Enhancing digital certificate security (Fake *.Google.com cert issued) - <AUTHOR> http://googleonlinesecurity.blogspot.com/2013/01/enhancing-digital-certificate-security.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+GoogleOnlineSecurityBlog+%28Google+Online+Security+Blog%29 <comment><USER3> If you host a website and are worried about these types of attacks against your users, there are a couple of fairly straightforward things you can do to strengthen your position:

1) There is no reason that your mobile apps need to use the public CA system. You can either generate your own signing certificates and embed them in your apps, or if you must use CA certificates for your mobile endpoints, at least pin those SPKIs in your apps. More info here: [http://www.thoughtcrime.org/blog/authenticity-is-broken- in-s...](http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but- your-app-ha/)

2) If your website is high volume, Adam Langley is very generous about adding certificate pins for the CA you are using to Chrome: <http://www.imperialviolet.org/2011/05/04/pinning.html> This will mean that a random CA in Turkey can not be used to intercept traffic to your website from Chrome, in the exact same was that Google was protected in this incident with its own websites. Word on the street is that Firefox is now beginning to use the same list of pins.

3) Experiment with and support the development of TACK, which is a way to frictionlessly pin certificates for your website in a dynamic way (rather than having to hardcode them into browser binaries): <http://tack.io>

4) And of course, make sure that you're advertising HSTS headers, so that your users aren't vulnerable to sslstrip (<http://www.thoughtcrime.org/software/sslstrip>) attacks.

<comment><USER4> It seems like "one guy pinning certificates to Chrome" might be an interesting attack vector. How does he verify you actually work for the high-profile site in question?

<comment><USER5> Same way they do other verifications I suppose; by proving you have write access to the server in question. If someone malicious can manage that, there's bigger problems than SSL.

</comment></comment></comment><comment><USER6> _"they discovered that in August 2011 they had mistakenly issued two intermediate CA certificates to organizations that should have instead received regular SSL certificates"_

This is the worst security violation committed by a CA that I have ever read! These organizations can now issue certificates for any domain, not just google.com, and they will be seen as valid by all browsers. Fortunately Chrome already revoked the intermediate CA certs.

However it is unclear whether TURKTRUST has done so on their side yet or not. They distribute 2 main CRLs: [1] which is empty(!) and [2] which contains a bunch of serial numbers recently revoked presumably related to the incident. However their root cert [3] does not reference any of these CRLs, and their (legit) intermediate CA cert [4] is also misconfigured and points to the empty CRL:

                X509v3 CRL Distribution Points:
                    Full Name:
                      URI:http://www.turktrust.com.tr/sil/TURKTRUST_Kok_SIL_s3.crl

What this means is that it appears TURKTRUST has not technically revoked anything via CRL. Perhaps they did via OCSP, but I have not checked whether their OCSP endpoint advertises the recent revocations or not.

[1] <http://www.turktrust.com.tr/sil/TURKTRUST_Kok_SIL_s3.crl>

[2] [http://www.turktrust.com.tr/sil/TURKTRUST_Nitelikli_SIL_s3.c...](http://www.turktrust.com.tr/sil/TURKTRUST_Nitelikli_SIL_s3.crl)

[3] [http://www.turktrust.com.tr/sertifikalar/19_TURKTRUST_Elektr...](http://www.turktrust.com.tr/sertifikalar/19_TURKTRUST_Elektronik_Sertifika_Hizmet_Saglayicisi.crt)

[4] [http://www.turktrust.com.tr/sertifikalar/20_TURKTRUST_Niteli...](http://www.turktrust.com.tr/sertifikalar/20_TURKTRUST_Nitelikli_Elektronik_Sertifika_Hizmetleri.crt)

<comment><USER7> Worse than the digitask desaster? Just from this talk [1], I can think of two or three worse behaviours by digitask.

[1] [http://events.ccc.de/congress/2012/Fahrplan/events/5319.en.h...](http://events.ccc.de/congress/2012/Fahrplan/events/5319.en.html)

</comment></comment><comment><USER8> I used to be in a contact with a guy who got an intermediate CA certificate, because he was friends with someone who was at the beginning of Thawte (I _think_ , it was a while ago). He said he got it as a gift in the early '00s or late '90s and it had an expiry in 2050 (?). Yep, I too was like O_O

The PKI in its current form and application should really go. Cross-signing of a certificate by two or more independent CAs would be also a good step forward. And so would be a native support for certificate pinning in browsers. In other words, PKI should be used for _bootstrapping_ the trust between two unacquainted parties, but it shouldn't be the only option, nor should be used as a trust provider on an on-going basis.

Consider this, if I hold a certificate for fubar.com, why am I not permitted to issue a certificate for xyz.fubar.com? Or, better yet - another certificate for fubar.com?

(edit) Also, "Enhancing digital certificate security" is such a bullshit title. Very odd to see this coming from Google. They must be very unnerved by the incident, or they are going to use it as a stepping stone to something else.

<comment><USER9> > Consider this, if I hold a certificate for fubar.com, why am I not permitted > to issue a certificate for xyz.fubar.com Or, better yet - <USER2> > certificate for fubar.com?

Because business model. StartSSL.com is afaik the first (only?) CA that charges solely for identity validation and then let's you create unlimited (wildcard) certificates (with the exception of EV certs).

* No ties, just a customer.

<comment><USER10> Quite. You, are, of course, free to run your own CA. I rather like my version (a custom minimal Linux virtual machine, ~ 16MB, stored on an IronKey). Built from source, reasonably tamper-proof, works offline, encrypted at rest. It's a bit of pain to remember to reset the time/date every time I boot it, but it works quite well.

Sadly you'll spend the rest of your time installing your root certificates in everything (good luck with mobile devices, I have torn my hair out in the past with Sony-Ericsson; Oh, you have to drag the specially-named-file-in exactly- the-right-encoding onto the HIDDEN node in the PC-suite-file-explorer-horror- window, of course. HOW OBVIOUS.)

<comment><USER11> Can you elaborate why you've spent the considerable time to do this? Do you habitually travel / connect to completely nefarious networks?

<comment><USER10> Much for the same reasons I run my own mail server - because I can, I learned something doing it, it gives me more control than I'd otherwise have. I also don't trust any network with plain-text credentials so TLS was a requirement for mobile email.

IronKey was something I already used, so it was natural to try and build a minimal CA that fit on it.

Given the choice I'd prefer a good VPN solution but the aforementioned pre- smartphones simply couldn't do that and SSL VPNs weren't common, so TLS was what we had. Now, that little CA primarily gets used for generating Xauth-RSA certificates for my IPSEC VPNs...

<comment><USER12> Any chance you could release a scrubbed setup or a blog post?

I'm looking at doing this and rather not have to slog through the nuances if possible. (I deal with certain on a sufficiently infrequent basis that I have to actively try to figure the steps again. One of the frustrating things of having to deal with cryptic options)

</comment></comment></comment></comment></comment></comment><comment><USER13> I'm a bit confused why they didn't remove TURKTRUST entirely. It's pretty obvious that they issued to a government under some kind of incentive or coercion, and thus became a MITM threat.

I'm sure every reasonably sized government already has either a root key or an intermediate key, but there should at least be enough penalty when you get caught publicly to deter it -- at least raise the cost of being caught enough that governments won't use their CA powers without fear they might be putting the capability at risk each time.

<comment><USER14> Obviously they don't blacklist the CA because doing so would break the sites of all of their customers. That's a very high-cost action, and the cost is borne by people not involved in the security situation. You do it only in an emergency. The system has an existing mechanism in place: revoke the cert, (though see the post by mrb above which argues that the revocation was done incorrectly).

Longer term, yes: I think looking at punishing TURKTRUST in some way, including revoking their CA, makes sense.

<comment><USER15> But isn't this exactly a high cost situation? Send a loud and clear message that CAs are entrusted with an enormous level of trust, and they damn well better make sure that their procedures are water tight, at the risk of losing their business overnight.

<comment><USER16> Punishing CAs is a laudable goal, but just immediately revoking a CA will result in worse security.

If TURKTRUST is immediately revoked, then all existing sites using it are toast, _despite them not being compromised_. That just tells users that SSL errors are not to be trusted, that you should just click through.

Hopefully, they remove TURKTRUST from signing future certificates. That way existing customers continue to work, but they can't do more damage, and the lesson is taught. Although, I don't think that's built-in to the cert system, it'd be a decent addition.

<comment><USER15> They could give them one month or even three months so their client have time to get their certs replaced, that's not terribly important. But in a broader sense, yes, they were compromised - they had an entity vouch for them that apparently vouched with a blank cheque.

</comment></comment></comment></comment></comment><comment><USER17> A bit more details from Microsoft:

      "TURKTRUST Inc. incorrectly created two subsidiary Certificate Authorities:
      (*.EGO.GOV.TR and e-islam.kktcmerkezbankasi.org).
      The *.EGO.GOV.TR subsidiary CA was then used to issue a
      fraudulent digital certificate to *.google.com."

[http://blogs.technet.com/b/msrc/archive/2013/01/03/security-...](http://blogs.technet.com/b/msrc/archive/2013/01/03/security- advisory-2798897-released-certificate-trust-list-updated.aspx)

</comment><comment><USER18> How am I supposed to trust an official Google security blog named "googleonlinesecurity.blogspot.com"? What a bizarre place to put your security blog!

<comment><USER19> What were you expecting.. wordpress?

Here is Google's blog directory.. all on blogspot, their blogging platform:

[https://www.google.com/intl/en/press/blog- directory.html#tab...](https://www.google.com/intl/en/press/blog- directory.html#tab0)

<comment><USER20> I would have expected something like security.google.com, which would be pretty obviously not a hoax. As it stands, what stops anyone from making googleinternetsecurity.blogspot.com?

<comment><USER18> Indeed. I went ahead and created <http://googleinternetsecurity.blogspot.com> as a proof of concept. I wonder whether it will be allowed to exist.

</comment></comment></comment></comment><comment><USER21> Sounds like only Chrome has been updated to reflect this? Which means all Android/iOS apps that rely on a secure channel to a *.google.com domain can be MITMed?

If so, then current SSL should be regarded as 'broken' effective immediately and not used for secure transactions with Google (and probably anybody else).

<comment><AUTHOR> I would assume the cert was revoked, this is about how they do not trust any cert signed by the same authority.

<comment><USER22> Even if the certificate was revoked, how do the Android devices know that the certificate was revoked? Do they regularly update CRLs or do they check using an online protocol e.g. OCSP?

</comment></comment></comment><comment><USER23> The CA system is fscked beyond repair (it always has been). We need an alternative now.

<comment><USER24> Do you know of any alternatives being worked on? No snark intended, I am genuinely curious about the current state of affairs.

<comment><USER9> Some developments in this area are:

* Convergence.io

* DNS-based Authentication of Named Entities (DANE) + DNSSEC

* Tack.io

For various reasons listed in [1] Convergence is not likely to be implemented (by default) in major browsers.

On DANE + DNSSEC, where the cert is authenticated via the information published in your DNS, Moxie Marlinspike has said it better then I can:

        "CAs are sketchy, but this is a whole new world of sketchiness. Think,
        sketchasaurus. Registrars were never built or selected with security in mind,
        and most of them don't have a very good track record in this area. Shouldn't it
        be laughable that the current first step in deploying DNSSEC is to create an
        account with GoDaddy?"[2]

The 2011 BlackHat video[3] and blog post[2] by Moxie Marlinspike are great sources of information.

IMO, Tack.io is the most viable solution. It's compatible with the current model but removes the thread of one CA being able to compromise all domains.

[1] <http://www.imperialviolet.org/2011/09/07/convergence.html>

[2] [http://www.thoughtcrime.org/blog/ssl-and-the-future-of- authe...](http://www.thoughtcrime.org/blog/ssl-and-the-future-of- authenticity/)

[3] <http://www.youtube.com/watch?v=Z7Wl2FW2TcA>

<comment><USER25> Registrar's are trusted. They can change the DNS records for your domain to point at their servers, allowing them to intercept email. That's sufficient to allow them to get certificates issued for your domain through some providers.

<comment><USER9> For domain validated certs, certainly.

The issue is that it doesn't solve anything. We merely shift (more) responsibility to registrars and NICs. You can change (untrust) registrars I suppose but if you have a .com you'll have to trust Verisign _forever_. Well, at least as long as they operate the .com tld. So if Verisign loses your trust, there is even less you can do than today.

</comment></comment></comment></comment></comment><comment><USER26> This is something I was thinking about last night, prompted by the recent resurgence in awareness of government wiretapping and some of the responses of "use SSL everywhere so it's not a problem."

Does anything prevent a government from privately coercing a CA into issuing certificates that enable a MITM attack?

It may be that the difficulty of getting a gag order for a CA could be greater than the difficulty of obtaining a warrant on the destination, unless the destination is foreign--but it still sounds feasible for a government to do.

Am I off base about that?

<comment><USER27> That's becoming a high-risk proposition now that Chrome (and apparently Firefox) are pinning certs. A government could indeed coerce a CA into issuing certificates, but they can't easily coerce Google into transparently overriding their pinned certificates, and when the two disagree, the world can see which CA root chain was used to forge the certs.

As you can see, it doesn't even take pervasive deployment of a technology like TACK to significantly mitigate the threat of rogue CAs.

</comment></comment><comment><USER28> I wonder if EFF SSL Observatory detected anything suspicious about the phony certificates.

<comment><USER29> Not in advance, but it will be interesting to see whether we have observations of them.

We (and other people who care about certs) could probably use contributions of algorithms for detecting things that are suspicious about certificates. :-)

One thing that I believe is not yet implemented but that I should try to implement is finding observations in the Observatory that, if they had been made by Chromium, would have violated a cert pin in Chromium. (Most of the observations in the Observatory are made by Firefox users, so their browsers wouldn't notice a pin violation at the time the observation was made.)

Another thing that could be interesting is finding all apparently valid certs that have never been seen by any Perspectives notary.

Anyway, there are a lot of queries to be run!

</comment></comment><comment><USER30> Does anyone know how to remove turntrust as a CA in Mac OS X? Or better, disable them? If I go to their website I can click on the little lock which shows they are valid.

I look in the keychain, and I see three listings for TURKTRUST and it looks like the only option is to delete them. I can't set the cert to alert or warn, which is what I would prefer rather than just fully revoke them at this time.

<comment><USER31> Double click the cert, then click the disclosure triangle next to trust. You can then select never trust for a variety of different purposes. Screenshot: <http://d.pr/i/c8Tx>

<comment><USER30> Thank you. I tried that but mine had no triangles. I closed and reopened the app and then they showed up. I must have hit a quick UI glitch or something, but a relaunch solved it. Thanks again.

</comment></comment></comment><comment><USER30> Why does this happen? It seems technically solvable. If you want a cert, you have to prove you own that domain. No amount if faxing or email is going to truly prove that.

And Chrome hasn't asked me to update, am I safe or do these updates happen unbeknownst to me server side?

If people can lie, they will, and there will be security issues. In this case a wildcard got out for *.google.com! MITM all google.com email, sounds fun!

Correct me if I'm wrong, but there isn't a single google webmaster tools or analytics account out there connected to the wrong domain. Why? Because to engage those services you must own the domain and have access to it.

Google makes you put an HTML file they generate in root or add a meta tag. They then request that URL and look for the resource.

If you want an SSL cert, you should have to put a file at example.com/ssl.html

Wildcard SSL's are trickier. My previous SSL provider charged over 100.00 per cert and that was as a reseller. They wouldn't even offer wildcards in the beginning. I believe they do now but it's a significant application process.

You still could require the placement of a file but that doesn't entirely prove they should get a wild cert for the domain. It still seems better than nothing and would have stopped the issuing of this particular cert.

Not to mention, wouldn't you think every CA or intermediate has a blacklist if domains they simply don't provide certain for? Google, Facebook, twitter, LinkedIn, every major ISP, etc.

Or what about using DNS as a means of authentication. If you want an SSL cert you have to add a TXT record of ssl. TXT (value issuer provides). Again, in this case, they would have failed the ability to interact with google DNS and no matter what DNS server they asked would tell the same.

They could set up a phony DNS server, but the issuer has no reason or knowledge to follow that out of band chain. Then the only way is a rogue employee, which is something no technology is going to solve and probably will remain a risk of all business security from SSL certain to banks to brick and mortar inventory shrink.

All these methods are fully automatic and should be of little burden to the registrar to implement. It's not like they have to handle a million requests a day. A page that spits out a hash of the domain and curl's the resource could probably handle most registrars load.

<comment><USER32> Prove to whom? The people that issued this cert were effectively (albeit mistakenly) a certificate authority. They could issue whatever certs they liked.

</comment></comment><comment><USER33> pki in it's current form is broken which is why a lot of enterprise customers use SecureAuth (whom I work for) which prevents any type of mitm attacks, even on mobile deviecs</comment>


Why Humor at Work Can Boost Productivity, Sales & Morale - <AUTHOR> http://citizentekk.com/2013/11/13/humor-at-work-boosts-productivity-sales-and-morale/

<comment><USER2> Once again, people's productivity is not linked with their salary. There are better ways to encourage them to increase the quality of their output, while making them happier.</comment>


The See-Through CEO - <AUTHOR> http://www.wired.com/wired/archive/15.04/wired40_ceo.html <comment><USER2> _'... "Does a price that ends in -000, like $490,000 seem casual? Is $499,999 too blue-light special?" I stared into my salad. Little did I know that Redfin's mad scientist, Mose Andre, was working on that very problem, crunching statistics on the data-set we pulled to calculate the Redfin Advantage. ...'_ [0]

great article. what made it better was reading the blog [1] ~ hilarious. The first thing I read is company blog(s). You can tell a lot from the blog (SWOT) [2]. The company hierarchy, culture, toolset used, market. If a blog is boring, doesn't contain at least some sort of technical (even if it's just a hint), I mark that down as a 'old skool' software company who's roots are shipping executables or companies without leaders who understand 'transparency'.

Reference

[0] Redfin blog, 'Pricing Advice: Make the Last 3 Digits -500'

<http://blog.redfin.com/redfin/2007/03/pricing_advice_make_the_last_3.html>

[1] Redfin, 'Redfin blog mentioned in article'

<http://blog.redfin.com>

[2] SWOT is an analysis tool and stands for Strength, Weakness, Opportunity & Threat

</comment><comment><USER3> Wow, thanks a lot for the link. As someone who has not fully submitted myself to the blogging craze, I had some trouble seeing what it was all about. After reading this article, I am thoroughly convinced that widespread blogging is a very good thing.

I guess the main thing holding me back from publishing my own musings online is the thought, "Well, who is going to care?" This article emphatically declares, "Google will, and all who seek information on you in the future."

Google's stated mission "is to organize the world's information and make it universally accessible and useful." I find it refreshing to discover that a large corporate entity has actually been able to improve the world in a way not even predicted by a typically lofty mission statement, by giving truth a voice.

</comment><comment><USER4> Well personally I find that keeping secrets hurts any relationship, company or personal.

People are bloody minded bastards when they think you are not on their side, but when you clean up your messes and make them feel included they will take a bullet for you.</comment>


Not a Word: The story of Lillian Virginia Mountweazel - <AUTHOR> http://www.newyorker.com/archive/2005/08/29/050829ta_talk_alford

<comment><USER2> Of course, once you invent a word... it's a word. In this, words are unlike Ms. Mountweazel, who does not spring into existence in the timestream just because an article is published about her.

Or... does she?

This calls for an obligatory Jorge Luis Borges reference:

<http://en.wikipedia.org/wiki/Tlön,_Uqbar,_Orbis_Tertius>

Though I can never cite that story without confessing that I prefer the four- paragraph condensed version by John M. Ford [warning: literary prerequisites suggested; tolerance for awful puns absolutely required]:

<http://nielsenhayden.com/makinglight/archives/004636.html>

</comment><comment><USER3> This, of course, is a form of digital watermarking in for textual data. Due to unique problems, natural language watermarking and steganography is not advanced or is covered as much as image, video, and audio watermarking. For one thing, it is impossible to make changes to text that are udetectable by consumers, as in images; _all_ changes introduce meaning shifts.

If you want to dig deeper, here's one of the rare introductory papers on the subject: [https://www.cerias.purdue.edu/tools_and_resources/bibtex_arc...](https://www.cerias.purdue.edu/tools_and_resources/bibtex_archive/archive/PSI000441.pdf).

</comment><comment><USER4> "Garret Thomson, a self-described 'code monkey,' or programmer, for Pseudodictionary.com, a site that calls itself 'the dictionary for words that wouldn't make it into the dictionaries,' picked 'electrofish,' calling it 'clunky-sounding.'"

Were they not allowed to use Google?

</comment><comment><USER5> I used to work for a company that produces a well known encyclopedia as well dictionaries and thesauri and other reference works and I can tell you this practice makes for a lot of fun. These sort of textual watermarks make it easy to track who's copying whom across relevant sites.

You can play the same game with false information, whether inserted accidentally or by design.

The interesting bit is that made up dictionary terms can actually become perfectly cromulent if enough people fall for the gag.

<comment><USER6> I feel embiggened with new knowledge. Thanks for the interesting story.

</comment></comment><comment><USER7> When this happens on a map, it's called a "trap street" <http://en.wikipedia.org/wiki/Trap_street>

<comment><USER8> Or 'map bunnies':

[http://articles.sfgate.com/2001-08-12/news/17611631_1_bunnie...](http://articles.sfgate.com/2001-08-12/news/17611631_1_bunnies- mapmakers-cartographer)

</comment></comment><comment><USER9> In search of Mountweazels, which are something "like tagging and releasing giant turtles."

</comment><comment><USER10> it seems that this was published originally in 2005 - [http://www.google.com/search?sourceid=chrome&ie=UTF-8...](http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=esquivalience%E2%80%94n.+the+willful+avoidance+of+one%E2%80%99s+official+responsibilities)</comment>


Why Did Google Buy Jaiku? - <AUTHOR> http://www.technologyreview.com/Biztech/19568/?a=f

<comment><USER2> Jaiku makes good sense in the mobile world where written (thumbed) communication needs to be short. It can offer Google a good user-base from which they can launch other mobices (1). Great for embedding ads, and for the multi-lingual user-base

(1) MOBIle serviCES.. If I'm the first to coin this term, CC Attribution please :P

</comment><comment><USER3> it seems pretty straightforward to me. my only hope is that they pay a bit of attention to the physical design of the phone, and think outside the '40 buttons and a small screen' box.</comment>


The death of scripting - <AUTHOR> http://www.sicpers.info/2015/08/the-death-of-scripting/

<comment><USER2> This is just historically and non-historically inaccurate.

First, there was no guarantee you could get useful data out of the programs of the PC and Mac era if they didn't explicitly support getting data out. I've got tons of sheet music in a Windows 3.1-era notation program that I can't get out, because it's stored in a binary format and there's no built-in exporter.

Second, APIs for web services actually _do_ support lots of this. I have a very tiny script taking all my Foursquare checkins and sending them to a private Slack, for instance. I wrote the script. I didn't need approval from Foursquare or Slack.

I wonder if the author has actually tried using any APIs. The fact that _some_ '90s desktop apps were easily scriptable and _some_ '10s web services aren't scriptable has nothing to do with them being desktop apps or web services.

(Not to mention most '10s web services being _scrapable_. I don't remember any screen-scraping tools for Windows 3.1 or classic Mac UIs that were anywhere near as good as the web-scraping tools we have today.)

<comment><USER3> > _First, there was no guarantee you could get useful data out of the programs > of the PC and Mac era if they didn 't explicitly support getting data out._

I don't know why you keep lumping the Mac in with the PC; on the Mac -- not counting AppleScript, the myriad of data translation tools, etc -- there was rich copy+paste support that _worked_ between applications.

> _I 've got tons of sheet music in a Windows 3.1-era notation program that I > can't get out, because it's stored in a binary format and there's no built- > in exporter._

So write a conversion tool that parses the file format; if it's sheet music, the format isn't going to be too hard to decipher. How is this any different, other than scale, than the "web APIs" you claim solve the author's complaints?

> _Second, APIs for web services actually do support lots of this._

No, they don't. They require _writing code_ , which requires that you actually be able to, you know, _program_.

In addition, even being able to use these "web service APIs" requires that you give all your data, control of your applications, and the ability to get work done to a 3rd-party service.

That's not a replacement for a desktop application.

> _The fact that some '90s desktop apps were easily scriptable ..._

Not some. Almost _all_. Even when they didn't explicitly support it, there was generally a way to get what you wanted done, done, thanks to scripting language integration with standard OS-level APIs upon which the applications relied.

> _(Not to mention most '10s web services being scrapable. I don't remember > any screen-scraping tools for Windows 3.1 or classic Mac UIs that were > anywhere near as good as the web-scraping tools we have today.)_

You mean the classic Mac OS where you could literally hit "Record" in AppleScript Editor and produce a surprisingly workable script based on your actual UI actions in the applications?

Or modern Mac OS and iOS, where things like VoiceOver give you semantic access to the entirety of the UI?

<comment><USER2> > So write a conversion tool that parses the file format; if it's sheet music, > the format isn't going to be too hard to decipher.

I appreciate your optimism. NoteWorthy Composer was first released in 1994; last I looked was around 2011. It looks like that year, after I stopped looking because I was no longer singing with the group using binary .nwc files, MIT's Music21 project started scraping together beginnings of a parser. (Also, sometime around 2007, the software authors voluntarily added a text export format. That doesn't count, because it depends on the goodwill of the software authors, just like the web services being decried.)

If it took _fifteen years_ for someone to decipher the format, and it only started being slightly parseable in the modern web API era where we've supposedly left scripting behind, I don't think you can claim either that it "isn't going to be too hard to decipher," nor that we're losing anything in our modern era.

(Also, like, my memory of software in the '90s is that in several cases the authors went out of their way to add obfuscation or anti-tampering features to their data formats.)

> How is this any different, other than scale, than the "web APIs" you claim > solve the author's complaints?

I didn't claim that they solve the author's complaints. I claimed that it makes no difference whether the software is web-based or local.

Your Mac vs. PC distinction is much the same. Some web services are pretty good at this; some aren't. If this is a criticism of the PC platform, phrase it as a criticism of the PC platform, not the web.

> No, they don't. They require _writing code_ , which requires that you > actually be able to, you know, _program_.

1\. [https://zapier.com/](https://zapier.com/)

2\. How is "program" different from "script"?

</comment></comment></comment><comment> Const-me Scripting isn't dying, it's doing great. For example, every competent system engineer needs to be comfortable with scripting, bash/ksh/zsh on *nix, power shell and vbscript on windows.

I don't know what kind of application is the author talking about, and what kind of support does he need. Here on windows I can automate things just fine. Some apps, like all OS components, web browser, ms office, visual studio, and photoshop have their own APIs exposed, documented and supported. For other apps I can use OS-provided UI automation API if I need to. In addition, the industry has shifted towards open file formats and network protocols. This makes possible to process other app's data in a way that was impossible in the early days of that amiga's, when most data formats were binary because performance.

Average end users ain't doing all that things but that's not a technical problem. Just demography and marketing. Old computers were expensive equipment targeted towards scientists and engineers. Modern computers are cheap, they're for everyone from 5 years old to 100+ years old who use them to post selfies and watch cat movies. You cannot teach them all programming, they have better things to do with their lives.

</comment><comment><USER4> Every application I use daily is scriptable. My OS is scriptable. My shell is scriptable. My text editor is scriptable. I hate to be negative, but I call BS.

<comment><USER5> Do you use scripting on your smartphone or tablet?

<comment><USER4> If you're looking at your smartphone or tablet and wanting to script it, put it down and find yourself a desktop or laptop.

Edit: Smartphones and tablets are simply not general purpose computers. I don't want a desktop type OS on either my phone or tablet. I certainly don't want a tablet OS on my desktop. That defeats the purpose. Smartphones and tablets are good at certain things the require _direct user input_. If you really want a smartphone/tablet with desktop capabilities there are vendors that sell that stuff. I just can't see a need for it.

<comment><USER6> Android smartphones and tablets can most definitely serve as general purpose computers (for developers on the go at least). My daily-driver is loaded up with the latest bash, python2, python3, gcc, openssl, ssh, busybox, etc. I'd never carry around a laptop, but with a phone it is always on me so I can get right to work anytime I have a few spare minutes. Just pull up a terminal and ssh into a development box or work locally. Its as easy as can be... You can even run a full Debian image or distro like XFCE in the background if need be. I usually just ssh in, but you can also connect over VNC for desktop use (this is generally best on a tablet). It works really well for me anyways.

<comment><USER4> Why? Especially if you ssh into a workstation. That seems to support my point...

<comment><USER6> Because its just not practical (or desirable) to carry around a laptop everywhere I go whereas my phone is always charged and on me. Nor do I always have a reliable network connection.

</comment></comment></comment></comment></comment></comment><comment><USER7> I wonder what he is talking about. I recently created a script that can build our whole cloud based test environment from scratch. It creates the servers, downloads and installs the platforms, builds and deploys our software.

Maybe he is talking about end-user software that can be scripted? But even that isn't true for devs.

<comment><USER8> I think he's talking about how scripting is less and less possible on Mac/Windows, and practically _im_ possible on phones, which is where the bulk of computing will be done in the future.

<comment><USER9> History lesson: It never was possible on 3270 smart terminals, either.

We've had a shift _back_ to centralized data storage and processing.

There were a few decades - the 1980s & 1990s & 2000s - where the canonical master of a data set might have been local to the user, but cloud computing has moved data back to DCs for centralized storage & processing. And we are using very smart terminals.

<comment><USER10> Even in those years, the client/server model was the norm. Except for people using MS Access, or similar fiascos, there was always a centralized data store.

That doesn't invalidate the claim that scripting is dying. Sure, us tech folk can (and do) script all kinds of things, even even more so the Enterprise IT world, who practically lives and dies by powershell. But back in the 90s in particular, there were such a thing as "power users", who would script the crap out of their systems. That really doesn't exist so much anymore. Now people in that grey area between end users and the coders are more likely to be professional business analysts. The days of a true end user also creating their own custom scripts to merge data and functions from disparate apps is getting rare.

(Keep in mind, HN is an entire community of edge cases... of course we all can spit out exceptions to this trend.)

Now, I do not think this is a bad thing. On the contrary, most of those people were very hard to support, and the ones who did it well and were easy to support often ended up moving into IT/Analyst roles anyway. I think we are in a better place today, with a much larger population of coders and analysts, so the end users can just tell us what they need, then focus on the actual jobs.

But the claim that end user scripting is dying... Yep, I do agree with that much.

</comment></comment></comment></comment><comment><USER11> Just by reading the title I thought that finally somebody has been able to put in good prose what I have been thinking for years: the push towards more secure systems will kill scripting.

Can you script copy and paste or move the cursor? It will be used for nefarious purposes, block it. Can you install and run apps as a user from your home directory? That is a security hole, should be disabled. Can you read windows' titles and move windows around? That is an information leak, it should be plugged. I like secure system just like everybody but I am worried that this will interfere with my pleasant very automated computer life.

But this article is about something else, so I will stop the rant here.

</comment><comment><USER12> "And so it's sad to see scripting die out as the popular platforms for application development fail to support it. Instead of the personal control of the script – I will take this information from that app, and put this part of it in that app – we have the corporate control of the API. This app maker and that app maker are BFFs, sign in here to let them share everything. After all, they know best."

Given the author's background along with this paragraph, I'm going to go ahead and guess that he's referring to iOS.

</comment><comment><USER13> Lately I've been thinking about optimal UIs for highly competitive environments (military, day trading, fraud reduction) and I've come to the view that the majority of these interfaces should be through an extensible command line interface - and given the plethora of easy to install open source software, I largely think that the CLI of choice should be a linux terminal shell. Some I could also see being delegated to either a spreadsheet or a mixture of a spreadsheet and a terminal shell, but in general I thing SQL wins against SUM_IF + macros + Solver.

But if this _is_ the optimal UI for highly competitive environments, why isn't it also the optimal UI for uncompetitive competitive environments like retail?

Two reasons:

1\. Self selection. The highly competitive environments attract extremely intelligent people. Abstractionists can assemble a breadth of solutions that systematize solutions, while workers such as retailers are generally less adept.

2\. A constriction on UI is similar to a schema constriction. Aside from the occasional "General Notes" field on a intake form, the interaction can be structured more reliably than a person with a terminal shell. This is important partially because lesser skilled people can't be trusted to make higher level decisions like data structure.

I don't think #2 is a hard limit, I think UIs can be designed around the limitations of human intelligence and I think that systemic educational changes could make CLIs more friendly to the general public; but I think there is a local maxima that is more easily solved with software like Tulip* and so that is what we have now.

* [http://tulip.io/](http://tulip.io/)

</comment><comment><USER14> "NeXT had services, in which applications could publish menu items that became available in other applications where the two were using the same data." \-- am I mistaken, or doesn't Android have a similar concept in "intents," which allow different apps to send data to each other?

<comment><USER6> Yeah that sounds like Android intents ([http://developer.android.com/training/sharing/send.html](http://developer.android.com/training/sharing/send.html)) and content:// style URIs. There's all sorts of really cool IPC (inter-process communication) mechanisms among various OS's such as Unix domain sockets, D-Bus, ØMQ.

</comment></comment><comment><USER15> I think scripting is alive and well. I've seen self described non-programmers do all sorts of interesting things with Excel, that I would have done with BASIC in 1981.

</comment><comment><USER16> Scripting is experiencing a huge resurgence, just look at the prominence of Lua in the ML community.

Never thought writing WoW ui add-ons would prepare me for a 6 figure job.

</comment><comment><USER9> I think the OP is bemoaning a paradigm shift - cloud computing, with all the implications - without fully understanding it. The best modern applications _are_ built of APIs, and they are composable. It's practically my personal working definition of "best" (certainly popularity isn't the key). Perhaps the author had a bad experience with a few popular services.

</comment><comment><USER17> It sucks that GUI scripting is dying on the vine on Mac, but it still sucked even when Apple was trying to support it with AppleScript. It was always kludgey. BeOS seems like the only OS that made apps that were by default scriptable.

</comment><comment><AUTHOR> All very true. But what to do about it? The hubris, that is.

<comment><USER2> Can you provide an example of this hubris?

</comment></comment><comment><USER18> Utter garbage click-bait and FUD. "Scripting" in the form of writing code in high-level programming languages is not going away anytime in the foreseeable future.

<comment><USER19> That's not the definition of scripting that the article was refering to. The article was refering to automating tasks, which is usually, but not necessarily, accomplished with "scripting languages".

<comment><USER20> Powershell is fantastic for that kind of thing in the Windows environment...</comment></comment></comment>


Math for Artists: Exponents and Radicals - <AUTHOR> http://www.cattail.nu/school_web/math107/math_artists.html

<comment><USER2> I was expecting (or hoping) that the pictorial versions would somehow illuminate why these various identities hold. But they seem to be just an alternative set of symbols.

I wonder why numerals are used to represent 2 and 3 in some places, but stacked boxes are used in others?

The idea appears to be that artists find the use of colors easier to memorize / mentally manipulate compared to letters for variable identifiers. I'm not an artist, so I'm curious if others find this to be true.

<comment><USER3> Actually as both artist and mathematician, the first thing I had to do is 'translate' her visualization into something I could relate to my visualization on a given subject. Hmmm--- that is not really clear; I suppose what I mean is that we all 'see' things differently, the trick is to line things up! BTW, I didn't really notice the colors, so for me at least they made little difference...

</comment></comment><comment><USER4> When I imagine mathematical operations like these, I sometimes imagine numbers moving around, distorting, and fading in and out in a way representative of the calculation. For instance, "x^2 * x" would show the x on the right moving onto the x on the left, and the 2 fading down to be replaced by a 3 fading in, like an odometer. I'd like to some day create a Flash animation of some calculation showing those movements.

</comment><comment><USER5> What is the one with the eyeballs? I don't get that one.

<comment><USER6> It's the same as the one right above it. It's just redone in a silly way to make it easier to remember. (The hair and lips don't mean anything)

<comment><USER7> They just cancel each other out.

</comment></comment></comment><comment><USER8> Looks just like variablekitten from Abstruse Goose: <http://abstrusegoose.com/345></comment>


Cringely on Microsoft-Yahoo: Yahoo Needs Courage, Microsoft Needs a Heart - <AUTHOR> http://www.pbs.org/cringely/pulpit/2008/pulpit_20080208_004240.html

<comment><USER2> I see how Microsoft gets a heart out of this deal.

How does Yahoo get courage? Or does it discover it "had it all along" when it makes the leap?</comment>


[personal blog, new here, 17yr, tips?] How to start programming - <AUTHOR> http://shsceo.com/2012/06/25/how-to-get-started-with-programming/

<comment><USER2> I completely agree with you: the easiest way to start programming is go grab some tutorials. I did just the opposite to learn C++ when I was in school: I searched how to set up my environment. Then I learned the syntax of the language. And then I opened a C++ template and asked myself: "Ok, I know how to do loops, create variables, assign, arithmetic operations, functions... What the hell do I do now?" I don't know if "For Dummies" books are good (never read one of them), but I suppose any book will be OK as long as it teachs you the basics and leaves you ready to dig deeper in the language.

About the language to begin with... well, I started with C++ and I'm still alive. There are maybe easier languages, but I don't think that does really make a difference if you have a good guide to get you started.

If you want to continue programming in one language, once you have a basic idea I reccomend to start building things. Whatever it is. If you have any doubts, search Google. Any basic question has been probably asked before. If it's not, StackOverflow is your friend.

Last, when you feel comfortable with the language, grab a reference book/web and keep it. I don't recommend getting one of these when you're just starting because those books dig deep in the language, and it's hard to understand a concrete thing if you don't have prior, strong knowledge on other features of the language.

With this reference you can solve a simple doubt just taking a look, and you can also learn new things (and strengthen your knowledge on the things you already knew) just by reading it. In my case (I'm a WP7 developer) I have the MSDN .NET documentation and a C# In A Nutshell book. Reading this last book I've learned a lot of things that don't appear so easily on the internet (never heard of yield-return until I read this book, and it's really great). It's from O'Reilly editorial which, by the way, is the best for me in this kind of programming/reference books.

</comment><comment><USER3> If I could tell my 17-year-old self (who had already learned a high-school- friendly subset of C++, SQL, and a scripting language or two) the fastest accelerator for learning general programming concepts, I'd say learn a form of Lisp. I started by doing some of the 99 Lisp Problems ( [http://www.ic.unicamp.br/~meidanis/courses/mc336/2006s2/func...](http://www.ic.unicamp.br/~meidanis/courses/mc336/2006s2/funcional/L-99_Ninety- Nine_Lisp_Problems.html) ) and then took a class in my Master's program that taught with Paradigms of Artificial Intelligence Programming by Norvig. I like functional programming in general because I haven't found a simpler way to represent certain types of sophisticated algorithms like searches, sorts, pattern matching, etc. You may want to try it out and see if you like the style.

</comment><comment><AUTHOR> Hey everyone,

Thank you guys so much for the feedback. I didn't know if I should be making the blog more techy about my experiences as a programming at 17. Or my high school/startup experiences. Any ideas?

@benjlang I did change my twitter name. I wasn't really expecting anyone to follow me, but I guess now would be the best time to change my name. It is @Spshulem (It was recently Shuby_Doo, my nickname), feel free to follow :).

@andrewcooke I will be crediting the photos and doing that, I simply forgot when writing this post, thank you for telling me.

Any ideas on fixing the loading of the site for you guys? Or is it working again? It seems to load fine for me now.

</comment><comment><USER4> I'm 21, admittedly not much older than you. Incidentaly 17 is also the year when I really started programming (I had fiddled in html/css and php before that).

What I found that is that learning tend to accelerate. The more you know, you faster you'll learn new things. So go out and learn, anything, it doesn't matter. Don't get bogged (like me) on searching for the perfect language or framework or whatever.

Also, build things. For some reason I'm very appealed by the idea that you can learn something out of a book. But looking back, doing stuff is always the best learning experience, and it also tends to stick a lot better.

</comment><comment><USER5> Just an FYI, the comics are from XKCD and you should link them back or give credit.

</comment><comment><USER6> Nice blog, definitely going to follow. Tip: change your twitter username.

</comment><comment><USER7> Hey guys!

Thank you guys so much for the support and tips. I tried to follow what I heard from you guys and made a new blog about my tech and programming, not so much about me being in high school and being a teenager trying to work with adults.

So check out my latest post! Tell me what you guys think: [http://shsceo.com/2012/08/18/starting-my-first- programming-p...](http://shsceo.com/2012/08/18/starting-my-first-programming- project/)

</comment><comment><USER8> <http://learnpythonthehardway.org/>

There's a free HTML book. I used it in a class at my hackerspace. I also taught CS 101/102 as a grad student. Learn Python the Hard Way is a very good beginner text. Do as it says, and it will teach you the game inside the game of programming. (For beginners that's the Edit-Test-Debug cycle.)

</comment><comment><USER9> Database error. Cache: [http://webcache.googleusercontent.com/search?q=cache:5iRPqrY...](http://webcache.googleusercontent.com/search?q=cache:5iRPqrYxlpUJ:shsceo.com/2012/06/25/how- to-get-started-with-programming/+&cd=1&hl=en&ct=clnk&gl=uk)

</comment><comment><USER10> Good on ya for putting yourself out there.

Your blog could be interesting, especially if you can talk about programming projects that worked and didn't work for you.

(Your hosting service doesn't have the mojo to appear on the front door of HN.)

</comment><comment><AUTHOR> I used GoSquared(.com) to see where all of you guys are viewing from. It's really interesting: <http://cl.ly/image/323G26341W3e>

<comment><USER11> Thanks for mentioning GoSquared. I've been looking for something like that.

</comment></comment><comment><USER12> It takes guts to put yourself out there, so I appreciate the bravery, but the content quality is pretty sub-par. Compare to /r/learnprogramming's FAQ:

[http://www.reddit.com/r/learnprogramming/faq#HowdoIgetstarte...](http://www.reddit.com/r/learnprogramming/faq#HowdoIgetstartedwithprogramming)

Keep writing, though! It's completely okay to write articles over subjects that have been discussed to death; they make for good practice. However, submitting those types of articles here is generally discouraged (unless you offer a truly unique perspective on the issue)

</comment><comment><USER13> For computer programming tutorials I would recommend <http://pickatutorial.com>

</comment><comment><USER14> Why the urge to be a CEO?

<comment><USER15> Have you ever been 17? :)

<comment><USER14> I am 18. So yes, it was just a few months ago actually!

I understand it, yet I think it is an immature behavior. I believe it's better to be known for what you actually do and titles given to you by other people, than slapping a title next to your name.

Except when you bootstrap a startup, work nine to nine every single day for months and raise a million or two. Then you can probably say you're a CEO.

</comment></comment></comment><comment><USER16> Sigh. w3schools claims another victim.</comment>


Exploding Offers Suck - <AUTHOR> http://blog.ycombinator.com/exploding-offers-suck <comment><USER2> A dear friend and excellent negotiator told me that when he gets any kind of short-term exploding offer, the first thing he does is verbally reject the deadline. And the second thing he does is ignore the deadline and offer feedback only after it has passed.

I've seen him employ this many times in practice and it has always worked out. I don't want to be responsible for anyone losing a deal, but remember: when someone offers you an exploding offer, it's because they really, really want you to take it. If anything, it should be a sign there's (a) more time to be had, and (b) plenty of room on the terms.

Any deadline claim has to be concrete and believable. The start of the YC program is a good example.

<comment><USER3> > when someone offers you an exploding offer, it's because they really, really > want you to take it.

Couldn't it be because they've got a lot on their plate and after a certain period of time they want to free up their brain cycles and stop wondering if you're going to accept that deal?

Couldn't it be that you're barely preferred and making the deadline shows them that you're excited about the offer? Missing the deadline shows that you're not excited and they'll know to go with the second best candidate?

FWIW, I'm relating this to exploding job offers as I have no direct VC experience.

<comment><USER4> Whenever I've offered an exploding offer in the past, it's because I had several candidates: an extremely strong candidate and several strong but somewhat weaker candidates. In general, all of the candidates have a limited timeframe to make a decision, and there's a risk of losing _all_ candidates if I waited for an indefinite time on the strongest candidate.

In other words, candidates sometimes also need an answer within a certain timeframe (often for very legitimate reasons; a job change can often be a life-changing event) and that means that there are some real time-limits across all of the candidates (in both directions).

<comment><USER5> >Whenever I've offered an exploding offer in the past, it's because I had several candidates: an extremely strong candidate and several strong but somewhat weaker candidates.

If you had several candidates of equal ability, would you still use an exploding offer? Otherwise, it seems to be less about "giving candidates an answer within a certain timeframe" and more about putting pressure on the candidate you really want.

>there's a risk of losing all candidates if I waited for an indefinite time on the strongest candidate.

Is there nothing in between an exploding short-term offer and an indefinite open-ended offer?

<comment><USER6> _If you had several candidates of equal ability, would you still use an exploding offer?_

I would think you would. If you have 10 candidates but only want to hire 1, you can only issue one offer at a time regardless the fact that all 10 are equally qualified. While the first candidate would love to have all the time in the world to contemplate the offer, the employer and the other 9 candidates who are waiting in line don't want that.

<comment><USER5> >the other 9 candidates who are waiting in line don't want that [to wait for the first candidate to contemplate the offer]

If any of them have other offers, they might appreciate _some_ extra time to decide between them.

EDIT: Nevermind the previous bit--I was still thinking in the context of multiple simultaneous offers, which I guess is not a thing.

And if not, then if the first choice turns it down, you make an exploding offer to the second (to be fair to the next 8), and again to the third (to be fair to the next 7), etc. Is there ever a situation where an exploding offer is not in everyone's best interest?

<comment><USER7> > And if not, then if the first choice turns it down, you make an exploding > offer to the second (to be fair to the next 8), and again to the third (to > be fair to the next 7), etc. Is there ever a situation where an exploding > offer is not in everyone's best interest?

The ideal scenario would be if it were socially acceptable to rescind offers—thus making the exploding offer unnecessary. An employer could make offers to everyone they're interested in, see who accepts, and then stay with them (essentially, allow parallel analysis on both sides). Instead, candidates can have multiple simultaneous offers while companies can only make offers sequentially. Hence the exploding offers.

<comment><USER8> A rescindable offer worse than a deadline, because the deadline is unpredictable.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> It is pretty clear to see whats going on:

It is without question that most people applying to incubators apply to a few of them, in case they don't get into the (obviously) best one, YC.

Its my guess that some of the less exciting incubators give these exploding term sheets to make the founder think:

"Damn, I got into Incubator X but I have to say yes in 48 hours. I wonder if I will get accepted into YC also when answers go out in 2 weeks. Should I risk walking away with nothing, or just take the offer I have now..."

Would not be surprised to see more incubators doing this anyways, with or without exploding term sheets. They will likely just move up the dates their sessions start (and the date you need to say yes by), to make sure its before YC answers go out.

On the same hand, I am not sure what you expect other incubators to do. YC is hands down the most prestigious incubator to get into and everyone knows that. So, you have a bunch of other incubators that have to think scrappy to get people into their programs. These guys don't just want YC's cast-offs, after all.

If YC was to start doing rolling acceptances for a start date, it would solve the issue of other people doing exploding term sheets. If I apply to YC today for the winter batch and can interview and get a yes in a few weeks, then the motivation for other incubators to do this behavior is gone.

YC partners need to realize they are the cause of other incubators giving out exploding term sheets. I know YC likes to make a event of doing all the interviews/acceptances on one day, but it would certainly be much more entrepreneur friendly to have it be rolling admissions. The start dates for sessions can still remain the same of course.

<comment><USER10> > These guys dont just want YC's cast-offs, after all.

That is thoughtfully provocative. I have literally zero evidence to go from, but I suspect that Y Combinator is like Harvard or Yale: they could get rid of the group that they actually admit and go for the next tier, then achieve similar outcomes. (In other words: there are so many strong applicants that they can't take them all.)

This is just to say that even taking YC's cast-offs could be perfectly acceptable. YC is dominant for now, but it's not hard to imagine a world in which there are a few accelerators which are true YC peers (just like Harvard, Yale, Princeton, and Stanford are variously preferred by different people with real differences in preference).

<comment><USER9> Im sure a ton of the companies who apply to YC and dont get in are still Grade A. But you have to trust YC knows what they are doing, and the A+++ companies will be picked over before they hit second or third tier.

You have to remember that investing in companies is a lottery game. Most angels/vc's profits are made on that 1 in a million company with a 1000x return.

If YC wants access to truly the best companies, they need to institute a rolling admissions. Otherwise, these scrappy second tier incubators will get lucky a few times when a nervous founder takes a bird in the hand over two in the bush. The policy only hurts YC itself.

<comment><USER11> > 1 in a million company with a 1000x return

Sounds like a terrible expected ROI ;)

<comment><USER12> Not if you can selectively winnow through and take the 100 best. Then it's a guaranteed home run.

</comment></comment></comment></comment></comment><comment><USER13> When my co-founders and I were applying to accelerators in 2008, we had been accepted into a Philadelphia based accelerator called DreamIt shortly before our YC interviews. Not knowing if we would get into YC, we accepted with DreamIt as it was an exploding offer. A few weeks later we found that we got accepted by YC. After deliberating it for sometime, we went back to the DreamIt team and told them that we wished to rescind our acceptance. This started a shitstorm with the DreamIt team as they seemed to take this very personally. It was the first year of doing the accelerator and they went as far as threatening to take legal action. Not knowing what to do, we turned to PG and Jessica for help, a bit hesitantly, as we were afraid of what they would say. PG expressed his extreme disappointment with how DreamIt had reacted to this and was supportive of our situation. He send them an email telling them to back off and that this was not an acceptable way to be treating founders.

Just one anecdote out of many of how YC has gone to many lengths to protect founders.

Since that experience, I've realized that it really doesn't do accelerators any good to introduce these conditions in their funding offers. It creates a bad reputation amongst founders in the increasingly competitive field of accelerators. And founders ultimately need to pick based on what they think will have the most impact to their business. Compete on benefits you can offer to founders, not legalese.

<comment><USER14> So basically you made an agreement with one set of investors and then went back on your word because another, "better" set of investors wanted to put money in? Maybe it's just me, but this doesn't reflect that well on you.

<comment><USER15> The effectiveness of the relationship between investors and startups in SV is built on upon being upstanding and not being overly manipulative. Founder/Investor agreements that are born from the manipulation of unexperienced founders always should be EXPECTED to turn out badly.

There's a child-like expectation that once the deal is signed or agreement is made that it's over. It never is, that's just the beginning. If you're expecting that everything is finalized as soon as an agreement is made, regardless of the conditions, then you're simply bad at business and taking risks that you haven't yet realized.

(Of course this isn't true in Europe. They love taking contracts extremely literally, and their economies suffer enormously for it.)

</comment></comment></comment><comment><USER16> I'm an MD for Techstars and I completely agree. This is the approach we've always taken for the programs that I've run, (Techstars Cloud and the Austin TS program).

In several cases, just as a consequence of the calendar, the timing of when we've given offers out can create tension for a company, particularly if it lands in between the YC interview notification and the actual YC interview. When it's come up in the past I've aways encouraged founders to notify YC and see if they can either take the interview early or if our timeline permits, to let them take their YC interview knowing that they have a standing offer from me regardless.

I've had some people mention to me that this is merely bolstering these companies' applications to YC, but I don't view it that way and regardless of which program they end up in, it's the right thing to do imo. It's actually worked out quite well and I'm happy with the companies that chose Techstars in those scenarios over YC, and also completely happy for the companies that chose YC.

<comment><USER17> I went through YC in '07\. But prior to getting into YC, I got into Techstars' very first class. David was a total class act in letting me go through the YC interview process before making a decision and completely understanding when I decided to go with YC. Although I went with YC(and would do so again), that one experience left a positive impression in my mind of TS.

</comment></comment><comment><USER18> Is this a change for YC? YC previously required getting an answer the day you're accepted because "you have all the information". So this is an update to allow people time to decide, right?

I always found the justification of having all the information a bit self centered. Founders have all the information... about YC, but not about other options.

That said, as a YC alum, I think you should almost certainly say yes if accepted.

<comment><USER19> only in the early years of YC did we require an answer right away.

as much time as the founders want has been the unofficial policy for awhile, but i thought it was time to share it.

<comment><USER20> I think it's a good opportunity for YC to improve the acceptance process. Why don't you review the applications in a FIFO basis and give an immediate green light to invitations? If they are ready for an interview why not have weekly interviews till the deadline? Clearly the waiting isn't founder-friendly neither..

<comment><USER21> At a guess because that would eliminate the largest advantage the classes system gives: batch acceptance gives YC the opportunity to evaluate all the potentials against the backdrop of every other entry. If they start accepting along the line then they're going to disadvantage themselves because there is only a limited number of slots for interviews. So by sorting them in decreasing order they operate more efficiently.

</comment></comment></comment></comment><comment><USER22> Cool change of policy. Brian Chesky says in this video that Y Combinator gave AirBNB an exploding offer back in 2009:

[http://youtu.be/6yPfxcqEXhE?t=53m6s](http://youtu.be/6yPfxcqEXhE?t=53m6s)

<comment><USER23> When I was reading this I thought to myself "wait, didn't YC have exploding offers before"? Glad you dug this up. It was widely known back then that PG viewed it as a "intelligence test" if you didn't accept on the spot. If you didn't, he didn't want you. So I guess now the tide has turned.

That all said, I'm very much against exploding offers. The person offering the deal may have a reason to do so but you should resist the urge to rush to a decision.

<comment><USER24> Here's the write up from the pg's essay site.

[http://www.paulgraham.com/frinterview.html](http://www.paulgraham.com/frinterview.html)

<comment><USER25> The relevant bit:

 _F|R: I read that when you call Y Combinator winners, the founders have only five minutes to accept. ( "If people turn us down," he says, "as far as we're concerned they've failed an IQ test.") Have startups turned you down? Are there any that have turned Y Combinator down and still gone on to succeed with a liquidity event?

Graham: You're confusing two separate things. The reason people are supposed to decide quickly whether or not to accept is that they already know everything except the percent we'll ask for. They've already seen the deal terms, and they already know as much as they're going to know about YC before actually working with us. So they should already know when we call what percentage they'd be ok with. Since all they have to do is subtract one integer from another, five minutes should be enough.

The "IQ test" quote refers not to how fast they have to decide, but the amount of equity we usually ask for. In the median case it's 6%. If we take 6%, we have to improve a startup's outcome by 6.4% for them to end up net ahead. That's a ridiculously low bar. So the IQ test is whether they grasp that.

There was one startup that turned us down because they received an acquisition offer during the weekend when we did interviews. It was a pretty good offer. I'd have taken it in their position, and they did. But other than that I don't know of anyone who turned us down and went on to succeed. There have only been about three others who turned us down. _

</comment></comment></comment></comment><comment><USER26> It's a little different for a lot of other accelerators. YC takes batches of, what? like 40 companies or so in a batch? Most other accelerators are smaller with class sizes around 10. If YC is shooting for 40, and gets 37, it's maybe not a huge deal (8% under target). You could even make 42 or 44 offers and plan for a certain acceptance rate, end up with 44 probably isn't the end of the world (110% capacity).

If another is shooting for 10 and gets 7, that's a 30% drop which is probably enough to mess with the economics of the accelerator. Similarly, if they make 12 offers planning for a certain acceptance rate and end up with all 12, they're at 120% capacity, which also might be enough to mess with the economics.

I still think exploding offers suck, but YC is in a much stronger position to be relaxed about them than others.

<comment><USER27> I agree. Also, it is not like they house the people, which is more complicated that office hours. In this case, they are talking a negative about YC and spinning it into a positive.

</comment></comment><comment><USER28> In general, if someone wants me to agree to something "big" immediately, I figure that they don't want me to have time to consider it carefully.

If you don't want me to think about something, I figure you know I would probably decide against your offer (if I _did_ think about it).

<comment><USER29> I agree, but exploding offers tend to explode sometime after "immediately". i.e., the deadline can be enough time to think everything through and do your due diligence. Still an exploding offer.

</comment></comment><comment><USER30> While I agree with the points made in this post, it's important to note that the strategy of condemning offers with a short term plays in the favor of YC and other established/larger accelerators and to the detriment of newer/smaller accelerators.

As others have noted, there may be compelling reasons to require an offer be accepted on a short timeline or not at all. In fact, as raised elsewhere in this thread, YC itself used to require acceptance the same day the offer was made.

From an entrepreneur's perspective, given two offers at equivalent valuations and terms it's rational to take the offer at the more established accelerator (e.g. YC) over a less well known one. It's also less important for large accelerators to allocate each open position in each cohort, and thus easier for larger accelerators (e.g. YC) to tolerate losing a few deals last minute.

Again, I agree with the points made in the post, but it's important to note that making longer term offers the norm plays in YC's favor.

</comment><comment><USER31> I'm sure Sam's heart is in the right place but I'm not sure I agree with him here:

"Exploding offers suck. Founders should be able to choose the investor they want to work with, not have to make a decision based on time pressure."

and investors should be able to choose the founders they want to work with. And accelerators are the one's who make it all about the calendar. So they inject the notion of time and deadlines (YCSpring12 etc)

"where an accelerator tries to force a company to make a decision about a funding offer before the company has a chance to finish talking to other accelerators."

The risk here is that sounds like sour grapes.

"after we make you an offer, we'll give you until the beginning of our program to decide (though most companies accept quickly, because you can't start having office hours with us and participating in other ways until you accept). We ask companies to be transparent with us about needing more time--we won't rescind our offer. It's usually about 45 days from interview to the start of the batch."

\- We use "soft" deadlines. You don't get access to important resources until you say yes. And yes look we have 45 days from interview to the start of the batch (there's that pesky calendar coming into play)

"We encourage all other accelerators to join us on this. It should be an easy yes. Exploding offers are the wrong thing for founders, and an accelerator that does the wrong thing for founders will not last long."

\- We're the pre-eminent accelerator and other accelerators should play by the same rules as that way we'll stay the pre-eminent accelerator!

"And founders should think very hard about joining an accelerator that puts forth a short-fuse offer."

Once again makes me feel like they're losing out to this tactic and it's hurting. And a bit of FUD?

Are you creating startups that have to go out and compete in a very competitive world? Seems like insulating them from making important business decisions is a little counter intuitive.

Again, I'm sure Sam's motives are pure. This is a little tin can ear to me and whiny.

</comment><comment><USER32> This is true for ALL exploding offers. Not just accelerators or investment term sheets, but for employment as well.

<comment><USER33> Indeed exploding offers for me is like: "Lets double, triple check this, this is fishy."

</comment></comment><comment><USER34> It seems like the other accelerators are doing this so they don't end up with only YC-rejects. Since YC is probably considered the top accelerator, it's also better for YC to have other accelerators not give exploding offers. Because then the few companies that would have accepted the exploding offers AND also would have gotten into YC, can now actually go to YC instead of accepting an exploding offer. If I missed something, I'm sure you'll point it out ;)

</comment><comment><USER35> A couple observations...

1 - If you're good enough to be accepted by one incubator, you have an incubator-worthy idea and team. If they go away, another will arrive.

2 - The person forcing your hand is trying to use their temporary leverage over you until you have leverage over them. It sets the tone of the relationship on leverage.

3 - That said, people with lower acceptance rates (whether it's accelerators, colleges, etc) have to play yield games. Harvard yields ~80% of admits so they can wait their time because they are confident of admits, and it won't impact their capacity. Amherst accepts ~40%, so they have to play the waiting-list game. The 2nd tier accelerators have to play waiting list games, and that's what drives this behavior. 48 hours is unreasonable, but a few weeks isn't. (Or having a formalized waiting list too)

</comment><comment><USER36> I accepted an exploding offer. It was a harbinger to a larger detonation.

There's a simple way of looking at this type of behavior: If someone is willing to go negative on you at the beginning (evidenced by 'denying' you an investment because you didn't take it when _they_ wanted you to take it) then you should assume they will be willing to go negative on something else of a similar or greater magnitude at a later date.

<comment><USER37> Yep.

</comment></comment><comment><USER38> This seems like a step forward. Exploding offers are generally unpleasant, usually a power play from the side that has less to lose.

It's also common practice for companies to extend exploding offers to new hires. Replace "accelerators" with "companies" and "founders" with "hires" and you get a very similar argument for not forcing people to take a job until they've completed their own decisionmaking process (this ultimately benefits the company as well, in my opinion).

<comment><USER39> I've used it for new hires. Helps get quick closure on those whose decision is right on the edge. Also you get to know how strong an interest they have. But if they ask for more time, I usually give it. They just have to be confident enough to ask.

</comment></comment><comment><USER40> This is a tactic I see used on the micro level on Shark Tank where usually Mark Cuban will be like "25 second shot clock, you gotta decide right now." Being a Shark Tank and Dragons Den addict (both Canada and UK versions) I can say the greatest difference between the US version and the others is this tactic. I have never seen any of the Canadian or UK investors do anything remotely similar. Usually they are more impressed by companies that take the time to think about the offers. Just an observation.

<comment><USER41> Just a point about Shark Tank and similar shows: the actual meeting is a lot longer than the ~6 minutes that they show you. Some go on for hours, and they just cut to the interesting bits, so that 30 sec shot clock thing is often just theatrics, they've been discussing things for a while and know before whether they're gonna say yes.

<comment><USER42> I learned this recently, the most interesting part of which was that the founders stand silent in front of the investors for at least a few minutes while the lighting and sounds and such are set.

I wonder, don't you think the shot clock offer is real even though they've been talking longer than we've seen?

<comment><USER41> It might be kinda real, but I think it's a lot easier to see coming and prepare for than the show implies. I've only watched the last two seasons of shark tank, but from what I remember the offer always seems to come out of left field, Mark doesn't appear interested and then he suddenly makes an offer. I don't think it's usually like that, but it makes for some great television.

</comment></comment></comment></comment><comment><USER43> A good alternative for YC to consider is to change to a 'continuous' mode.. where you incubate companies on 1st Tue of every month. The companies in a batch are already in variety of stages, some just starting with an idea, some with some market validation done, some may even have raised $500K round before.

This is very much unlike a college or a vocational class, where all participants are in more or less same stage.

</comment><comment><USER44> I agree with the concept for the most part, but have a few gripes.

First, the desk space argument is very real. Y Combinator takes 60+ companies and has no real space constraints since they do not offer office space. Other accelerators take far fewer companies and do have office space, so they need to know ahead of time 1) that their batch will be full and 2) that each company has passed their own due diligence process.

Also, as with term sheets, founders can take their offer from one accelerator and shop it to others. It's happened before (with people I know), who take an offer from one accelerator and use it to trigger FOMO from the other.

Couldn't an accelerator just position it's start date before Y Combinator's decision date, and therefore not need an exploding offer but have the same effect?

Exploding offers should be reasonable, and I'm not against being fair to founders. But doesn't democratizing this essentially involve accelerators colluding to have the same offer/acceptance date?

</comment><comment><USER45> Academic here: Doesn't this post state that the offer has a 45-day duration?

Are offers that "explode" only a few days in duration?

<comment><USER2> The distinction is this: "exploding" typically refers to a very short period of time, designed to prevent shopping the deal, extensive legal review or advice, or exploring other options. A legitimate deadline for an offer wouldn't be called exploding if it spans many weeks and lets a participant fully understand it.

</comment></comment><comment><USER46> I used an exploding offer effectively _once_. I was buying a house in 2002, during the crazy bull market on housing. Houses in the neighborhoods we were shopping regularly went for more than list, with competing bids. We finally found a house, at the very top of our price range, and put an offer in for it just a few hours after it first listed - for list price. The seller's agent was furious! She really wanted to drag it out to the weekend and get a bidding war, which we absolutely could not afford. But what were they going to do... turn down a list price offer? Why not just sell it at a higher price, then?

We still have that house, 12 years later. It's finally worth what we paid for it again. Sigh.

</comment><comment><USER35> It's not the same as job interview exploding offers, but the thought process behind it is the same.

[http://www.joelonsoftware.com/items/2008/11/26.html](http://www.joelonsoftware.com/items/2008/11/26.html)

</comment><comment><USER47> I got an exploding offer for employment and came to the same conclusion. The company is called Loyal3: [https://www.loyal3.com/](https://www.loyal3.com/)

Steer clear of them.

"Senator? You can have my answer now, if you like."

<comment><USER48> Employment offers tend to be exploding because a company has a single need and doesn't want to lose every candidate because they are waiting for their top choice.

Almost every offer of every kind 'explodes' at some point. It's the duration until the explosion that varies. I'm sure YC will make you reapply for future consideration, just as companies can not be expected to honor your employment offer if you defer for a year.

<comment><USER49> What's a normal period for exploding employment offers? Is 2 days a lot or a little?

<comment><USER48> In my experience two days is low. 5-10 days is more common, and most companies are fairly willing to negotiate beyond that given some circumstances. It's not common to see candidates rejected if they try to accept an offer after it explodes.

<comment><USER49> Thanks. Also wondering: should more senior people be offended by exploding offers. Architects, team leads, etc?

<comment><USER48> I'm not sure anyone 'should' be offended by an exploding offer. There are lots of potential factors at play. You only see people talking about exploding offers of employment when the window is relatively small - no one bats an eye when given 45 days to accept a job offer, as that should give plenty of time to find other competitive offers. It's those 3-5 day figures where candidates tend to think they smell a rat.

No one wants to be forced into a decision at gunpoint, which is essentially what a short notice exploding offer becomes. Part of this is also dependent upon the length of the interview process and how much detail is given. If you interview with a company 10 times over a 6 week period, I don't think a short window for acceptance is overly limiting for most candidates.

We often see candidates trying to expedite the offer process in order to receive offers around the same time. Candidates are at their most advantageous position when they hold multiple active job offers, and they have the opportunity to leverage them off each other (I'm not suggesting this tactic). Yet when companies try to expedite the acceptance process, suddenly we feel that there is something dubious at play. Candidates want companies to make quick (and positive) hiring decisions, yet want to take their time to maximize their ability to shop for offers.

More senior talent is less of a commodity than an entry-level candidate, so you might expect more junior level candidates will see exploding offers more often than senior candidates. Senior talent can also leverage their experience a bit more in order to get windows increased if necessary.

I don't think they should be offended as much as they should be curious as to why the company employs such tactics (assuming again that the window is short).

<comment><USER50> > We often see candidates trying to expedite the offer process in order to > receive offers around the same time.

As a candidate, what would be the best tactics to achieve that objective? Say I have 6-8 candidate employers, from mature startup to enterprise in size, and I'm moderately senior. My approach would be to do the phone screens with them all, and narrow it down to about 4 companies to interview with in person, then do that all in a single week, planning on accepting somewhere at the end of the next week.

<comment><USER48> To maximize the chances of offers coming in around the same time, I generally suggest that candidates stagger applications as a first tactic. Generally speaking, we expect smaller companies or firms with lower levels of bureaucracy (not always the case) to move quicker, so one should apply to those last since they can usually be more agile.

Once in the interview process, you can try to expedite some interview processes while slowing down others. So you might ask one company to push an interview up and another to push an interview back. Once an offer is about to be presented, asking questions can help delay a bit as well - you could ask all your questions at once in an email if you want a speedy reply, and you could ask questions in a live meeting or call (that requires scheduling) if you want to buy yourself a few days.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> It's simple: if you're being pressured just say 'no'. There is no upside to negotiations under pressure, only downsides. Likely the pressure is there because if you thought about it long enough you'd refuse the deal anyway, so you might as well refuse it right off the bat and tell the counterparty the time-limit is what caused you to refuse.

If you have no other options then likely you already made a series of mistakes. Exceptions exist but don't happen often enough to go and make a series of qualifications here, adding pressure is similar to being blackmailed, the only reasonable course is to refuse to play.

<comment><USER51> Actually, if you're being pressured, a better response is, "If you need an answer now, it's going to have to be 'no', so I hope you can adjust your schedule so we can consider your offer more fully."

Exploding offers are unfortunate and a significant negative data point about the behavior of the organization but they are not the only data point. The above answer will defuse the threat and give you the upper hand in the negotiation so you can make the right decision for your team, whether it's 'yes' or 'no'. This is helpful for exploding offers in any circumstance - jobs, M&A, etc.

As a side note, while short-horizon offers are terrible, it is reasonable to have some expiration date. Techstars Seattle, for example, has 10 slots and while they might be able to add an extra one or two, logistics don't allow for the kind of flexibility that YC has[1]. I believe there's a good way for an accelerator to handle this ethically:

1) Tell applicants when the decision date is when they apply (so they can plan accordingly) rather than surprising it on them as a negotiating tactic

2) Provide all relevant information when they apply, so they can consider the possibilities in advance, versus (for example) springing restrictions, valuations, or fees on them when they get the offer

3) Allowing enough time between the acceptance and the notification for the team to make a good decision - a week seems reasonable.

YC's behavior is exemplary here; their model and position in the industry lets them be super-flexible. Other programs may not have the ability to be quite as flexible but that doesn't mean they're unethical if they're thoughtful about their implementation.

[1] My understanding as a mentor for the program - I don't have inside knowledge

<comment><USER21> Good one, yes, that's even better.

</comment></comment></comment><comment><USER52> This is sensible and good for the entrepreneur. If its good for the entrepreneur, its good for the prospective accelerator, its good for the prospective investors and so on and so forth. The virtuous cycle is for real. The issue is the not-so-famous accelerators bear the brunt because almost all applicants are awaiting response from YC and not the other way around. If the conclusion of this is you give you short-term exploding offer, the accelerators have got it all wrong. Instead, the right perspective is that they need to make their value prop as strong as a YC. Glass half-full/half- empty, remember?

</comment><comment><USER53> There's a balance between "exploding" offers and hang-around-forever offers. You don't want someone to come back 6 months later and say they're finally ready to accept your offer.

Its not difficult to balance these factors. Just ask, "how long do you need to consider this deal?" "Two weeks? Four weeks?" "If you need more time, just give me a call."

</comment><comment><USER54> Exploding offers make perfect sense in situations like this. Especially if you're given 48 hours, that's plenty of time to accept/decline. And if it's not enough time then you weren't ready to play ball yet anyway. If I'm making someone an offer, I'm not giving them weeks to decide so that they can go shop around for something better.

</comment><comment><USER55> I'd feel a bit more ok with exploding offers for organizations where there are a finite number of slots -- e.g. if an accelerator is very small and capital or other resource constrained, or has a hardware lab and limit space, or something like that. None of that applies to YC, of course.

</comment><comment><USER56> Most exploding offers don't represent credible threats. That being said, if someone jumped at one of my exploding offers, I'd definitely try to negotiate a better price ex post facto given my read that the counterparty is so jumpy.

</comment><comment><USER57> > It may be the best thing for accelerators to use time pressure to get > founders to accept their offer, but it's definitely not the best thing for > founders.

isn't that 'not the best thing for accelerators' in the long run as well? if you're using a strategy which is clearly not win-win, you're going to lose _good_ deals to people who aren't doing that - so you'll get stuck with a portfolio of companies run by founders not smart enough to see this for what it is. enjoy, sucker!

</comment><comment><USER58> Sam - This is standard fare not just for accelerators but VC term sheets as well. Curious if you apply your logic in that case as well?

</comment><comment><USER59> _> It may be the best thing for accelerators to use time pressure to get founders to accept their offer, but it's definitely not the best thing for founders. _

Why should accelerators should do what is best for someone else, not themselves?

The world is full of expiring offers of all kinds; they are everywhere. Rarely does any kind of offer stand for as long as we would like. Expiry of offers is the norm.

Also, Golden Rule: he who has the gold, sets the rules.

</comment><comment><USER60> What if you accept the exploding offer and then break the contract or avoid to sign it?

</comment><comment><USER61> exploding offers call for exploding counter-offers

<comment><USER42> "You have 24 hours to give me more than 24 hours" ?

<comment><USER61> I agree to your terms but you get half equity.

</comment></comment></comment><comment><USER62> the solution: a centralized clearinghouse that uses the gale shapely deferred acceptance algorithm</comment>


Ask HN: Best Legal Entity to Create for a Single Founder Non Profit? - <AUTHOR>

I have been working on a startup over the past 2 years now.  After a lot of consideration, I have decided that the success of the startup is more important than monetizing the startup.  Because of this, I want to start some type of non-profit legal entity for my startup.  I have done research on non profit organizations, and they require a board to be formed.  I have a very distinct vision for this start up and don't want to give control away to other people.  Also, I could not take a developer's salary if I were to start an NPO.  I have no want of monetizing this startup.  I have no plans of running advertisements on my website, as they would actually be detrimental to my vision for a startup.  I don't plan on trying to get funding
from capitalists or angels because they usually want a stake in the company and I'm not after money.  I do plan on taking donations.
I want to use the donations on hosting, and if the site takes off, a developer's salary for myself, so I can work on it full time.  I plan on running this startup until my last breath, and there is not an amount of money it can be bought for.
What is the best type of legal entity to form for a person in my situation?
Is creating a successful startup without any goal for riches just a pipe dream? <comment><USER2> _> What is the best type of legal entity to form for a person in my situation?_

Is it remotely possible that what you're doing might result in legal action taken against you by one of your users? If so, I'd go with an LLC to separate your personal liability from your corporate liability. If not, you might be fine treating it as an S-Corp. I would suggest the LLC, though. [This is not legal advice. I am not a lawyer.]

 _> Is creating a successful startup without any goal for riches just a pipe dream?_

Not at all. What would lead you to think it's unreasonable?

<comment><AUTHOR> Do you think the costs involved in hosting a large scale web application could be paid for entirely from donations?

<comment><USER2> I would doubt that a "large scale web application" would be covered by donations, unless it were truly exceptional, like Wikipedia. I certainly wouldn't want to bank on it. But it's possible.

I was interpreting your comment about not having an eye for "riches" as meaning that you weren't looking for the big exit that many of the founders at HN are looking for (see the conversations a few weeks back about how retiring on $4MM might not be "possible"). "A successful startup" could just mean that it covers its own costs and teaches you something along the way. At least, I'm open to that interpretation. Some at HN would describe that dismissively as a lifestyle business.

Bottom line: I don't know what your needs are for launching and maintaining the app. At some point, you'll need to decide who's going to pay for the costs: you (out of pocket), the users (through donations or subscriptions), or a third party (advertisers or data miners). Without some external source of funds, it'll fall back to you. That might not be a bad thing, but if you truly are talking about a "large scale web application" along the order of ... well ... even modest successes like Quora or Outright or something ... well ... the money's going to need to come from somewhere. I wouldn't count on donations being the source. But that doesn't mean you shouldn't try.

<comment><USER2> I should qualify my comment about "modest successes" ... I have no idea what Quora or Outright look like from the inside. They could be _wildly_ successful based on whatever metrics they have in place. I was just trying to differentiate that level of success from the Facebooks and Twitters.</comment></comment></comment></comment>