MakeGamesWithUs (YC W12) is now MakeSchool, building an alternative CS degree - <AUTHOR> https://www.makeschool.com/article/introducing-makeschool <comment><USER2> What a bummer that the tuition for this is still $30k for a year. I just can't imagine that $30k/year is a sustainable economic model for higher education. Especially in the technical arena, you can become proficient enough to get a junior-level engineering job pretty easily. Definitely for a lot cheaper than $30k.

I say this as a self-taught engineer - never went to college, and I've now got a pretty great software engineering job. Dropping $30k for a year of training (or, even worse, $30k/year for 4 years!) would have been a huge waste.

<comment><USER3> $30k seems unreasonable. You can go to Canada, receive CS education from University of Waterloo for 22k/year international student tuition + 500/month rent * 12 months + 500/month living expense * 12 months = 32k / year. Granted admission will be far more difficult, but why would you pay $30k to an institution that is charging as much as a reputable university? I hope they reevaluate the price for the program.

<comment><USER4> CS creates computer scientists. It doesn't necessarily make good programmers. You can't compare this to CS.

The model in a year-long bootcamp (which is what this is) is vastly more expensive to operate than classic CS education. Being in this business, I think you'd be surprised by the numbers. They're probably barely breaking even at that tuition amount.

<comment><USER5> >>CS creates computer scientists. It doesn't necessarily make good programmers.

This is making the line between theory and practice too bright, there's actually quite a bit of overlap.

By 19 I was already working as a dev at a game studio you would know well and made a difficult decision to leave and do a CS degree.

It was incredibly worthwhile in my case, and I rely on theory and foundations learned all the time in the real world.

The point is yes you can get a job without a degree but in some cases you will never be quite as strong without investing in that foundation.

<comment><USER6> You make it sound like what matters most is not actually _studying CS_ but _getting a CS degree_. Is there something special about getting a degree that would cause a programmer to "never be quite as strong" if they studied CS but not for a degree, for example outside of the traditional college system? Most of the science seems to be freely available, if one is willing to put in the effort needed to learn it without the assistance of a professor.

<comment><USER7> Yes, there is great quality content available free and online. But it is incredibly rare for some to get a CS level education from it, because it's not something you can easily do part time. Even if you just try to learn the materials from core CS classes I've taken, that's a few textbooks, a few large projects, and a LOT of hours of studying and work. College lets you get that done all at once - if I tried to give myself a "CS education" while having a full time job, I am pretty confident I would have failed. It certainly couldn't come in just a few years.

</comment></comment></comment></comment></comment></comment><comment><USER8> I'm rather frustrated with this huge push to create a "new" CS degree, which is basically saying "Let's abandon half of CS and focus on just programming." Computer Science is, obviously enough, the science of Computers and computation. Coincidentally, programming happens to be a tool for computer scientists to interact with computers and demonstrate computational theory. While I understand and appreciate the necessity for good programmers/developers, people seem to miss the point of what a Computer Scientist actually is. It includes a whole lot of theory and knowledge of how computers function and operate, from the fundamental logic up to the application layer. Programming is learned as a Computer Scientist not necessarily for the purpose of a career, but rather as a means of implementing and testing theories and ideas. Much the same as Mathematics where theories are abundant, many of which are necessary to become a mathematician. You don't see anyone trying to create a Math degree that skips a lot of theory and just teaches you Applied Mathematics for a career. While the analogy breaks down when you move into industry, the concept is the same. If you are pursuing a Computer Science degree, you must become a Computer Scientist. If you want a more objective approach, see the definition of Computer Science as put forth by wikipedia: [http://en.wikipedia.org/wiki/Computer_science](http://en.wikipedia.org/wiki/Computer_science) . You'll notice that Software Engineering is but a subset of the field of Applied Computer Science, which is itself a subset of Computer Science. Before I continue ranting I'll just summarize: You cannot forgo or severely reduce the extensive amount of theory behind Computer Science and churn out Computer Scientists. It does not match up. If your goal is instead to produce more software engineers / programmers / developers who are not real Computer Scientists, then you should re-name your degree and your program. You might find CIT/CNIT/IT more appropriate. [https://en.wikipedia.org/wiki/Information_technology](https://en.wikipedia.org/wiki/Information_technology)

<comment><USER9> Yea, the culture basically is Computer Science == Software Engineering. As much as I hate it, most people get degrees nowadays not for research or education, but to land a job. However by using that association I'd say that it helps a bit to pick out the people who make that incorrect association (and are getting a CS degree for work instead of for research) that otherwise wouldn't take it seriously if it just said software engineering. It leaves more room in the universities for people that actually want to learn CS and the people who didn't know the difference between the terms learns what they need to get a job (since I'm sure true computer scientists would understand that the term is butchered). It's a win-win IMO.

<comment><USER8> I understand what you're saying, but I think that my point is still valid: If you want to offer a degree to become a Software Engineer, it should be a Software Engineering degree program not a Computer Science degree. Someone else mentioned that the direct path to Applied Mathematics takes form of say an Engineering degree. They are two separate degrees/programs yet clearly Engineering is just the fast path to a career in Math in an industry environment. So too should a Software Engineering degree be a fast path to a career in Computer Science in an industry environment.

</comment></comment></comment><comment><USER10> We've been using the SpriteBuilder tutorials on makegameswith.us as a resource for teaching a group of high school students how to program games. It's been extremely valuable for helping them get up and running, and saved us a ton of time.

Happy to hear they are leveling up with MakeSchool.

</comment><comment><USER11> I gotta say, I hope they've improved. I participated in makegameswith.us and found the experienced to be very disorganized. There was no clear indication of which week you were supposed to be in in regards to the course schedule, and the pods, groups, etc. devolved into a wasteland pretty quickly. Of course, there's also the fact that it would be far preferable to use Swift at this point (or develop for Android) but I may be biased because I loath ObjC.

</comment><comment><USER12> Congrats MakeSchool! The summer program students I met were very bright and loved the program, look forward to following the gap year program.

</comment><comment><USER13> This is an exciting space right now. I'm gearing up to launch RPG Classroom this Spring. The name is sort of a combination of their old and new names (gaming and mentoring).

I think their price is a little high, but I guess they have an obligation to charge what people are willing to pay. Instead of charging $30,000, my idea is to accept Bitcoin donations if people are happy with their education.

Besides teaching computer science, I think gamification is a natural next step for primary education (K-12) in this era of attention challenged kids and I hope MakeSchool isn't back-peddling on that. For example, instead of making proof of concept games, I want to put out an RPG that teaches Biology 101 (or build a platform that enables someone else to do it).

</comment><comment><USER14> Where is Zed Shaw's follow up article to '[http://zedshaw.com/2014/10/19/the- coming-code-bootcamp-destr...](http://zedshaw.com/2014/10/19/the-coming-code- bootcamp-destruction/') ?

</comment><comment><USER15> >The MakeSchool Gap Year is designed to accelerate the careers of the brightest computer science majors.

I'm confused about what this is offering. If it's for existing CS majors, surely by definition if you're among "brightest", you wouldn't forgo the $5-10k/mo internships available [1] or generous starting salaries you can get right out the door, and instead _pay_ $30k.

[1] [https://twitter.com/tzhongg/status/536565474041937921/photo/...](https://twitter.com/tzhongg/status/536565474041937921/photo/1)

</comment><comment><USER16> Congrats Jeremy and Ashu! Hope the new Gap Year program does extremely well.

</comment><comment><USER17> FYI: Title tag on [https://www.makeschool.com/home/](https://www.makeschool.com/home/) is MakeGamesWithUs | Home

</comment><comment><USER18> Looks awesome. Are there any regulatory issues associated with starting a formal school with a physical location?

<comment><USER19> Well, they aren't an accredited program, so they're pretty much eliding the regulatory aspects. The flip side is, its students are paying private-college prices (and over _three times_ average resident tuition for state schools) for an unaccredited program. So, is the program significantly better than an AS, BS, or MS when factoring in time and price? Not sure about that. (It appears to be an accelerated and relatively superficial tour of CS, plus a lot of hanging out with startup types. Compare with an undergrad at Stanford or Berkeley plus regular Caltrain or BART trips for coffee in SoMa.)

Having said that, MakeSchool isn't trying to be a replacement for a traditional uni education -- hence the "gap year" terminology -- but for the price, I'd hope they're working with ABET to get some kind of seal of approval of their curriculum. Alternatively, they can do what some colleagues of mine did back in the late '90s, with a similar concept (a "web talent incubator" named Populi) -- they worked with accredited institutions like Pratt to build and monitor their curricula, giving them the imprimatur of a prestigious institution without the regulatory handcuffs.

</comment></comment><comment><USER20> Cmd+F on 'journey'. Was not disappointed.</comment>


In Baltimore and Beyond, a Stolen NSA Tool Wreaks Havoc - <AUTHOR> https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html <comment><USER2> I'm unclear on why I'm meant to take this particular Windows SMB exploit so seriously when there's such a long history of comparable bugs that nobody ever referred to as "stolen cyber weapons". I think it might be almost entirely because of the name; "ETERNALBLUE" sounds much scarier than "CVE-2017-0144".

Don't get me wrong: a reliable modern Windows drive-by RCE is nothing to sneeze at. But if it wasn't this exploit, it'd be a different one --- _will_ be a different one, likely not "stolen from NSA", when the next half-life of this bug is reached.

The phenomenon of a single bug having intense, distinctive utility is not new. In any couple of years, there will usually be a couple bugs like that --- a very popular RCE that's publicly known, and a very popular RCE that is somehow kept on the DL. Back when those RCEs were in things like UW IMAP, nobody wrote NYT stories about how the NSA had accidentally unleashed them on us like some filovirus from Zaire leaked from the CDC.

Meanwhile: seized on by North Korea, Russia, and China? Come on. We know roughly how much it costs to develop a reliable remote (Project Zero has written them up, what, a dozen times?). The smallest SIGINT agencies in the world can afford this kind of work out of petty cash. I'm sure none of them are going to look a gift bug in the mouth. But CVS-2017-0144 isn't fundamentally enabling them to do anything they couldn't have done themselves.

I think Mitre should just start assigning stupid NSA names to CVEs, so that people will take them more seriously.

<comment><USER3> The reason is that there's a big difference between an exploit and a fully weaponized utility that gives you a root shell for a given IP address.

You almost never see these lying around the Internet. There is a lot of work involved in creating a tool that'll successfully identify and exploit every single build of an executable, with 99.9% reliability. There is lots of testing to be done, lots of tweaks required. Things that random individuals just don't do by themselves.

<comment><USER4> but his point is that we're not talking about individuals. The article breathlessly goes on about foreign states, you know _the bad ones_ , who have used this to attack all over the world. Except as tptacek points out, these states can do this kind of work on a slow day, in office. I actually disagree with tptacek, I don't think its partially, or even at all because of the name. I strikes me as more fear mongering, part of a narrative thats meant to drive more defense spending. "Look at all these breaches, can't have this stuff happening, be afraid lowly citizen, and support your security state".

<comment><USER5> >According to three former N.S.A. operators who spoke on the condition of anonymity, analysts spent almost a year finding a flaw in Microsoft's software and writing the code to target it. Initially, they referred to it as EternalBluescreen because it often crashed computers — a risk that could tip off their targets. But it went on to become a reliable tool used in countless intelligence-gathering and counterterrorism missions.

If it took the NSA a year to develop, then it can't be done "on a slow day".

<comment><USER2> I didn't say it could be done "on a slow day". I said it could be done "out of petty cash", in the context of a SIGINT agency. Google employs dozens of people who do this stuff as a hobby.

We don't have to wonder whether this is some space alien technology that only the NSA can develop; it's a reliable Windows remote in pre-Win8 SMB servers. Read a writeup on it; it's less complicated than most type confusion browser RCEs.

<comment><USER4> fair enough, my language, not yours. I was driving at a similar point however inept my language was.

<comment><USER2> I don't object to your language as a rhetorical flourish, because I think it's true that this level of exploit development is not all that rarified. I'm just saying, what I actually said is harder to knock down with a message board rebuttal. :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> > "If Toyota makes pickup trucks and someone takes a pickup truck, welds an > explosive device onto the front, crashes it through a perimeter and into a > crowd of people, is that Toyota's responsibility?" he asked. "The N.S.A. > wrote an exploit that was never designed to do what was done."

Let's rework that analogy. If the NSA knows a trick to make Toyota pickup trucks explode, and they don't tell Toyota about the trick for years because they want to keep using it, and then eventually they leak the trick and suddenly everyone's Toyotas are exploding left and right, is that the NSA's fault?

Yes, yes it sure is.

I wouldn't go quite so far as to say the NSA was obligated to tell Microsoft (metaphorical Toyota) immediately about the exploit. For better or worse it's in America's interest for them to hack into foreign computers, and they take some risks as part of doing that. But they're 100% responsible for the downside of the risks they take.

<comment><USER7> Imagine Toyota makes a faulty truck, and then they issue a recall, and there's headline news about the danger this issue poses, and truck drivers all over Twitter are pleading for people to fix their trucks, but you nevertheless continue driving around for 799 days without fixing it, and then your truck explodes. I know who I'm blaming.

<comment><USER6> Both points are true. Think about having giant holes in the sidewalk. On the one hand, if you walk into a giant hole in the sidewalk in broad daylight, that's pretty much your fault, and your friends will laugh at you. On the other hand, everyone understands that some people will inevitably walk into a giant hole in the sidewalk if it's there, and so we consider it negligent to dig one without putting up bright orange barriers around it. In part that's because some people are more vulnerable than others (maybe it's nighttime, maybe their eyesight isn't very good, maybe they're going fast on a bicycle), and in part that's because with a large enough group of people some of them are bound to be careless, distracted, or unlucky.

</comment></comment></comment><comment><USER8> NYT again buried the lede. This was never a 0-day. How is it that companies and governments still fail to install updates years later?!?

"One month before the Shadow Brokers began dumping the agency's tools online in 2017, the N.S.A. — aware of the breach — reached out to Microsoft and other tech companies to inform them of their software flaws. Microsoft released a patch, but hundreds of thousands of computers worldwide remain unprotected."

<comment><USER9> Of course it was a 0-day. It was one until the day that Microsoft released patch MS17-010 on the 12th of March 2017. So for around 5 years it was a 0-day that was used by the NSA and possibly other unknown actors.

<comment><USER10> 0-day generally refers to the day the vulnerable party learns of the vulnerability, so it would be substantially earlier.

<comment><USER9> True, I was wrong about that. I looked at it from the perspective of the affected customers.

In that case it was a 0-day until probably February 2017.

</comment></comment></comment></comment><comment><USER11> [https://twitter.com/ErrataRob/status/1132345806177144833](https://twitter.com/ErrataRob/status/1132345806177144833)

Some interesting rebuttal notes. Apparently it is the vulnerability that is being exploited, not eternalblue itself.

<comment><USER12> I find one of the responses pretty compelling:

> This is a distinction without meaning. Infosec frequently uses the same name > to refer to a vulnerability and a corresponding exploit. I don't agree with > the framing of the story either, but calling it "fake news" is a serious > accusation that goes too far.

[https://twitter.com/mehaase/status/1132366433491533824](https://twitter.com/mehaase/status/1132366433491533824)

<comment><USER11> I'm less interested in the accusations and more about the content.

</comment></comment></comment><comment><USER13> "The tool exploits a vulnerability in unpatched software..."

It's a self inflicted wound by Baltimore.

Question is, what is the cost of actually maintaining their systems competently vs. the cost of the attack? Both are difficult to quantify, but if you factor in the likelihood of getting attacked I bet it's still cheaper in the long run to just run your IT dept fast and loose and let the chips fall where they may.

As a government entity, they are probably making the soundest decision based on budget. Disruption in services hurts the populace, not the government.

As an anecdotal aside, I once worked as a contractor for over a year for a state government entity, run by a young, ambitious, dept head who was _all_ about the security and soundness of the software they used. But he needed a good sized budget, to convert buggy and insecure systems over to something more sound, and every single meeting with his superiors was about money. He argued so vehemently (I was in some of these meetings and he couldn't have been any more astute in his observations on the future of attacks) that eventually his superiors found a reason to fire him (using government bought software for personal use at home - for self education). And, no joke, literally all the work he and his team had done in the dept for years was just chucked when the next guy came in.

Government is about money, not security.

<comment><USER14> One thing I didn't realize till I talked to someone who works in IT procurement for a populous county in KC was that they can capitalize buying servers, and finance via bonds, vs. using cloud providers, which comes out of their operational budget.

</comment></comment><comment><USER15> I think the national security establishment are applying pre-digital paradigms and thinking to cyberspace and as a result have gotten things almost entirely backwards. In the physical real world, "the best defense is a good offense" often has a lot of truth to it as in limited resources situations force concentration to defeat hostile forces can be fundamentally more effective. But when it comes to information which can be infinitely and losslessly copied it might make more sense to think of security in terms of information _gradients_ and societal model. For a liberal democracy/market economy a lot of useful information gets generated, but it can be less effective at utilizing it and more leaky. Whereas (at least in examples so far in human history) centralized command authoritarian societies don't seem to as effectively come up with new stuff, but if offered the chance to take it from elsewhere can act with more of a long term vision (and of course with panopticons and massive restrictions on individual freedoms can more effectively insulate themselves).

So maybe from a strategic point of view government security should be working to shore up the weaknesses of the societal model while maximizing the strengths, the best strategy for each model are opposites. So for the USA, I think it'd be better if nobody had any ability to hack anything and the government acted aggressively to maintain an unequal information gradient. Then the problems that come from short term incentives, less decisive/unified responses, and so on continue to get made up for by a major technological edge. Whereas for a polity like China in a world where information is smoothed out they can leverage their authoritarian governance for more advantage.

Which means the NSA has been doing the opposite of what they should, because for America in the digital domain "the best offense is a good defense". America has the most to lose from having all of its information generation/infrastructure (R&D, networking/governing systems etc) get taken and/or disrupted. Rather then thinking of digital security issues as weapons to be exploited against less technologically advanced enemies who by definition have far less to lose, they should have long since been thinking of them as big strategic risks and working to eliminate all of them as aggressively as possible, and to be a dependable source for best practices in general. I think maybe there is a basic mindset mixup in the leadership given the last 50 years and their military backgrounds, and that's really caused America to squander enormous amounts of strategic value (and goodwill as well for that matter). Very foolish and unfortunate, and I'm not sure if anyone in government is currently thinking about reworking the NSA into a role focused on actual national security.

<comment><USER16> This is a very interesting take on the road we should have taken with respect to cybersecurity. I agree with what you said, but I think there's still scope for this sort of thinking in current nation states. It's a strategic mistake, but one that a generation more in touch with technology would probably not make as easily, so I expect that there's already people thinking this way in most governments, and that will only increase in the future.

</comment></comment><comment><USER17> "We can't protect our own dangerous secret software tools, but trust us to protect your keys in escrow."

<comment><USER18> You don't see a difference in protection posture between something which has to be used in the wild vs something which could be kept in a vault for it's entire lifetime? I'm not arguing that escrow is a good idea, I'm arguing that this argument is not why that's true.

Edit: consider how often keymat has leaked.

<comment><USER19> There isn't one really - if they had access to it the same logistical issues would come up no matter how much they pinky promise not to abuse it. The more it spreads the more vulnerable it is

The only way key escrow would be remotely trustworthy would be if there were "hostages" to provide an intrinsic punishment for their failures or stonewalling of transparency.

</comment></comment></comment><comment><USER20> > EternalBlue was so valuable, former N.S.A. employees said, that the agency > never seriously considered alerting Microsoft about the vulnerabilities, and > held on to it for more than five years before the breach forced its hand.

This has been common "conspiracy theory" for at least a decade. And not just about Microsoft.

</comment><comment><USER21> I feel that given the US government prosecution of the MalwareTech guy for use of an exploit package he wrote, but was not using, the US government should accept financial responsibility for the misuse of their own exploit.

</comment><comment><USER22> I just want to mention how Tim Cook rightfully pushed back on government pressure to develop a tool to break into an accused terrorist's iphone, citing the dangerous precident it would set, as well as the enevitable theft of said tool. if the NSA can't fully secure its arsenal, who are they (government) to demand a private company to develop (and expect to secure) a tool that _everyone_ would want to get their hands on. alas, while the effort was noble, state sponsored actors have made this a moot point.

</comment><comment><USER23> This is on the NSA. They decided not the tell the vendors about this and that makes them responsible. They failed their task which I thought was to keep the Unites States safe and secure.

<comment><USER16> They did tell the vendors about this, and the vendors actually released a patch too, all this before the tools were leaked.

<comment><USER9> The patch was released just one month before the exploits were leaked to the public, and the NSA only decided to act after they were certain that their tools had been extracted. But we still don't know when it was extracted from the NSA. If they would have brought this to Microsofts attention 5 years earlier (and without releasing an easily adaptable exploit for the vulnerability) a lot of damage could have been avoided.

</comment></comment></comment><comment><USER24> You know what's bizarre? Amidst all this drumbeat of news about cybercrime trashing government, and with the clear evidence that the US 2016 turned, at least partially, on cybercrime:

NOT ONE of the candidates for US President has undertaken any effort to boost their own infosec. (Or if they have, they keep it quiet.)

What can they do? The same stuff we do in any SaaS business:

Rudimentary security training for everybody, including bigshots and candidates. (Podesta got phished, twice!)

Make sure their laptops and office computer equipment are up to patch levels and the malware detectors work.

Engage one of the large-scale email providers; they have topnotch dedicated infosec people, good spam traps, and a lot to lose if they visibly mess up.

Adopt strong multifactor authentication.

Hire compentent pentesters and remediate any vulnerabilities they find, fast.

Let their donors and the public know they're taking action (not WHAT action of course, just that they're on it.)

Governments should do the same for their constituents and taxpayers.

Now, maybe candidates will argue they don't have time for the extra security. But, in 2019, that argument shows they're unfit for public office. One candidate learned that the hard way in 2016. No more of this.

</comment><comment><USER25> shouldn't it be patched by now?

<comment><USER26> Elsewhere in the thread it is said to never even have been a zero day, i.e. before it was publicly released, Microsoft was forewarned and released a patch.

So yes, it is patched in the sense that the vendor did, and in the sense that the Microsoft customers should long, long have patched a vuln from 2017.

<comment><USER27> >is said to never even have been a zero day, i.e. before it was publicly released, Microsoft was forewarned and released a patch.

Which is nonsense. It was an exploit that was actively used for at least 5 years before Microsoft was informed about it. The "not a zeroday" is pretty close to doublespeak. There is nothing to sugarcoat here. It was a zeroday that was exploited for years and Microsoft wasnt informed until the very end. All the while millions of devices were vulnerable. I have to say I am having a hard time assuming good faith when people make such statements, here of all places.

A vulnerability is a zero day until the day the maker is informed about it. Its not an ambiguous definition.

<comment><USER28> The dangerous assumption here is that nobody else ever got hold of the EternalBlue exploit outside of those they wanted to have it.

This is a bad assumption. Others could have developed it independently, or intercepted it from NSA usage, and used it for years prior to the leak of the tools.

Hoarding 0days makes everyone less safe.

</comment></comment></comment></comment><comment><USER29> _> The tool exploits a vulnerability in unpatched software_

Eternal Blue exploits a vulnerability in unpatched _Microsoft Windows_ software

</comment><comment><USER30> Slightly off-topic, but does anyone know who makes those standing desks shown in the pic of the MSFT office?

</comment><comment><USER31> Bed, Bath, Baltimore and Beyond

NSA knew that EternalBlue was in the wild and possibly being used by other bad state actors, and just sat on it. For years. In case you are wondering whose side they're on.

</comment><comment><USER32> The Shadowbrokers announced their access to EternalBlue many months before Microsoft released a patch.

The NSA was negligent in not immediately informing Microsoft after the Shadowbrokers announced their access to the NSA tools with clear proof (codenames, etc) on Reddit.

</comment><comment><USER33> Wreaking havoc on outdated computers...

</comment><comment><USER34> Two years ago, in 2017, Microsoft distributed the security update to fix this problem. The issue has nothing to do with the NSA and everything to do with the City of Baltimore failing to keep their capital equipment, in this case computers, up-to-date applying security and other updates.

The article also discuses healthcare systems hacked by other exploits. This again was not caused by the computer virus, but by the fact that Microsoft vendor issued security updates were not applied to the systems.

Often there are security upgrades in hardware as well as software which means that the computer hardware needs to be upgraded as well.

As is the case with most of these security hacks, it is the failure of the agency to budget appropriately for equipment maintenance and having competent leadership that actually understands the importance of budgeting for and implementing security upgrades including upgrading to the latest version of the OS, in this case, Windows 10.</comment>


Ask HN: Which payment provider do you use? - <AUTHOR> I am currently looking for a payment provider for a SaaS project and find it very difficult to find a proper single solution that integrates Paypal and Stripe (or other CC payment gateway).
It seems to be that the difficulty is in reoccurring payments and invoicing.
What do you use and how bad was the integration? <comment><USER2> I use Stripe exclusively. The integration into Rails isn't too bad (I wrote a book[1] about it and a gem[2] that automates a lot of it) but there are a lot of little details that one might not think of if they've never done a payment integration before.

Recurly][3] abstracts over multiple payment gateways for subscriptions, if that's something you need to do. I haven't used it myself but I've heard good things.

[1]: [https://www.masteringmodernpayments.com](https://www.masteringmodernpayments.com)

[2]: [https://www.payola.io](https://www.payola.io)

[3]: [https://recurly.com](https://recurly.com)

<comment><AUTHOR> Thanks zrail, I will definitely have a look at those and your book :)

</comment></comment><comment><USER3> (I work at Stripe.)

Are you looking for a single integration that handles both PayPal and credit card transactions? Stripe users typically end up integrating both separately (though building a billing abstraction above both).

<comment><AUTHOR> Yes I was hoping for both, but it seems to be that the best way is to separate all payment gateways. Just in the sake to keep flexible.</comment></comment>


Apple has hired the guy who 3-D printed his own brain tumor - <AUTHOR> http://www.cnbc.com/2017/04/21/apple-hires-steven-keating-mit-student-who-3d-printed-his-brain-tumor.html <comment><USER2>
        Where is the Google Maps, Facebook,
        or Dropbox for health?

Interesting question. More details of Keatings efforts in this article ~ [https://www.vox.com/2015/5/2/8532381/steven- keating](https://www.vox.com/2015/5/2/8532381/steven-keating)</comment>


Casper Sleep S-1 - <AUTHOR> https://www.sec.gov/Archives/edgar/data/1598674/000104746920000166/a2240404zs-1.htm <comment><USER3> Casper sued a mattress review site, Sleepopolis, for writing negative reviews of their products. Casper then settled the lawsuit by taking over Sleepopolis. The site now posts only positive reviews of Casper's mattresses.

[https://www.fastcompany.com/3065928/sleepopolis-casper- blogg...](https://www.fastcompany.com/3065928/sleepopolis-casper-bloggers- lawsuits-underside-of-the-mattress-wars)

I would take any reviews of Casper's products with a grain of salt.

<comment><USER4> Mattress reviews are notoriously fake. I would take any mattress review with a grain of salt.

<comment><USER5> Not to get too meta but undermining reviews is also a tactic used by companies to manipulate sales because if you don't trust any reviews but still have to make a decision you're going to go with a "safe" "established" brand which usually means whoever has the most mindshare.

<comment><USER6> Can you recommend an unbiased site then

<comment><USER3> Consumer Reports is non-profit and purchases all of the products it tests. Its revenue comes from subscriptions and grants/donations, not advertising or commissions.

[https://www.consumerreports.org](https://www.consumerreports.org)

Some U.S. public libraries offer access to Consumer Reports for free with a library card.

<comment><USER7> > commissions

sadly, consumer reports now gets money from purchases through amazon affiliate links

<comment><USER3> Thanks for the correction. You're right.

I would still place more trust in Consumer Reports than in for-profit review sites, but that trust has declined.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Just wanted to say that working with Casper customer service was one of the worst experiences I've ever had.

I bought their top of the line hybrid mattress then a few weeks later they had a sale which could be used on any of their products if you bought a mattress. We really wanted the lamps so we contacted customer service to see if it was possible to get the discount since we just bought the mattress. The girl was extremely rude making it seem like I was wasting her time. She told me that there was no way to add anything to an existing order so I couldn't do it. I asked if I had to return the mattress and reorder it to get the lamps and she said yes that's what I would have to do but no I was out of luck because they took too long to respond to me (called after they didn't respond to any of my messages) so the promotion was over. The whole time she just seemed annoyed that I even tried to ask.

Sorry I spent $2000 on a mattress and wanted to spend more on another product. I just returned it and got a Novosbed for half the price and it was way better so I'm pretty glad it turned out that way. Keep in mind that Casper can't sell a return so they have to donate it. The whole return was a mess to deal with as well. Glad they lost money on the return even if they get to write some of the donation off.

Guess my point is that I don't think Casper treats their customers well. I wouldn't touch them as an investment. I personally think they're just cashing out at this point.

<comment><USER9> Do you keep track of all the things you buy in case price goes down so that you can complain to customer support when they do?

In my case, I contacted support to see if I could get a discount _before_ making the purchase and they told me to wait two weeks for an upcoming promotion. Also quickly exchanged a defect mattress.

Not saying they're the best, but complaining because they don't have retroactive sales....

</comment></comment><comment><USER10> I haven't been in the market for a mattress for awhile now but went on Casper's website and was shocked to see the price for a Queen is now $1095.

I didn't remember it being that high, and checked Wayback and sure enough it was $850 in 2015, and $950 in 2017.

Given how many copycats are out there, many selling for much less, can someone help me understand how Casper gets away with selling a $1095 mattress + tax to a majority millennial crowd, who are supposedly cash strapped, and doing so successfully?

<comment><USER11> Advertising/marketing.

People often perceive a mattress as "very important," as sleep is important, and are willing to spend a bit extra if they think the quality will be there and they'll sleep better.

In reality I believe most of these "mattress in a box" companies are selling the same 2-3 mattress manufactured in the same factory.

Personally, I buy mattress in the $300-$500 range. When I was in college I just slept on a brick of foam because that was what I could afford.

<comment><USER12> It is important. Given how much time you spend sleeping and people complain about spending $1000. But they don't complain about a $30000 car they spend less than half the time in.

<comment><USER11> The same or very similar mattresses are rebranded and resold as vastly different price points. Mattress sales is mostly marketing. When I was researching mattresses years ago the takeaway was basically price and satisfaction/quality of sleep are not correlated very much.

</comment></comment></comment></comment><comment><USER13> I bought a latex mattress several years ago, and will never buy another mattress. (Literally, they last 50+ years) Feels great, available in a range of firmness, no weird smells, never deforms, doesn't get hot, and naturally insect/mold resistant. I think I paid 1300 USD for a king size.

I know that's only tangentially relevant to the topic at hand, I'm just mentioning this since I had trouble finding much info on them. Latex is not promoted or advertised much, since they have very low markup compared to other mattresses; the store would much rather sell you a "hybrid" (usually 1/2 latex and 1/2 memory foam). But if you want to pay 2x as much to get something that lasts 4x as long, what you want is simple, boring, 100% natural latex.

<comment><USER14> Which brand? I've never considered a latex mattress, and I need to replace my current one soon.

<comment><USER15> I really like our SleepOnLatex mattresses ([https://sleeponlatex.com](https://sleeponlatex.com)). They're yet another mattress-in-a-box company, and the name is kind of bad, but the mattresses are very high quality AFAICT - UL Greenguard Gold/Oekotex certified for low emissions, organic wool covers rather than chemical retardants to meet fire standards. And they're extremely reasonably priced to boot ($800 for a queen).

No affiliation, just a very happy customer. Never tested their customer service/returns/etc, so I don't know how good they are there.

</comment></comment></comment><comment><USER16> For the last 9 months of 2019 (all in USD)

Revenue - 312M COGS - 157M Sales & Marketing - 113M General & Administrative - 106M

Net profit (loss) - (67M)

First thought: How on earth are they spending $11M/month on G&A expenses?

On further reading -

Casper Labs, our over 25,000 square foot advanced research facility in San Francisco.

Ah, ok then...

Second thought: Why isn't R&D broken out as a separate line item?

</comment><comment><USER17> Many engineers would benefit from spending a year in sales and a year in marketing.

There is a whole other way to look at products like this that is often missed if you haven't done the time.

<comment><USER18> Many engineers focus on sales and marketing all the time as a normal course of jobs that involve product management. Many engineers already take into account sales and marketing perspectives in very effective ways, especially quantitative ways that are underused by employees whose sole jobs are exclusively in sales or marketing.

It's very tiring to see engineers be tacitly assumed to need remedial time in other fields to gain sufficient appreciation for them, especially when the reciprocal deficiency of experience in engineering is virtually never raised for sales, marketing, etc. while engineers often do self-learn quite effective product and business skills.

</comment></comment><comment><USER19> The trick is that there are a bunch of mattress companies on Amazon selling really cheap foam mattresses (~200$) that are basically the same as Casper. But Casper jammed a ton of money into branding and marketing, so probably has great margins on their products. Foam mattresses as a product are getting extremely cheap and the quality is really not bad. I have a cheap one and honestly like sleeping on it more than 1200$ spring bed I had.

<comment><USER20> Can you recommend any of these cheap Amazon alternatives?

<comment><USER21> We bought a Zinus mattress recently. $260 for a queen size and pretty great so far.

<comment><USER22> My kid sleeps on one, while I sleep on a Casper, so I can compare side by side. They're more or less the same thing for all intents and purposes, except Zinus is 1/4th the price.

</comment></comment></comment></comment><comment><USER23> Great business story. They quickly capitalized on a trend (tuft and needle started 2 years before), pumped it up with great marketing and distribution, and now are making their exit before a recession.

Would. Not. Buy.

<comment><USER24> Feels like in all of these booming startup segments there's always an Uber.

</comment></comment><comment><USER25> Interesting that they want to explore medical devices, "sleep services", and sleep supplements. Guess they are marketing themselves as the Amazon of sleep? Because right now all I know about them is that they sell overpriced mattresses

<comment><USER26> Though my initial response to the title was to laugh, upon further thought I think they're actually making a smart play here.

They're essentially betting on "optimizing wellness" being a huge fad this decade, which I believe many others are predicting, and are using their current position to get more cash to get ahead of that.

I don't associate Casper with "a quality night of sleep", probably because I'm happy with my current mattress and have no need of their product, but at the same time I couldn't name a single one of the current applications that exist to track + "optimize" sleep / circadian cycles, and I'm sure I'm not alone in that, so who knows? Maybe in 2030 we'll all be moaning about Casper putting up their Nighty Night subscription another $7 for "HD dreams" and reluctantly acquiescing to it.

</comment></comment><comment><USER27> We tried the memory-foam-in-a-box mattresses and they were not good (leesa - <USER2> suspect Casper is similar.). We just ordered and received a latex mattress from Arizona ([https://www.mattresses.net](https://www.mattresses.net)) and it's so much better. I don't work for or have any affiliation with them, I just hope this helps someone else.

</comment><comment><USER28> Just want to shout out to the Casper Glow Lights, those things are awesome. Interesting to see a mattress company expand into other cool products.

<comment><USER29> I've been using 2 of them now for well over a year and they've been excellent. I fall asleep with them every night. It's a well engineered product. The only minor criticism I could give is the dimming functionality by spinning while in the charging platform could work a little better.

</comment></comment><comment><USER30> Casper's return policy is wasteful.

100 nights or your money back. After two days we didn't like the mattress. Emailed support and told them we weren't happy with it. The next day 1800 Junk truck came out and trashed the mattress. So essentially their returned mattresses go into the landfill and become waste if you're not happy with it.

<comment><USER31> Maybe they don't want a bedbug invasion in their warehouse.

I bought a cushion for my desk chair from Amazon and it turned out to be garbage so I tried to return it. They said they could only give me a refund if I sent them a picture of the cut up cushion. I didn't have to send it back, just send a picture of it with a big gash down the middle.

I guess, at least with 1800 Junk there is a good chance a employee will pluck the mattress out and put it up on Craigslist.

</comment></comment><comment><USER32> Disaggregated Revenue Data (Nine months ended September 30) Direct to Consumer: 2018- $239M; 2019- $259M [13% YoY growth]

Wholesale: 2018- $31M; 2019- $54M [75% YoY growth] "20.3% year-over-year net revenue growth for the nine months ended September 30, 2019"

"We have also expanded our gross margin from 42.8% in 2016 to 44.1% in 2018 and to 50.7% for the three months ended September 30, 2019"

<comment><USER33> It seems that they already saturated their Direct to Consumer channel and all their growth is now dependent on their wholesale efforts. It seems risky to me, especially with a slow-cycle business like mattresses. Also what happens if retailers create their own premium brands and/or secure exclusivity deals with other manufacturers?

<comment><USER34> No better time to dump the business on the market and run

</comment></comment></comment><comment><USER35> A genuinely enjoyable long-form post I read a while back involved Casper [0]. Not sure how germane it is but perhaps someone will enjoy it.

[0] - [https://www.fastcompany.com/3065928/sleepopolis-casper- blogg...](https://www.fastcompany.com/3065928/sleepopolis-casper-bloggers- lawsuits-underside-of-the-mattress-wars)

</comment><comment><USER36> It's a tech company guys

</comment><comment><USER37> The product I like from Casper isn't their mattress – It's their lights. They're god damn incredible, I sleep peacefully thanks to those. They should just focus on stuff like that.

</comment><comment><USER38> They could be making better Facebook ads to get that acquisition cost down. The text on the image for a lot of their ads is way too small!

[https://mobile.twitter.com/kevinwlordbarry/status/1215786907...](https://mobile.twitter.com/kevinwlordbarry/status/1215786907784941570/photo/1)

</comment><comment><USER39> I bought a Casper off shelf two days ago. It was the only one on the shelf in Target and it was 9.45 PM. It was pricier than I had expected and didn't understand why it was so expensive. But I needed one pronto and it wasn't worth my time to go looking for something else that late at night.

But I did wonder why it was so expensive..

</comment><comment><USER40> I think this is who put it more succinctly:

"Casper is a very inefficient wealth transfer from venture capitalists to prestige podcast makers"

[https://twitter.com/kevinroose/status/1215734138981928960](https://twitter.com/kevinroose/status/1215734138981928960)

<comment><USER41> > "Casper is a very inefficient wealth transfer from venture capitalists to > prestige podcast makers"

___[Big Well Known Consumer Products Company]___ is a very inefficient wealth transfer from ___[Blue Chip Stock Investors]___ to prestige ___[Traditional Media Companies]___

</comment></comment><comment><USER42> When I was 23 and doing startups full time, I slept on a hardwood floor with just a blanket and a pillow. Helped me to get up in the morning and do work, did nothing bad for my body as far as I can tell.

<comment><USER43> That's ridiculous that you were down voted. My brother slept on a rock hard bed as a kid and is able to sleep on the floor, without a pillow, all night no problem. The soft bed thing is more of a cultural issue than a biological necessity.

<comment><USER44> Anyone who has ever been to bootcamp can tell you that it really doesn't matter where you sleep if you're REALLY tired. I would sleep on the ground if they let me. I would fall asleep sitting down, then stand up and fall asleep again. And when I did finally go back to my tent to sleep on my 50 year old army bed in a used sleeping bag, it was the best sleep I ever had.

</comment></comment></comment><comment><USER45> Unsolicited advice: buy the cheapest mattress (that doesn't squeal) that you can find and slap a $50 memory foam topper on top of it. That maxes out my comfort level.

</comment><comment><USER46> I did an insane amount of research when buying my mattress a couple years back, there are _so_ many bed-in-a-box companies now. Decided on Helix Sleep because they offer a level of customisation, and their customer support is rated incredibly highly (which I decided very important if you're going to buy a mattress without trying it).

I _love_ my Helix so much so that I convinced my parents to buy one. They didn't love theirs and sure enough, customer service was hassle-free with the return. So my n=2 recommendation: Helix is the way to go

That said those Glow Lights do seem pretty awesome

</comment><comment><USER47> Casper should buy calm.com

</comment><comment><USER48> I'm so tired of this

<comment><USER49> IPOs have precipitously declined since the 90s. In 1999, there were 486 IPOs. There are now approximately 190 per year. [1]

[1] [https://www.statista.com/statistics/270290/number-of-ipos- in...](https://www.statista.com/statistics/270290/number-of-ipos-in-the-us- since-1999/)

<comment><USER50> You're going to go with the dot-com bubble era for a comparison here?

<comment><USER49> I didn't mention whether I thought the increase in IPOs was worrying. (In fact, I do think we may be reaching/reached saturation.) IPOs per year is a highly volatile number [1], based upon lots of factors, such as perceived market conditions (sometimes by the underwriters, not the company IPO'ing). [2]

[1] [https://theweek.com/articles/770020/americas-disappearing- ip...](https://theweek.com/articles/770020/americas-disappearing-ipos)

[2] [https://www.youtube.com/watch?v=sC7ht0CAQsk&feature=emb_titl...](https://www.youtube.com/watch?v=sC7ht0CAQsk&feature=emb_title)</comment></comment></comment></comment>


Ask HN: Why can't I submit Inquistr's story about Reddit's The_Donald subreddit? - <AUTHOR> I'm sure others before me have tried to submit the story from Inquistr about The_Donald subreddit being a haven for Russians. My submission was blocked but I don't see the story anywhere.<p>Censoring, YCombinator? <comment><USER2> I don't see any submission from you for this. I've seen submissions from some domains get marked dead by default (often spam-type sites it seems). I don't know if that's the case here. Can you describe how you've tried to submit and what the failure mode has been?

As an aside, I can understand you might be frustrated, but please don't immediately assume bad faith or malicious intent. Even stories which are flagged dead can be resurrected by members who vouch for it or mods if they think it's appropriate. You've provided far too little information here for someone else besides a mod to easily figure out what might be going on. You can also contact the mods directly via the Contact link in the footer, which is often the most expedient method of getting an authoritative response.

<comment><AUTHOR> I'd like to believe you but I tried submitting from another account: [http://imgur.com/a/tDiA7](http://imgur.com/a/tDiA7)

<comment><USER2> > _" I'd like to believe you but..."_

I checked for submissions from the 'Calvin02 account, which shows no dead submissions for the inquistr story. Like I said, you gave much too little information about what had failed for me to try much else.

[https://news.ycombinator.com/submitted?id=Calvin02](https://news.ycombinator.com/submitted?id=Calvin02)

The image you posted shows a message that the submitted title is 13 characters too long, which is the reason it's not letting you submit. You'll likely be successful if you shorten the title.

<comment><AUTHOR> I just tried again with a shorter title (below) and still got the same error message.

"Reddit's The_Donald Was One Of The Biggest Havens For Russian Propaganda" (72 characters)

<comment><USER2> That's not an error message (though, FWIW, I can't replicate that message: I only see "X too long" when that's applicable, and 72 chars is well under the 80-character length limit). The submit button should be enabled, and you should be able to click it to submit.

AFAIK, if you're logged in and have a title that's of acceptable length, you should be able to submit. Any flagging or whatnot happens after submission: there's no filtering that happens before the submit button is clicked.

If you think something else is going on, or there's something that's affecting your account, I again suggest you contact the mods directly. If that _is_ the case, they're the only ones who are going to be able to confirm and address it.

<comment><AUTHOR> I've tried submitting multiple times with shorter titles but I get the same error (as the second screenshot in the Imgur link) after I hit submit: "Sorry, that story was previously submitted."

<comment><USER3> It's difficult to be sure with the public information, so I have to make a few guess ...

<guess> You probably submitted the story once and see that it was killed (automatically). Then you probably deleted it and tried to resubmit it (with a shorter and longer title) (from your account and from other account).

Probably some of the automatic spam filters can detect resubmission of deleted stories, perhaps for a short time. This is probably to prevent spammers form resubmitting stories that are flagged/killed. You are not a spammer, but automatic filters sometimes make mistakes.</guess>

In any case, to get an official reply, send an email to the mods.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> "Please don't post on HN to ask or tell us something. Instead, please send it to email@example.com."

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment><comment><USER5> Also - post things that are more interesting that Politics.

There is such an abundance of Political fodder that it makes political stories less relevant or interesting.

There's a place for it, but it's not here. If people wanted that, there would be no need for HN's.

It's not really censoring as much as that's the boring content that's on every other major news syndicate.

<comment><AUTHOR> This isn't about politics. It is about how tech companies are enabling outsiders to create political discord and influence elections.

<comment><USER5> The whole "influence elections" was interesting in the Spring of 2017 when Trump was recently elected.

Now it's just a dead horse that's being beat.

Let me give you the benefit of the doubt - Is this the first you have heard of it?

<comment><AUTHOR> This is the first I've heard of Reddit being used in this capacity.

In my opinion, Reddit could have had a greater influence than either Facebook or Twitter. On Facebook, the Russians ran ads and they used bots on Twitter but in both of those cases the total reach was probably less than Reddit's reach.

Also, while we are scrutinizing Facebook and Twitter (rightly), it is time that Reddit (the fourth most popular site) should also have to explain what it is doing.

</comment></comment></comment></comment><comment><USER3> The submissions to the Inquisitr are autokilled. See [https://news.ycombinator.com/from?site=inquisitr.com](https://news.ycombinator.com/from?site=inquisitr.com) with "showdead" enabled.

For an official reply, send an email to the mod in the morning firstname.lastname@example.com , sometimes they unkill the story.

<comment><AUTHOR> This probably explains it but definitely wasn't apparent in the error message shown.

</comment></comment><comment><AUTHOR> For the curious: [https://www.inquisitr.com/4790689/reddits-the_donald-was- one...](https://www.inquisitr.com/4790689/reddits-the_donald-was-one-of-the- biggest-havens-for-russian-propaganda-during-2016-election-analysis-finds/)</comment>


Show HN: Weekend project. Tool to help new Twitter users. Feedback appreciated - <AUTHOR> http://www.tweetoptix.com/

<comment><USER2> Interesting. I can see how this may help out novice users, but you'll definitely have to beef out the offering before it's worth paying for.</comment>


Tenure-Based Ownership – A distributed equity model for worker ownership - <AUTHOR> http://ianmobbs.com/projects/equity <comment><USER2> This strikes me as idealist and disconnected from reality. This is how some engineers think they should be paid without ever seeing the other side. \- the first year has a lot more risk than future years \- often, you pay yourself less when starting out \- raising money is hard \- finding your first customers is hard \- building from zero with no paying customers is much harder than adding features or reimplementing \- quitting your job is hard

I'm not saying that maybe early employees might deserve more equity, but to suggest that contributions in year 2 of a startup are somehow equal to those of the first year is laughable to me. Maybe strictly from coding contributions, but there's office space, culture, vision, etc. If it was that easy, that person joining would have started their own.

<comment><USER3> This comment strikes me as idealistic and disconnected from reality. It idealizes the mythos of risk/reward/effort for founders while minimizing the risk and effort of later employees. Founders work very hard, but I know people at Apple who work harder. Founders take financial risks, but I know people who've taken pay-cuts an order of magnitude larger than bootstrap costs to get 1% of a company that ultimately failed.

The reality is that there are no objective, consistent metrics which map risk to equity or effort to equity, all we have is cultural norms, pretending otherwise is a self-serving narrative.

<comment><USER4> Have you started a company and made it successful?

<comment><USER3> No. I've been a part of five startups, one which I founded, three are still going, one very well, the other two died (including the one I started.)

</comment></comment></comment></comment><comment><USER5> I believe alternative forms of ownership aren't discussed nearly enough. As we see more wealth become concentrated in the hands of fewer people, and with new companies being one of the sources of wealth creation, we need to re-evaluate our current system of corporate ownership and ask if it is really what's best for society.

I'm not necessarily sure if this is the best way of doing it or not, but I appreciate the viewpoint. I've thought about how best to manage company ownership in a worker owned cooperative, but I haven't settled on a personal answer.

<comment><USER6> I have occasionally thought that for worker cooperatives, equity that decays over time might be interesting. That is, shares are still liquid and can be held by non-workers and former workers, but they gradually expire. New shares would only be issued to current workers; one could set this rate and the decay rate to get a desired result. No idea if this has been tried or not.

<comment><USER7> I don't know whether it's legally possible to decay equity. Equity is seen as property, so once it's granted you can't just revoke it. You can expire or revoke options, but options themselves don't grant any right other than buying or selling the underlying asset. You could do something like a maturing bond, where it grants payout rights, but that doesn't give equity. You can just plan on a constant level of dilution, ala Bitcoin, but that doesn't ever actually remove previous ownership.

<comment><USER8> Lease the equity (and associated rights) instead of selling it, and include the decay schedule in the contract... Seems fine to me?

</comment></comment></comment></comment><comment><USER9> Certainly interesting to think about new forms of ownership, but there's some issues with this idea.

\- You have to have Coase in there somehow. When is a new line of work a new entity? Seems to be something to do with internalizing costs, the friction of negotiating externally, and as part of that the difficulty of valuation.

\- Say I'm a pro athlete. I hire a physio and a permanent PR rep to handle my social media. Now I'm in minority? Valuation has to come into it somewhere.

The problem fundamentally is how to pay people what they're worth, which in itself is a nebulous thing. Tying to some specific measure like time spent might be very wrong across different fields. The current "solution" which I'll grant is not entirely satisfying is that everyone just negotiates. If there's an amazing manager he talks everyone else into giving him a large slice of the pie. If there's a recent grad he gets a little bit, but gets his foot in the door.

<comment><USER10> Such an ownership model is certainly not suitable for the examples you bring up. One simple modification that might work for the pro athlete case is that the athlete always owns 70% of the company, and the rest of the team get ownership based on time spent. Or you could even allocate percentage ownerships to each division of the company. The PR team gets 15% divided amongst themselves based on time spent, the health team gets 10% etc, where the percentages are based on some notion of the value generation by each team.

The proposed model, I think is best of large companies with lots of workers - say a factory, where most people bring in roughly equal amounts of value. The high value people could negotiate earning ownership at 5x or 10x the base rate, for example.

The big point is that there is a massive space of possible ownership models and exploring them is a very interesting exercise. In fact, experimenting with such models is an excellent way of exploring and understanding how much value different people in a company bring and what they are worth.

</comment></comment><comment><USER11> > As America gets closer to full employment, workers are suddenly finding > themself with the most power they've had in decades.

This... does not comport with the available evidence. Workers in the US right now do not have a lot of power relative to the height of US unions. And saying the US is near "full employment" is a parlor trick of how you define who is and who isn't in the labor force, which is why we can have stagnant wages while being near "full employment" for some time now.

<comment><USER12> There was just a Planet Money podcast episode (#917 'Quit Threat') that gives some evidence of the opposite. Namely, that the status of near-full employment is giving unions more power, to the point of renegotiating two-tier contracts before the contract ends. It's not absolute across all unions but does seem to indicate more employee power as unemployment numbers decrease, even after acknowledging your point that there isn't an exact definition for "full employment"

</comment></comment><comment><USER13> This won't work very well in practice. You need to pay a new employee a _market rate_ , and if equity is going to be a part of that, it depends more on the value of the company than the tenure of its employees.

You can very easily overpay or underpay new hires in equity if you adopt this system. It seems to make it more difficult to find the correct amount.

</comment><comment><USER14> I don't think tenure based systems are excellent examples for growth, innovation, productivity or excellence when compared to more free market competitive merit oriented systems.

A firm could pay everyone the exact same salary, regardless of role or responsibility. But that doesn't quite work out in the real world with resource scarcity.

</comment><comment><USER15> This approach treats time as the only factor in determining the fair distribution of equity.

Slicing pie has a much more realistic set of methods

based on the principle that a person's % share of the equity should always be equal to that person's share of the at-risk contributions.

The method has been road tested by dozens of startups and I'm in the midst of using it for a new startup and find it to be quite approachable.

If you are interested in some research behind optimizing cooperative systems, check out Shapley Value.

Shapley Value assigns a unique distribution (among the players) of a total surplus generated by the coalition of all players. The Shapley value is characterized by a collection of desirable properties

[https://en.m.wikipedia.org/wiki/Shapley_value](https://en.m.wikipedia.org/wiki/Shapley_value)

<comment> em-bee this looks very interesting. can you add some details how that actually looks in practice? how do you evaluate what each person contributes?

</comment></comment><comment><USER16> The author doesn't provide any reason why this should be done. I'm going to assume it's some sort of ideological and moral (under some ethical frameworks that are not widely used) justification. The employee shortage that currently exists has not reached the point where people could make demands like this.

>Say you're a solo founder. You've worked full-time on your company for a year (4 quarters). You hire your first full-time employee after 1 year (4 quarters). After their first 3 months (1 quarter), you own 83% (5 quarters / (5 quarters + 1 quarter)) of the company, and the employee owns 16% (1 quarter / (5 quarters + 1 quarter)).

This completely ignores risk. let's say I've launched a startup on my own and after 1 year of work I am now hiring employee number 1. Presumably if I'm hiring anyone I've found some product market fit. So why does employee number 1, who is presumably earning a salary (something that the founder was not doing) and is joining a startup that is somewhat proven, deserve an amount of equity proportional to the time they have spent in the company?

It also ignores the motivation for many to start their own business. The obvious one is to be rich, another is for control and independence. Why would someone seeking these things give up such a large amount of equity?

If you want 16% equity in a company that you have not founded on your own, you need to either have been part of the team from the start (when the idea was not proven, and thus have taken the same risk as the founders) or you need to bring something that is transformational for the company to the table (sales, management, connections, technical knowledge).

<comment><USER17> The only way employee #1 gets hired under such a system is if they can increase the value of the company by more than 20% in 3 months.

That's unlikely to be the case (barring a company that is on the brink of failing).

</comment></comment><comment><USER18> This is a disastrously stupid idea. How are you going to attract talent after a few years when inevitably the people who were willing to join a start-up early to treat it as an experiment / fun project have engineered you into catastrophe & you have to hire people who expect real compensation and provide professional quality work outputs?

The people who join a start-up early are rarely the people who make it successful, scalable or growable. In fact, the early people are often to blame for terrible decisions that could have been avoided by paying real compensation to people with greater skill.

Person A might work at a company for 1 year and meritocratically accomplish more than Person B who has been in the same job for 5 years. Person A's contributions might immediately be vastly more vital to the company. This happens all the time.

This is all to say nothing of how tenure will become an issue of political favorites, luck of the draw regarding layoffs or project assignments, etc.

</comment><comment><USER19> in theory this works but there's a flaw: hours worked. How many hours worked isn't the same as much value someone has added to the company or how much work they've actually done.

In addition sometimes value added to the company isn't realized until months later. And sometimes hard work doesn't add any value to the company.

</comment><comment><USER20> I don't understand. I start a company and run it for a year. Then I hire a developer. 3 months later, that developer owns 16% of the company?

<comment><USER16> You understand it perfectly and it's as dumb as it sounds.

</comment></comment><comment><USER21> I understand the idea, but how does salary play into this? A founder providing all the money, paying a market salary is supposed to also give his first employee 16% of the company after 3 months?

Also, timing matters. Getting the company off the ground is much more risky and much more demanding than joining when it's smooth sailing.

</comment><comment><USER22> > With that, how can we distribute ownership of a company to the many, instead > of the few? How can we cement worker power and ownership for decades to > come?

Anyone interested in this should check out an existing model that's been going for decades already: a workers co-op. [https://en.wikipedia.org/wiki/Worker_cooperative](https://en.wikipedia.org/wiki/Worker_cooperative)

Having read some of the comments here; I can guess a lot of the objections and honestly the answer to most of them is going to be "Yes, that's the point". It's a totally different model. It's not for everyone and that's fine.

But they come with many advantages (disadvantages too, to be honest, but doesn't everything?). Do google it and spend some time reading up on it if your interested in this question.

<comment><USER16> > "Yes, that's the point". It's a totally different model. It's not for > everyone and that's fine.

"that's the point", what's the point? I don't see why anyone starting their own business that is not firmly entrenched in whatever ideology the author has would ever consider implementing this.

Not only is it damaging to the business (what venture capitalist would ever invest in a business operating under such a model?), it's also directly damaging to the founder who after 4 or so years wont even be in control of the company they've dedicated so much to found.

When a founder decides to abandon their office job what they really desire is to work at a business that is run by a committee of employees and power in that committee isn't determined by merit and skill but by _TENURE_. /s

<comment><USER22> > "that is not firmly entrenched in whatever ideology the author has"

But then you strongly talk about a startup, looking for V.C. funding with strong founder ethos. That's also an ideology. And if you want to do that, go ahead - this clearly isn't for you.

But a lot of people don't want to do that. And that's why workers co-ops were started in 1844 and have been going strong since - granted, a small fraction of the market - but a successful small fraction that has survived and is clearly not going away.

I'd just suggest people read up on them before dismissing this. And sure, I get that the majority of HN readers probably are going to decide this is not for them. But other people do like them, and have made a success of them, so if your interested at all in the original question, do check them out.

<comment><USER16> > But then you strongly talk about a startup, looking for V.C. funding with > strong founder ethos. That's also an ideology.

Wanting to raise money is an ideology? It's better to describe it as a practical way of expanding a business.

> But a lot of people don't want to do that. And that's why workers co-ops > were started in 1844 and have been going strong since

I just looked it up and there are an estimated 400 coops in the US with around 7000 employees total. This does not qualify as a lot. Almost nobody with the desire to create and run a business wants to run a business this way.

Also you missed the most important criticism, which is why is tenure of all things being used to decide who gets how much equity?

<comment> em-bee > Wanting to raise money is an ideology?

it most certainly is. with all the startups i was involved in the decision whether to raise money from VC or to bootstrap ourselves in other ways always came down to the believes of the founders. practical considerations hardly ever mattered.

</comment></comment></comment></comment></comment><comment><USER23> I wonder if this could be more easily adopted by Silicon Valley style startups if this ownership was of what would normally be the employee option pool rather than the whole company.

That way you'd still be compatible with venture capital, quarantine the hours worked dilution to the pool and you can treat founders differently to employees if you want by having founders shares outside the option pool.

</comment><comment><USER24> This is definitely a problem worth more innovations. But it should be kept in mind that the core idea of coming up with such a model is literally to design a contract. By recognizing that, it becomes evident that the contract must benefit, and be voluntarily acceptable, by both counterparties.

In finance, we already have a lot of innovations, thanks to the significant reduction of the transaction/contract-enforcement costs. I guess that is why it has not happened in other fields like employment contracts or partnership agreements. The designing and enforcement costs of any innovative contracts are just too high (considering you have to hire a layer to confirm all those changes and when you have to sue someone for violations).

<comment><USER22> It has happened: [https://en.wikipedia.org/wiki/Worker_cooperative](https://en.wikipedia.org/wiki/Worker_cooperative)

Co-ops being people who like to share, you should find plenty of examples online - here's one for UK co-op companies, for instance: [https://www.uk.coop/developing-co-ops/model-governing- docume...](https://www.uk.coop/developing-co-ops/model-governing-documents)

</comment></comment><comment><USER25> Ownership is more about control that sharing the profits. So after a few years the staff can fire the founder? nice. We must be getting to the top of this bubble.

</comment><comment><USER26> Suppose an existing company, not a startup, but an Fortune 1000 or so, wanted to shift to this model going forward. How would they approach it?

<comment><USER27> One option would be to set up a trust, backed by a lending bank, that would purchase an amount of the company for the purpose of eventually selling the stake to the workers. This is how most companies transition towards worker ownership with ESOPs.</comment></comment>


Compose for MySQL - <AUTHOR> https://www.compose.com/articles/compose-for-mysql-now-for-you/ <comment><USER2> For those like me who were wondering: Compose is a "Database as a service" company (hosting, scaling, consulting) for various databases (mysql, postgresql, mongodb, rethink, elastic, etc).</comment>


You cannot test for all browsers alone - <AUTHOR> http://ommunist.com/2013/you-cannot-test-for-all-browsers-on-earth/ You can't rule them all. <comment><AUTHOR> More to the point.

I am amazed and terrified how browser landscapes differ from country to country. In the UK iPad Safari is now ahead of Mac OS X Safari, and in Russia Opera became more popular than MSIE 8.0!

To sum it up, I now develop and test for the particular browser landscape, not for everyone. This is not overkill methodology, but at least it is sane.</comment>


Microsoft cloud services catch 300M fraudulent sign-in attempts every day - <AUTHOR> https://www.zdnet.com/article/microsoft-using-multi-factor-authentication-blocks-99-9-of-account-hacks/ <comment><USER2> I certainly doubt that 300m/day number. For me the real reason is clear. MS Cloud login is the worst in the industry. I'd like from time to time use some of their free services, like Azure CI. But it's impossible to login there. Even with autosaved passwords I cannot manage to login 99% of the time. No other web site's login is that bad.

It might be that I have no Windows. I remember when I developed on Windows I implemented the company login via NTLM and Internet Explorer login was transparent and automatic then. Good times. Only with Chrome or Firefox you needed to login.

</comment><comment><USER3> It looks like an interesting story, but the page is so bloated with ads its unreadable. Is there another source?</comment>


Stop Checking Email So Often - <AUTHOR> http://www.nytimes.com/2015/01/11/opinion/sunday/stop-checking-email-so-often.html

<comment><USER2> "Indeed, although the participants in our study sent and received roughly the same number of emails during both weeks, they reported doing so in approximately 20 percent less time during the week when they checked their email less frequently."</comment>


We understand why Etsy removes Electronics projects - <AUTHOR> https://www.tindie.com/blog/i-understand-why-etsy-removes-electronics-projects/

<comment><USER2> I'm the guy who got removed from Etsy.

I want to start by saying I think Tindie is awesome and that I've known about it for quite some time. There's a reason that I don't sell my products there and it's because I literally do put them together by hand. I don't use a pick and place machine, reflow soldering techniques, or order in batches of 10,000. I build unique instruments for unique people.

I don't mean to draw a comparison between my skills and those of the Haute couture sewers and needlework types or even suggest that we should install some kind of massive institution for overseeing what is and what isn't "hand made," but only to say there is a line and for the most part it's pretty obvious who's on what side.

<comment><USER3> There are very unique and laborious products for sale on Tindie, I don't think there is a requirement to produce in batches or minimum sales: <https://www.tindie.com/shopping/category/robots/>

<comment><USER2> I appreciate this, but it's very simply a matter of being associated with something "artsy" or "techy."

</comment></comment></comment><comment><USER4> The "handmade enough" argument can be applied to Etsy's more typical products as well. How handmade is a T-Shirt? Does the seller buy pre-made fabric or weave it themselves? Do they spin their yarn and thread or buy in in rolls? Do they forge metal buttons themselves? All of Etsy's products are in some way or another just a combination of other mass produced goods.

<comment><USER5> While I do agree with you - i think it's fair to say that Etsy have opted to focus more on the crafts side of goods (at least that's the impression their site gave me). While it is a great pity for the electronics goods that get rejected, it is still Etsy's business and their choice. Thankfully there is other options for the goods that Etsy choose not to adopt.

<comment><USER6> Then they need to rework their rules. Fine if they want to focus on crafts, but they shouldn't be throwing out people based on "not handmade" and then allow 250,000 types of "fabric". Most likely 99% of which are not handmade. <http://www.etsy.com/search/supplies/fabric>

<comment><USER7> their rules include "supplies," which include fabric. I have bought fabric on Etsy, both new stuff and vintage. (I have yet to buy handwoven fabric on Etsy, but it's just not my style.)

<comment><USER8> What's a definition of "supplies"? Keyboards + Monitors + Hard Drives + Motherboards + Cases are supplies for Computer Systems. Musical Keyboards + Cables + Stands are supplies for a band.

</comment></comment></comment></comment></comment><comment><USER9> I saw someone mentioned tindie.com in the other thread regarding this particular electronics project. Seems like someone over at tindie noticed, nicely done.

<comment><USER10> We did thanks!

</comment></comment><comment><USER11> Bravo, Tindie! Self-promotion without making anyone out to be a bad guy in this issue (I mean that sincerely).

<comment><USER5> I couldn't agree more. They saw an opportunity to gain exposure and took it yet still managed to present themselves in a way that was neither exploitative nor full of FUD (i know - i hate that term as well).

I wish more businesses conducted themselves this way.

<comment><USER12> Good for them, but I wish I hadn't wasted time clicking on their self- promotion.

</comment></comment></comment><comment><USER13> Good move. I'd love to see tindie get more exposure.

The last time I bought "maker" electronics from someone it involved finding a years-old forum post via Google and arranging the sale via email + paypal.

</comment><comment><USER14> I _can_ make you some transistors from scratch. Seriously, I have enough equipment in my garage (and at work). But you'd be an idiot to buy them, and I'd be an idiot to try and make money like that. But who knows? Maybe audiophiles would pay enough to make a living. Fnord's Transistor Boutique - The World's Finest Bespoke Transistoria!

</comment><comment><USER10> PS Tindie will be at Maker Faire Bay Area this weekend. Just look for us in Tindie T-shirts. We'd love to talk with you about your business.

</comment><comment><USER15> Early on Etsy did the same thing to the vintage collectors. Shortly after they let them build their stores again, but it was all in the name of 'not handmade enough'.

Etsy needs to clarify the definition of craft and the difference between that and handmade. It's an important distinction that they've never set a policy to.</comment>


Why the Web 3.0 matters and you should know about it - <AUTHOR> https://blog.goodaudience.com/why-the-web-3-0-matters-and-you-should-know-about-it-a5851d63c949 <comment><USER3> Worth noting that the term Web 3.0 was previously used to describe the Semantic Web, a revolution that seems to be largely dormant.

[https://www.w3.org/standards/semanticweb/](https://www.w3.org/standards/semanticweb/)

<comment><USER4> I was just about to mention that.

At least it still lives on in the metadata used for Google smart snippets, and it's used a lot in the life sciences, and on wikidata. I really wish it went further, but at least it's still useful for most intents and proposes despite the small ecosystem.

<comment><USER5> there is still _some_ activity going on, and an attempt to reboot the initiative, like with Solid ([https://github.com/solid/solid](https://github.com/solid/solid) with Tim Berners Lee behind it, i believe)

also 'semantic web' has become a bit of a loaded term.. 'linked open data' is now more commonly used (though this is a broader defined concept).

\--> i don't think blockchain will be web 3.0 (or higher version numbers for that matter)

Web 3.0/4.0 might be The Decentralized Web, though

</comment></comment></comment><comment><USER6> TL;DR riding the blockchain hype wave...

Though I wish the author were right about privacy, anti-monopoly, data ownership, and decentralization!

<comment><USER5> yes, i see a lot of content that basically suggests that blockchain == decentralization, while it is just a technology that works well in decentralized setups

i am most interested in decentralized technologies _without_ blockchain.. (might use that after the hype blows over), like datproject.org, scuttlebot.io, ipfs.org, etc.

</comment></comment><comment><USER7> Buzzword-heavy, dreamy-optimistic speculation on how the Internet might change.

What's the author's interest in this pitch?

<comment><USER8> The author appears to be the founder of one of the technologies listed at the end of the post.

</comment></comment><comment><USER9> There was a few things that made me question the validity of this post / claim. For one, I wouldn't call Steemit the next Facebook, it's more like the next Reddit or Medium. Second, where is Cardano when comparing with EOS?

</comment><comment><USER10> You know hacking is not just possible because the data is centralised. Hacking is possible because there are bugs in the software or the configuration - <USER2> simply there is a weak human element. So the so-called "Web3.0" will be secure as long as you fix all of these problems.

</comment><comment><USER11> TL;DR

        Instead of Google Drive or Dropbox, we have services like Storj, Siacoin, Filecoin or IPFS technology to distribute and store files.
        Instead of Skype we have platforms like Experty.io.
        Instead of WhatsApp and Wechat we have Status
        Instead of operating systems such as iOS and Android, frameworks such as Essentia.one and EOS provide a gateway to the new web.
        Steemit will play the role of Facebook, the Brave browser will serve as Chrome and Monetha will take over from PayPal.

you may buy it or not (in 2025?)</comment>


You're a moron, Torvalds, not a cryptographer - <AUTHOR> http://blog.sn4t14.com/post/5/2016-03-08/You%27re-a-moron,-Torvalds,-not-a-cryptographer <comment><USER2> Linus also wrote that "SHA-1, as far as Git is concerned, isn't even a security feature. It's purely a consistency check. The security parts are elsewhere, so a lot of people assume that since Git uses SHA-1 and SHA-1 is used for cryptographically secure stuff, they think that, OK, it's a huge security feature. It has nothing at all to do with security, it's just the best hash you can get."

(It's not security because it's stored together with the data. An attacker who can corrupt a particular patch has enough access to corrupt the rest of the same file. It's not meant to defend against an attacker, merely to detect accidental corruption.)

<comment><USER3> That's true, but the format of signed tags will need to change in one way or another. What we could do is to have a "shadow" tree which is built using a stronger hash algorithm (e.g. SHA256), and which is used for signing history. The shadow tree would be identical to the real tree except for the hashes and references to hashes.

</comment></comment><comment><USER4> The author seems to be missing a bit of Linus' point. It seems that the point Linus is making is that a collision along with the underlying data being meaningful is orders of magnitude harder than the collission, or produces easily detectable abberations. I'm not a cryptographic expert either but the author seems to be thinking more in a world of passwords where the underlying data often remains unknown. I think Linus is being somewhat pragmatic too and basically saying that if you think this is a problem then the whole thing is a house of cards.

</comment><comment><USER5> Very interesting way to start a blogging career: never learn about subject (SHA-1 and it's role in git), call creator moron and then rant on security issues with SHA-1 without realizing SHA-1 is just hash and has no security function in git (at least in context Linus posted his reply 10 years ago).

<comment><USER6> well, isn't it nice when a blog uncovers so much from its author right from the first post?</comment></comment>


Uber and Lyft drivers say apps are short-changing wages while raising fares - <AUTHOR> https://www.theguardian.com/technology/2019/apr/18/uber-lyft-drivers-surge-pricing-wages <comment><USER2> > _"There is an element of trust that we are relying on Uber to set the market > clearing price, and to the extent Uber and Lyft have market power, that can > be distorted," said Stucke. "They can create the rules of the game, they can > design the competitive process and they can ensure whichever driver makes > more or less, whoever wins in the competition among drivers, they can be > assured they're always going to profit."_

Seems to me either there need to be some antitrust laws brought down on companies like Uber/Lyft, or the laws that are already in place (if any) need to be better enforced.

If that's not the best way to go, then what else can there be done other than simply eschewing these ride sharing companies altogether?</comment>


Vowpal Wabbit: fast, scalable, useful learning algorithm - <AUTHOR> http://hunch.net/~vw/

<comment><USER2> This is the github page:

<http://github.com/JohnLangford/vowpal_wabbit>

</comment><comment><USER3> Is there a mailing list for the project somewhere? I asked a question in the blog comments (about the possibility of learning a matrix of values using a custom loss function, instead of a single-valued output), but I don't think these are read.</comment>