Metarpheus: A Custom Approach to API Contracts - <AUTHOR> https://blog.buildo.io/metarpheus-a-custom-approach-to-api-contracts-f340a6792d43 <comment><USER2> Off topic: How do you pronounce the name?

<comment><USER3> I would say like "morpheus"</comment></comment>


New PHP Vulnerability:?-s may expose source code for mod_cgi - <AUTHOR> http://www.php.net/archive/2012.php#id2012-05-03-1

<comment><USER2> This vulnerability is about as bad as it gets, and my heart stopped while I was reading the intro (it's so trivially simple to compromise a site).

Then I reached this sentence, which I felt needed to be bolded and underlined:

 _A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this._

<insert immense sigh of relief>. Thank God.

That said, some blackhats are going to be really sore that a backdoor that's been wide open for "at least 8 years" is finally being closed.

<comment><AUTHOR> You're right, my title was a bit sensational. I softened it a bit by appended mod_cgi. I think it is very telling that the PHP core recognizes that the people using mod_cgi probably can't upgrade so they're offering a .htaccess adjustment - very commendable.

<comment><USER3> Well, after all, PHP is all about backwards compatibility.

</comment></comment></comment><comment><USER4> From the commit that introduced this bug:

      The point of the question here is if anybody remembers why we decided not
      to parse command line args for the cgi version?  I could easily see it
      being useful to be able to write a cgi script like:

        #!/usr/local/bin/php-cgi -d include_path=/path
        <?php
            ...
        ?>

      and have it work both from the command line and from a web context.

      As far as I can tell this wouldn't conflict with anything, but somebody at
      some point must have had a reason for disallowing this.

Perfectly illustrating the utility of well-chosen comments in code.

<comment><USER5> In addition, it illustrates the utility of well-written commit messages with judicious use of the blame utility.

</comment></comment><comment><USER6> Here's a fun fact...if you try this trick on <http://facebook.com/> you get the following source code

<?php

include_once '[https://www.facebook.com/careers/department?dept=engineering...](https://www.facebook.com/careers/department?dept=engineering&req=a2KA0000000Lt8LMAS);

<comment><USER7> Clever. I wonder if they have a tradition of having exploit easter eggs like this?

</comment></comment><comment><USER8> From the article:

 _> [...] we had a bug in our bug system [...] causing this issue to go public before we had time to test solutions to the level we would like._

Ouch.

<comment><USER9> So we know about this issue because the bug for the disclosure vulnerability was vulnerable to disclosure because of a bug.

</comment></comment><comment><USER10> <http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/> has some more info, including the fact that they first reported it to the PHP devs in the middle of January.

</comment><comment><USER11> From Twitter: Stefan Esser  @i0n1c The security emergency release to fix the PHP CGI RCE (that was tested for days...) does not fix anything at all.

<comment><USER12> Here is the fix that was applied:

[https://github.com/php/php- src/commit/55869a95ab75c0eb99c572...](https://github.com/php/php- src/commit/55869a95ab75c0eb99c57201bfeccaef57e0d36d)

If the first char in the query string is "-" and the query string also contains "=", it skips cmdline argument option parsing.

Maybe it is possible to construct a string not starting with "-", not containing "=", but containing a "+" followed by "-options" further out?

<comment><USER13> No, the problem is that they check the decoded query string for `=` signs, but Apache checks the raw query string. If you pass an encoded `=` anywhere in the query string then you can bypass the fix.

</comment></comment></comment><comment><USER14> 1) It's not new.

2) Running PHP as regular CGI (not FCGI) is a very dated practice so the amount of implementations that are vulnerable is probably limited.

</comment><comment><USER15> As has been mentioned, using CGI for php is quite outdated so it probably doesn't impact that many sites, that said this sort of vulnerability is exactly why you should put all but the minimum front controller PHP in a folder that's outside of the public folder your site is being served from.

<comment><USER16> Absolutely not. Lighttpd and Nginx both use it, and have recently picked up a lot of popularity because of it.

It maybe an old mechanism, but it is fast, which is worth something these days :)

<comment><USER17> Those generally use FastCGI, which again, is not vulnerable.

</comment></comment></comment><comment><USER18> 8 years!!!! I wonder how many people knew about this already...

On the other hand, this does make me feel better about my own code!

</comment><comment><USER19> Wow, it's pretty scary that a vulnerability as simple as this has been around for 8 years!

<comment><USER20> Yeah, but nobody's run PHP in this silly CGI configuration for 10 years.

<comment><USER21> I wouldn't be so sure: <http://wiki.dreamhost.com/Php#PHP_on_DreamHost>

<comment><USER22> That's horrible! I would never use a host that relied on CGI for anything. There's a reason they came out with FastCGI.

<comment><USER23> FastCGI makes little to no sense on shared web hosting machines. With FastCGI, each user on the machine needs at least one long-running process to handle requests. This is a waste when you consider that large numbers of the sites may be idle 99% of the time. With CGI, you only have PHP processes running when they are actually handling requests, it's really a much better solution for shared hosting.

<comment><USER24> With PHP 5.3.9 or 5.3.10 and php-fpm a new method of process management called ondemand was introduced that handles this use care very well. With a super short idle timeout (a few seconds) this could work very well for shared hosting, but I doubt there are many folks using it since it does still require the process manager to stay running in order to start the workers (this makes it hard to have user configurable php.ini settings since it would require restarting the master).

See <http://www.php.net/manual/en/install.fpm.configuration.php> under 'pool' group and the 'pm' setting.

<comment><USER5> You can send a signal to php-fpm to reload configuration without restarting (at least, the way I read it). My /etc/init.d/php-fpm has "reload" with `kill -USR2 $PHP_PID`

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> "we had a bug in our bug system that toggled the private flag of a bug report to public on a comment to the bug report causing this issue to go public before we had time to test solutions to the level we would like" Thats having a really bad day!

</comment><comment><USER26> Huh. I'd used that method of passing in parameters, mistakenly thinking it was the correct way to get a query string.

Then I asked on SO and found out I was doing things horribly, horribly wrong.

<comment><USER27> How would that have worked?

<comment><USER26>
        http://example.com/cgi/mything?stuff

Results in apache calling:

        /home/ajf/cgi/mything stuff

</comment></comment></comment><comment><USER28> Does anyone have an example site to see this in action?

<comment><USER27> I'd thought you could find some with this Google search, but I haven't gotten any to work.

[https://www.google.com/search?q=inurl:%22cgi- bin%22+inurl:ph...](https://www.google.com/search?q=inurl:%22cgi- bin%22+inurl:php&hl=en&safe=off&prmd=imvns&ei=9fSiT9nlBomI6AG50N35CA&start=10&sa=N&biw=1015&bih=557)

<comment><USER29> Using that search and clicking through a few pages I found this: <http://support.webroot.com/app/answers/detail/a_id/1761> which is susceptible to this vulnerability.

</comment></comment></comment><comment><USER30> That's hilariously shitty.

Although to be honest I doubt it's going to affect anyone as I reckon 99%+ are on mod_php.

</comment><comment><USER31> Their is a fix here.

<http://pastebin.com/87sfaYL1>

</comment><comment><USER32> To my knowledge, this vulnerability is anything but new. It's been around for years.

</comment><comment><USER33> I don't think any major site uses mod_cgi.

</comment><comment><USER34> what? a new php vulnerability? havent heard of one of these for a few hours!!

<comment><USER35> I don't understand why this is downvoted, considering that the bugfixes don't work.

<comment><USER36> Perhaps because vacuous, pandering snark adds absolutely no value to the conversation?</comment></comment></comment>


Paper, Procreate, or Affinity Designer? Comparing Popular Apps - <AUTHOR> https://spin.atomicobject.com/2020/02/06/paper-procreate-affinity-designer/#.XjwjAUKnD3s.hackernews <comment><USER2> The current link leads to a 404 page</comment>


What do you think of my social app? - <AUTHOR> http://www.fmcplease.com I created a simple web app to allow you to like your facebook friends that are crushes and see which crushes like you back. If your crush likes you back, then you both get notified. And if your crush doesn't like you back your crush will not find out that you like them. <comment> apa-sl err, isn't it SLIGHTLY similar to Tinder app?

<comment><AUTHOR> Yes, it is. But the difference is this is with your facebook friends so that you can actually find out who likes you back in real life.</comment></comment>


Get Google+ Invitation. - <AUTHOR>

Unfortunately, Google disabled Invitation option (for now) after the Invite-fest on Lifehacker. Apparently a user found an alternative to this, sharing posts with accountless users (with a gmail account) will receive an email with an invitation option.
WAIT, DON'T POST YOUR EMAIL JUST YET!
I'll be sending invitations (with the above method) to any user who emails (check my profile for my email address) me with his/her email. Other users who're already invited to Google+ are requested to follow the same.
Upvote this post if you received an invitation.
Edit: It will take 10-30 minutes for your account to be included in the access list, till then you'll receive this message - "Already invited - capacity overload blah blah message, try later".
Edit2: If you are unable to get an invite message in the email, apparently you haven't created your google profile. It looks like that you need a google profile to get it working. Please re-send me your email after creating your profile.
This is no con for spamming and google hasn't fixed the loophole (yet). http://i.imm.io/6YFW.png
Just so if you're confused with the time, it is GMT +5:30
Edit3: If this still doesn't work, apparently you need to wait till the next day when google re-enables the invite button. Re-send me your email then.
Edit4: I'm going to sleep, will reply to PMs when I'm back online. <comment><AUTHOR> So far, this method has worked for some lucky users. Don't worry, you'll be included in the access list soon. This happened because of too many users trying to join Google+ at a time. Google+ is just not ready yet, it is still in field trial. Apologies to everyone who wasn't able to join Google+, I'll re-send all the invitations once this gets fixed.

</comment><comment><USER2> A friend invited me using this exact "loophole", and I used it to successfully invite a few friends.

Google+ is spreading virally in my social network, despite Google's attempts to limit the number of users :)

<comment><USER3> Same situation here. Its spreading all over my friends. I invited a ton of people once I got in and they in turn invited a ton more. I can see it won't be long till I've got all my tech friends on it.

</comment></comment><comment><AUTHOR> Some users have reported that re-clicking the "Learn more about Google+" in the email after some time redirects them to a page which asks them to join it.

</comment><comment><AUTHOR> [https://plus.google.com/107117483540235115863/posts/PhJFJqLy...](https://plus.google.com/107117483540235115863/posts/PhJFJqLyRnm) Once the invite button is enabled again, I'll try invite everyone to Google+ directly, everyone who emailed me.

</comment><comment><USER4> I hope your method works. I posted in another thread and was forwarded to the exceeded capacity page and now I am getting a 404 error so I guess that invite link doesn't work.

Any who I shall email you.

<comment><USER4> doing the same thing the other invite I received from someone else is doing. It is now going to 404. Thanks anyways.

<comment><USER5> I have figured out what to do about the 404. Your link consists of the address of a Google+ post, followed by ? and some parameters which are your unique invite id. For some reason the post does not resolve, but the invite is good. So keep the invite ID, but replace the main URL with [https://plus.google.com/107117483540235115863/posts/PhJFJqLy...](https://plus.google.com/107117483540235115863/posts/PhJFJqLyRnm) which is the address of Vic Gundotra's much-quoted post about shutting down invites for the night.

</comment></comment></comment><comment><USER6> Arg, Google is killing me with it's "Already invited? We've temporarily exceeded our capacity. Please try again soon.". Getting an invitation and still not being able to join is bad practice ...

<comment><AUTHOR> Please wait, it takes time for your account to be included in the access list.

<comment><USER6> I understand that, and appreciate your invitation. But I think Google is somehow overplaying the whole invite-game. Shall I collect dozens of invites, or does only the first one count? Google is annoying those persons most enthusiastic about their new toy ...

<comment><AUTHOR> Not sure what you mean here, but you automatically get invited (no confirmation) when someone invites you, regardless of the number of people who sent an invitation.

</comment></comment></comment></comment><comment><USER7> Mine didn't work. I've resent a request after adding some information to flesh out a google profile.

I received this <http://imgur.com/u5vEI>

<comment><USER8> That is the current alternative to sending invites...sharing posts/comments which gives you an invite when you go to view.

<comment><USER7> But when you click through, I get the Join Google+ button, but that links back to [https://plus.google.com/u/0/up/start/?sw=1&type=st](https://plus.google.com/u/0/up/start/?sw=1&type=st) where it says 'Keep me posted'.

<comment><AUTHOR> Please read the thread carefully.

<comment><USER9> well i got a (karlton) google account and the email just offers two links

View or comment on Salman Khan's post »

or

learn more about google.

when i click the first link there appears a join google+ button which links to [https://plus.google.com/u/0/up/start/?sw=1&type=st](https://plus.google.com/u/0/up/start/?sw=1&type=st)

:/

</comment></comment></comment></comment></comment><comment><USER10> thanks for the email, but the notification received still didn't have the ability to invite me, but merely redirected me to: [https://plus.google.com/u/0/up/start/?sw=1&type=st](https://plus.google.com/u/0/up/start/?sw=1&type=st)

<comment><AUTHOR> I hate to repeat this, but you need a google profile to get this working. Please read the thread carefully and re-send me your email.

</comment></comment><comment><AUTHOR> Update: I'd appreciate if anyone thanks me with a dollar for the invite. Email for details :)

<comment><AUTHOR> same as in my profile details

</comment></comment><comment><USER11> Could you send me the invitation? email@example.com ... Thanks

</comment><comment><USER12> Have a google profile...

Can you please e-mail it: firstname.lastname@example.com</comment>


GraphQL Website SSL Cert Expired - <AUTHOR> https://graphql.org/ <comment><USER2> How could they miss it after the news about expired certs at Mozilla shook the world?</comment>


Meteor begins scaling work, releases 0.5.1 - <AUTHOR> http://www.meteor.com/blog/2012/11/20/meteor-051-database-scaling

<comment><USER2> Meteor is solving problems like latency compensation ([http://meteor.com/blog/2012/11/19/latency-compensation- impro...](http://meteor.com/blog/2012/11/19/latency-compensation-improvements- coming-soon-in-meteor-051)) the Right Way, so that we don't have to do it with a mess of ugly and buggy callbacks. Writing web applications today sucks, and Meteor is changing that.

It's really exciting to see it maturing so quickly.</comment>


Hynix FABs on fire after chemical explosion - <AUTHOR> http://www.kitguru.net/components/memory/faith/hynix-fabs-on-fire-after-chemical-explosion

<comment><AUTHOR> Reports of up to 15% of the worlds memory production being affected, no reported casualties.

Memory shipments are on hold from the Far East while the effect on supply and pricing is determining.

Also see: [http://www.kitguru.net/components/memory/faith/far-east- memo...](http://www.kitguru.net/components/memory/faith/far-east-memory- shipments-on-hold-after-hynix-explosions/)</comment>


Technology and Human Rights in Comics - <AUTHOR> https://medium.com/taraaz/technology-and-human-rights-in-comics-e9c8c804e6bb <comment><USER2> I've been reading more philosophy lately and something that stood out is that human-centric views, masked behind "welfare of mankind" has long-term consequences. The are much larger problems such as deforestation, animal extinction, pollution, that _human-centric views are responsible for_. Take into account that we now have 8 billion people and human rights seems like a worldview that's preventing any real sustainability.

<comment><USER3> Can you share to me your resources about this topic? I would love to read them because I had a similar train of thought during one of my personal "meditations"[0] but I was not able to follow up on it.

[0]: fancy term for doing nothing but stare into the distance and think about things

<comment><USER2> Sorry didn't see this.

-"Biocentric Worldview" by Ludwig Klages

-"Can life Prevail" by Pentti Linkola

-"This Spoke Zarathustra" and "The Antichrist" by Nietzsche

If you want some spirituality the "On Being Pagan" by Alain De Benoit

Mostly about loving Life as opposed to just loving humans. Nietzsche and Klages see Christianity (and Abrahamic religions in general) as contributing to that change of worldview in Europeans.</comment></comment></comment>


Apple may replace Touch ID with 3D face scanning on the next iPhone - <AUTHOR> http://www.theverge.com/2017/2/16/14641990/apple-iphone-rumor-touch-id-3d-face-scanning <comment><USER2> Terrible, terrible idea.</comment>


Ask YC: Masters in CS? Or no? - <AUTHOR> Hey guys,
I'm currently an undergrad student at Stanford University, and I'm wondering if I should pursue a 1 years masters program to get a Masters in CS. Here's the lowdown: I've done a lot of programming before---in fact, I've written four books on programming (two were international bestsellers), sold a facebook application to Kaplan Inc, and have developed for some hot start ups in Silicon Valley. I'm studying abroad, and I was planning to stay abroad until next April, but if I want to pursue the masters program I will need to come home to start working on it.
My future goal is to start a freelancing company to develop enterprise software--my first project is this summer in Italy. So, my question is, based on the cost ($45,000 for a year--after TAing, it should be closer to $15,000) is it worth it to pursue a masters degree at Stanford? Will a master's open up any doors that wouldn't be open for a Stanford grad with a good resume?
Thanks!
-Maneesh Sethi <comment><USER2> I did the co-term at Stanford about 6 years ago, though my goal at the time wasn't to go start a company or freelance right away. I'm personally glad I did it, and not because of any resume-padding or salary-boosting (I already had a job at a startup where I worked part-time while I did the co-term) but simply because it was a great opportunity to learn a lot of stuff. I knew that if I didn't do it right away, I'd probably never really want to go back, and I'd also never have another chance to do it in just one year.

There are just a lot of things that are harder to learn on your own. Want to learn SQL, OpenGL, TCP programming? Read some web pages or some books; you don't need a class for that stuff. Want to learn how to write your own database, rendering engine, network stack, compiler, or filesystem? Take a class. Especially if your goal is write enterprise software, which inherently involves building large, complex systems, some of those things will come in handy, if only by exposing you to new ways of thinking. My experience has always been that the practical stuff is easy enough to pick up on your own, but the theory is always harder. It can be done, you'll just learn it better and faster from a good professor.

If you've already taken all the 200 or 300-level courses in CS at Stanford that you want to take, I don't think you'll get much out of the MS. If there are a lot of those courses that you haven't taken and that still interest you, it's worth doing. If it's just a pure business play it's not worth it.

</comment><comment><USER3> _Will a master's open up any doors that wouldn't be open for a Stanford grad with a good resume?_

Wait and see.

In your case, I'm extremely doubtful that a master's will make any difference whatsoever. And getting one now is premature optimization. Wait until you find yourself trying to get a specific kind of job, but failing, because the jobs are being snapped up by people with advanced degrees. Then get a master's. It only takes a year.

I bet you'll wait a long time before that happens.

And why play the go-back-to-school-for-free card now? It's valuable. Keep it in your pocket for a while. You've _been_ in school recently, at _Stanford_ for god's sake -- you've already got a lot of recent contacts from your school days, and you're _already in_ a startup hub. So, wait. After you spend a few years in industry, and find yourself stuck in a rut, you'll discover that it's wonderful to have a ready-made excuse to take a year off, go back to school, and make a whole new set of friends and professional contacts. You might even have a better idea of what you want to study, and where, and with whom.

<comment><USER4> A MS usually requires about 30 credit hours, or 10 courses. Do these accelerated MS programs have the same requirements?

Sounds like earning the degree now may shorten the program's duration.

<comment><USER5> An MSc and a Masters of CS are slightly different. Basically a Masters of CS is a masters lite. 2/3 the coursework with no thesis. Its a whole different bag.

I'm doing a masters in applied math, and not having to do a thesis would sorta ruin the whole super independent part of it. I'm looking forward to doing cool research that I want to do. It will probably suck towards the end when I'm finishing the details of my thesis, but right now its exciting to dream of things to research.

</comment></comment></comment><comment><USER6> I'd advise against getting a master's degree for someone who already has an impressive resume and knows what they want to do next.

I dropped out of my master's program after getting accepted into YC. It was a no brainer; I flew back to Boston and met with my adviser the same day to tell him I was dropping out. I had already published with him so we were good friends.

With few exceptions, people in the tech industry rarely care about graduate degrees.

Beware of opportunity cost when reading posts saying it's only one year, or you can make $x more / year with a master's degree. It sounds like you're going to learn much more in the first year of your venture than you would in school.

</comment><comment><USER7> The opportunity to bang it out in one year is something that shouldn't be passed up lightly. Going back after being out for a while is hard.

I'm getting my masters now (graduated undergrad in 2003). It is difficult, but then I'm working and going to school.

The one thing going for taking time off and going back is that you are amazingly focused because you know why you are there, but then if you are graduating from Stanford and considering a MS, then I don't think that is really a problem for you.

I don't think the MS for you would be as much about career options as it would be being able to get even more in depth with subjects in a way that you really don't get much opportunity to do later in life. At least for me it became become fluent enough in subject n+1 to do task x+1. The queue only gets longer and I never have managed to go back to any one thing that has interested me.

<comment><USER8> _The one thing going for taking time off and going back is that you are amazingly focused because you know why you are there, but then if you are graduating from Stanford and considering a MS, then I don't think that is really a problem for you._

The OP is the author of a book called "How to Succeed As A Lazy Student" :)

</comment></comment><comment><USER9> Besides the monetary cost, you'd be investing a year of your life. When faced with a similar situation, I went for it not so much because of the future earnings potential but because I thought it would be a valuable life experience (which it was, and I'm happy I did it).

If you see it purely as an investment, you have to figure out what else you could be doing in the meantime that would give you the same return, both financially and emotionally.

</comment><comment><USER10> As a freelancer you will rarely (if ever) be asked about your educational experience. If you were for some reason, then a bachelor's degree would probably suffice. If you are good at what you do, then you will have high enough demand for your work that you can pick the work you do. If a potential client makes unreasonable demands, then you simply go with with next client in line.

The world moves fast. If you have an idea about a certain niche for enterprise software then right now is probably better than a year from now. The earlier you can break into a market the better.

A degree is more important for working for others. You need that degree to get past the HR gatekeeper. In the freelance world, things are different. I don't even have an undergrad degree and I have had no shortage of freelance work.

Once you go freelance, you will have a hard time convincing yourself to go back to working for someone else. Leave the grad degrees to the academics. For hackers, grad degrees take us out of the real world for too long.

</comment><comment><USER11> A masters degree is always good when you are selling yourself to other people. If it only takes you one more year, I would simply do it.

<comment><USER12> You can write a lot of code in a year. If what you want to do is write code. (And he does.)

<comment><USER13> How much less code will he be able to write if he gets a masters degree?

</comment></comment></comment><comment><USER14> If you'd want to eventually work abroad, I'd go for it. I don't know about Italy, but many countries have points-based immigration systems and having a master's degree from Stanford gives you a significant amount of extra points.

</comment><comment><USER15> Posts like this make me wish I had worked harder in school. Which is why I'm back and getting my MS -- doing things _right_ this time. _grin_

In your case, you need to ask yourself if another year in school is what you want or need; nobody here can answer that for you. A Master's will open new doors, but at the opportunity cost of taking time away from other projects that may be more beneficial.

<comment><USER16> What doors would those be?

</comment></comment><comment><USER17> IMHO the purpose of MS should not be to find a better job or to get a raise. You have already proven that you are an Entrepreneur therefore it would not be too difficult for you to start where you left off after a year. You can never go wrong with education and investing a year of your time will only make you a better decision maker.

</comment><comment><USER18> It sounds to me that you are already 1 (perhaps 3) steps ahead of the game. A graduate degree from Stanford will always "look good" on the resume, but I wonder what it will do toward further your freelancing goal. One thing to keep in mind, and all caveats apply, but in my experience I have found that many organizations/clients view higher level degrees as a "sign" (valid or not matters little IMO) that you are prime leadership material. This may be beneficial in winning contracts. At the same time it may make you appear over- qualified (less likely I would say). It's a delicate balance.

</comment><comment><USER19> Masters coursework isn't worth it across the board. Some areas are too theoretical for what Masters students will want to do.

I got a more directed MS in Robotics, and am very glad I did. I think it helps to have a niche. You can do the exact same work I did for my robotics degree in a general CS degree - so my advice is to pick an area of focus, and work on building something interesting.

You shouldn't work on many projects. Take the opportunity to build up a single real system for 2 years.

</comment><comment><USER12> If your goal is to developer enterprise software, and you already have your first project (i.e. this summer in Italy), what do you need the Masters degree for?

<comment><USER20> What does he need his BA for? Not for what he is doing ATM anyway.

<comment><USER12> I agree, but that is in the past. He's asking about the future.

I don't work in the field I got my degree in. But I still enjoyed the experience.. :)

</comment></comment></comment><comment><USER21> I'm not sure about what a masters will do for your prospects, but I'm getting one and I LOVE it. So I say do it if you think you'll enjoy it.

</comment><comment><USER22> >My future goal is to start a freelancing company to develop enterprise software

Based on some interviewing I've done in a corporate setting, Masters is often looked at as a trade off for lack of work experience. In your case it doesn't seem like that would be an issue.

Whether or not you have a Ph.D. will matter more for your career long term, than whether you have a BS/MS.

</comment><comment><USER23> If you are starting a company why not pursue an MBA, sounds like you wont get much more out of the mscs degree.

</comment><comment><USER24> That's quite pedestrian and bottom-line oriented approach to life. Good luck crossing the finish line.</comment>


Ask HN: Review my startup, Droplink for OS X - <AUTHOR> http://droplink.me/

<comment><USER2> Just tried it. I like how fast this is! It's a good alternative to dropbox for a quick image upload or something. It would be nice if it auto copied just the url.

I would also like it if the file stayed hosted longer than an hour. Say I want to email the link to a friend, but the friend doesn't check their email for 3 hours. If they click the link the file will no longer be there. Having the droplink icon in the top menu bar would be great, instead of having it in the dock.

<comment><USER3> It does auto copy the URL, but you can only paste it into email/IM convos. At least from what I've seen.

<comment><USER4> It copies it to the clipboard, you should be able to past anywhere. Pro tip: you can drag an image right from a web page into the dock app.

<comment><USER3> Here's what I got when I went to paste the copied url from an image called storepromo.png - [http://img.skitch.com/20090304-tqx32knar1rhd6gcxhwmc98qic.jp...](http://img.skitch.com/20090304-tqx32knar1rhd6gcxhwmc98qic.jpg)

if you hit submit, it tries to go to <name>.<extension> \- it's like copying/pasting a url from safari into iChat or Adium. It shows a clickable name, not the full URL.

<comment><AUTHOR> The latest version just pastes URLS. It can be found here: <http://droplink.me/Droplink.zip>

You can use the registration code from the signup e-mail. Cheers!

For help using or installing, please check here: [http://blog.droplink.me/post/83016847/installing-and- using-d...](http://blog.droplink.me/post/83016847/installing-and-using- droplink)

</comment></comment></comment></comment></comment><comment><USER5> Pretty awesome! I have an almost daily need for something like this when sending files to people over chat/irc.

Your link creation needs some work, however. I can't paste the link into a non-RTF box (this input box for HN, for example). You should reverse-engineer how Safari creates links when they're copied to clipboard and do the same.

For example, if you right click on any title on any website, and copy a link, you will notice that when you paste it to an RTF box, you get the same behavior as what you currently do but when you paste it into Terminal, you get the URL. When I paste Dropsend "URL" to Terminal, IRC or to Safari's address bar, I get nothing.

<comment><AUTHOR> This is fixed in the latest version, which can be downloaded here: <http://droplink.me/Droplink.zip>

Thanks for the feedback, and enjoy the software!

Alan

</comment></comment><comment><USER6> Is it just me or was there no audio in the video?

I think divia's problem is that there is no documentation in the program itself. I downloaded it and unzipped it, and ran it. After entering the registration code I had no clue what to do. The program seems to just "end".

I had seen the video so I figured that I should try dragging a file onto it. I added it to my launcher and it works as it does in the video, but had I not seen the video I wouldn't have known to do that.

I suggest that after you accept the registration code you ask if the user wants it installed in the menu bar. Also I suggest telling the user that they can drag files to it to upload them. Perhaps embed the video at that point again.

Hope this helps. Jer

EDIT: I also find mac programs distributed as .zip to be annoying. I strongly prefer .dmg files. Also, why is my "Downloads" icon now the same as Droplink's?

<comment><AUTHOR> Hi, thanks for trying it. And yes; I can see how it's not exhibiting the expected behavior. I started by adding a Growl note to the "no files dropped" case post-registration. There's also a simple help document here, which I'll start sending with registration emails:

<http://blog.droplink.me/post/83016847/using-droplink>

Re DMG: Yes - a DMG is something it needs. Workin' on it. Re Downloads: Your Downloads icon is the same as Droplink's because the Droplink application is probably the last thing you downloaded. You can move it to your Applications directory, and then drag it back down to the dock.

Thanks again for testing, you guys are coming up with really good feedback :)

</comment></comment><comment><USER7> There's a Dropbox Droplet (<http://wiki.getdropbox.com/DropboxAddons/Dropbox%20Droplet>) that does essentially this. For somebody who doesn't have Dropbox, this tool seems cool, but I wouldn't go to the effort of adding yet another tool when Dropbox is close enough.

</comment><comment><USER3> I like it. Tried it out, works quickly. I emailed you about a possible integration, let me know if you're interested.

</comment><comment><USER8> The important questions here are:

1) What's my file limit?

2) How long are files kept for?

<comment><AUTHOR> 100mb max uploads, files last for 24 hours

<comment><USER8> In my opinion, it should be something closer to 2 weeks. I send alot of emails that don't get checked within 24 hours.

<comment><AUTHOR> It's a question of markets, I think, and it's something we haven't really decided on. 1 hour covers IM, mostly. 8-24 probably covers most e-mail use (maybe?) What we don't want this to become is something like Rapidshare, and limiting file lifetimes is our attempt at not letting that happen. The service is designed primarily to share files with people you know personally, within a finite time period. But we'll see how it gets used, and maybe change our policy.

<comment><USER9> If you're worried about that you can always expire either when time limit is exceeded (say, 2 weeks) or download limit (downloaded 5 times?). Or you can make download times degrade when the file is downloaded more frequently -- the 100th download will go at 10kb/sec instead of 10mb/sec. There are so many creative solutions that you don't need to put any rules in place now.

Also, I think most of us (myself included) worry about abuse too much. If people start abusing your service you will have the data to deal with it effectively -- you'll think of a solution because you'll have to. And if it turns out people aren't taking advantage of a friendly download policy -- then the service ends up being more useful for honest users.

<comment><AUTHOR> I really appreciate your insights here, you bring up some really good points. I went ahead and wired in as much data collection / monitoring as I can so through the beta I can see how the service is actually used before I get too concerned with abuse prevention.

</comment></comment></comment></comment></comment></comment><comment><USER10> You should work on the website's design, there is a lack of unicity.

The screencast is too short, you should describe to us what you're doing, why you're doing it and the result.

</comment><comment><USER11> How does it compare to dockdrop? <http://dockdropx.com/>

Is it just stored on your servers vs. my own?

<comment><USER4> Pretty much, yea.

</comment></comment><comment><USER12> I downloaded it, but it quits right after it opens. (Macbook running 10.5.6, if that helps.)

<comment><AUTHOR> Thanks for giving it a look, I'll try and see whats up with it.

<comment><USER13> Same thing quits right after it opens,

10.5.6, imac

<comment><USER6> See my first comment; I believe it is working as designed, but there is no message to the user.

<comment><AUTHOR> Sorry, yes - after registration, clicking on the icon will do nothing. It only does stuff if you drag-and-drop a file on the icon.

Please see this blog post for installation/usage help: <http://blog.droplink.me/post/83016847/using-droplink>

</comment></comment></comment></comment></comment><comment><USER14> not sure if im missing something here, but you realize that you could have just dragged and dropped that same file into the chat window, right?

<comment><USER5> In theory, yes, but not in practice. From my experience, Skype's the only app that works reliably when you try to send files. Adium, much less so... it's a hit & miss (and more of a miss).

</comment></comment><comment><USER15> damn, that's fast</comment>


3D Programming with JavaScript - <AUTHOR> http://blog.prolificidea.com/?p=39

<comment><USER2> Every time I think of a new hobby project I want to start I think about learning a new language alongside. Inevitably before I start a library or tutorial comes along that brings it back to Javascript.

<comment><USER3> This is one of my favorite aspects of JS. It won't win many prizes for its language design, but the community of people and the proliferation of projects & libraries is worth a little struggle.

</comment></comment><comment><AUTHOR> Soon, the programs for our space shuttles will be coded with JS :P

</comment><comment><USER4> nice overview!</comment>


German Police in the Nazi State - <AUTHOR> https://encyclopedia.ushmm.org/content/en/article/german-police-in-the-nazi-state <comment><USER2> I were told there were 3 occasions the people of a state are called cockroaches and nazi Germany is top one. This article sounded so familiar living in Hong Kong the third cases. Police as a force that can change to a totalitarian tool is one of the problem humanity has not solved. Who watch the watchman.</comment>


Should Shopping Centres Offering Free Wifi Block Access to Amazon? - <AUTHOR> http://www.seolondonsurrey.co.uk/blog/should-town-centre-offering-free-wifi-block-amazon <comment><USER2> You would have to block more than just Amazon...how about buy.com, Walmart.com, Google shopping, etc? You'd end up blocking the whole internet, and in the end people would still go home and buy online.</comment>


How I Rendered a Massive List in React without Memory and CPU Issues - <AUTHOR> https://medium.com/better-programming/how-i-rendered-a-massive-list-in-react-without-memory-and-cpu-issues-7ac6fe6a697b <comment><USER2> Seems that this is more trivially and optimally solved by using a virtualization library like [https://github.com/bvaughn/react- virtualized](https://github.com/bvaughn/react-virtualized) or [https://github.com/bvaughn/react-window](https://github.com/bvaughn/react- window)</comment>


What yet-to-be-written security book would you like to see on your shelves? - <AUTHOR> Looking at my library of security books. What yet-to-be-written book would you like to see on your shelves? <comment><USER2> How to Secure Your Life. It would cover everything from your physical wallet to your smartphone to public networks to your home network. End-to-end best practices for securing your life.

<comment><USER3> I was just thinking of a well-written "Security for Dummies". (Some books in the Dummies series are well written.)

Along with the premise that a significant fraction of the public would read it and become reasonably informed at least in layman's terms.

Perhaps that -- they -- in turn would effectively influence public knowledge and reporting as well as government and business policy and practice.

</comment></comment><comment><USER4> A list of types of threats, organized by target area, summarizing:

        - each threat
        - its basic mechanism
        - basic effective defenses
        - common ineffective defenses
        - tradeoffs between more effective and less effective defenses
        - possible stopgaps until you can use an effective defense
        - where to start to learn more about each.

Sort of a Zagat's of security.

I would also like to see evo_9's How to Secure Your Life, described in his comment.

<comment><AUTHOR> A Zagat's of security. The ThreatBook. A quick reference guide to the threats we might end up to be vulnerable and the applicable defenses in review. There's much to be written here. Thanks.

<comment><USER4> And you might support the book (in both senses of the word "support") with a web site.</comment></comment></comment>


Why We Sold TechCrunch To AOL, And Where We Go From Here - <AUTHOR> http://techcrunch.com/2010/09/28/why-we-sold-techcrunch-to-aol-and-where-we-go-from-here/ <comment><USER3> Since this is Arrington you have to take things with a grain of salt.

The technical reason seems like a very bogus reason. Its true that the TC design could use some help and the general site layout and speed could use some improvement. But any half-decent developer and a designer who is worth his balls could solve this problem. After all they are running on wordpress using PHP. In regards to the speed of the site, its no so much of a technical problem as it is a "widget problem" they have more external JavaScript widgets pulling in than the site itself. The only solution to that problem is a reduce the number of external calls.

The other reason he used was that he is tired. I can understand that, it is very much possible to get tired of something that you have been very involved with for several years, even if the project is the love of your life. It can be both mentally and physically taxing. But he is not going anywhere... he is staying with TC even after the sale. What responsibility is he offloading other than the technical aspect of the site? And it isn't much offloading because its not like he is sitting behind the computer and developing the site, he would be hiring someone to that job.

The only thing that he doesn't mention and doesn't talk about (anyone else in his position would have done the same), is money. It is possible that AOL offered something that was too good _for him_ to refuse or he really needed the money. Everything else he mentioned sounds like a bunch of hogwash to me.

<comment><USER4> > _The technical reason seems like a very bogus reason_

That reason isn't a technical one. As an administrator of your small company you have to hire people that are good enough and keep them happy.

All small companies have this problem. Programmers don't want to work for small wages, feel unappreciated, work on uninteresting problems forever, or be second-class citizens. Those that do and are half-decent, would rather prefer the job security of a big company.

Another reason would be the stress of any small business to be profitable. Not only that, but you've started the business partly to get rich.

If what he's saying is true, and AOL can't interfere with their writing, and it's in the contract, and he also earn a handsome sum of money, then I can see why they agreed.

<comment><USER5> To be honest, both the TC blog and Crunchbase aren't that complicated to do. Arrington could theoretically hire contract programmers to do upgrades to the software if and when they need them.

Perhaps what Arrington means is that it's really hard to find programmers willing to work on these two products for the long term. It is a blog and a database, after all, and the nature of the software doesn't make for terribly exciting work.

<comment><USER6> It's never as easy as "hire some contract programmers to [insert thing here]." Management is a pain in the ass. Finding talented contractors is hard. Finding one's whole be available past that one feature you need is harder. Finding folks who will deliver when they say they will is even harder than that.

Making sure that the 3 guys working together are actually working ltogether is tough. Then you deal with schedules, deployments, personality conflicts, and the whole thing.

Managing things is a profession unto itself. My guess is Arrington doesn't like doing it.

<comment><USER7> _Finding one's whole be available past that one feature you need is harder._

It took me a while to parse this as "Finding ones who'll be available after finishing that one feature you need is harder." :)

</comment></comment></comment></comment></comment><comment><USER8> Arrington's post says all the right things, but it does not contain the word "money". It's not a dirty or shameful word, and a discussion of a sale of a company that makes no reference to it is obviously incomplete.

<comment><USER9> "Tim asked me how things were going at TechCrunch. I told him I was exhausted after five years but that a recent move to Seattle made it easier to balance my life."

Translation: Dear California FTB, my move had absolutely nothing to do with tax avoidance on a cash windfall and I really am a Washington resident. I had NO idea we were being acquired when I made the move 4 months ago... I'm as surprised as you are. Seriously. For reals.

Teasing aside, Mike's built an impressive media business from scratch over the last 5 years. It's been fun to watch, and I'm sincerely happy for him. If you're reading, Mike - congratulations!

<comment><USER10> Could CA do anything to him even if he came right out and said, "I moved so I could avoid California taxes"? There's nothing illegal about that.

<comment><USER11> Yes. They would re-classify him as a permanent California resident with a temporary residence in WA, which would make him subject to CA franchise tax. Not paying his taxes would then be illegal.

<comment><USER12> But if he's no longer living in California, and has a WA address, drivers license, etc. then how can California do anything?

<comment><USER13> _then how can California do anything?_

There are probably rules about how long you need to be there to establish residency. And the franchise tax board is notoriously nasty. I remember reading an article about how they go after athletes who play games in CA (read: all of them). So if you're a basketball player and you play the Lakers, if you earn $200,000 that night, CA wants $20,000, even if that's the only thing you've done in the state.

<comment><USER14> This is true everywhere, not just in California. All forty-one states with a personal income tax have laws on the books to collect taxes from non-residents who work in their state. If you're affiliated with a pro team (including players, coaches, trainers, etc.), you can expect to file your taxes about a dozen states (plus Canada.) If you're a musician or other entertainer (circus clown, for example) on a huge tour, you could conceivably file 41 state returns plus a few for other countries.

<comment><USER15> Technically, MN and ND have a reciprocity agreement where residents of one state that work in the other can pay tax in the state they are residents of and not the state they are earning money from. It is generally there because of the Grand Forks / East Grand Forks and Fargo / Moorhead areas crossing states.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Best comment:

"Congratulations, Mike! Now stick to your roots and leak the price! :-)"

</comment><comment><USER17> He mentions their "endless tech problems". Never noticed that.

<comment><USER18> They're on WordPress VIP. I don't know why they would have endless tech problems seeing that they're hosted on the largest WordPress system.

EDIT: Yes, I know that WordPress VIP does go down, but that's WordPress.com's problem, not TechCrunch's.

<comment><USER19> TC downtime on Wordpress VIP: [http://techcrunch.com/2010/06/10/wordpress- gives-us-the-vip-...](http://techcrunch.com/2010/06/10/wordpress-gives-us-the- vip-treatment-goes-down-on-us-again/)

</comment></comment></comment><comment><USER14> > _Tim told me that he doesn't want whatever makes TechCrunch special to go > away. He also said it was important that we feel free to criticize AOL when > we think they deserve it. And the agreement we signed with AOL fully > reflects this._

I can't figure out how this agreement could actually be enforced. If AOL shuts down a story on TC, what's going to happen? It's not like TC/AOL is going to sue corporate/AOL for breach of contract. There are almost certainly performance and tenure based incentives in the buyout to push Arrington and other higher-ups at TC to be a good soldiers. (They might choose not to be good soldiers, but their only option at that point is to quit.) The editorial freedom of TC is entirely dependent on the honor of upper management at AOL.

<comment><USER15> Look at the history of some of Paramount's divisions (book vs film/tv). I remember there was some threats of lawsuits there.

</comment></comment><comment><USER20> The reason TechCrunch is TechCrunch is because they are TechCrunch, not AOL. Now everything they write is going to (legitimately) be put under the microscope to find a pro-AOL slant.

Arrington got his FU money and so what does he care at this point. I'd be surprised if you don't see the startups AOL is courting get positive spin on TC, and the startups AOL loses to in acquisitions to suddenly drop from the headlines. I wouldn't blame them, as the pressure is going to be absolutely huge on them to shift their reporting as AOL is in negotiations with startups.

</comment><comment><USER21> Yeah, I'm sure the CEO of AOL just mentioned that he wanted to acquire TechCrunch out of the blue and that Arrington had no idea.

</comment><comment><USER22> If this means we don't have to see any more TechCrunch headlines on Hacker News, then I'm all for it.

<comment><USER23> Aw, give him this one.

</comment></comment><comment><USER24> does arrington get an @aol.com address now?

<comment><USER25> They were all recently changed to @teamaol.com from @corp.aol.com

</comment></comment><comment><USER26> I don't care what MA says, it's a sad day for getting the controversial embargo-breaking news that TC is known for.

</comment><comment><USER27> Anybody have thoughts on what will happen to CrunchBase? Will the terms of use stay the same?

</comment><comment><USER28> I like the comment about halfway down:

A $25M – $40MM sale, doesn't this make techcrunch a "dip shit company"?

</comment><comment><USER29> I think instead of TechCrunch now losing its character, Arrington will take TechCrunch to new heights. This "merger" makes sense to me. <http://goo.gl/fb/GAxZ5>

<comment><USER30> This isn't Twitter - you can write out your comment, or at least your URLs.

</comment></comment><comment><USER31> The whole post was FAIL due to the fact he never once mentioned price - <USER2> though he's dying to do that about every other deal in the tech scene!

Do as I say, not as I do Mike?

</comment><comment><USER32> AOL?

</comment><comment><USER33> "Internet Innovation Is Like The Auto Industry In The 1950s — Big, Stagnant Companies Rule", an article posted on Techcrunch earlier this week, is indicative of why Arrington sold. He is sitting at the forefront of the consumer internet space, and as such, sees the death of startups in that space. I am sure he got tired of putting out press releases for big companies.

At an age when the giants (facebook, google, amazon, zynga) can quickly react to your new startup and assemble a team and build your website features in a few month, all the while retaining distribution power, what chances do startups have against them?

</comment><comment><USER34> Most of the spam I get comes from AOL addresses, I actually think about blocking the entire domain altogether. I'm sure same competent engineers will help TechCrunch shine.</comment>


Ask HN: solving mobile app discoverability - a major opportunity? - <AUTHOR>

Mobile app discoverability is a major problem - application developers find it hard to become visible to end consumers. This leads to problems where a small number of more visible publishers get the lions share of the revenue http://www.forbes.com/sites/chuckjones/2012/12/06/top-25-developers-receive-half-of-app-store-revenue/
Is there a major opportunity in solving this problem?
Put another way, are we at AltaVista level of search engine for apps, but no one has yet come up with the Google of mobile app discoverability? <comment><USER2> Have read that every community, be it foodies, or science fiction fans, or horror film buffs, has two components- the casual, who tend to have a very low depth of awareness about the content of the field and make up the majority of the people involved in it, and the hardcore- who've seen everything, can tell you all about it, and make a tiny minority of the community.

It's these hardcore users that form the gatekeepers to the mainstream- not only will they be the first to try products, but they will also be far more harsh and negative to mediocre products than a typical user would be. (It's kinda comforting that the people who know everything about something I get excited about aren't keeping the best stuff to themselves and leaving me with the dregs, but rather the reverse). What these gatekeepers look for isn't usually all that different from what casual users look for- quality is quality.

The winner-take-all distribution can be really daunting, but when you consider how long each of these apps on top have been in existence at all (maybe a few years for most), then you realize that it's not so much luck that makes these top apps so much more successful than average, but that their content is just that much better from a market perspective.

The lesson here is, make a good enough product (something the market REALLY wants even if no one realizes it yet), and the market will promote you naturally. Some sort of "ASEO", if it's even possible, won't make a fart app into #3 on the app store.

</comment><comment><USER3> I think the fundamental question you have to ask isn't whether app developers find it hard to be visible to consumer, but rather are consumers finding it hard to discover apps that they want ?

What apps do you love using now that were hard to discover ? - if there aren't any then maybe the market for app discovery doesn't exist.

</comment><comment><USER4> It depends on the platform. For instance, Apple policies don't make this business attractive because it brings lots of limitations. But with Android I don't see why you couldn't improve this space. I know some companies that are doing research in this field, trying to tie geolocation and ML with app reviews and recommendations.

Another idea that comes to my mind (haven't seen this yet) is to set up some sort of monthly payment subscription that would get bundles of apps at a much lower price. If I was a mobile developer with an app with few downloads but potentially good, I would sell my app at a wholesale quantity for much a lower price in order to gain exposure.

</comment><comment><USER5> There's definitely a lot of room for improvement in this market. If you've been keeping up with current mobile statistics (which you obviously have), you'd consistently be seeing how the app markets are shifted way off to one small corner. I'm positive that solid product design and build are huge factors, but there are apps out there that don't get enough credit they deserve. Unfortunately, I feel that this problem relates to the world in general as well. Not everyone who is doing interesting and disruptive things will get all of the attention that they deserve.</comment>


Ask HN: What can an engineer do in southern Africa? - <AUTHOR> I'm an electronic/embedded engineer, and would like to put my skills to use in southern Africa. I have no contact or knowledge of the industry there. My question for HN is this: what are the greatest unmet engineering needs in southern Africa? How can a humble engineer contribute?<p>Any info would be super appreciated! <comment><USER2> I run a small software company in Zambia and quite aware of the needs here.

Unmet needs include: Power generation (Solar/Wind setups), Building natively useful electronic devices - if you see my other post, I am looking for some farm security devices, agriculture technology that actually (not cosmetically) helps people.

I can think of a number of things.

<comment><USER3> What kind of software company do you run? I joined the BongoHive slack community a couple of months ago and have been slowly learning about the Zambian tech scene.

<comment><USER2> We are in E-health so focused on writing software for E-health platforms as well as supporting the government in deploying these solutions in our environment.

<comment><USER3> Got a link to your site?

</comment></comment></comment></comment><comment><USER4> [https://hanselminutes.com/569/a-new-kind-of-commerce-m- pesa-...](https://hanselminutes.com/569/a-new-kind-of-commerce-m-pesa-mookh- and-africa)</comment>


Most of the Amazon SES IP blacklisted by SpamCannibal - <AUTHOR> https://forums.aws.amazon.com/thread.jspa?messageID=538207 <comment><USER2> I have been managing email servers for over 10 years, and it has gotten to the point that I feel like blocking some of the most common ISPs. Seriously.

I am following all the best practises, hell, I even advocate them. It is just that these days it seems not to matter if you have SPF, Sender ID, DomainKey and DKIM, PTR, proper MX and even a normal to good IP reputation. There is still no guarantee what you will be able to reach the inbox of the likes of Gmail, Yahoo, Hotmail, etc.

I have been filling out huge forms for each and every major ISP for the past year because one or two users mark a newsletter as SPAM.

Conclusion: There is no common standard because every major ISP can set their own standards. This will eventually force everyone to use the same services worldwide.

Where's the freedom of choice here?

<comment><USER3> > one or two users mark a newsletter as SPAM.

I'm one of them. Those newsletters _are_ spam. I would _never_ sign up for a newsletter and somehow I'm getting those too. If my intent was not to get the newsletter, it's unsolicited mail by definition, i.e. spam.

Stop spamming me and I'll stop flagging you. Period.

How not to be flagged as spam:

\- There should be a checkbox clearly visible and it shouldn't be pre-checked.

\- Your "kind" product reminders are obnoxious too and I'll flag them as spam as well. Did I ask you to remind me of your product? Nope. Unsolicited then.

\- If you ToS say I agree to receive mail, guess what? I don't agree, I just want to try your product. I'll flag you in a breeze.

\- Social reminders like Twitter's trending around me or people I might know? SPAM! I don't care if I can disable these, I didn't enable them.

\- You want to offer me discounts but I didn't ask for them? Flagged!

\- I submitted a paper to a conference and it got published? Dozens of "calls for papers" in my inbox. Flagged, flagged, flagged, flagged!

\- Calling it a newsletter or adding a tiny "unsubscribe" link won't hide the fact that it's still spam. I didn't click subscribe, I shouldn't have to unsubscribe.

\--

EDIT: Woah, this seems controversial. Lots of up- and down-votes.

Dear product owners, downvoting me here won't change the fact that me (and your fellow users) will still flag the shit out of your unsolicited mail. I guess it pays if you keep doing it, but you should direct your energy far from that downvote button and closer to "ways not to annoy my users".

<comment><USER4> It is users such as yourself that make spam filters have the kinds of silly false positives being discussed in this thread: as a user (not as a product owner; I _am_ a product owner, but I don't send e-mail, so I have no "skin in the game": so, you can claim all you want that the people downvoting you are all product owners, but some of us really do just feel you are abusing a shared system to carry on some kind of personal vendetta) it really sucks that I can't trust spam filters to not filter valid e-mail out of my inbox because people like you are so trigger-happy (and in some cases, simply vindictive) with the spam button... it is my sincere hope that services like Gmail are at least sometimes smart enough to realize "this person is just being annoying" and makes your spam votes meaningless :/.

<comment><USER3> None of those are false positives. Spam is unsolicited mail. Did I solicit the mail?

\- Yes: not spam.

\- No: spam.

And, since I never solicit promotional email to my personal address, my method is 100% accurate.

In my opinion the companies sending unsolicited promotional email are the ones gaming the system taking advantage of the _" well this might be unsolicited but it's not v14gr/\"_ grey area.

<comment><USER5> By this definition John sending an unexpected party invitation to his friend Dave is spam.

edit: I guess spam is by definition commercial email. Still, I think it's possible to have a business relationship with a company where it's acceptable for them to send an occasional email that you didn't specifically request.

<comment><USER6> Business relationships are different from personal relationships, and "solicit," in this case, does not mean literally request the email. It is perfectly reasonably to describe unexpected email from a friend as solicited and unexpected product email from a business as unsolicited (even if you've had contact with them previously).

It is unlikely that the business is your friend ;-).

</comment></comment></comment></comment></comment></comment><comment><USER7> > The SES team knows about the spam cannibal listings and is in contact with > them, they say it's unlikely your open rate drop from 25% to 0.15% is caused > by the SC listing.

SpamCannibal can cause the originating mail server to get caught in a 'tarpit' by slowing it down. Given the AWS _CUSTOMER_ was sending a significant amount of measurable email to a given destination server (which was running SpamCannibal) it's possible the sending servers are being slowed down. In that particular scenario, that would affect open rate over a short period of time.

</comment><comment><USER8> Let people run rampant on your IP range, and this is what happens.

I run a fairly large website, and I block all traffic from the likes of Amazon AWS because it's full of dodgy bastards who think they're entitled to run however many HTTP requests they like. Webmasters, look at your web logs. Don't be surprised if the majority of hits are coming from bots pretending to be web browsers.

<comment><USER9> SES uses different IP ranges than those used by EC2.

<comment><USER10> It's the same idea though. Web sites might block crawlers in EC2, and mail servers might block emails from SES.

<comment><USER11> Our company offers a frontend web performance scanning SaaS product. We use EC2 for our scanning boxes. I've found many of our customers's website filter EC2 IPs. Its mainly from websites that offer a high demand product with a large secondary market. (think ticket websites for concerts/musicals/plays, airlines, hotels, etc).

</comment></comment></comment></comment><comment><USER12> bl.spamcannibal.org is notorious for a higher error rate (false positives). It'd be crazy if a popular mail service provider like Yahoo categorized incoming mail based on results from Spam Cannibal. If I added them to my MTA, I'd rank them fairly slow to diminish the effect of their false positives. See here: [http://dnsbl.inps.de/analyse.cgi?type=monthly&lang=en](http://dnsbl.inps.de/analyse.cgi?type=monthly&lang=en)

And see here how to add them to your checks (and rank them accordingly) if you're using Postfix: [http://www.postfix.org/POSTSCREEN_README.html](http://www.postfix.org/POSTSCREEN_README.html)

</comment><comment><USER13> If you were to remake email from the ground up, how would you solve the spam problem while keeping it as decentralized of a system as it is now?

<comment><USER14> Require a small fee to send an email, e.g. $0.01. Small enough not to matter for legitimate users, large enough to make spam unprofitable.

Bitcoin or some other cryptocurrency would be ideal for facilitating micro- transactions like this. Interestingly, the Hashcash concept was originally designed to fight spam, and later became one of the important ideas that made the invention of Bitcoin possible: [http://en.wikipedia.org/wiki/Hashcash](http://en.wikipedia.org/wiki/Hashcash)

<comment><USER15> That wouldn't work for mailing lists.

<comment><USER16> One could add a proof of permission model to that to cover things like mailing lists and other regular sources of email. Something like:

I sign up for a mailing list.

The mailing list mail server contacts my mail server.

My mail server presents to me a request for free delivery.

I approve it.

My mail server gives the mailing list server a secret token.

Each mailing list message includes proof that the message has been blessed by the sender and that the sending server knows the token.

<comment><USER17> What stops this server from then using that token to spam you?

<comment><USER16> I'd do it with revocation.

Right now I give out tagged addresses to most vendors, and I know others do it for lists. When a tag goes bad, I just route any further mail to my spam trainer.

<comment><USER17> But that means for every legitimate mailing list you're on, you get one spam. And you lose the legitimate mailing list just because their token got compromised.

Dunno, I feel like we should just charge for mailing lists too. Or use usenet!

<comment><USER16> If I can get it down to one spam each time a mailing list server is compromised, I'm ok with that.

Even with a charging scheme, some spam will still happen. Give the amount of BTC stolen so far, and given the number of compromised computers that could be used to generate cash, looks like there will be plenty of money to spend on sufficiently profitable spam.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Blacklists are general a very effective method in handling spam, but its kind of dangerous to use in a commercial setting. A few weeks ago SpamCop blocked gmail for a few days, causing some "mild" issues for companies that depend on email.

There is sadly not much options. Either I can accept more spam, or use blacklist and put the control of the filtering in the hands of a third-party with none of the responsibility attached.

</comment><comment><USER19> It might help the situation more if webmail providers provided actual 'unsubscribe' or 'hide' links in their UI instead of 'spam' being the only feedback mechanism users are offered.

"unsubscribe" links vary in position, language and visibility in various clients. Making something beyond "this is spam" part of most mail clients, perhaps with reporting back to the originating sender, would help.

<comment><USER20> Problem here is that particularly such "unsubscribe" links where used in the past (and still are, I guess) to reassure spammers that somebody is there. Because one problem spammers have is the quality of the addresses they have. Many spammers use lists from dubious sources and a big number of addresses are invalid. So, if they get an "unsubscribe", they know which addresses are better and can deliver more spam to it ...

So many don't dare to use such links and rather click on spam.

The only solution could be some "trusted" functionality that goes via the own mail provider of the receiver. But of course the mail provider can not simply send information to the sender of the eMail .... So the thing gets complicated. As much I learned, for spam clicks there is something like that available ... some kind of trusted feedback chain that gives information to trusted senders, that some mails where labeled as spam. Thus those senders can (indirectly) adopt their eMail campaigns.

<comment><USER21> > Many spammers use lists from dubious sources and a big number of addresses > are invalid. So, if they get an "unsubscribe", they know which addresses are > better and can deliver more spam to it ...

That's only true of the dubious "viagra" style spam, where they got your name from a list. I don't think those even bother with "unsubscribe" links any more. I only see unsubscribe links from places where I've had to give my email up to buy something or sign up to a site. Those are generally legit and most of the techy/startup web sites will unsubscribe you immediately.

The next tier are the sites that unsubscribe you but take more than a week and will keep spamming their dumb newsletter in the meantime.

The final ones are either broken by stupidity (it's amazing how many web developers cannot grasp that "+" is a legit email character), or willfulness and will keep spamming no matter what. I block these at the SMTP level with 503 messages (usually containing some personal insults and swearing) as soon as they "RCPT TO" the unique email address I gave them.

<comment><USER20> Luckily I managed to block much of the spam I got before, so I don't see the current spam behavior. But some years ago, there well existed some non-viagra style spammers that just put dubious unsubscribe links inside. I never tried myself, but was warned that they use the information against you. I would guess, that verified eMails have a greater value ... but it also might be negligible now, since with bot-networks spammers don't need to care if they send 1 billion or 10 billion eMails ...

</comment></comment></comment></comment><comment><USER22> I know there are legitimate uses for something like SES, but it has always seemed a bit like "Spam as a Service" to me. Ditto for every other service that's designed around mass email, no matter how much YC startups might depend on them to "improve their conversion rate" or whatever the buzzword is this week.

<comment><USER23> _Spam as a Service_

I'd call it "Sender Reputation Checking as a Service". Where said service is paid for by the sender, but provided to the email recipient. Anyone can send email directly; but knowing that email has been sent through SES and Amazon hasn't killed the account yet provides a greater degree of trustworthiness.

In a sense, it's like a bond rating service.

<comment><USER22> ...and we all know how well the bond rating services performed their function. Sorry, couldn't resist.

On a more serious note, it seems like the "greater degree of trustworthiness" is only _very slightly_ greater. SES might be better than some server in a domain nobody ever heard of, but it's still not as good as a provider with a long history of responsible email use. Many people can and do block SES and its ilk, as is the subject of this story, because the aggregate amount of spam is so great even if the individual spammers are transient (like they care).

Amazon could raise the bar, thus raising their own reputation and thus making the service more valuable to those who can still afford/qualify to use it. It's probably just not worth their while to do so. I'm not even criticizing them for that. I'm just observing that online business has a shady side, and Amazon isn't afraid to partake.

</comment></comment></comment><comment><USER24> Considering Amazon themselves send spam this isn't surprising. They like to send out product spam under the guise of account notifications with no opt- out. The only way to remove yourself is to close your account. At the very least they do this to affiliates and to Student Prime members.

</comment><comment><USER25> I had had the same issue with amazon SES. While Spamhaus PBL is not necessarily a blocklist, due to the default configuration error, all the emails we send out (from other providers like mailchimp) ended up in spam. Finally, the issue got fixed by configuring reverse PTR.

</comment><comment><USER26> are people not relaying their newsletters/unsolicited mails/spam thru some antispam outgoing smtp gateway if they're concerned about being blocked? filter it yourself before people filter u?

</comment><comment><USER27> I believe in IP blacklisting. Why should my business be open to countries like North-Korea or Somali if I don't have anything to do with those? Spam comes from everywhere, but you can get rid of at least 50% by simply dropping traffic from certain countries, so the expensive score based spam filtering get cheaper. Unfortunately Amazon SES is the victim of cyber warfare and spammers.

<comment><USER28> This sort of logic will hurt you with customers who are US persons living overseas. I cannot tell you how annoying it is when as a US citizen and taxpayer I am blocked from using US services because I am not physically in the US. In 2014, where we plug our computers in does not define who we are. Geolocation is not authentication.

<comment><USER29> Not even just that, but where they ignore your Accept-Language and just make up a decision on what language you should be using. Google has no way to fully switch languages - even after going to Google.com and setting English, you'll see images have tooltips in your "local" language.

Google's Play app does the same thing for a bit of their content. Certain headers get localized, despite everything else in the app being English. Netflix has the same problem, and then to further add insult, they send you to non-English phone numbers for support.

The most annoying thing is that someone probably got a raise for these "features".

<comment><USER30> You can use [http://www.google.com/ncr](http://www.google.com/ncr)

[https://support.google.com/websearch/answer/873?hl=en](https://support.google.com/websearch/answer/873?hl=en)

<comment><USER29> That doesn't actually fix it. When you start searching, the alt text for the logo is still in the "local" language.

</comment></comment></comment></comment></comment><comment><USER31> IP blacklists are a waste of everyone's time.

<comment><USER32> Not my time and my clients'.

By appending in the Posfix configuration file line smtpd_recipient_restrictions = ... spamcop and spamhaus , spam decreases in like 95% without even touching your server further (spamassassin I'm looking at you).

I you add greylisting you get rid virtually of all of spam.

<comment><USER33> How much good mail gets mistakenly canned? I'd rather sift through a little spam than lose something I wanted.

<comment><USER34> I think we'd all rather "sift through a little spam than lose something I wanted" but my guess is that you've never run an email server. "a little spam" is not what you will get - it will be orders of magnitude more spam than legit emails. This is hard stuff - Gmail, supposedly one of the best, catches between 2 and 10 emails a day in my "Spam" folder that aren't actually spam. If I were to turn off the spam filter (if you could) in Gmail, I'd get 2,000 emails a day - of which 50 would be legit.

<comment><USER33> I actually have run a mail server before, and now I gladly pay someone else to do it for me :)

Point taken, but I've been on the receiving end of what I would consider false-positive blocks by Spamhaus & co. They sometimes have policies about what's considered spam that I don't think all their end users would agree with. I've been blocked for having an IP address on the same provider as someone else who allegedly advertised their website via spam. If you're running a mailing list, dealing with the anti-spam stuff is at least as big a problem as the spam it was supposed to solve.</comment></comment></comment></comment></comment>


Americans' Confidence in Institutions Stays Low - <AUTHOR> http://www.gallup.com/poll/192581/americans-confidence-institutions-stays-low.aspx <comment><USER2> Speaking generally, people seem to have unrealistic expectations about human institutions. Name a large one that isn't bureaucratic, that doesn't have inefficiencies of large organizations, and where its priority isn't loyalty to the institution itself (though Congress, consisting of elected people nationwide, might be an exception to that).

Not all institutions are the same; some are better than others and we shouldn't just accept problems and corruption. But why do people keep believing big talkers who say they're going to magically eliminate all those things and make it run like a hyper-efficient 5-person business?

IMHO, much of it is people looking to get elected by looking for problems and things to complain about, rather than looking how to get things done.

Without time to examine it in detail (I've got to run), I'd hypothesize that most of what's important in the world is accomplished and has been accomplished by large institutions.

<comment><USER3> In "American Amnesia" (1) Jacob S. Hacker and Paul Pierson argue that post WWII, the mixed economy of private business / free markets doing what it does best, in conjunction with the government investing in education, science, technology, and infrastructure (which all benefit private sector), while providing a safety net, resulted in prosperity.

The trend since Reagan / Thatcher years (neoliberalism) and anti-government free market fundamentalism threatens this constructive partnership where private sector and government were both rivals and partners.

On the one side you have "starving the beast" (think Grover Norquist, Tax Pledge), defunding critical programs to the point of dysfunction. Does it surprise anyone that the IRS is underfunded by Congress to pursue tax evaders, as Congressman are lobbied to keep loopholes open?

Another calamity is NASA's Earth Sciences, the part that studies Earth itself (climate change, etc).

On the other side of the isle, the dems have failed to make government /efficient/ and a visible positive force in the daily lives of average people.

(1) [https://www.amazon.com/American-Amnesia-Government- America-P...](https://www.amazon.com/American-Amnesia-Government-America- Prosper-ebook/dp/B010MHAITI)

<comment><USER4> The Dems have failed because they've largely signed onto the 'neoliberalism' philosophy too.

<comment><USER2> Norquist and the current GOP aren't neo-liberal; they take it much further.

The Dems fail to provide an alternative narrative; they let the GOP frame every issue and the debates are over before they begin.

</comment></comment></comment></comment><comment><USER5> The problem is multilayered:

\- Corruption. money gets access

\- Elected government folks over promise and under deliver.

\- Elected government folks' priority is getting reelected.

\- Unelected government folks have far too much power

\- Lack of accountability for wrongdoing and incompetence

\- Waste of taxpayer money

\- Good people don't want to run for office because the scrutiny is too high

<comment><USER6> In other words, Americans are correctly assessing their institutions, which is why confidence in them is low...

<comment><USER7> Exactly. I don't see why this is a "problem."

<comment><USER6> Well, it's not a problem that the American people are too cynical. But it _is_ a problem that our institutions are turning into trash.

<comment><USER8> It is a problem that the American people are too cynical. Cynicism is the reason negative campaign ads are so effective - no one _trusts_ political ads unless they're negative - and the more negative they are, the more people believe them. Cynics don't bother actually studying the positions of a candidate - because they know all candidates are corrupt anyway, and all parties are the same - but of course they'll vote for anyone who's politically incorrect and promises to "throw the bastards out," because the only politician anyone trusts is a politician who pretends they're not running for office. Cynicism has made the concept of being engaged with the political process a joke to anyone who doesn't want to destroy that process.

I mean, the cynics are correct, but they're also more than a little responsible for perpetuating that system by setting the bar so low.

<comment><USER9> I think a big part of the problem is that we have a concept of cynicism at all. It's very similar to the conspiracy theorist label. There are known conspiracies. Big ones. It's not that crazy to be a conspiracy theorist. It _is_ crazy to think that we've been visited by aliens or that the elite are reptiles. Thinking those things _does_ make a person a conspiracy theorist. That _doesn 't_ mean that all conspiracy theories are crazy. In the same way, not all cynicism is petulant and hopeless. But when a population is trained to recognize and dismiss cynics that is frequently what they become.

<comment><USER8> >In the same way, not all cynicism is petulant and whiny.

That's true, but most of it is, and I don't think that's entirely accidental. Many cynics are cynics because society expects them to be. People mistrust the government before they really even understand what it is.

>It's just that when a population is trained to recognize and dismiss cynics that is frequently what they become.

I would argue the population has been trained to be cynical in order to disengage them from politics, lead them to expect nothing from the system, and make them more easily manipulated. It does seem evident that there is a feedback loop between the cynicism of voters and politics.

<comment><USER9> > I would argue the population has been trained to be cynical in order to > disengage them from politics

I actually agree. However, I think the discussions we need to be having are ultimately cynical. We need to be able to tolerate it. The opinion you've just expressed is terribly cynical and that doesn't undermine it's legitimacy.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> You have to enable people to do the right thing. Sufficient stability and resources, combined with active and effective accountability.

No project, much less institution, is "set and forget". Nor can any individual continually nor consistently "do the right thing" in the face of ongoing personal threat and insecurity.

Not every aspect of life benefits from loose, disposable relationships.

Professional, nor personal.

</comment><comment><USER11> Most Americans' common encounter with the "institutions" would be the following:

DMV (motor vehicle bureau/department) Post Office Police/Courts Local schools Social Security

Our government is not monolithic. It's vast (ranging from SS, military, FAA, FDA, NASA, etc etc) and on the state level as well.

But seems many Americans' experience are mostly with these front line departments and quite often it is not quite positive.

But many of us do not see beyond this and want to tear down everything regardless of how essential many of these agencies/services are.

<comment><USER12> You don't notice when things go well. If you have a good experience with the Fire Department, you aren't going to say "wow, I wish we could take down that institution". It just disappears from your mind.

I'm sure there's a term for this, but I don't know what it is.

</comment></comment><comment><USER13> I wonder if the reason we distrust our institutions is because we almost worship them. As I've watched the society become more atheistic, I've watched it look more and more to the human institutions to replace what it lost. All the grandeur and power we expected of a god is missing. Instead we see corrupt humans just like us doing corrupt things. Every time something bad happens, we scream for the government to do something. We don't hold the person accountable; we hold the tool. When the government does something and it has unintended consequences, we get mad that they didn't forsee it coming or we get mad that they knew what would happen and just wanted steal even more power. The same is true for financial institutions. We expect them to magically make money and prosperity for our stocks. We give them grand titles and powers. Then they fail. We gnash our teeth and curse these Titans of industry.

<comment><USER14> This is one of the main points of "Sapiens." That Capitalism, Communism, Nations-States, et al are manifestations of a new wave of religions that followed the first wave (polytheism, tree worship, animism, etc), and the second wave of monotheistic religions like Islam, Christianity etc.

</comment></comment><comment><USER15> confidence in congress only went down 10%? they must be polling the lobbyists or something...

<comment><USER16> It's sad because congress is where our individual vote carries the most weight. It's a crucial institution for our country, without which we'd be nothing more than an empire (in my opinion). Now more than ever it is important to root out the cronyism, nepotism, and big-money that has corrupted this important branch of our government.

<comment><USER17> Maybe people have higher confidence in their own Congresspersons. Perhaps, they disagree strongly with their counterpart voting constituents on the Coasts. If this is the case, democracy is working as expected.

<comment><USER18> I also believe democracy is "working as expected".

It's hard to see locally, but we're a country that's deeply divided on some core issues. Half the country wants gay marriage, the other half doesn't. A single-payer-advocating socialist almost won the Democratic primary, where his opponent is talking seriously about trying to "roll back" the ACA ("Obamacare"), this president's legacy domestic policy achievement.

I feel like half the country wants to become more like Europe -- more socialist, higher minimum wage, high taxes, big social safety net, free universities, lots of job protections (and the reluctance to hire that goes with it), minimal/no religion, less marriage, whereas the other half wants to step back about 50 years to picket fences, nuclear families, and a more isolated national existence.

We aren't going to have another civil war but I wouldn't be surprised if, looking back, we're more ideologically divided now than the country was, then.

<comment><USER19> As many American soldiers died in the Civil War as in every other war we've ever fought combined. If we were as divided now as we were then, I think it'd be surprising as hell.

<comment><USER20> The Civil War didn't occur just because of how deep the divisions were, but because they were strongly correlated with geography and not strongly correlated with class (particularly, that the divisions were quite present _among_ the upper class with disproportionate influence on governments, and, while not perfectly aligned with geography, strongly correlated with it especially among the upper classes.)

The same degree of division with different geographic and class distribution could very well not have similar results.

</comment></comment></comment></comment></comment></comment><comment><USER21> Life in America is simple, "To each his own". You are on your own if you fuck up and no, you can't rely on institutions to save your ass. Institutions are just looking for their own good.

<comment><USER22> Your path leads to lots of problems. Humans are social; our entire adaptability revolves around being able, in times of discomfort or disaster, to use the tools others have spent their time and resources creating. Someone thinking it's possible to make it on his/her own just shows that cooperation is so ubiquitous that we don't even notice it.

The development patterns of the last 75 years, with their spreading out of people, have caused huge problems here, causing people to be physically distant from one another, eroding a very natural support network.

Additionally, we've lost powerful charitable forces over the recent decades: religion and unpaid women. Wealthy wives, being expected to stay home with the kids, were hugely important in social work. Now that church influence is in decline and women are paid for their work, we have to pivot to other institutions for support structures. In the US, we've not quite gotten that next generation of support figured out.</comment></comment>


Microsoft promises no patent prosecution of open-source .NET - <AUTHOR> http://www.theregister.co.uk/2009/07/07/mono_microsoft_promise/ <comment><USER2> We can all trust they will behave and not break their promises.

Right?</comment>


Automattic expects to make $45 million in revenue this year - <AUTHOR> http://allthingsd.com/20120425/automattic-grows-up-the-company-behind-wordpress-com-shares-revenue-numbers-and-hires-execs/

<comment><USER2> How on earth do they keep such low turnover when these people have to work with the wordpress codebase?

Black Magic? Holding their families hostage?

Seriously though: I'm very interested in how they manage this company and the distributed employees as they are obviously doing a lot of things right.

<comment><AUTHOR> Every employee at Automattic has a trial period before they announce they've been hired. It usually includes a test project for designers and programmers. I'm sure that's a helpful filter. Then, when the employee starts, they spend some amount of time (I think a couple weeks) doing support, no matter what their actual job is.

'm sure working from home helps limit turnover too. Also, they work in teams, and I'm sure that's fun. And I've never noticed anyone mention things like logging time either - I think they get assigned work and as long as you get it done, time isn't an issue.

And finally the people that work for Automattic tend to be really really passionate about WordPress in the first place, so I'm sure working for the most influential company to the WordPress.org project(Automattic / wp.com), doing WordPress stuff all day, is pretty awesome.

<comment><USER3> As an Automattician: yes to all of the above.

Also, I get to work with really smart people that are driven to improve themselves, their co-workers, and the company's products. That's the #1 reason for the low turnover.

</comment></comment></comment><comment><USER4> "The company is profitable, and expects to bring in $45 million in revenue this year, according to CEO Toni Schneider and founder Matt Mullenweg."

What's hiding behind that revenue number. The co. is "profitable". Is the company going to make $10 in profit or $10 million in profit this year?

<comment><AUTHOR> Well, they're completely distributed with little physical overhead. With 100 employees and the only other primary cost being servers, I'd guess they're doing alright.

<comment><USER5> Isn't employee salary the #1 expense for most tech companies? And isn't the rule of thumb about $160,000 per year per employee on average, and that's assuming high-end engineer types? By that metric they'd need $16 million per year just to pay salaries. $45 million income is 2.8 times what's needed for salaries, which leaves plenty for profit.

<comment><AUTHOR> I almost went down that route. I interact with a lot of Automattic employees, and all of them are extremely talented.

I'm not sure what they get paid, but I tend to doubt it averages $160k, because if I were Automattic I'd probably pay relative to where the employee lives. And even though I'm sure most of them could command top dollar where they live for what they do, I'd bet in most parts of the world it comes out to less than $160k / year, because most parts of the world just are not as expensive as SF.

Also, I'm pretty sure they have thousands and thousands of servers. I have no idea how much that costs, but an uneducated guess would be that it's not as much as the $16 million in salaries you mention. So... $45 million - $32 million for salary and servers is indeed a hefty profit.

</comment></comment></comment></comment><comment><USER6> I highlighted their difference with Tumblr here not too long ago: <http://news.ycombinator.com/item?id=3809374>

They both use Quantcast, so the numbers have to be pretty accurate.

<comment><AUTHOR> A lot of Tumblr pageviews are dashboard based, whereas WordPress.com's tend to be much more front facing. Also, I imagine the amount of time a Tumblr user spends per page is less than those on WP - just by typical nature of the content. Just guessing, but that's my assumption.

Mullenweg has said before he pictures Tumblr as more of a social network than a blogging platform. I wish I could find that right now. Either way, WordPress.com is definitely learning some things from Tumblr. The new wp.com dashboard and quick posting mechanism is enough proof of that.

<comment><USER6> You are right, hence the reason they redirected the dashboard stats to wordpress.com. I think they're gunning for an IPO or sale.

<comment><AUTHOR> I personally don't think so based on my observation of the company over the past few years. I think they're in it for the long haul, as are their investors. However, I don't have much to back up my statement, other than Matt's ideals.

</comment></comment></comment></comment><comment><USER7> That's a magnificent $0.65 a blog...per year...in gross revenue.

<comment><USER8> Silly semantics.

You could also see it as a magnificent $0.65 per page. After all, a blog is just a dynamic page outputting database records, right?

<comment><USER7> _You could also see it as a magnificent $0.65 per page._

Well...no. Not at all. It isn't semantics at all, anymore than saying that The McClatchy Company operates 30 newspapers.

Further the other comment opines that they're focused on growth. That seems incredible given that the blogging industry is on decline.</comment></comment></comment>