Ask HN: How did you start your business? - <AUTHOR> Did you leave your job and then start a business, or was it a side project that evolved into a full-time gig? <comment><USER2> I started buying broken laptops on eBay, fixing them, and reselling them with my best friend. We started with $600 each on credit cards. That turned into a large refurbished computer sales business. So large that I started shopping for a vacation home (lake home).

Well, the process of buying a vacation home was frustrating. This was back in 2002 and most real estate brokerages did not have websites, and if they did, they were static and outdated. This led to a conversation with my business partner...and we ended up buying a really good domain related to my vacation home search and launched a website for realtors. We called it our side project.

When the used laptop market turned into the used VCR market, we shifted all of our eggs to our side project basket.

Today we own a real estate brokerage with 20 offices and are pretty much considered the leaders in the lake home sales market in the Midwest. We're on track to hit a $Billion in annual sales in the next couple of years (did about $300M last year). Neither of us were Realtors (I'm still not). It's been an interesting ride so far.

<comment><USER3> A naive question - if you are selling a lake home worth $5m then you are considering that amount as your sale? Let's say you are charging 1% as your fees then $50k is your revenue? Thx

<comment><USER4> Given that OP was doing $0.45M just 7 years ago [1], doing $300M today would be some phenomenal amount of growth.

Maybe this is a "gross revenue" vs "net revenue" topic.

Especially given that the OP states in the same Link that he'd love a "$20m exit".

A $20m exit on a $300m is a no brainer.

Either way. Being your own boss. Being profitable. And growing is awesome. Congrats.

[1] [https://news.ycombinator.com/item?id=2341124](https://news.ycombinator.com/item?id=2341124)

</comment></comment></comment><comment><USER5> I left my job. Or, more accurately, the startup I was doing contract work for went under, and I decided not to look for another contract afterwards. I worked on a few projects before starting my business, Indie Hackers, which I grew to just under $6k/mo in revenue (in 8 months) before joining Stripe.

I've done interviews with close to 300 founders. Recently, I added a sortable, filterable directory that can help answer questions like yours. For example, you can filter to only show businesses started as a side project: [https://www.indiehackers.com/products?commitment=side- projec...](https://www.indiehackers.com/products?commitment=side-project). I'm still working on improving the accuracy, but it's coming along.

<comment><USER6> I've seen other attempts to build a community around this demographic before. One I really liked, I even found someone on there and we built a nice project together, though I forget the name.

Do you recall what you focused on when you started? What do you think led to your success and traction?

I find this stuff fascinating when there seems to be an idea that people want to happen but no has been able to get it right. Then finally someone (or some people) crack the code.

<comment><USER5> Long day, finally back. The key was a combination of (a) identifying the right audience, (b) finding a distribution channel that could consistently reach them in large numbers, (c) creating a product ideal for that audience and distribution channel, and (d) parlaying that traffic into its own community. And not necessarily in that order.

The answer to those questions turned out to be (a) developers who want to self-fund profitable online businesses, (b) Hacker News, (c) interviews with successful developer founders willing to tell their story and share revenue numbers in the open, and (d) getting readers onto a mailing list, then sending them links to interesting forum threads every week for a year.

Lest I seem smarter than I am, this analysis is being done with the benefit of hindsight. I did not have 100% of this stuff planned from the beginning.

</comment></comment></comment><comment><USER7> I had been a recruiter for several years, starting off out of college with a ~200 person international firm for a couple years and then a founding member of a small boutique recruiting firm for about seven years. I eventually figured out that I wasn't getting any value from my partner, so I started my own recruiting firm.

During my recruiting career I was always writing/editing resumes and giving job search advice to my candidates, but the job search advice was always awkward because I had "skin in the game" (potential fees). I never became comfortable with that process.

On the side I started a resume writing and career consulting business, and I decided a couple years ago to make that my full-time focus. At first I wasn't sure if I'd be able to maintain my income from recruiting (wife and 2 kids in an expensive area, special needs kids), but so far it looks like I'm on schedule to actually earn more.

Beyond the compensation, I find the work far more fulfilling. I'm working more hours than I used to, but I feel I'm actually helping people much more effectively. Hearing stories about how a resume and advice got someone their dream job feels good, and I'm also writing for some interesting people both in and out of tech.

<comment><USER8> Recruiting and resume writing is what entrepreneurs call a "tie shop business." The product is already well-defined, the customers are already well-known, and how to operate the business is already well-known.

Even a software consulting firm is a "tie shop business."

Developing new technology is the polar opposite of a "tie shop business." The product is new, the customers are unknown, and how to sell the product is unknown.

The reason why I state this is that hacker news's users, and Y Combinator's businesses, are developing new technology. They aren't creating "tie shop businesses."

It's important that you know the difference when participating in a forum like this, and deciding what kind of business to start. Advice that applies to a "tie shop business" doesn't really apply to someone who's starting a business to develop new technology.

<comment><USER7> I expect most users of hacker news aren't creating any businesses at all ("tie shops" or otherwise) but are here for interesting stories and dialogue with others.

YC's _portfolio and team_ may be creating new tech, but HN is a bit of a bigger umbrella from what I've seen, and in my several years commenting here your comment is the closest thing to a "you don't belong here" or "stay in your lane" signal that I think I've heard.

OP's question was pretty open and didn't mention anything about developing technology. I wouldn't offer expertise where I didn't have it, but if someone asks how I started my business I think I'm qualified to answer.

<comment><USER9> Want to add to side comments that I've read a few of your posts in Ask HN and generally enjoy them so hope you do feel valued here.

<comment><USER7> Thanks, and I absolutely do feel valued here. I was a bit surprised by this reply as it was a bit out of left field given what I wrote and the question asked. Identifying as a recruiter (now former recruiter) here was always interesting based on the reputation of the industry, but I haven't had any real issues with the audience.

Thanks, I appreciate your comment.

</comment></comment></comment></comment></comment><comment><USER10> Employee => academia (PhD in AI) => open source (Gensim) => ML freelancing (radimrehurek.com) => ML consulting company (rare-technologies.com) => ML products (pii-tools.com, scaletext.ai).

Looking back, it's hard to imagine what it would be like to jump right into full-time products, skipping the intermediate budding steps. Is it a burden to understand the whole process, from accounting, legal, HR, management, ops, sales, support? Better to outsource them right away?

It's definitely true that all that ancillary stuff is a distraction, a (stressful) time sink. Especially when you're just starting out and clueless, like I was. Bootstrapping slows you down. On the other hand, it felt kinda natural, but took many years. Not the standard (?) SV path of rapid growth.

<comment><USER11> How old were you when quoting as an employee and started the PhD ? Was it hard financially ? I'm asuming you had a degree already.

<comment><USER10> Quit in 2009, age 28. It was not that hard financially -- I moved to southern Thailand, worked on the PhD and Gensim there. Thailand is a pretty cheap country to live actually.

<comment><USER12> How did you negotiate doing a PhD remotely?

<comment><USER10> I feel like I'm not helping you guys much, because my circumstances may have been unique, but the honest answer is:

Not much negotiation needed. My uni had what I'd call an "old school AI department", grounded in linguistics / semantic web and RDFs / expert systems, that type of research. I was more into statistics, Bayesian inference and vectors. The mutual impact was lukewarm, and completing my thesis remotely not an issue.

<comment><USER13> Did "PhD" pedigree help in anyway? I mean you could do your research outside academia, since your department was not helping you (in research). But I guess US PhD stipend could be considered as a good salary in Thailand.

</comment></comment></comment></comment></comment></comment><comment><USER14> Neither. After getting my degree, I continued a student project for 1 year that went nowhere. Eventually, I realized it wasn't going anywhere, so I decided to look for a job.

I went to a hackathon, summarily said I was looking for a job on stage at the end. Instead, someone I already knew came talk to me about their startup idea (which had PoC already live, a solid business plan and good proofs the project could be viable), and I decided to give it a go.

That was 5 years ago, I'm still there, learned a lot, and now we are 12 employees (we started at 2 unpaid founders, and started paying ourselves a minimal salary after a year). While it's not up to SV standard, I do consider it a success that we are still alive, and did not sell our soul doing others people project at any time of the company (which happens a lot here, companies don't die, they become contractors).

Important note: I had the privilege of a nice parental cushion that let me do that instead of absolutely requiring an income. I couldn't have done it otherwise.

<comment><USER15> Thanks for the honesty about the cushion. Often these tidbits get left out. It is really interesting to understand all the puzzle pieces and the mentality of those that made it.

</comment></comment><comment><USER16> I started my company, [https://rezi.io](https://rezi.io), 5 months after graduating college in August of 2014

I noticed that about all of my classmates were grossly underemployed since their resumes were simply trash. They didn't understand applicant tracking systems and existing resume companies don't address the issue of resume optimization (except Jobscan, but they're a little different)

It started as a side project in Wisconsin, then in November 2016, I moved to South Korea where we've successfully supported a number of the top universities with our English resume solutions and I've been able to go full time + hire our first employee. Feels great. Such a ride so far. Here is a quick article of my time in Korea

[http://www.mobiinside.com/2017/12/05/rezi-korea- startup/](http://www.mobiinside.com/2017/12/05/rezi-korea-startup/)

</comment><comment><USER17> I started making video games as a teenager, and about ten years ago there was this golden age of Flash games where you could make a small video game, auction it off on a private website to various companies that ran Flash game arcades. You'd incorporate their branding, ads, links, and in exchange receive an upfront fee followed by a split of the ad revenue. Over the course of my three year degree I had five games published, which gave me a taste of the business side of game development. It was a weird, unique, fun time in game development! I don't think there's much like that now for hobbyists to transition into commercial work quite so naturally.

But I finished uni and went into the industry, writing Python/Django code for a startup. During this time I started work on the game that eventually let me go full-time, The Cat Machine ([http://store.steampowered.com/app/386900](http://store.steampowered.com/app/386900)). I'd work on it on Saturdays and towards the end of development I'd even get up early in the morning to get an hour or two in. I released it on Steam and a bunch of other places, where it did... better than a niche puzzle game about cats should do, I think! Other good things happened, it was featured for a number of months on the front page of the Apple Mac Store next to actually really good games like Braid and Mini Metro, so it turned out that cross- platform support was really worth it!

I've been working on my second downloadable title for the past two years ([http://store.steampowered.com/app/654960/The_Eldritch_Zookee...](http://store.steampowered.com/app/654960/The_Eldritch_Zookeeper/)), but that's the story so far!

<comment><USER18> Just wanna say that's pretty inspirational. Keep it up.

<comment><USER17> Thanks!

</comment></comment></comment><comment><USER19> I have had some side projects make a little bit of money, but never enough to make any sort of headway toward replacing my full-time job.

My current effort is also a side business while I continue to work my FT job. It is definitely detrimental to the business to continue to devote 40+ hours per week to something else, but I need to feed my family (if I was young and single with no other financial obligations, I would totally just quit the day job and live on canned meat and potatoes) :/

My advice - if you're young, take your financial risks now. It only gets harder to do later :)

<comment><USER20> Depending on how far you take your business while young, you may find it difficult to go back to regular employment, especially in places where people expect you to be reliable and dedicated.

I'm not sure young people can take financial risks, unless they're already rich. If they're not rich, I'd sooner advise people to work for long enough to have a safety net of cash, as well as cash to invest in their idea first. A bonus you get while working is that you meet people who can potentially help you in your business later on. Seeing what's involved in a real business will also help you make more realistic estimates of what you'll need in your own.

The average age of the successful startup/business founder is way older than what the media lets people know by showing only the youngest entrepreneurs i.e. the outliers who are noteworthy. Those people happen to have industry experience and money that can be "risked".

<comment><USER8> > I'm not sure young people can take financial risks, unless they're already > rich.

It's a lot easier to take a financial risk when you have no dependents and no mortgage.

I quit my job to start a business in my late 20s, when I was single and had no kids. I will say that another reply's statement is very true: "If I think back to the person I was in my mid-20s, I would not have had the dedication, confidence, people skills, or even the technical know-how to pull off anything approaching a successful business."

In my case, I just wanted to be in charge of my own destiny for awhile, with the freedom to screw up. (And I did screw up.) Although I wish I did things differently, the experience itself was worthwhile. Our modern upbringings are so structured that "starting our own business" really just turns into an outlet for avoiding authority for awhile.

<comment><USER21> During my 20s, I was in graduate school and I had no money. Now I'm in my 30s making good developer money, and while I have a mortgage I also have enough saved to pay it for a long time.

I also have no dependents, which is obviously the big difference maker.

<comment><USER19> > I also have no dependents, which is obviously the big difference maker.

Yep. Just try to build significant savings with a wife and 3 kids. I'll probably never have more than a couple of months' pay sitting in savings. I realize if I lived alone I could easily live on 1/3 of my current salary. Ah well, life choices and all that...

</comment></comment></comment></comment></comment><comment><USER22> I started working on a prototype smartwatch back in 2008 while I was doing undergrad at UWaterloo. iPhone didn't have a Bluetooth API then so I actually hacked together a small 30 pin dongle with an nrf radio. Quickly moved to Blackberry which had a semi working BT API.

I graduated in 2009 and decided to work on it full time. Funding in early days came from oversized novelty cheques from pitch competition wins, some interest free loans ($15k personal loan from Canadian government - CYBF) and personal savings from my coop work terms over previous 5 years.

Got $20k YC funding in 2011 which kicked company into higher gear before our Kickstarter campaign in 2012.

<comment><USER23> I still regret that Pebble went out of business. Any plans to make similar smartwatch again?

<comment><USER22> No, there's no point. You can buy a Pebble 2 HR on Amazon for $90. It will last long into the future (albeit with slightly reduced feature set in July, until the Rebble.io project is up to speed).

</comment></comment></comment><comment><USER24> The best thing that I was able to do is to reduce my fulltime job hours to part time, initially 3 days/week, and used the other time to grow my own business. This may or may not be applicable in every situation, but if you are a positive contributer in your working environment, it's unlikely that your boss would rather just replace you (and retrain a new person) instead of just having you work less. This eases the stress tremendously on the new business if you don't have to worry about eating and rent/mortgage payments.

<comment><USER25> You know what, I've never thought about that possibility at all. Usually, when you hear about starting a business while working, you're just working extra hours on top of your 9-5.

Maybe I can try that with the leave I have saved up and then ease my way into a part-time gig. Well, after I start making money on the side business.

Thanks for the insight.

<comment><USER26> 1st step, going from 5 days / week to 4 days / week is pretty much a no brainer. You get 50% more free time for 20% less money. I did that 2 years ago and never looked back. Sometimes I switch to 3 days / week, then back to 4 days, depending on how I feel. But I would never consider a "full time job" more than 4 days / week. But sure, I am getting shit done, so I don't have a problem asking for that.

<comment><USER27> Well said! Just for a statistical curiosity, which weekdays do you work? :)

<comment><USER26> Mon-Thu or Mon-Wed. I like long weekends. Not that it matters really.

</comment></comment></comment></comment></comment><comment><USER28> Office Snapshots ([https://officesnapshots.com](https://officesnapshots.com)) was started ~11 years ago as a side project while I was teaching middle and high school history. It got fairly popular immediately due to early viral sharing on Twitter and Digg.

I just kept going at posting to it for the next several years. Eventually I decided to stop teaching, and my wife and I moved to a new city, and decided to do something else for a career. Through the process of temping at various businesses (warehouse for a tooth whitening company, office manager at a cremation sales company), I decided that Office Snapshots should be my main pursuit.

There was still a lot of doing various projects for people to make money in the meantime while the business was growing such as web design work or hunting for working coupon codes for a friend's business.

All that said, Office Snapshots has been my sole work for the last 3 years and we recently launched a site dedicated to healthcare projects and one for educational architecture projects.

<comment><USER29> I check out your site every few weeks. I really enjoy looking at the design and layouts in offices around the world. No real reason for it. It's just a nice distraction sometimes. (Especially in boring meetings!) Keep up the good work!

</comment></comment><comment><USER30> I left my job, took some time out, and then started building my business ([https://dependabot.com](https://dependabot.com)).

Financially, it's been tough - after 10 months Dependabot makes $2,100 a month (although that's now growing quite fast). I know I'm the kind of personality that couldn't have started it at the same time as working a full time job, though - I need to be really focussed on one thing at a time.

<comment><USER31> If you want those big money enterprise clients, add Maven and Nuget support.

<comment><USER32> I agree. If this tool does what it says, and supported .Net/Nuget, my company would throw a lot of money at it. More than the $50/month advertised.

<comment><USER30> Interesting, thanks for the validation. We have basic Maven support already, and a PR half-finished for .Net - I'll get on it :-)

</comment></comment></comment></comment><comment><USER33> I started freelancing 5-6 years ago, doing copywriting projects mostly. Website copy, monthly blog posts, that kind of stuff.

After a few months I realized that none of the clients I was working with had an actual digital marketing plan in place; they were just farming out copy projects because they "knew the needed to have a blog."

I pitched all of my existing clients and spent the next year building up a side roster of additional clients who relied on me for their digital marketing strategy, copy, and social media management. This pivot away from being just copy-based to strategy and execution/management earned me enough recurring monthly revenue that I was making more from my side project than my 9-5, so I quit.

I've been running my company, Starling Social ([https://www.starling.social](https://www.starling.social)) for just shy of three years now. I have a Copywriter, an Account Manager, and it's looking like I'll need to hire an Ads Specialist in the not-too-distant future. Life is pretty great.

</comment><comment><USER34> A little tangential, but my wife decided to start a business a few years ago. We had no idea where to begin with the legal, banking, etc. side of things.

This book was a great primer for us: [https://www.amazon.com/Small-Time- Operator-Business-Yourbook...](https://www.amazon.com/Small-Time-Operator- Business-Yourbooks/dp/158979799X)

</comment><comment><USER35> My first company was a design agency which I started in 2005 with one other partner. I left my other job to do it after I got tired of working for other people.

Built that up to 80 people and left in 2012 to got to New York to help another company get acquired. That happened faster than I thought (hadn't anythhing to do with me), that company was Square were I spent 4 1/2 years. Last year I left to start a new product consultancy we are still two, have a bunch of freelancers and are about to hire our first people.

I have had a lot of side projects (still do) my most profitable one is Ghostnote. Because I live in NY I wouldn't be able to live from it but it does give me substantial income and I am working on a few more which will definitely put me in position to not even have to do consulting (although I really do enjoy it)

To me the most important benefit besides the money is freedom and if I have anything to say I will never work for someone again.

</comment><comment><USER36> I started [https://www.browserless.io/](https://www.browserless.io/) when I found out that there wasn't a good hosted solution for headless-browser work. There's a ton of other higher-level services that do things like screenshots and pdfs, but what if I needed something that those services didn't cover (and had to scale out to 100's of concurrent sessions).

I didn't really set out to do this service, but it came after _not_ finding it anywhere else. I'm about ~4 months in and make $1k/month on it so far, which tells me that others need this service as well. Happy to answer other questions about the business if folks are curious.

<comment><USER37> What was version 1.0 of the product?

<comment><USER36> Version 1.0 was a very very simple hosted headless image running on a few VM's. At that point there wasn't any debugger or notifications about your sessions. Pretty much just a submission form that provisioned machines to support the account.

This actually took place after a few months in a beta where I was doing everything manually (to see if it could even work). That was actually a good lesson: do things manually until it doesn't scale as it's possible that you'll be writing code that doesn't ever run!

</comment></comment></comment><comment><USER38> Never had a job in my life. I helped friends at real estate offices fix their IT problems while a student. People kept asking me for more and more stuff. Server setup, hosting, data analysis, websites, etc. Also got many referrals that expanded the business.

Eventually I just focused on the most fun and profitable projects only, while passing the rest on to freelancers or friends.

</comment><comment><USER39> Got fired from this large international company. By the time I was saying farewell to my project team some folks from India told me they wanted to partner with me in case I decided to open my own (web development) company. And that's what I did a couple of weeks later. The partnership lasted 5 years. Lesson learned: networking is everything, not only with levels above but also below. You will need it when you decide it is the right time to build the team you need.

</comment><comment><USER40> Hope you are not looking only for success stories... I left a stable job at a small consultancy, with one-year-worth of salaries on the bank, armed with my tech skills but no sales expertise ( or commercial talent ) whatsoever. The results, 14 years later: bankruptcy, lots of debt, a couple labor-related lawsuits and back to full time employment for a large corporation... Lesson learned: as an entrepreneur you can buy tech skills ( and it's cheaper than most would imagine ) but nothing is more valuable than sales (soft)skills. A competent, well related, sales person is the most valuable asset on your company.

( BTW, my company was developing J2EE/JEE/JavaEE small/mid-sized projects for finance&insurance companies in Brazil )

</comment><comment><USER41> I started freelancing just under 20 years ago and have worked as a solo developer ever since.

Maybe this isn't the best advice but I think we're capable of doing pretty extraordinary things when you're thrown into the deep end. You'd be surprised at how things start to work out once you're 100% out of your comfort zone.

I'm not saying quit your job immediately while still in debt or whatever. I just think that if you're debt free and have a few months of savings you could at least give starting your own business a fair shot without a safety net. If things don't look like they are going to work out, you could always find some type of job to pay the bills.

<comment><USER42> > I think we're capable of doing pretty extraordinary things when you're > thrown into the deep end

This resonates with me as I've been there once already in my life and felt the same thing. A very sudden life-changing situation popped up unexpectedly and I just had to dig my heels in and push forward. You really find out what you're made of when failure is not an option. It turned out great and got me a job at a Fortune 500 while still in college, but admittedly I've had trouble replicating that tenacity ever since. There has to be a term for the phenomenon, but you feel like you're in this advanced state of mind and somehow you just know you're going to hit the ball out of the park if you keep working. Thanks for sharing your story!

<comment><USER43> Grit, I think. It's not a static trait, the way some people talk about it. More something you discover when you need it.

</comment></comment></comment><comment><USER44> I started a first company with some friend. I was in charge of the IT, he was in charge on Sales. However, things were catastrophic as I was selling more than him. A huge conflict occurred and I closed the company. => I lost some money in the process, but I learnt a lot.

Then, a friend from Engineering school just graduated. We had previously worked together on side-projects, and we had a common passion for cybersecurity. We decided to launch our company.

After three years of hard work, we are now profitable and really happy about this choice :).

<comment><USER45> I'm curious what does a cyber security company do? Do you do pen testing for other companies? Consulting? Also what is your background? Thanks

</comment></comment><comment><AUTHOR> I'm building my company ([https://weardulo.com/](https://weardulo.com/)) while working as a web developer full-time. Mornings, evenings and weekends is when I dedicate time to it.

</comment><comment><USER46> A colleague and I left a large UK company and started orangejellyfish ([https://orangejellyfish.com](https://orangejellyfish.com)), a software consultancy with a focus on the web and JavaScript. The real push to start it came when we realised that much of what we both wanted to achieve in terms of craftsmanship, maintainable code and training in new technologies for engineering teams not yet exposed to them, was not going to be possible. We knew that many businesses do have a desire to improve those aspects of their engineering teams, and when we came to an agreement with a company that would become our first major client we decided that the time was right to both commit ourselves full-time.

We've doubled in size from our initial 2 in the last couple of months and with many more prospects on the horizon we're hoping to add a few more to that over the course of the next year!

<comment><USER47> How do you typically find your clients?

<comment><USER46> We network at meetups, conferences and other events, so through word of mouth mainly. The active engineering community in London is fantastic at helping to spread opportunities.

</comment></comment></comment><comment><USER48> A job was no option in the first place. Started and failed with businesses since I finished school with 19. With 29 now I have a business with 7 figure yearly profits.

</comment><comment><USER49> I was in law school, planning to start my own law practice. Then I read the 4HWW, fell in love with the automated business model, and realized it was difficult in law.

I left law school, using LSAT tutoring and teaching to cover expenses while thinking of an automated product idea.

I had reached out to online LSAT tutors for tips when I first started tutoring. A few months in, one of them approached me to ask if I would write some explanations for LSAT preptests. He needed them for licsening reasons, but didn't have the time to write them himself.

This seemed like an automated product (he would pay me royalties, I kept the rights). I wrote a bunch. These eventually also turned into print books.

I later made the explanations free online. This site attracted a lot of users, and I made video courses to sell to them.

That's where I'm at now, it's the 8th year.

</comment><comment><USER50> I was touring full-time in a band, while on retainer with an app agency for 30-hours/week when we launched [https://soundstripe.com](https://soundstripe.com). I was introduced to the other two co-founders by a client, and we hit it off.

I quit touring about 10 months after we launched because we had gotten a staff of a few people and it was starting to take off. I took about a 75% pay cut to focus on it full-time until we were able to pay ourselves a reasonable salary about a year or year and a half into business. Still did some side work until then, but not 30-hours/week worth.

We bootstrapped it for the first two years (had about 15 employees by then), but just recently closed a late seed round, and have about 25 staff now.

</comment><comment><USER51> Started my own business with a friend 4 years ago to write funny sci-fi side scrollers, he was then promoted in his permanent job which meant he didn't have any intention of leaving it.

Straight after with a 3d artist co-worker at the job at the time created a relatively re-useable VR ArchViz Engine in UE4 and Oculus Rift, our first client (major Indian construction firm) expected us to give it away for free and subsequently they went radio silent.

I panicked and quickly pivoted to DevOps/SRE consulting and contracting through agencies, which I've happily been doing since then.

Now it's a decision on whether to go back to permanent work (at a relatively senior level) as I'm starting a family or to double down and start hiring.

</comment><comment><USER52> Started it in 2012 while wrapping up my last year of school. Put my idea for a product I really believed in on Kickstarter, luckily Hacker News and the like really took to it, pushing it past 100% quickly. Been at it ever since.

</comment><comment><USER53> I left my job to become a consultant. I had some savings that were only going to last me a few months but I found a way to stretch that to 6 months, which is how long it took me to start getting consistent work. That was 5 years ago and I'm still consulting and loving it.

I've written about this: [https://www.gkogan.co/blog/how-i-learned-to-get- consulting-l...](https://www.gkogan.co/blog/how-i-learned-to-get-consulting- leads/)

</comment><comment><USER54> It simply started out with blogging about web development, JavaScript, and React and writing a self-published book about it eventually. I didn't plan to do it in the first place, but now I teach many people online React.js on my own course platform [0].

It's an exciting adventure, because suddenly you have to handle customer support, marketing and sales. Yet your main priority is keeping the course content up to date, adding new content and ensuring content with a high quality. It's not a 100% full-time gig yet, but I would say 60%. I hope by getting more students this year that I can accelerate it to 100%, because the teaching part itself is more fulfilling for me than any other 9 to 5 job. Last year I quit my job to support this adventure, but I have to have a couple of clients on the side [1]. Most of these clients are companies which are transitioning to React.

\- [0] [https://roadtoreact.com](https://roadtoreact.com)

\- [1] [https://www.robinwieruch.de/work-with- me](https://www.robinwieruch.de/work-with-me)

<comment><USER55> That's cool, congrats!

May I contact you with some questions about doing something similar?

</comment></comment><comment><USER56> My first startup attempt was a indie game right out of university. In hindsight, I was too inexperienced, and as the only programmer on the game; it failed.

I got a job and worked there for ~3 years to gain experience, learn, and make some money. About 2 years into that, I started working on a side project with my lead and we left about a year later to work on it full time.

[https://www.stroom.live](https://www.stroom.live) started out as a live streaming video "social network for local happenings". Shortly before we launched, Facebook Live/Meerkat/Periscope were launched, and we could not gather any traction. We took our base tech and pivoted, turning it into a low cost, high quality (allowing the user to plug their professional camera into a cell phone) professional live streaming platform for video and broadcast professionals. After 2 years, we are finally starting to gain traction and customers.

My founder and I were able to pay for it through savings, me sucking it up and living at home, side contracts, and a Canadian government research program IRAP.

</comment><comment><USER57> I started freelancing in 2012. Some years after, I started to understand I could never be rich or dissociate my income from my time while freelancing.

Started to build side projects 2 years ago. I roughly get $700/mrr with my 1st side project and my goal this year is $1.2k/mrr in 2018. So still far from being a full-time gig and still freelancing but increasing other revenues, which is my long term goal.

</comment><comment><USER58> I have a side project that lets me work for myself two days a week. Growing the project has been hard. I'm glad now I didn't pack in the day job.

</comment><comment><USER59> 1\. My nation elected a president more interested in plundering the environment than protecting it.

2\. Nearly everyone feels "I want to act but if no one else does then my actions won't matter so I'll keep doing what I'm doing."

3\. When I've gotten over that feeling, my changes _improved_ my life.

My podcast, Leadership and the Environment [http://joshuaspodek.com/podcast](http://joshuaspodek.com/podcast), emerged to help provide the leadership for cultural change, to where people _want_ to act on their environmental values.

Then guests like Dan Pink, John Lee Dumas, Dorie Clark, Frances Hesselbein, and other luminaries enjoyed their personal challenges, leading to more influential guests.

With a Superbowl champion and a Victoria's Secret model coming up, I'm more motivated than ever.

Plus people are volunteering to help, leading to in-person events.

Check it out: [http://joshuaspodek.com/podcast](http://joshuaspodek.com/podcast).

<comment><USER60> are you eating meat? avoiding meat & diary products is the best way to help the environment. Sensitive issue because not many people will do the change.

Watch Cowspiracy to learn more.

<comment><USER61> 75% of carbon emissions come from our energy supplies. Not taking any long flights is another amazingly potent way to reduce footprint. It's hard to pinpoint a best way to help but there are certainly a lot of good ways.

</comment></comment></comment><comment><USER62> I have a question about starting businesses...I'm getting ready to launch an MVP and it never occurred to me to research opening a specific bank account for it, whether or not I need to get a sole proprietorship (I'm in Canada, afaik this is our version of LLC more or less), etc. Anybody have any good resources for this stage of the process?

<comment><USER63> In the US a sole proprietorship is different than an LLC. It's basically just an alias that an individual uses to operate as a business. I think this is the same in Canada. An LLC limits your liability in the case that the business goes bankrupt or someone sues you or something like that so that your personal assets can't be taken.

I'm hesitant to give legal advice, especially to someone in another country whose laws I don't know, but in the US sole proprietorship are very common for small businesses and you can always switch to an LLC (or its Canadian equivalent) later.

</comment></comment><comment><USER64> I was contracting as an individual. I thought of myself as a a temp employee. The one of the executives at the company I was contracting for referred me to an executive at another business. In that moment I realized I could make the mental transition from temp to consultant, and my consulting business was born.

</comment><comment><USER65> I started a blog on the side in 2015 as I was taking the 30x500 business class, built up an email list, and later wrote a book that teaches folks about the React JS library. I launched the book in 2016. I still have a job at this point, but the book continues to sell, and I have more products in the works.

It's not been fast. There are no hockey-stick graphs. But it's slow steady growth, and still seems to be growing. I am very glad I did not quit my job before I started this thing! I did a podcast interview about the process I went through and some of the earlier false starts here: [https://stackingthebricks.com/podcast/ep27-you-can-ship- but-...](https://stackingthebricks.com/podcast/ep27-you-can-ship-but-will- anybody-buy/)

</comment><comment><USER66> I just got started - I started a content website about starting e-commerce businesses [https://www.starterstory.com](https://www.starterstory.com)

Right now, it's earning about $1-200 a month. Still have a full-time job.

</comment><comment><USER67> Before i was hired i went through around 150+ rejections. Every time i would go for an interview or interview candidates in my current role as technical team lead.

I will seriously wish for some resources which can teach me and others about the full interview process. what to do and what not to do. What kind of questions to prepare and what not to prepare.

And moreover a self assessment tool which can tell me how good i am as a developer from the interview perspective.

So i started [http://www.codespaghetti.com](http://www.codespaghetti.com)

currently i a, working on an AI based self assessment tool. Hoping to launch it by the end of this year.

</comment><comment><USER68> I got tired of (only) working for other people as a consultant. Started a side project 14 months ago to create a small scale integration tool, and it turned into a full-on search indexing tool for digital product companies - [https://getctx.io](https://getctx.io)

(Basically you connect it with your Slack, Trello, Google Drive, email and GitHub and it indexes the content & lets you search via web or our Slackbot)

I've got multiple clients in trial and a couple of promising community installations for large tech bodies, hoping to get some decent revenue on the scoreboard soon :-)

</comment><comment><USER69> I started freelancing on the side for about a year or two. Once it started to gain some momentum and be more predictable, I officially made an LLC and website and started devoting more time to it.

</comment><comment><USER70> We started building small apps in 2010 for fun. We were building it for our passion, this was a side project.

2010 to 2012 - We generated $ 10k in ad revenue in a year.

2012 to 2014 - We started an app consulting keeping our full-time jobs.

2014 to Present - We started app consulting for full-time with a couple of clients. Two co-founders with a technical background.

\- We had our first hire in 2014

\- We became a team of 5 in 2015

\- We on-boarded amazing clients & provided monthly retainers for App consulting & app maintenance

\- 2017, we have our first $ 100k client

\- 2018, we are a team of 14 people focusing on mobile apps, web apps

</comment><comment><USER71> For many years I was switching between earning money from client projects for 6-8 months and then trying to build my own things for 3-4 months while living from savings.

</comment><comment><USER72> A few years ago I was working as an application security consultant at Accuvant LABS. I had been reading the small business and consulting writings of tptacek and patio11 on this site and elsewhere for some time before then.

My experience as a security consultant was mostly working with very large enterprises. The technical work was interesting for the most part, but there was a lot of mundane "process" minutia and bureaucratic scar tissue. I noticed that kickoff calls with these companies would involve myself and any other technical consultants scheduled on the engagement, sales representatives, my immediate manager, a "solutions architect", the account manager, several people from their side, etc...I also witnessed a lot of "we'll get back to you" and inefficient internal team communication happening. At the time they were billing out consultants for $10-12,000 per week, but each consultant was only typically paid about 20% of that. A lot of value was being captured by a process very clearly designed for enterprise sales funneling, whereas the technical meat of the process was receiving a relatively smaller portion of the value.

So I left that company and started my own consultancy, aiming to effectively streamline the logistical for a smaller absolute rate while capturing nearly all of it individually. I began by focusing on smaller clients, particularly seed stage and VC-funded tech companies. I differentiated myself by 1) setting my weekly rates at approximately half of the market norm, and 2) handling all the foregoing roles on my own. On kickoff calls I could confidently speak about the end-to-end process both technically and logistically. In particular, I prioritized getting technical cofounded on kickoff calls in one-to-one or one-to-two settings, doing technical deep dives to demonstrate value, and consolidating all the answers into a single half hour call. For the most part, this was extremely effective - founders enjoyed having a single person to speak to who could fluidly transition between both "languages" for them.

After the first few clients, I started asking each founder directly for a referral to other founders they knew who might need help with security. Within the first year I no longer had to do any sales; all new clients were coming in through passive referrals, and my personal compensation well eclipsed my former salary. I focused on getting early champions and repeat clients who would excessively evangelize my service. In return, the folks who sent me referrals early on have been promised a lock into the low weekly rate for the life of my consultancy, and at this point I've raised my rates enough that my pricing has nearly reached parity with the large, enterprise consultancies. However, I've entirely avoided large enterprise companies, and I keep the sales cycle to a few weeks at the most (with a few outliers here and there).

Now having said all of that, if I'm being fully honest with myself I feel that much of the success of my consultancy comes from being very lucky - particularly in the beginning, with respect to finding initial clients. I don't think it's at all typical to achieve a fully passive sales funnel in year one of a new consultancy. But I don't have any sense of how much that achievement is attributable to my own networking skill and business savvy (or excellent technical work) rather than to being in the right place at the right time.

</comment><comment><USER73> Had a noncommercial side project (website) while working at university and later as a freelancer. It became more popular and got some press coverage, then VCs came knocking on my door. I gave in to the 3rd offer. Business model was tacked-on later (it was the year 2000), but was logical and works to this day.

</comment><comment><USER74> I recently launched a website for those who want to download their Instagram photos, videos or stories for offline use. I am hoping it attract user and get early attention. [https://www.savefromweb.com/](https://www.savefromweb.com/)

</comment><comment><USER75> Left my job to become a consultant (to my former company initially), did that for 5 years, then used the money I made and saved to bootstrap my current project. Still did some part time consulting on the side for a couple of years until we raised.

</comment><comment><USER76> I had a full-time job, and my side gig was only 10 hours per week that I was doing in addition to my FT job. Then I went full-time as a contractor for my side gig.

</comment><comment><USER77> By accident.

</comment><comment><USER78> I was and still am working full-time, but I try to put a new side mvp project out every roughly every 6 months which can (hopefully) generate revenue. Ive been doing this for about 2 years, and am launching hopefully my third "successful" project in April.

My most recent project ( [https://projectpiglet.com/](https://projectpiglet.com/) ) is an AI financial predictor - I started with scripts in 2013 - 2014, I then rewrote it recently to launch as a web service. So you can say it started as a side project, made me money (100% yoy), then after I felt it was validated, I went to expand.

My first project ( [https://easy-a.net/](https://easy-a.net/) ), was built as a weekend project to help some friends. It lets you know the grade distribution of every course, semester and professor of the universities in the system. Further, it provides estimated workload, probably exit grade for you, etc. My friends needed it because they couldn't get in to see a CS advisor at UIUC at the time, because they only had one advisor for ~ 1600 students.

The two I have today (aka the remaining "successful" MVPs) are gowing at an alright pace based on how much I put into it. And although I don't plan on leaving my job yet, I'm sure in the next couple years.

For reference, I did $3k the first year from my projects, $7k the second, and this year I'm on track for ~$25k+. I think I've heard it called the hockey stick of death.. where it isn't profitable enough to sustain itself, but it's growing... Slowly. It's a pain for SaaS. But I try to improve the products because they are both growing constistently.

The project I'm about to launch is built off my most recent platform ( [https://projectpiglet.com/](https://projectpiglet.com/) ). I think I can build at least four apps off of it - which I why I built it. More MVPs to try for the market!

List of ideas that haven't made it (yet at least):

\- [http://synaptitude.me](http://synaptitude.me)

\- [http://lettergram.github.io/AnyCrypt/](http://lettergram.github.io/AnyCrypt/)

\- thinksuite - [https://www.kickstarter.com/projects/synaptitude/thinksuite-...](https://www.kickstarter.com/projects/synaptitude/thinksuite- brainware-not-software?ref=discovery&term=thinksuite)

\- pearlywhiteparcels - toothbrush deliveries (similar to Dollar shave club), couldn't find enough partners with dentists (probably didn't want you to clean your own teeth lol)

<comment><USER79> Just an observation: On project piglet, the red price slashing gives me a perception of "desperation". My opinion is get rid of it and just make them nice simple numbers (whatever those prices end up being) without the drastic price slash.

<comment><USER78> Yeah I can see that, it also might explain why my conversation rate was higher at $50 / month.. lol although we are talking 1.5% vs 2%

</comment></comment></comment><comment><USER80> I decided to quit my full-time job in Feb and go 100% start-up.

Two of the largest risks I considered before taking the plunge was career risk, and financial risk.

For financial risk, I'm from Waterloo Canada, which is a relatively low-cost area. I'm doing some part-time contracting to pay off the bills just to break even. I am okay to lose out on the opportunity cost of earning more money at a full-time job. I treat that as an investment in the future cash flows of the company I'm trying to build.

For career risk, I think working on a start-up can actually make you more employable and increases your future earning potential. At a start-up, you work like hell and are constantly learning. If you believe your salary should be an accurate reflection of the market value of your skills, and you work to improve those skills, then your market value should increase accordingly.

Reading Nassim Taleb's book "Antifragile", gave me a lot of confidence. One of the central ideas from the book is to put yourself into environments where there is an asymmetrical bias for positive payoffs. I.e. you can't get randomly unlucky and die from entrepreneurship, but you can get randomly lucky and do very good.

For those of you curious, my company is [https://www.hodlbot.io](https://www.hodlbot.io) After I realized I was spending too much time rebalancing my portfolio, I made a trading bot.

For the MVP, it uses trade-only API keys to diversify your portfolio into the top 20 cryptos by market cap on Binance. It rebalances monthly.

<comment><USER55> > you can't get randomly unlucky and die from entrepreneurship

Unless you, you know, get into an accident and don't have enough cash or a decent medical plan...</comment></comment>


Card Breaches at Car Washes - <AUTHOR> http://krebsonsecurity.com/2014/06/card-wash-card-breaches-at-car-washes/ <comment><USER2> "Chaves said the store owners told him the devices had remote access via Symantec's pcAnywhere enabled, access that was granted to anyone knew the same set of default credentials."

Maybe its because The Cuckoo's Egg is what got me into this field, but I cringe everytime I hear this. Its 25 years later and we are still getting breaches based upon using default credentials.

This isn't even a hard problem to solve, you have three options: 1\. Do not have a default password and prompt the user for one during setup. 2\. Do not have the same default on every device, create it automagically from a serial number or something. 3\. Have the system be unusable for the intended purpose until the default password is changed.

<comment><USER3> A lot of these default passwords on non-consumer devices aren't user admin accounts but tech support accounts. So #1 and #3 don't work, because the user doesn't get the password.

But there is also a 4th option, the user somehow enables the support account.

</comment></comment><comment><USER4> I get the low level carders (or whatever you call them -- the folks buying card data and attempting to steal goods with it). If you're stealing $500 worth of gift cards at a time, it's not like you have many life alternatives.

But somewhere there's a series of folks that (1) engineered a symantec breach; (2) someone else either knew #1 or figured out how to get their hands on source; (3) security audited said source; (4) scanned the internet to find vulnerable servers; (5) pulled cards off those servers, and (6) sold them. It seems like there's more than enough technical knowhow here that these folks should be able to get software or security jobs, no? It doesn't seem like the card thieves make so much money that the reward / federal pound-me-in-the-ass prison ratio skews far enough.

And the more I read krebs, the more I think I should get a $2k limit credit card and use it for all purchases that aren't on amazon.

<comment><USER5> That assumes that the people doing all of this are located somewhere where better paying legitimate jobs are easy to come by. They usually aren't.

<comment><USER4> even if they don't, they seem like they have enough technical chops that said jobs would find them...

<comment><USER6> > they seem like they have enough technical chops that said jobs would find > them...

In my experience, jobs don't find you. By what mechanism do you think this would happen?

<comment><USER7> That depends on your exposure to people interested in you working for them. It's certain that when you are well connected jobs just find you. On the other hand it is imaginable that for many people in computer security most "jobs that find them" are not exactly ethical.

While I would not exactly position myself into computer security, I've got my share of borderline black-hat offers, although in all cases the other party believed that what they are doing is perfectly legal.

</comment></comment></comment></comment></comment><comment><USER8> Credit card numbers aren't particularly secret (if you think of all the retail staff online, on the phone and offline) that have access to them. The thing that manages fraud and keeps the value of card numbers down is the difficulty in converting card numbers to cash or goods safely and anonymously.

I'm slightly surprised that the gift cards scheme works as I don't see why there couldn't be a revocation list for gift cards circulated amongst stores that is added to when a chargeback occurs. Even if it doesn't it still exposes the criminal when buying the gift card.

<comment><USER7> Security of credit card industry is built not on hard computer security principles but on auditing and ability to point fingers. This breaks with enough levels of indirection and gift cards add such additional level of indirection.

Also gift cards have secondary (and probably more important) use for thieves. Giftcard is legitimately looking magstripe card that in many cases gets processed in same way as card payment, so you can just write stolen magstripe data onto giftcard and get something that does not raise suspicion (store clerk is not going to verify that card number matches or event that payment method matches).

</comment></comment><comment><USER9> _Given how easy it is to buy stolen cards, encode them onto gift cards and then use those cards to buy goods in big-box stores that can be easily resold for cash, Lavey said he wonders why old-fashioned bank robberies are still a problem._

EMV.

I know it's far from perfect, but it raises the bar considerably. You can't just clone EMV cards that way. The USA really ought to try to catch up with the rest of the world on this front.

</comment><comment><USER10> "The clerk told me they would come into the store in pairs, using multiple credit cards until one of them was finally approved, at which point they'd buy $500 each in prepaid gift cards,"

"We have two Family Dollar stores in Everett and a bunch in the surrounding area, and these guys would come in three to four times a week at each location, laundering money from stolen cards"

You would have thought they would report them.

<comment><USER11> You might think, but a few years ago, but when credit was crazy cheap in the UK and they were just throwing credit cards at people, I had friends who would go through this process each time they were picking up a bar tab. The credit card company won't let you go over your limit and don't forget just a few years ago there was no easy way to check your limit other than waiting for the bill or calling the company.

I wouldn't be surprised if many people in the service industries still see this type of multi card roulette daily.

I can imagine if the clerk did report his concerns, he'd likely be told they were good customers so why rock the boat....

<comment><USER12> > I can imagine if the clerk did report his concerns, he'd likely be told they > were good customers so why rock the boat....

Isn't the merchant liable for the chargebacks? Or in this case, who was footing the bill for this fraud?

<comment><USER13> The merchant may be liable - but the minimum wage clerk...?

<comment><USER14> Minimum wage clerk is not liable due to many laws that protect employees from wage abuse without a judgement in court[1] but they can surely get fired for negligence in reporting suspicious activity.

[1] [http://www.seyfarth.com/dir_docs/publications/NEHT01120810.p...](http://www.seyfarth.com/dir_docs/publications/NEHT01120810.pdf)

>As a practical matter, the Court's decision means that employers can- not safely take deductions for theft or damage to property unless fault and value have been determined by a court of law or government agency.

</comment></comment></comment></comment></comment><comment><USER15> One of the most striking things to me is this sentence: "Trustwave and other companies that get hired to investigate breaches involving card data is that far too many point-of-sale breaches start when the thieves abuse some kind of remote access tool installed on the point-of-sale device itself."

We have an incredibly secure and successful piece of remote access software (ssh) that is used on billions of computers and yet that sentence exists. It seems that sometimes it's not just an engineering problem.

<comment><USER16> SSH is no better than some random Windows-based remote admin tool if the same default password is used.

<comment><USER15> Ah yes of course, and the portion that I quoted didn't include this tidbit which I guess is what I was actually thinking about: "What the investigators we've worked with so far have been able to gather is that [the thieves] were exploiting not the pcAnywhere credentials, but a flaw in old versions of pcAnywhere,"

Then again old versions of SSH are probably equally vulnerable.

It would seem that there is no substitute for having a real root who has responsibility for the system, though perhaps the comment from nuxi7 is a simple way to engineer around part of the problem. Sane defaults or in this case an explicit lack of defaults could be useful.

</comment></comment></comment><comment><USER17> Considering how expensive point-of-sale systems are, I'm not surprised that these systems are running old, vulnerable software. Heck, there are still ATMs running OS/2 Warp in the United States; the only reason people don't hack those is because it's so obscure.

My father still uses a small pre-computer cash register to this day; I've had no luck convincing him to buy a new computerized one so he can accept credit cards.

<comment><USER18> I'm surprised these PoS systems aren't managed with automatic updates, since the merchant service providers (along with the banks) are usually the ones losing money if they get hit with chargebacks.

<comment><USER7> In europe typical deployment solves this problem (EMV is quite orthogonal to this) by the fact that card data does not touch the PoS system itself. In fact any other approach is not feasible as PoS systems themselves are invariably horrible mess of accumulated kludges and backward compatibility restrictions. And there are quite powerful economic incentives to keep this state of things. Security-wise this is one of the few situations where semi-air-gapped network makes sense (for the PoS part, with card terminals having their separate network).

</comment></comment></comment><comment><USER19> Prolexic hosts this site which has for some reason kills connections from my entire IP address range (residential DSL).

Wonder what one of my IPv4 neighbors did to piss them off.

<comment><USER17> I've copied the plaintext here for you.

[http://pastebin.com/d4vFzJDC](http://pastebin.com/d4vFzJDC)</comment></comment>


Ask HN: Do you think its fair to charge for fixing bugs? - <AUTHOR>

Putting myself in the client's position, why should I have to pay for some stupid mistake the developer made..? Not only do I have to pay for it, I also have to waste my time logging a ticket with a whole lot of detailed information. And THEN, I have to prioritize it over some other functionality that was already planned for the sprint.. <comment><USER2> Sure, the client is always paying for it anyways...

If he doesn't wanna pay for defect correction, you are just going to spend a lot more time on that before you deliver (i.e. your estimates goes up)....

Finding subtle bugs is increasingly difficult as the code quality goes up, so each bug is getting increasingly costlier to find before it hits the real world.

Even well-tested code will not be defect free unless an incredible amount of effort is spent. (We are talking orders of magnitude more than regular clients are willing to pay for). Look for the NASA study on code quality and look at their productivity to achieve that (granted, brilliant) code quality.

Personally (as an freelancer), I comp the really, really stupid oversights (and their diagnosing time)... That shit happens once in a while (and that comping buys you a lot of credibility)... but the "normal" (i.e. somewhat trickly) bugs, they client pays for them.

For new customers, I usually have a "facts of software development" talk, so that they know how and why I do stuff... (most customers appreciate the frankness and have no problem paying for bugfixes afterwards - if they do, I simply add margin to their estimate that gives me room for expected later bugfixes).

If they balk, when you say that you cannot write defect free code... ask them if they ever find typos in documents or wrong calculations in spreadsheets even after they spend "a lot" of time to make sure they were correct...

<comment><AUTHOR> I usually use the "car warranty" analogy. That "free" 3 year service plan is not free. It's just built into the price. We're just more transparent, that's all. I like you're "typo" example as well.

The "facts of software development" is really important, especially if the client hasn't got a lot of experience in developing products. I've always found the more experienced a client is, the easier they understand the concept.

<comment><USER2> Yeah, I try to only take clients that have been in the game for a few years - or really go heavy on the "facts" speak...

Most clients are reasonable, but the newb ones simply don't know the realities and mechanics.

And it's when you have a different view on reality, that you get unhappy with each other...

I also tell my "newb" clients, that the first project is perhaps 50% of the total, even if it delivered on time and on spec (for bigger projects)... But the spec is always incomplete and wrong, so fixup is going to be needed, because we learn while we do the first version and the first "real deployment"...

</comment></comment></comment><comment><USER3> This is a good reference implementation.

[https://news.ycombinator.com/item?id=7850335](https://news.ycombinator.com/item?id=7850335)

In general, I would avoid selling software without a service agreement.

Bugs are a thing that happens. You will endeavor to make them happen less, because you're a competent professional. But because you're a competent professional, you know that some will happen anyway. So structure your business deals such that both you and your customer have a good answer to the problem. You shouldn't take a wash for being available, and they shouldn't be left hanging with nobody to get help from.

This gives you a tidy source of recurring revenue and an easy way to nudge up your average deal value. It gives your customers a reliable source for fixes and changes. It's good business all around.

</comment><comment><USER4> If you are doing freelance work, you could roll maintenance development/fixes into an ongoing support contract which includes a SLA and monthly fees.</comment>


Password Reuse - <AUTHOR> http://www.xkcd.com/792/ <comment><USER3> <preamble> I initially posted this as a comment on a duplicate submission, not realising it was a duplicate. So I've moved it here to the original. For some reason someone down-voted it there - no idea why - so I hereby give them the chance to down-vote it again, but ask for a reason.

</preamble>

Usually submitting XKCD is frowned on, but I'm pleased to see this one submitted. This attack vector is so seldom recognised as a real potential problem. It neatly explains the problem of password re-use.

As an aside, it's known that One-Time-Pad is provably secure. What's less well known is that during WW2 OTP systems were occasionally broken, because in the real world they ended up being Two-Time-Pads. People re-used a pad because they didn't get a new pad in time, _etc._ This was going to be one of my greybeard stories, but I'm still getting closer to the information source.

<http://news.ycombinator.com/item?id=1333934>

<http://news.ycombinator.com/item?id=996250>

<http://news.ycombinator.com/item?id=994358>

<http://news.ycombinator.com/item?id=1001262>

I really have to find time to go back and organise them properly.

</comment><comment><USER4> This reminds me of the good old days of searching Limewire for "password .txt .rtf .doc". It's incredible what folders and documents people would foolishly share.

But the most important thing I learned is this: email account passwords are worth their weight in gold! As soon as you have an email address and password, you have access to a searchable list of logins and password confirmations.

This is even more worrying than the example the comic utilises. You still have to (manually or automatically) go to these sites and guess the username (is it bob101 or is it 101bob this time?) and try the various passwords. As soon as you're into an email account you have quite the dangerous list. All of which are confirmed and ready to go.

\-- This is entirely a work of fiction, and in no means describes my teenage years.

<comment><USER5> also most sites have a "forgot password?" link that works by sending you an email. In this sense, the email password is the master password.

<comment><USER6> and the e-mail password is recoverable by guessing the answer to a weak security question, so in a sense a weak security question answer is the master password.

</comment></comment></comment><comment><USER7> A friend an I have considered a number of times setting up something like <http://ismypasswordsecure.com> and just collecting passwords that way.

This is of course pure evil and we never figured a way in which it had a return apart from publishing lists of common passwords.

<comment><USER8> Instead of collecting the passwords, have the submission button show a page about sane password practices. (Something similar to <http://ismycreditcardstolen.com/>)

<comment><USER7> I just wouldn't want to actively encourage anyone to enter their password in a webpage like that.

We need to train people to behave more securely.

</comment></comment></comment><comment><USER9> Actually, a company-wide Starcraft 2 tournament is more likely. Oh wait, we just finished one of those last week. And then had HDStarcraft come and cast the finals.

</comment><comment><USER10> The fun part is that password complexity makes this problem _worse_ , not better.

People use the same user/pass combo for every site they visit, except when one of them forces them to use a complicated password that they can't remember. So they send themselves an email with the site name, username and password so that they can find it next time they need to log into their bank.

So once your registry cleaning website has their email password, you also have a nice list of all their strong passwords too.

Adding to the irony, most people know that they need a different password for their bank, so if you just let them pick one without forcing complexity, they'll choose something they can remember, and their bank account will be safe.

<comment><USER11> But letting them pick a password without forced complexity makes it significantly easier to crack their password using one of the various, comprehensive, easy to find and download wordlists or dictionaries.

<comment><USER10> In the real world though, passwords aren't cracked nearly as often as they're read off a post-it note stuck to somebody's monitor.

Loosen complexity and you can eliminate that post-it. That's a huge overall win.

Complexity in itself isn't actually that bad. It's _arbitrary_ complexity that spawns all those post-its. You can come up with a strong password that you and only you can remember, but it's useless if your bank rejects it due to its own silly complexity policy. There are sites out there that I regularly fail to log in with using my standard "strong" passwords, and it's not until I make it all the way through the Reset Password process to where it tells me its complexity requirement that I'm reminded which password I must have used last time I went through the process.

The only real solution is to let people use the word "password" if they really want. It's still orders of magnitude safer than having them keep a file/email/post-it full of plain text passwords sitting around in plain view.

<comment><USER12> Fully agree with the first post-it point, but I disagree with:

> The only real solution is to let people use the word "password" if they > really want. It's still orders of magnitude safer than having them keep a > file/email/post-it full of plain text passwords sitting around in plain > view.

If I have "password" as password for my work webmail/remote login, it can be broken by any yokel on the internet with five minutes free time. If I have "ge.9u30!ey0" written on a post-it note on my desk, it can only be "cracked" people with physical access to my office.

Also note that people who have physical access to my office already have security privileges similar to mine own, mitigating the actual risk - <USER2> can't do _much more_ damage with my password than they could without. And if they wanted my private stuff, they could just as well nab my harddisk.

Not that I'm justifying passwords on post-its in any means whatsoever, by the way. :-)

</comment></comment></comment></comment><comment><USER13> I thought of this 9 years ago, and got stuck at the same step as the hat guy. Once you have the login details, then what? The only thing you can really do with the information is be a giant douchebag, and that's not cool.

<comment><USER14> Steal the accounts, use it to make money and blow it all on high class escorts.

People claim money won't make them happy. That is because they buy the wrong things...

<comment><USER15> Have you observed this purchase to actually cause happiness?

<comment><USER14> Not really - most people tend to end up in gaol.

</comment></comment></comment></comment><comment><USER16> I often wonder why this hasn't already happened on a massive scale.

I figure a bunch of Russian and Chinese hackers are skimming off cents at a time or something because they don't want to kill their golden goose by being too overt.

<comment><USER17> Who says it hasn't?

</comment></comment><comment><USER18> Well, exactly that is the reason why we should adopt something like OpenID. Of course, if someone catches the password of your OpenID provider, you are also fucked. But all OpenID consumers (i.e. any random site) will not get it that way. Also, you can easily globally change your password for just everything if you know that your old one has become insecure.

</comment><comment><USER19> Why do people remember passwords? We've had browsers that can remember them for you, password1, etc. for years now. I make up a new password for every single site I have to log into and let the browser remember it.

<comment><USER20> Mainly because most people log into these sites from more than one computer.

It's imperative for me to recall all of my passwords as I need them both at work and at home. Currently I am rotating between three different passwords but this is an area I am becoming increasingly paranoid over.

<comment><AUTHOR> If you have relatively few passwords, use Bruce Schneier's advice and write them on a piece of paper that you keep in your wallet - safe and available.

<comment><USER21> until you lose your wallet.

</comment></comment></comment></comment><comment><USER22> Can anyone suggest decent password manager that would have the advantages of being cloud based without the risk of someone stealing my passwords?

<comment> brown9-2 PasswordSafe on a dropbox shared folder works great: <http://passwordsafe.sourceforge.net/>

<comment><USER6> Can I ask how this works?

Is the binary stored at dropbox, or the data file? If you store the binary at dropbox how can you be sure it hasn't been modified?

<comment> brown9-2 I store the data file on dropbox, so it is replicated across different machines I use. Each machine has the PasswordSafe program (binary) installed on it.

</comment></comment></comment></comment><comment><USER23> problem is, Google will not remain non-evil forever. The public market has a way of corrupting the soul of a company.

<comment><USER24> What are they going to do after they turn evil? Play CoD4 on the lobby TV? (Yup, I read _all the way_ to the end.)</comment></comment>


Bitcoin URL scheme whitelisted in HTML5 - <AUTHOR> http://html5.org/tools/web-apps-tracker?from=7849&to=7850 <comment><USER2> "Added to HTML5" is misleading. More specifically, the bitcoin scheme was added as a valid scheme that websites may register themselves as handlers for via navigator.registerProtocolHandler, a list that already includes mms: xmpp: webcal: tel: and other misc schemes. It doesn't specify any kind of support for the scheme for the browser.

See [http://www.whatwg.org/specs/web-apps/current- work/#whitelist...](http://www.whatwg.org/specs/web-apps/current- work/#whitelisted-scheme)

<comment><AUTHOR> Yes, I didn't know how to be more precise while being concise. I replaced the word "added" with "whitelisted", thanks.

<comment><USER3> It should also be made clear that being whitelisted is different from being implemented.

</comment></comment></comment><comment><USER4> Seems like a horrible and arbitrary idea. What is it meant to achieve? Send a bitcoin to an address? View a block?

HTML5 started off well, but is beginning to morph into a cargo cult of 'cool': the return of mystery navigation, "swipe to navigate", many others.

<comment><USER5> You have given reasons that support the idea that this is arbitrary, but why is it horrible?

<comment><USER6> Are we going to have to whitelist every currency that will exist in the future? At least have a pay: schema so you do pay:bitcoin.com/... or something.

<comment><USER7> Exactly. Needs another layer of abstraction to handle competing crypto currencies. BTC was the first, but won't be the last.

<comment><USER8> Something analogous to the way magnet URIs are used as an extensible scheme for peer-to-peer filesharing links?

<http://en.wikipedia.org/wiki/Magnet_URI_scheme>

<comment><USER9> Right; perhaps it would be better to introduce a generic URI scheme for paying:

        pay:?currency=btc&address=1BlaH&amount=1.0

<comment><USER10> Then you need some standardisation on what 'currency' is anyway, and if you use ISO 4217 you shut out Bitcoin.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Everyone who maintains the HTML5 spec. is named Mike.

<comment><USER12> it's a diff of an alphabetical list, it's showing a few lines on either side of the name that was added.

So all the HTML5 spec contributors whose names start with the letters "mike" are called Mike.

</comment></comment><comment><USER13> OK, if I understand correctly this is the WHATWG HTML5, not the W3C HTML5. Are there any browsers actually using WHATWG's spec?

<comment><AUTHOR> Yes, all of them! :-)

WhatWG HTML is the living standard, and the HTML5 (W3C) spec. is like a snapshot.

<http://wiki.whatwg.org/wiki/FAQ#What_is_HTML5.3F>

<comment><USER13> No, it's not that simple.

<http://wiki.whatwg.org/wiki/FAQ#WHATWG_and_the_W3C_HTML_WG>

<comment><AUTHOR> Yeah, nothing is simple, but it's still true most of the time. Feel free to explain better :-)

<comment><USER13> Basically, the WHATWG and W3C specs have diverged and there is no clear plan for them to meet up again. So, just because WHATWTG has added bitcoin links to their HTML5 spec does not mean that W3C will add bitcoin links to theirs. W3C is generally considered the more respected/"official" spec out of the two. (I would not be surprised if most people who've heard of the W3C have _not_ heard of WHATWG.) I know that browser developers care about being W3C-compliant. I'm not sure whether they care about being WHATWG-compliant.

<comment><AUTHOR> Browser developers _care_ about being "WhatWG compliant", because the WhatWG HTML group is composed by browser editors, they work with the W3C HTML5 group, and the HTML5 specification is based on the WhatWG's HTML document.

Read this if you need more clarifications:

[http://lists.w3.org/Archives/Public/public-whatwg- archive/20...](http://lists.w3.org/Archives/Public/public-whatwg- archive/2012Jul/0119.html)

<http://blog.whatwg.org/html-is-the-new-html5>

<comment><USER13> Thanks, this is what I was asking for.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Aren't they picking favorites then?

I mean what about alternatives like litecoin?

<comment><USER15> Yes. Favorites like http and not gopher.

Litecoin will get whitelisted if it ever becomes important or useful.

<comment><USER16> If gopher is actually left out I won't be "upgrading" my pages to HTML5. Some of us still use these technologies even if they may not be the latest and greatest.

<comment><USER17> > Some of us

For very small values of 'some'.

Can you give a couple of (practical!) examples where gopher has not been replaced by http?

Chrome, explorer, opera and safari do not support gopher, and from 4.0 firefox did not support it either (though there is a plug-in).

<comment><USER16> I was speaking for myself rather than making a principled stand; my site still links back to some documents on my old university's system, via gopher. Perhaps there is an http equivalent that new students would use, but if there is then I don't have access to it.

</comment></comment></comment></comment></comment><comment><USER18> What does this mean exactly?

<comment><USER19> It is referring to the registerProtocolHandler function. The function allows you to register handlers for custom schemes, so that you can do clever things with links like awesome.

The "web+something" namespace is what we should be using for our custom scheme handlers, but there are a bunch of other web-related schemes that will be fine to use too... "bitcoin" is one of the OK ones.

It's not a big deal as far as I can see... basically any scheme that is popular enough or documented enough and isn't supposed to launch some external application could probably get white-listed if you asked nicely.

</comment></comment><comment><USER20> People are way overreacting to this.

HTML _already_ lets arbitrary applications register themselves as protocol handlers at the OS level, so for instance spotify:// links get handled by the correct binary.

All this does is let a website register itself as the handler of a particular protocol. This has obvious uses for instance letting mailto: be handled by Google Mail if the user wants it to be.

I'm not sure why HTML5 has to have a whitelist of protocols that allow websites to register as handlers - it seems like an overhead.

</comment><comment><USER21> how i can see name of user who committed this?

<comment><USER22> The name is always "Ian Hickson". He's the only committer on the HTML5 SVN repo:

       $ svn log -q | egrep "^r\d+" | cut -d "|" -f 2 | sort | uniq -c
       7850  ianh

</comment></comment><comment><USER23> This screams bad idea to me...

<comment><USER24> Care to elaborate?

<comment><USER25> Maybe because there are many other currencies besides bitcoin, what about ripple, litecoin, etc? Would they alter the standart every time to add one of them?

<comment><USER26> If those currencies gain traction comparable to Bitcoin, why not? The standard is being changed every day anyway.

</comment></comment></comment></comment><comment><USER27> Not good. HTML5 shouldn't be opinionated and definitely not in favor of a doomed standard.

</comment><comment><USER28> I would love to see the reaction here if this was paypal: not bitcoin:

<comment><USER29> Paypal payment is implemented only using paypal website. It is pointless to add it because no website/app can register as a handler for that URL scheme to implement it in any different way. Bitcoin payment is not centralized and processed by one agency.</comment></comment>


I have a confession - <AUTHOR> I have a confession.  I love reading Hacker News while in the bathroom on my mobile.  Yes, I know.  Disgusting.  But it's important to understand where the "NEED" for a mobile friendly version came from.  It's one of the few times during the day that I can surf what I want without some other agenda or task pulling me away.  The mobile experience was always pretty meh on the official site and required me to pinch zoom to read the contents when I should be focusing on pinching something else. I was going to use a reader when I thought, why don't I just wrap it with some css and display it the way I like it.  I also made it easy to share the articles across different social sites, and since I was designing this for myself, I figured I would just make it easy to do the things I do when I do them. I don't vote on articles.  It's just not what I do.  I share the cool one's.
I also added a more promenent search (at the top) so I can find what I want. I also put in some categories for things I tend to want to keep up on and added a few hotkeys (alt - s = search). the design is a work in progress with no plans to ever "finish" it.  It's just an experiment and totally selfish. If you find yourself "needing" a mobile friendly version, feel free to try it.<p>Warning: It's still in alpha....  it's still being worked on...  also open to suggestions. <comment><AUTHOR> alpha link: hackernews.ca</comment>


Apple Unleashes New Macs, Multitouch Mouse - <AUTHOR> http://www.wired.com/gadgetlab/2009/10/newmacs/ <comment><USER2> Beautiful! That iMac looks like a fabulous UNIX workstation.

And I soooo want that mouse.

Anyone know of a good creative way to send an old Mighty Mouse with stuck scrollball to mighty-mouse-heaven? I'll document it on video :-)

<comment><USER3> Some thermite?

A high powered air cannon?

A bath in liquid nitrogen followed by a toss in the air and an impact with a baseball bat on the way back down?</comment></comment>


Phreeze - Ruby on Rails for Backbone.js + PHP - johnx123-up http://phreeze.com/?utm

<comment><AUTHOR> This is cool, but is it possible to generate apps w/o relying entirely on Ajax?

Truthfully, this style architecture is the root cause of almost all of our support tickets. Our percieved load time has gone up quite a bit as data tables, forms and property lists all need to be re-populated with every page load...

If users try to trigger an editor prior to event handlers binding fully, at best nothing happens; at worst unpredictable things (eg: orphaned records/workflows, things only appearing to have been edited/deleted, etc).

And probably the biggest problem I have with giving this much responsibility to the front-end is dealing with the mountains of interdependent JavaScript.

All these things are solvable, I know: for example push state helps with the page load problems, event queuing helps keep ultra-clicky users in check and having solid conventions helps keep JS organized properly; but I still find myself always going back to relying on tried-and-true progressively-enhanced HTML.

On that note, I have to give props as it is a breath of fresh air to see all these great technologies used in a framework like this.</comment>


Python becomes a platform. Thoughts on the release of clojure-py. - <AUTHOR> http://khinsen.wordpress.com/2012/03/15/python-becomes-a-platform/

<comment><USER2> The idea of a python implementation becoming host to other languages is somewhat interesting. Python has had a good interop story with the vibrant ecosystem of C libraries and is pretty good at being cross-platform as well.

However, I'm not sure Clojure is going to impress Python developers for the reasons the author states. Python has metaprogramming and it has an immutable type (the tuple). However, Python has rejected functional purity for pragmatism so I'm not sure there will be a great many Python developers suddenly switching to clojure. It's generally not the implementation that impresses Python developers the most AFAIK -- it seems that most Pyhtonista's like the language more than anything.

That being said I'd be interesting to see how far clojure-py goes. Pypy is the ideal implementation for this sort of project as they're aiming to be a JVM- like platform for dynamic languages.

<comment><USER3> Users of a host platform are almost never the target of a port such as this. ``Pythonistas'' are not the audience here, it's Clojure programmers who wish to sneak Clojure in a Python environment or use its libraries in lieu of Java's.

Also, I must add that I really dislike the use of the word ``pragmatism'' in the context of a programming language. It almost always is used to justify either sloppiness, misunderstanding or just plain (and save for the word, valid) aesthetic preference.

<comment><USER4> Fair point about "pragmatism" but the contrary "elegance" often comes across as dogmatic or even elitist. Most languages strive for both pragmatism and elegance, but tend to favor one a little over the other.

And yes, this is relevant since Python and Clojure embody exactly this kind of tension.

<comment><USER3> I guess one could pinpoint it to the clashing of the traditions of pure mathematics and engineering which one finds in Computer Science.

Elegance is an often trotted epithet in mathematical writing, and sure, it has some sort of established connotation (minimalism, what we call orthogonality, etc.), but in the end it's almost always something like "it has sugar, and marmalade, and skittles and ketchup! All my favorite ingredients! I'm very glad they didn't put that icky caramel stuff in it".

Anyhow, Clojure sports a fair bit of ``pragmatism'' with its own, very leaky sequence abstraction, as you sometimes feed a vector to a function and you get a linked list and next thing you know, your head has been put in your ass (when you conj/cons an element to a sequence).

Lisp has also always leaned to a sort of messiness in its use, even if the language's features and libraries are held to a higher standard. Thus you see phrases like ``ball of mud'' used in a subtly positive way.

</comment></comment></comment></comment><comment><USER5> I'd argue that clojure-py is important for a different reason: Clojure is slowly sneaking up on every popular runtime:

      JVM -> Clojure
      Javascript -> ClojureScript
      Erlang VM -> Joxa
      CPython/PyPy -> Clojure-py

In a few years clojurers/lispers will be able to target multiple platforms with one simple language.

As a pythonista myself, I used to feel overcome with nausea just by looking at Clojure/Lisp code. However, Erlang was my gateway drug into the functional/bizarre-syntax world and now, after a few weeks (and two books) with Clojure I'm having a bit of an identity crisis: my brain simply refuses to touch messy-non-Lisp code ever again.

<comment><USER6> > In a few years clojurers/lispers will be able to target multiple platforms > with one simple language.

I doubt it, unless either their code doesn't use any external libraries, or Clojure writes a library abstraction layer containing all the Java/Python/etc libraries.

<comment><USER5> I did not mean to imply that Clojure code would be portable across runtimes (though it is a possibility).

I meant that things like ClojureScript One (if you don't know it, please take a look, it's worth it) will be possible across a variety of domains. Simple interoperability between platforms, same data structures, fewer context switches, Clojure all the way down.

</comment></comment></comment><comment><USER7> I'm not sure why the author would say that metaprogramming is "absent" from Python.

Do decorators and metaclasses not count as metaprogramming features? I'm sure that languages in the Lisp family might be better suited for metaprogramming than Python but the author's claim seems straightforwardly false.

<comment><USER8> > "Do decorators and metaclasses not count as metaprogramming features?"

Not when compared to macros in lisp dialects. The closest python comes is: <http://docs.python.org/library/ast.html> but lisp with it's simple structure is much less unwieldy.

</comment></comment><comment><USER9> I'm curious, can PyPy JIT-compile Python bytecode by itself, or does it require the source to be in Python? Because it would be really cool if you could target the Python "platform" and get a free JIT as well.

Edit: Nevermind, just read the project readme[1] where they explicitly mention targeting PyPy as a goal.

[1] <https://github.com/halgari/clojure-py>

<comment><USER10> > I'm curious, can PyPy JIT-compile Python bytecode by itself, or does it > require the source to be in Python?

Considering you can run bytecode-only Python, it would be weird if Pypy's JIT only worked from source.

Beyond that, they're apparently implementing Clojure on top of (in) Python, so they won't get the JIT for free (the interpreter code will be JITed, but the Clojure code won't be unless their runtime compiles to Python bytecode which does not seem to be the case). They'd get it for free if they implemented a Clojure in RPython as well, but would leave the Python ecosystem behind.

<comment><USER11> From the article

> clojure-py is an implementation of the Clojure language in Python, compiling > Clojure code to bytecode for Python's virtual machine

Which means both the compiler (mostly an AST walk from the look of clojure/lang/compiler.py) and the Python bytecode it produces should benefit from PyPy's JIT.

<comment><USER12> This is very correct. We compile Clojure code to Python bytecode. Clojure functions become python functions, clojure deftypes are Python classes, Clojure namespaces are Python modules. And yes, it runs perfectly well on PyPy. Actually it sometimes runs a bit better. CPython segfaults with bad bytecode sequences (unbalanced stacks). PyPy actually throws an error so you can fix the code.

</comment></comment></comment></comment><comment><USER13> I'd rather see things being overlaid on a Lisp, ala <http://common- lisp.net/project/clpython/>.

</comment><comment><USER14> Interestingly, when I saw the release announcement a week or so ago, I thought "neat, but I can't think of any use I'd have for it". And then yesterday I ran across SimpleCV [<http://simplecv.org/>] and realised I could potentially use it from clojure, which would be really nice. There really is a lot of nice scientific/visualisation work going on in the python community and it is great to have access to it from clojure.

</comment><comment><USER15> "Clojure is strong in two areas in which Python isn't. One of them is metaprogramming, a feature absent from Python which Clojure had from the start through its Lisp heritage."

Absent is too strong a word, surely.

[http://bitshaq.com/2011/07/14/basic-intro-to-python-meta- pro...](http://bitshaq.com/2011/07/14/basic-intro-to-python-meta-programming/)

</comment><comment><USER16> Last time i looked the Python bytecode was not considered stable. This means, Python devs might change syntax and semantics in minor version changes. This would be a major problem for clojure-py.

</comment><comment><USER17> I've used Clojure on and off but never really learned enough Java to be comfortable with it. Clojure-py has been a lot more fun because I can use the Python libraries I'm already familiar with.</comment>