So You Want to Be a Security Expert - <AUTHOR> http://www.schneier.com/blog/archives/2012/07/how_to_become_a_1.html <comment><USER2> I have no idea what his list would actually make you, but it wouldn't be anything I'd consider to be approaching "security expert". So, here's my list, So You Want To Break Shit:

\- Learn C. Learn it well. That will give you the level of understanding you need of the way the computer works.

\- Learn Python or Ruby. If you can automate something, do it. Computers are better than you at repeatable tasks.

\- Learn x86 assembly (to start). Write some C code, compile it down to assembly, and read it; understand how the two map to each other. Get your friends to write stuff for you and decompile it back to C, and have them check your work.

\- Learn the basics (at least) of web development. Understand how web applications work, understand the constraints it puts in place, understand the interactions between the client and server.

\- Internalize the OWASP Top 10. Understand and be able to recognize and mitigate XSS, SQL injection, command injection, arbitrary file reads/writes, etc.

\- Grab old versions of open source software and rediscover known vulnerabilities. Grab the latest versions of open source software and discover new ones. Start off looking for simple things, and know it well.

\- Reverse-engineer network protocols. Pick a game, write a server emulator for it. This is a great way to use all your skills up to this point. It's also a lot of fun (it's how I cut my teeth).

\- Write a debugger. Understand the interaction between hardware, the kernel, and userland.

\- Understand, understand, understand. Ask questions. Ask a _lot_ of questions. In my opinion, the key to security is always asking "Why?"

These are in no particular order, and none of these is more important than the other. It also jumps all over the place, perhaps because that's what I do myself; I may be breaking a web app one day and reversing some hardware the next. But these are things I feel are important, and will give you some direction.

If anyone has any questions, wants direction, or anything else, my contact info is in my profile. The world needs more breakers.

<comment><USER3> I think this is a good list on how to get good at learning to jump between layers of abstraction with gusto, but I think ultimately this all needs to be motivated by a desire to actually exploit or reverse engineer something (as your latter bullets point out).

Learning C super well is important, so is assembly, so is other topics but I think fundamentally, step one needs to be: "I have product X. What is it trusting? What is it trying to protect? How do I get around it?" Then, find similar vulnerabilities and continue on stumbling to the ultimate goal.

<comment><USER4> Being able to jump between layers of abstraction --- in both directions, so I'd add "learn the browser JS DOM model inside and out --- has to be in the top 5, probably top 3 all time most useful software security survival skills.

<comment><USER5> What is the standard reference for DOM mastery?

<comment><USER6> Another document worthy of some study is <http://lcamtuf.coredump.cx/postxss/>

<comment><USER4> Yes! This is a great paper which made surprisingly little noise given how important it is.

The idea is: stipulate that no attacker can ever inject Javascript into a browser. Assume we solve that problem completely. Now, how secure are DOM- based applications? Turns out: not that much more secure. Lots of very clever examples.

</comment></comment></comment></comment></comment></comment><comment><USER7> If you want to start _doing_ security, I think it is more important to learn a fundamentally different perspective. It's sort of like learning magic, where the new perspective is 'What will my audience assume automatically? How can I get them to think that a given hat is empty?' (If it's a baseball cap and you drop it or invert it or so, for example.)

In security you're asking a similar question addressed instead at yourself. You're asking, "what am _I_ assuming automatically?" Schneier for example has talked about why pilots don't get reduced screening at airports. The problem is that the pilots who cry out, "this is absurd, I could crash the plane I'm flying, how could I possibly be _more_ of a risk to these people?" don't realize a certain automatic assumption: the assumption that the only people wearing the pilot's uniform are fellow pilots.

I tell this story occasionally, sorry if you've already heard me tell it. I once corrected a major security leak in an application I was paid to help develop -- the leak existed in the dev but not in production (thankfully!). The problem was that the team who had asked me to help out had made an assumption: "logs are good and are one of the only ways to create an audit/revert trail, we should log every request which comes our way just in case." This was built deep into the system. When I heard that, I was almost floored. As a proof of concept of the seriousness of what I'd realized, I looked through the audit logs for my boss's dev password and sent it to him.

It's a fundamental perspective shift: "if I wanted to break this, what assumptions could I use against it?" Whenever you see an implicit assumption you ask "how could that come back to bite us later?"

</comment><comment><USER8> I'm glad he mentioned the importance of doing and showing rather than just studying the material. But be careful-- like many careers, computer security favors specialization, and its easy to get more or less pigeonholed into a few areas. This is further complicated by the rate at which technology changes.

I spent 6 years in computer security right out of college, and most of it was PKI and assessments. To stay on top of other areas of security required constantly learning and doing stuff on my own, outside of work.

Even if you make it a profession, you have to keep learning and doing if you want to be considered an expert or specialist.

<comment><USER9> > _But be careful-- like many careers, computer security favors > specialization_

I agree that this is worthwhile to be careful of, but it very much depends on your employer as well. As with any career, find a good employer. So if you care about being a generalist, find an employer that needs you to be a generalist. I know for a fact that there's plenty of these in the security space.

</comment></comment><comment><USER10> I would be interested to see what the HN crowd's opinion on certifications are. Mr. Schneier mentions them in his post but they seem to be a sticking point in the community as a whole. I have been on the hunt for ~2-3 months now without luck so far. I am currently working on my CISSP though I don't have the experience to qualify (CISSP requires 5+ I only have 2+) for it so even if I pass I can only qualify for the associate level.

I'm not sure if the CISSP is the way to go but I want to feel as if I am moving forward on a career search so I don't get stuck in a rut.

<comment><USER11> IMO, he's seriously wrong about certifications. (and not really on the right track with this article in general; a good background in making stuff is key to knowing the tradeoffs in securing stuff...)

Maybe the perfect cert would be a useful tool for some purposes (corporate hiring, huge projects with consultants doing low-level IT, etc.), but those are crappy jobs (and not really "expert" in any way).

More importantly, the extant certifications are all crap. CISSP in particular. Get it if an employer requires it, but it's independent of your actual knowledge and learning process.

<comment><USER4> You will never, ever get the time you waste at a bad employer back. Employers that require CISSPs are far more likely to be wasting your time than not. The most important life lesson I've learned over the previous 10 years: be jealously protective of your time.

<comment><USER11> If you're in the military, you're basically required to get it, and it's not much more of a waste of your time than other things you could be doing there...

I personally got it just so that no one else in my company would ever need to do so; there are stupid companies which won't buy a product without integration, and where they have artificial requirements for integrators being certified. Given that it is only 1% of useless pain to enable 99% useful rewarding stuff, I found the sacrifice worthwhile.

<comment><USER4> This comment is a great example of why I'm training myself to be less factional and defensive about people who hold the certificate. The military thing hadn't ever occurred to me.

But to be clear: I believe pretty firmly that for technical / software security, the CISSP is useless.

<comment><USER11> CCIE Security is probably useful, although that's more CCIE + Security than some abstract security cert, too, and specifically for network security, and specifically the kind of network you get in a corporate environment, not a startup/saas.

I'm not sure how I feel about SANS/GIAC. Absurdly expensive IMO, but potentially actually has some value for sysadmins doing system security. I can't think of what CISSP is actually good for, except maybe trivial pursuit - crappy consultant edition.

<comment><USER12> Somewhat related - about 2 years ago, my employer had a bunch of us go through the SANS/GIAC GSSP training & certification. Some of the material was pretty boring and of questionable utility, but we had a good instructor and some of the hands-on parts where we were finding vulnerabilities was actually really fun.

I'm under no illusions about the certification's marketplace value and I doubt I would have ever paid for the course/cert on my own, but it felt like one of the better formal trainings I've been through in my professional career (which, granted, isn't saying a whole lot by itself).

Also, the certificate comes mounted on a comically oversized plaque, which provides some entertainment value.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> An important thing to note is that there are many different aspects of security, and therefore, there are many different types of security "experts."

Here at HN, many of us tend to view things in terms of how it relates to software development, but there is more to security than computer security, and the author mentions this in some of his other articles.

There are physical security experts, often having an extensive background in military or law enforcement operations. There are COMSEC custodians who are experts at implementing, operating and repairing a wide variety of cryptographic equipment, while also managing a program that generates, issues, maintains and disposes of an organization's crypto keying material. There are also security managers who at one time may have been experts in a specific domain, but are now called upon to maintain a bird's eye view of an organization's entire security strategy in order to develop a cohesive plan for minimizing the treats presented to their employer. There are intelligence analysts who make an organization more secure by using their expertise of social engineering to actively track down those who would wish them harm. Each of these types of employees is a security expert in their own right, yet none of these examples really need any knowledge of programming.

When you look at the content from the Security+, CISSP, and CISM, the classes lean heavily towards information security, but they address the other areas briefly. More specifically, they focus on information security from the perspective of a security manager. In other words, you don't take these certifications to gain technical expertise.

Unfortunately, many businesses fail to understand this, and so they end up making CISSP a requirement for their technical recruits out of ignorance. Does this make the CISSP a worthless piece of paper? Not really. It's just misunderstood by those whom are doing the hiring.

<comment><USER11> There are lots of subfields of security. (for instance I really wish I knew more about appsec; by far my weakest area, working on it.)

However, CISSP is a worthless piece of paper for IT security managers, crypto custodians, developers, pentesters, and auditors.

</comment></comment><comment><USER14> This is a good list for getting a job in information security. Becoming an expert? Not so much.

<comment><USER15> To be fair, though, he is writing it for people who want to get into the field, and you can't become an expert without getting into the field first.

(Well, you can, but it requires dedicating a lot of time and energy to it, more than most people are willing to give up after the normal day job.)

</comment></comment><comment><USER16> I have a better idea: Forget becoming a "security expert" and become a security-conscious developer instead. The world needs a lot more of the later.

<comment><USER4> Disagree. With possibly a few exceptions, secure software development is led by the breakers, not the builders. Some of the best of the breakers start out as competent builders, but either way: you can't defend something if you don't understand how it's going to be attacked, and the history of software security over the last 20 years suggests that we _suck_ at predicting what attackers will come up with. Great example: "buffer overflows are easy to fix; just make the stack non-executable".

One of the best secure developers in the world is Daniel J. Bernstein, and, two things you'd want to know about DJB: (i) he missed LP64 integer overflows, which got flagged by (pure breaker) Georgey Guninski, and (ii) he's a world- class cryptanalyst and breaker in his own right.

There's a reasonable "builders vs. breakers" argument to be had, I'm sure, but my experience suggests that overwhelmingly the people making this "world needs more builders and less breakers" point are people who are annoyed at the prospect of sinking the time into becoming a competitive breaker.

<comment><USER17> Disagree. You don't need to be a breaker to learn how things get attacked; being a fixer also works. I've broken a few things over the years, but I've learned far more by fixing things in FreeBSD which everybody else has broken.

(Maybe you don't think I'm a good secure developer, though.)

<comment><USER4> By definition, fixers aren't leading; they're reacting to what the breakers do. Also: you're a breaker. Face it.

<comment><USER17> Fixers are reacting, sure, but they're probably reacting to far more vulnerabilities than any one breaker could find. And reacting doesn't mean that you can't be leading -- it's entirely possible for someone to say "gee, OpenSSL seems to have lots of security vulnerabilities, maybe we should avoid using OpenSSL" and thereby pre-emptively immunize themselves against a wide range of yet-to-be-discovered breaks.

As for me being a breaker... I'd say that my security-related time is split roughly 90% building, 9% fixing, and 1% breaking.

<comment><USER4> That's how you spend your time _now_.

<comment><USER17> No, that's how I spent my time when I was FreeBSD Security Officer. Now there's more building.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> This is a good article, with links to good resources for those interested in security. One good place to learn is IRC. I must say though that a better title would have been, "So, you want to get into Computer Security..."

</comment><comment><USER19> On a related issue, I'd like to know if there's market for security (mostly appsec I guess) freelancers working remotely? The area interests me, but I have limited time I could contribute to it if it were only a hobby; OTOH, if it could one day transform from a mere hobby into a marketable skill, I'd be much more inclined to make time for it (The "remote" part of my questions comes from the fact that I don't think many interesting jobs will be available in my area, so remote's the pretty much the only option).

</comment><comment><USER20> i wanna be</comment>


A trillion dollar math trick: it may speed up db operations 50x - <AUTHOR> http://rjlipton.wordpress.com/2013/05/02/a-trillion-dollar-math-trick/

<comment><USER2> Pretty fun idea, but I think in practice it won't be this good

"For example, suppose the query is:

Select all the records with age in the range [21,31] and cell phones with area code 404.

Then the query needs only to look at two columns. All the other fields are completely un-needed."

That's not true. If you're selecting the entire record, you then need to go back and read the whole row for every record you select. In traditional storage formats you just return the record as you read it, but now you have to either jump around selecting fields one at a time, or batch up the records id's that are needed, and then only select the right records in a separate pass later.

</comment><comment><USER3> read the article. it's called an "index". :)</comment>


Ask HN: Best way to teach someone Python and Data Science in about a month? - <AUTHOR> I have an ambitious new student taking lessons with me online. His background is in Finance and Accounting, but he wants get into Data Analytics ASAP.
He has been watching videos on Udemy which cover numpy and pandas, but he has been struggling to understand what is going on. I feel he needs to take a step back and learn Python fundamentals.
I suggested we start by using Think Python[0] to structure our lessons, but he said reading the entire book (~200 pages, not like a traditional academic textbook) would slow us down.
Suggestions? <comment><USER2> Make him do it.

If a 200 page book is too much, he'll never make into Data Analytics role. Odds are that he needs more than 1 book on Python to do well.

<comment><AUTHOR> Thank you. I will relay the message.

For what it's worth, he said long-term he wants to really learn Python, but right now wants to be able to get his foot in the door with upcoming projects at his firm.</comment></comment>


Show HN: Echelon – A safe way to manage your company's Twitter accounts - <AUTHOR> http://www.echelon.io

<comment><USER2> May I just suggest a different name (see [http://en.wikipedia.org/wiki/ECHELON](http://en.wikipedia.org/wiki/ECHELON))

<comment><USER3> Forgot your password? Just visit our website [http://itanimulli.com](http://itanimulli.com) for convenient access to all records.

</comment></comment><comment><USER4> I must admit I didn't sign up yet - just read the homepage - but something that would be super useful on such a system is throttling tweets.

I've seen more than a few instances where an employee screws up or goes 'rogue' and either goes off on a rant or posts the same thing over and over. It'd be great to only allow employees to post, say, once per hour or whatever, so any problems could be contained.

<comment><USER5> Or perhaps an employee kill switch that deletes every tweet they've made in the last user-defined number of hours?

<comment><USER6> That is a great idea, thanks – will definitely add to the product ideas log.

\-- Pete, founder, Pixie Labs

</comment></comment></comment><comment><USER7> The invitation flow is very roundabout (even if you sheepishly admit it :-)), and the group account invitation doesn't seem to work at first. I tried to authorize a third-party account (inside of an anonymous tab) three times and the invitation didn't seem to be redeemed when I was redirected from Twitter to Echelon.

At first I thought something was wrong because, perhaps, you didn't set a "return to" URL to complete the invitation acceptance (which you should do if it's at all possible, to prevent your users from having to repeat an action). That was the behavior I expected since the invitation URL's log in prompt said "Sign in to accept".

What really happened is that the Twitter authorize call doesn't — in fact — trigger the acceptance of the invitation, it simply creates an Echelon account. I had to hunt down the "Notifications" section through the Menu while there was no sign where I had landed after the OAuth trip that there were any notifications waiting for me.

You should find a way to surface these notifications where you users are going to land after the Twitter authorize call, otherwise the experience is going to be as frustrating for them as it was for me — that is until they do the work your application should be doing for them: letting them know what actions they need to proceed with next in order to have a fully functioning account.

Now I have to say this is a cool app, I especially like the fact that individual user accounts are used and therefore everything can be logged so the whole team can be aware of the outgoing Twitter activity for each "group account".

<comment><AUTHOR> This feedback is really useful; we've struggled to nail the process as it is generally very cumbersome having to sign in & out of Twitter accounts (but it's the most secure way, as opposed to XAuth, which would be a possible alternative).

The key thing here is showing the user they have a new invite/notification, which we will add ASAP.

</comment></comment><comment><USER8> Working on something similar. A free Twitter manager for individuals/teams that includes analytics and scheduling. A couple of screens [http://i.imgur.com/0bCOizS.png](http://i.imgur.com/0bCOizS.png) [http://i.imgur.com/rYfCKdN.png](http://i.imgur.com/rYfCKdN.png) Interesting to see how you've done things, good luck! :)

<comment><USER9> Echelon looks quite good, but needs to include Tweet scheduling before we would be able to make the switch.

<comment><USER6> Hi Polynomial, this feature is the one we're working on right now :)

\-- Pete, founder, Pixie Labs

</comment></comment></comment><comment><USER10> Most of our Tweets come from events where users are on iPhone or Android, so access to Echelon through a mobile app is essential.

HootSuite offers this already, and it's only a little bit more expensive than Echelon, so why should we switch? Genuine question as HootSuite has its own problems so I'm always looking for alternatives.

<comment><AUTHOR> HootSuite is great, but it's also quite a hefty tool if all you need to do is let people tweet on behalf of n accounts. Also HootSuite works really well if you have a small team of people managing your social media but breaks down (or becomes expensive) if you need to give access to lots of people (this is where you end up with systems involving sharing lists of passwords!).

The idea behind Echelon (and its pricing model) is to promote sensible account security around the simplest of actions - tweeting. The bigger your team the more you pay but otherwise you can divide up your accounts however you want (different amounts of access for different people, etc).

</comment></comment><comment><USER11> I don't have any use for this personally, but it sounds like a very good idea, congrats!

<comment><AUTHOR> Thanks :)

<comment><USER12> Echelon is the name of a multi-country spy listening network that we here in NZ are part of. It includes the US.

"Safe" is the last thing I feel my data would be.

<comment><AUTHOR> Yes I noticed this name collision too. At least we didn't call it ECHELON :)

<comment><USER13> Or PRISM.

</comment></comment></comment></comment></comment><comment><AUTHOR> Appreciate any feedback. We're only just getting started, there's a long way to go :)

<comment><USER14> The service seems counter intuitive. You advertise "The safe way to manage your company's Twitter accounts." yet using the service would mean giving access to a third party. We all know that security is hard and you're creating online password manager - if it will be popular, it will gain unwanted attention.

Sure, you are using an access token and not a password for the accounts, but that's not explicitly said anywhere. I suggest you improve the trustworthiness of Echelon on the landing page.

<comment><AUTHOR> The landing page mentions that you don't have to share passwords, which is what makes it inherently securer than...well...sharing passwords. Agreed that perhaps it could be clearer that by using access tokens, access can be revoked at any time via Twitter directly which removes the risk (compared to people stealing passwords).

<comment><USER14> See, I'm bit confused here. I understood it so, that as a user of Echelon, as I wouldn't have to give the Twitter account password to colleagues. But what about to Echelon itself? How can I be sure that the Echelon won't be compromised and all hell wouldn't break loose? Does the account have one Echelon app authorized which then works as a middleman to the users?

<comment><USER15> Since only the tokens are stored on Echelon's server, any compromise might do some damage (tweets, bio change, etc), but you will not lose the account's password.

So that's a pretty good tradeoff if you ask me.

</comment></comment></comment></comment></comment><comment><USER16> Very nice, I like the flat design, but I don't think you're charging enough.

<comment><USER17> Agreed. Any company with enough employees to justify using this service can afford more than $10 a month.

</comment></comment><comment><USER18> I'll stick with HootSuite because of the functionality. It allows me to manage my Google+ pages, Facebook pages, and Twitter all in one place.

If you had the ability to do that, I may be interested.

</comment><comment><USER19> Nice try NSA: [http://news.bbc.co.uk/2/hi/503224.stm](http://news.bbc.co.uk/2/hi/503224.stm)

</comment><comment><USER20> How do you get rid of twitter's api limits, what if you have more than thousands accounts?

<comment><AUTHOR> We don't...it's not particularly heavy on Twitter API usage. What are you thinking of?

<comment><USER21> I'm assuming he thinks of the token limit which is only for "traditional twitter clients" [https://dev.twitter.com/docs/faq#10650](https://dev.twitter.com/docs/faq#10650)

</comment></comment></comment><comment><USER22> RIP CoTweet! :(

[http://mashable.com/2010/03/02/cotweet- acquired/](http://mashable.com/2010/03/02/cotweet-acquired/)</comment>


Vanity Fair's photo server lists all files (link downloads JSON) - <AUTHOR> http://photos.vanityfair.com/2015/03/11/

<comment><AUTHOR> I wanted to find a larger version of an image in one of their articles. Turns out if you GET the directory, it returns a handy JSON file of contents, with size metadata.

The root photos.vanityfair.com also spits out JSON for subfolders, so the whole thing is easily trawlable.</comment>


MIT Techtalks saturday - TED speakers, MacArthur fellows and more. - <AUTHOR> http://techfair.mit.edu/events/talks

<comment><USER2> "Kwindla Kramer, THE FUTURE OF COMPUTING: MULTI-USER, MULTI-MACHINE, MULTI- DEVICE"

MULTI ALL THE MULTIS

In all seriousness, multimodal/HCI/UI/UX/AI/psych peeps will love this

</comment><comment><USER3> For anyone interested in going, I highly recommend hearing Ed Boyden's talk on "Engineering the Brain." Fantastic research and an amazing guy.

</comment><comment><USER4> This looks sick, I hope there's going to be videos posted. Although, it _might_ be a nice weekend to travel to Boston...

</comment><comment><USER5> Anybody know how big the MIT population on HN is? SWAG (stupid wild ass guesses) welcome.

<comment><USER6> I would guess it's smaller than you think. I feel it's not that big of a subset of MIT CS majors who care about startups/the kind of things posted on HN. Including faculty, I'm going to guess 200-300 regulars at most and up to a 1000 with occasional lurkers.</comment></comment>


Show HN: Paperbot for Slack – a Pocket-like app for your team's shared links - <AUTHOR> http://paperbot.ai/?utm_source=hacker_news <comment><AUTHOR> Paperbot saves the links shared on your Slack channels and organizes them into a beautiful web or mobile app. It can also send you a summary by email so you don't miss the most important stuff. And it's free :)

</comment><comment><USER2> Free, powerful search functionality, beautifully rendered articles... this is one useful bot!

</comment><comment><USER3> So 1000s of big companies use slack and yet the appstore app has only like 50 installs?

Does not compute.

</comment><comment><USER4> Great time saver and a great way to share information on the go.

</comment><comment><USER5> The concept of this bot is really interesting.

</comment><comment><USER6> Saves time. Very good</comment>


Measuring SSL performance: RSA keys - <AUTHOR> https://certsimple.com/blog/measuring-ssl-rsa-keys

<comment><AUTHOR> Author here. Hope this is useful: not so much for my own results, but for the techniques you can use to measure this on your own infrastructure.

For example, the distance between your clients and your datacenters will have a large impact on your handshake latency.

<comment><USER2> Cool service, I'll likely use it for our next EV.

Some thoughts:

1\. Add details on re-issuing. Heartbleed, sha1 -> sha2, etc. It happens now and then. Useful to know if there is a charge etc.

2\. Mention Certificate Transparency (I guess you are covered here, if you use DigiCert).

3\. Pricing on adding multiple names to a multi-domain EV, e.g. 5 or 10.

<comment><AUTHOR> Thanks Sandstrom! All excellent suggestions, I'll post back here when they're complete. FYI reissuing is free, but I'll add that (and details) to the FAQ.

<comment><USER2> Also, I'd consider changing the name. It took me a mere ~10 min to forget the domain, and I tried googling simple cert only to end on `simplecert.co`.

Could be my bad memory, but perhaps there is another name, that would be more memorable? Your current is a mix of two pretty generic words -- it's reminds me of General Atlantic[1], only that you'd like yours to actually be memorable :)

[1] [https://www.quora.com/How-did-General-Atlantic-Partners- get-...](https://www.quora.com/How-did-General-Atlantic-Partners-get-its-name)

<comment><AUTHOR> I'll consider it - I do like CertSimple - there's BankSimple for banking (though they're now just Simple) and DNSimple for DNS, and also: the domain was available! That said, if you think of anything better feel free to email me - email@example.com

</comment></comment></comment></comment></comment><comment><USER3> Who actually needs the extra security? 112 bits of security is enough for everyone, bar none. If you have a 2^32 processors and they can crack 32 bits of encryption every second (unreasonable in each case), then it's still going to take you 9 million years before you can crack it.

If someone finds a new attack, it'd invalidate that number, but it could just as easily break any RSA based system, and it's not thought that such an attack is on the horizon at the moment (I think), or known by any entity (government or otherwise).

Meanwhile the performance difference is measurable and considerable; it's 10% of your loadtime if you're targeting 250ms.

I don't get why people set their security levels so high at all; it's like getting alien abduction insurance or downloading a bootlegged film in uncompressed AVI.

<comment><AUTHOR> I think that 'whatever breaks 2048 bit RSA will also likely break 4096 bit RSA' is pretty reasonable. I know at least one person using 4096 bit just for the SSL Labs score.

That said, do measure this on your own kit, particularly for SSL handshake latency: eg latency caused by additional CPU work during handshaking will likely be worse on a mobile site. Or someone might be reading this in 2019 and handshaking performance has increased significantly.

</comment></comment><comment><USER4> Seems very balanced and well argued.</comment>


10 Articles Every Programmer Must Read - <AUTHOR> http://www.improgrammer.net/10-articles-every-programmer-must-read/

<comment><USER2> The identical article on a different site was posted recently, with extensive discussion:

[https://news.ycombinator.com/item?id=7743952](https://news.ycombinator.com/item?id=7743952)</comment>


In All Fairness, Internet Explorer Still Stinks - <AUTHOR> http://www.sitepoint.com/blogs/2007/11/22/in-all-fairness-aEUR|-internet-explorer-still-stinks/

<comment><USER2> Let's not bash IE too much and just write that DAMN web2.0 app shall we?

You chose web to be your platform and you whine? Wuss.

Here's the problem with standard:

First you need to decide whose in

Then you need to have a meeting to talk about the agenda.

Then you need to have another meeting to talk about the next meeting.

Then another meeting to discuss a SINGLE TAG.

Then another meeting to debate about that TAG.

What happen when the consortium decided to move to a different direction? you'll have to rewrite your software.

You'd think all of the members could come at a certain Date/Day?

While I agree that MS might have a hand in sabotaging the standard but hey, they want to move forward faster than the train and they stick to their decision for a very long term.

<comment><USER3> Meh. Other than the admonition to just go out and develop your app, that's a pretty weak argument.

I'd rather have to tweak my sites when the W3C decides to phase-in a new convention than be forced to do so with every hare-brained browser upgrade that some company does.

Yes, the W3C takes a long time to discuss what casual users think should be trivial. That's largely because they're actually _thinking_ about the semantics and implications of proposed changes, not merely succumbing to feature creep.

Meanwhile, the implication that not all members can make W3C voting meetings is of no consequence whatsoever. If you were so concerned about the direction of HTML or CSS, you could actually get on the appropriate mailing lists and committees. How would you go about convincing IE to, say, drop the concept of "hasLayout" or, for that matter, fix any of the other numerous bugs in their CSS parser?

So yeah, Internet Explorer still sucks. The bureaucracy of the W3C is a complete red herring with respect to that issue.

<comment><USER2> MS would rather not change their codebase at the expense of market lead than to follow the new standard direction.

They want to decide their own fate.

What makes you think there's definitely ZERO politic in W3C? Semantics? implication of changes? feature creeps? bla bla bla bla bla you'll have Tim Bray.

Quit making feature creeps a big issue please. There are two directions for a software such as IE and Firefox: enhance or die. Enhance means more features. Quit adding features = stagnant = die.

Take 37signals as an example of "Less is More". Have you actually seen their customer complains? 1 million users.. pfftt, I have 2 inactive (free) accounts there. It's good only for about a week before I ditched them for good.

</comment></comment></comment><comment><USER4> ...and it still can't block pop-up ads.

</comment><comment><USER5> and most of the world still uses it so we have to deal with it. At least its not IE 5...

</comment><comment><USER6> Please take that down and stop spreading lies.</comment>


Ask HN: What would you consider a reasonable price for on-site training? - <AUTHOR> My company wants to hire an expert to train our team. The mentor is a Microsoft MVP, has published some books, presented at conferences and is the author of some OSS projects. The price for an AWS on-site training is $1000 per day and per person. Is this price reasonable? How much would you pay for this kind of services? <comment><USER2> I charge $5,000 per day for on-site training, to train a group of up to 12 people. People have told me I'm undercharging. People have told me I'm more expensive. People buy my services. (We train on Linux system administration related topics, and on Git for version control.) I have contributed (an appendix) to an O'Reilly book and have spoken at numerous conferences.

Speaking of which, I have a partner that does AWS on-site training -- contact me if you'd like a quote. :)</comment>


Stop Wasting Money On WebLogic, WebSphere, And JBoss Application Servers - <AUTHOR> http://blogs.forrester.com/mike_gualtieri/11-07-15-stop_wasting_money_on_weblogic_websphere_and_jboss_application_servers

<comment><USER2> There's so much wrong with this article. First of all, two ideas are artificially intertwined: (1) paying for an app server and (2) using an app server. JBoss is open source just like Tomcat. You can pay RedHat for JBoss support, and you can pay SpringSource (and, for that matter, others) for Tomcat support. Given how expensive Weblogic and Websphere are coupled with how incredibly good JBoss is, you would be hard-pressed to justify writing checks to IBM or Oracle. If you want support, use JBoss and write a check for 1/10 as much. Their support actually kicks ass.

"Use Spring, and you don't need an EJB-compliant container."

Huh? Does JdbcTemplate now count as a suitable replacement for a transacted ORM? Perhaps the author is referring to Spring's wrappers around other ORMs like Hibernate?

" Manageability is super important, but all I want to know is: 1) Is the server up; 2) is my end-user performance acceptable; 3) has my fault-tolerant architecture kicked-in to solve either problem?"

The open source version of tomcat his shitty management features. If you want even reasonable manageability, you'll have to pay for SpringSource's TC server or something similar.

"has my fault-tolerant architecture kicked-in"

What fault-tolerant architecture? Tomcat's clustered session replication?

"I highly recommend elastic caching platforms (ECP) since it is a technology that is independent of the application server and super-fast. "

You know who makes a really good open source one? JBoss :) And, it's transactional! But, you need a transaction manager if you want to do 2PC with your DB. And, guess what doesn't come with a TM? That's right, Tomcat.

"I question even the need for a container. Seriously, why can't Java web applications just run on the operating system like the containerless Microsoft .NET applications? "

[Note that I don't know a darned thing about .NET, so I'm speculating a bit] Ummmm...in this case, isn't Windows acting as the container? So, if I create a Linux distro with Java/JBoss included, does this satisfy his need?

"The next generation is elastic application platforms (EAP) that are containerless."

What's up with this obsession about "containerless" platforms? Isn't this like saying, "I want a platform, but I don't want it to be a platform"? The whole idea of a platform/container/framework is that someone else handles a bunch of cross-cutting concerns for you so that you can concentrate on the business-y aspects of your app. Servlets are much more convenient than binding to a socket and serving up HTTP by processing incoming byte streams. Furthermore, how can any of these in-the-cloud offerings be containerless?

</comment><comment><USER3> I'm not sure what I think of the article: many of the points being made didn't make sense to me. But I WILL say that I work for a major bank and we run 100% of our web applications on Tomcat. And it works great. The more expensive options (including JBoss which costs us money based on our contracts with RedHat) offer extra features, but they're not features we want or need.</comment>


NSA metadata program "consistent" with Fourth Amendment, Kavanaugh once argued - <AUTHOR> https://arstechnica.com/tech-policy/2018/09/even-after-nsa-metadata-program-revised-kavanaugh-argued-in-favor-of-it/ <comment><USER2> I don't like articles like this. The article itself is great _if you actually read it_ , but in a world of news aggregators I think most people read the headline and promptly come to their conclusion: Kavanaugh is another stooge, just like Scalia before him, claiming righteousness under the flag of "originalism" but in practice serving corporate and partisan interests through legal (read: gobbledygook) bullshit.

As much as I want these programs to be ended, the fact of the matter is that there's no coming back from a government with broken courts. If the supreme court ever gets to the point where one party is packing it and they're ignoring precedent, that's game over. People will be shooting each other. Don't believe for one second that our country or our time in history is special, it's on the table and as long as humans are forming institutions it will always be on the table.

You can equally argue that there's also no coming back from a government that no longer respects civil liberties, but that's irrelevant to a conversation about who we ought to put on the courts. Kavanaugh is looking to become a member of the least oscillative part of American government, and I'm personally glad that he places the sanctity of that institution over everything else --- yes, even the values of the constitution.

To anyone who reads the full article and comes away believing that Kavanaugh is in the wrong, I have to wonder what criteria you believe he _should_ be using to decide his position when answering questions like this. It's unreasonable to say, "He should just look at the constitution and see that these programs are at odds with the 4th amendment and we'll just fix everything in one fell swoop." The court can't operate like that.

Be angry at the precedent. Be angry at the legislators who wrote the Patriot Act. Be angry at the ISPs for cooperating so freely. Be angry at yourself for not making or using technology that makes their spying irrelevant. But don't blame the court for putting their responsibility to self-preserve over their responsibility to bail society out of our collective bad decisions.

edit: s/precedence/precedent/g

<comment><USER3> > I'm personally glad that he places the sanctity of that institution over > everything else --- yes, even the values of the constitution.

The Constitution isn't a set of "values" against which judges must assess law. It's a written set of directives and constraints. It's a contract that defines the outer scope of democracy.

The 4th amendment, likewise, doesn't articulate a set of "values." It says:

> The right of the people to be secure in _their_ persons, houses, papers, and > effects, against unreasonable searches and seizures, shall not be violated

Interpreting the word "their" does not require resort to "values." Google's server logs are not "your" data just because they record a hit from your computer. A phone company's call records likewise are not "your" data. It's not about "values," but the plain meaning of ordinary English words.

Blaming "precedent" here is even more misguided. Precedent long ago departed from the text of the 4th amendment, importing this expansive "reasonable expectation of privacy" concept into a document where the word "privacy" or anything like it never appears.

If we get the courts to strike down things like metadata collection in 4th amendment grounds, it will only be because the courts ignore what the Constitution _says_ , expands this precedent, and impkses one group's "values" onto the public.

<comment><USER4> Your argument is pivoting on the definition of ownership of data, that the fourth amendment doesn't apply to metadata because it's not 'your' data.

Even if we accept that premise, the fourth amendment still protects against "unreasonable searches and seizures". This means that the government needs to go through a meaningful review process to take possession of other people's property. This is unquestionable not the case with PRISM / FISA court approvals. _Blank checks for the government to access whatever data it wants is unreasonable searches and seizures_

The fact of the matter is that metadata is _somebody 's_ property and by forcing all third-parties to be unable to defend their data about their customers, the government denies enterprises the ability to compete in the marketplace on as many privacy features.

<comment><USER5> I'm reading a great book - Habeas Data - on specifically these issues. The idea of the metadata being separate from the actual data (in terms of surveillance and warrants) became a thing in the late 70s.. a case involving ATT in 1977 iirc.

Since that time, it's been generally understood that to get the actual data requires a warrant whereas the metadata just requires asking whoever is storing the metadata.

If we want to roll that back - and I do - we need to demonstrate that the metadata is just as telling/informative/sensitive/damaging as the data itself and therefore should be protected under the same standards.

</comment></comment></comment></comment><comment><USER6> A lower court judge asserting consistency of a binding precedent by a higher court is not news. The question is, what does this judge think, professionally, legally, without respect to precedent, which as a SCOTUS justice he's able to reconsider, are limits to state surveillance if any at all?

For at least 2-3 decades now, there's substantial evaluation and grooming of judges for SCOTUS that does not begin with their nomination by a long shot.

The big problem I see is the process depends on trust, and there is a distinct lack of it. If public trust can be correlated to some reasonable degree to public approval, the person doing the nominating is below the water mark on approval, and the body doing the advise and consent is even farther below his. And that explains nominee's low approval. The low public trust in two branches is now extending into the third, and regardless of the specific issues at stake no one should be pleased at further erosion of trust.

The Senate would be well advised to new rules agreeing to a 3/5ths majority confirmation for all federal judges, while also limiting the filibuster and individual senator indefinite hold on appointees. These things would improve trust in the process.

</comment><comment><USER7> From the article:

"...when your information went to a third party and when the government went to a third party, the existing privacy Supreme Court precedent was that your privacy interest was essentially zero," Kavanaugh said Friday"

This is a perfect example of the problem. The fact is that this metadata is collected without our knowledge, or is out of our control to limit its collection.

Just because a third party has metadata (obtained however, whereever and whenever), does not really give someone else (eg any government body or other private organisation) the right to claim that our privacy is null and void.

</comment><comment><USER8> Blame the judge for the laws congress passed. Blame the congress for the law the executive misused. Blame the executive for misleading the fisa judges. It's a perfect circle.</comment>


Rethinking 'Fuck You' money - <AUTHOR> http://www.tonywright.com/2010/rethinking-f-you-money/ <comment><USER2> His premise seems flawed to me. He says people should forget about F@#$ You Money because you can't depend on it to grow in this bad economy. That's reasonable.

But then he suggests you aim for "f@#$ you influence and credibility" because it "allows you to charge $30k+ for a 1 hour speaking engagement". But I know people who used to make $10k per speaking engagement and they aren't getting much work lately. In my experience the first thing people cut in a bad economy are the expensive speakers and while influence can probably get you a magazine column I wouldn't expect that to pay much at all.

So if the problem was finding a stable income in a bad economy his solution really didn't solve it.

<comment><USER3> I agree with you fully, the first thing to go when the economy isn't all that great is the stuff that you can do without.

So, no more lavish all employee trips to tropical islands and no more expensive speakers.

Time to get up and do some more work instead of talking about your previous successes.

And about dying penniless, who cares, you can't take it with you anyway. If you plan on passing your wealth to your kids better do it while you are alive and scale back accordingly. In plenty of countries that's the better strategy tax wise anyway.

<comment><USER4> I think it's not about _dying_ penniless quite so much as messing up your calculation by a year or two and _living_ penniless at the age of 87.

</comment></comment></comment><comment><USER5> Does the rule that you should get out of the stock market when random people tell you stocks are sure to go up apply in reverse?

If so, this is a pretty encouraging sign.

<comment><USER6> Top money manager at major Wall Street firm != random people. It doesn't necessarily mean stocks are about to go down either (Wall Street has certainly been wrong too, eg. 2000 or 2007), but it's a far cry from having a shoe-shine boy tell you to buy stocks.

<comment><USER7> No, I think "top money manager at a major Wall Street firm" and otherwise unattributed actually _is_ random people.

<comment><USER8> Bernard Lietaer (former central banker, successful currency speculator, one of the architects of what today is the Euro, and nowadays complementary currency advocate) starts most of his post-crisis conferences by asking the public to raise their hands if they believe that the worst of the crisis is past/ahead of us. Generally, most people will raise their hand to state their belief that the worst is still to come. Here's an example, in front of an audience of financial journalists:

<http://www.youtube.com/watch?v=OfMbYllbN6c>

(Skip to 2:40 for the actual start if you want.)

<comment><USER9> That doesn't necessarily mean you shouldn't buy stocks.

It is extremely unlikely that you will time the bottom of the market just right. So even if it will continue to get worse for a while, it might still be a good decision to continue buying into the market so that when the bottom does hit, you will have bought some stocks right around that time.

This all depends on your investment horizon, etc. etc.

<comment><USER8> There is still the possibility that a significant part of your particular investment vehicles will just vanish forever.

</comment></comment></comment></comment></comment></comment><comment><USER10> Repost but a quote from George Foreman about longshoremen. What is real wealth?:

Mr. Foreman, who stared down financial collapse as an adult despite a troubled, impoverished childhood, said he knew real wealth when he saw it. "If you're confident, you're wealthy," he says. "I've seen guys who work on a ship channel and they get to a certain point and they're confident. You can look in their faces, they're longshoremen, and they have this confidence about them...I've seen a lot of guys with millions and they don't have any confidence," he says. "So they're not wealthy."

<comment><USER11> in entertainment and sales, confidence is almost everything. The thing is, outside those fields, confidence is dramatically less useful. (granted, sales skills have a pretty wide applicability, but my point is there are jobs that don't involve much sales, where confidence doesn't matter that much.)

<comment><USER12> Confidence doesn't have to tie directly to the work you do. One aspect of confidence is knowing that you have the skill to find work, or the smarts and personality to get a new job and learn the necessary skills quickly. A person like that never needs to fear poverty, which is one aspect of wealth.

<comment><USER11> Not fearing and not needing to fear are two different things. Confidence can help get you jobs, but without competence, you will have a hard time keeping it.

</comment></comment></comment></comment><comment><USER13> If you ask me, the best way to invest the $2 million mentioned in the article in order to retire comfortably would be rental property. Take your $2 million and buy four $500K houses (or eight $250K houses, or whatever's appropriate). Pay an agent to take care of them, or do it yourself, depending on how much involvement you want. That should yield maybe $8,000 a month in rent, which after you've taken care of all the extra costs should still be enough to live on quite comfortably. Any capital gains you enjoy (and if you're smart you'll have invested in an up-and-coming area) are a bonus.

The best part is that you don't need to leave some money on the table to hedge against inflation, since in the long term rent will pretty much keep pace with inflation.

There are areas where this is a completely terrible idea due to rent controls and other landlord-unfriendly policies, obviously you shouldn't do it there. Also, avoid any area where you're likely to get undesirables as tenants.

<comment><USER14> Improvement on that is avoid family housing and go for industrial/commercial.

You can get a quality property with minimal leverage for your $2million. You will get a blue chip tenant like a national retailer or even a government department, and they'll sign a 10 year lease with mandated, upwards only, CPI- indexed increases each year. You won't even have to fork over 8-10% on a property manager because the tenant will maintain the property. And at the end of it, you'll have a property worth much, much more than what you paid for it.

Compare to a portfolio of houses, this strategy is higher return, lower risk and much lower management. The problem with family housing is that they are full of families, with all the associated problems that brings. Families split up, move out, get into trouble, have parties - blue chip businesses just keep their place tidy, make money and get on with life.

<comment><USER15> Commercial property is much more sensitive to cyclical downturns than family housing. 10 or 15 year leases are mostly in either downtown, prime location property (with very limited supply) or in new developments, where you only get them once. After that you're left to the market.

As usual, I think diversification if best for a stable portfolio. Mix various types of property, in various locations with various target markets, and then real estate is very sensible investment option.

<comment><USER14> Yes, I'm talking about a prime location property. That's why you are putting down $2million with leverage (say $4 million total buy).

Of course there are cyclical downturns, and also upturns. The idea is to get a low risk passive income, not to flip it and make money. Any blue chip property is going to stay blue chip regardless of market conditions, unless the location goes sour. But that's part of your due diligence.

</comment></comment></comment></comment><comment><USER16> 8% ROI is unrealistic, but a 2-4% is certainly possible especially with municipal bonds and insurance annuities. The former are also exempt from federal taxes, state taxes (if you live in the same state) and even local taxes (if you live in the same city). Both have guarantees against inflation (at the cost of lower yield) .

Nonetheless, I do think the is somewhat overrated. If I had fuck you money, I'd... write code, read books and papers. I'd have more freedom on how I write my code during working hours (and it's important not to understate importance of that, but the more senior you get, the more choice you have in what you work on what tools you use), but I'd also not have the focus that comes from working on systems that solve actual problems that individuals and organizations have; nor would I be solving these problems at scale that makes them much more interesting.

On the other hand, I'm pretty confident that if I were to spend my time chasing a big payoff I'd be working on problems that are far less interesting and more frustrating (which is almost axiomatically why these problems have the payoff). There's very few early-stage startups doing systems programming (and I'm speaking loosely here i.e., beyond just operating system kernels and file systems). For web companies systems programming only becomes needed as a scalability becomes a problem (in most cases it never does). The idea that _may be_ I'll be able to go back to doing what I enjoy most of the time if the business succeeds won't be enough to drive me: I already do that (perhaps that's why so few "home run" startups have come out of Google?)

Keep in mind that while stock options after product/market fit (pre-IPO startups, public companies) account for only a tiny percentage, the chance of a payoff is much higher (which, again, is why it's a tiny percentage: you're no longer taking a risk). That payoff is certainly no fuck you money (except in rare cases e.g., Google in early 2000s), but it's often sufficient in terms of giving you more freedom e.g., to go back to school for a Ph.D.

Were I to have a vision for a business (rather than a science project, which most of my ideas have been) based upon interesting technology (i.e., not a website) I'd certainly consider pursuing it, but even then I'd have no illusions: I suspect, I'd spend _more_ of my time doing what I don't like (general business operations) than what I do (coding); it would be the vision of bringing forth new technologies that solves real problems that would let me pull through that (as opposed to pure research or solving business problems with well known existing technologies) .

<comment><USER17> _8% ROI is unrealistic, but a 2-4% is certainly possible especially with municipal bonds and insurance annuities._

Amusingly, municipal bonds are in the top 4 likely candidates for our next set of major financial problems. The others are default on consumer ARM mortgages, debt on commercial real estate, and repayment on private equity. Interestingly, the largest class of investors in private equity funds this time around are government pension funds, which will just compound the risks for the munis. (The last time there was a bubble the investors were Savings and Loans institutions, the result was the S&L crisis of the late 80s/early 90s.)

<comment><USER16> > _Amusingly, municipal bonds are in the top 4 likely candidates for our next > set of major financial problem_

There's several kind of muni bonds, however, each with their own set of trade offs. The higher yield, the higher the risk. Some are guarantees, but only offer a very low yield. If the guarantees lapse, the problems are likely to be very deep, irrespective.

For what it's worth, I'm sticking with FDIC insured bank CDs across two banks, but I my expectation is more of "retain value" rather than "investment".

<comment><USER18> Insurance annuities are not as risky as municipal bonds. What's more, your state's insurance commissioner guarantees them, similar to the FDIC guarantee on deposit accounts, up to a certain dollar amount (I think it's something like $100K).

So you have $2 million in F-you money? Stick $100K each into 20 different insurance company annuities (staying below the guaranteed amount and diversifying your risk) and enjoy guaranteed monthly (inflation adjusted) checks for the rest of your life.

The only thing that will stop your income stream is the complete destruction of the entire US financial system. I suppose that is possible, but if that happens your money won't be safe anywhere, except perhaps gold bars buried in your back yard...

</comment></comment></comment></comment><comment><USER19> "His belief was that it was likelier to get worse before it got better and that it could be 10 years or more before the economy bounced back. "I think we'll see Dow 4,000 before we see Dow 12,000," he told me."

sure but as long as you believe the economy is going to bounce back over 10 years then if you took a good piece of your $5m and simply put it into an index fund now, in ten years (retirement) time you'd have a very healthy return on it.

i don't agree that now is a bad time to invest. i believe now is a bad time to invest for returns over the shorter/medium term but if you're talking about investing over a retirement time scale then it's during periods like the one we are in where big returns can be made.

</comment><comment><USER20> People who think 6-10% returns are unrealistic are sheep, and know nothing about real estate.

A friend of mine, a complete novice, was able to buy a multifamily unit in downtown San Jose for 500K and rent it out for 5000 a month. His down payment is 100K. His expenses(400K mortgage, insurance, taxes, etc) is 2500 a month. His rate of return is (5000-2500)x12/100K = 30% or so.

He did this while violating the #1 rule of real estate investing: you never buy at market price. You pay 70% of what stuff are going for on the MLS.

I invest in courthouse foreclosure auctions, and manage about 40% cash on cash returns.

Investing in real estate is a skill, just like building companies or coding. Imagine how much a typical person know about building web apps. That is how much a typical person know about real estate investment.

<comment><USER13> So because your friend managed to get a crazy-good deal on one property, everyone else is sheep?

Arbitrage opportunities do exist in the current market due to the current craziness, but the present foreclosure pace can't last forever. I don't know how long "70% of MLS" has been "the #1 rule of real estate investing", but how easy was it to snap up properties for those prices in 2005?

<comment><USER20> My point isn't that my friend got a crazy good deal. My point is that arbitraging 12% rental income against a 5% mortgage rate is so easy right now you can do it by buying right off the MLS at market rates, in one of the most expensive(price to rent wise) cities in the US.

The original poster was moaning about how hard it was in TODAY's environment to make money off of several million dollars in cash(!). I wanted to provide a counterpoint to that attitude.

<comment><USER7> If what you say is true, why is all this free money still lying around? Is there some systematic reason for why hedge funds don't do it, or why too few people bid on courthouse auctions?

<comment><USER20> It's not free at all.

Buying a rental property off the MLS means you have to manage it, and is like starting a small business. This is fairly safe to do even for beginners, and is a good way to leverage a few tens of thousands and a good credit rating.

Buying at courthouse auctions is a completely different ball game, and requires you to

1\. pay all cash(this eliminates 99% of competitors)

2\. research title and liens on the property(if you screw up you might end up buying the second mortgage instead of the first and lose everything)

3\. estimate the market price without being inside

4\. be there on weekday mornings

5\. have strong intestinal fortitude.

6\. have heard about them in the first place and have taken the trouble to learn the system.

The above are why you can get discounts of 30% or more off of market price.

Properties need to be individually researched, fixed up and resold. Someone has to physically go attend the auction. It's MUCH too messy for hedge funds. It's ideal for individuals, or groups of individuals, with cash and local knowledge. More and more people are showing up at my local auction, and good deals are getting harder to find.

Are you in California? Go to your local county courthouse at 10AM on a weekday and look for a circle of homeless looking people holding large cashier's checks. Depending on the state, it might be once a month on a designated weekend. Let me know if you want more info.

Stop reading HN and get back to work on chapter 35.

<comment><USER21> I would like more info. I am in the position to invest on this scale and the idea of being a landlord is not too scary to me (actually sounds kinda fun in a twisted way). Some questions off the top of my head:

\- What attributes constitute a good rental property?

\- Is it ever worth it to hire a manager?

\- How often do you have to visit the property? I live in SF but I understand being a landlord here is difficult due to renter protection. If I were to buy a property in an outlying area, how often would I need to visit it? I'd also like to take some extended travel in the future. Would being a landlord get in the way of that?

\- What else should I be thinking about?

Thanks!

<comment><USER20> Right a mortgage is 5% or so. So around 0.5% per month, roughly.

Rule of thumb #1 for rental properties is that if it can get 1% of its total value in rent per month in rent, you can get positive cash flow. 1.5% is worth your time. 2% is what you want to aim for.

Rule of thumb #2 is that the crappier the property, the easier it is to get a higher % of rent vs price. Multifamilies are in general more profitable to rent than single families.

Don't hire a manager when you're starting out. Do it yourself, invest close to home.

SF is too expensive, anyways. Everyone has their own comfort level trading off profit vs crappiness of neighborhood. I'm drawn towards slums, myself.

Richmond/Concord has some nice cheap properties, is close, and has good rents. Oakland is even cheaper but slummier.

The default first step would be to fire up realtor.com and craigslist, and compare prices versus rents. Start with the cheapest single and multi families in Richmond, Concord, and Oakland.

How much cash do you have? This is important since it defines your options.

Join bigger pockets, it's a great forum with lots of pros.

Always try to buy below the market price set by the MLS.

You can get away, but you'd need to get someone trustworthy on call to take care of emergencies.

Shoot me an email at foreclosurevision dot com, once I know exactly what you're looking for I can offer more targeted advice.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> I know of a couple of entrepreneurs who made a good few mil by selling their startup and were looking to start a business as a lifestyle cashflow only business. When I asked him why, he said they did not want to dip into their savings for daily expenses and wanted to have a business that was sure to make them just enough money without way too much effort. I think this is not a bad strategy unless you just don't want to work, which I think is rare.

In terms of growth, I think its wiser to invest in BRIC where the core domestic markets are getting stronger and the stock market returns are a lot better, though choppy. Also if you diversify into real estate (recurring income), CDs (monthly income), and such other opportunities, then you can strike a balance for yourself.

Influence is VERY tough though. I wouldn't count on it as an indefinite opportunity to earn money when needed, assuming you are able to cut through the noise and build credibility (which itself may be tougher than having a decent exit. Plus it is not for everyone). New influencers constantly displace current influencers and it would take a lot more work to maintain it unless you founded Google or something.

</comment><comment><USER23> Two words: permanent portfolio.

[http://crawlingroad.com/blog/2008/12/22/permanent- portfolio-...](http://crawlingroad.com/blog/2008/12/22/permanent-portfolio- historical-returns/)

<http://crawlingroad.com/blog/tag/permanent-portfolio/>

<comment><USER24> I keep seeing this pop up on HN and I'm intrigued.

Any wealthy people out there using this who can comment?

</comment></comment><comment><USER25> what's the moral of this story? you most likely, even if you make a good amount of money, will not escape the anxiety associated with money. or, escaping the anxiety associated with money is not accomplished by making money. the idea of fuck you money is for kids. being able to say fuck you to anyone is more about what you've got on the inside than what you've got on the outside.

<comment><USER26> _being able to say fuck you to anyone is more about what you've got on the inside than what you've got on the outside._

Sure, but the consequences will be different.

<comment><USER15> "Sure, but the consequences will be different."

Well I guess that with that reply you missed the whole point of the comment...

</comment></comment></comment><comment><USER27> The first 3/4 of this article is _fucking terrifying_.

<comment><USER28> If you are not fucking terrified at the moment you're not paying attention.

<comment><USER29> Why don't you just put your money in a global index fund instead? No one forces you Americans to invest your savings in your own country..in fact, that seems like a pretty bad idea in the first place, since this means that when the economy is bad and it is hard to find jobs is the same time it is a very bad idea to take money out of your investments.

Seems pretty obvious to me that the American economy as a whole has so much shenanigans going on that investing broadly in it is a bad idea. Is it really that hard to move your money to a foreign currency`

<comment><USER6> Which country? Europe is worse-off than America, China likely has their own bubble. Japan has been in a funk for 20 years. Russia has recently been cracking down on political freedoms in a worrisome way, there's no guarantee that you'll be able to take your money out once you put it in. Same for many Latin American countries.

<comment><USER30> How about India? Indian economy has bounced back some time ago. Here is sensex over last 5 years.

[http://in.finance.yahoo.com/q/bc?s=^BSESN&t=5y&l=on&...](http://in.finance.yahoo.com/q/bc?s=^BSESN&t=5y&l=on&z=m&q=l&c=)

Risk-free return rate is still at around 8%: <http://www.bajajcapital.com/gss/nsc.html>

<comment><USER31> If I'm reading it correctly, that risk-free return rate is only available to resident Indians. In addition, even if international investors would be able to access it they'd be adding currency risk to the equation.

<comment><USER30> Yes, and Yes. I quoted the risk-free rate to give an idea about the economy and its risk-level. Equity market here can be expected to give decent returns (~15%). I'm not sure about the citizenship requirements but the equity markets should be quite open.

<http://new.valueresearchonline.com/funds/default.asp>

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> It's actually silly to think that stock market ROIs won't rise again. They're abnormally low now, but we've seen it many times before.

Market returns are based on the amount investors need to take the inherent risks. Unless stock market investing gets considerably less risky (seems quite unlikely) investors will leave the market for less risky vehicles until rates return to the amounts needed to justify taking the risk, which have historically been around 7-10%.

Stocks, real estate, bonds, and all other market-based investment vehicles will always have returns in-line with risks in the long run.

Nobody should ever retire hoping to get a steady income from the stock market or real estate or other volatile investments. By the time you're ready to retire, you should be entirely in FDIC-insured CDs and the like. If your retirement plan is contingent on 6% annually you're asking for trouble, and you're probably going to get it if you live long enough.

<comment><USER33> One thing that worries me, and I'd love to hear other people's opinions, is that as baby boomers retire they will be removing their retirements from the stock market. Whether they move their money to other non-stock investments or whatever. But don't you think the transfer of money out of stock-related investments by such a large percentage of people is going to cause some problems for those of us who still have money in stocks in the market?

</comment></comment><comment><USER34> I think after you get fuck you money, your goal should be to create a lifestyle business. Something that can more or less run on autopilot and generate money for you to live on.

If you are a web guy, you can create some software product(or pay someone to build one for you). Then charge $50 a month...and you only need to make 6 sales a day(via adwords) to make $100K/yr.

If you are not...you can buy a franchise...i.e. McDonalds franchises make something like 1-2 million a year. And you as an owner don't need to do anything...just hire a good manager...and it'll more or less run on autopilot(from your perspective)

<comment><USER27> If you can make something that makes you $100k/yr why wait until you have already made your fuck you money?

<comment><USER34> because a lot of these niche $100K/yr products...hit the ceiling at 150-200K. So you have no security like you do when you have 5-6 million in the bank. Anything can happen...Google might slap your adwords account, someone might release a competing product etc.

And starting a lifestyle business with FU money, means that you can tough it out as it grows from 1 sale every other day, to 1-2-3-4-5-6 sales a day.

<comment><USER11> If you can build a $100K/year product, why not do that, and then use that money as your runway while you build your five million dollar product?

building a company is /much/ easier if you don't have to worry about where rent is coming from three months from now.

<comment><USER34> because at that point it's very easy to get complacent...and building up to $100K for a niche business still takes time and money.

<comment><USER11> personally, I'd rather try to run a starup while fighting complacency than while either trying to wrangle investors or working a dayjob. I think complacency would be a lot less distracting.

</comment></comment></comment></comment></comment></comment><comment><USER35> Well, there must be some correlation between money and influence. If Paul Graham is right, then the guy who has $5M at 30 by virtue of a startup exit has created enough value to be compensated as such. Which of course, leads to influence.

FYM in it's old-world sense (retirement) is probably getting more obsolete anyway. As Tim Ferriss put it, "The goal isn't to work less. It is to live more."

</comment><comment><USER36> I come to this thread late but couple points:

1\. Low return on money. That's because money itself worth more now; the Fed has destroyed whole bunch money via credit tightening. We have gone through an asset deflation phrase and the money you have can buy more assets now. It's ok to have low return on money for now.

2\. Asset allocation. Should not just put your FU money in stocks or Treasury. Read up on asset allocation. Have better downfall protection and better return.

3\. 4% withdrawal rate. Studies and simulations have found that annual 4% withdrawal rate of a portfolio can make it last for very long time adjusted for inflation. 4% of 2M is 80K, which can provide a nice living.

4\. Count net worth, not just cash. That 80K makes a big difference with a paid-for house.

5\. Don't discount Social Security/Medicare/IRA/401K/Pension. The discussion of couple millions of PRESENT day often ignores the age restricted retirement funds. Those can be substantial.

</comment><comment><USER37> What about dividend paying stocks? Good companies are usually very reluctant to cut dividends even in bad times and with stock prices suppressed, this should lead to higher dividend yields. Probably not a total solution but should be looked at.

<comment><USER38> In theory, shouldn't all stocks be dividend paying? If your stock doesn't pay dividends, what makes it any different from baseball cards as an investment?

<comment><USER39> It's different from baseball cards because a given baseball card can't _start_ paying dividends if all the people who own the card have a vote and decide it should.

I used to spend a lot of time playing Railroad Tycoon 2, and in that game a good way to get rich is

1\. Put all your money in to a railroad you control.

2\. Grow your railroad. As your railroad grows, the value of your stock in it grows. This causes your purchasing power to rise, allowing you to borrow money to buy more stock in your railroad.

3\. Eventually you're in a ton of debt, but you've also got a ton of stock in your (presumably successful) railroad. Then raise the dividend paid by your railroad's shares and rake it in.

The problem with raising the dividend paid by your shares early on is that it will give your railroad less capital to expand with. So you only want to execute step 3 when your railroad is making more money than you know what to do with.

I think there's a good argument to be made that companies like Google know what to do with the money they're making.

<comment><USER9> "I think there's a good argument to be made that companies like Google know what to do with the money they're making."

There's a good argument that a company like Microsoft doesn't anymore, which is why they were pretty much forced to pay out a big dividend a few years back. Just to give an example at the opposite end of the corporate life cycle.

Just found this article suggesting it's still an issue:

[http://www.bloomberg.com/news/2010-07-22/microsoft-may- use-c...](http://www.bloomberg.com/news/2010-07-22/microsoft-may-use-cash-to- boost-dividend-this-quarter-after-two-year-lull.html)

</comment></comment></comment></comment><comment><USER40> maybe it safer strategy not to think of retirement at all and try to find what really motivates/fulfills you. If you get good at it whatever it is, there will always be a way to make money with it.

</comment><comment><USER41> Slightly myopic given that we're still very much in a recession, but good points nonetheless.

I would have to disagree, though, because fame and influence fades. You still have to work hard to maintain it.

</comment><comment><USER42> this may be good advice for people who have the potential to earn fu money. the corollary to average people seems to be that it's no longer possible to retire.

how did we go from an age in which average people could hope to retire, to one in which someone with 5M needs to worry?

</comment><comment><USER43> A couple of folks are tossing in that you can get 2-4% returns nowadays. Here's the historical rate of inflation (scroll down for the recent years):

[http://www.usinflationcalculator.com/inflation/historical- in...](http://www.usinflationcalculator.com/inflation/historical-inflation- rates/)

Looks like about 2-4%. :-(

<comment><USER6> If we get deflation, as many people are predicting, then you can get several percent "interest" just by holding your money in cash. That's built into the interest rate expectations for a lot of securities right now. You wouldn't see these near-zero interest rates unless people were expecting the dollar itself to become more valuable in the near future.

<comment><USER44> The Fed, with all of the T-bills out there, will never allow deflation. It's not in the government's interests.

</comment></comment></comment><comment><USER4> I have a really hard time believing that there will be no investments for _30 years_.

</comment><comment><USER45> am I the only one who sees a flaw in the math here? I mean I wasn't a math major in college, but i did take financial math, and think he's forgetting a key thing called compound interest.

<comment><USER46> I can't figure out his math, either. In his second example, if you put $4M in a bank account that gets 2%, and can still save $10K a year you'll have $7.6 mil in 30 years. If you can get 8% (which I think you can, all arguments to the contrary) you will have $41M. Maybe he just means once you get the cash, you quit your job, put the money under the mattress and spend it all?

<comment><USER45> yeah, he ignores the money growing on its own.

</comment></comment></comment><comment><USER47> $5M is definitely not retirement money if you're only 30 years old. I figured at that age you'd need about $15M, and even at that you'd need to make sure you invest it properly to at least keep up with inflation.

I've always thought that FYM and retirement money are two different concepts. If I had FYM, I can quit my job. I would still be looking for what's next, but I can take my time. (Usual disclaimers apply re: deadlines)

<comment><USER48> I'd have no problem extracting 250,000 in annual income from 5 million, after it's been invested for a year. Whether or not that's enough t decide to go walkabout depends on the person.

<comment><USER49> What would your strategy be to get that 5%?

<comment><USER50> Tax free municipal bonds.

<comment><USER51> Come back and tell me about dumping all your money into tax-free municipal bonds in two years.

<comment><USER50> <neutral question> What is the reasoning behind your comment?

<comment><USER51> See btilly's comment that mentions them. There is a lot of chatter about bankruptcy. It's still just chatter, with a small number of exceptions. Let us all hope it stays that way.

Mind you, I'm not guaranteeing they'll all go away, but it won't take very many bankruptcies for your returns to go below inflation. (Or worse.)

I might invest in specific municipalities, if that's possible for a mere mortal investor, but I wouldn't think it's necessarily a safer assert class than anything else right now.

</comment></comment></comment></comment></comment></comment></comment><comment><USER52> ok, thats all nice, but if author is so much worried about his financial perspectives in US, he should look at other markets. Hey in Asia, even somewhere Europe after some research you can easily find that 6-8% safe investment opportunities. So retirement with 2M is still no problem if you are willing to open your eyes, and see that there is something going on outside US.

</comment><comment><USER53> Personally, I'm not at all motivated by money so long as I can pay the bills and have some modest standard of living. If I had been interested in accumulating money I would have taken a quite different career path.

</comment><comment><USER8> FU money can be just enough to buy a patch of land and build one of these:

<http://earthship.com/>

</comment><comment><USER54> Oh yes, you shouldn't sit on your ass after banking a wad of cash and expect to live forever, not doing a thing.

But neither should you rely on _influence_ and _credibility_ , because those things still imply gatekeepers. You have to have influence and credibility... to convince somebody else.

Why not just rely on yourself? Why not foster the ability to make money in any circumstance?

I cashed out my IRA because, so far, the money I've put into my SaaS has paid back itself 1000%, not 10%.

Based on that, and my other efforts/products, I know I could easily earn 7K euros a month just by working a few days. Training is lucrative. My information products are lucrative. I'm about to open my "your first product" launch class again - last time it made $25k (as I was building it!), this time I aim to double that. Shouldn't be too hard.

Sometimes I sit back and think about it, and I can't help but laugh (in a nervous way), that I can earn more in a few weeks than one of my parents' yearly salaries from when I was a kid.

Now, back to my influence/credibilty/gatekeepers argument - the perceptive HNer will point out that I am using my credibility to bring in customers. That's true, at a few hundred bucks a pop -- which is a far cry from hoping somebody will hire you for a sweet job (which means, of course, that you have to work that job), and miles away from trying to use your credibility to get millions in investment.

My way is very do-able for a normal person, the other is incredibly hard and requires much luck in addition to a full-out effort.

</comment><comment><USER55> A very easy solution to this: Go live in a cheaper country. Go now, before the heavily debted countries lock down money transfers (In which case, buy gold/silver)

<comment><USER56> How does crazy paranoid stuff get up-voted here? Very Sad.

Cheaper countries can be fun, but there's lots of downsides as well. If you are asocial, it could be your dream to live there. I'll always want a vacation there, but not to live there.

<comment><USER57> It is a bit paranoid, but then again, you've never been in a country that locks down money transfers, right? You still believe you can emigrate anywhere.

It's currently unlikely, but I suspect the U.S. could implement that much faster than you think if it keeps going downhill. It already implemented a ban on holding gold in the past, for example ( <http://en.wikipedia.org/wiki/Executive_Order_6102> in place until 1974 ). It's not the scenario I envision, but thinking "The U.S. would never do that!" is naive.

By the way, I believe the original post had a reasonable suggestion... you could live like a king for your lifetime in, say, Uruguay or Costa Rica with 5 million (and those are reasonably safe countries). Yes, emigrating is a quite hard decision, but it is a possibility.

<comment><USER56> Keep in mind that 1974 was 36 years ago. I am working with a very different model of the world than you are I think. Capital controls exist in the world and some are quite harsh. However, no serious person is even close to advocating them (for wealth nations like the US). What problem do you imagine they would solve?

</comment></comment></comment></comment><comment><USER58> IMO Fuck you money is not just when you have enough for a life of mindless consumption, but enough for when you can do the things that you really really want to do.

eg save the world from malaria, build that skyscraper with your face on it, start an iron and blood revolution (there are a few governments that I would want to overthrow).

</comment><comment><USER59> More like 'fuck other people over" money.</comment>


List of Languages that Compile to JS - <AUTHOR> http://github.com/jashkenas/coffee-script/wiki/List-of-languages-that-compile-to-JS

<comment><USER2> Heh, I started this :) strange thing how the interwebs works.

I was searching like mad for a coffeescript + operator overloading and classes with private/protected methods. In my desperate search I started to make a list with languages that compile to JS. Then - an idea came to me. How about I put this in the coffeescript wiki, post it on Hacker News then people will crowdsource it. It worked like mad, in an instant people were adding projects and I was organizing it.

Now I see people making sites/communities out of it. Small world. I guess it's a topic of interest.

      PS
      Crowd-sourcing is an amazing experience.
      1. commit 8a0bae391e5711bce233ccac756d2b80070868da in CS wiki
      2. Previous discussion in my original thread http://news.ycombinator.com/item?id=2075111

</comment><comment><AUTHOR> Previous submission & discussion is at <http://news.ycombinator.com/item?id=2075111> , but as it was about 500 days ago and many, many things have changes since then, I thought re-submitting this wiki (by changing 'https' to 'http') would be OK and hopefully illuminating to some.

I'm particularly eager to learn how IcedCoffeeScript has changes since then. I'm starting a rather big CoffeeScript/Node.js project and I can't decide whether to go with IcedCoffeeScript (I love its simplicity), or go the 'async.js' way... If anyone has used both Iced and async, I'd be more than thankful if they could share their experience (I Would've asked this question on StackOverflow, but I'm sure it'll be closed within 5 minutes as _not a real question_ or something like that).

<comment><USER3> Have you considered using plain coffee-script with node-fibers instead?

It might also be worth looking into Common Node (<https://github.com/olegp/common-node>) that I'm working on which provides a higher level abstraction: <https://gist.github.com/1447709>

<comment><AUTHOR> Thanks. I'll look into it.

One thing I forgot to mention about async.js: It's downright disgusting when you try to use it with CoffeeScript, so even though it's a mature, well- architectured piece of framework, I don't like to use it with CoffeeScript...

<comment><USER4> As someone who was just about to add some async.js to a CoffeeScript/Node project, I'd be very interested to hear about what problems you've had before I go and potentially do something stupid.

<comment><AUTHOR> It might be just me, but

          async.waterfall [
            (callback) ->
              callback null, "one", "two"
            (arg1, arg2, callback) ->
              callback null, "three"
            (arg1, callback) ->
              callback null, "done"
          ]

just doesn't make much sense to me. I just don't like the way it looks.

(code snippet from [https://groups.google.com/group/coffeescript/browse_thread/t...](https://groups.google.com/group/coffeescript/browse_thread/thread/dd2071f3b0d73861?hl=en&noredirect=true&pli=1) )

<comment><USER5> Looks fine to me, but I do agree Iced can look even better.

</comment></comment></comment></comment></comment></comment><comment><USER6> More detail on the Haskell -> js options here: <http://www.haskell.org/haskellwiki/The_JavaScript_Problem>

</comment><comment><USER7> Why do so many languages choose JS as a 'middle' language? Is it something inherent to the language itself that makes it particularly easy/attractive? Or is it simply because of the availability of the interpreter in the browser?

<comment><USER8> When Rich Hickey announced ClojureScript he said "Why are we doing this? Because Clojure _rocks_ , and JavaScript _reaches_." The simplest reason is because JS is the Language of the Web.

It's worth wondering why this is, and I don't really have an answer. In JS's infancy, Java was meant to be the Language of the Web and JS was its asthmatic younger brother. There are probably purely aesthetic problems which led to Java being overtaken by Flash, but I don't know. I sometimes like to say that Java looked consistent in every browser -- but consistently ugly. But Java is not necessarily fun to develop in either, and getting people to install Java always seemed like it was more pain than getting them to install the Flash plugin.

You can treat it as a black box, of course: even to this day, for lots of people, Java on the web just plain doesn't work. But I think you're asking _why_ it doesn't work, and that's much more subtle. You know who would be an interesting person to ask? An advertiser. You see flash ads, you see JS ads, you see flat image ads -- but you never see Java ads.

In any case, I think JS won because it gave immediate gratification: you took the image that you had already placed on the page and, onmouseover, you replaced it with an animated GIF which you'd already loaded and cached. It was event-driven design with a GUI language that you already needed to know when you were making a web app in the first place -- you didn't have to learn AWT and Swing and such before you could make and place a drop-down menu; you just placed a SELECT with OPTIONs, the same as for a form.

When CSS replaced FONT tags and ECMA partly solved the problem of Microsoft trying to kill Javascript in favor of JScript, it became clear to me that JS was indeed the Language of the Web, and that HTML and CSS were just very smart declarative domain-specific languages for its GUIs. If you want a single lesson, there it is: make sure your language allows for declarative programming, and make sure your GUI language is declarative and event-driven.

Its other strengths would not necessarily have been strengths elsewhere. It's an asynchronous language with no race conditions. That's perfect for a responsive GUI, but it's probably wrong for anything which needs lots of processing power. It's got light objects and first-class functions, which is beautiful when you want to package data and write jQuery, but the cool stuff you can do with the Haskell type checker is pretty much not allowed by this model.

But those are the reasons why you might _still_ prefer JS, even when other middle languages exist.

<comment><USER9> > You can treat it as a black box, of course: even to this day, for lots of > people, Java on the web just plain doesn't work. But I think you're asking > why it doesn't work, and that's much more subtle. You know who would be an > interesting person to ask? An advertiser. You see flash ads, you see JS ads, > you see flat image ads -- but you never see Java ads.

Well, to begin with, a typical Java applet take around 30 seconds to one minute just to load and start execution, usually suspending the whole page. There's nothing more annoying on the Internet for me than encountering an unexpected embedded Java applet. Hitting "back" and killing the Java process is almost subconscious reaction to me now. Java Web Start was actually something nice and I used it to launch programs and play games written in Java. It at least asks before hunging your browser up.

And then again, Java applets are consistently ugly. Maybe it has something to do with default GUI libraries, which look bad and break UI conventions. Only today I had to deal with a Java program that reinvented tree view, so that you couldn't rename elements without killing and reinserting them.

So yeah. Execution sucked then and still does now.

</comment></comment></comment><comment><USER10> I'm the creator of LiveScript (<http://gkz.github.com/LiveScript/>) which is on that list. Feel free to ask any questions! LiveScript has unnested callbacks, paren free chaining, function composition and piping operators, proper list comprehensions, and a lot of other improvements over CoffeeScript.

<comment><USER11> Why fork (and reverse half of Coco's semantics), instead of contributing to Coco?

Do you expect that any of your additions will get merged into mainline Coco/CoffeeScript?

<comment><USER10> Most of my changes would be unacceptable to Satyr, the maintainer of Coco. For instance, I posted an issue about creating proper list comprehensions in both CoffeeScript and Coco, and both times was shut down. That's why I decided to create my own project, and make the changes I want without being shut down all the time. I don't expect any of my changes to be merged into Coco or CoffeeScript, but if they want to then I would encourage them to do so.

</comment></comment></comment><comment><USER12> Funny to see this post together with LLVM 3.1 announcement on the same page as both are used as backends for programming languages these days. Now question, is this world gone mad? While I can justify existence of CoffeScript(it is only a nicer Javascript, with similar or improved semantics), the whole hype about the "assembly of the web" is ridiculous. Shame that with all the advances of the technologies today we have to compile to Javascript.

Update. Nice picture to illustrate what compiling to JS feels like [http://im4-tub-ua.yandex.net/i?id=140745948-54-72&n=17](http://im4-tub- ua.yandex.net/i?id=140745948-54-72&n=17)

</comment><comment><USER13> IMHO such lists are rather useless without information about the state of the compiler, indicators for active development, financial situation (who pays the bills?), community size etc.

<comment><USER14> It's just an index so you can see if your favourite language is supported. Follow the links for the rest. You couldn't trust extra information in the wiki itself because most of the details you need would get outdated pretty fast.

</comment></comment><comment><USER15> A bit off-topic and I might have missed something, but why is this on GitHub? I would have thought Wikipedia is best for reference lists like this.

Still an eye-opening read, though.

<comment><AUTHOR> I don't think so:

        [..]
        Family (share genes with CoffeeScript)[citation required]

And now you have to find a _tertiary_ source (not even a secondary, or god forbid first-hand, like for example coffeescript.com) that _proves_ that they share genes.

I'm not trying to be funny or sarcastic, so don't downvote me! That's what Wikipedia is, for better or for worse.

</comment></comment><comment><USER16> I just discovered Perlito thanks to this list, and it's awesome (compiles perl5/perl6 to Javascript/Python/CLISP/Go/Ruby). I don't know what it can be used for but I like it :)

</comment><comment><USER17> See also: <http://altjs.org/></comment>