My Startup has 30 Days to Live - <AUTHOR> http://mystartuphas30daystolive.tumblr.com <comment><USER2> I'm going to say this knowing that I may get down voted to heck. And I don't mean it as a "told you so" to the OP, but rather hopefully some cautionary advice for would-be founders.

I have come to the opinion that if you are bootstrapping, you have no business calling your company a startup. You are building a small business. And there is nothing shameful about this. You are among solid companions with your local plumbers, restaurants, and barbers. You make a good living building a sustainable business that is growing steadily but slowly, to serve a small group of loyal customers.

But you are not a startup.

Startups are about growth. About chasing metrics like 5% week over week. About going from 100 customers to 100,000 in a month. That is the reason you take VC money. It's not "I have this idea for a business, but I need some money to quit my job while I work on it". It's "I have an idea for a business that could be huge but I need to build it up _fast_ ".

So when I see someone bemoaning the advice they were given by their investors, telling them they should be meeting all these crazy metrics, I can't help but ask, what did you expect? The VC isn't in the business of slow, organic growth of your company. They are in the business of generating a return for their fund within a relatively short timeframe. The advice you get is their best effort to try and help you find "explosive" growth.

Before you sign your bootstrapped business on for investment money, ask yourself: is this business, and more importantly am I, really suited for massive, short term growth?

<comment><USER3> Ah, the "hacker/cracker" debate equivalent for software entrepreneurship, complete with the person who says other people have "no business" calling themselves something if they don't meet their specific definition of that something.

Bolted, of course, to the top of any thread that mentions "bootstrapping" or "VC".

<comment><USER2> This is more about an internalized understanding of the type of business you are building for the founders than it is about external perceptions. That can be difficult for some, particularly with the prestige we in this community attribute to the word "startup". But understanding the needs of your business and how you want to grow it are key. If you're thinking of your business as a startup, that massive growth is the only way forward, you'll make decisions like taking VC money. If you think of it as a profitable small business, with measured and planned growth, you can recognize that VC money may not be the answer for you.

<comment><USER3> I think we understand that you believe businesses that don't aim for shoot- the-moon growth shouldn't call themselves "startups".

The problem is, not everybody agrees with you. I've done both kinds of companies and don't think growth trajectory is the defining feature of a "startup". I'm also not particularly interested in debating the point, since it has very little to do with the story we're commenting on. (I also understand your rebuttal to that point, that the problem this person had was not understanding the distinction you're making, but I also disagree with that argument and find it a little mean-spirited.)

<comment><USER2> My only point is to offer hopefully helpful advice to the legions of folks who come to HN wanting to learn how to start their own business for the first time. Many unintentionally assume they need to operate like a startup to their own peril, when in fact they could have had a successful business if not for chasing that label. Certainly no intention of being "mean-spirited". The fact that it might come off that way likely speaks as much to the aforementioned prestige which we place on the term "startup" as anything.

I think creating a business can be one of the most rewarding things a person can do, and I want as many people to find success in that as possible.

<comment><USER4> All funded startups are startups, but not all startups are funded.

It is possible to create a business with a very ambitious growth trajectory regardless of whether you have taken VC or angel funding or whether you are bootstrapping. It's just a lot easier to do this if you've taken funding.

In the valley, most plausible ambitious growth trajectory businesses are VC- funded of course; this is not necessarily true elsewhere. As someone who has lived in the valley for many years and before starting a startup outside of the valley, it's easy to understand why: not all funding climates are created equal.

The thing is, your comments come off as extremely dismissive: the implication is that anything not-funded is a "small business", which is the equivalent of a pat on the head and "nice lemonade stand, son" (or, Italian restaurant, if you're DHH).

Finally: say a startup has a high growth trajectory and closes a Series A round. Was it a startup before it closed the round? I'd argue the investors thought so...

<comment><USER3> I think he actually means to communicate the opposite --- he's dismissing "startups" as he defines them, and chiding the author of the post for pursuing that model.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> So, it sucks, but it happens, and it won't matter _nearly_ as much in June 2014 as it seems to right now.

Your co-founder will, hopefully, not find out about this through guessing "Is this my company?" on Twitter, but rather in hearing it from you. You may be heartbroken about it, you may cry a bit (totally OK). Then, you will put on your Responsible Adult pants, call your employee into the office, and tell them the situation. You will emphasize that it is in no way their fault. You will tell them the status of your future payments to them (you can make them -- good), and instruct them that they have no job now other than lining up their next gig, and that you are totally at their disposal for making that happen. _First among all things you take care of your employees_ \-- they have the worst risk situation of anyone involved.

You will then tell your investors that you're failing and will be proceeding to wind up the business in an orderly fashion. They probably already know this. None of the ones who you care about will hold it against you -- "this is the nature of the business we have chosen." Some of them may likely attempt to invest in your endeavors in the future, if you decide to go down that route.

You will then draw up and execute on a plan to wind down the business in an orderly fashion. Give your customers a window on their apps going dark, if appropriate. Turn off new signups now. Turn off ability to take money now, unless it is absolutely required to continue paying your employees. There likely a small mountain of very boring administrative work here -- your lawyer and accountant can help you through it.

After this is over, you'll probably be very stressed. That is fine and natural. You're in the hottest market ever in terms of hiring right now. If you want a job immediately, you will have many offers for it. "Built a company with real revenues from nothing. Got into an accelerator. Took funding. It didn't work." is enough of a resume to get you an interview at any number of places. If you need introductions, you are probably well-networked enough to get them, but if for some reason you want more drop me an email. Your designer co-founder will have, similarly, no shortage of offers.

Like tptacek says below, this will not meaningfully hurt your chances of creating a business later. You've likely learned plenty through the experience.

It sucks. It will be better, very soon. You don't have to be scared: this is routine and, while it doesn't feel like it, you're actually in very good position, both absolutely and relative to many other people.

<comment><USER6> Ask yourself: who did you compete with to hire that developer? Are they still short of somebody?

The one time so far in the history of Shadowcat I've had to cut people for no reason other than lack of money, I talked to managers I knew at other companies who might have an interest in the sort of talent that I was about to force onto the market.

Two people finished working for me on a friday and started a new job on the following monday. The reduction in stress and guilt and hence increase in my capacity to focus that resulted from knowing that was the outcome for them repaid the time spent finding them new gigs within a handful of days. Maintaining a positive relationship with those people afterwards - and the attitude of people who saw how I'd handled it - was effectively just gravy.

Or: Handling this sort of situation with honour tends to help turn it into a positive sum game.

<comment><USER7> I have a similar guilt when we're hiring and I wind up with several great candidates. sometimes I have 2 or 3 people and I wish I could hire them all. I feel like it's a waste if I can't at least create something out of the situation. Especially considering it's hard to find good people and I have friends who are often looking for staff. A few times I've contacted the candidates and asked if they would allow me to put them in touch with another company. I think I've managed to hook up a few people with jobs.

<comment><USER8> Good to know that we still have some good people in the world who care about one another.

</comment></comment></comment></comment><comment><USER3> Your startup is going to die, you're going to get a new job (which you'll have no trouble doing), and sometime in the future you'll start another company. Maybe you'll do the next one smarter, since you'll have more experience.

Signed,

Been there.

<comment><USER9> It is very hard to say "This too shall pass" during your darkest days, but tptacek is correct on this one. You'll also know who your true friends are once you get out on the other side.

<comment><USER10> _You 'll also know who your true friends are once you get out on the other side._

Spot on.

</comment></comment></comment><comment><USER11> I recognize a lot of this from startups I've been involved in.

At the height of the bubble I co-founded a vanity e-mail business. We wanted it to be a paid service. Our only competitor was a paid service. But when we looked around, we saw ludicrous valuations per user for users that provided little to no revenue. And the VC's saw it too. And everyone were seduced into going for a free service and figure out monetization later. So that's what we did.

Of course the bubble burst, and the lofty valuations disappeared, and we had to hunker down. The business survived, but we fired 45 or so people - the vast majority of the team, and the VC's lost most of their investment.

I have two big takeaways from that experience: Be conscious whether or not you want to gamble. A gamble can be worth it, but you may be much happier building a company that'll stand a reasonable chance of giving you steady returns and pay you a salary than taking a long shot at millions. We started out wanting that reasonable chance, but got seduced into the long shot without really thinking about it.

Secondly: Keep in mind the VC's often have a vastly different risk preference than you. A founder is usually investing all his/her time in a single business, often for years. A VC spreads their investment over a wide range of companies, and spreads risk accordingly. For them, it's not such a big deal if a few of their portfolio companies fail, if they get the occasional massive return, so it may make sense for them to be willing to take risks with your business that are not in _your_ interest.

It's vitally important to think through how much risk you're ok with _before_ going out and getting investment, and to look for money accordingly, as well as consider how much control you're willing to give up depending on how aligned you think your interests are with the profile of any investors you bring in.

Failures makes valuable lessons (and I've had more lessons...).

</comment><comment><USER12> "This week, I need to speak to the other founder and fire our first employee before he leaves on a planned vacation. He's a good developer, but I won't fucking make payroll next week if I don't clear him and his severance out of the company."

Is it wrong that I feel worse for this employee than for the author? He's looking forward to a (probably well-earned) vacation, and he's about to be forced into a job hunt instead.

<comment><AUTHOR> You should. I feel fucking shitty about this.

<comment><USER13> Can't you wait till he gets back so he can have a good vacation?...Although I've seen the whole "got fired upon returning from vacation" thing happen a few times. That sucks too! Sorry for both of you.

<comment><USER14> Apparently you missed the part about not meeting payroll. There are few things worse( legally, in employment law )than missing payroll.

<comment><USER15> Ugh. I remember what it was like the first time the 2000-era dotcom I was at missed payroll. A co-worker and I had taken the day off to take our kids to the state fair, and found our money wasn't where we thought it would be. They announced the payroll shortfall the day it happened, in company email we didn't read because we were off that day.

Kinda sucked.

</comment></comment></comment></comment></comment><comment><USER16> > _I'm scared._

Congratulations: You're normal. Look at it this way: You are commanding on a battlefield, there are a helluva lot of guys about to die. If you freeze up, they all die.

So make some fucking decisions, save as many as you can. Throw some into the line of fire for the sake of the others. It's what battlefield commanders do. The gods have chosen you for this role, rise up and do your best. You will make some bad calls, and don't sweat it. Focus on making the right calls, then course correcting the bad ones.

Good luck.

<comment><USER17> I think commanding on the Battlefield is the wrong metaphor, we use it a lot but its not a battle, its a sport. When you tell your developer you can't afford to pay him any more it isn't that he (or she) "dies" its that they move on to their next job. Is it painful? Of course. But it isn't death.

Sports analogies work better since there is always next season with some of the same and some different players. You decide to go for the touchdown for the win instead of the field goal to tie on 4th down. Its a choice, it works or it doesn't, you go on to the Superbowl or your don't. The decisions tomorrow will be affected by today but you will still have decisions to make.

Start-ups (and I think this is one, and I think pizza stores are start-ups too) are sprouts of a business. Sometimes they grow into bushes, sometimes trees, sometimes they can't develop enough to stay alive and they die after a while. But a start-up "dying" isn't people dying. Its people going on to do something else. For non-founders their work day may proceed pretty much unchanged other than office environment and neighbors in a new job somewhere else. As for founders? Well it demands reflection and inspection to glean the maximum amount of understanding about what worked and what didn't. Sadly its the only way to learn some of those lessons.

<comment><USER16> > _Is it painful? Of course. But it isn 't death._

No, but firing somebody who is the head of household and has major medical issues at home, is a helluva lot more serious than 4th down.

<comment><USER17> Absolutely it's serious. But if we're talking laying someone off because you can't make payroll, that is quite different than dismissing them for cause. Generally the latter is what I think of as 'firing'.

There are scenarios one can construct that are quite painful, the person you convinced to move out of their home town away from an ok job and family to work for you who, due to the high cost of living, had a really long commute and got into a vehicle accident their first week, because they had been putting in 80 hour weeks to come up to speed quickly, that put them into the hospital but they they hadn't worked long enough to qualify for California Disability Insurance. Can we make it any worse? Perhaps their girlfriend found out she was expecting that week and so that was why this poor guy was rushing home? And your startup goes out of business because the lead investor pulled out just before the round closes, so now they don't have a job.

I'm sure we could pile more on.

My point is that the common case, the general case, is that people have multiple jobs throughout their lives. Sometimes it is wonderful, sometimes it sucks, but when they are 60 looking back at their 20's it will be part of a much larger tapestry of experience. If for the majority of people it isn't the end of their world.

</comment></comment></comment></comment><comment><USER18> It sounds like you waited a little too long before trying to arrange a soft landing, so now you're probably going to have a hard landing.

In this situation, I would tell your investors immediately that their investment is going to zero if you can't manage to sell the company for the value of the team - and that in order to even _try_ to sell the company for the value of the team you're going to need a bridge loan, because otherwise the team is going to evaporate.

If you can get a month's worth of bridge, get all your investors to start looking for a home for the team and concentrate solely on that. If you can't, tell the employees to start job hunting and use the small amount of money you've got left to wind things down gracefully and sanely. Winding things down on your own without the help of a lawyer is a pain in the ass, and lawyers cost money.

</comment><comment><USER19> If you can't make payroll, stop staring at the ceiling in your bedroom and feeling so alone, while you plan how to fire your expensive first hire.

Hold a company meeting, put the accounts up on the wall, explain that you have almost no money left and the company is about to go broke. Be willing to consider ideas, but don't string people along so you can postpone pulling the plug on them. It's possible that your employees (individually or collectively) will come up with solutions that you can't; your lack of transparency about the firm's health may be part of your problem.

<comment><USER20> That. Since you have pretty much accepted that you failed as the "leader" of your crew, why pretend you are one now?

Have a meeting with the guys that do work for your company/product first, LISTEN to them, and then take it from there.

</comment></comment><comment><USER21> What I see of this, is similar to my experience in be part of the "startup"-machine business. I won a award in my country (for my business idea), and participate in several contest where I land in the finalist.

What tremendous waste of time.

Triying to chase the "investor money" was the most damaging thing I do. I waste months on that. Building investor plans, do meetings, and work on CANVAS and other methodologies where some company, that get the real $$$ to "create startups", guided each of us to the path of silicon valley..yes, rigthhh....

At the end, I understand that we was part of a masterplan, where the money was on the big players sucking from the gov funds on build startups, with pre- pakaked advice and zero of the real value that we need.

I think that YCombinator is the only that truly make sense, and the rest copy- cats are more a waste of time than not (even with good intentions).

</comment><comment><USER22> Thanks for sharing. I sympathize with you, because I just recently went through something similar, with less success than you've had. It sounds like a tough situation, but you're not out of options. You might just be out of the preferred options.

It seems to me that if you're truly out of money, you can either:

1) Try to double down on funding. Your investors can either re-up you or kiss the money they've put in and the debt/equity they have goodbye. But this just puts you on the treadmill for another X months. If you don't like how that feels now, maybe it's not the best direction. 2) Try to get acquired by someone who will pay you to finish your product. 3) Get outside work to pay the bills and put your startup into side project status. Surely with what you've built, you have made yourself highly employable, and if you're in a big-time accelerator, you probably know people who need your skills. 4) Make a "personal pivot", and use the skills and experience you've developed to springboard into something else.

I've come to learn that the discourse in the startup world is completely slanted toward success stories, even though success is far from the most common outcome. Almost no one gets it right the first time.

For example, from my own limping startup, I've learned a lot about what I did that didn't set myself up for success, and how I would do it differently. I got a day job--which I'm loving so far--and I'm planning to save a substantial portion of my pay to build a warchest over the next few years, such that next time, I won't dive in already broke (just one of several crucial things I would do differently).

</comment><comment><USER23> Interesting. I feel like the time most previously successful startups begin to fail is when the founders are intellectually dishonest and push forward through cognitive dissonance. You have to see and believe in a vision to make it come to life. That is my big takeaway from this - if you disagree with your VCs or don't think something will work, you _have_ to say so.

This may be a shot in the dark, but if it were me I would call up the VCs and begin having the hard conversations. "Hey, we're in trouble. I think we made mistakes here, here and here. I'm in over my head, what do we do now?"

They may ask for what's left of the money back, your business may fail, but at least you go out having been straight-forward with yourself. And you can get on the horse and do it again.

Just my two cents.

</comment><comment><USER24> > "The day we set foot into the doors of the accelerator, we had a business > that DHH would be proud of"

DHH is well known for being against investors in general. Why would he be proud ?

My point of view on this : investors are OK while the funder(s) have more than 51% share, and therefore still making the decisions. You kind of sell your thing to satan here brother, you shouldn't have. You are not in charge of what you put so much work building, from scratch. People with money come here and change your view on the business, on your values ?

Also, I feel you don't talk enough to your co-funder(s). You should not have secrets, work-wise of course.

A bit of advice, if I may : at my startup (in which I'm associate, not funder), we make a scrum retrospective meeting every now and then (2-3 weeks). In these meetings every member of the team explains : 1/ what we should do more 2/ what we should do less 3/ what we should do the same (SAME !) 4/ what they have found frustrating 5/ what they are happy about 6/ any questions I feel this is really important so that every one is happy. It takes courage to explain all this in front of people, but it builds up the team...

Anyway, good luck brother.

<comment><USER25> I think you misread his paragraph. He was proud of the business the day in its state that day he walked into the accelerator (and presumably for some time before), not BECAUSE he walked into the accelerator.

</comment></comment><comment><USER26> This is a fantastic headline and a good writeup, but ... why?

Perhaps it's cheaper than a psychologist, but in the process of being "stretched so thin" why are you spending time and effort into something that won't materially help you.

Dude, you have 30 days left. Don't be one of those football teams that gives up with :30 left on the clock. If you're going to lose anyway, throw the ball into the fucking end zone and try your hardest until the game's officially over.

Use your name. Tell us and the world about your company. Ask for ideas and help. Take advantage of this medium to try and turn it around with a Hail Mary pass instead of quitting early. There may be plenty of time for psychoanalysis in August, so what have you got to lose?

There are already 148 people on HN who care enough to comment. And thousands of readers, all of whom are tech savvy and perhaps more. You just never know.

Even if it fails, you'll go down a fighter instead of an anonymous blogger bemoaning his bad fortune. Which would you rather be?

Good luck,

        Ken

</comment><comment><USER27> Do you have any HAPPY customers? Talk to them. DAILY.

Why are they happy with you? ASK them and then shut up and write down why.

Take a step back. What do you need to achieve break even NOW and next month? Who do you need to let go? Who do you need to keep?

</comment><comment><USER28> The grass is always greener on the other side.

I too am running a startup with a downward trajectory. We have more like 6-12 months of runway left but things aren't looking good.

Our path tracks your alternate reality.

I started a project several years ago that took off. It wasn't meant to be a business at the beginning but once it started getting traction I slowly devoted more and more time to it.

It was "profitable" from the first day; the Adsense ads more than made up for the costs of hosting it and the initial design work. I programmed it myself so there was no development cost.

From the beginning it snowballed. It had a thousand users the first week, ten thousand the first month, and 50k users 3 months in. It was at that point that my amateur coding got in the way and the server crashed and burned.

By this time the business was making about $300/day in advertising. The costs were basically zero (a single virtual server + me part-time while I was still in school).

In retrospect this is the point I wish I had dropped out of school, raised some funding, and started building a development team. But I didn't; I read up all I could on scaling and hacked together some more code. That helped the project grow to a million users by the end of the first year.

By this time I had added in for-pay features to the free product to augment advertising and was making well over $1000 per day. I started plugging some of this into advertising to accelerate the growth but most of it was being distributed to me as the only shareholder. Things were going peachy until the servers crashed again.

Again, I read up on scaling, bought a couple hours of consulting time, and patched things up. Within a few months the advertising spend had paid off and at the peak the project was raking in $20,000/day (most funneling straight back to me since at this point it was just me [still part-time] and a couple of part-time customer service reps). This was where the project hit its peak of about 1 million monthly actives.

And, of course, the servers tanked again. This time by the time I was able to get things stable again the market was not as good and we weren't ever able to get back our exponential growth.

I wish I had at the very least "gone for it" and plugged the profits back into the business to hire people to help me. It was about this time that my competitors were discovering the same things I had been experiencing (easy viral growth, cheap user acquisition) and raised about 100 million in VC funding to buy up and saturate the market.

Long story short, we stagnated and slowly declined (no longer able to compete effectively with our newly extremely well-funded competition). Our competitor who raised 100MM in VC is now a public company with several billion in market cap, and there are several others who took a similar path that are worth in the range of a billion as well.

By the time I decided to hire and build a team it was too late to make much of a difference.

I made a couple million bucks and had a fun ride but I'm still kicking myself for not seizing the opportunity to go all-in while the window was open.

We're now playing catch-up but the market is more fully developed now and it's harder for underdog players to get an upper hand.

<comment><USER29> If you know you're screwed, and you've made a couple of million bucks, why aren't you just closing up the company and going home to have a money party?

That probably sounds quite harsh if it's something you love, but a million bucks is like economic freedom for life, and you can try again with a different idea later where there's less active competition. Sounds to me like you did pretty well for yourself.

<comment><USER30> In this day and age, a million bucks is not even close to an economic freedom. @webwright has a good post on what he calls "Fuck you money", the amount you'd need to retire rich. Well worth the read.

[http://www.tonywright.com/2010/no-you-cant-retire-rich- at-30...](http://www.tonywright.com/2010/no-you-cant-retire-rich-at-30-if-you- sell-your-startup/)

<comment><USER31> Sure it is. You just have to have more reasonable expectations. A million bucks can easily generate 30-50k a year in dividends, and without a mortgage, that is enough to live a comfortable lifestyle. You can't go on permanent vacation, but you can live and work on whatever you want to without needing a job.

200k is a silly number to use in this calculation. Most studies show that "happiness" stops having big returns past something like 70-80k. Could I spend 200k a year? Sure no problem. Do I need to? No way.

<comment><USER32> While 200K is silly, I don't think 1M is really enough to never have to work again assuming a family.

You would have to purchase a house, it should be in a safe area with a good school district, so that's probably 200K? (I don't know what prices would be far away from the coasts)

So now you have 800K generating dividends for you, plus you have to save every year to be able to cover your kids college tuition since you can't get any need based money due to your nest egg. Even assuming you somehow do that on 50K/year (or your kids get merit scholarships), in 30 years (by the time you are 60) your 50K has the purchasing power of ~25K.

<comment><USER33> 1) You don't need to pay your kids college tuition

2) Without a mortgage or debt, even 25k goes a very long way. Add up all of your non-housing bills, it shouldn't come anywhere close to 25k, I just did a sample budget and it still leaves 500 in savings per month.

<comment><USER32> 1) So shoulder your kids with massive debt or hope the educational system has changed enough that college degrees aren't required for everything and things are affordable. Nice.

2) Assuming a low cost of living state, and you live frugally for just yourself, I totally agree. I don't think that anyone would say raising a family on that much is easy in any part of the country. (I'm not saying its impossible, just not easy, probably to the point where you would say screw it and go back to work.)

<comment><USER33> 1) I paid for my own college and know others as well. I also know many people whose parents paid for their college. Guess who earns more out of this admittedly small sample? When you have to shoulder your own education you make many more money-making decisions, so that poetry degree from $200k school doesn't look so hot.

2) It's not that frugal, that's my point, here's the budget I put together, which still has luxuries like cable tv, smart phones, and $250 a month for going out _.[https://www.budgetsimple.com/budget/DKwEDsxt](https://www.budgetsimple.com/budget/DKwEDsxt)

_ Assumptions- You own your house outright, you own a car outright. There are other costs like property taxes and car repairs, but with $500 savings per month, those should be easily covered in a year.

EDIT- It's also worth noting, we're talking about income solely from dividends on $800k. Once your kids are going to college if you want to help them out, you have 800k (plus the $500 in savings per month to help them.)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER34> Maybe I missed it, but WHY does your startup have 30 days to live? You ran out of money and have no raise potential? How could your employee and cofounder not know this already?

<comment><AUTHOR> Founders are all very well aware, employees still in the dark.

No raise potential as metrics are nowhere near where they should be. Solid IP and team that might make for a good acquisition, provided investors will OK it (they've rejected one some time ago)

<comment><USER35> shouldn't you give employees 30 days notice? or is the plan to just fire them when the money runs out? before they've had time to look for another job...

<comment><USER36> haha, has this ever happened?

If you give employees 30 day notice, most will look for other jobs and leave. You will then have no hopes in turning the company around.

</comment></comment></comment></comment><comment> mck- These are the stories that matter more than the success stories we read every day on HN -- there should be more of these; this is reality -- great write-up :)

</comment><comment><USER37> If you let us know who you are and what company you're working on steering in the right direction, I'm very certain there are people, like me, that would love to help you in any way.

1\. I work for a company that can alleviate any back-office pain you have, setting you up on the proper infrastructure, rather than startup blood-sucking solutions like BackOps, TriNet, and Algentis.

2\. I have industry connections to help you find mentors, funding, or guidance of any kind.

3\. I don't know you, but I am passionate about you. You're a founder and I believe you have great value to offer the world. With this startup or any other you create in your lifetime.

4\. You've drummed up great awareness for you and your product with this post, so why not use it to get feedback on your product, with hopes to continue developing something customers want.

That's all I can say. I wish you the best, and hope you're not too discouraged if things don't work out with your current startup. You have the spark. Keep it alive, and build something of value.

Cheers :)

</comment><comment><USER38> I've been through all of this, it sucks. But this line sticks with me:

"Honestly think the only thing that keeps my health and my marriage intact is my running."

I gotta start running. That's the one thing I always get wrong.

Good luck. Just remember, this happens all the time. For you, it will be a learning experience. In a year's time, you'll be in a new situation with almost a completely new life, and your experience will be valuable to that next step.

Next time will be a little bit better. You'll be a little more trusting of yourself, with a little less naivete, and you'll create something again. Or you'll help someone else create something. Either way, your life will get better, because you're a capable person who started a company, and you're capable of even more. Do the best you can right now and stay positive. The future will be brighter.

<comment><USER39> For me it's cycling not running (arthritis runs in my family and one knee is pretty fucked from a football injury).

It's _literally_ the only thing that keeps me going some days I reward sustained effort with a ride and a ride wakes me up, clears out the cobwebs and I get some of my best work done after a ride.

It also helps that I've lost more than a stone (14lbs) in just over a month by switching diet and cycling 200 miles a week :).

</comment></comment><comment><USER40> > I really love my co-founder. It's an enduring bromance that will last a > lifetime. He's a talented designer, supportive listener and I trust him > entirely. However, he left me alone in the cold. He didn't mean to do this, > he didn't even realize he did. I became the guy who would "do-it-all". Biz > Dev, check. Product Management, check. Support, check. Accounting, check. > PR, check. Ad Copy, check. Development Lead, check. While he took complete > ownership over design (and really excelling at it).

Communicate. communicate! Cofounder relationship is like any other and communication matters. a lot. You will get tired, feel low and discouraged. you'll have to share it and let one person know who has an outside chance of understanding it and help you out if possible. your co-founder(s).

</comment><comment><USER41> Failure is a part of growth. This may be a monumental failure, but this blog is both therapeutic and introspective for the author. Examining failures helps us as we move forward. We get the added benefit of looking in from the outside. Kudos for coming forward with this kind of honesty.

</comment><comment><USER42> I have complete understanding of your situation, having been in the position of having to let people go from a very small team a couple of times. It's hard and feels awful, but you are doing what you see needs to be done which is great in comparison to not having the willpower to act.

If the developer you need to let go is as good as you say, he won't have a problem finding a new job. You feeling shitty will not help him nor you so continue working to remedy the situation to the best of your ability. That's all you need to do and I think it sounds like you will be able to look back to all of this and be proud of you being able to make hard decisions even in a situation when it's so much easier not to.

</comment><comment><USER43> Could the OP chime in as to why he is writing and publishing this blog? It appears to be a cautionary tale, but I'm not sure what anyone can learn when all the particulars are removed. Why not just write a retrospective after the next 30 days?

<comment><AUTHOR> Not a cautionary tale, just a blog to vent my frustrations and record the experience.

I'm not in a position to give "advice" nor do I suggest anyone follows "advice".

If you're a new founder and about to get on the VC train, through the accelerator and out again at light speed, it's good to know that this is one way it can all end up. (Nobody really speaks about it anyhow)

<comment><USER44> Here are some lessons I'm taking away from this article:

      > ... our initial desire to not raise a seed round was
      > dismissed and we were thoroughly convinced that we had
      > to continue on the VC rocket-ship in order to matter to
      > anyone. My reluctance to do this was met by scoffs and
      > dismissals from many others in the accelerator cohort...
      >  as well as by the mentors and investors who had offered
      > their time, network and resources to help us succeed.

Lesson: VCs want founders to take larger risks with their company for the reward of a larger payoff. If the founders don't want to "bet the farm" like this, then they probably shouldn't be seeking out VC money, or at least wait until they're profitable enough to have a lot more negotiating leverage.

      > I didn't believe the shit I was selling investors. This
      > was not the company I put my life on the line to build.

Lesson: Founders have to push back on their investors when the investors don't understand the full ramifications of what they're asking the company to do. First-time founders often fail to push back because the investor/advisor line is blurry.

      > When I built this team, I didn't build it with
      > generalists and with people who could jump into any
      > area of the business and get shit done. Instead, I built
      > it with quality-minded perfectionists who build
      > beautiful things.

Lesson: The founding team has to build two things: The product _and_ the company that builds the product. Find people who can do both.

<comment><USER45> For a VC your company is just 1 of 1000 they have invested in and so they are focused more on the numbers game. But for you it could be your life's work. It seems taking VC money early on is a big mistake for serious founders.

</comment></comment></comment></comment><comment><USER46> What if you just kept everyone, told them the truth that you can't pay them, and kept going? If you still believe in the core underlying thing that was working when you started then maybe you can turn this around.

</comment><comment><USER47> Well, lesson learned.

> What happens next? Hard to tell without precise context, but: as far as I > can tell, your company just needs money (paid customers I guess); you cannot > be good at your (too many) jobs? Fine, if your company is B2B there is only > 1 job to get done right now: business development, if you cannot do it > yourself, let's find the best business dev guy you can in your industry. BTW > "biz dev" is the only kind of guy I can sincerely hate and love at the same > time; that's how I recognize them.

My 2 cents.

</comment><comment><USER48> I had a moment just like this. We would be short $20k on payroll and the founders and myself and to come up with the difference. That sucked. Reality really sinks in when you are not in a good place to write those checks but you write them anyways. It was the responsible thing to do. Also, don't be a dick. Inform your employees that they need to keep their options open.

My biggest regret was allowing my VC to convince me to not worry about money...but you live & learn.

</comment><comment><USER49> Thanks for sharing your story. If you need someone to chat with: [http://www.startupsanonymo.us/](http://www.startupsanonymo.us/)

</comment><comment><USER50> That's unfortunate but this is business, most successful people go through this many times.

Best thing to do now is man-up, spend your last dollars taking your guys out for a drink and try and leave it with relationships in tact.

Best of luck on re-entering the workforce and don't lose hope. You may find an opportunity you can get started in your spare hours without all the extra sparkly bits that brought you down this time.

</comment><comment><USER51> Don't get me wrong but this is the classic example of "following the herd" of current gen startups --- too much focus on pleasing investors, raising money, eventually realizing you've relinquished control == don't feel sense of ownership in the company, straying from the vision or not getting enough traction, founders breaking up and then the ship sinking!

</comment><comment><USER52> I think the best way to look at this is as a learning experience. You have "scar tissue" now and won't make the same mistakes again.

Since you are an entrepreneur, you will inevitably build another successful startup - except this time you'll make it happen in half the time with twice the wisdom.

</comment><comment><USER53> this thought popped into mind - don't be a zombie startup [http://www.daniellemorrill.com/2013/03/zombie- startups/](http://www.daniellemorrill.com/2013/03/zombie-startups/)

</comment><comment><USER54> I am curious, as to why you didn't listen to your gut, and how old you are?

<comment><AUTHOR> The tempting lure of a big convertible note and a set of drooling investors saying that we were building "the next big thing".

<comment><USER54> Did you have the self-awareness at the time to realize that what you were building is something DHH would be proud of, or was that only in retrospect? I'm asking these questions, because I struggle with listening to outside advice vs listening to my gut, and Ive been trying to strike a balance as of late.

</comment></comment></comment><comment><USER55> I think the team should understand you and stand-up with you. Accepting a job in startup means be ready for an adventure where things like this could happen. Talk to them and look for a key feature or PIVOT

</comment><comment><USER56> You can alternatively pick the "indefinitely sustainable" road instead (for instance by mixing bootstrapping with freelancing like I did).

It is much slower but much less stressful too, in my opinion!

</comment><comment><USER57> wow, hidingmyname, if nothing else, you've inspired one of the most positive and supportive threads I've seen on HN (don't bother checking, I'm still a pseudo-noob).

I can only echo what many others have said in one way or another: be at integrity with yourself, do what you can to support your team and maintain your honour, and I believe that you will look back at this, in 6 months, with some kind of gratitude.

You lived it. :)

</comment><comment><USER58> I would like to send you an email, can you contact me ? simone at mweb dot biz

</comment><comment><USER59> Is it legit? I saw a few 30 days left to live stories here, now 30 days for startup to live. Is it PR shit or real deal? If you fire employee you must pay compensation, so how can you not able to pay his payroll of week? If you fire him it will be more expensive then one weeks payroll.

<comment><USER60> In most states of the US (at will employment), you do not have to pay that much severance. So you can either pay an employee their salary every 2 weeks (and their vacation is paid), or pay then 2 weeks severance.

The amounts might not be that different. $2k paycheck versus $3k severance.

</comment></comment><comment><USER61> Elon Musk put his last $3 million into Tesla to make payroll a few years ago.

<comment><USER62> That guy has balls of steel and fame to fall back on. While I think Elon is a man to be admired I wouldn't recommend copying all his decisions.

<comment><USER63> Also survivorship bias; we wouldn't be hearing anything about Tesla if it had failed normally.

</comment></comment></comment><comment><USER64> Is returning to what you were doing in the beginning not an option?

</comment><comment><USER65> sorry for what you are going through. happy to try to be of help if I can. [http://hall.com/tim](http://hall.com/tim)

</comment><comment><USER66> "Product after Product"

It seems like you were building mobile apps

</comment><comment><USER67> Now that's what startups are all about

</comment><comment><USER68> He has time for running? I think I know what's wrong.

<comment><USER69> I don't think you know. 1h of running could double the productivity of the hours you put in afterwards. And, most probably, the issue stems from product/strategy decisions. Not from spending 1h a day running and clearing his body and mind.

</comment></comment><comment><USER70> This thread does a lot on asking what is a _start up_ and what about taking equity funding, e.g., from a venture capital firm, versus remaining a company 100% owned by the founder(s).

The discussion keeps trying to find simplistic _patterns_ that cover most of the cases. I claim that such _new businesses_ ( _start ups_ ) are so varied that we should not look for simplistic patterns and, instead, just look at the businesses themselves.

Here is an approach to some insight into the growth of a new business: Commonly the intended or _expected_ growth is modeled with a spreadsheet with, say, one column for each _planning interval_ (maybe one month) in the plan of growth, but long ago I decided just to use an interpretive procedural language with, essentially, a Do-loop with one pass for each planning interval.

So, of course the Do-loop has some variables. So maybe we have some variables for business decisions, for random exogenous inputs, and for the _state_ of the business.

Considering all of these variables and the _business dynamics_ during each planning interval, we see that we can have a lot of complexity.

In particular, in some of this complexity, we can see that the business can run short of various necessary _resources_ such as management time, capacity of the server farm in users served per second, disk space used by the database software, time to hire and train staff, floor space used by the staff, rate of writing software, ads served per second, revenue from the ads, delays in getting paid by the companies running the ads, etc.

So, there are lots of 'constraints' or limitations which can slow the growth of the business.

Generally, if usage and revenue are growing slowly and the free cash is low, then we react by slowing down on hiring, buying servers, etc.

Yes, it can be that a big check of equity funding can open or _relax_ many of these constraints. But it may be that margins and free cash flow are nicely high and the constraints that are 'tight', e.g., management time, rate at which can bring on more software engineer staff, are not _relaxed_ by equity funding.

Programming a multi-interval growth model makes these points quite clear. Just envisioning such software should, for the HN audience, also make the points plenty clear.

So, net: We can't generalize. It might be that for some start up, equity funding cannot help its growth because cash is not nearly one of the tight constraints and, instead, the start up might be able to grow as fast as possible just _organically_. Common? No. Possible in principle? Yes. Possible in practice? Maybe, but don't try to generalize or theorize. Instead, if have such a case, then recognize, accept, and run with it and tell the people with equity capital "no thanks".

So, really, we can't generalize: _Organic_ growth might be for a business that has just one pizza shop and will never have more, a business selling donuts that opens a new location once a quarter, a Web site that is a _lifestyle_ business and gives the sole proprietor and owner $5 million a year in income but is not growing very quickly, or a similar Web site business that is growing rapidly, as fast as the time of the sole proprietor permits.

Such an organically grown business might be the next "big thing", worth $400+ billion, depending just on the business, say, the Web site, how many users like it how much, and how much free cash flow the revenue from the ads generates. In general we can't say and have to look at the particular business.

But, we can draw conclusions from what was common in the past? When looking for "the next big thing" (NBT), mostly just simple empirical patterns from the past are next to useless, deliberately, even nearly necessarily, so since the NBT might be -- should be, likely is -- quite new and different.

So, again, when looking for NBT start ups, we have to consider them one at a time with little hope of good help from past, simplistic patterns.

</comment><comment><USER71> ha! can a guy get a "hello fucking echo chamber!" up in here?

m3mnoch.

</comment><comment><USER72> Any proof this is real?

</comment><comment><USER73> All I can do is wish you good luck and say that I admire you for having the courage to try. These seem like empty words, so read some of my other posts to see that I really say what I mean (i.e. I'm very harsh with people I don't think much of, so when I'm nice, it _means something_ ). I'm sorry to hear that this is happening and I hope things turn out for the best.

Where are you located? What's your next move?

I can't stand how these investors get so hung up on Playing God with other peoples' companies. If they want to take over the world (and endure the risk involved; since world domination has a much higher chance of failure than a sustainable, mid-growth lifestyle business) they should do it with _their_ careers and companies, not someone else's.

Elon Musk is doing the right thing. He's chasing the vision with his own work, rather than jumping into someone else's Magitek Armor and then deciding to burn Narshe.

Also, these asshats are the reason it's so fucking hard for startups to get clients. Businesses (clients) have been burned, horribly, in the past by startups dropping them to chase dragons because their investors thought it a better idea to drop the client and roll the dice on some red-ocean product play with a 1-in-100 shot at success. This creates a world in which clients are very cautious about dealing with startups.

We'd have a better ecosystem if the VCs were just passive investors who didn't try to live out their own adolescent do-the-world fantasies. They'd certainly make more money that way.

</comment><comment><USER74> This one got me out of just about everything, and it's very very true, good luck;

Never, Never, Never give up. Winston Churchill

</comment><comment><USER75> Can't make payroll? Complain about being stretched thin?

Start a useless blog!

Perfect!

<comment><USER76> Considering he got on the front page of hacker news, it is far from useless. That's like 10k page views and good chance of investor/VC attention. I've gotten a couple meetings with VCs thanks to being on Mashable/Verge/etc., so Hacker News is likely no different. Actually, the page views are more from Hacker News since people go to your site directly instead of reading an article and maybe going to your site.

Too bad he doesn't have contact info or anything on there to capitalize on the traffic.

</comment></comment><comment><USER77> Why not double down and keep pushing forward?

</comment><comment><USER78> And in 90 days, you will be served with divorce papers.

<comment><USER79> Screw you dude. For someone with over 1k karma and an almost 3 year old account, you should know better than this.

This is a community meant for us, hackers and entrepreneurs, to help and support each other out. Posting shit like this when a guy is exposing his deepest anxieties to the world and reaching out for help should make you ashamed.

<comment><USER78> It's the reality of the situation. Unemployed men or men who earn less than their wives are more likely to be divorced. He needs to manage the situation with his wife carefully. Don't show her that you are worried. Don't share your problems with her.

<comment><USER63> That's so cynical that it looks sarcastic.

Isn't it far more likely to get a divorce if you are refusing to discuss problems with her? Holy hell. If this is what your relationships are like, you might want to look for different partners.

Thanks for making me appreciate my wife that much more.

<comment><USER78> Facts are not cynical:

[http://healthland.time.com/2011/07/11/unemployed-men-are- mor...](http://healthland.time.com/2011/07/11/unemployed-men-are-more-likely- to-divorce/)

[http://www.nypost.com/p/news/national/women_divorce_cur_SfyE...](http://www.nypost.com/p/news/national/women_divorce_cur_SfyEHTdYT8khsy625mbJOL)

I know there are women out there who would not dump their husband like this. One of my friends who has been with his wife since they were in high school went through a very tough 5 years in his business while trying to make it. He lost hundreds of thousands of dollars which he never made back. His wife stuck by him the whole time and even helped him out. They just had their first child.

You are right that the quality of partner is what matters the most. I suspect HNers on average choose a more morally upright class of women, however, I would still counsel anyone to be cautious about appearing worried to their wives.

Me though... I like firecrackers. Will never marry.</comment></comment></comment></comment></comment>


Stack traces on ESP8266: a GDB server stub - <AUTHOR> https://blog.cesanta.com/esp8266-gdb <comment><USER2> Slightly offtopic, but I wanted a nice breakout board for the ESP8266 and couldn't find one, so I made one:

[https://github.com/skorokithakis/tiny- ESP8266-breakout](https://github.com/skorokithakis/tiny-ESP8266-breakout)

If you want to just order one, here's a paneled PCB of the earlier versions (the only difference is pretty much the lack of a 3v3 out, plus the traces aren't as pretty): [http://dirtypcbs.com/view.php?share=15302&accesskey=](http://dirtypcbs.com/view.php?share=15302&accesskey=)

Technical details: There exist some breakouts like this one[1], but they're crap, stay away from them. They don't include all the necessary pullups/pulldowns for the ESP to start running code, they don't include a capacitor and they don't leave room on the breadboard for connectors, so they're useless. My PCB fixes all these problems by adding 0805 10k Ω resistors, a capacitor and by being less than 2.5cm in each dimension.

[1]: [http://www.ebay.com/itm/ESP8266-ESP-12-WIFI-UART-Serial- Modu...](http://www.ebay.com/itm/ESP8266-ESP-12-WIFI-UART-Serial-Module-and- Breakout-Board-for-Arduino- TW-/151696756353?hash=item2351d4ce81:g:-dAAAOSwl8NVZ9nQ)

<comment><USER3> Nice! I did the same thing for ESP-01, only with stripe board so that I could make it myself: [http://www.nfriedly.com/techblog/2015/07/build-a-diy- esp8266...](http://www.nfriedly.com/techblog/2015/07/build-a-diy-esp8266ex- esp-01-dev-test-programming-board/)

<comment><USER2> That looks fun! You can probably make it a bit smaller if you use one of those stripe boards that have pins connected in threes, rather than the full length of the board.

<comment><USER3> Yea, definitely. The part selection mostly came down to what I had on-hand from previous projects.

</comment></comment></comment></comment><comment><USER4> If you can get a gdb stub onto an embedded system, you can do a lot of cool stuff, up to and including running its firmware in an emulator and forwarding I/O accesses to the real hardware (!), which gives you basically unlimited visibility into the code. You can see Jonas Zaddach et al.'s Avatar paper (PDF: [http://www.s3.eurecom.fr/docs/ndss14_zaddach.pdf](http://www.s3.eurecom.fr/docs/ndss14_zaddach.pdf) , code: [http://www.s3.eurecom.fr/tools/avatar/](http://www.s3.eurecom.fr/tools/avatar/) ) for more details.

</comment><comment><USER5> I do most of my work in Lua. So the GDB traces will be to the major Lua routines. I'm going to assume the ports of microPython will have the same problem. Any suggestions for those implementations?

<comment><USER6> Immediate thoughts go to `debug.traceback` (via xpcall). You're on your own when it comes to Lua<=>C boundaries, however. Now, if you're talking about _manually_ walking the stack... this will point you in the right direction: [http://zeuxcg.org/2010/11/07/lua-callstack-with-c- debugger/](http://zeuxcg.org/2010/11/07/lua-callstack-with-c-debugger/)

<comment><USER5> Thanks for the hints. I'll need to get to the lab to see how well they work in the ESP8266 environment, that would be a huge bonus win.

<comment><USER6> Happy to help.

To expand upon my 4am ramblings:

There's two ways your code is going to fail, (a) Your Lua is going to die in a pcall (or friends); or (b) Your C/C++ (or similar) code has its front fall off.

In the former case, you just wrap with an xpcall and append your Lua callstack to your C++ callstack. Nothing fancy. You can of course go further, using lua_Debug to get the value of upvals and all that jazz.

However, in the latter case you have no guarantee that your application is in a sane state; you have no (solid) assumption that you can go the lua_Debug route, say from a segfault handler. You'll have to walk the callstack, and when you hit lua_whatever, prod internal state.

Both methods are really helpful. Say you're writing a game engine, knowing how to reproduce a catastrophic failure with a small Lua snippet, closes the feedback loop and make debugging a hell of a lot easier.

There's definitely a product and SaaS around this (much more expanded), with a Gitlab or Sentry business model.</comment></comment></comment></comment>


Return-Oriented Programming without Returns (on the x86)  - <AUTHOR> http://cseweb.ucsd.edu/~hovav/papers/cs10.html <comment><AUTHOR> Ok, so security papers on Hacker News never get that much love, but take my word for it that you want to read this one.

This paper is the moral equivalent of that post from yesterday about how you could derive all of ASCII from []()+! in Javascript. Here, the authors are trying to evade runtime defenses that prevent memory corruption exploits from uploading executable code in target processes. To control execution, they analyze target binaries and synthesize a turing complete runtime out of scraps of legitimate basic blocks.

From 34 instruction sequences, they essentially derive a VM with load/store/move, add/sub/neg/and/or/xor, conditional branches, and call (read the first couple pages and skip ahead to page 12 for the diagram of what "call" actually looks like when you scavenge it out of the bblocks of an unsuspecting program.

Obviously, once you have such a VM defined, you can compile arbitrary exploits to it. It's like having a scriptable debugger attached to the remote program.

You should read the paper because it's an excellent crash course in runtime exploit design and mitigation, and a good way to jog your x86 memory. But I should also note that I haven't done justice to the paper: it's thesis is that you can not only do all these things, but do them without the "ret" instruction, or any other non-innocuous sequence of instructions.

<comment><USER2> IANA security expert, but stuff like this makes me believe it is _never_ possible to secure native code. If you want a secure system, build a VM using a strict language like Haskell.

Is that a fair statement?

<comment><USER3> I am a security professional, but not a developer. You're half correct. Your suggestion of a VM with Haskell would result in a system that could still be made to fail. The methodologies would just work differently.

<comment><USER4> Could you back up that claim? lambdabot on #haskell runs arbitrary Haskell code very safely.

<comment><USER5> I think he means fail as in allowing you to write a function like:

      deleteAllFiles user = if user == Root
                               then throwError "access denied"
                               else unsafeDeleteAllFiles

Even if memory access is safe, you can still type in the wrong algorithm.

<comment><USER3> Most certainly. But further, it's possible to write unintentionally exploitable code in any language.

</comment></comment></comment></comment></comment></comment><comment><USER6> Can somebody describe what this document is all about in simple words, for the average "high level" developer? Thanks in advance!

<comment><AUTHOR> You've probably heard the term "buffer overflow". A buffer overflow is one example of a memory corruption flaw. In virtually all modern memory corruption exploits, the goal of the attacker is to corrupt a victim program in such a way that they can upload their own code into the victim and run it.

For about 8 years (95-'03, the "summer of worms"), the bulk of all the work in stopping these attacks was directed at the broken code that allowed the vulnerabilities (for instance, the use of strcpy() and sprintf(), which are unbounded). The payoff for this work went asymptotic.

Starting in the late '90s and really picking up in the '00s, research instead went into hardening runtimes to break exploits. For instance, you can't simply overwrite the activation record for a function to change the return address, because there's a random cookie there. The stack and heap aren't executable, and the text segment isn't writeable. The whole runtime is randomized, so you can't predict addresses.

What papers like this (and, as Dave Aitel pointed out on Twitter, papers like John McDonalds from the 90s -- that guy is spooky) aim to show is that even if attackers can't literally upload x86 instructions into their targets, they can still take control of the process.

That's because even simple real-world programs are very complex at the runtime level, and linked to very complex libraries. The CPU can be coerced into executing any of the instructions in those libraries --- or, indeed, any sequence of bytes comprising any fragment of those instructions.

So, if you do some basic binary analysis on your target, you can craft a sequence of addresses in the target which, if executed in the right order, will have the same effect as any program you could write (it's "turing complete", but a more helpful way to think about it is that they're synthesizing a simple VM running out of fragments of code).

As far as we know, it is very hard to stop these kinds of attacks. An attacker that can write 1-4 bytes to an arbitrary (or even restricted) address in memory can trick the CPU into looking at attacker-controlled memory (say, the 1024 character login name they just gave you), and once the CPU is looking at that memory, it starts running sequences of its own code against itself.

This is systems programming, compiler theory, computer architecture, and computer security. If you're into serious practical CS, you're crazy if you don't consider security as a career. There are very few other jobs that will reliably expose you to so much CS (and even EE) at this level.</comment></comment>


What are the implications of NSA surveillance on the average Internet user? - <AUTHOR> http://security.stackexchange.com/questions/37076/what-are-the-implications-of-nsa-surveillance-on-the-average-internet-user <comment><USER3> There are both clear and subtle implications for widespread surveillance. Whether they will practically impact your life and rights depends on chance and your private habits.

Here's a broad list of consequences that is by no means exhaustive:

1\. You can be indicted and charged with a number of felonies, most notably treason and violating national security, for your private correspondence and electronic habits.

2\. Incidental to an existing charge, you can have your private interests and communications leveraged against you as evidence not directly relevant to what you're being tried for.

3\. You can be implicated in crimes for communicating with known criminals or having any demonstrable (reasonable or otherwise) association with "people of interest." Corollary to this, you could be harassed and pursued and made to act against such people in the interests of national security.

4\. You could be blackmailed or slandered in the public eye, effecticely crucifying you in the media, by taking your private life out of context in the name of the legal process.

5\. You would be effectively "nude" in the virtual sense - every thing you do is and could be an actionable offense or interpreted as one, despite the fact that it's not in direct offense to anyone else and despite the fact that it's private. Your every interest, hobby and habit could be dissected and questioned as though an Orwellian thought police agent were ever vigilant in your room.

6\. Innocent until proven guilty would be effectively null and void. You could be presumed guilty for all of the aforementioned reasons and due process would be extremely hard for the average individual to utilize to their advantage.

All of these would scale (against you) in a situation involving mass media. You might believe that on a cursory inspection these are justified if it prevents terrorism. That is a fear response, to which I reply that our government, and the rule of law it represents, is lost if we walk down this path.

Sacrificing liberty for the _sake of liberty_ is both absurd and fundamentally objectionable.

<comment><USER4> The biggest implication - it makes opposition impossible. In a few years there will be nobody to defend the average person rights. "Power corrupts and absolute power corrupts absolutely"

<comment><USER5> _All governments suffer a recurring problem: Power attracts pathological personalities. It is not that power corrupts but that it is magnetic to the corruptable. Such people have a tendency to become drunk on violence, a condition to which they are quickly addicted._ \- Frank Herbert, Chapterhouse Dune, Missionaria Protectiva

<comment><USER4> Nice sounding statement, but power does corrupt. Quite a few experiments proofing it.

</comment></comment></comment></comment><comment><USER6> Let's just say this: have you at least pirated a song or a movie, smoked marijuana and bragged about it online, or done anything at all that you know could be seen as a crime, or even stuff that you think is "moral" but probably illegal?

Okay. Then in a surveillance state you better not ever try to piss off the national leaders, or even the local ones (depends how far this gets), and you better not complain to your friends and neighbors either.

Because that's how they'll get you. Not with the last part - but with the first one. You'll just be another "pot smoker" or "pirate" and they'll demonize you as a dirty criminal who deserves prison.

<comment><USER7> This is what how it could impact avg people in the future. But it very probably won't.

<comment><USER8> It's not about affecting everybody. The vast majority will likely be left alone. It's about having the _ability_ to affect everyone.

</comment></comment></comment><comment> grey-area The danger as I see it is negligible to the average Internet user, _until_ they become a person of interest to someone with the power to use these programs - a journalist say might pursue their work for decades without being interfered with, but with all their correspondence stored, only to find themselves undermined fatally by their actions at the age of 19 when they broke a story which the administration didn't like, decades later. In the same way that Nixon abused surveillance powers to undermine reporters, someone high up in the chain of command could redirect the NSA for their own purposes - <USER2> there is no open judicial oversight and no respect for the rule of law, this is inevitable. I wouldn't want to live in a world where that is possible.

What I find disturbing about these tools is that they are far more suited to retrospective analysis, and therefore to discovering dirt on ordinary people and undermining the rule of law, than suited to tracking terrorists (the ostensible aim). They'd be far more useful to someone like Nixon than to someone genuinely concerned with promoting America's interests in the world and stopping terrorist attacks, because those planning serious attacks will simply use other means of communication (as in Bin Laden's use of paper and messengers). In addition to that they are so wide-ranging that the damage and danger caused by them far outweighs any possible benefit.

Also this sort of powerful bureaucracy has a way of ensuring its own survival after it reaches a certain size and power - after all if the NSA hears politicians are planning to shut them down, they might have to take steps to stay in business - a very easy task with tame secret courts rubber-stamping requests and a culture of little respect for the rights of those surveilled. Just a matter of digging up their surveillance on most of congress (who of course have all had contact with foreigners, so fair game), and deciding where to apply leverage. Imagine then someone truly evil in charge of the NSA, and the power they could wield, unfettered by quaint notions of international law or oversight by other branches of government.

<comment><USER9> > What I find disturbing about these tools is that they are far more suited to > retrospective analysis, and therefore to discovering dirt on ordinary people > and undermining the rule of law,

Aha yes. Access this kind of system would be Stalin's or any other brutal dictator's wet dream. This is what they'd get a hard on thinking about. "Oh, I wish I had a system where everyone would input their hobbies, interests, connections, all they messages (Facebook, GMail, Skype, etc) and then I would be able to read and access those things, all the phone calls, shopping habits, text messages, what kind of porn they like, who they like to joke about, what they eat,...mmm". Well guess what we have that here and now.

Retrospective analysis is the key here. I have mentioned in the past how the formula for a successful brutal dictatorship is this:

1) Complicated, ambiguous and broad laws (disobedience, being suspicious, obstruction of justice, obstruction of business, disorderly conduct, etc etc)

2) Total monitoring and control & archiving

Just those 2) are enough. With enough background material to scare anyone with jail, a criminal record, disclosure of shameful information ("I see you like foot fetishes, how would you like if your church friends found out about that?... Are you sure you should keep participating in this Occupy movement, think twice about it...") they can control and manipulate anyone.

</comment></comment><comment><USER10> If someone lies to your face for years and, only when caught red-handed, claims that what he/she is doing isn't all that bad, would you believe them?

It's worse than that. Not only does the U.S. government expect us to believe the content of our communications are safe from their eyes unless we "have something to hide", they're about to come down hard on the whistle-blowers that made them admit as much as they have. It's as if that red-handed thief were quietly shoving the person who caught them out a window while telling us a story about how it's not what it looks like!

What a crock.

</comment><comment><USER11> Today: The Government

Tomorrow: Insurance companies, your competitors and your employer.

There is nothing wrong with surveillance per se, however it requires a transparent and accessible legal system to keep it in check - right now that is not happening.

</comment><comment><USER12> People will increasingly censor themselves. Not everyone, maybe, but those with non-mainstream views will increasingly learn they need to guard what they say on the internet.

And slowly, the greatest meeting place we've ever had will lose its potential.

... that's my biggest fear, anyway.

On a straw poll amongst my friends many of us are already self censoring to some degree. And we don't have extreme views, either, we're just cautious about how things that we thought might be anonymous no longer are, how jokes might be taken out of context in the future or links made between accounts that are meant to be separate.

We are essentially moving towards the Panopticon Internet:

[https://en.wikipedia.org/wiki/Panopticon](https://en.wikipedia.org/wiki/Panopticon)

> the essential elements of Bentham's design were not only that the custodians > should be able to view the prisoners at all times (including times when they > were in their cells), but also that the prisoners should be unable to see > the custodians, and so could never be sure whether they were under > surveillance or not.

</comment><comment><USER13> Since starting Lahana[1] I've become much more aware of the information we leak and the information that can be intercepted. In terms of counteracting the average Internet user, provided that Amazon isn't in the prism list (and I'm referring to Amazon outside of country) A private Lahana node may be sufficient, but I'm not making promises and would welcome ideas both to the contrary and ways of making Lahana better while still accessible.

Lahana was designed to be accessible by lowest common denominator non- technical people on closed hardware. At the moment as an experiment I'm building supporting infrastructure for Lahana, starting with StaTorsNet[2], an Anonymous/Pseudonymous twitter implementation based on Statusnet. Again, I welcome comments positive and negative especially if they can be used to improve the deployment or convince me to pull the service based on risks.

I've been looking at Mumble for calls, but am interested in alternatives with working mobile clients. If anyone wants to get together and turn this into a proper project, please get in touch from my profile page. I'm game if you are.

[1] - [http://lahana.dreamcats.org/](http://lahana.dreamcats.org/)

[2] - [http://r5c2ch4h5rogigqi.onion/](http://r5c2ch4h5rogigqi.onion/)

</comment><comment><USER14> I'd say it weakens you if you ever ever go up against the powers that be.

Say you want to protest or challenge the government about something like chemicals on farms, child mortality, racism, legalising pot, or some other abuse. As soon as you do, the government will rake though their data on you, and use anything they can find to rubbish you, over an above the point you are trying to make. It means millions of people will not longer have an effective voice.

Imagine an e-petition with a million names on it. A fairly quick database scan, matching signatories with information will enable a government to deal with the lot of them in one go.

</comment><comment><USER15> For the average person - not much impact. However, once this data exists in a central, searchable format, you can bet that it will get used for purposes other than national defense.

It'll start off with being used to locate missing & kidnapped children. Then it'll be used to locate spouses who haven't been making their child support payments. Then it'll be used to locate tax cheats (what can be more un- American than not paying your taxes?) And then people for whom there are outstanding warrants - both felonies and misdemeanors. Like unpaid traffic tickets.

</comment><comment><USER16> There are broadly two types of innocent victims. Those who feel violated if they found someone had broken into their house and gone through their underwear and those who would be dismissive because their underwear was all clean and no real harm was done. Rather than trying to decide which victim reaction is correct by trying to assess if any real harm was done or not perhaps we could ask what possible justification there was for a stranger to be in their underwear drawer in the first place.

</comment><comment><USER17> A global ban of US technologies might be coming.

</comment><comment><USER18> Except nothing has changed. This has been going on for enough time that if the average Internet user hasn't been effected by it yet then they don't have much to worry about in the near future. So for the immediate future there are absolutely no implications on users other than being aware that someone can look at your communications, which you should have assumed already. Because if the NSA didn't already have your information than Google, Facebook and every other social network certainly did, something that we have been well aware of for a long time.

<comment><USER19> > _Except nothing has changed. This has been going on for enough time that if > the average Internet user hasn 't been effected by it yet then they don't > have much to worry about in the near future_

That's from the things you CAN see (I don't see ordinary people being harmed directly by this program). What about the things you can't directly see or measure?

Some issues that come to mind:

1) This kind of privacy abuse opens wide open the Overton window about surveillance. Today it's the secret services. Tomorrow the general government (from IRS to the FDA). The day after tomorrow insurance companies, corporations, etc.

2) This kind of privacy abuse harms directly people that the government, men in power, lobbies with heavy clout, etc, consider dangerous. Dissidents, activists, whistleblowers, investigative journalists, hackers, etc. To draw an historical analogy, people like MLK, Aaron Swartz, Mother Jones, Howard Zinn, Phil Zimmerman, EFF, Timothy Leary, I.F. Stone, and thousands more. People that make society better, or push certain aspects of it forward.

Those people ARE constantly monitored by the government, are harassed regularly, are being blackmailed or even made to shut up or disappear, are threatened with legal action for bogus charges, etc. It's difficult to measure the harm on a society's future caused by enabling the government to keep tabs and better control these kind of people.

3) It shows a huge moral, political and judicial decline that Nixon got punished and yelled at, by the media, for Watergate (eavesdropping on the opposite party), and in 2013 American accepts it's government eavesdropping, keeping tabs, etc, on virtually ALL Americans.

<comment><USER18> While these are all valid reasons to be concerned about future abuses, none of them are implications on the average internet user resulting from the uncovering of PRISM.

</comment></comment></comment><comment><USER20> A question which is overlooked in this kind of answers is, how do you circumvent your mistrust of your own OS?

It's a foregone conclusion that Microsoft OSes have backdoors for the NSA, and it's not unlikely that they also know some exploits, which grant them access to many distributions of open-source OSes. If my OS reports everything to the NSA whenever I access it, encrypted cloud storage won't help that much; it will only make super-wide surveillance harder to scale.

</comment><comment><USER21> There are no implications for an average netizen, since an average netizen doesn't use strong end-to-end crypto nor does he/she avoid cloud-like- storage/services (it doesn't matter which).

Average individuals aren't opposing her/his government or committing a felony.

They simply can't anymore because they would provide their own evidence/leverage against them or simply because there is nothing left to hide anymore.

</comment><comment><USER22> I clicked through to a post on zero knowledge web applications and thought it was pretty interesting: [https://news.ycombinator.com/item?id=5853294](https://news.ycombinator.com/item?id=5853294)

The basic idea is build web applications that only store encrypted data on the server. All data is encrypted and decrypted on the client using JavaScript.

</comment><comment><USER23> I'm just going to repost a comment I made during an HN thread on trolling here:

\----

"....However, on a general note, I think it is important to realize that every text message you send, every cell phone conversation you have, every post to the CNN forum you make, every tweet you send ... is directly attributable to your IP whether you use your own name or not. With Facebook and Google tracking everything you do, whether you are logged in or not, I would go one step further, and say all of these things are directly attributable to you personally.

I would strongly urge young people to really think about what they are putting out there. Consider this, the military was doing the equivalent of credit checks for sensitive positions during the 60s. No one else typically had to have credit checks back then. [Today...] you need a credit check to do ANYTHING, even things that don't require credit. How long before an internet and phone background check is standard in the background checks organizations do before offering jobs? [Saying that it won't happen is naive.]

I can tell you the military is doing this sort of screening right now for sensitive positions, but at least you are confronted about it. It still basically ends your career, but they will give you a chance to explain your posts. In the private sector in the future, they will just deep six your application and you won't know what happened. Or they'll let you in at entry level, maybe, and subsequently you'll start running up against an invisible barrier as you try to advance beyond the first or second layer of management. Or you will find resistance to you advancing into management at all.

Also be mindful, it can affect more than your professional life. Think about what the background [and credit] checks for apartments will look like in the 2020s. Or what 'dating sites' will be like in the 2020s [perhaps with Google Glass]..."

\----

That comment was made in a thread on trolling... but the principle is apropos here as well. Back in the 60's credit and background checks were not commonplace because only security agencies had incentive enough run that information down and collate it for a given person. Security Agencies like... say... National ones. Eventually the process was smoothed out so much that today even a rinky dink property manager in Rochester MN, or Santa Clara CA can run that information down. So they do! Whenever you want to rent an apartment. And employers do as well... whenever you want to get a job. etc. etc.

Now think about that in the context of a theoretical "internet and mobile phone profile check".

For an apartment?

For a job?

For a date?

For a lawsuit? or for a divorce?

or even...

Just for the hell of it! Why not? I never liked that lady anyway.

So people ask... what are the implications?

Well... consider "scope creep".

With information of this nature... the number of methods to command your conformity that the government and military can dream up is legion.

<comment><USER24> _Now think about that in the context of a theoretical "internet and mobile phone profile check"._

If you're a marketer you can already buy this data from various vendors. The way it works is since everyone signs up for various services with the same email address, they just figure out what your email address is, then scrape out your data from all the services you've signed up for.

</comment></comment><comment><USER25> what are the implications .. you can't have a conversation with someone without thinking that your thoughts and opinions right now won't be tied and assigned to you forever ..

Imagine a highschool student who liked some band or political movement on facebook or talked about it on skype that is somehow tied to a imbalanced person who shot up a school or committed a crime? how could this effect his applications to state universities or grants or whatever? who knows...

do you trust the goverment that feels the need to spy on everyone behind their back to make a decent decision?

I've been keeping all of my work notes/journals/thoughts in OneNote which is synced and stored on Microsoft's servers ... who has access to those?

I don't want the bureaucracy to use my private thoughts, my private information or my private feelings to make decisions about me for whatever reason .. what happened to having rights and liberty?

tl;dr the implications are that you don't have the freedom to be yourself as long as this is going on</comment>


The Unemployed Worker's New Friend: Outsourcers - <AUTHOR> http://online.wsj.com/article/SB10001424052702303499204576387511296578664.html <comment><USER2> It would be interesting to see how effective this approach is. I was told by the HR firm helping us through our last layoff that most technical jobs (in the US at least) were won as a result of personal contacts or networking rather than a crop-dusting approach.</comment>


MongoDB {name: "mongo", type: "db"} - <AUTHOR> http://www.theroadtosiliconvalley.com/technology/mongodb-mongo-nosql-db/ <comment><USER2> This post is useless.. Some excited newbie writes his first thoughts on MongoDB, which you can't gain useful information.

<comment><AUTHOR> Ummm you can't get any useful information? There is a step by step Ubuntu install guide, common MongoDB commands and insights on some differences between RDBMS and NoSQL.. what were you looking for?

<comment><USER2> Something which doesn't exists on any other zillion blogs, something is not " MongoDB 101 "...

If i want to install MongoDB on Ubuntu, i would use google, first result for "MongoDB ubuntu install" is MongoDB's web site ( [http://www.mongodb.org/display/DOCS/Ubuntu+and+Debian+packag...](http://www.mongodb.org/display/DOCS/Ubuntu+and+Debian+packages) ). I think it would be better to follow these instructions.

The point is : If one wants to be useful for others, he/she should be write about use cases and possible implementations (eg. " our e-commerce solution and how we using mongodb")</comment></comment></comment>


Picture houses: a last glimpse of Moscow's beautiful and derelict Soviet cinemas - <AUTHOR> http://www.calvertjournal.com/features/show/10811/moscow-cinemas-yuri-palmin <comment><AUTHOR> Interview with photographer, [https://www.citylab.com/design/2013/10/russias- disappearing-...](https://www.citylab.com/design/2013/10/russias-disappearing- movie-theaters/7306/)

 _> What compelled you to start documenting them? I perceive them as rare, unique objects and often the movie theater is the only handsome building in a district so my urge was just to keep them in a time, place and memory through documenting. These cinemas are frozen in time, being parted from movies but their identity preserved; a frontispiece and a name._

</comment><comment><USER2> They look kinda ugly.

<comment><USER3> I find them beautiful. I thought to myself, "there's no way whatever the developers put up will be as nicely designed".

</comment></comment><comment><USER4> Are concrete cubicles beautiful?

<comment><USER5> There is not a single concrete facade among those pictures, so that seems a strange question to ask.

In any case, the answer is of course that concrete cubicles can be made both poorly or with great skill.</comment></comment>


Congress says pizza is a vegetable - <AUTHOR> http://notionscapital.wordpress.com/2011/11/16/congress-reaps-pizza-harvest/

<comment><USER2> bwahahahahhaha???? I can't figure out if I should laugh or cry? This is the same thing as the Indian government declaring that PI is exactly 3.14 or something to that extent.

</comment><comment><USER3> yes it is.. :D</comment>