Electron Bug - NodeIntegration Bypass - <AUTHOR> https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/ <comment><USER2> Someone should point out --- and it should have occurred to me earlier to look into this and point it out myself, and I should catch some flack for that --- that the Trustwave bug is situational, but is reported as if it impacts all Electron applications.

In fact, a good number of Electron apps, including Signal and Slack, are confirmed _not vulnerable_ to this particular bug, despite the misleading way the report was written. (There's another bug being talked about which is adding to the confusion).

The authors of this report should update it to clarify, rather than simply naming the most popular Electron apps as a means of whipping up attention.

<comment><USER3> Isn't it mostly confusion with the Signal XSS report? The Trustwave thing doesn't come out and say any particular app is vulnerable.

<comment><USER2> It probably is, but then, that would suggest that they should be extra careful about not saying they found a Signal vulnerability, right?

<comment><USER3> They don't really say that but I'm in violent agreement they should have been much more clear and explicit. At the same time, you were just talking about a BlackHat presentation which you feel didn't get sufficient attention, possibly due to a lack of awareness the tech in question is at the core of a bunch of popular apps. The presentation mentions no specific apps at all. So this thing seems like a bit of threading that needle poorly and also some bad timing. It's not like they bought the domain jitterbugdoor.exposed and splattered 'Signal Degradation through Electron Degeneracy Pressure' across it.

</comment></comment></comment></comment><comment><USER2> The security story on Electron is pretty grim; it's an environment where you can plausibly say that DOM injection (cross-site scripting) is equivalent to RCE. Luca Carretoni broke this news last year at Black Hat, but didn't seem to get too much attention (I don't think many security people knew what a big deal Electron was in the dev community).

[https://www.blackhat.com/docs/us-17/thursday/us-17-Carettoni...](https://www.blackhat.com/docs/us-17/thursday/us-17-Carettoni- Electronegativity-A-Study-Of-Electron-Security-wp.pdf)

<comment><AUTHOR> And it isn't getting much attention on HN, ironically. Oh well...

</comment></comment><comment><USER4> I wonder how widespread the issue might actually be, given the description at the end:

" can allow for remote code execution provided that the application is using a vulnerable version of Electron (version < 1.7.13, < 1.8.4, or < 2.0.0-beta.3) , and hasn't manually opted into one of the following:

* Declared webviewTag: false in its webPreferences.

* Enabled the nativeWindowOption option in its webPreferences.

* Intercepting new-window events and overriding event.newGuest without using the supplied options tag. "

<comment><USER5> Is there a way to tell what version of electron an app is using?

These aren't old versions - 2 months in one case.

</comment></comment><comment><USER6> Slack already confirmed that they are not vulnerable: [https://twitter.com/SlackHQ/status/995444608002875392](https://twitter.com/SlackHQ/status/995444608002875392)

</comment><comment><USER7> Apps using Electron are – among others – Signal, Slack and Zoom:

[https://electronjs.org/apps](https://electronjs.org/apps)

<comment><USER8> And Skype, VS Code, etc...

<comment><USER9> And Atom</comment></comment></comment>


The Social Scientific Case Against a Muslim Ban - <AUTHOR> https://www.nytimes.com/2017/02/18/opinion/sunday/the-social-scientific-case-against-a-muslim-ban.html <comment><AUTHOR> Belonging nowhere: Marginalization & radicalization risk among Muslim immigrants (.pdf)

[https://behavioralpolicy.org/wp- content/uploads/2016/1-2/BSP...](https://behavioralpolicy.org/wp- content/uploads/2016/1-2/BSP_vol1no2_Lyons_final.pdf)</comment>


Ask HN: Is there a social network based on the HN? - <AUTHOR> There is content,people,discuss on HN , people can share , discuss something on HN. So is there a social network based on HN News ? <comment><USER2> I think that a HN/YC run Mastodon instance would be perfect.</comment>


Opinion: How Apple could have prevented the iPhone-slowdown controversy - <AUTHOR> https://www.marketwatch.com/story/how-apple-could-have-prevented-the-iphone-slowdown-controversy-2017-12-23 <comment><USER2> > Knowing the battery size (which also limits the total peak power draw from > the battery) and software system in play, Apple could have (and I would > argue should have) designed a processor that would provide consistent > performance throughout the life of the phone.

> Yes, this would result in lower peak performance for iPhone devices.

Aren't they essentially arguing that Apple should enable the throttling on day one instead of waiting until the battery degrades? How does that benefit anyone?

<comment><USER3> No. It's about building a chip that isnt going to crash when the voltage drops for a picosecond, allowing throttling to happen only as needed without fear of crash.

<comment><USER4> Are there processors out there that can handle voltage drops without crashing?

<comment><USER5> Pretty much all processors start off that way. The clock speed needs to drop to compensate, though.

Unless you actually put some thought into your hardware designs because you're making phones that have a life expectancy of greater than a mere 12 months that will be used around the world for years to come... in which case you can easily reference an electrical engineering textbook and design a circuit that can buffer enough power and supply sufficient voltage/current to meet your expected max sustained power draw with some very simple and cheap components.

But simple frequency scaling based off of _dynamically detected_ available power. There's no need to slow down a CPU based off the age of the battery so you can "guess" what the max speed you can safely run at without inducing a brownout is (and even less of a reason to do so in discrete steps instead of linearly scaling the performance, except if you're trying to do it discreetly) - all you have to do is monitor available power and scale the CPU clock rate accordingly in realtime. But if your circuit is poorly designed with no forethought as to what you'd do if the maximum rated power of the battery wasn't available, I suppose that's not so easy to retrofit.

</comment></comment></comment></comment><comment><USER6> There is a lot of gymnastics this days, from people like John Gruber and Rene Ritchie to downplay what just happened. Truth is their 'explanations' are disturbing to watch and extremely unhelpful to Apple.

Plain and simple, battery is shaved so much that there is no surplus left (in the name of thinness), nothing to amortize normal battery degradation, so iPhone only works beautifully during initial review and couple of months after that.

I really love Apple and some of my daily living depends on it, but this crap has to stop already. Three years back until now there are many missteps in the name of fad and profit, couple of years more and it won't matter since I won't have any market in that ecosystem.

<comment><USER7> > Plain and simple, battery is shaved so much that there is no surplus left > (in the name of thinness), nothing to amortize normal battery degradation, > so iPhone only works beautifully during initial review and couple of months > after that.

This is the crux of the issue. Apple is trying to "fix" a design flaw with software.

<comment><USER6> If it is only one hiccup I woundn't react half as much but we could see exactly the same 'form over function' flaw with Mac Pro recently. Mac Pro has no cooling margin so it often fries graphic cards as soon as you try using it for (surprise) pro stuff.

I really dislike gimmicks over reliability, and I count race to thinness there too, that can be seen with Apple in last couple of years.

</comment></comment></comment><comment><USER8> When we were doing the Apple Newton, one of my cow-orkers noted that the CPU had a divisor register that let you choose pretty much any clock frequency you could want, down to kilohertz.

His half-serious proposal to guarantee users "a 12 hour battery life" regardless of battery condition was poorly received by the rest of the team . . .

<comment><USER9> Is that different from what a prescaler is?

<comment><USER8> It was a "CPU throttle" register that controlled the ARM's clock, with four or eight bits of divisor from the base 20Mhz clock. It's been a long time and it's hard to remember h/w register layouts from several decades ago :-)

(Yes, we did the whole Newton on a 20Mhz ARM with less than 512K of RAM).

</comment></comment></comment><comment><USER10> So his argument is that the CPU should be throttled from day 1 so that it doesn't have to be throttled after a year of operation at a higher speed? How is that logical?

<comment><USER11> You could provide a smaller throttle to get the same effect over longer periods of time. Leveling the throttle over the average lifespan of the phone would provide a consistent performance experience. That's how I read the argument at least.

<comment><USER10> How does he know the CPU isn't actually throttled already per his suggestion? :)

</comment></comment></comment><comment><USER12> The simplest solution is to just tell the user that they need to replace the battery with a popup.

The fact that they didn't implement it and that doing so might benefit them financially obviously leads people to assume malicious intent.

<comment><USER13> Agreed. They can have a $79 in-warranty battery replacement program but if no one knows about it, it does little good to point to its existence later.

</comment></comment><comment><USER14> >How Apple could have prevented the iPhone-slowdown controversy

Easy, user replaceable battery. (For clarity by "user replaceable" I don't mean by the user paying $79 for Apple to do it; which is a rip off)

IMO if you design a phone (costing the better part of a grand) with a battery unsuitable for a years worth of use it's a design flaw, if the battery is not easily replaceable by the user then the phone is not fit for purpose.

<comment><USER15> I (and many other buyers) don't want a user-replaceable battery. I think they look like crap, they make the phone look like crap, and in my history of owning iPhones since day one, I've never had to replace my iPhones battery. I did have one replaced through a warranty extension thing but that was because I was reselling the phone and wanted to give the buyer a perfectly new battery. Otherwise I would have kept the one inside.

<comment><USER16> Many phone owners these days put their device in a case.

How then can it then "look like crap" if aesthetically it's hidden under a layer of coloured rubber?

<comment><USER14> Not to mention you'd be hard pressed telling if a phone has a user replaceable battery just by looking at it. I should know because that's the first thing I ask because I won't buy a phone without a user replaceable battery.

</comment></comment></comment></comment><comment><USER17> "controversy"

I replacyed my old Samsung S4 Mini because the flash storage got super slow. It is known, you can test it and because android uses sqlite and there are apparently many small iops, the smart phone starts to become slow and lagy.

Who cares? I cared. Had to replace it because i can't / will not re solder flash chips. Who else cared? NO ONE...

My previous smartphone was also too old for warranty and had an issue with the mainboard. Also enough other people had this issue.

I don't mind when there are better lawys like 3 year warranty for specific specs like battry lifetime, broken pixel and iops but this is not a 'controversy'.

</comment><comment><USER18> No one would have blinked if Apple had just built the throttle into Low Power mode and documented the X% cut to clock speed and left stock performance alone.

<comment><USER19> The problem is - when the battery is bad, the phone will shutdown even if the gauge says 60% or so, and that isn't obviously "low power mode". Source: saw it happening on my daugher's iPhone 6, a year or so ago.

To be clear: I'm not apologizing Apple. They have "we'll make decisions for the user" attitude in their DNK, but this was gone too far.

<comment><USER20> I wonder if that's what's happening with my Nexus 6P, which shuts down at 40ish%.

<comment><USER21> No, that's a widespread defect. I called Google Fi to complain about in October, and they decided to replace my out-of-warranty 6P with a Pixel XL (1st gen, but new).

Apparently they had run out of 6Ps and were trying to clear stock of 1st gen Pixels. They probably won't be quite so nice to you, sorry.

<comment><USER20> Yeah, I already called them and they said I could at most talk to Huawei to see if maybe they'll get it repaired :/

</comment></comment></comment></comment></comment><comment><USER22> Why is throttling needed when the phone is connected to AC power?

<comment><USER23> Due to the length of the wire leading to the AC adapter, it probably can't respond quickly enough to the voltage drop. The battery is much closer. A solution would be to use a big enough capacitor on the phone end of the wire, but phones are very space constrained, and since the battery is non-removable, it can be used as sort of a "capacitor" for these instantaneous power demands, so there's no need for the extra cost and space of beefier input capacitors.

<comment><USER5> I know what you're saying and see where you are coming from, but that's not how it would work in reality. Presuming sufficient voltage at the the cable (ie no extreme loss due to internal cabling resistance) the length of the cable should not matter.

The real limiting factor is that a basic USB plug charger puts out only 2A while the iPhone's peak draw at the same 5V can be well north of 2.5A if you're using the GPU to its fullest.

 _However_ it's not just the power cord that's supplying current when you're plugged in - if it were designed correctly there's no reason those 2A couldn't supplement whatever your battery is already putting out and only charge it with what's left over. In fact, that's how iPhones can stay at 90% while plugged in to a car charger, running GPS, playing audio at the loudest, and streaming some data in the background while some android models would _discharge_ even while plugged in... but both would be dead a lot sooner if they weren't plugged in.

The real problem is just shoddy engineering. Hardware isn't much different from software: what all this boils down to is the equivalent of someone writing code that went into production across millions of devices around the world that assumed input x would always be greater than y and didn't bother with any exception handling or bounds checking. And when that voltage/current combination coming in is insufficient.. an unhandled brownout exception occurs.

<comment><USER22> There's also the USB-C adapter which can fast-charge iPhone/iPad quickly via Apple-specific charging protocol, which clearly provides much more power than than the battery does.

<comment><USER24> And if USB-C doesn't provide enough amps for you, there's always jumper cables.

[https://www.engadget.com/2014/07/14/junojumpr-jumpstart- your...](https://www.engadget.com/2014/07/14/junojumpr-jumpstart-your-iphone- and-your-car/)

<comment><USER5> I have to admit I'm a bit disappointed. I was hoping to see a real, full-size car battery.

I actually have three absorbent glass mat batteries hooked up to a Noco Genius battery tender and a 1000W 12V inverter to provide battery backup for my sump pumps (long story). Losslessly converting that to 5V shouldn't be too hard.

</comment></comment></comment></comment></comment></comment><comment><USER25> What if the flaw was earlier in the design? The iPhone has a battery that's 2/3 the size of other phone batteries. Would there even be a problem with a 1000mAh bigger battery?

</comment><comment><USER26> Apple could have just implemented replaceable batteries and all this situation could have been avoided.

Edit: When I mean replaceable, I mean replaceable batteries without the user having to go an Apple store. Like in the old days, taking the cover off and putting the new battery back in.

<comment><USER4> Apple batteries are replaceable. $79 and an hour at the Apple store will do the job. If you want to save money you can get it done at a third-party shop for less than $50.

Where Apple made a mistake was in not communicating to its users that this is something they need to do on an annual basis, so people could budget it in to their cost.

<comment><USER27> The hour at the Apple Store is the deal breaker. My time is too valuable for that.

<comment><USER28> You don't have to spend the hour at the Apple Store.

You drop the phone off, leave, and come back at literally any time more than 1 hour later. Go to your important meeting. Do some shopping. Have that doctor's appointment you've been putting off. Have a nice long lunch. Whatever. You don't actually _lose_ that hour.

I mean, obviously.

<comment><USER29> I love Apple products. Every major computing device I use is made by them. I am lucky to be closer than the vast majority of people to an Apple store and even for me this is a huge pain in the ass. I think it is incredibly unreasonable to just hand wave this away like its no big deal. It absolutely is and to pretend otherwise is naive at best.

</comment></comment></comment></comment></comment><comment><USER5> I don't know if I'm just too old having lived through the old nickel-cadmium "memory effect" days, it everybody I know - techie or not - already knows and accepts that batteries "get old" and then "die faster" and "don't charge right" as the device ages.

Lithium battery tech today is an incredible step forward, but simply acknowledging the still existent limitations of the battery and it's lifespan seems like a much simpler and saner solution than building a house of cards trying to hide that reality.

Battery dying in 2 hours after a full charge? Time to get it replaced. If your device is still under warranty, it's free. Otherwise it's 80 bucks and you're golden. What's the big deal?

Instead we have this nonsense approach to pretend that batteries live forever at such a cost.

And then you have the people that pop up out of the woodworks in each and every single iPhone battery life thread to say "it's not that the battery dies faster, it's that the phone suddenly shuts off at 60% [or whatever]," which is an absolute load of BS. The iPhone 6S was the first device to have that problem (I went to the Apple store within a year of its release with my iPhone 6S and spent over 3 hours explaining to the tech what was going on despite what his fancy charts and on-chip reporting software saw until he relented and gave me a replacement phone well before Apple ever acknowledged the issue and initiated the limited recall) - and it's the equivalent of a bug in the hardware design.

As a battery ages, the "definition" of 100% slides (as the charge cycles go up the charge capacity goes down - although it's not that simple since li-ion batteries also retain some form of the old cadmium cell memory effect that doesn't scale in a directly linear fashion with the charge cycles, but not to an appreciable extent that would have a bearing on this particular matter), but there's no reason that a device should die at 60% of its _remaining_ battery life. Except that the iPhone 6S' hardware was designed in such a way that it demanded current that could only be supplied at a voltage in excess of what the reduced-capacity battery could supply, leading to the problem at hand.

This is just me guessing, but I'm fairly convinced of the truth here: Apple didn't implement CPU scaling to improve the end user experience nor to make money off of "planned obsolescence" but rather to avoid having to replace phones/batteries within and without the warranty period (as a recall was warranted due to the faulty design) and decided to implement a software _workaround_ (and decidedly _not_ a _fix_) to get all but the most susceptible phones to avoid the scenario that would trigger the brownout.

<comment><USER30> There is no such thing as "100%" or "60%" or any other battery meter number. They are all guesstimates based on the battery's history and cycle count.

Li-ion batteries don't have a simple voltage-charge relationship like lead- acid batteries do so you can't actually know the real charge state of the battery (and even those have a number of ways the battery chemistry can get messed up).

I'll also note that your specific battery history matters a lot. If you leave your phone on a hot car dash in the summer even once it will dramatically alter that battery's performance. It isn't as simple as saying it cuts the lifetime... the battery's ability to deliver peak current is affected.

</comment></comment><comment><USER31> The fun part is, everybody easily accepts that battery degrades. But thinks hardware shouldn't.

<comment><USER32> I have a 6 year old battery in my 2011 Macbook Air and it seems to handle the peak load of my quad core i7 just fine.

<comment><USER33> Phones and laptops are different beasts. I'm going to make up some numbers here to simplify, but the idea is the important part.

 _Note: I wrote this whole comment with C inverted the first time. Too little sleep. It is now fixed thanks to user revelation._

First: Battery people like to talk about discharge and charge rates in a unit called "C". If you drain a battery at 1/10C, you will totally use it up in 10 hours. If you drain it at 1/2C you will totally use it up in 2 hours.

Laptop: 5000 milliamp hours at 10 volts for 50 watt hours of energy. This will last for 10 hours of use if you average 5 watts. You will be discharging at 0.1C on average. Your CPU might be a 15 watt CPU, so you can burst to maybe 20 watts total, or 0.4C.

Phone: 1500 milliamp hours at 4 volts for 6 watt hours of energy. This will last for 6 hours of active use, so that is 1 watt. You are discharging at 0.16C on average. Let's guess the CPU can surge to 5 watts. That takes you to 6 watts total use and a discharge rate of 1C.

So that is a 2.5x safety margin that the laptop has for degraded batteries over the phone.

Summary: Phones operate much closer to the current limits of batteries compared to older laptops. Accumulated wear or damage to the battery will affect them sooner.

<comment><USER34> I think you got it backwards, "C" is for capacity (useful since (dis)charge current obviously scales with capacity, ceterus paribus) and a 2C discharge rate is twice the current of a 1C rate.

You also need to be careful in your calculations. Battery discharge rates are given in Amps (or C multiples) not Watts because over a cycle, cell voltage will naturally drop. Discharging at 5 Watts puts more strain on an empty than a full cell since the first requires higher current to compensate for the lower voltage. Amps reflect the "demand" better.

Your summary is still correct though, there is more margin for degradation in a laptop battery and space for decoupling.

<comment><USER33> Yes I did write it all backwards. I'm going to go back and fix the post, so your comment is not going to look insane.

</comment></comment></comment></comment></comment><comment><USER35> The lede of the story and pretty much every one I've read is false.

>For years consumers have complained and theorized that Apple would purposely degrade the performance of older iPhones, pushing them to upgrade faster than they normally would.

>This week the theory of slowing iPhones was validated by external sources and eventually corroborated by Apple.

The conspiracy theory we're talking about is that Apple slows your old iPhone to make you upgrade to new ones and it goes back all the way to the first iPhones. It's false on its face because this fix wasn't added until iOS 10.2.1 [1] and it wasn't what Apple "corroborated" at all. And for the "Apple should have been transparent" crowd, here's what it said in the release notes:

>iOS 10.2.1 includes bug fixes and improves the security of your iPhone or iPad.

>It also improves power management during peak workloads to avoid unexpected shutdowns on iPhone.

>For information on the security content of Apple software updates, please visit this website: [https://support.apple.com/HT201222](https://support.apple.com/HT201222)

There's some extremely bad writing on the internet about this story meant to capitalize on the general controversy. Honestly, Apple should find the most egregious one and sue for defamation, and relish the opportunity to testify under oath if it goes to trial.

[1] [https://support.apple.com/kb/DL1893?locale=en_US](https://support.apple.com/kb/DL1893?locale=en_US)

<comment><USER36> _The lede of the story and pretty much every one I 've read is false._

Meta comment: Why is it that we routinely debunk shoddy journalism here on Hacker News but struggle to see why people call the vanguard of mainstream media "fake news"?

I see articles from all venues get eviscerated here on Hacker News. Can we be honest with ourselves and just say that if they're this bad about complex technology subjects, perhaps they might be equally as bad on complex geopolitical or economic issues?

<comment><USER37> Because we shouldn't think about the media categorically one way or the other, as if it's either all fake or everything in the media is true. The media gets things wrong, and we should correct their mistakes.

However, the political aspects of discrediting entire news outlets or the entire news community because of critical or negative coverage of certain politicians or political parties is an attitude that promotes mistrust in our society and creates an environment where nefarious political actors can successful avoid scrutiny.

</comment></comment></comment><comment><USER38> What happens if you charge your throttled iPhone. Does the performance improve while charging vs running on battery ?

</comment><comment><USER39> Rather than throttle, Apple has done something similar since the A10/A11 processors with their additional low-power cores. Presumably this should reduce the short-term wear on the battery and extend the life of the cells.

</comment><comment><USER40> then they should have charged less for their products. or created a more environmentally friendly design. my guess is that apple's PR team made this article happen

</comment><comment><USER41> Just add a setting. Prefer performance, or prefer battery life.

Is that so hard?

What arguments are there against this _other_ than planned obsolescence? Educate me. Downvotes aren't arguments.

<comment><USER42> Performance isn't lowered to extend battery life, it's lowered because the degradation in old batteries makes it impossible to reliably run the processor at max clock; if you flip a switch to force high clocks despite an old battery, your phone will randomly shut down sometimes.

So they couldn't really run the CPU full speed for years. They sure could have, say, highlighted to users that a battery replacement can make an old phone run better for longer, but of course they'd much rather users replace their phones. Or, as another comment here suggested, they could have left more margin--overspecced the battery so it could run the CPU at higher speeds even once it was somewhat degraded, rather than putting so much of the efficiency gain over iPhone generations into thinness and lightness. Might also help battery life for heavy users.

<comment><USER41> _Performance isn 't lowered to extend battery life, it's lowered because the degradation in old batteries makes it impossible to reliably run the processor at max clock; if you flip a switch to force high clocks despite an old battery, your phone will randomly shut down sometimes._

That may be what they're telling people, but there is absolutely no engineering basis for it. Battery voltages decrease gradually under all normal operating conditions, and switched-mode converters can extract useful energy from them throughout the entire discharge regime.

The main constraint on battery voltage isn't some mysterious "random shutdown" effect, but the health of the battery itself. If you allow the battery voltage to fall too low -- which will, again, happen gradually and not instantaneously -- its service life will be greatly impaired. This is not something that happens without warning. It's a perfectly well understood effect. Once the phone's CPU sees this happening, it will have plenty of time to post a "Shutting down in xx seconds" message to the user, go into emergency low-power mode, or otherwise take action to protect the battery.

<comment><USER42> Even those that skeptical of what Apple did here seem to think there's some real limit on safe power draw involved. If that can be shown false it could probably be a popular blog post here at least.

</comment></comment></comment></comment><comment><AUTHOR> From Apple's statement: "Lithium-ion batteries become less capable of supplying peak current demands when in cold conditions, have a low battery charge, or as they age over time, which can result in the device unexpectedly shutting down to protect its electronic components."

Apple seems to be saying that throttling might occur even if the battery is perfectly fine. This points to a fundamental design flaw across many different models and generations, which is the main conclusion of this article. One could even argue that Apple is using a "cheat device" that produces different performance during benchmarks vs. actual real-world use. Sound familiar? This is exactly what VW did. Is it illegal? We will find out as the lawsuits proceed.</comment>


37signals Launches Haystack for Web Designers and Clients To Find Each Other - <AUTHOR> http://37signals.com/svn/posts/1976-launch-haystack-a-better-way-for-web-designers-to-find-clients-and-for-clients-to-find-web-designers

<comment><USER2> We originally wanted to do this for web developers, but we didn't find it to be very useful without the visual component.

With web design, you can very quickly scroll through a lot of portfolios and find a style you like. That wouldn't work at all with web developers and backend code.

We're going to be launching the index page shortly and it'll become even clearer why this form only works for visual works.

<comment><USER3> I'm not sure you need the visual component for developers - the hard part is getting a sense for what things cost, how long they take, and how people work.

Turns out those things are really hard to get a feeling for in isolation, but in comparisons, people are really good at it. I know I want an iPhone app; I come across <http://www.flingmedia.com/>, and the contact us form gives me his rates. Then you try to see if Brian's rates are valid; the pricing itself gives a marker of credibility. If Brian's rates are in line with what I see elsewhere, and his portfolio seems directionally suggestive enough that he can build what he says he can build, at the very least, I'm going to contact him. The conversation with Brian will tell me, as a client, if he'd be good to work with. Sure, it takes more work - you can't make judgments based so heavily on portfolios - but I really think Haystack would be really helpful to both clients and developers. (So, please, add developers!)

Semi-related, I'll bet you a dollar that people will be looking for local designers before they look at portfolios (rather than starting with portfolios) because you give them that option. For developers, I bet they'd do the same. You'll be able to track that relatively easily.

<comment><USER4> Just curious: why do you think people care about geography more than skill?

<comment><AUTHOR> I don't know about Sachin, but we like working with locals so we can meet them face to face without paying thousands for travel expenses.

<comment><USER5> To keep the logic going (that Dustin may have been implying) - why meet face- to-face and pay thousands for travel expenses?

<comment><USER6> \- People prioritize those who they have met in person: it's why in-person meetings are so important in sales.

\- There's a higher likelihood they share networks, or have the potential to share networks, which provides additional incentive to do a good job.

In short, all the reasons that geography still matters in most businesses.

<comment><AUTHOR> I was just thinking, so we could share a piece of paper to draw on. But those reasons make sense too.

<comment><USER5> You can be separated by distance and still easily use paper to quickly iterate through ideas. 37signals themselves do this - they're geographically distributed yet use Sharpies to think through rough interface ideas:

<http://37signals.com/svn/posts/466-sketching-with-a-sharpie>

[http://37signals.com/svn/posts/1880-the-different-sketch- sty...](http://37signals.com/svn/posts/1880-the-different-sketch-styles-of- the-designers-at-37signals)

All of my freelance clients in the last few years have been startups in the Bay Area (where I live) so I understand all of those reasons and the benefits of proximity. Hell, I wouldn't have moved up here if I hadn't read Hackers And Painters in 2005 - I wanted to be where the action was. But I've been slowly doing less and less on-site work and have gotten to the point where I don't do much more than weekly meetings and not even that with some clients, so I can't help but realize that I could've technically been anywhere in the world for all intents and purposes. And these aren't low-paying entry level portfolio builders either, it's real paying work with the same challenges as always.

So again, are the reasons for working with a local designer more important than overall skill and portfolio?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER3> One piece of feedback: we've found that buyers don't think in ranges; they think in terms of budgets. If my budget is $10,000, I don't just want to see the $3K-$10K range; I'd want to see all the designers under $10K, so that I'd see the under $3K and the $3K-$10K group all at once.

EDIT: Second piece of feedback: you should add a "see other designers like this" on the page. For example, for <http://haystack.com/company/161-right- sizer>, there should be a link to see all other Chicago designers under $3K. (I got to this page by clicking on its card on the front page of the site.)

<comment><USER7> Good ideas/feedback. Thanks for posting.

</comment></comment><comment><USER8> Here's another feature I'd like to see: Availability.

This is the most frustrating thing about any designer I've ever contacted or worked with.. Half the time their plates are so full that you can't get a slot.. I'd like to know that in advance so I have a better idea of wait time..

<comment><USER9> Behance.net has a feature like that:

      Status:

      (x) On Fire
      ( ) Busy
      ( ) Available
      ( ) Bored

</comment></comment><comment><USER10> Cool.

For comparison's sake, this is very similar to another website that's been around for a few years, Carbonmade (<http://carbonmade.com>). Carbonmade is a bit broader than just web design, but it's likewise beautifully designed and it's also a lot cheaper ($12/month for a pro account).

I don't mean to take away anything from this particular announcement or product, but I think it's useful to consider existing products as well in the contexts of discussions like this one.

(FWIW I have no affiliation whatsoever with Carbonmade.)

<comment><USER11> A rising tide raises all ships. I think this announcement is great for Carbonmade.

For example, I heard of online invoicing when I came across Freshbooks. However, I did some research and went with Harvest.

I think people will see Haystack, see the value proposition, do some research, and then Google search and come across Carbonmade.

I think Haystack will be successful. And I think that will make Carbonmade more successful, too. Haystack legitimizes the market.

</comment></comment><comment><USER12> At $99 / month for Pro accounts, I can see 37 signals making a small fortune off of this.

<comment><USER13> They've already reached the 1,000 pre-signups and have at least 20+ pro accounts. They made a (very) small fortune in less than 5 hours.

If they can give designers a decent return and keep clients coming back... wow.

<comment><USER14> It didn't require a super-unique idea that needed to be rushed to market before the window of opportunity closed, either. Just another common idea, executed well. (Ok, so they're not quite there yet.)

<comment><USER15> Not just a well executed idea.

Its another situation like StackOverflow where they can tackle chicken and egg situation others can't because of their exposure.

<comment><USER16> Not just exposure, but exposure to the right two communities: many designers follow them, and many coders. These groups tend not to hang out (like biz and coder guys don't...). If there aren't any other intersections, it's a _unique_ competitive advantage.

Perhaps the trick is also in knowing what you got; and what problems others have got.

hmmm... I do wonder if some kind of specific advertising like this was a thought very early on for them when they started dedicating themselves to blogging, speaking to build an audience, as a financial rationalization of what they wanted to do anyway. :-)

<comment><USER17> Yes, they will get sign-ups because designers and coders know about them. But if I went to ANY of my web design clients from the last 7 years, I would have to say that maybe 1% or less of them EVER heard of 37Signals.

That being said, it looks to me like a bust in the making because if only other designers are looking at your $100 per month "ad", then it's actually working against you.

<comment><USER16> I was thinking that coders need designers; but you're saying that, in fact, clients are neither.

hmm.. I bet that _some_ coders do need designers (e.g. if the coder was hired first), but it's probably a tiny tiny fraction of all clients.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> And the overloading of the name continues...

(see <http://haystacksearch.org/> for example)

</comment><comment><USER19> I must admit I can't help feel a little cynical about this project.

If an unknown company had launched this website I doubt it would have made anyone's radar, let alone have found a willing group of companies to pay $100/month. If it only works because 37 Signals made it and promoted it (as opposed to being an elegant solution to a problem) is it not a little exploitative?

Haystack's simplicity comes from a dearth of functionality and a small number of users -- neither of these are sustainable in the medium-term for the project to remain viable in its market (which, despite 37 Signal's claims, is pretty well serviced).

They risk damaging their brand by creating a feature-light product that doesn't exhibit any capability to grow beyond a small number of portfolios. They could well find an increasingly dissatisfied group of customers demanding features and results for their $100/month. It will be interesting to see how they keep these people happy while continuing to look after their other interests.

<comment><USER20> > If an unknown company had launched this website I doubt it would have made > anyone's radar

I think that's one of the perks of becoming successful ;) The app rides on the fame that comes with Basecamp's success and there's nothing wrong with that!

I agree, though, that US$99 is quite pricey considering that you'll still be a needle in a haystack (albeit a smaller haystack). If I paid that rate, I'd want more tools for my profile of clients to narrow down on me.

<comment><USER14> Assuming your exposure on Haystack brought you business worth substantially more than $99 a month, why ought you be in a position to demand anything at all?

</comment></comment></comment><comment><USER21> Can web programmers get in on this? What do I put for a picture if I mostly do back-end work?

<comment><USER2> It's not designed for people who just do back-end work. If you're a shop that does both front- and back-end work, then you're more than welcome to join though!

</comment></comment><comment><USER22> >What does your work looks like?

And did you proofread it?

</comment><comment><USER23> Will there eventually be a way to separate out folks who just do design (static pages, etc.) vs. folks who've designed actual web apps? Maybe tags or something would help.

</comment><comment><USER24> A better filter than just "Other Cities" would be nice.

<comment><USER2> Agree. We're working on that. Stay tuned.

</comment></comment><comment><USER25> Too bad it doesn't also target web _developers_.

<comment><USER13> Seems like a market opportunity to me. How would a developer best pimp their wares?

Screenshots of sites they programmed wouldn't be as useful as they are for designers. Clients wouldn't understand code snippets...

<comment><USER3> A developer pimps his wares by 1) still having a portfolio of sites they've worked on, 2) being able to have a reasonable conversation, and 3) being competitive on price.

You have no idea how goddamn hard it is to find developers - they're generally terrible at any semblence of marketing. And I say this as someone who spent over $100,000 on a web development firm for my startup before I was able to recruit an internal team. Everyone knows about Pivotal Labs, but after that, it's all-but-impossible to know where to look.

<comment><USER21> Pivotal Labs?

<comment><USER26> Looks like [1] they're a web design firm that's created web sites for twitter, Urban Dictionary, Alexa, and Best Buy.

[1] <http://pivotallabs.com/clients>

</comment></comment></comment></comment></comment><comment><USER27> I'm curious as to how they picked the list of cities. By population?

<comment><USER2> Initially, yes. We picked the top cities by population in the US. We're going to change that shortly, though, so it's based on the number of firms in those cities. That way London or Berlin or Tokyo or whatever can bubble up on the list if there's a large number of firms listing from there.

</comment></comment><comment><USER28> have always wanted to build something like this

<comment><USER29> yeah I even registered aHayStack.com and some other domain names - I don't think it would work as good for anyone with less "web design equity" as 37signals.

<comment><USER28> this would have made for a great yc company.. maybe jobspice can branch out into this niche space a bit</comment></comment></comment>


Paul Graham's Letter to YC Companies - <AUTHOR> Jessica and I had dinner recently with a prominent investor. He seemed sure the bad performance of the Facebook IPO will hurt the funding market for earlier stage startups. But no one knows yet how much. Possibly only a little. Possibly a lot, if it becomes a vicious circle.
What does this mean for you? If it means new startups raise their first money on worse terms than they would have a few months ago, that's not the end of the world, because by historical standards valuations had been high. Airbnb and Dropbox prove you can raise money at a fraction of recent valuations and do just fine. What I do worry about is (a) it may be harder to raise money at all, regardless of price and (b) that companies that previously raised money at high valuations will now face "down rounds," which can be damaging.
What to do?
If you haven't raised money yet, lower your expectations for fundraising. How much should you lower them? We don't know yet how hard it will be to raise money or what will happen to valuations for those who do. Which means it's more important than ever to be flexible about the valuation you expect and the amount you want to raise (which, odd as it may seem, are connected). First talk to investors about whether they want to invest at all, then negotiate price.
If you raised money on a convertible note with a high cap, you may be about to get an illustration of the difference between a valuation cap on a note and an actual valuation. I.e. when you do raise an equity round, the valuation may be below the cap. I don't think this is a problem, except for the possibility that your previous high cap will cause the round to seem to potential investors like a down one. If that's a problem, the solution is not to emphasize that number in conversations with potential investors in an equity round.
If you raised money in an equity round at a high valuation, you may find that if you need money you can only get it at a lower one. Which is bad, because "down rounds" not only dilute you horribly, but make you seem and perhaps even feel like damaged goods.
The best solution is not to need money. The less you need investor money, (a) the more investors like you, in all markets, and (b) the less you're harmed by bad markets.
I often tell startups after raising money that they should act as if it's the last they're ever going to get. In the past that has been a useful heuristic, because doing that is the best way to ensure it's easy to raise more. But if the funding market tanks, it's going to be more than a heuristic.
The startups that really get hosed are going to be the ones that have easy money built into the structure of their company: the ones that raise a lot on easy terms, and are then led thereby to spend a lot, and to pay little attention to profitability. That kind of startup gets destroyed when markets tighten up. So don't be that startup. If you've raised a lot, don't spend it; not merely for the obvious reason that you'll run out faster, but because it will turn you into the wrong sort of company to thrive in bad times.
--pg <comment><USER3> Note incidentally that I'm talking about the performance of the IPO, not the performance of Facebook itself. I think Facebook as a company is in a strong position. The problem is simply that Mr. Market (<http://en.wikipedia.org/wiki/The_Intelligent_Investor>) doesn't think so at the moment.

<comment><USER4> Out of curiosity, why is it that Facebook's IPO would hurt early stage valuations, when all of Facebook's early investors made hundreds of millions or billions of dollars? I could see it getting harder to IPO at a good valuation for a few years, but that shouldn't drive down early stage valuations all that much. Also, to me the most interesting thing to watch (beyond Spain) is these new crowdsourcing laws going into effect January 1st. That has the potential to drive hundreds of millions of dollars into the angel space overnight, sending valuations through the roof or at least keeping them propped up for a while.

<comment><USER5> I suspect it's because investors think that one of the few routes to 'exit' a company and cash out your investment just got closed down, at least in the short term. That increases the risk of investing and therefore lowers the valuation.

<comment><USER6> In the next few months Facebook will create over 1000 new millionaires. Is it to much too assume that many of them will get into inventing, which could actually cause the opposite affect of what you're suggesting where there is even more money available?

<comment><USER7> At the rate FB is falling, there won't be 1000 new millionaires by that time

<comment><USER8> If you do the arithmetic, yes there will. At any rate, you don't need to be a millionaire to do venture investing.

<comment><USER7> At the rate FB is falling, it will be worth less than 12 billion in 3 months.

<comment><USER9> It's these kind of forward projections that cause booms and busts, ie. people assuming that housing prices will increase at a steady/regular rate over time. Just as we saw that this doesn't happen in a steady way, nor will facebook steadily decline over the next 3 months.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> It's very possible that the Facebook IPO came early enough in this bubble to actually prevent a huge disaster. I did not like where things were headed with most startups in the past couple of years. The Facebook IPO was like a fire extinguisher that happened to contain a small fire before it got way too out- of-control.

If your startup has no business model, you better think of one fast. If your startup has no revenue or a lack of it, you better start generating a lot more really soon. If your startup has a solid business model and is cash-flow positive, it's time to start leap-frogging the competition and adjusting the course. This is the time when good companies become great ones.

</comment><comment><USER11> I read this with a heavy heart, especially after working at Facebook before my current startup.

Facebook is an amazing company with some of the best people in Silicon Valley working to make Facebook a once-in-a-generation company.

But if Google debuted at $25b, and grew into a $200b company, how can Facebook grow by a similar multiple starting at a $100b valuation?

In my opinion, opening at $38/share sucked all the oxygen out of the room, in the IPO market, especially the later stage market, and potentially downstream as well.

Instead of debuting at $50b or even $75b, the delta was the price of the collective hope of entrepreneurs and early stage startups everywhere.

Because at the end of the day many investors will ask, "If even Facebook couldn't do it, who can?"

The price of leaving a little money on the table for most retail investors would have been worth the good will and Facebook's reputation. Because Facebook really is a great company that is doing and will continue to do great things, but PG is saying the air is gone, and no one knows if more will come.

Is all this a bad thing? Perhaps more companies should be valued based on revenue in stead of API calls/month etc.

<comment><USER12> It's important to remember that pre-IPO Google was a vastly different company than post-IPO Google. It wasn't just the Eric Schmidt factor, which cannot be ignored, but the way the company seemed to position itself. With billions in the bank they could take more risks, explore new markets, and branch out in somewhat unpredictable ways.

In 2004 Google Maps didn't exist. Android was an independent entity. The Google server farms were still few and far between. It was a search-based advertising company and nothing more. You could argue they're still fundamentally the same, but that's just because they have a rock-solid foundation to expand from.

Facebook in 2020 could be a completely different company and who knows, maybe a $500B one.

<comment><USER13> Maybe, that's a possibility.There is a very good possibility that Facebook will be in the same range as Google or Apple. an if any companies have a chance at $500b in 2020, Facebook are probably in the run. It's just not all that likely.

There is also a possibility that Facebook won't be able to monetize with the same effectiveness as Google. It's also possible that Facebook will have fewer active users in 2020.

Valueing a company purely in terms of its current cashflows and assets without taking into account its potential is wrong. I'm not saying that. Companies have quality and Facebook is absolutely a quality company. This way of thinking about businesses (good companies & bad companies) is rightly ingrained in the way we talk about companies. Talking about them as over/under valued companies seems shortsighted and it is, especially if you are talking about startups. When good startup investors make their most hopeful investments, valuation comes second.

This is also true of bigger companies. Google has quality that Yahoo doesn't. Facebook has quality that Groupon doesn't. Warren Buffet evaluates companies this way - great companies at a fair price.

 _but.._

every rule of thumb has a reductio ad absurdum. "Valuation doesn't matter if the company is a great company" only goes so far. The way Facebook was/is valued takes into account their potential to grow like Google. It takes into account their potential to be the biggest company in the world. It _doesn't_ take into account their potential to fail. The way its priced even defines as failure outcomes that should be defined as success. If Facebook can double its profits every 3 years for the next 10 years they'll probably still be a moderate failure for those who bought at $100b. If they double every 5 years, it'll be a bomb.

</comment></comment></comment><comment><USER14> To those having fun saying "pop", contribute value not onomatopoeia.

The clearest message in PG's letter is simply "The startups that really get hosed are going to be the ones that have easy money ... So don't be that startup."

If you have a viable business then you can either a) proceed without venture capital or b) prove yourselves enough that you'll get the terms you need. Yes, (a) may make you move slower, and (b) means that potentially brilliant ideas that have a bright side just past the edge of horizon are more difficult to get off the ground, but this has always been the case.

One of my mentors always quotes "you don't know the value of your captain until you hit turbulent waters". These are our turbulent waters. For those of you ready for it, this is a time of opportunity.

</comment><comment><USER15> So here is an idea for an email feature/gmail plugin: 'Semantic Scramble' Basically, any sensitive email that you send to a bunch of people is automatically scrambled (retaining original meaning/correct grammar, just a small shuffling of words) so that each person gets a unique email. Easy to find out who leaked it. You could add a similar unique jitter for sensitive photos/images...

<comment><USER16> The canary trap.

<comment><USER17> This is how the music industry does it with material they send out to different parties like reviewers or magazines with tools like Haulix, except they use watermarks that are undetectable to the ear but encoded in the file itself.

Wrt email however, I don't think Paul really minded that it was leaked or just realized it was futile to stop it, perhaps that's why he un-killed it.

</comment></comment></comment><comment><USER16> This happens every couple of years in tech. I've personally witnessed 3 downturns now. One was real and two were arguably the best time to start companies. Raising money might be harder, but generally only for bad companies.

<comment><USER18> Why would they be good times to start companies? Less clutter for investors to sort through and more available talent?

<comment><USER16> Mostly: Less competition for users (e.g. there are 600K iOS apps now - <USER2> many), and easier to hire (main alternative right now is to get funding and start a company).

</comment></comment></comment><comment><USER19> When I saw PG's email, I thought this was a self-fulfilling prophesy, even if it was only seen by YC founders. But now that every has seen it - it will be in Forbes and TechCrunch soon no doubt - it seems almost certain.

If just YC founders see it, then they'll take less money, and get lower valuations, etc, leading the tone of the valley. But if everyone sees it, investors will close their wallets, people will declare the bubble is now popped, and the prophesy will fulfil itself.

<comment><USER20> Only the Social Network bubble is popped -- which is the majority of companies that YCombinator funds. Social network websites that can be built in 3 months and have zero paying customers or any potential profitability really shouldn't have existed in the first place.

<comment><USER19> I'm not sure where you get your information, but it looks like you didn't read pg's email or my comment.

<comment><USER21> catty

<comment><USER19> They're trolling, the best response is calling it out.

<comment><USER21> I was calling the comment above me catty, which it was. I'm not trolling, but trying to convey that sharp sarcasam doesn't really ad much to a conversation. If people want to downvote me instead of the sarcasm, that's cool (I just don't necessarily understand it).

<comment><USER19> Sorry, miscommunication. waveform was the troll, not you (though I dont think adding single word replies ever adds to the conversation on HN).

<comment><USER21> point well made. I could've been more elaborative.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> I am not sure what will cool the investment climate more. The fact that facebook's IPO was a disaster or that PG sent this letter and recommends to be cautious.

<comment><USER23> Facebook IPO disaster, coupled with Yelp and Groupon and the others, is the real death knell. PG's letter merely states the obvious.

The goal of the VC game is to get 10x+ returns. That only happens for early or mid-stage investors if there are investors down the line investing at higher valuations. Those late stage investors depend on the IPO exit. If the late- stage investors lose confidence (which is what appears to have happened), the mid-stage investors lose confidence and thus the entire market contracts.

From the other side, the entire wall street game is crashing. People, for better or for worse, are convinced that the entire equities game is a sham. Volumes (which lead to commissions and revenue for the firms) are down in all of the asset classes, and the bonds have reached near-ponzi yields (swiss bonds actually have negative yield, which means investors are actually paying interest ...), so the "retail investor" who traditionally buy into the IPOs aren't playing a significant role anymore

<comment><USER24> But PG's argument is the Facebook IPO will put off investors investing in __startups__, this is the very definition of early investors, which for facebook has made a few billionaires and many millionaires.

<comment><USER23> You have to work backwards. The penultimate round of investors depend on future investors to buy in at a higher valuation. The third to last group depend on the second to last group. And you can walk this all the way back to the seed stage. If there are few people left at the end to buy up the IPO then the late stage investors dry up and the ripple works its way back to the seed and angel rounds.

</comment></comment></comment></comment><comment><USER25> Facebook waited too long. Part of the psychology on joe public's love of Apple has to do with APPL -- they got to invest in the stock while investing their time (and $) in their products.

Facebook decided to have all that growth in value for insiders only. And it's not like they wanted to be a private company, so the outcome is planned.

By not leaving any money on the table, and having joe public not share and invest in their success, when the government starts to beat down on them, there won't be much public support for FB.

And pg is right: nor will there be much support for those following in their footsteps. Scorched Earth. Those investors did well (and many HN peeps on SecondMarket). So well in fact, it won't happen again. Not for a long while.

<comment><USER26> Mmm, I disagree about psychology of investing stock, time and products together - in Aus, there's a lot of Apple love but little investment in it's stock. Doesn't harm the brand... In the end, investors may like a good stock but customers just like a good product.

</comment></comment><comment><USER27> Bubble 1.0 - Just have a prototype, and money will follow you.

Bubble 2.0 - Ship a product, make sure you have enough users, and money will follow you.

Post this bubble, is it going to be: "Make profits, because that is where your money is"?

I am not implying bubble as a bad thing, fwiw.

edit: grammar

</comment><comment><USER28> Am I the only one thinking that Facebook's IPO was actually a success? The point of the IPO is to sell your company shares at the best possible price and Facebook did it.

Compare to an A/B/C round for a startup. If you know investors are willing to pay $50m for the round, but you settle for $25m, then you just lost $25m and gained nothing.

I think the main reason FB is falling now, is not because the stock was not worth $38, but everyone that expected it to quadruple overnight is now selling.

<comment><USER29> On day 1 it was a success, but now it is a disaster for several reasons.

1\. It is harder to attract people to come work for you when you company's valuation is going down. Obviously FB can afford to pay for talent, but that cost just went up.

2\. If FB ever needed to get more investment money, people may be more reluctant due to this situation.

3\. If your company was getting acquired by FB would you want to be paid in cash or Stock?

</comment></comment><comment><USER30> The FB IPO sends a signal that certain exits are about 35% less lucrative than the most enthusiastic might have thought. And, the IPO wasn't the 'starter pistol' for another frenzy. I think the memory of 12 years ago hasn't faded entirely yet, and there's so much other uncertainty in the economic world no one can be a runaway optimist.

But the IPO results might actually boost certain kinds of deals. For example, would you rather sell your company to FB for $X million of FB stock when that stock is at 45 or when it's at 26? (Of course X is larger when FB is flush, but I doubt X goes down linearly with FB market-cap when there are other bidders. And psychologically, it may be easier to think FB grows 50% back into its peak, than 50% more above its peak.)

If there had been an indiscriminate frenzy, everyone knows that ends in a crash. When everyone's instead been reminded that companies are different -- FB isn't GPRN isn't AAPL isn't LNKD -- and the particulars of value and model matter, that's better for a sustained boom at a more measured pace.

</comment><comment><USER31> This will probably be a self-fulfilling prophecy.

</comment><comment><USER32> "The best solution is not to need money."

This always is a good rule for any kind of business. not only about startups.

Paul, you're trying to explain basics of business processes.

In YC application, Faq there is an item in which you're asking to state is there any programmers in startup team, and explaining that if not, you better should have one. I think you should add one more item, on which YC team should have experienced and successful project manager, businessman who make startup profitable and successful.

</comment><comment><USER33> I am confused why the FB IPO is considered anything other than a failure of bankers to price the stock correctly. Did anyone who actually understands Facebook's business today expect it to maintain a 100B valuation? Did any institutional investors throw money into it hoping it would rise up to 150B? If you invested in Facebook at the 150 P/E or whatever absurd value it was you deserved to get burned and hopefully are not investing in startups.

</comment><comment><USER34> I note that BI is called a "cesspool" in these comments, and that this email has been posted here so that you don't have to send any traffic to us.

Just so everyone is aware, you'd not be reading this email right now if us cesspool-splashers hadn't done the hard work of getting a copy and posting it. Now, by not linking to us, you are essentially punishing us for that work. I suppose you'd prefer a world in which you hadn't read this email.

</comment><comment><USER35> The problems in Europe are a more severe weight on the market (whether generally or for tech stocks specifically). By any rational logic, the Facebook IPO went well:

\- the company raised a lot of money at a good price,

\- the company remains valued at a high multiple (ie, even today valued on the dream not on the numbers), and

\- I can imagine no better antidote for bubble muppets than the performance of the IPO

Bubbles can be fun but they're not healthy. Recent events are far better than a crash. It's just a correction. The emotional hand-wringing will last about as long as it always does, and be forgotten just as it always is.

Events in Europe may turn out much more severe than the minor impact to date. And they may not. But that's a bigger concern than the over-valuation of social companies.

</comment><comment><USER36> "The best solution is to not need money. The less you need investor money, the more investors like you". That's true if you are dropbox, airbnb and other startups that have a solid revenue avenues other than advertising. If twitter or facebook itself had been founded after that disastrous ipo (facebook ipo) they would be in a worse position than dropbox or airbnb in terms of funding and revenue. That said, i think facebook will get to its intended valuation within this year.

<comment><USER37> There is a fundamental problem with the way the web is working now. We're in a kind of limbo. Companies like Dropbox and Airbnb (and the company I mostly work with) actually sell a product and as you say they're good.

I've been having a hard time formulating what I'm about to write so I apologize if it doesn't make a lot of sense. I can't help feeling that the Facebooks and Twitters are using the web in a way that there really isn't a proper infrastructure for. They seem to be quite expensive to maintain and, by nature don't generate lots of money by what they do. In my opinion, if they charged they wouldn't be able to build the big networks of interconnected users that defines their value.

I think there are ways past this conundrum but I don't think that profit motive will be the what pushes them and I think they will require a somewhat different infrastructure than we have now.

</comment></comment><comment><USER38> With the risk of getting downvoted; why this letter was made to public? I think it was meant for YC companies only. FB IPO has nothing to do with early stage investing. It may be a good thing that IPO didn't pop. We've averted a major bubble. But making this letter public made situation even worse. Now all the investors will rethink their investments. Why? Because PG (of all the investors) has said it will be hard to raise money.

And expect Business Insiders, Venture Beats of the world to spread doom and gloom. After all it will attract more eyeballs. RIP good times indeed.

Edit: grammar and minor changes

</comment><comment><USER39> Can someone explain the perception that Facebook's IPO was a disaster? Doesn't the fact that the stock has not risen mean that the offering had the correct price?

<comment><USER40> Opening at 38 and staying in the high 30s/low 40s would be reasonable. Maximum value for FB, Inc., stable price.

Dropping to 26, not so much.

<comment><USER41> Remember that 26 includes the value of $9B of additional cash on the balance sheet from the IPO. So the valuation of Facebook as a business is actually lower still, once you back out the cash.

</comment></comment></comment><comment><USER42> Interesting but Facebook was absurdly valued to begin with. At nearly 100 times earnings, it seems to me that Mr. Market actually responded appropriately for now.

Facebook has already been monetizing using traditional revenue streams (ads) and there doesn't appear to be much left to do there.

They may have another ace up their sleeve, but it's not Wall Streets job to guess that they may.

</comment><comment><USER43> I have been mixed on this, and I think it will have an interesting impact on the IPO markets.

But, one area that I am still waiting to see play out is the intersection of secondary markets and IPOs. People have raised the examples of Groupon, Yelp, and FB (Zynga is another that comes to mind). All social, yet all different. Groupon has had some interesting accounting practices along the way, FB was richly priced by the secondary markets.

I have yet to see any big name, non-social, companies really test the markets, and I mean when they are in a position to do so -- strong product, strong revenues, and strong path moving forward.

Given what is happening in Europe and the world markets in general, there will be an impact on investment.

There have been basically 3 downturns (as I believe cdixon mentioned) in the last 12 years, is this the 4th? Or is this a by product of new avenues like the secondary market?

I have no idea, but it will be interesting to see how it plays out.

<comment><USER44> DWRE? BV?

</comment></comment><comment><USER45> This is not necessarily a bad thing for the new startups, in my opinion. I want to quote PG from his essay: The top idea in your mind (my favorite one btw)

{...} I'd noticed startups got way less done when they started raising money, but it was not till we ourselves raised money that I understood why. The problem is not the actual time it takes to meet with investors. The problem is that once you start raising money, raising money becomes the top idea in your mind. That becomes what you think about when you take a shower in the morning. And that means other questions aren't. {...}

This is actually how it works, and more or less always worked here in Europe. No investments, no money raising, only part of your daily job salary invested in your startup ideas, and endless nights learning, coding, failing in a loop....till you succeed and you start to make money.

</comment><comment><USER46> _because "down rounds" not only dilute you horribly..._

I'm missing something here. What makes "down rounds" so dilutive? I'm assuming we're talking about a larger effect than the obvious "lower valuation = handing over more stock to raise the same amount of cash" effect.

<comment><USER47> The investors in the initial round usually have some sort of anti-dilution provision, so the founders get diluted much more. See this, for example:

[http://www.businessweek.com/smallbiz/content/jan2009/sb20090...](http://www.businessweek.com/smallbiz/content/jan2009/sb20090123_008974.htm)

<comment><USER46> Ah, thanks for explaining. I thought such anti-dilution provisions would have gone out of style a years ago.

</comment></comment></comment><comment><USER48> I think this is a good thing, as startup valuations are already frothy, especially when based on users instead of earnings.

Perhaps this is what's needed to bring the game back to reality so that everyone can prosper.

</comment><comment><USER49> Asserting that the decline in Facebook's stock price post-IPO has generalizable implications for early stage companies is helping the tail to wag the dog.

I agree with Fred Wilson that Facebook's present valuation should be a thrill to its early investors, not a chill <http://www.avc.com/a_vc/2012/06/some- perspective.html>.

It is natural to see personal meaning in well known events. Venus is passing in front of the Sun right now. Seems like a good time to call some investors.

</comment><comment><USER50> _"... But no one knows yet how much. Possibly only a little. Possibly a lot, if it becomes a vicious circle. ..."_

The email is counter-intuitive because being truthful and signalling a possible crunch speeds up the observation. It also gets you trampled as the herd looks at the lead changing directions ~ <http://news.ycombinator.com/item?id=4067278> but it also forces teams to _'adapt'_ quickly.

</comment><comment><USER51> FB is a healthy message. Before the IPO it has been noted that late-stage financings were feeling out of control in terms of valuation. BDC-based funds have sprung up to "invest" in the "pop" but don't really help build companies directly.

Smaller, more focused rounds at lower valuations are probably a good thing. So is using sites like kickstarter to generate funded ramps for new products.

The more capital efficient you can be the better.

</comment><comment><USER52> Late to this thread, but I posted this on May 31:

Facebook: Did they just pop the bubble and screw twitter?

[http://abnerg.tumblr.com/post/24119345098/facebook-did- they-...](http://abnerg.tumblr.com/post/24119345098/facebook-did-they-just- pop-the-bubble-screw-twitter)

Two outstanding questions: 1\. Can we be done with the advertizing business models please? 2\. How much did the Facebook IPO really shift the private equity market?

</comment><comment><USER53> I spend so much time arguing and thinking critically about things that I've made a decision: I'm just not going to question Paul Graham. It's not worth my time, he's right enough where it's probably not dangerous and let's be honest: we all need something solid to lean on. I've realized I've leaned so heavily on his advice up to this point, so I'm just going all in.

</comment><comment><USER54> Isn't it a bit early for someone like pg to be calling this?

Calling it publicly essentially creates the effect, especially from an accelerator lead.

<comment><USER54> Anyways, at least pg's making more founders angry with FB & Zuckerberg. Only good will come of that. ;-)

</comment></comment><comment><USER55> To play Devil's advocate for a moment, Facebook's IPO will also create a bunch of millionaires, some of whom will want to become angel investors. So it might become harder to raise money from VCs but easier to raise it from angels because the rising supply of angels will counteract the tightening market.

</comment><comment><USER56> So FB clusterfuck of an IPO might end up being really good for them because now it will be much easier to hire...

</comment><comment><USER57> Many of the people I know at Facebook are talking about getting into Angel investing or starting their own companies now that they have money. I'm most worried about all that seed money flooding the market, making it even harder for existing companies to find good talent.

</comment><comment><USER58> Isn't it the case that there simply is too much money and at the end of the day, people seem to be desperate to invest it somewhere? I think that is a reason why most stock market crises don't seem to last very long.

</comment><comment><USER59> "The best solution is not to need money". Best advice on this post.

</comment><comment><USER60> As wise as a Warren Buffett letter to shareholders. Thanks, Paul.

</comment><comment><USER61> Or just don't raise money and bootstrap from the ground's up.

</comment><comment><USER62> In argentina there's almost not other way. BTW MG Sielge wrote about the FB IPO and said it was bad for short sight bankers but good for FB, is he wrong?

</comment><comment><USER63> Did you hesitate before sending this out due to the fear that such a letter might itself push the market closer towards a vicious cycle?

</comment><comment><USER64> Thank goodness. Now maybe it just might be a bit easier to find some developer talent now that the easy money faucet has turned off.

</comment><comment><USER65> "The best solution is not to need money."

"The startups that really get hosed are going to be the ones... that pay little attention to profitability."

</comment><comment><USER66> A post like this probably only helps push along the vicious cycle :) Not saying it shouldn't have been posted, but it's ironic.

</comment><comment><USER67> PG's message sounds too alarmist. Facebook has a huge impact on the tech ecosystem, but FB's impact is I reckon overrated.

</comment><comment><USER68> Who is emilepetrone? Did pg really write this?

Also why did this disappear from the front page, and then reappear?

<comment><USER69> If he didn't, then business insider was certainly fooled. [0]

[0]: [http://www.businessinsider.com/facebook-fallout-y- combinator...](http://www.businessinsider.com/facebook-fallout-y-combinators- paul-graham-just-emailed-portfolio-companies-warning-of-bad-times-in-silicon- valley-2012-6)

<comment><USER70> funny how people copy paste stuff

</comment></comment></comment><comment><USER71> I'm sure the Facebook IPO will hit seed/early stage funding less than the SF housing market :)

</comment><comment><USER72> I think only problem is that we again got into 2000-dot-com thinking that "users == money".

</comment><comment><USER73> Founder shares get diluted in a down round, but employee options go completely underwater.

</comment><comment><USER74> how obvious this post. It just tells we're screwed now by the bad facebook ipo and find a business model fast. Now the party is not over but the drinks are getting fewer and the music gets silent. Cheers, Chris.

</comment><comment><USER75> R.I.P. Good Times 2.0

<comment><USER76> R.I.P. Good Time v1.0 ended up marking the trough (not the peak) of the last cycle.

That said, I have more faith in pg's market timing abilities than in Sequoia's.

</comment></comment><comment><USER77> I think this advice is useful in just about all times.

</comment><comment><USER70> word up pg. Let the winter come and lets see who can ski.

</comment><comment><USER78> This seems ethically dubious.

<comment><USER79> I don't agree with the parent comment that I'm replying to, but I think this is a healthy skepticism to have. I don't think it deserves a downvote...

<comment><USER78> I appreciate the reasoned reply. I respect pg immensely, which is why I spend time on this site and why I found the post surprising.

</comment></comment></comment><comment><USER80> Did I hear a bubble just pop?

<comment><USER81> A lot of people seem to think so.

</comment></comment><comment><USER24> I'm sure Peter Thiel wishes he could go back in time and not invest anything in Facebook, he only turned 500k into over a billion, but if the IPO went better he could have made it to 1.5 billion. I agree all those investors that might have invested in startups will be less inclined because of this. Who wants a measly billion when you could have 1.5 billion!!???</comment>


Tor – Our first real donations campaign - <AUTHOR> https://blog.torproject.org/blog/our-first-real-donations-campaign <comment><USER2> People pay taxes to the government, the government pays organizations to attack Tor network, now people donate to Tor. How fun.</comment>


OS X Mavericks adoption pushing past 7% in under 24 hours - <AUTHOR> https://www.gosquared.com/mavericks/

<comment><USER2> That's because it's a free upgrade that improves speed, battery life, adds multi-monitor support, and removes the dumb leather interfaces. This is the first time since Snow Leopard that I felt new OS X was an upgrade; not a downgrade just to continue using Xcode.

<comment><USER3> I honestly don't get the fuss about multi-monitor support. Mavericks doesn't add multi-monitor support, it's always been there. What Mavericks does is fix multi-monitor behavior for fullscreen applications, which I personally would never use on a display larger than 13" anyway, non-fullscreen behavior hardly changed, so I really don't understand the big deal.

<comment><USER4> A lot of people have macbooks and external secondary displays. Just as you said, these people should be able to go fullscreen on their laptop and still utilize the connected display...

<comment><USER3> Yes, of course. I didn't say the feature shouldn't be there, I said that multi-monitor was broken only for fullscreen, so "Mavericks adds multi-monitor support" is a slight overstatement.

But yeah, I see people have strong feelings about this issue, I just _personally_ don't get it.

</comment></comment></comment></comment><comment><USER5> Possibly a big part of this fast adoption is that you can upgrade to Mavericks from previous OSX releases - you can skip over Mountain Lion, etc. So a lot of the people who never paid to upgrade their OS before can now skip directly to Mavericks and get all of the previous OS improvements for 'free'.

<comment><USER6> Although looking at these charts, it seems like right now it's only users who were already on Mountain Lion who are upgrading - the other lines are flat.

<comment><USER5> Going off the 'chart' (which is probably the worst chart I've ever seen), it looks to me like the bottom line has dropped a lot. I think the bottom line probably isn't Mountain Lion?

Are you using some chart where you can actually see which OS is which ?

EDIT: The chart is broken in Firefox - it works fine in Webkit only. Goodbye open web, was nice knowing you.

Anyway, I see you're right. Lion and Snow Leopard are both roughly where they started. So I change my opinion - the 7-8% who have upgraded to Mavericks are likely the people who follow Apple closely and so were already on Mountain Lion to start with. This might signal that the fast upgrade speed may slow down quickly as it implies only the small part of the OSX population who follows Apple news is upgrading so far?

<comment><USER7> Apologies for the lack of support on the chart, SVG rendering is terrible in Firefox.

If you click on the 'Day' view and then 'Show only Mavericks' you can clearly see a rise from 0.20% at 7pm yesterday up to almost 10% at 5pm today. The other lines have had a slight decrease, but yes it does look like Mountain Lion users are upgrading fastest. I'd be surprised if Leopard/Tiger users upgraded quickly as I'm sure they'd be apprehensive of updating their old and potentially fragile kit.

</comment></comment></comment></comment><comment><USER8> That's impressive, but then again Apple is _giving away_ copies, so I'm not too surprised.

It's more interesting considering what this means as an Operating System developer. If they're giving away copies, it shows that Operating Systems are truly commoditized (as well as the huge profits that Apple is raking in!)

<comment><USER9> No all it really shows is that it's a loss leader for Apple.

Much the same way Microsoft made the browser a loss leader because it made money on the OS, Apple is making the OS a loss leader because it's making money on the hardware.

<comment><USER10> I'm not even sure if I'd call it a loss leader, solely based on "making it up" in hardware margins.

I think you could show that by having much larger %'s of its user base being up to date and adopting new releases faster, that it cuts costs in other areas and makes it a more attractive platform. Just spitballing here, but less users on old versions should reduce support costs, create a better user experience for more of its users, and entice developers to take advantage of new features, which may further differentiate the platform from competitors.

I'd have to think that creates more long-term value for the company than making $30 bucks per license. And that's not even calculating the customer goodwill by making the updates free.

</comment></comment></comment><comment><USER11> I think the price definitely helps, but Apple has made it so easy to upgrade OSes and it's paying off.

<comment> k-mcgrady >> "Apple has made it so easy to upgrade OSes"

I think this is the key. Last night it took only a few clicks to download and install Mavericks. I walked away, came back a couple of hours later and it was finished. My stuff was exactly where I left it.

When I used Windows only crazy people upgraded. Most people did a clean install of the OS then spent days reinstalling software and putting files back where they were supposed to be. I would have to wait until I had a few days free to make sure it didn't affect my work.

<comment><USER12> > I walked away, came back a couple of hours later and it was finished.

FWIW, yesterday I installed Mavericks on two Macs. On a Late 2009 Mac mini, the installation process took 40 minutes (upgrade from Mountain Lion). On a Mid 2012 MacBook Air, the installation process took 30 minutes (upgrade from Mountain Lion).

<comment> k-mcgrady I'm using a late 2011 MacBook Pro and it took about 60mins - but then it stuck on 'one minute remaining' for another 45mins. Still, I can't complain that's still pretty impressive imho.

</comment></comment></comment></comment><comment><USER13> Seems like it is mostly taking share from Mountain Lion, which only ever got to 55% or so.

</comment><comment><USER14> I'll take that as a (small) counterweight to the massive amounts of Apple- hate/contempt seen lately on HN.

People upgrade, because free, simple and better. Go figure.

</comment><comment><USER15> Can anyone who's already upgraded comment on whether or not Mavericks has really improved battery life (and what hardware you're using)?

</comment><comment><USER16> Great. Then, when I get around to upgrade (never before 10.9.1), most of the kinks would have already been spotted and most (hopefully) fixed.

<comment><USER17> I upgraded last night and haven't had any kinks. The only thing I had to do was re-set my maven environment variables for some reason (and was prompted to install a Java runtime when I opened IntelliJ, but that was an automatic process).

Other than that...no kinks. It's been a pretty smooth transition...just trying to get used to having menus on both monitors (which is AWESOME)

</comment></comment><comment><USER18> Having really bad issues with mail.app and syncing with 1 out of my 3 gmail inboxes... nothing is showing up at all. Anyone else?

</comment><comment><USER19> Hope you don't want to use the built in VPN option. It's completely broken with Cisco IPSEC.

<comment><USER20> Counterpoint: I use 10.9's integrated VPN with our ASA 5505 in IPSEC (not AnyConnect/SSL) without any issues.

</comment></comment><comment><USER21> can someone tell me how they are getting these data? is it real time?

<comment><USER22> This is aggregate data from the GoSquared analytics network. All figures are up to the minute with historical context to show the trend.

<comment><USER23> In other words, the percentage can go lower or higher as more elements are added to the dataset.

<comment><USER13> It seems way too noisy to me. Like a data point can swing from 4.59% to 2.66% in a minute interval. That's nearly doubling, so how can you interpret either value?

<comment><USER22> The latest data point on its own can fluctuate but it's the overall trend that showcases the growth

<comment><USER13> Yeah, my thinking is that a trendline would be useful.

</comment></comment></comment></comment></comment></comment><comment><USER24> I don't know enough about the Apple ecosystem to have an opinion, but I wonder whether and how much Apple expects to save on support for older versions of the OS, over time.

In addition to being "nice", "free" may have payoffs that at least partially offset supposedly lost revenue from charging for the upgrade.

<comment><USER25> The cost for Apple operating systems is low or free because the cost is built into the premium cost of the hardware along with a license which does not allow you to install OS X on anything but Apple hardware.

It's a win for consumers not being stuck with old software, and a win for Apple having to be much less concerned with their old software.

</comment></comment><comment><USER26> Is there any context to this? I see some commentators here saying "that's great!" Is it? I have no idea.

Considering the Apple marketing machine is going full force, it doesn't seem like a jaw-dropping number. But, again, no context.</comment>


Magic Eye Tube - <AUTHOR> https://en.wikipedia.org/wiki/Magic_eye_tube <comment><USER2> These look way cooler in person than videos and photos show them for online. I've played some guitar amps that had them for indicators (Selmer Zodiac) and they were so damn cool looking and futuristic feeling. I keep hoping they will make a comeback on some amps.

<comment><USER3> They should definitely bring these back for tube amps!

<comment><USER4> Many high end ones have them. I have a few 50s and 60s hifi sets with magic eyes, but most are for tuning. Newer designs use them as a gain or VU meter.

<comment><USER5> My father owned a Phillips AM/FM/SW/LW radio from the 60's that had one for tuning. It was the most magical part of the whole item.

</comment></comment></comment></comment><comment><USER6> My hope was this was somehow related to the "Magic Eye" book series and finally those who'd spent years "Magic Eye"-challenged could experience the joy of hidden 3D objects!

<comment><USER7> Lol, me too. Your comment prompted me to Google for it and found this: [https://www.youtube.com/watch?time_continue=6&v=2AKtp3XHn38&...](https://www.youtube.com/watch?time_continue=6&v=2AKtp3XHn38&feature=emb_title)

</comment></comment><comment><USER3> Wow, I forgot about these. And the smell of warm tube electronics in a wooden housing.

>Magic eye tubes were used as the recording level indicator for tape recorders

Pretty sure that's where I saw them, in old reel-to-reel tape decks.

<comment><USER8> Old radios too [1]. A few years back there was an intense discussion on some antiquarian site about what the function was for a central hole in an otherwise beautiful antique wooden philco radio cabinet. Finally some bright old duffer shows up and allows: "Oh, that's where the 'magic eye' went". Of course, the rest thought he was just pulling their legs about there being a "magic eye" on these things.

[1] [https://mikesradiosandstuff.weebly.com/uploads/1/0/8/7/10875...](https://mikesradiosandstuff.weebly.com/uploads/1/0/8/7/10875761/1351260_orig.jpg)

</comment></comment><comment><USER9> The Korg NuTube would be an interesting basis for a new display device. [https://korgnutube.com/en/](https://korgnutube.com/en/)

While it doesn't have the cool visuals (Feature request for 2.0?) it can actually do tube-y things in your circuit. I imagine a VFD magic eye simulator would be possible and you could actually use it as an active component.

<comment><USER10> Already done, see here:

[http://techlib.com/electronics/roberts_radio.htm](http://techlib.com/electronics/roberts_radio.htm)

</comment></comment><comment><USER11> Surprisingly these can still be bought easily on Ebay, Aliexpress etc. Many seem to be Soviet "new old stock" models (or perhaps actual new items?). This might be explained by the fact that they've been used quite a lot in Soviet military equipment, even long after they were considered obsolete in the west.

</comment><comment><USER12> These have always been magical devices to me. I still use and maintain an old Heathkit capacitor tester that uses one as its indicator.

</comment><comment><USER13> I have a few of this on my vintage vacuum-tube shortwave radios. They're used to indicate how strong the signal is for tuning.

</comment><comment><USER14> These things were standard on vintage Blaupunkt Radiograms, indicating the strength of the signal.

</comment><comment><USER15> One of my favorite tubes, happy to have a working one in my Grundig 4010. Original EM34s can be quite expensive, unfortunately. Luckily the 6E5C is much more common and can usually, with some effort, replace an EM34.

</comment><comment><USER16> Oh, I believe I've seen similar devices on the little boxes next to railways in Canada. Is this the case?

<comment><USER17> From what I have seen, those are some sort of neon glow lamps. Probably used instead of incandescent lamps for much longer life.</comment></comment>


Chicago's MCA transformed into a 60 foot, living comic book - <AUTHOR> http://www.youtube.com/watch?v=2BdVsqwvgso&feature=related

<comment><AUTHOR> Saw the production in late August. The show was an amazing homage to 50's and 60's "They Came From Outer Space"-style scifi. There are a few scenes from the show available here: [http://www.youtube.com/watch?v=b_AMczwJA2g&feature=relat...](http://www.youtube.com/watch?v=b_AMczwJA2g&feature=related)

Amazing that they were able to do this with overhead projectors.</comment>


How I used a Google query to mine passwords from dozens of public Trello boards - <AUTHOR> https://medium.freecodecamp.org/discovering-the-hidden-mine-of-credentials-and-sensitive-information-8e5ccfef2724 <comment><USER2> Here is another (Google) search query that yields a lot of email addresses and passwords:

        site:vk.com/doc "@gmail.com"

As it turns out, vk.com (and other large social networks) are used for discreetly sharing large lists of credentials. These are publicly crawled by Google but do not typically end up on lists of email or password breaches. You can find many credentials this way that are not (for example) in the haveibeenpwned database.

More generally this is why "google dorking" can be a sophisticated reconnaissance method for collecting a variety of data that is _technically public_ but not intentionally so.

<comment><USER3> Just to put this in context and because in my experience many people miss this fact:

vk.com is _huge_.

SimilarWeb ranks it on position eight for worldwide traffic, this is right after Twitter and above Instagram and Wikipedia.

<comment><USER4> Never heard of this site.

About:

"VKontakte (or VK for short) is a social media networking site. Like most social media networks you can add friends, gain followers, and post photos of your food and your cat. VK, like Facebook also gives companies the ability to create their own pages for marketing purposes."

[https://www.echosec.net/what-is-vk-and-why-should-you- care/](https://www.echosec.net/what-is-vk-and-why-should-you-care/)

Still don't understand why so many logins are being publicly exposed there.

<comment><USER5> > _Still don 't understand why so many logins are being publicly exposed > there._

• VK is the most popular website in Russia.

• There are many hackers in Russia.

Connect the points.

</comment></comment></comment></comment><comment><USER6> You can also search for AWS keys and you'll find quite a few. Or for Heroku keys.

It's funny and sad at the same time.

> the access key for amazon s3 is:

        User XXXXXXX
        Access Key ID: XXXXXXXXXXXXXXXXXXX
        Secret Access Key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

> Let me know when you've recorded these and I'll delete the comment.

(blacked out by me)

Or fitgoapp, which has publicly accessible services, with passwords "fitgo" and "fitgoapp" (also visible on trello).

Just go through the entire list of queries at [https://www.exploit- db.com/google-hacking-database/](https://www.exploit-db.com/google-hacking- database/) you'll find so many exposed passwords, it's crazy. No one ever properly protects their keys and passwords.

<comment><USER7> At a previous company, a new employee accidentally commited his aws credentials to a public github repo, which had instance creation capabilities. It got scraped and we had the max amount of instances created at every zone (we assume for mining). I assume you have bots scraping public sites for those creds at all times.

</comment></comment><comment><USER8> I don't know how you'd stop this. If people are so careless with their credentials, is it the responsibility of sites like Trello to protect them?

<comment><USER9> I think Trello should be doing similar scraping, automatically. My work does, granted it is potentially a bit easier in our case. We scan things like GitHub repos and looks for credentials into our system, and, if found, deactivate the credential and reach out to the customer.

<comment><USER5> Slack does this as well with API tokens, I believe. If they find them in a commit, they'll automatically revoke them.

<comment><USER10> i'm guessing your name is timvdalen?

</comment></comment></comment></comment><comment><USER11> This guy seems to have given more regard to impressing his twitter followers than the privacy concerns of these companies.

<comment> martin-adams Which appears to have backfired when his bug bounty was marked as duplicate by the looks of things

</comment></comment><comment><USER12> With the GDPR, this is not just a security vulnerability. Is a law violation as not doing best efforts to protect customer private information.

<comment><USER2> I don't think this is a GDPR violation _or_ a security vulnerability.

The purview of GDPR is personally identifiable information, whereas these are vulnerability details and passwords. If companies were storing their user lists in Trello boards that might be a bit different, but the examples in this blog post do not seem to be related to user data. They are also being volunteered by the companies using Trello, not Trello itself, so a potential violation would probably be levying fees against individual companies.

It also doesn't strike me as a security vulnerability because it's not a technical failure in Trello's software. This is closer to accidentally publishing AWS keys on Github or opening a phishing email, and in neither case would GitHub or (say) Gmail be responsible for that. There are proactive steps they can take to mitigate this kind of mistake (as GitHub and Gmail do), and it's arguable Trello should do the same, but it doesn't seem like a compliance or security failure whatsoever.

<comment><USER13> Although PII is dealt with in GDPR, GDPR doesn't only cover PII, and it makes numerous references to the obligation on anybody who processes personal data (not just PII) with respect to security. For example "Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing."

</comment></comment></comment><comment><USER14> I wonder if there's some secret group of hackers out there notifying these people of their clumsiness, urging them to correct it

<comment><USER15> Who is clumsy here? The guy who set it up and didn't know how people would be using the system? The guy who used it and didn't how it was set up?

If the set up is public, is there enough visual cues to the everyday user that the set up is public?

</comment></comment><comment><USER16> Most responseibly the researcher has informed all the concerned parties..

</comment><comment><USER17> Wow! Makes you think of all the different ways black hat hackers can advise this!

</comment><comment><USER18> While I appreciate the integrity of the researcher, companies that are so careless don't deserve responsible disclosure. They deserve someone anonymously logging in with those credentials and _rm -rf_ 'ing the entire company and user data.</comment>


Top Reasons to Choose iOS Platform for Startups - <AUTHOR> https://www.fortunesoftit.com/top-reasons-choose-ios-platforms-startups/ <comment><USER2> Con: Apple has the final say for your app being released.</comment>


'People just don't carry cash nowadays':how Brits are adapting to cashless world - <AUTHOR> https://www.theguardian.com/business/2018/feb/19/people-dont-carry-cash-uk-firms-adapting <comment><USER2> I keep reading about the "Death of cash" while checking out faster with my wad of bills than the annoyed people with their seldom-working chip and pin. I think "cashless", like "driverless" is a utopian/dystopian dream. There will always be need for an offline and reliable as rock trading system.

Pennies however...</comment>