Very Good Security - <AUTHOR> https://a16z.com/2018/08/28/very-good-security/ <comment><USER3> This doesn't say anything. They invested in a tokenization company. That's not a new or interesting technology. What am I missing?

There are interesting data security companies happening right now. For instance, Matthew Green is doing Zeutro, an ABE company. Think of ABE as Shamir's Secret Sharing on Steroids: you can encrypt data and delegate it out to different people based on boolean expressions. That at least addresses a fundamental problem in data center encryption (the fact that serverside data encryption is "all or none" with respect to applications).

This, though? I assume the announcement means VGS is doing great in the market. Congratulations, I guess?

<comment><USER4> your comment reminds me of the commentary on Drew Houston's announcement of a product called dropbox (you might have heard of it...) here on HN 10 years ago. (1)

"This is nothing new", "I could build this myself", "you have to install something, nobody does that", etc. etc.

The key to a successful company is not being first, not (only) having a great technical solution, and not having tech noone else does.

The key is an umbrella of technology, business sense, marketing ability, salesmanship and much more. Andreeses/Horowwitz probably see a whole umbrella, and not only the tech.

(1) [https://news.ycombinator.com/item?id=8863](https://news.ycombinator.com/item?id=8863)

<comment><USER5> _> "This is nothing new", "I could build this myself", "you have to install something, nobody does that", etc. etc._

Note that he didn't make any of these criticisms. What he _did_ say is that there is little information about what the company's innovation is, and to public appearances what the company is doing is _not_ novel. He then went on compare the company to _another one_ with an impressive team of cryptographers behind it who developed an impressive, novel solution to the problem at hand. Further, he's made this point from a position of domain expertise in the field.

Frankly I don't think raising the spectre of famous "wrong" comments about Dropbox constitutes a meaningful response to his point. He outlined a substantive critique. In order for a criticism to be a middlebrow dismissal it has to be both _middlebrow_ and _dismissive._ What you're responding to isn't, and doesn't fit the template you're invoking.

<comment><USER6> Note that he did make exactly that. "That's not a new or interesting technology" sounds a lot like "this is nothing new" to me - direct quotes.

This may not be the latest and greatest cryptography breakthrough, but if it helps me offload the compliance PITA and not even touch any PII ever, I'll take it - so that my small team can focus on our main business - and no, I'm not aware of any such general service outside of payments use case. If you know specific examples of token proxying SaaS services, let me know! Just like Dropbox, this solves a unique pain point for us and others like us, even though it may not sound sexy to some people.

<comment><USER5> I think the issue here is that the company does one thing and the article is sort of grandstanding about a much larger and worthwhile problem that's fairly different. As another commenter said, VGS seems to be solving sales and distribution with security baked on top. That's useful, but it does not at all solve the core problems outlined in the article.

So he (and I) are not rejecting this company because the technology already exists, but because this is not a company capitalizing on that existing technology. We're pointing out that the company - whatever it _does_ do - <USER2> not meaningfully resolve the problems in the article, not that the problems don't exist. This would be more like someone responding to Drew Houston and saying Dropbox doesn't in fact work as claimed. That's not what's being said here.

I'm pretty sure neither of us are saying there's no problem and to avoid this exact criticism my top level comment specifically explained why it's a usability problem. There _is_ a company to be made based on "not new" technology; this isn't doing that.

</comment></comment></comment></comment></comment><comment><USER7> EnvKey[1] takes a somewhat similar approach to securing credentials/config in that we effectively replace your config with a short token that can be set as an environment variable. This then 'expands' into your full configuration when it's needed.

 _But_ the crucial difference is that instead of storing sensitive data in plaintext ourselves and then sending out access tokens, we manage an OpenPGP PKI/web-of-trust for you behind the scenes so that we're only storing encrypted data, and only the token (which we never see in its entirety) can decrypt it.

End-to-end encryption is _much_ harder to implement for these kinds of use cases than simple tokenization, but there's also the huge benefit of not needing to trust your storage layer.

With credit cards, for example, an approach like this could hypothetically remove PCI-compliance as an issue entirely because no one is actually storing the cc # in the clear. To me this is a lot more interesting than simply shifting the burden of trust. That said, anything is better than our current status quo of spraying secrets all over the place.

1 - [https://www.envkey.com](https://www.envkey.com)

<comment><USER8> Looks cool! I can very much appreciate progress in this space. I haven't been able to find this info by skimming the website: while I understand that the user ultimately holds the keys that can decrypt the secret, how do you prevent this key from becoming the weakest link? Assuming the worst, users could just store their key where they used to store their secrets before EnvKey (like app environment)?

Something I appreciate very much about running in the cloud is being able to use the control plane's APIs to authenticate requesters (e.g. Kubernetes API + Service Accounts or AWS IAM + Instance Roles). Does EnvKey have anything in the way of that?

Regarding PCI compliance: if card data is encrypted, the scope of compliance simply moves over to the keys :-)

<comment><USER7> Thanks! Yeah, the key still needs to be protected--the benefit is that you minimize the number of secrets you need to deal with, but it unfortunately isn't possible to avoid managing _some_ kind of secret entirely. That said, using a token instead of storing the secrets directly also allows for additional access control (say by IP range), quicker/more effective revocation and rotation, and makes it trivial to keep developers and infrastructure in sync (this was always a major problem in my experience with approaches like 12 factor).

We're definitely interested in other authentication approaches that leverage pre-existing cloud credentials/roles, but for now are sticking with the simplicity/universality of an environment variable, since just about every platform supports them, and access is generally coupled to server-level access.

Integrating with Kubernetes in particular is very straightforward--you just set an ENVKEY secret, expose it as an environment variable to your pods, install envkey-source[1] in your containers, and then run a single line `eval $(envkey-source)` to inject your config. Or to make it even simpler, one of our users has figured out an approach that avoids the need to install envkey- source/eval it in your container at all[2].

"Regarding PCI compliance: if card data is encrypted, the scope of compliance simply moves over to the keys :-)"

True enough! This could also be said about e.g. your Stripe secret key, though you're still less screwed by having this exposed than losing the cc numbers directly.

1 - [https://github.com/envkey/envkey- source](https://github.com/envkey/envkey-source)

2 - [https://medium.com/@dmaas/add-envkey-to-a-docker-app-in- kube...](https://medium.com/@dmaas/add-envkey-to-a-docker-app-in-kubernetes- without-rebuilding-the-image-5c7b2775b05b)

<comment><USER8> Thanks for the detailed reply! There is indeed a lot to do with authentication/authorization (and things like audit logging…). I'll look more at EnvKey later to understand the cryptography better.

Stripe/other gateways do abstract most of PCI DSS from you, and will not return card data via API calls, so that somewhat sidesteps the compliance issue.

<comment><USER7> I look forward to hearing your thoughts--feel free to email me directly: dane [at] envkey.com

All the crypto/security details are here btw: [https://security.envkey.com/](https://security.envkey.com/)

</comment></comment></comment></comment></comment><comment><USER9> Anonymous account, because of reasons.

I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all.

Just a quick list of giant red flags-

1\. They are violating visa laws by having their employees in the Ukraine lie on their applications and say they are coming into the US for tourism instead of business.

2\. The Ukrainian developers they get out here are kept on their Ukrainian salary, with a small stipend for housing. So they get to live in the bay area on a eastern european salary.

3\. Their CEO actually bragged to me about how little they were paying the only female developer they had in the office. He thought it was hilarious.

4\. When they made an offer they refused to tell me how many shares had been issued for the company or what percentage the offer included, making their offer completely impossible to decipher. It was also about 15% lower than the numbers they had discussed with me beforehand.

If I was an investor in this company I would demand the removal of the CEO and put their CTO in charge.

<comment><USER10> This sounds weird.

What kind of software engineer in their sane mind would want to stay in the US illegally (I don't think one can get any long-term tourist visa?) _and_ get paid peanuts? Even if they really want to live in the US, being poor sounds like a very strange sacrifice.

Unless one's a junior developer (where I heard it's hard to compete those days), as far as I know there are a lot of realistic options to find a legal immigration venue to a first-world country (probably not to the US, though) - so, why do stupid things like that?

<comment><USER11> I actually went to the US in that exact scenario - tourist visa, six months, paid peanuts. (This was back in 2000.) Until then, it had been a dream of mine to visit the US and that accomplished that dream.

I have fond memories of that time and I would revisit... but I'll wait until things return to how they were back then. (Start at "no TSA" and go from there.)

<comment><USER10> Makes sense, thanks. Yes, no doubt US is a good country and one can wish to live there.

I didn't knew tourist visas can be as long as 6 months - thought they're normally shorter.

Yet, this is still odd to me (just me). As far as I get it, if you're caught, you're banned from visiting the country again, and for a long while. Feels like a bad way to end a dream.

It must be that my subjective perception of the risks involved overweighted the positive aspects.

</comment></comment></comment></comment><comment><USER5> I can see why this is an attractive idea to fund, but in my opinion it's the wrong way to resolve the problems highlighted in the article.

This is not a technical problem, it's a usability problem. We have had the cryptography necessary to technically fix this for a long time. Replace the single human-memorable token (SSN) with a unique public/private key pair. Then you provide safe authentication by signing verification messages with your private key without placing that private key into the hands of a centralized vendor (like Very Good Security).

The obstacle to this solution is 1) buy-in, to either get the government to do this or to bypass it with this solution in private industry, and 2) usability, to abstract as much of the technical signing process away from the user as possible. But this _is_ a better solution. From what I can understand of Very Good Security's website, it's just more of the same. It wants to become the secure gatekeeper of sensitive data instead of developing a novel means of obviating that problem entirely.

The _real_ company to fund is one which takes inspiration from an existing cryptographic protocol - like ApplePay's or AndroidPay's - and expands it to handle identity verification and one-time payment authorization without requiring an SSN or canonical credit card.

<comment><USER12> I think it is an example of great preconditions for starting a company, even though it will be very challenging to make it work well. Basically, our technology is advanced enough to do this, but it so complicated that the percentage of people who can use it, rounding to the nearest, is 0%. I see it as similar to the situation with Dropbox when it was started, where it was possible to accomplish the same thing yourself -- if you have expert level ability in that specific area.

Observing how people get along with cryptocurrency wallet software, key management is a hurdle that many will fail to clear.

<comment><USER5> What you're saying is precisely why I'm saying it's a usability problem, not a technical one. We have the technology, yes. _This_ company is _not_ that technology. The company we should fund is the one that solves the usability problem, not one which moves the goalposts to a different centralized point of failure.

The ideal solution would look like the ApplePay protocol - there is a PKI and cryptographic authentication, but users (and receiving vendors) never need to know what a digital signature even is. I agree with you that trying to get users to handle their own key management is a complete non-starter.

</comment></comment></comment><comment><USER13> H(ssn) just kicks the problem downstream.

      - If H is a simple cryptographic hash function, it's not resistant
        to brute-force attacks to recover the SSN
      - It's not revokable

What we need is something more akin to a Credit Card number. Something like an abstraction layer. It might even be implementable as a UUID.

If you need to revoke it, you can do so since it's not cryptographically tied to anything.

Failing that, a base32-encoded random string (without = padding) with an optional checksum would do the trick.

<comment><USER14> (disclaimer: I work at VGS)

We offer a variety of various format preserving aliasing algorithms. Only legacy systems tend to choose the SSNs if they have fixed-width columns in their RDBMS that are difficult to change (imagine petabytes of data).

The idea behind format preserving aliases is actually based on the NIST SP 800-3G standard[1]. We use FF1 and are actively engaging with the world's leading cryptographers such as: [https://cryptoonline.com/publications/](https://cryptoonline.com/publications/).

Happy to share more in detail if there's interest. Please email me: mahmoud @ ${COMPANY_NAME}.com

[1] [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38G.pdf)

<comment><USER15> Please provide an example of an RDBMS with petabytes of data. Seems unlikely.

<comment><USER16> NASDAQ had a 2 Petabyte Microsoft SQL Server.

[https://customers.microsoft.com/en-us/story/nasdaq-omx- group...](https://customers.microsoft.com/en-us/story/nasdaq-omx-group- reduces-2-pb-of-data-to-500-tb-with-m)

</comment></comment></comment></comment><comment><USER11> I find it interesting that Stefan Brands [1] solved the zero-knowledge authentication problem a couple of decades ago and his tools are still not widely applied. Given my bias against imaginary property, I believe that's because his patents on them are still valid -- and apparently owned by Microsoft at the moment [2].

[1] [https://en.wikipedia.org/wiki/Stefan_Brands](https://en.wikipedia.org/wiki/Stefan_Brands) [2] [http://financialcryptography.com/mt/archives/001011.html](http://financialcryptography.com/mt/archives/001011.html)

<comment><USER17> > Stefan Brands [1] solved the zero-knowledge authentication problem a couple > of decades ago

Reference? If you want people to take you seriously when you claim that someone's solution to a problem has been overlooked you have to provide a link to the (alleged) solution, not just to the author's biography.

<comment><USER18> See also: [https://www.researchgate.net/scientific- contributions/354493...](https://www.researchgate.net/scientific- contributions/35449372_Stefan_Brands)

Although I hadn't heard of Stefan Brands before, I wasn't surprised he'd worked with David Chaum, who is the person I first think of regarding zero- knowledge proofs: [http://sceweb.sce.uhcl.edu/yang/teaching/csci5234WebSecurity...](http://sceweb.sce.uhcl.edu/yang/teaching/csci5234WebSecurityFall2011/Chaum- blind-signatures.PDF)

Then I get depressed because we had anonymous digital cash 20 YEARS AGO and fucked it up.

Software patents are bad, crypto patents are worse. It's (almost) literally patenting math.

</comment></comment></comment><comment><USER19> Doesn't this mean VGS becomes the single point of failure and a larger target for malicious actors?

<comment><USER14> (disclaimer: I work for VGS)

Hi robert204,

Your question has two specific parts that I want to address:

1) Single Point of Failure

2) Larger target for malicious actors

Regarding point #1:

\- We have invested significant amount of resources in making our product as stateless as possible and our core product can live on different cloud providers' edge networks.

\- We conduct failover tests every 2 weeks to ensure we have the capability to respond to any blips in downtime. Our SOC2 Type2 report is available to discuss the availability and disaster recovery items in detail.

\- As a side note: We solve the issue of the "vendor is down" problem -- for example, we have customers who seamlessly switch between providers, say credit score checks, when one of them is down without the liability of storing that data themselves.

Regarding point #2:

\- This is our core focus. We take on the liability. The idea here is if this is the core focus, we can do this better than a lot of folks out there.

\- We also broker access to different Fortune 500 institutions that visit our offices and constantly pen-test us, audit us, etc.

I think it's important to acknowledge that as developers security is always important, but never prioritized until its urgent. We are trying to change that @ VGS.

Please, email me directly and I'm happy to have a further chat: mahmoud @ ${COMPANY_NAME}.com

<comment><USER20> You had me at "cloud providers". If you store the data on some cloud provider, then you are just as bad as what your prospective customers are doing.

I don't want any of my sensitive data stored on "some cloud provider".

Also, your security strategy apparently boils down to "we'll be REAL CAREFUL, pinky swear!"

That strategy does not work, and has never worked before. The whole reason why you think your product is needed is because your prospective customers do it just like that.

I'm stunned you found investors with this proposition.

<comment><USER21> I'm curious, what's wrong with storing this type of data in a cloud provider?

Also, security aside wouldn't a16z have invested because the business isn't "do it more securely", but "outsource PCI compliance entirely"?

<comment><USER22> If by outsourcing PCI compliance entirely, they mean "ensure you don't store cardholder data by tokenizing it and we store the real stuff" this is very much not a new solution, so I'd struggle a bit to see the value of a new entrant.

There's already quite a few payment gateways where an e-commerce site can iFrame the payment page (or similar) to ensure that they never see the real cardholder data.

(the fact that this shouldn't really make them out-of-scope for PCI is a different problem)

<comment><USER6> This is not a payments gateway. We use them for something entirely different than processing payments or credit cards. I haven't seen a general PCI- compliant transparent PII tokenizer proxy service like that. If you know of one, let me know, maybe we'll even switch. But this is not a payment gateway solution, and it's offering many more use cases than an iframe or credit cards.

</comment></comment></comment></comment></comment></comment><comment><USER23> This type of things are better off delivered as an SDK rather than a 3rd party API. Sending sensitive data to VGS for encryption would be a non-starter for many companies.. the probability of data getting stolen is same for VGS or anyone else...

</comment><comment><USER24> Why don't we already have apps on our smartphones for this?

        - $PROVIDER wants the following data: $LIST_OF_OPTIONAL_AND_REQUIRED_ITEMS
        - You select which you can provide
        - If the data to be provided includes "billing identifier" or "credit file identifier" (and especially if the identifier is, say, SSN), then first your app obtains a new identifier from the reporting agency or your insurance carrier, and *that* number is given to $PROVIDER

Gives more control back to the customer/patient and eliminates (yet another) treasure trove of data for attackers to go after.

<comment><USER25> what happens if you do not trust your smartphone? I do not like storing anything of value on mine.

not that it matters but I recently switched to LineageOS and my opinion has not changed.

<comment><USER26> Apple does this with apple pay and the per device identifier is stored in the secure enclave (seperate chip that can create keys and sign data). The identifier can never leave the SE, requires Touch/Face ID to unlock and can be wiped remotely in case you lose your phone.

</comment></comment></comment><comment><USER27> It's mind-boggling to me that this didn't already exist. I wonder if that's because there's a lot of low hanging fruit in security/privacy, low hanging fruit in healthcare, or a combination of the two.

<comment><USER28> It exists, it's called tokenization

[https://en.wikipedia.org/wiki/Tokenization_(data_security)](https://en.wikipedia.org/wiki/Tokenization_\(data_security\))

<comment><USER27> Specifically, I mean for this specific purpose, as a service.

</comment></comment></comment><comment><USER29> Biggest problem with this solution is to trust VGS capability to secure our sensitive data. Which is a hardest thing to do in the first place. All it takes for a disgruntled employee(given company's practices cited in the posts below) siphoning out the data. They are really tiny enough to pay for the damage, making their liability claim render useless. However, given the trivial nature of this problem and interest, I decided to open source a solution which avoids liability concern.

</comment><comment><USER30> If an organization is deciding between interacting with VGS hashes/tokens having to proxy requests or deploying a secret store like HashiCorp vault what are the pros/cons?

> When it's time to bill your insurance company, their "reimbursement" code > goes through VGS which "reveals" the token and sends the real version to the > insurance company.

Forgive me if I am wrong, but that means all 3rd party integrations that require the sensitive values must be implemented by VGS correct?

<comment><USER31> Of course third 3rd party don't need VGS, you will send tokenized data through forward proxy, and at the other end they will receive real data. That is the usability.

</comment></comment><comment><USER32> This old guy appreciates the nod to Pretty Good Privacy, well done on naming.

<comment><USER33> It's a nice reference but seems likely to cause jokes after their first security hole. "Pretty Good" is modest. "Very Good" can be seen as arrogant, unless you are reading it as ironic.

But no worse than "Best Buy" I suppose.

</comment></comment><comment><USER34> I'm not quite sure what this is exactly, but it sounds like they are providing a security "service", so all the "real identifiers" will be stored on their servers?

Why should an entire country trust them? I'm not saying they wouldn't be an improvement over Equifax, but it still sounds far from ideal. I think a hardware token would be preferable.</comment>


Every time an engineer joins Facebook, a startup dies - <AUTHOR>

Next to all the talent acquisitions (Sofa etc), many a great engineer is hired away from a sometimes promising startup by Facebook (Lightbox etc). What are examples where this happened? Your thoughts please! <comment><USER2> Why do we assume that being hired at a startup is inherently better than being hired at Facebook, or any technology company for that matter? People can create just as much value at a large company than at a small one, though there are fewer outliers.

<comment><USER3> People may create more value at a large company but most of the compensation will go to the founders and investors.

<comment><USER4> Most of the compensation goes to the founders and investers in startups as well.

</comment></comment></comment><comment><USER5> >Every time an engineer joins Facebook, a startup dies

eh, I'm not convinced. Sure some will, others go on to have jobs with decent family-supporting salaries, great benefits, and predictable hours. I know a couple of engineers like this who make > $100K in the midwest and they're home for dinner at night by 5:30 every night. It just isn't a dichotomy of startup or poverty and shittiness without contribution to society.

</comment><comment><USER6> I'm sure there are exceptions in the talent acquisitions but most startups just aren't worth keeping and are going to die. Talent acquisition is a way for the story to end without you becoming homeless.</comment>


Going Through Y Combinator (YC S13): Lessons Learned - <AUTHOR> http://blog.zactownsend.com/going-through-y-combinator-s13-nine-lessons-learned

<comment><USER2> _Kirsty Nathoo spends the second half of the day describing the basics of corporate setup. She goes over all of the associated paperwork, the YC investment, the YCVC notes, and advice on what to spend money on. It was a fast, expert primer on corporate law, corporate finance, startup financing, benefits, payroll, and more._

Can anyone recommend a good book on VC finance? It's hard to find anything that goes into much depth on the web.

<comment><USER3> I liked Venture Deals: Be Smarter than your Lawyer and VC.

Amazon affiliate link: [http://www.amazon.com/gp/product/1118443616/ref=as_li_ss_tl?...](http://www.amazon.com/gp/product/1118443616/ref=as_li_ss_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=1118443616&linkCode=as2&tag=sokoloffcom-20)

Amazon non-affiliate link: [http://www.amazon.com/Venture-Deals-Smarter- Lawyer-Capitalis...](http://www.amazon.com/Venture-Deals-Smarter-Lawyer- Capitalist/dp/1118443616)

(Choose whichever you prefer.)

<comment><USER2> Thanks (also thanks to mbesto)!

</comment></comment></comment><comment><USER4> * In order to think through this, Dan and I walked around the same block in Mountain View several hundred times

Don't. If your startup is trying to sell to small businesses, stop asking the business owners on Castro St. They already have more pitches than the VCs on Sand Hill road. They are bombarded with half-baked ideas on how to get more customers, make more money from existing customers, etc.

Long distance calls have been free for a while now: call some other state with no startup culture and pitch to those business owners. They'll be both more receptive and more representative of the overall business population.

<comment><AUTHOR> (I'm the author)

Sorry for my lack of clarity here. We weren't pitching customers in Mountain View, we were just walking around a block a few hundred times -- talking and thinking with each other.

<comment><USER5> pg also seems to like doing office hours while walking in circles around the same block

<comment><AUTHOR> As do other partners. This was a different block though, one that our house was on.

</comment></comment></comment></comment><comment><USER6> I think it might be interesting to see some stats on Prototype Day. Or, at least, what factors contributed to high votes and whether or not those votes had any correlation to the Demo Day and performance of the company beyond YC.

What I'm trying to get at is - YC obviously sees some kind of value in Prototype Day, so what is the value and can others replicate that value in some other way?

<comment><USER7> Prototype Day is a chance to practice your pitch in front of your peers. For most people, it's also the first chance to see what impacts an audience, especially after they've just sat through 20 presentations. (This is helpful both for pitching investors in general, and for demo day specifically.)

You can replicate a lot of the value by getting a group of serious founders together and having them spend a day or half a day pitching to each other, with feedback. If you can get a mentor experienced with the process to give you feedback, even better.

<comment><USER6> That makes sense to me. What did Zachary mean when he wrote, "The partners tell you not to prepare"? I understood that to mean you don't have to have a pitch ready for Prototype Day yet.

</comment></comment></comment><comment><USER8> That was a great article - very insightful. A question though : Is it possible to get into YC without having an actual working product? That is with just a general idea for a product that you want to build?

The impression I got by reading all the stuff in the tech press, is that almost no one will fund just an idea - even seed funding - you do need to have a working product, and traction and customers, etc.

The other question is : Is it possible to get into YC if you are much older than your mid-twenties or early thirties? I know it is theoretically possible - but are there any YC founders in their forties or even fifties?

<comment><USER9> Just having an idea is tough. Having a market for that idea, with some interest is better.

When we did YC, I was 36. I wasn't the oldest, but it was close. There have been founders in their 40's and even 50's (as far as I know - could be even more).

The problem with older founders... your needs are different (financial burdens, children etc) which makes it more difficult to succeed. As a "kid" you are much more likely to live with 6 other people eating ramen and coding 18 hrs a day.

<comment><USER10> > The problem with older founders... your needs are different (financial > burdens, children etc) which makes it more difficult to succeed.

This is an interesting point and one that I've seen multiple people bring up over time on HN. Often as first hand feedback from the person with a family. Financial obligations are more. No doubt. When I started my first company I lived off of a few hundred dollars a month (personally) and put everything else into the company.

And your point about "eating ramen" is too true.

In my experience, founding a company in my 20's, early 30's and doing one again in my late 30's is that finding a big opportunity is equally hard at any age. I don't see that getting any easier. However, what I do differently now is that that I'm infinitely more disciplined. I talk to customers earlier, I spend less time on building a prototype (6 weeks to 12 weeks max), and am willing to kill an idea as soon as I realize that its not going to get me to my goal.

What I'd be interested in seeing are stats on the success of 30+ founders who are on a 2nd/3rd startup vs. 1st time founders who are 30+. My guess is these two groups would diverge widely, but that's just a guess.

Importantly, I find some parts of starting a company much easier at this age.

First, and perhaps most importantly, my wife and I have committed to the startup lifestyle (not a lifestyle business per say, but to pursuing opportunities to grow our net worth). We openly discuss our goals. We have been together through 2 companies, so we know how much of a pain this one will be. We are in agreement that the costs of building a new company are worth the potential to take us to the next level financially. I find this is where many people think that starting a company after marriage is more difficult. However, I have seen that being married can lighten your load as a founder if you and your spouse agree on who will carry what load. One of my friend's had the same conversation with his wife. She's starting a company, and he's pulling a huge load at home. So the same advice works for both men and women.

In terms of distractions, I have way less of them now than when I was younger. Everyone I know is busy with family and kids, so there is little pressure to hang out and waste time.

This is totally personal experience/opinion, but kids have been a boon to my startup work. There's no way to explain it except to say that spending time with my daughters is calming. Stress be damned.

Maybe its just me, but I find the 20 year olds of today exceptionally capable. I am super impressed with how good the younger generations are. They are focused, motivated, capable. I find this beneficial both because I have now have experience, but there is an entire younger generation who are wonderful to speak with, learn from, and work with.

The financial aspects of starting a company now are a world easier. Without diving into detail, its a cake walk now. I don't starve. I know to expect losses on some ideas. I've had enough failures and some successes to know that sometimes ideas and companies fail, and sometimes they succeed.

In summary, your point is well taken. It's definitely different.

<comment><USER11> Interesting problem you are tackling, incidentally we are sort of trying to address a similar problem (simplified web development) at Crudzilla Software (www.crudzilla.com).

I am guessing you guys are in heavy development? because I didn't see how you go from using spreadsheets to using your solution (at least from the code samples). I am guessing people who use spreadsheets to build "apps" aren't typically in a position (skill-wise) to use JavaScript to do anything sophisticated.

<comment><USER10> > I didn't see how you go from using spreadsheets to using your solution (at > least from the code samples)

Sorry about that. The video is for an older MVP. I pushed the product live last week before attending NodeDay, so I really need to update the video.

The specs are actually written using a small JavaScript file which is then serialized to JSON, which is used to generate the JavaScript.

The best way to experience Exponetial.io is via:

npm install -g exponential

Then just create a login on www.exponential.io and you're ready to go.

If you don't have Node installed, then installation instructions for Mac, Windows and Linux can be found at:

[http://exponential.io/docs](http://exponential.io/docs)

Site note: We're definitely early alpha. So Exponential.io as it stands now is for early adopters who are ok with giving feedback to drive product features. Our target is to hit beta by April 30.

<comment><USER11> ok, that makes sense.

</comment></comment></comment></comment></comment></comment><comment><USER12> How much does YC cost to attend (like boarding, food, transportation, social events)? Would those who attends likely come from a well off background?

<comment><USER9> All those things are subjective to where you want to live, what you want to eat and what you want to do.

The events YC provides are free. Depending on where you live your rent will obviously vary (you can pay $5000/month for an SF apt, or you can share a place in Mountain View for $600/month).

Like Zac said... the $$ invested should more than cover your expenses for the 3 months. Of course, that money is for kicking off your company - not fine dining.

<comment><USER13> The guys over at [http://startuphouse.com/](http://startuphouse.com/) have short term stay options in the heart of SF (It's not publically stated, yet, but I think ~$35/night, so $1k/month). Might be a good option for people doing YC for a summer and want to keep things extra lean.

<comment><USER14> It saves a lot of time and stress to stay near YC in the south bay for the duration of the program (mountain view, sunnyvale, palo alto etc). Living in SF means you waste at least 2 hours every trip down to yc (usually 3 times a week or so).

</comment></comment></comment></comment><comment><USER15> "There is only so much you can do on Castro Street."

That is so true. You only have houses and more houses, nothing to do other than work 24/7.

</comment><comment><USER16> Do founders from Europe or other places have to come back? What if company is ramen profitable or profitable?

<comment><USER17> Depends on your visa. I ANAL etc, just spent a bit of time a while ago looking at the visa situation. Basically you will probably get away with a B-1 visa for your three month run very simply (electronic registration online and ~$15). It's a bit questionable as the work your doing could technically get you in hot water though deal signing and seminars are fine.

After those three months you will have to leave, you can come back on the same type of visa (though it is more likely you are breaching it) but you'll likely be asked more serious questions and if a border agent doesn't like you then you could be out of luck and barred from re-entry.

One of the key things to remember is the penalties for getting caught breaking any visa conditions could essentially get you barred from reentry for life.

So after that first three months you'll probably want a visa that line up with the fact that you're now effectively working in the US.

H-1B, which will require your startup to be up and running and look reputable and they are in short supply.

O, which will require you to show your a respected top of your field type person (i.e. articles written about you, speaking engagements).

E-1, your company must be non-us (which isn't ideal for YC) and a substantial volume (and over 50% of the international trade) of trade must occur in the US.

E-2, 50%+ of the business must be owned by investors in your country (you and your co-founders). Possibly your best bet but you'll need a substantial amount of your wealth (cash,IP (which might effect how you work for your company to set up IP transfer which might not be agreeable with other investors)) committed to the business (100K+) in a non-revocable fashion. Also if the business fails your visa is no longer valid. Risky but probably the most achievable in terms of startups (with regards to getting back in the country doing it quickly and with a high degree of certainty).

L-1 this will require you to have an office in your own country as well, you'll effectively transfer yourself between the two offices. Keep in mind that immigration aren't robots and you'll need to show your not just playing a shell game.

If your canadian(mexican too I believe) TN, basically with an offer of employment from a US company you can work there for 3 years. They'll need supporting details and you'd do well to have the company at a point were you can technically get fired to be credible (i.e. board of directors/you don't own 51% of the company).

Edit: Also visas have intent. i.e. Plan to immigrate or not. If you have a visa with no intent to immigrate and you look like you're planning to immigrate then you can be found to have broken your visa conditions and barred reentry/kicked out. So if you grab a work visa that does not have intent to stay then apply for a visa that only has intent to stay your current visa can be invalidated, you may have to wait until your current visa expire before applying for a more appropriate one.

The go to advice is find an imigration lawyer, they'll have a better idea than you or me on how to set this up.

There are also more options that may open up as your business grows but if you're at the point of considering them you are at the point were you'll have the resources and responsibility to get lawyers to do the majority of the leg work finding/explaining your options.

There may be better news on the horizon:

[http://startupvisa.com/](http://startupvisa.com/)

<comment><USER16> This seems like an awful distraction.

</comment></comment></comment><comment><USER18> Awesome post. Thanks Zac!

</comment><comment><USER19> Awesome Zac</comment>


Internet Explorer Now Has Less Than 10% Browser Share on Pluggio - <AUTHOR> http://justinvincent.com/page/1520/internet-explorer-now-has-less-than-10-browser-share-on-pluggio

<comment><USER2> Hmm.. a sample size of one site with 14000 visits

<comment><AUTHOR> Agreed that it doesn't speak for the whole world, but it's interesting no?

<comment><USER3> Not really. All it says is that depending on your niche, you get a different mixture of browsers - and a single sample doesn't even say that well; I would rather see a comparison sites in a lot of different niches to make that point.

</comment></comment></comment><comment><USER4> For what it's worth, in the past 4 months I've got 46% IE visits (out of 5.5M). <http://i.imgur.com/9NqYq.png> If I look since March 2007, then I get 54% IE visits (out of 39M). <http://i.imgur.com/gV4BY.png>

This is for <http://www.quantcast.com/scratch.mit.edu>

</comment><comment><USER5> I would be worried about missing the mainstream user if my numbers were like that but I didn't take time to look at his site.</comment>


Using AI to Gain Context for Scientific Research - <AUTHOR> https://blog.paperspace.com/interview-with-josh-nicholson-scite-ai/ <comment><USER2> > Nicholson: With scite, we're working to introduce Smart Citations. These > citations provide the context for each citation and its meaning. For > example, we want to know whether the citation provides supporting or > contradicting evidence – not just the metrics of how many times it has been > previously cited, viewed, or downloaded. This allows people to look at a > study and quickly determine if it has been supported or contradicted.

> Nicholson: We decided to do this because Wikipedia is often the first and > only stop for many people trying to understand something better. We found > that most cited articles (58%) are uncited or untested by subsequent > studies, while the remainder show wide variability in contradicting or > supporting evidence (2- 40%). This sounds bad, but is actually not too > different from all scientific articles in general. Indeed, scientific > articles on Wikipedia receive more supporting citations than the scientific > literature as a whole.

</comment><comment><USER3> Would you like to do this kind of innovative use on the corpus of scientific articles? Yeah, you can't without specific partnerships, because that corpus is spread between various publishers and locked behind paywalls. (Who have not contributed a dime towards actually doing the research in question.)

So if you're an academic, please stop working with closed-access venues; and if you're a citizen demand the right to access and redistribute the results of publicly-funded research.

<comment><USER4> Meh, just use sci-hub and lib gen, it is a way better user experience anyway.

<comment><USER3> You can't easily download or mirror this dataset because of its copyright status, so they don't solve the problem.</comment></comment></comment>


Show HN: Open Listings is hacking real estate - <AUTHOR> https://www.openlistings.co/

<comment><USER2> How do you plan on gaining national coverage of listings? Between the agents, brokers, aggregators, and MLSs the data supply chain is incredibly fragmented. Securing access to all of this data is an incredibly time intensive process that requires a LOT of relationship building. Unless of course you try to go the 'redfin' route and become a licensed brokerage in every state... but then.. you lose your edge and you're essentially competing with Redfin.

How do you plan on getting all of that listing data?

Otherwise, very cool idea - just trying to figure out how you plan to overcome that.

<comment><USER3> Great questions Austin. We've spent the last 6 months "exploring" the data supply chain and have learned first hand how fragmented and closed the system really is.

National coverage is nearly impossible unless you go through an aggregator like ListHub or Point2, but this doesn't work for real buyers because of delayed, inaccurate and incomplete information. The only reliable way to get listing data in most regions is by opening an office and joining the local MLS.

Our non-answer is that we plan to focus on our clients in California for the time being while we nail the customer experience before thinking about expansion.

<comment><USER2> Very cool - thanks for the answer!

</comment></comment></comment><comment><AUTHOR> Hi HN, we're reimagining real estate for a generation that grew up with e-commerce. We've been working full time for a couple of months now and this is our HN debut.

We'd love to know what you think of this. We're hoping the DIY aspect resonates here as much as it does with us.

<comment><USER4> Are you guys a brokerage? How can I buy a property by sending you an email?

<comment><USER3> We're a registered brokerage. Self-service but with expert support when you need it, you keep the agent commission.

Send us an email if you're interested in becoming one of our first clients and we'll get you setup.

<comment><USER5> What's your business model then?

<comment><USER3> We'll charge a small brokerage fee to start but plan to offer $0 commission closings in the future for clients who utilize partner services. There are other revenue streams we are looking at as well.

</comment></comment></comment></comment></comment><comment><USER6> Sounds like it might be cool, but I'm hesitant to put my email in there in order to just browse around.

<comment><USER3> We hope to remove this requirement very soon :)

</comment></comment><comment><USER7> How do you plan to set yourself apart from the hundreds of other real estate listing startups that have come about in the past 5 years?

<comment><AUTHOR> We don't just list homes, we sell them in our app and let you avoid paying commission to the buyer's agent (up to 3% of the sale price is refunded from your down payment).

</comment></comment><comment><USER8> What exactly does this app do? How does it save me money? Will it be US only or available internationally?

<comment><AUTHOR> We're LA and SF only for the time being. We save you money by refunding most of the buyer agent's commission (usually 3% of the total price). We're able to do this because we're automating a lot of the time consuming things normal agents such as pushing you listings as they come on the market.

<comment><USER8> How do you get the listing information? I assume you wont be connected into every realtor database so where are you pulling data from?

<comment><USER3> We have real-time listing data in LA and SF at the moment as broker members of a local MLS. The only real way to get quality data for a listing product is to connect to every realtor database.

</comment></comment></comment></comment><comment><USER9> looks awesome. I want an invite!</comment>


LinkedIn is ignoring user settings - <AUTHOR> https://petermolnar.net/linkedin-public-settings-ignored/ <comment><USER2> 2 months ago I signed up for a 30 day trial to search for people to hire and then 140 eu/mo if I decide to continue using it.

Of course I forgot to stop it (they were pretty quiet also) and they charged me 1400+ eu for a full year because...why not - no refunds (that's what their page says).

I know, I know...should have read the whole shebang. Lost 1400 euros for something I didn't really use. I was about to pay for a month and discontinue but now I feel robbed. I do websites myself and I write in `bold - caps - red` when I'm about to charge someone for a full year.

Shady tactics.

<comment><USER3> My credit card company offers a way to generate a one-time credit card number so that I can safely _trial_ a service and have the monthly charges stop after one month. If I want to continue the service, I can provide my real static credit card number.

<comment><USER4> That's awesome, but it unfortunately won't help when a company charges for a full year in advance like LinkedIn does.

<comment><USER5> Mine also let's you chose a maximum amount that can be charged to the temporary card number. I usually add 10% or 20% extra to the expected amount so that unexpected taxes or shipping costs don't block the whole transaction.

I really love the feeling of safety that I get from chosing the max amount, being sure that I won't be overcharged.

<comment><USER6> I love the points I get from my current cards, but what card is this actually? This sounds like a really killer card I'd use frequently for these use cases.

<comment><USER5> The service I was writing about is French: [http://www.service- virtualis.com/virtualis/index.htm](http://www.service- virtualis.com/virtualis/index.htm)

So unfortunately if you get points I'm guessing you're from North America and probably won't be able to apply.

I haven't searched but there might be such services available to you in a nearer bank.

<comment><USER7> Thank you for the link (I'm French too), but my bank (BNP) is not on the list :'(

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> LinkedIn is a weird, weird place.

There's always people wanting to add me, but then they mostly don't introduce themselves. Even half of the recruiters who add me don't do an intro. How is that networking?

The articles seem pretty low quality. Sorry to say it, but a lot of them seem to be written as a form of homework, as in "you should write something to be seen". There's rarely any insightful comments on news pieces either.

And then there's Oleg. Doing a parody of him is basically the only form of humour on LinkedIn. Do you agree?

The endorsements system is messed up. My 6th grade teacher endorsed me for "derivatives" and "investment". That's not quite the same as a colleague or a manager, is it? But you won't know unless you check all those links.

The one thing it's good for is as a replacement for a rolodex. No need to have business cards anymore, you have LinkedIn.

<comment><USER9> LinkedIn is going the MySpace way. Total crap "content", endless amount of people that indeed just want "connect" without intro, reason or anything else than bumping their numbers. Weird thing, I found it pretty useful up to 2 years ago. I guess that's when the influencers takeover and bullshit blogging began.

<comment><USER10> God, you should see the number of 20 line posts, each line in a paragraph by itself, about how someone hired someone that others wouldn't. I agree with you about the 2 years/influencers thing.

<comment><USER11> Yeah, I think the platform is more popular among recruiters, which leads these types of posts to become popular with likes/comments/arguments. I am genuinely curious how they get tens of thousands of engagements though. I can't imagine getting in public arguments about this stuff. Maybe it's a form of networking for recruiters? To us outsiders, it's just plain bizarre.

</comment></comment></comment></comment><comment><USER12> As a UX guy I have noticed so many dumb quirks, tiny inconsistencies and flat- out design errors like:

\- URLs not being clickable or selectable in many contexts for no good reason

\- icon positions/sizes being off by a pixel between different pages

\- if you're typing a message in their mobile app, and the text input field loses focus for whatever reason, _everything you typed in so far is erased_ (this was true a few years ago and I essentially "rage-quit" the LinkedIn app after that)

... that I am absolutely convinced that their technology stack is a Frankenstein's monster of different chunks of code and logic, with a similar- enough skin on the outside for all of the parts to fool the managers (both inside and outside LinkedIn) into believing the website works.

(I know, I know: in a way all software projects relying on other libraries are Frankensteins, but you know what I'm talking about here: the parts don't even fit together properly)

These kinds of "ignores its own rules" bits fits perfectly with that.

I really wonder what the internal culture of that company is. I bet there's a lot of turnover, leading to this mess.

<comment><USER13> Another UX guy here. Right after they did their redesign, I had an initial phone screen where the interviewer asked if I had a portfolio. I told them that it was on my Linkedin profile, and the interviewer said that he had looked there first, but couldn't find it. I knew that I had put it on there, so I went to LinkedIn to see if the recruiter had made a mistake..

About 2 minutes later, I figured out what had happened. The redesign had moved the Contact & Personal Info section to the side of the screen, and by default it was collapsed. Originally it was right under your profile picture & job title, but for some reason they decided to move & hide it. Very strange.

<comment><USER14> [deleted]

<comment><USER13> This was actually my first time seeing and using the new UI. I (wrongly) assumed that this person was using the old UI where the links were more prominent.

</comment></comment></comment></comment><comment><USER15> I always think about LinkedIn as a "light scam". LinkedIn always pretended to help businesses and employees but indeed they don't do anything special to match people except for recruiters, which at the end it is enough with a search. To put it straight, it is not a Tinder for business.

I tried many paid services like Ads, Premium, and API. They are subpar. I recruit better via Reddit than via LinkedIn, you can post in a group with hundreds of thousands and it is a ghost town when nobody pay attention. they refuse API access for obvious uses, etc.

<comment><USER16> Let's give the power back to users. Please someone create an open source alternative, where everyone will contribute to do something __good __.

Wait. That was just a dream.

<comment><USER17> [https://news.ycombinator.com/submitted?id=whoishiring](https://news.ycombinator.com/submitted?id=whoishiring)

<comment><USER18> I tried once, I don't think it will replace classic recruiting.

<comment><USER17> Yeah I don't think so either. I actually think it's great we are not floor with a thousand recruitment here (mostly by staffing agencies). However, for this relatively small but active community, this is one of the best things I like about HN.

</comment></comment></comment></comment></comment><comment><USER16> I've hated Linkedin for years, but what's interesting is to understand why. I think it's a mix of \- really, really bad UX resulting in an ugly product \- the level of emptiness of the news feed, full of people talking about respectful bosses and good work condition while quoting Steve Jobs (oh, the irony) \- seeing people becoming apparently more successful than me (if I have to be honest) \- the level of intrusiveness of the platform in general

Despite all that, I've been afraid of missing job opportunities if I left the platform. And I don't know why, because I've only found one job through Linkedin in 10 years.

I wish I had the guts to leave it entirely.

<comment><USER19> What bothers me the most about LinkedIn is how vapid everyone seems to be.

Everone has a job title like 'dynamic individual searching for creative opportunities' when they really mean unemployed. It's like a game where everyone pretends while simultaneously knowing that everyone else is pretending too.

<comment><USER20> > It's like a game where everyone pretends while simultaneously knowing that > everyone else is pretending too.

To be fair, that sounds a lot like job-hunting, in general. The whole process can be filled with rituals meant to obfuscate the fact that you just want a job.

<comment><USER21> Pretty much. When searching around for advice on how to market yourself on LinkedIn, that sort of title, though full of shit, is what is recommended.

I wish I could have an alternate profile or A/B test. I think my current one is detrimental to the job search because I list jobs going back 17 yrs vs my resume which is tailored to my current field. With a second profile, I'd narrow it down. Maybe I should do that anyway.

</comment></comment></comment></comment><comment><USER22> I deleted my LinkedIn profile years ago. The amount of spam I was getting from them was ridiculous (the owner of the pizza joint next door wants to add you, etc.). The final straw was when someone pointed out to me that unless you keep it up to date, it reflects poorly on you. And I had no interest in doing that.

<comment><USER23> I deleted mine too, but recently I wanted to see someone else's page and was not allowed. Not even a detail shown without login.

<comment><USER24> If your referrer is from Google, they actually do allow you to see public detail.

So just override referrer header, and you'll see a lot more.

<comment><AUTHOR> Doesn't work for me either, at least not with cURL.

<comment><USER25> Don't forget that you have to misspell Referer.

<comment><AUTHOR> !!!

I'm having a really bad day with typos and overlooking them. You are correct; it does work with [https://google.com](https://google.com) as referrer. I'm updating the entry.

EDIT aaand it stopped working. It was either a glitch or it will lock you out after a few requests.

<comment><USER26> It definitely locks you out after a few requests. In the past I built a LinkedIn profile scraper, but they are really really good at locking down their data. If you even somewhat appear to be a bot, you're blocked.

<comment><USER27> Can it differentiate between a bot and a human opening up a dozen links in tabs? I suspect the tumblr one can't, it appears to rate limit me for using there archive pages.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> I'd like to see this issue get more attention. However, I did think this was already known — anecdotally, I've not really been able to view _public_ profiles ≈50% of the time without hitting an auth-wall.

What I'd like to know more, is if LinkedIn tracks non-logged-in viewers somehow. I have an inkling there's some kind of cookie-mongering taking place that informs the person's profile that you viewed who you are (if they are able to ascertain that). It's just an inkling, but strong enough to make sure I'm always browsing others' profiles in Incognito.

<comment><USER29> It's definitely a cookie wall of some sort.

On the computer I used to access LinkedIn from, I use two browsers. One for general browsing, and one for "more sensitive content" (eg things with passwords). I used to log into LinkedIn with the second one.

Trying to look at public LinkedIn profiles using the general browser (which has no LinkedIn cookie) never works. Always shows the log-in-wall. Whereas looking at the exact same profile (cut-n-pasting-the-url) using the browser- used-for-secure-content did always work. 100% reproducible.

<comment><USER30> That is so odd. So I use Safari for general browsing. Typically use Chrome in private window but rarely for general browsing (only sometimes). For a while I would always check linkedin profiles from google private window and a google search and it stopped working a few months ago (getting an auth wall). After reading your message, I opened Firefox (which I never use), googled a name, click on the linkedin name, and bang it worked!

<comment><USER29> Weird. Yeah, no idea. Sounds like they have some other exceptions in place too then. :)

On the other hand I don't use Google any more (mostly StartPage or DDG), which is likely why I hadn't noticed the use-Google workaround.

</comment></comment></comment></comment><comment><USER31> The issue at hand is how LinkedIn defines "public". From the public profile settings page the author linked:

> Select what shows via searches on Bing, Google, etc. as well as on public > profile badges and permitted services like Outlook, when the viewers are not > logged-in members or did not bind their LinkedIn account to their account on > such services.

Its not anyone who isn't logged in but rather a subset of unauthenticated users who discover your profile through a specific set of avenues

Clicking on the informational icon next to "public" reinforces what they mean:

>All LinkedIn members as well as others who find you through search engines (e.g. Google, Bing) or other servies.

<comment><USER32> I just tried googling the authors profile and got a login-wall coming from Google though.

<comment><USER33> Are you sure you're not running any browser extensions that might be blocking the Referrer header? On fresh Chrome profile, I didn't get a login-wall from Google, but I did get one coming directly to the URL.

</comment></comment></comment><comment><USER34> Sort of funny LinkedIn story: I was fed up with the recruiters constantly contacting me without any relevance to the work I actually would like to do (if I was looking for a job in the first place, which I am not as my profile states). So I went ahead and changed my job descriptions to things like "The theme for Fresh Prince Of Bel Air plays in the background" and I have now been contacted about my Fresh Prince Of Bel Air skills twice.

<comment><USER35> Those are the "spamcruiters" who just use bots to scrape the pages and automate the whole process.

I don't use it myself but I've heard from others who have, several times, received offers for jobs in _the company they were already working at_.

<comment><USER36> LinkedIn has suggested that I connect with addresses of mail lists.

</comment></comment></comment><comment><USER37> If I remember correctly, Linkedin recently lost a court case where some startup was scraping it's public data for analytics purpose. And pretty sure LinkedIn didn't like that.

Edit: Heres the article about the court case.[Aug 15, 2017] [https://www.reuters.com/article/us-microsoft-linkedin- ruling...](https://www.reuters.com/article/us-microsoft-linkedin-ruling/u-s- judge-says-linkedin-cannot-block-startup-from-public-profile-data- idUSKCN1AU2BV)

<comment><USER18> I still hear a lot of complaints about this, has there been any confirmation that LinkedIn changed anything at all?

</comment></comment><comment><USER38> There seems to be a relationship between 'not logged in' and 'not a LinkedIn user'. I have found sometimes that a profile isn't visible (asks me to log in) because at one time I was logged in. Switching to an incognito window "fixed" it.

That said, I too find that people use LinkedIn in different ways, I try to only link with people whom I know personally, ideally have worked with, and know something about me. I do occasionally get random invites (which I assume is someone trying to reach me) which I will accept and add a calendar entry to remove in 2 weeks. Then if I haven't heard anything from them for 2 weeks I know it was just random 'contacts' spamming or 'people you might want to link with' spamming.

</comment><comment><USER39> Its an issue private companies are owning the social networks which are the real value for most people. Ie you give away private information which are then sold as targeted ads to you.

For example SMTP is an internet standard yet almost none of the new tech is standardized chat, social networks.

<comment><AUTHOR> > none of the new tech is standardized chat

XMPP?

> social networks

This is on it's way (sort of) in form of ActivityStreams, webmentions + h-feed, etc. Making something into a standard unfortunately takes a lot of time but with the GDPR it might even get a push, data portability wise.

</comment></comment><comment><USER17> LinkedIn is a good tool. The recruitment email aspect is definitely quite annoying, but please consider using an alternative email address so you don't get spammed, if that's one of the things you find problematic. It's an easy solution to that (you can also disable notification). I always use separate email addresses to keep my sanity (one for private, one for bank, one for useless stuff, one for mailing list, one for tech, one for school, one for utility bills, and a couple more).

I often use LinkedIn to check out famous people's credentials because I am generally curious about their backgrounds. From time to time I do get a "hello" from really big SV companies, otherwise I would have a hard time to get an initial interview without a LinkedIn profile. I am sure they send like 10,000 requests every month, but it still help speeds the progress with a recruiter directly reaching out to you.

But there was an embarrassing anecdote, something a lot of users had faced before. One day I was on LinkedIn and it asked me whether I want to import contacts, I hit "no thanks", but I think there was another confirmation which I pressed "next" and LinkedIn sent out an invitation to everyone in my email contact list, including many mailing lists. Some mailing lists rejected the email, but some let the email through its filter.

<comment><USER18> I agree. If it was just a resume hosting tool and a graph of who probably knows who then it would be quite valuable. As long as it is... whatever you call that kind of thing, its always going to be something people hate.

</comment></comment><comment><USER40> It's tied to an IP address, you have a limited number of visits per day. At least in my experience has been like that, really annoying...

[https://webapps.stackexchange.com/a/106476](https://webapps.stackexchange.com/a/106476) [https://www.linkedin.com/help/linkedin/answer/69654](https://www.linkedin.com/help/linkedin/answer/69654)

<comment><USER41> I think they've completely disabled public profiles. I never use LinkedIn, and my own profile is now locked down (though pieces of it show up in search engine cache).

</comment></comment><comment><USER42> LinkedIn need to be made an example of. They continue to spam with contact recommendations etc even after I closed my account.

</comment><comment><USER43> Easily the buggiest, spammiest and most dishonest of the social media sites, I hardly find it surprising. Never had any reason to go there other than incessant spam invites, unwanted notifications and the vague promise of potential future value of contacts.

</comment><comment><USER44> LinkedIn seems to be moving heavily towards monetize at all costs. They've always been an Enterprise Company making money off of ads and HR departments. Now they're going more extreme with aggressive credit card policies and more user limits. They risk killing the goose that's laying their golden eggs. Facebook is learning it quicker than they are.

</comment><comment><USER45> Years ago, LinkedIn's early behavior caused me to avoid them. I can't say anything's changed.

I wonder what I'll do if/when I need to engage in a "traditional" job search. There's no way I want to let them into my life, professional nor otherwise.

As for the ongoing "networking" aspect: It reminds me all too much of the "can you do something for me" networking permeating the traditional job search. I've met a minority of really helpful people and generous spirit, in the past, in that context. But, it's individuals you get to know, personally; the proforma data exchanges are mostly just part of the routine and are at best a pre-cursor to those few real connections.

I can't see LinkedIn or its like ever "algorithmizing" that. Though, like I said, I don't have experience with it.

TL;DR: If I'm not a networking cynic, I'm a pragmatist. And with the way LinkedIn has spammed me, because one of my friends once touched their property, however briefly and/or indirectly, I'm not very optimistic their model matched my experience of what actually works and is useful.

And, I don't want their cooties.

</comment><comment><USER46> Aside from the question of whether the request should be denied... The HTTP status "999 Request Denied" is complete nonsense. What is the point of that?

<comment><USER47> Am I weird for being more upset about this than the rest of LinkedIn's shady "public" page treatment?

</comment></comment><comment><USER48> Unfortunately, the german LinkedIn competitor (clone?) xing.com is getting less usable all the time. They try very hard to get you to subscribe and have crippled most of their functions (search etc) in reckless fashion.

<comment><USER49> Xing is almost a scam, demanding asymmetrical methods for signing to a service (such as their paid membership) and canceling that service. For canceling, you need all kinds of manually sent, privacy endangering proofs of identity while subscribing is of course very straightforward.

Furthermore, they are very aggressive at sending any of these fees to collections if you dispute their shady tactics -- I personally know people who've been bitten by this.

It has left such a bad taste in my mouth that I always strongly suggest everyone to abandon them. What they do is technically legal, but definitely should not be. The company can't die soon enough.

</comment></comment><comment><USER50> LinkedIn is super buggy lately (6 months+); it might be one of those recent ones. Maybe they are transferring from their own tech to Azure, causing all kinds of fun happening?

</comment><comment><USER51> You might have bought a wrong product then. You should use PPC job posting that only charges you for clicks and doesn't have any trials or annual subscriptions: [https://www.linkedin.com/help/linkedin/answer/74054/pay- per-...](https://www.linkedin.com/help/linkedin/answer/74054/pay-per-click- pricing-for-posting-a-job-frequently-asked-questions?lang=en)

</comment><comment><USER52> LinkedIn wants users to sign in to see anyone's profile. what is seen is defined by the user. LinkedIn is behind networking data. who sees who, who connects to who and how are the connections and relations impacting.. etc.. so they are not for showing anyone profile for the public. that is the new business model. this news is mistitled, Linkedin is not anonymous anymore.

<comment><USER53> I wish Google would obliterate their search engine ranking for redirecting you to a login screen that does not contain any of the text from the preview

</comment></comment><comment><USER41> Moving forward, I guess I'll have to make sure my web server has all the info my LinkedIn profile contains.

<comment><USER54> most people are likely to know how to get to linked in, but your webserver... not so much.

<comment><USER41> Point taken, though my GitHub page is right under LinkedIn for the common spelling of my name on unbubbled google search. Also, you can figure out the right spelling by skimming the top ten of the other spelling's results (oddly, LinkedIn is the top hit for both spellings).

I mostly just crosslink across reputable, indexable domains and make sure the same keywords show up everywhere that's possible. :-)

But, yeah, nothing seems to think my web server should be in the top ten of any keyword search.

<comment><USER54> > common spelling of my name on unbubbled google search

I think there is a misunderstanding here. Things work the other way around. People do not seek you, linked in takes you to them.

A recruiter more often is looking for people with your skillset, than looking for you specifically.

In other words they are not typing in your name into a search engine, they are typing "aws architect python" etc.

If they were seeking you specifically, they probably already know enough about you and will just get to emailing you directly.

</comment></comment></comment></comment><comment><USER55> That's fair, I'm ignoring LinkedIn. Seriously, I'm ignoring a crapload of messages from that service.

</comment><comment><USER56> yep I noticed this months ago. Very annoying, I set mine to public for a reason...

</comment><comment><USER57> I just ran into this, and it's weird, because it's not consistent. I tried to look up someone's profile, and saw the same paywall page - but accessing it from a different browser profile (or maybe Incognito - I forget) showed the profile to me.

</comment><comment><USER58> Easy solution; don't use LinkedIn.

</comment><comment><USER59> is anyone actually surprised? LinkedIn is even more hostile than Facebook. scum of the earth.

</comment><comment><USER60> LinkedIn is a complete joke, but also somewhat necessary. It's become the new resume. I personally maintain a parody of myself profile (check it out if you want: [https://linkedin.com/in/brndnmtthws](https://linkedin.com/in/brndnmtthws)) but I'm considering deleting my account altogether because LinkedIn seems to only be used as a spam delivery mechanism these days.

<comment><USER61> "LinkedIn seems to only be used as a spam delivery mechanism these days."

I created a dedicated email address for Linkedin. And yes, I do receive a lot of spam on this unique email address. For testing purposes, I regularly update this email address to a new one every 6 months, and spam begins to flow a few days after the address change. So I believe either LinkedIn resells email addresses, makes users emails public and easy to scrap, or regularly gets hacked.

</comment></comment><comment><USER62> _Public_ not _pubic_. SMH

<comment><USER28> No need to be condescending about it ("smh") — people make mistakes...

</comment></comment><comment><USER63> Honestly, anything you want private should not go to LinkedIn.

<comment><USER64> The article's point is the inverse: you cannot get any info public (without login) e even if that's explicitly what you ask for..</comment></comment>


Ask HN: Do you also feel less confident over time? - <AUTHOR> It seems that each year I get less confident about my work. Coworkers tell me everything is fine and the quality of my work is okay but I don't feel like I'm doing my best anymore.<p>Shouldn't I be feeling more confident and not the opposite? I have 18 years of experience in my area and it's only getting worse. <comment><USER2> The curse of being an expert is that experts tend to be more aware of the limits of their knowledge than people of lesser experience. It takes experience to know what it is you don't really know. Thus the old observation that someone new to a field tends to be full of certainty and those who are experienced in the field tend to be full of doubt.

Could that be the source of your increasing lack of confidence? If so, then perhaps you should focus on what should be the source of confidence for you: your ability to effectively problem-solve.</comment>


Gruber: Microsoft's Competition for Windows 7 - <AUTHOR> http://daringfireball.net/2009/10/microsofts_competition_for_windows_7

<comment><USER2> I think it's a fair point to say that apathy is Windows 7's biggest competitor. I would never recommend somebody "upgrade" their home computer to Windows 7, I might recommend they buy a new computer with Windows 7. There is a school of though "if it aint broke don't fix it" which really does dominate.

ps. I do have a home machine - it runs Windows XP. My laptop (newer) does run Vista - I work on a bunch of terminal windows connected to a linux box (which has been up for 600 days).

<comment><USER3> Exactly, and this is also the reason many people are still using IE6. If your computer does the things you want - sends email, browses your favorite websites, lets you write a letter, maybe plays music - then what's the point?

Until recently, Apple's market has indeed been these "straw-man fanboys" - people that will always upgrade to Apple's newest kit, covet their latest OS or shiny thing. But that's not the case any more, and Apple have been selling to the common man, and they're eventually going to get bitten by the same bug as Microsoft - consumer apathy - as their market share rises.

I have a Macbook running Tiger, and a PC running XP. The only OS I regularly upgrade is Ubuntu, and only then because it's (almost) automatic.

<comment><USER4> It's not entirely consumer apathy.

There is a perception among Windows users that you don't "upgrade" Windows. You get a new machine with a new version of Windows, and then you spend a lot of time trying to get all of your files moved over and your programs working again. And then, after all that -- the user interface looks different. Things have moved around. You'll have to spend some time learning how to use your computer again.

Meanwhile, the perception among Apple users is that they can put in a disk, run an installer, and they get to upgrade their old hardware to run the new thing. There might be a few user interface differences, but most of them are subtle. They don't have to learn how to use their computer all over again, and somehow it's better now.

In both cases, the perception isn't quite reality, but that doesn't matter. Those perceptions are both Apple's strength and Microsoft's weakness in the vast majority of their markets.

<comment><USER5> Essentially Mac users get used to the upgrades, which are much more incremental, fairly painless, and much cheaper. Mac OS X also seems to actually get faster (Quartz Extreme, launchd, 64bit+LLVM) with every major release, rather than slower.

</comment></comment></comment></comment><comment><USER6> I find the argument that piracy is bad for Microsoft be so far from the truth. Are you kidding me? They practically owe their market share to the fact that the choice isn't "learn linux" or "pay for windows" it's "learn linux" or "get windows somehow". People would never buy vista for $400, but if their friend "fixes" their computer and all of a sudden it looks different, great!

I learned to program in windows because that's what was there. That's what my games (that I pirated when I was 13) ran on. They are ubiquitous because of piracy. I would love it if they could magically make windows "unpiratable". There is no way they would do it.

</comment><comment><USER7> When Mercedes releases a new E-Class, Honda doesn't start shaking in its boots about declines in Civic sales.

Gruber is right; the markets for Windows and Mac OS are becoming more and more orthogonal.

<comment><USER8> And it's really depressing that this whole stupid Apple v Microsoft thing is still the great epic story being told in (nearly) every press article or news report.

<comment><USER9> And yet, I don't recall the last Apple ad I've seen where they weren't taking a direct swipe at MS.

<comment><USER10> Apple very much realizes that they're after a completely different segment of the market than MS is, but they also realize that many consumers cannot clearly see where one segment starts and the other one ends, because, if all you ever had was a Windows PC, then computers aren't all that different to you.

With their ads, Apple is trying to inform those consumers that there _is_ an alternative.

</comment></comment></comment></comment><comment><USER11> Having tested some clean installs of Windows 7, it really is a very smooth process (much improved over XP) -- at least for the somewhat technical user. I have not tested upgrading from XP to Windows 7, but it's probably not a good idea.

Regarding the learning curve, most users will probably view Windows 7 as just an enhanced version of their old XP system. The taskbar and menus are still there and as long as they can find the big 'E' and "W" buttons in the taskbar they are fine.

I don't think Windows 7 will have much of an impact on Mac sales either way. Most users that were tired of XP probably switched to a Mac (if they were able to choose).

</comment><comment><USER12> I'm sure Windows 7 will do fine. Microsoft has a captive market for the most part. Eventually these XP machines will need to be replaced and it's very unlikely a large number of those people who have been happy with a ~10 year old OS will suddenly become interested in the virtues of OSX or Linux. Linux on netbooks was a threat to Microsoft briefly but it was never capitalized on. Most of the Linux distributions shipped on netbooks are really subpar. Hopefully ChromeOS, Moblin, and Android can change that. HP's Linux UI is quite nice also. The big question is how hard they'll push this when Microsoft is offering Windows 7 for netbooks so cheaply to OEMs.

</comment><comment><USER13> I think the article is a little short sighted. While He definitely presents a possible scenario, I don't think it will be that simple.

I've been running Windows 7 64-bit on my home machine for quite some time (legally, first RC, then RTM) and it really is a rather nice OS. It's very polished among other improvements I wont go into now.

I think what the article underestimates is peoples willingness to try what they consider good.

Think, twitter. Another blogging site, really? The Sopranos. Yet another mafia show?

People will use what they or their friends consider good. I think Windows 7 will be fine, if for no other reason that as mentioned above, those XP machines will need to be replaced eventually.

<comment><USER14> I think the fact that you are not representative of most Windows users is Gruber's whole thesis, and you haven't really addressed it with this comment.

I'm doing tech support for people on my block running machines from 2002-2003. They don't need _anything_ that Win7 offers; they use their computers to get on the web and edit Word documents and that's it.

<comment><USER9> By that reasoning they haven't needed any of the new technology to come out since Win98. I don't see why that's a mark against Win7.

<comment><USER14> Who said it was? Gruber's post isn't about whether Win7 is any good.

<comment><USER15> Right... the reason XP has hung on so strongly is that it was finally a Microsoft OS that did what most people wanted without crashing or locking up all the time. When you have a stable OS that meets your needs, why change (especially if you are a business and you need to justify expenses with a bit more of a rationale than "ooh, that's pretty, I want it"

</comment></comment></comment></comment></comment><comment><USER16> Another argument to be made here is that Apple can argue that if you are going to have to "learn" a new OS anyway, why not "learn" OS X? I am very skeptical that the release of Windows 7 (as good as it might be) will slow the market gains Apple has seen.

<comment><USER17> The gap between XP and OS X is properly larger than the gap between XP and Windows 7.

I have seen how developers are treated on the IPhone, are Mac developers treated any better?

<comment><USER18> You're talking two entirely separate ballparks. On the Mac, Apple has no ability to block products from release. Furthermore, the environment of OS X seems to be a positive reenforcement for developers, because I've seen more beautiful software here than I see anywhere else. Hell, I can't think off the top of my head if I've ever seen an elegant minimalist interface on another operating system. Closest I can think of is the Ribbon system on Microsoft Office, which they unfortunately ruined in the transition to OS X.

</comment></comment></comment><comment><USER19> Computers aren't getting faster as quick as they used to (certainly not to Moore's Law) so the Microsoft strategy that always assumed faster hardware, is a flop. Which means a properly optimised OS can sell more, ultimately (eg, no endless layers of graphical libraries just to draw a textbox in a GUI).

</comment><comment><USER20> To me, the flag that tells me that Windows 7 is getting a lot of traction is when I see applications that only run on Windows 7. When developers are willing to use the new features and sacrifice XP sales, then things are going well.

</comment><comment><USER21> I think he is correct in his apathy theory, but if Facebook and YouTube told these XP/IE users that they no longer could use their sites until they'd upgraded, millions would get off their lazy butts and upgrade from XP and or IE.

</comment><comment><USER22> the article seems to reference a format and reinstall. I'm quite sure an upgrade path exists for windows 7, why would they bother with the xp virtualisation for older programs with no way to upgrade and keep those programs.

<comment><USER23> You can do an in-place upgrade from _some_ versions of Vista to _some_ versions of 7. See this official Microsoft chart for details:

<http://www.macalope.com/files/windows-upgrade-chart.png>

Note that 'Custom Install' means a clean install.</comment></comment>


AMD Ryzen CPUs Getting New Microcode with over 100 Improvements Next Month - <AUTHOR> https://www.tomshardware.com/news/amd-ryzen-cpus-new-microcode-bios-agesa-1004,40549.html <comment><USER2> 100 changes to their binary blobs.</comment>


Our SaaS Startup Just Reached Ramen Profitability - <AUTHOR> https://www.veed.io/blog/journey-to-ramen-profitability-saas#t <comment><USER2> Nice article :)

To me this highlights the importance of a dependable business partner. It's pretty impressive that you both persevered through the storm.

I'm running a business on my own atm. Despite lower expenses and no possibility for conflict, it sucks not having someone to share the ups and downs with.

</comment><comment><USER3> That's amazing!! Some tips for struggling startups like us?

website-> www.parceltracker.com

</comment><comment><USER4> Congrats for reaching this milestone and your transparency.

<comment><USER5> Really appreciate it, thank you!</comment></comment>