Ian-Gallagher-2)

Could someone more knowledgeable confirm this?

<comment><USER6> actually everyone seems to have switched to the "fast" SSL ciphers instead - only dropbox defaults to DHE:

> openssl s_client -connect google.com:443 RC4-SHA > openssl s_client -connect > dropbox.com:443 DHE-RSA-AES256-SHA

Again, this is usually done for speed, but all of the companies on the list are using "fast" SSL/TLS ciphers rather than more secure ones.

<comment><USER5> I not really an expert in this at all, but we were not discussing ciphers, but key exchange methods.

I open google.com in Chrome, click on lockpad icon, go to the second tab, and it says: Key exchange method: ECDHE_ECDSA

Some googling turns up that: "ECDHE-ECDSA provide perfect forward secrecy" [http://nmav.gnutls.org/2011/12/price-to-pay-for-perfect- forw...](http://nmav.gnutls.org/2011/12/price-to-pay-for-perfect-forward.html)

<comment><USER6> yes it appears Google has PFS for Chrome/Firefox: [http://www.imperialviolet.org/2011/11/22/forwardsecret.html](http://www.imperialviolet.org/2011/11/22/forwardsecret.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> It sounds like this employee was not even aware that Google's "Transparency Report" specifically _does not_ include the number of FISA orders that they have received:

 _" Update 2013-06-07: at the time that we wrote this post, we asked Google whether its Transparency Report included data about secret FISA court orders that would send data to the NSA. The response we received was extremely vague, but seemed to possibly be "no". In the wake of yesterday's revelations that the NSA was harvesting data from Microsoft, Yahoo!, Google, Facebook, AOL, PalTalk, Skype, Youtube and Apple, Google has now clearly confirmed that the numbers in its Transparency Report do not include the number of orders or targets for NSA surveillance."_

[https://www.eff.org/deeplinks/2013/03/new-statistics- about-n...](https://www.eff.org/deeplinks/2013/03/new-statistics-about- national-security-letters-google-transparency-report)

This is especially interesting, because it means Google has acknowledged the distinction between NSLs, which include a gag order, and some other even more secret directive, which services NSA surveillance.

It's also worth noting that if Google was willingly supplying anything PRISM- like, this employee would not be _allowed_ to know without a Top Secret clearance. Any Google employees who do have such clearance face the threat of prison if they tell him or anyone else.

<comment><USER8> > _It sounds like this employee was not even aware that Google 's > "Transparency Report" specifically does not include the number of FISA > orders that they have received_

Are you concluding that from this statement?

> _" I'm not sure what the details of this PRISM program are, but I can tell > you that the only way in which Google reveals information about users are > when we receive lawful, specific orders about individuals -- things like > search warrants. And we continue to stand firm against any attempts to do so > broadly or without genuine, individualized suspicion, and publicize the > results as much as possible in our Transparency Report."_

He may be ignorant of that fact...however, that last statement, " _as much as possible_ ", would cover that. However, his assertion that _" the only way in which Google reveals information about users are when we receive lawful, specific orders about individuals"_ would still cover FISA, because FISA, as far as we know, is specifically for the targeted surveillance of individuals.

Moreover, FISA, as it applies to Americans, _requires a court-approved warrant_ for that surveillance. So again, what the OP is claiming is non- contradictory, because FISA requests are both legal actions that target individuals that go through an approval process.

This is entirely different than what PRISM is alleged to be, which, well, we don't know exactly what it is, but involves the warrantless surveillance of Internet usage with the collaboration of Internet companies...currently, Google is outright denying being a part of that.

Some relevant links: [http://en.wikipedia.org/wiki/United_States_Foreign_Intellige...](http://en.wikipedia.org/wiki/United_States_Foreign_Intelligence_Surveillance_Court)

[http://www.huffingtonpost.com/2012/12/30/obama-fisa- warrantl...](http://www.huffingtonpost.com/2012/12/30/obama-fisa-warrantless- wiretapping_n_2385690.html)

Also worth noting, national security letters, which Google _does_ oppose, are controversial because, among other things, they do not require a warrant. This is not the case with FISA and American citizens.

<comment><USER7> Ah, you are right on the PRISM distinction, I mixed up details with the "metadata" thing, which I'm sure is not accidental. A lot of the responses from government officials are to the effect of "these aren't a concern, because to get the metadata we need to go through FISA courts for every individual", which is just a red herring now.

So, there are:

1\. NSLs, published on the transparency report

2\. FISA orders, which are "through a court", but is by all accounts just rubber stamping, _not_ on the transparency report

3\. PRISM, which is intended to bypass FISA entirely, according to the Guardian article. Either Google is lying, the NSA is doing it without Google's knowledge, or there is subtle wordplay involved (so, lying). Or, that it's been grossly misreported.

</comment></comment></comment><comment><USER9> Two things that cannot be true at the same time: this Google+ post, and the idea that Google coughed up their TLS keys to the government.

<comment><USER3> You're one of the few whose opinion I would trust on this: how much data would the NSA need to derive TLS encryption keys from encrypted data? I feel like I read once that you could possibly use statistical methods to derive the key if you had enough encrypted source data.

<comment><USER9> The technique they'd be using to do that would be new to science.

Here it is worth pointing out that Google did something awhile ago to make NSA's job much harder (if their goal is to read everyone's mail): they became aggressive advocates for TLS forward secrecy.

[http://googleonlinesecurity.blogspot.com/2011/11/protecting-...](http://googleonlinesecurity.blogspot.com/2011/11/protecting- data-for-long-term-with.html)

TLS forward secrecy involves the ephemeral Diffie Hellman ciphersuites (which your browser supports). Instead of deriving a session key and using the server's RSA key to convey it, the DHE ciphersuites run the DH protocol to derive a session key between the client and the server, and then use the RSA key to sign the exchange ("breaking the tie" if there was a MITM). The RSA key is never used to convey a session key; if you got all of Google's TLS keys, you would not be able to go back in time and decrypt old sessions that used a DHE ciphersuite.

It is also worth pointing out that some of the hardest people working in security show business, including Adam Langley and Michal Zalewski and Justin Schuh, people with unimpeachable reputations in my field, work for Google on these problems.

</comment></comment></comment><comment><USER10> What I don't get is:

from US government, we got confirmations - half-ass confirmations, but still confirmations - that PRISM is real, we maybe have some information wrong and we should stop asking and talking about it, but it's real.

While the companies and its architects all oppose the claims in a way that's very convincing.

I don't know what to believe anymore.

<comment><USER8> I can't tell you want to believe, but maybe a place to start is: the world is a confusing place, full of miscommunication and gray areas. Why should we expect the world to be as it is in the movies, in which bad guys are obviously bad and that there is an "ending" in which things are clear?

For starters, I just re-skimmed the Washington Post report and noticed that it has since been amended:

> _It is possible that the conflict between the PRISM slides and the company > spokesmen is the result of imprecision on the part of the NSA author. In > another classified report obtained by The Post, the arrangement is described > as allowing "collection managers [to send] content tasking instructions > directly to equipment installed at company-controlled locations," rather > than directly to company servers._

 _edit: Here 's the link:_ [http://www.washingtonpost.com/investigations/us- intelligence...](http://www.washingtonpost.com/investigations/us-intelligence- mining-data-from-nine-us-internet-companies-in-broad-secret- program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story_1.html)

 _I think I 'm wrong that that was one of the actual changes since yesterday...either way, the Post is allowing for the possibility of a miscommunication/misinterpretation by its source. Business Insider also alleges of other hedging by the WaPo here:_ [http://www.businessinsider.com/washington-post-updates- spyin...](http://www.businessinsider.com/washington-post-updates-spying- story-2013-6)

At this moment in time, we still do not know two things: who the leaker is, beyond a "career intelligence officer" and the contents of this 41-slide presentation other than the 3 or 4 slides that the Post and the Guardian have published. The identity or motives of the leaker isn't necessary to know, but it's kind of problematic when we are missing context to the so-far published slides that explain the PRISM program. For example, it kind of changes things if the first two slides say "PROPOSAL" or the last slide says "APRIL FOOLS"

<comment><USER10> Well it's pretty clear now

[https://news.ycombinator.com/item?id=5843352](https://news.ycombinator.com/item?id=5843352)

They don't have direct backdoor, but they have a system in place for a fast and effortless data sharing.

<comment><USER8> Maybe they do, but I don't think you can assert that from what the NYT is reporting in that link. The article is talking about FISA requests:

> _The companies said they do, however, comply with individual court orders, > including under FISA. The negotiations, and the technical systems for > sharing data with the government, fit in that category because they involve > access to data under individual FISA requests. And in some cases, the data > is transmitted to the government electronically, using a company's servers._

The _data sharing_ is effortless. But the process to get it is still _the bottleneck_ , because in the NYT article, the companies still assert that they conduct a lawyer review of the requests. And, moreover, FISA mandates that when the request involves an American citizen, that a court-approved is required.

If you're arguing that FISA is wrong and that companies should be doing everything they can, including sending the requested data in dot-matrix printouts, to hinder the process -- no argument from me there. But the question at hand is whether they are part of PRISM, which, according to the reports so far, is a program that is different in implementation and legality than FISA.

(And if you want to argue that sending _any_ data upon a legal review is not at all different than direct, near-real-time access to a company's servers...I'm sure some infrastructure engineers would disagree with you, among other kinds of people required to make such a pipeline happen)

</comment></comment></comment></comment><comment><USER11> I'd really like to know whether Google shared its SSL/TLS certificates with government agencies. I asked the author (Yonatan Zunger) a short question and he replied to say he doesn't know anything. I followed up with:

> It seems you care very much about user privacy:

>> I would no longer be working at Google [but for] the fact that we do stand up for individual users' privacy

> Will you be willing to find out whether Google has shared its SSL/TLS keys > for public sites with government agencies? As a person interested in user > privacy, I imagine this will be as of much interest as whether they have > direct access to the data.

> As you mentioned, direct access would require Google to build something. > Intercepting SSL/TLS traffic would not.

> If Google shared its SSL keys, then the NSA can intercept all inbound and > outbound traffic, and would be able to capture virtually all Google user > data. They can store the data and search it. They wouldn't particularly even > benefit from direct access to Google's data, if they're planning to store it > themselves anyway.

> I would be great to hear an affirmation from Google that it has not shared > its encryption keys with governments.

I can't figure out how to link to my comment, but it appears in the comments on Yonatan Zunger's post. (See original post)

</comment><comment><USER12> For clarity, he's currently chief architect for Social/Google+ not Google as a whole, but he's still a very senior, longtime engineer.

<comment><AUTHOR> Good clarification. Only so many words that would fit into the headline...

<comment><USER13> One more character would have been sufficient...

</comment></comment></comment><comment><USER14> What might have happened is this: 1\. NSA bribed someone to obtain Google's SSL certificate private keys 2\. NSA installed wiretaps outside of all Google datacenters 3\. NSA hired someone to write software that would reconstruct Gmail inboxes, login activity, etc. based on the decrypted traffic

If Facebook, Google, etc. are indeed innocent they should change SSL certificates immediately, store the new ones in secure cryptographic hardware, stop offering non-HTTPS access, and start inspecting network equipment for the wiretaps.

</comment><comment><USER15> > _" the only way in which Google reveals information about users are when we > receive lawful, specific orders about individuals -- things like search > warrants."_

Things _like_ search warrants? What has been described in the PRISM slides is an interface in which a NSA agent can access a subject's data at will, in a few clicks and an affirmation that "yes, this person is a terrorist".

Also the US government has confirmed that systematic collection of user data was indeed happening for non-US citizens. What of that? Are they users of lesser rights in the eyes of Google, etc?

<comment><USER8> > _Things like search warrants? What has been described in the PRISM slides is > a interface in which a NSA agent can access a subject 's data at will, in a > few clicks and an affirmation that "yes, this person is a terrorist"._

Google has officially denied being a part of PRISM. The way you phrased this statement makes it sound like the OP is sneakily leaving out the PRISM implementation, which would be sneaky if Google _were_ a part of PRISM.

(this doesn't mean that Google's _isn 't_ flat-out lying about everything...but you seem to be alleging a contradiction where there is none, at least in the OP)

> _" Also the US government has confirmed that systematic collection of user > data was indeed happening for non-US citizens. What of that? Are they users > of lesser rights in the eyes of Google, etc?"_

NSA's mandate since its inception is to conduct surveillance of foreign communications suspected to be a threat to America...So while it's still worth arguing whether the surveillance they conduct is unethical or unproductive, it's not going to be worthwhile arguing whether they _do it at all_.

edit: removed sarcasting phrasing that was too assholish for a Friday after work.

<comment><USER16> >> Things like search warrants? What has been described in the PRISM slides is a interface in which a NSA agent can access a subject's data at will, in a few clicks and an affirmation that "yes, this person is a terrorist".

I'm not sure where you getting that from the slides. They don't explain how an analyst uses the system.

>>Google has officially denied being a part of PRISM. The way you phrased this statement makes it sound like the OP is sneakily leaving out the PRISM implementation, which would be sneaky if Google were a part of PRISM.

Other media reports from insiders (not information on the leaked slides) make it sound like PRISM is more of an NSA internal thing that aggregates data and presents it to analysts. Based on the description of the slides it sounds like the NSA has some integration with the on site premises of the target company.

So it could be as simple as PRISM is just a way of automating the whole process of getting data from a valid warrant which would be consistent with the denials made tech companies. They don't have any contact with 'PRISM' per se; they have just set up their systems to spit out data when they get a valid warrant.

<comment><USER8> I was quoting and disagreeing with the grandparent comment...which I interpreted as implying that Google is a part of PRISM (which may actually be true, but that would be begging the question in this argument)...

But I do agree with the grandparent that PRISM, as described in the original Washington Post report and in the excerpted slides, do seem to allude to "an interface in which a NSA agent can access a subject's data at will"

Here's the Washington Post:

> _There has been "continued exponential growth in tasking to Facebook and > Skype," according to the PRISM slides. With a few clicks and an affirmation > that the subject is believed to be engaged in terrorism, espionage or > nuclear proliferation, an analyst obtains full access to Facebook's > "extensive search and surveillance capabilities against the variety of > online social networking services."_

[http://www.washingtonpost.com/investigations/us- intelligence...](http://www.washingtonpost.com/investigations/us-intelligence- mining-data-from-nine-us-internet-companies-in-broad-secret- program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story_3.html)

</comment></comment></comment></comment><comment><USER17> Since the Chief Architect is so supportive of privacy rights - I'd like to participate in G+ using a pseudonym. How about it Google??

<comment><USER18> Something like this? [https://plus.google.com/+BradleyHorowitz/posts/SM5RjubbMmV](https://plus.google.com/+BradleyHorowitz/posts/SM5RjubbMmV)

<comment><USER19> No, that says you can't use a pseudonym without proving to Google that it is one a lot of people know you by.

<comment><USER20> Nothing in the names policy prohibits pseudonyms. If your given name is "Jason Ramirez", you're welcome to have a separate Google+ account with the name "Nancy Young".

You only have to prove people know you by a name if you want to go by "#RS", "Albert Einstein", or "GreenLife Rx"; all three of those are likely name violations for reasons that have absolutely nothing to do with knowing who you are.

</comment></comment></comment></comment><comment><USER21> To be clear, this is the chief architect of Google+, not Google as a whole. Would he necessarily know?

<comment><USER12> He actually responded to just this question in the comments (and he's a very senior 10-year engineer, so it's plausible).

"I have various reasons to believe that the odds that I would have known about it are higher than those for most employees -- but it still wouldn't be a certainty. That said, the odds are good enough that I would be fairly surprised, and rather furious, to find out that such a thing had been happening without my knowledge."

</comment></comment><comment><USER22> We pretty much already have confirmation that PRISM exists. [1] It's a little funny all of these companies expect us to believe that none of them are involved.

[1] [http://gizmodo.com/the-government-responds-to-the-prism- spyi...](http://gizmodo.com/the-government-responds-to-the-prism-spying- program-511822476)

</comment><comment><USER23> This denial is a lot stronger than Page's, which was full of weasel words. Unless Zunger is just lying, which somehow seems unlikely (forgive my naiveté), it'll be interesting to know how PRISM actually works. But I will say that his faith in his company sounds misplaced, since Google's more official denials are so weak.

edit: clarity

<comment><USER24> He hints at a couple of reasons for his confidence in his post.

One of his assumptions was that people would notice surreptitiously installed hardware or software doing the monitoring. I don't think this is unreasonable. Hoovering up all the private data in Google is bound to be a big job, regardless of whether you are sieving it on site or transferring it off site. Even if it would only take a few people to install and manage, everyone else would probably be tripping over it constantly. Accessing all of Google's data means you'd be tied into nearly every system.

It's possible to keep projects secret inside a large company like Google, but only if an exceedingly few number of people know about it, and have good reasons to not tell anyone else. A system with as much surface area as you'd probably need to hoover off all of Google's data would be vulnerable to almost every engineer and datacenter worker accidentally running across while debugging other problems. Even -- especially? -- if they didn't realize the significance of it immediately, they'd probably ask their coworkers about this weird extra code/jobs/hardware, and pretty soon everyone would have heard about it. Once everyone inside of Google had heard of it, I think you'd have a very hard time keeping the secret from leaking into the outside world.

<comment><USER23> Right, that mostly paraphrases his arguments. But it doesn't convincingly eliminate a few possibilities for how this works.

One possibility: Google obviously has some capacity to honor search warrants and NSLs. And presumably that involves some technical artifacts somewhere: admin-level API access to data and some sort of external endpoint through which the government can actually make those requests. So that's all stuff we can confidently say is already there humming along happily, whether used for nefarious purposes or not.

OK, so given that those exist, how much volume do they support? How hard would it be to modify them to bypass the scrutiny process? Or give the NSA access to those endpoints instead of just domestic law enforcement? In other words, these are just changes to the _process_ , totally invisible to anyone without explicit access to it. It might not involve any weird hardware at all, and could operate with very few people in the know.

Another possibility: Google handed over its TLS keys and just let the taps happen upstream.

That's why the confidence of a senior person that there isn't fishy hardware running around makes the question of how PRISM works more interesting. But it certainly doesn't make the project impossible.

Edit: removing distracting aside

<comment><USER24> I don't think I can guess about how well whatever the search warrant APIs are scale to "look at everyone" without speculating overly much about the design of the system. I would argue that, regardless of the access method, if someone is looking at the terabytes or petabytes or yottabytes or however many bytes of emails there are, you're once again back to a huge amount of network or CPU or whatever utilization. Eg, even if the database access is allowed and off the record, the database admin should still be wondering why the load is so high, as if everyone in the world were reading all of their email simultaneously. And then you're back to gossip and everyone internally knowing about it.

The TLS keys are an interesting angle. Are TLS keys typically one (small set) per site, or would each server typically generate its own unique keys? Even with the latter the surface area might be small enough within Google that no one would accidentally stumble upon it.

</comment></comment></comment></comment><comment> cupcake-unicorn With all of the conspiracy theories floating around, what about something fun, like the government proved P=NP and is just able to secretly crack the encryption keys, passwords, etc., like that silly movie "The Traveling Salesman Problem" where they turn algorithms into an action packed movie.

Seriously though, it seems like the general consensus is that no one on either side is actually lying, but the companies involved are using weasely language that can be interpreted to exclude any kind of indirect access, SSL keys, etc? I'm surprised at the tone of the statements the companies are giving, because were it to come out that the companies are giving _indirect_ access, their adamance would just make them look terrible...It's as if the companies in their statements, at least FB and Google, sound shocked, hurt, etc. to find out people would assume that of them.

<comment><USER25> It's widely known and admitted that they have indirect access, by issuing warrants and being provided with slices of the data. You must be talking about some specific form of indirect access?

</comment></comment><comment><AUTHOR> Also worth reading is the comment thread. " We don't sell our users' information to anybody.... we do use user information to target ads: this approach has made us what's technically known as "large stacks of cash:" "

</comment><comment><USER26> "might have also denied knowledge of the full scope of cooperation with national security officials because employees whose job it is to comply with FISA requests are not allowed to discuss the details even with others at the company" [http://www.nytimes.com/2013/06/08/technology/tech- companies-...](http://www.nytimes.com/2013/06/08/technology/tech-companies- bristling-concede-to-government-surveillance-efforts.html?_r=0)

Welcome to evil google team. It was nice knowing you. You will not miss me, but good bye.

</comment><comment><USER27> I wonder what the NSA thinks about Google's plan to change their SSL certificates?

[http://googleonlinesecurity.blogspot.com/2013/05/changes- to-...](http://googleonlinesecurity.blogspot.com/2013/05/changes-to-our-ssl- certificates.html)

Seems like that could put a crimp on any beam split obtained data. At least for a short while.

</comment><comment><USER28> >"Google had no involvement in the PRISM program and the first we heard of it was when Greenwald's article hit the press."

Greenwald broke the story about the Verizon FISA warrant, not the PRISM story. These are (ostensibly) different things.

<comment><USER29> I think he broke both stories.

From [http://www.guardian.co.uk/world/2013/jun/06/us-tech- giants-n...](http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa- data)

> The Guardian has verified the authenticity of the document, a 41-slide > PowerPoint presentation

</comment></comment><comment><USER30> This is the sort of response that I find convincing. Thank you, Dr. Zunger.

</comment><comment><USER31> one thing crossed my mind : could the fact that this things blows up right when china's president is coming to the US to talk about cyber espionage and individual liberties be a coincidence ?

<comment><USER32> That's a good point. It does seem like the slides are fake and someone is trying to play the public against Internet companies, or alternatively, that someone is playing public against US governement.

</comment></comment><comment><USER33> Somebody probably puts the census in their inbox, then.

</comment><comment><USER34> >> _the fact that we do stand up for individual users ' privacy and protection, for their right to have a personal life which is not ever shared with other people without their consent, even when governments come knocking at our door with guns, is one of the two most important reasons that I am at this company_

The indisputable fact is that your company gathers a lot of private info online about its users for profit, make that for extra, extra profit. Best case scenario, it makes NSA's job super easy, all they have to do is ask for it. Worst case scenario, the government knows all our thoughts as we type on Google search and everything else we do on Google. I do not trust that such info will stay private. Not anymore.

>> _the national security apparatus has convinced itself and the rest of the government that the only way it can do its job is to know everything about everyone. That 's not how you protect a country. We didn't fight the Cold War just so we could rebuild the Stasi ourselves._

Yeah, WTF do they think they are, Google or Facebook?????</comment>


Ask HN: How does a stealth startup get someone to redesign it confidentially? - <AUTHOR>

Our startup needs a redesign. It has been put together entirely by programmers and looks like shit. The problem is, we don't intend to hire anyone else and we are concerned that if we get a designer from outside to redesign the site, it could result in destroying our cover.<p>I know there is a huge potential debate here about whether startups should be in stealth mode at all. All I can say here is that it's not a decision that's under my control, is not going to change, and has no bearing on the fact that I need to redesign the site while maintaining the confidentiality of the idea behind it. So feel free to start another debate on stealth startups if you like but I would still appreciate if someone could try to answer this question I'm dealing with regarding carrying out a stealthy redesign. Thanks. <comment><USER2> Every product commercially released requires confidential design to take place. It is normal for designers to work like this.

Even super-secret companies like Apple require videos, adverts, web-pages, photo-shoots etc. The iPad2 probably already has all of these.

Find yourself a good designer. Ask them to keep it quiet. If need be, get them to sign an NDA.

One request. Please release them from the NDA as soon as it is no longer necessary so that the designer can add the work to their portfolio. More than half of the things I have designed have never seen the light of day and yet are still NDA'd. It's very frustrating as it includes some of my best work.

</comment><comment><USER3> Three words: trust, Non-disclosures, and contracts. And work with a US firm or firm in another jurisdiction where you know that the force of law (and the power of the lawsuit) is much stronger if they violate any of the above three.

Of course, you know that it's very hard to truly protect an idea. This is why trust matters the most.

Oh, and don't be cheap. Expect to pay a premium for keeping things quiet. If you play lowball cheapskate, don't be surprised if the other party at some point finds it more economically advantageous to run with your idea in ways you can't / won't.

So, pay well and trust few. Then cross your fingers.

And you're right when you say this will spawn conversation about stealthiness for startups. I have rarely seen stealth matter. But you probably already know this.

</comment><comment><USER4> > it's not a decision that's under my control, is not going to change

Kind of guessing here, but this leads me to believe you have investors. If so, have you asked them about this? Seasoned tech investors usually have contacts to facilitate such things. (I'm sure you'll get some useful, actionable input here too.)

</comment><comment><USER5> Alright... when you say it "looks like shit" do you mean it really needs a complete overhaul from a top, professional designer, or do you think it could be touched up and look pretty good? I'm no top designer, but I do contract web design - I'd be up for signing an NDA, looking over it and giving you my input.

</comment><comment><USER6> Hire a professional designer. If the design is so important to your startup that it's holding back your launch, and you don't trust freelancers or outsourcers, then you need to hire for it. My portfolio is in my profile ;)

</comment><comment><USER7> Do you have a good professional network? You could ask them to recommend someone trustworthy.

FWIW I agree you should put them under an NDA but don't rely on that stopping quiet/silent leakage.

</comment><comment><USER8> We have done work for companies like yours as well as YC companies. If you need help my contact information is in my profile, send me an email.

</comment><comment><USER9> Just ask the designer for confidentiality.

</comment><comment><USER10> Use an NDA that's what they're meant for.

</comment><comment><USER11> Crowdspring (and maybe 99designs) requires the designers sign NDAs if the project is above a certain dollar value I believe.

<comment><USER5> Ok, but then you're sharing your idea with hundreds of people... do you want the fun (impossible) task of finding out which one of them leaked your plans?

</comment></comment><comment><USER12> The advice given pretty much covers it, but the one caveat I'll mention is to try and find a designer whose style you like first.

If you get a bunch of people competing for the work, you can somewhat safeguard yourselves with NDAs, but the more people you bring in, the more likely it'll slip or you'll piss somebody off or they'll think the NDA is over when they don't win the work, or what have you.

While you're perfectly covered legally, your secrecy might well have been blown, and no amount of legal action is going to save that.</comment>


Part time Entrepreneur, fulltime Employee - <AUTHOR> http://sdk.org.nz/2010/02/10/part-time-entrepreneur-fulltime-employee/ <comment><USER2> This is totally doable, although I don't envy him for trying to do it while also having a wife and kids. If your life situation allows you to play WoW, your life situation allows you to run a business. Heck, my business is _considerably_ less complicated than the guild I used to run. I managed to cut my headcount by 39 and my hours by 75%. (You may have to stop playing WoW. Apologies in advance, but trust me, the loot gets better.)

It occurs to me that I've never done a blog post explicitly about doing a business while also employed. I think I might over the weekend. Is there anything specific y'all would be interested in hearing about?

<comment><USER3> I would love to hear about any techniques you have for overcoming mental fatigue at the end of your work day when you still have business work to do.

Did you work on your business before the work day started? Or something different?

<comment><USER4> Seconded. It seems to me that whenever people tell you to keep your day job while trying to start a business, their day jobs are not related to programming.(so IT, analyst...)

I would love to read something about how your code all day for your day job and then code all night for your business. That info, coming from somebody who has done it before would be a very interesting read.

(Another interesting thing would be reading about how to keep your sanity while doing all of this for more than a few weeks)

<comment><USER5> To code on both, do something you care about as your startup. _really_ care about. Also, there is lots to do. Do whatever seems most fun to you at the time. By the time you are forced to do things for clients, you'll have enough code and good habits formed to manage it.

To stay sane, set strict rules about time off. For me, Friday night and Saturday (all day and night) are family time. Sunday is totally Gridspy time. If I start to feel tired, admit it and remind yourself that you can ship one month later and take a few days off here and there.

</comment></comment></comment></comment><comment><USER5> Proud to see my blog post on HN.

It has been a tough slog working full-time while spending every other waking moment on Gridspy. It doesn't help that I spend every waking moment thinking about it, even when I should be applying myself to my full-time job.

Biggest challenges:

1) Starting work again at 7pm after dinner, and sticking with it as long as possible

2) Stopping at 10:30pm so I'm not dead after 2 days

3) Taking time off on Saturday, simultaneously fantastic + frustrating

4) Being an available father, giving love and attention to my kids

5) Knowing that I could do in one normal day what takes me Monday..Friday to do.

The second I can step up and go full-time Gridspy without going bankrupt in 1 month, I will.

<comment><USER6> Well written and it comes at a great time for me. It's such a wonderful feeling to know there's someone else out there like me... I too am a family man (2 + 1 in the oven) with a fulltime job and a mortgage, and am trying to make time to build something by myself.

I love pg's essays though I often feel depressed after reading them. He frequently seems to be saying "don't even try unless you're young, free, have at least one partner, live in the valley, have no other obligations, and are willing to 'work until you endanger your health'"

Added your blog to my RSS reader.

<comment><USER6> @pg: Uh... that came across as far more negative than I intended. I really do like reading your work and want to read more. The fact that I don't fit into (what I think is) your primary audience does NOT make them any less valuable to me.

</comment></comment></comment><comment><USER7> I'm sure dedicating yourself to one single project may be better, but doing both is absolutely doable at the beginning. You can even go a little further. At one (recent) point of my career I had more full time employees than the company of which I was an employee at the very same time. Sometimes you don't have the option of risk it all, so you need to adapt, even if that means skipping your beauty sleep. It's all about been driven, just like you are.

<comment><USER5> Thanks.

Honestly, what Gridspy needs is more of Me. I don't see myself paying other people to do work until I am running full-time because I am more dedicated (it _is_ my startup) and also I know the code better.

Interesting situation to be in, working elsewhere while your start-up employs others. I'd be jealous of my employees in that situation.

<comment><USER7> Oh, I was just working 16 hours instead of 8 (mmm... that actually didn't change after I quit). My case is different cause mostly I'm a designer/front- end developer so I couldn't have done it all by myself anyway.

</comment></comment></comment><comment><USER8> Sounds about right without the kids.

Btw, if you have a blog you should probably take the opportunity to pimp your own site with a little seo magic. looks like your first keyword is "power use" and the chances of putting someone else putting that in an "a" tag aren't that likely. Also a direct link to the site rather than just the blog entry would be helpful for real people.

Google will take the first link to [a href = "gridspy"][/a] and take a look inbetween the a tags, and consider that a relavent term for searches so [a href = "gridspy"]power use[/a] would help increase your search ranking for that term.

<comment><USER5> Thanks for the suggestions.

I'm still focusing on the part of the "SEO Pyramid" where I create great content that people want to read. There is heaps of tuning to do soon.

</comment></comment><comment><USER9> There should be a support group for over 30 startup founders that have families, bills, and full-time jobs.

My advice to any one trying to do this is to be patient and find a time management system that works for you. Also, get used to the hours between 8pm and 2am. Those hours can be your best friend and worse enemy.

<comment><USER10> Hi, 38, married, 2 kids, full time job and a mortgage here.

My hours are from 4:30am to 7:15am, 30 minutes at lunch and 30 minutes making the next day's todo list before bed.

Even though the time I can commit is short I'm much more productive now than I was at 28 working crazy hours.

<comment><USER11> Same here. 37 yrs old w/ 2 kids (3 & 2 yr olds!). Full-time job that I like but don't love. Lots of ideas that need room to breathe in their own skin. I'm preparing to create an LLC to do just that.

I don't know where it will lead in the future (maybe nowhere), but I'm prepared to deal with that. The harder thing to deal with is simply sitting on the sidelines doing nothing while life passes me by.

</comment></comment></comment><comment><USER12> Wonderful read. Your story could be mine. I completely understand all the things you're saying. I know what it feels like to have two small kids, a job, a mortgage, having to get up at night to feed a baby and dreaming of having your own succesful business. I have been developing my own sites for the last decade, without ever being really succesful (in terms of money). I've been working at my own computer from eight in the evening until I can't keep my eyes open. Almost every night, and many saturdays and sundays. Sometimes in the middle of the night, when I can't sleep (which happenes quite often :-).

Even though the lack of succes is at times wildly dissapointing, especially when seeing friends having good academic careers (a path I could have chosen), and even though I feel tired at almost any moment of any day, I'm not complaining. Not once. I cannot help but go on with the next application, and the next and the next. It's my dream, and one day I will succeed.

I currently have two things in the pipeline, for which I have the same high hopes again - even though the odds are against me :-)

I hope you do well. Instead of just talking about the things you could do (like many people), you act. And you work long days. You deserve your succes, and I hope you will have your deserved succes one day, hopefully just as me.

Ah, and perhaps most importantly: I found your post to be very motivational. Keep it up!

<comment><USER13> Maybe focusing on and sticking with one thing may be a better alternative?

<comment><USER12> Good point, but don't get me wrong: I don't work at too many things at the same time. Of the two things I'm working on now, one is rather simple, so I don't think I'm dividing my energy over too many things.

(And also, when I get excited about something, I just can't wait to do at least some work on it :-)

<comment><USER5> You do need to stick to one idea for a long time for it to succeed. See [http://www.codinghorror.com/blog/2009/01/overnight- success-i...](http://www.codinghorror.com/blog/2009/01/overnight-success-it- takes-years.html)

</comment></comment></comment></comment><comment><USER14> +1

Even college grads can follow some of this advice. Come out of school ladened with debt is no picnic and sure going straight to a startup sure seems like a sexy idea but even Paul Graham admits most startups fail. Sure valuable experience, and new contacts help ease that but there are alternatives. I would prefer to go into business for myself once I am debt free and on solid footing (not waiting because I am scared....well I am a little)

Not to mention that above average coders can make some good salaries.

<comment><USER15> But are you really going to be able to walk away from a comfortable life and good salary some years down the road to try something risky? The longer you get used to having disposable income and the freedom to do whatever you want outside of 9-5 knowing you'll have a job to go back to tomorrow, the less likely you'll be willing to take the plunge.

I landed a good job right out of school. I soon after (i.e. a few months) left that job to pursue my entrepreneurial dreams because it would have been many times more difficult to leave after being comfortably employed for a few years and fully out of debt.

I'm not saying this scenario never happens, because clearly it does. But there's a reason the stereotypical startup founder is a 20 something fresh out of school or a drop out living on Ramen.

EDIT: grammar

<comment><USER11> On the other hand, having substantial job experience in an industry helps you identify various pain points and can give you the perspective and wisdom you need to pursue your own venture. If I were a potential customer I would trust a 15-year veteran over a young and inexperienced person when they're selling their "solution" to my problem.

</comment></comment></comment><comment><USER16> I'm doing this now, but don't have a wife or kids to worry about. It's still HARD. Pacing only solves the burnout problem, but fails to solve the satisfaction problem. Only working 15 to 20 hours each week leaves a lot of gaps where we simply lose track of our short term goals and spend a lot of time re-orienting ourselves. When we actually have a productive day, it creates frustrating contrast to the unproductive ones. You constantly think "if only we had another 25 hours each week, we'd be so much further along".

<comment><USER5> Hear hear! I have exactly that problem. Also, Full-time Sunday (for me) is a bittersweet taste of what that would be like.

</comment></comment><comment><USER17> I'm in the same boat. Knowing and repeatedly experiencing the fact that most startups fail, I have accepted that the time spent is not wasted, even if I never make a dollar. I've already seen positive results in contacts made and experience gained. However, I still have those days when I think the guys "wasting" their time playing WoW or xbox are getting the last laugh.

<comment><USER12> About your last line: Some people do indeed seem to just be in the right place at the right time and have good things fall in their lap just like that. Even while playing WoW :) But no, I think ultimately only your own hard work is the best possible guarantee for success.

</comment></comment><comment><USER18> the issue i face is, when i start working on my side project at 8pm i just want to keep working on it and before i realize its 3/4am and now i am late for office next day :(

<comment><USER19> haha. I hear you brother. And let me guess, after spending the whole week burning the midnight oil and getting 3-4 hours sleep per night, you catch up by sleeping all day saturday?

Try modafinil.

<comment><USER19> I presume the downvoter thought I was being condescending, but I was commiserating! That's the exact pattern I've fallen into too many times : /

</comment></comment></comment><comment><USER20> I don't really buy into this approach especially with young children and a wife. Read all the posts detailing how hard this approach is without a wife and kids. How much time is this guy spending with his spouse? How happy is the spouse going to be with you constantly on the computer. This kind of advice will mostly lead to a divorce. Of course, this is case by case as some spouses may be OK with being totally ignored or perhaps you can convince them that this amazing web application is going to make a fortune and you will be able to purchase an island for her (just a couple more weeks honey I promise!); however, for most this advice will land them in a financial and emotionally devastating divorce. When you get married and have kids you need to put some selfish needs on the back burner. I think a better approach is to take money from savings and quit your job. Or perhaps go to 20 hours a weeks or something like that. And if you can't do something like that than just forget it -- it is not meant to be. Your gold rush web application is just not that important -- your wife and kids are.

<comment><USER21> I completely agree that anyone with kids absolutely _must_ make their kids the #1 priority in their life. Having said that however, it sounds like the OP is working on his startup in the % of his free time that many of his peers might be using for more conventional hobbies like bowling, playing WoW, watching TV, etc.

<comment><USER5> That is true. Also, any time I spend not working on Gridspy or my day job I spend with my wife and kids.

</comment></comment></comment><comment><USER22> This is precisely my M.O., save for having an active project or a definite idea. :-)

<comment><USER5> Yeah. Don't bother until you have an idea that really fires you up. However, you might want to spend the time actively searching for that great idea (research into unautomated industries, say).</comment></comment>


Why I don't want funding - <AUTHOR> http://breasy.com/blog/2007/05/26/why-i-dont-want-funding/ <comment><USER2> Posted on the site, and have further thoughts.

"Work hard for a year, save enough, be diligent, and you too can fund your own startup.", was the basic summation of the article in the end.

The tools I'm working on require partnerships with different service carriers which can run as much as 10k a month, then you have contractors, lawyers, designers to pay. You'd have to have one helluva job to pay for all that. My partner and I have been using our salaries, equity lines, savings, for a year and it's not enough.

Playing the slow-goer, almost like a casual gamer, won't always work. In a years time maybe you'll get married. Maybe you'll have a kid. Maybe you'll get fired. Maybe you'll want to go live on an island and harvest coconuts. Not to mention the market might be radically different by the time you even launch.

If you have an idea, and you want to see it birthed, and you know what it will take, and you can write a plan that shows it--because you did the hard work to see it through--then birth that bad boy.

Term sheets aren't all horrible. Don't ask for the moon, be realistic, get what you need and make sure you don't have to go get more. Don't get an office, be frugal, hire the best, negotiate well, partner with those who are assets and share the love.

This isn't rocket science but it does take careful thought and solid reasons. Do your homework and make the right decision for you and your product.

-a

<comment><USER3> If a term sheet isn't horrible, then the lawyer you're using is the one the VC firm hooked you up with!

Sounds like you believe you need to spend it all before you make anything.. I think you've got it backwards. If someone wants to charge you $10k a month, find their competition and get the same service from them at a higher unit rate but paid for out of actual usage. Negotiate.

"Not to mention the market might be radically different by the time you even launch."

you're making an erronous assumption-- the VC treadmill has you betting the farm on the state of the market at some point in the future.

Building a viable business means that you are _less_ dependant on the state of the market, not more.

One company I worked for was profitably doing consulting when we took VC funding. They insisted that we close that business to "focus" on the product... the result was, when all was said and done th company ended up selling for less than the consultancy was worth and the founders got a fraction of it -- because the VC business took most of the money due to their preferences. Venture Capital killed that business. Now a decade later, the market that company was in is a huge multi-billion dollar market... if they'd kept the consulting business and kept at it for another three years-- they would have been in it when it finally did take off.

Bottom line-- you can't be frugal when taking venture capital. Keeping a viable consultancy was percieved as a threat to the business-- even though it would have allowed us to hire more engineers on the commercial side. ITs almost as if VCs want you completely dependant on further funding from them. (Or they are just totaly incompetant at business.)

<comment><USER2> Above and beyond you have to have advanced common sense. If a VC wants X, but you're not a moron, and you want to do Y, don't go with the firm that is selling you bad advice. If it's too late then you didn't do enough due diligence before it was too late. That's not anyones fault but those who signed the papers.

Time to market is deeply important. Not to find a herring to point at but go create another Youtube or Twitter today and tell me how the post market absorbs it. If a market grabs enough momentum to get to a kool-aid point getting the weight of the market is going to be difficult.

While I don't believe our product is so important, I believe some of the deals and ideas we have are. If delivered properly placement has concrete potential which locks a company in for a good term, not to mention a good vector for growth. They don't say strike the iron when it's cold.

Like you've said in your other funding YC talk, cases may be different. There are thousands of variants that can effect ones viability, needs, realities, and needs.

As well I'm not making any assumptions on VC's talking points. They are our own from our own market research, trends, and skull sessions. We're seeking more angels than VC's anyhow since VC's play a game we're not really interested in. Not that good VC firm's don't exist. The funded is showing us that the cloth isn't always equal.

Good contemplative stuff though, none the less!

</comment></comment></comment><comment><USER4> I think you make a lot of very valid points and credit to you for dealing with them candidly.

IMHO I dont think there is a right/wrong answer to taking VC money/raising funding in general. I think the absolute wrong answer is raising VC for the sake of it and not having your eyes open as to the consequences.

Otherwise it really comes down to your own circumstances - if you want to go for a massive hit then VC is a great option. If you want to build something slowly then self-fund. If that's not financially possible or you want to scale faster than you expected, raise angel. Either way, make sure it's your decision - that's what really counts.

<comment><USER3> Really, its backwards. Speed to market is a factor of team size-- the more engineers you hire the slower you are to get to market. So, VC funding slows down the rate of feature development.

A small tightly focused and really motivated team will out compete a group of employees funded by VC everytime.

And, if you look at it from the perspective of the opportunity value-- you will get more massive going it alone than going with VCs. Both because of the massive dilution of venture capital, and because of the significantly decreased chances of success.

Scaling should never be a problem-- you should outsource everyting but engineering and scalability should be the problem of your hosting provider. (or manufacturer, etc.) At the time that you really need to scale you will have plenty of money to pay for it. And because you outsourced this (something that is often harder to do in a VC backed business) you have people who are more capable working on it.

Course, I'm presuming we're talking about businesses that make something people want to pay for.

If you're building a youtube like business, then VC is the onyl way to go-- you're just gambling on some mebulous chance of profitability or getting acquired for having massive pageviews... and when gambling its always better to do so with someone elses money.

</comment></comment><comment><USER3> Unless your product requires you to build a factory (and even if you're in the manufacturing business its highly unlikely that you can't profitably outsource even manufacturing) -- then you absolutely shouldn't take VC funding.

YC, Angel, Friends and Family, maybe even a couple million (to last several years)... but not VC funding.

VC funding is for people who would like to spend four years working like a dog for a %1 chance to get $10M in payoff...than the alternative of four years working like a dog for a %400 chance of getting a $1 million payoff.

The value of these two opprotunities are $100k for the VC route and $4M for the independant route.

But, like contestants on "Deal or no Deal" they don't do math and they go for the big score instead of the sure thing. You only hear about the people who get the big score- they go to conferences and they start investment funds. but for each of them there are 100 or mor equally talented people who went the VC route and are now employees somewhere because the VC killed their company.

The big difference is when you get on the VC treadmill, as pointed out, the only options viable to the VC is IPO and acquisition... and you'll be diluted all to hell. Worse, you'll hire too many people spend too much money and lower your chances of success.... because you're spending that money before you know it works. And you pay in equity for the priviledge of lowering your chances.

On the other hand, if you angel fund, you can quickly determine whether the business is viable, and if it isn't, you only spend a few months on it before trying another idea. In four years you should be able to try 16 businesses .... but likely you'll make $1M per year doing it. And at the end of it, if you've failed and you've got a business that's throwing off $400,000 in cash for you for profit (your share) you could stop working and live on that $400k. The 99 out of 100 times that your VC backed venture fails, you've got nothing to show for it. So, even if you "Fail" and have a business worth $4-$8M, you still win.

One of the commentators had an excellent and underrated point: "And thats the rub. Every lawyer, finance, and admin guy you run into at a VC firm will think they know your idea better than you, and worse yet, better than your intended customer.

Sure, they will give you funding, but along with that funding comes their screwed up way of thinking that no matter how much you, because they have money, or an mba, or a bar number, that qualifies them to tell you how much more they know than you."

Never met anyone associated with a VC (including Seqoia) who wasn't dumb money but thought they were smart money. (except Guy Kawasaki, who is smart enough to realize he's dumb. If you think you're smart, you aren't, if you think you're dumb, you're smart.)

<comment><USER2> "YC, Angel, Friends and Family, maybe even a couple million (to last several years)... but not VC funding.

VC funding is for people who would like to spend four years working like a dog for a %1 chance to get $10M in payoff...than the alternative of four years working like a dog for a %400 chance of getting a $1 million payoff."

Ahh! I understand you better. This type of VC deal is something I would probably be pretty scared of.</comment></comment>


Mint: A programming language for writing single page applications - <AUTHOR> https://www.mint-lang.com/ <comment><USER2> My first thought: an entirely new language for one domain?

But then I started looking at the examples and how styles and an xml-like syntax are given first-class support and it makes sense. It really is a hard problem to shove into an existing language, evidenced but all the transpiling that goes on now. Thanks for sharing!

<comment><USER3> Agreed. I browsed through the guide and at least at first glance it looks very well designed. Things like naming a node or a component (<Item as item>) that can then be used elsewhere look really clever. I'm curious what the actual code looks like for an example app like todomvc.

Edit: coffee -> code

<comment><USER4> > I'm curious what the actual coffee looks like for an example app like > todomvc.

I've never seen the term 'coffee' used in this context. Is this a typo or some kind of slang/reference?

<comment><USER5> That was a typo and he meant covfefe.

<comment><USER4> I appreciate the joke :) but I really didn't get the obvious at first (code => coffee autocomplete). I was distracted by the fact that this language transpiles to JS so coffee might be a reference or something.

<comment><USER5> oh haha, I thought he was referring to coffeescript for some reason. code => coffee autocomplete makes much more sense

</comment></comment></comment></comment></comment></comment><comment><USER6> I don't really see a major advantage of this over using create-react-app with Typescript and libraries like Styled components for styling and react-router for routing. All of the batteries-included features can be easily handled by libraries and tools that are already well developed.

<comment><USER7> Author of the language here, I think it is a major advantage for several reasons:

\- the documentation is in one place instead of several places

\- the dependencies of a Mint project is usually a few megabytes since everything is included instead of hundreds of megabytes (I have a production app that does not have any dependencies at all)

\- only need to learn one (compact) thing, instead of many complex things (complex since there is no compiler to make it simple)

\- only need to update the code once there is a new version of the language not every time there is a new version of a dependency

On top of the libraries mentioned the language also includes a formatter, package manager, builder/dev server and testing environment, also for which you would need to add dependencies.

All of these add up to less cognitive load so I can focus on building the product instead of managing the development environment.

(edit: formatting)

<comment><USER8> (Not GP.) You've clearly put a lot of work into this, a lot more than a lot of people could.

I think a lot of people will gloss this over, but I thought about what I would want if I put the same amount of time and effort into something, and I would want honest feedback.

> \- the documentation is in one place instead of several places

For developers with a few years experience, they don't generally have trouble finding documentation for disparate frameworks and languages. The bigger trouble is usually finding out the latest best practices.

> \- the dependencies of a Mint project is usually a few megabytes since > everything is included instead of hundreds of megabytes (I have a production > app that does not have any dependencies at all)

There are a lot of use-cases where the bloat of the web app isn't really an issue. But for those who do (and I'm not sure who they are), it's still a somewhat unsolved problem.

> \- only need to learn one (compact) thing, instead of many complex things > (complex since there is no compiler to make it simple)

I don't think that's necessarily true. They would have to learn all the same _concepts_ which exist within Mint. (And if not all the same concepts exist within Mint, then it's not up to par.) What's different is the syntax, and the semantics of how these concepts glue together _within Mint_. This generally means it's actually _harder_ to learn a new all-on-one language than it is to learn React + TypeScript + styled-components for someone who already knows JS.

> \- only need to update the code once there is a new version of the language > not every time there is a new version of a dependency

Then how are the dependencies getting updated when there's a new version? If I use a currency library in my Mint app, how can I update it, and test it locally to make sure the updated library still works with my app? At some point we have to deal with dependencies and updating them...?

<comment><USER7> Thanks for the feedback! I really appreciate this ;)

All of your counter points have merit, I think it boils down to preference at this point, but what I can tell you that after doing Elm for a while getting back to the JavaScript ecosystem is a nightmare and Mint is my way out of that (for SPAs).

> I don't think that's necessarily true. They would have to learn all the same > concepts which exist within Mint. (And if not all the same concepts exist > within Mint, then it's not up to par.) What's different is the syntax, and > the semantics of how these concepts glue together within Mint. This > generally means it's actually harder to learn a new all-on-one language than > it is to learn React + TypeScript + styled-components for someone who > already knows JS.

I'm not entirely convinced that that is the case, TypeScript can be it's own language in itself. Not really a problem now but a few years back people struggled to even learn new versions of JavaScript in itself, let alone a the libraries with their different paradigms.

Also to get where Mint is you would probably need to learn: TypeScript, React, styled-components, Jest, prettier, Webpack, Redux (or one of the alternatives), Babel and that's just from the top of my head.

> Then how are the dependencies getting updated when there's a new version? If > I use a currency library in my Mint app, how can I update it, and test it > locally to make sure the updated library still works with my app? At some > point we have to deal with dependencies and updating them...?

There will be dependencies sure and you will take care of them as usual, what I am saying is that with Mint you will only need a few.

The application I've been developing ([https://www.base- api.io/](https://www.base-api.io/)) and the front-end is in Mint and it has 0 dependencies (other than the standard library which is built in).

<comment><USER8> > I'm not entirely convinced that that is the case, TypeScript can be it's own > language in itself. Not really a problem now but a few years back people > struggled to even learn new versions of JavaScript in itself, let alone a > the libraries with their different paradigms.

I think that's just a coincidence. We happen to know people who are starting to learn JavaScript (and learning new languages is always a struggle), and so naturally they also struggle to learn TypeScript when faced with those concepts for the first time. But this is more The Evolution of a Programmer kind of thing.

> Also to get where Mint is you would probably need to learn: TypeScript, > React, styled-components, Jest, prettier, Webpack, Redux (or one of the > alternatives), Babel and that's just from the top of my head.

A lot of these (Babel, prettier, Webpack) just need a good starter configuration and can be mostly ignored afterwards. The rest mostly boil down to concepts: Jest stands in for any testing framework, there's nothing special about it; TypeScript for a mostly-basic type system; React for a basic declarative UI framework; styled-components for mostly-just CSS encapsulation.

> There will be dependencies sure and you will take care of them as usual, > what I am saying is that with Mint you will only need a few.

Ah I understand better now what you meant: the concepts that come built into Mint are ones you don't have to worry about getting an external dependency for.

<comment><USER9> > A lot of these (Babel, prettier, Webpack) just need a good starter > configuration and can be mostly ignored afterwards.

Hilariously, the more difficult, time-consuming work I've done over the last couple of years has been getting these kinds of configurations setup appropriately for my org. It always feels like an enormous cost with hidden tech debt.

</comment></comment></comment></comment></comment></comment><comment><USER10> Mint appeals to me a lot. The two bits that have stopped me from diving in past times it's cropped up are:

\- No way to render a page outside of a browser. It'd suffice to be able to run a CLI tool or import Mint as a library and generate static HTML for a given component and input data.

\- The fact that two record types can't coexist with the same key names and type signatures. I worry this will lead to all kinds of headache dealing with dependency compatibility: any change to a record definition, even an internal one, becomes a breaking API change, and some libraries may not be usable together due to coincidental naming. I would much rather the compiler require that I annotate record literals with explicit type names to disambiguate, ie:

        record Todo {
          label : String,
          done : Bool
        }
        ...
        foo = Todo { label = ..., done = ... }

Haskell dealt with a similar problem for a long time and it meant that best- practice code gave all its data type keys unwieldy prefixes to disambiguate between data types that were imported together (todoLabel and todoDone vs issueLabel and issueDone). In Mint I guess you'd also want to stick the project name in, too (so myLibTodoLabel).

</comment><comment><AUTHOR> Note: I learned about this from a comment here [1] by gdotdesign, who appears to be the main contributor [2].

[1] [https://news.ycombinator.com/item?id=22245742](https://news.ycombinator.com/item?id=22245742)

[2] [https://github.com/mint- lang/mint/graphs/contributors](https://github.com/mint- lang/mint/graphs/contributors)

</comment><comment><USER11> Having read through this, I fail to see any benefits over using existing tools like Clojurescript+React. What am I missing?

<comment><USER12> Clojurescript is unmaintained and full of bugs, the same for the cljs parts of core.async.

<comment><USER13> Fake news. Clojurescript today is a much more pragmatic and production ready option, more popular than Elm, Reason and Purescript, better than Scalajs and KotlinJs and definitely much better than JavaScript and Typescript.

</comment></comment></comment><comment><USER14> Mint needs to up their "we are better than X because..." message because they are stepping into a pond with lots of big fish.

From what I can see: it has zero incremental development. You must start with Mint and haul in other new tools, or it doesn't work. That's a nonstarter, and part of the reason why VueJS was so easy to integrate.

I read the Guide (briefly) and don't see any advantages. It looks like they thought-out the most trivial scenarios, and that's it. Recursive components? Data sharing? Messaging?

<comment><USER7> Author here, yeah noted. I should do a better job on selling the language but it's not easy doing this as a single individual.

I can however elaborate on the points raised:

\- Recursive components: you can do it, the type-checker allows it and it works, or goes into an infinite loop if you don't exit correctly.

\- Data sharing: I don't know what you mean by this. If it's data sharing between components you can do that by creating a store and connect as many components to it as you like.

\- Messaging: I don't know what you are referring to? Websockets? Http? between components?

The fact is that there is some many things built in that it is hard to fit it on a single page above the fold, that's why I would say it's advantages is: it's the only thing you should need.

> You must start with Mint and haul in other new tools, or it doesn't work.

Could you elaborate on this?

<comment><USER15> I think GP means that you cannot try out Mint in existing toolchain/codebase without rewriting it from scratch with Mint, which is a deal-breaker. The main selling point of VueJS and Elm (if I remember correctly) is that you can try it out in your existing code (even though with non-trivial setup).

Another problem with a framework especially for UI, is that you need a network effect, that is really a good chunk of people who had tried it in production and could vouch for it, so that other folks can atleast give a thought about giving it a try. This is important given the rate of UI framework churn and JS fatigue that people have gone through in recent times.

Personally, as an UI engineer who has familiarity with almost all of the existing libraries/frameworks/toolchains this looks refreshing and would not mind trying it out.

<comment><USER16> VueJS and Elm are not the same thing. Vue is just a JS library. Elm is a an entire language with its own tools and ecosystem.

<comment><USER15> Yet, they are same when it comes to the value proposition of trying it out in the existing code base right? Since my original comment revolved around that I took those two examples (instead of say React and Vue)

</comment></comment></comment></comment></comment><comment><USER17> I'm waiting to see Single Page Applications that just use Web Components from the browser.

[https://developer.mozilla.org/en- US/docs/Web/Web_Components](https://developer.mozilla.org/en- US/docs/Web/Web_Components)

<comment><USER18> A lot of people are waiting for Web Components folks to answer how you're supposed to render them without JS (i.e. server-side renders)

<comment><USER17> Yeah, I am too, although I'm not entirely opposed to using them with JS, it would be nice. I always wondered why you can't reuse HTML code. I think Components are the obvious way forward.

</comment></comment></comment><comment><USER19> I'm curious. A question for the author: What is it that you're aiming to improve over Vue + Typescript? Vue is opinionated and comes with single file components, a router, a store etc.

<comment><USER7> What I am aiming for is to move away from writing JavaScript or minimize it to the level where it's more controllable.

I've come from Elm where it is done in a very good way, but it's too restrictive, and I like react and it's expressiveness so I wanted to combine the two.

Vue is really good but at the end you are still writing JavaScript which is really hard to do in a safe way. And from my experience Typescript isn't 100% safe as well.

<comment><USER20> > What I am aiming for is to move away from writing JavaScript or minimize it > to the level where it's more controllable.

Why is this a goal? Could you elaborate?

> And from my experience Typescript isn't 100% safe as well.

Does it need to be? In my experience, enforcing reasonable standards (don't allow escape hatches like the `any` type, or the `// @ts-ignore` comment band- aid) fosters pretty strong interfaces. I haven't really needed more from the type system. Has your experience been different?

<comment><USER21> JS is on an extreme end of the spectrum of language inconsistencies, and a lot of developers with extensive experience in other languages strongly prefer not to use it. That's partly why there are so many languages that transpile to JS so you don't have to suffer though actually _writing_ it.

Further, UI development is an area where things can get messy very quickly. "Safe" languages often greatly minimize the kinds of bugs that are very easy to write in JS. This is one reason why Elm and Clojurescript have had years of adoption -- they by default make values immutable (and their entire programming paradigm doesn't actually require mutating most values ever) which removes a large class of common UI errors. There are other benefits as well.

</comment></comment></comment></comment><comment><USER22> I really dislike the choice of `fun` to represent function, `func` is acceptable, `fn` is acceptable, I don't even mind `def` in Python, but `fun` is a widely used english word that is making me do mental gymnastics while reading mint source code.

<comment><USER23> Walder's Law states that:

          In any language design, the total time spent discussing
          a feature in this list is proportional to two raised to
          the power of its position.
               0. Semantics
               1. Syntax
               2. Lexical syntax
               3. Lexical syntax of comments

In future, I would suggest not nitpicking the most trivial, irrelevant detail of a language's design. Please consider the level of effort it has taken to create this language.

<comment><USER24> Small details are off-limits to criticism?

<comment><USER23> Yes

</comment></comment></comment></comment><comment><USER25> I actually love this. I don't foresee it replacing JS|TS for major app development but this looks like the perfect fit for a certain subset of SPAs. The syntax does a wonderful job of describing exactly what is needed for that subset of applications

<comment><USER7> Thanks :) I love reading comments like this ;)

</comment></comment><comment><USER26> If the authors are reading this: The home page has some weird width issues going on for me where content starts somewhere off the left of the screen and ends somewhere off the other end. To compound the issue, I cannot scroll to the left.

Device: iPhone XS (fully updated)

<comment><USER7> Thanks for reporting this, will look into it!

<comment><USER26> Thank you

For additional reference, it seems to be alternating sections starting below the fold (man I hate that phrase)

</comment></comment></comment><comment><USER27> This appears to be a compile-to-js language with a compiler/related tools written in crystal.

An interesting use for a DSL.

</comment><comment><USER28> Not imaginative enough IMO, I'm assuming since it's a new language you can design it without the limitations we've had to design around in JS.

The magic sauce for me is a global state data structure where all my app state goes into. And it should just be data. I don't need to wrap it in 'semantic' constructs.

And then I need an easy way to query that, something more expressive than `get-ins` like `state.path1.path2.value`.

However the state is accessed the component should just update. I don't want to provide or connect.

<comment><USER29> Global state in one happy place is basically what we've done with Blazor.

Instead of using cascading parameters and other ridiculously complex ways of passing state around, we inject stateful services as scoped dependencies per client request. These are effectively just POCO models with a functional interface for mutating state. Then, we take dependencies on these throughout the web application (I.e. within each component or page). An example of one of these used heavily throughout would be UserSessionService. Certain aspects of the application may have their own dedicated state machines like LoginService (which is utilized only during the login process). LoginService takes a CTOR dependency on UserSessionService and it all plays together really nicely via Microsoft's DI.

We've even wired events from server-side directly into these services so its not just for handling the client-specific interactions either. Integrating server-side events is trivial. It felt a little weird at first, but it seems we are moving in a much more sustainable direction now. I can actually test my UI state machines in complete isolation from an actual browser. Also, because they are simply .NET implementations, we can reuse these for other aspects of the application.

<comment><USER30> This sounds very similar to what we've been doing with XState[1] and React.

We have a "service layer" for React made up of state-machine-based services (although reactive services based on RxJS observables works as well). We also created associated custom hooks that allow developers to easily "inject" a service into their React component (use use React's Context API for our "DI container"). From there they can read the service state, or send events to it to trigger behaviour that is encapsulated in the service itself.

We even have the same "most used" service; a UserSession service manages OAuth based login flow and session management.

The best part of this approach is that our service layer started in an Angular based proof-of-concept before we lifted-and-shifted it all into React.

[1] [https://xstate.js.org/](https://xstate.js.org/)

<comment><USER9> How much does the react wrapper do? Ie how easy would it be to support Angular or Vue? I imagine just aligning syntactic conventions?

<comment><USER30> React wrapper doesn't do much, and it is very easy to port to other UI frameworks.

Here's a follow-up post with a gist of what the React integration looks like.

[https://news.ycombinator.com/item?id=22294087](https://news.ycombinator.com/item?id=22294087)

</comment></comment></comment></comment></comment><comment><USER31> From a - admittedly superficial - first look I couldn't understand if mint is able to produce a static file as well.

If it Didi I think it would be a major advantage over react, angular and Vue. Of course all these support the creation of a static file, but it's not trivial and it feels like an hack more than a feature.

Therefore if mint has/had the option to produce (also) a static website, I think it would have very nice use cases

</comment><comment><USER32> Mint looks nice, but I am worried about the tooling. It feels it's trying to do too many things.

Don't get me wrong. I really applaud the effort and it's great. I'm just telling you why I wouldn't use it. I've been building SPA's for over a decade and have had my lessons. Things are complex for a reason when it comes to large code bases contributed to by a large team.

At a previous workspace we used pug(jade). Great language but it's just not about the language. The tooling around the language really matters. You want linters, prettifiers, typecheckers, sourcemaps, dependency analyzers, good ide code completion, auto doc generators, etc to work with it.

Making a language with good ecosystem is really hard.

That's why I prefer to stick to well supported proven basics.

Typescript, prettier, jsx, eslint, webpack, stylint, scss, css modules etc

Small well supported tools that do one thing really well and work with other tools. (Unix philosophy)

</comment><comment><USER33> I like the idea of being able to use the same variables in css, js, and the rendered components, like you've achieved in this language. It seems like a problem everyone's trying to solve in different ways but there still isn't anything that feels just right. My gut reaction, without having tried this language yet, is that lacking finer grained control over everything the browser is capable of, there will come a use case that this language can't handle (or can't handle as nicely) as native browser languages would and such limitations will be major in any sort of complex application. That said, I'm excited to give this a try. Always appreciate novel approaches to the problems I face in my everyday work.

Side note—your site doesn't render well on a mobile device. The whole left side of the page is cutoff. Might want to look into that.

</comment><comment><USER34> Before I start this rant I want to say that I appreciate authors who put work into trying to solve hard problems. These are hard problems and I think at least trying to make a step in the right direction is a good step.

I feel like we are approaching the problem of frontend development complexity the wrong way. These new frameworks and domain specific languages fail to cut through the complexity of the real problem and instead mask the complexity with shiny new frameworks. These frameworks still all suffer from the same problems.

There are deeper issues that need to be addressed. The fact that their landing page doesn't work well on mobile is evidence of that. Assuming it was created using Mint.

<comment><USER7> I think you are right about that. Mint is not a solution of the whole front- end development but a part of that, it tries to solve the problem of single- page applications specifically.

> There are deeper issues that need to be addressed. The fact that their > landing page doesn't work well on mobile is evidence of that. Assuming it > was created using Mint.

Actually it's not created in Mint and that it doesn't work well on mobile is the evidence that I didn't tested it thoroughly :D

</comment></comment><comment><USER35> Clojurescript solves the impedance mismatch for front end apps elegantly. An all-in-one framework like Fulcro also solves the analysis-paralysis issue of making effective library choices for everything

</comment><comment><USER36> Looks like a similar idea to Elm

<comment><USER37> The Mint Guide page (Learn link) discusses Elm and it being one of the roots of this language.

> What is wrong with Elm?

> Elm has great developer experience, but it being a purely functional > language leads to some boilerplate code and makes it harder to learn. Also, > it's not possible to contribute or influence the language in any meaningful > way.

</comment></comment><comment><USER38> Looks pretty cool. I'd love to see a side-by-side comparing the same application in say, React/Vue/Angular/Elm and Mint.

<comment><USER7> I've done an article about comparing it with React it a while back, the code shown there might be outdated but not much:

[https://dev.to/gdotdesign/mint-vs-javascript- stack-15id](https://dev.to/gdotdesign/mint-vs-javascript-stack-15id)

<comment><USER38> That's pretty compelling. If mint sticks around for a while I will definitely consider it for future projects.

</comment></comment></comment><comment><USER39> Tried to read on mobile (iOS) but the second code block, maybe called state management, is clipped and not readable.

</comment><comment><USER40> From the install page:

> To easily install Crystal on MacOSX you can use Homebrew.

I think "Crystal" should be "Mint"...

<comment><USER41> Uh, Mint is written Crystal.

<comment><USER40> I realize that, but look at the page. It's pretty clearly a typo.

EDIT: it's been fixed now.

</comment></comment></comment><comment><USER42> Being able to declaratively write CSS properties based on the component state is pretty sweet. Ie you can put "if active" in your CSS instead of putting conditional logic on the markup. That's the first thing that jumps of the page for me with this project.

</comment><comment><USER43> This aims to solve all the problems that Flutter already does. Except now with XML syntax.

I didn't like how "uncommon" Dart and Flutter were until I used them. But I've really come around on both after starting to use them.

This though, cool, but I see no possibility of traction.

</comment><comment><USER44> Wow this is very cool!! I really like the syntax and how the components are structured

</comment><comment><USER45> I tried to learn something about who or what is behind this language/platform. The mint-lang website is not very revealing. Someone named Szikszai Gusztáv appears to be a core contributor to the GitHub repo.

<comment><USER7> I'm the author and main contributor of the language, let me know if you have any questions, happy to answer :)

<comment><USER46> So how does it work? Does it use a virtual dom? How is the performance? What about the bundle size?

The answers to those questions should be on your home page.

Also it would be great if you included it here: [https://github.com/krausest/js-framework- benchmark](https://github.com/krausest/js-framework-benchmark)

<comment><USER7> Mint uses React as the view layer anything else is done by either the compiler or the runtime(1).

So the bundle size should be around the same as react or smaller (the compiler can output optimized code) and the performance is the same.

[1][https://github.com/mint-lang/mint-runtime](https://github.com/mint- lang/mint-runtime)

<comment><USER46> Thanks. I skimmed over the docs but didn't find that mentioned anywhere.

Why not use something faster and smaller than React though like Preact or Inferno?

<comment><USER7> It is possible, but it turns out they are not a 100% compatible.

<comment><USER46> Not 100% compatible but much faster and lightweight:

[https://krausest.github.io/js-framework- benchmark/current.ht...](https://krausest.github.io/js-framework- benchmark/current.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER47> I don't see any mention of server rendering. I would expect that to be a necessary and fundamental concept for a language/toolchain specifically designed for building single-page apps.

<comment><USER28> I agree, but do want to say that server-side rendering is a lot more complicated than just "be able to render my app on the server as well". We went down that road with a large app and the team was stoked and promising how awesome it would be, but it turns out it just slowed down the experience and users hated it.

I'm a lot more hesitant about SSR now. Users don't mind spinning wheels as long as they can see something happening.

<comment><USER47> In a world faced with a climate crisis, client-side code faces the burden of proving that it is worth the value. Unfortunately, today companies are free to externalize their energy use by forcing users to run compute for them, in a significantly less efficient environment, and repeatedly. This insanity should not be allowed to continue.

A new language is in the perfect position to structure components so that they can be cleanly rendered on a server first, and rehydrated on the client as- needed. Trying to do that backwards will always result in less developer and user satisfaction. That doesn't mean it's right to just keep doing things the bad old way.

</comment></comment></comment><comment><USER48> This doesn't look sufficiently different to JavaScript with JSX.

<comment><USER18> Being similar enough to the technology a huge number of people use doesn't strike me as a _bad_ thing.

I don't think this is for me, but it's an interesting experiment and I could immediately grok what it was doing.

<comment><USER48> If the differences are only minor then what does it enable that the more popular alternative does not?

You're right the familiarity is a good thing though - just look at TypeScript!

<comment><USER18> > If the differences are only minor then what does it enable that the more > popular alternative does not?

Fair point. I think there's a tradeoff in there somewhere. The fact that you need to do things like wrap JavaScript in order to use it within Mint sets off all kinds of alarm bells for me. I still like the concept, but justifying an entirely new language (to myself, to my higher ups, to the company at large) is a high bar.

</comment></comment></comment></comment><comment><USER49> A thread from 2018: [https://news.ycombinator.com/item?id=17161533](https://news.ycombinator.com/item?id=17161533)

</comment><comment><USER50> Some of the stuff does t fit correctly on an iPhone 6-8 screen.

</comment><comment><USER51> This actually looks pretty cool. It's extraordinarily ambitious to create one's own language for frontend development, but I think you did a decent job.

</comment><comment><USER52> Can you comment on the differences/advantages compared to Elm in terms of type safety, helpful error messages, no runtime errors, and other features?

<comment><USER7> Since I used Elm before and after I lost interest I wanted have the same experience, so I created Mint.

It has a similar type system (HM) nice error messages, ADTs and if you don't do JS interop then no runtime errors.

<comment><USER52> I am considering using Elm soon. Can you talk about why you lost interest? Somethings that are better done in Mint than Elm?

<comment><USER7> Rounting, styling and data storage is much better and easier to do.

I lost interest beacuse I wanted to help/influence it's the development but my ideas weren't welcome and after two? years since then the problems are still the same without a solution in sight.

<comment><USER52> Thanks! I'll give Mint a try too! :)

</comment></comment></comment></comment></comment><comment><USER53> What happens if you want an entirely different kind of e.g. routing -- say traversal-based routing instead of simple matching-based routing?

</comment><comment><USER54> Seems kind of like QT for the web (obviously very different, but the same general idea). I like it, shall try it out.

</comment><comment><USER55> seems to be written in the crystal programming language, which i am discovering here too. looks very much like ruby to me.

</comment><comment><USER56> This looks like a DSL on top of React.

</comment><comment><USER57> Wondering how could I use my favourite React calendar and paginated table components with it.

<comment><USER7> Actually Mint uses React under the hood, I haven't figured out how to work with existing packages but it should be very possible.

</comment></comment><comment><USER58> All evolution to get at this moment we realize an HTA's were not too wrong

</comment><comment><USER59> one thing that confused me, why does incrementing an integer require returning a future?

</comment><comment><USER60> would be neat to see an implementation of the realworld app with Mint. [https://github.com/gothinkster/realworld](https://github.com/gothinkster/realworld)

<comment><USER7> There you go: [https://github.com/mint-lang/mint- realworld](https://github.com/mint-lang/mint-realworld) ;)

It maybe a little bit outdated but it should get the point across, also the demo seems to be offline, I'll check in the morning and get back to you :)

</comment></comment><comment><USER60> suggestion for your documentation page: add id's to your h2 elements so it is easy to send a link directly to the section you're looking at to a friend/coworker.

<comment><USER7> Thanks for pointing it out, will do ;)

</comment></comment><comment><USER60> no windows installer :(

I'll have to try out the docker container solution, I suppose. I uninstalled the WSL a while back, and don't really want to go back down that rabbit hole.

</comment><comment><USER61> Can I use backtics for inline CoffeeScript code easily?

</comment><comment><USER62> Not to be confused with:

\- Mint, the Linux distro

\- Mint, the web-analytics tool

\- Mint, the motion controller programming language

<comment><USER63> The Elixir HTTP client [https://github.com/elixir- mint/mint](https://github.com/elixir-mint/mint)

What is so great about the word "Mint"?

<comment><USER64> > What is so great about the word "Mint"?

It is English slang for something very good, very neat, very clever, very sharp.

<comment><USER65> [https://www.urbandictionary.co/define.php?term=That%27s%20mi...](https://www.urbandictionary.co/define.php?term=That%27s%20mint)

</comment></comment></comment></comment><comment><USER66> This feels like a repackaging of ideas that have been around for awhile. I'm not sure I see the value prop of this over stitching together more loosely coupled solutions that have more of a support base. This looks more cohesive overall, but that cohesion doesn't seem worth the headache of the (likely) possibility of this losing favor in a few years

</comment><comment><USER67> A new language might be fun to work on, but it's a massive negative in terms of anyone adopting a framework based on it, and in terms of the resources needed to maintain and improve the framework.

Likewise, it would be more efficient to embed one of the many existing "better CSS"s than do another one.

It's sad to say so, given how much work seems to have gone into this, but it looks DOA to me.</comment>


Can you talk about your most challenging technical problem? - <AUTHOR> https://blog.codonomics.com/2020/07/can-you-talk-about-your-most.html <comment><USER2> While I appreciate that the context of technical problems is vitally important... the examples given are product and team management problems, not technical. I have had technical problems where I discovered bugs in a 3rd party core product, even notably show-stopper bugs on their major releases, and had to work in tandem with their devs while leadership from both companies lurked on the conference calls. That is the kind of context I think of when I am thinking of difficult technical problems.

The danger of thinking of your own product management as the context that caused the problem is that instead of telling a story of high-pressure but successful collaboration, it is easy to fall into the trap of bitching about how your former bosses handled things. That is never a good move in an interview.</comment>