Bingo Card Creator (etc) Annual Report - <AUTHOR> http://www.kalzumeus.com/2010/12/17/bingo-card-creator-etc-year-in-review-2010/ <comment><USER2> Thanks for sharing your numbers, they are refreshingly honest.

I wonder if conversion rate from free to paid accounts is similar in other industries.

If so, the numbers are quite sobering.

If even a successful, highly targeted and well marketed SaaS product with 100K users and millions of pageviews makes as much profit as someone working for minimum wage flipping burgers, it seems that most startups don't stand a chance of ever getting ramen profitable.

I'm not deliberately trying to be negative, but I'm wondering why your revenues are so low even with such a massive amount of traffic.

Is your free offering so good that most people don't feel the need to upgrade?

<comment><USER3> I have an 8% conversion rate to sale per unique visitor. I wish I knew what I was doing right.

<comment><USER4> I think it has to do with your product, frankly. I imagine there's a lot of buying intent there.

</comment></comment></comment><comment><AUTHOR> If you have any questions, feel free. I can't answer the obvious juicy ones regarding acquisitions or clients, but other than that, I aim to please.

<comment><USER5> Do you use Facebook Ads ?

I've been spending a lot of time optimizing Facebook ads for my own startup over the last month or so, and I've been shocked at how poor the information out there is regarding it.

In a month of doing my own tests I've probably got more info on how to optimize Facebook Ads than is on any blog / website out there.

Given your love for A/B testing it be great to hear if you've any experiences with Facebook ads that you'd like to share ?

<comment><AUTHOR> "Like setting money on fire." describes everything I know about it.

</comment></comment></comment><comment><USER6> Hey Patrick,

I don't have a question, but I just want to say that you're a huge inspiration... and I'm so close to getting ready to take the plunge, get off my ass, and start working on my own projects.

Thanks for being so open with your experiences.

<comment><USER7> >so close to getting ready to take the plunge, get off my ass, and start

How close is that again? :p

</comment></comment><comment><USER8> We started going down the whitelabeling path with Doorkeeper, but ran into the issue that we were competing for mindshare with the whitelabeled version. I'd be interested to hear how you plan to approach the whitelabeling of Appointment Reminder.

</comment><comment><USER9> Seems like there's a bunch of recurring credit card payment services out there now; what made you choose Spreedly?

<comment><AUTHOR> A recommendation on a Rails blog. Investigated: sane pricing, painless API, worked with Paypal. That was my shopping list.

</comment></comment><comment><USER10> Have you ever tried making software targeted at the Japanese market? From what I understand, you might find a lot of niches as of yet unserved.

<comment><AUTHOR> I had an agreement with my employers that I would not, prior to quitting my job recently. I think there are likely huge, huge unexploited opportunities here, but the language barrier (I speak Japanese, but I speak English _very well_ , which rather helps when doing copywriting) and my lack of familiarity with the contours of the Japanese-speaking Internet (I couldn't name a major Japanese blogger if I tried, for example) always make me reach for the USA first.

<comment><USER11> The agreement was that you wouldn't work in the Japanese market at all? I agree with you about the huge, unexploited opportunities. ;-)

</comment></comment></comment><comment><USER12> Patrick, considering your chops (I think anyone who's read your posts on HN for a while will agree that you're in the '10x programmer' range), is there a reason why you won't launch a full fledged startup? Maybe even try out for HN? BCC is clearly at a point where it can be run on the side and that can take care of your 'ramen' needs while you focus on building something great.

<comment><AUTHOR> AR looks an awful lot like a "real" startup I'd you squint at it the right way. If I were willing to commit to the growth curve (and implied lifestyle) that taking investment commits you to seeking, I'd do it and start hitting up people for money. At present, that doesn't fit in with my plans at the moment, but if I ever decide to roll the dice YC will be among the first to know.

</comment></comment><comment><USER13> Patrick,

I'm curious why you worked as a salary man for the time that you did. You enjoy spending time with family/friends and money isn't a huge motivator, so why submit your self to the 70 hour work weeks and 3 hour commute?

And as other have said, thanks for the inspiration and information.

</comment><comment><USER14> If you had to live only from BCC's profits alone (25k~ this year), would you be able to?

<comment><AUTHOR> Yep. Ramen profitable for me is about $2k a month, counting taxes. Japan would be cross with me, though: the unofficial "below this line you are stealing our jobs" mark is three million yen a year. It is not maximally relevant to Immigration that I created the job to steal it.

<comment><USER15>
        the unofficial "below this line you are
        stealing are jobs" mark is three million
        yen a year.

Still a bit below the mark here (~2.4-2.5k euros/month for Austria, which is ~3.2-3.3m yen/year).

Kind of annoying when you have enough money to not need a job but not enough to not lose your work/residency permit.

</comment></comment></comment><comment><USER16> "Aside from frightening my bank a few times when I got large wire transfers from America, charging a lot of money is a great idea in every possible way."

That is a classic, congrats Patrick!

</comment><comment><USER17> I am know AR is still new, but can you shade light on traffic numbers related to AR?

<comment><USER18> Go to the lower third of the article.

</comment></comment><comment><USER19> Matasanos is the Spanish slang for doctor (literally, means "healthy killer").

</comment><comment><USER20> Thanks for sharing</comment>


Dinosaur tail discovered trapped in amber - <AUTHOR> http://www.cnn.com/2016/12/08/health/dinosaur-tail-trapped-in-amber-trnd/index.html?sr=fbCNN120816dinosaur-tail-trapped-in-amber-trnd0610PMStoryLink&linkId=32110038 <comment> crooked-v > McKellar said that soft tissue and decayed blood from the tail were found in > the amber but no genetic material was preserved.

Damn. I was looking forward to a park opening date.</comment>


What the fuck, Yahoo? - <AUTHOR>

Why is Yahoo hijacking my (Firefox & Chrome, though I mainly use Firefox) browser and how do I ban them from taking over my default search?  I set my browser up THE WAY I WANT IT and it pisses me off that Yahoo constantly changes my stuff.  I've done countless searches about how to fix this and going back many years people seem to have a similar issue.
I've tried all of these to no avail: https://support.mozilla.org/en-US/questions/952305
Is it possible to have my browser (AND YAHOO) respect my wishes and stop hijacking my browser?
Edit: I don't even use Yahoo for anything, nor ever visit their website, so it shouldn't be some sort of random leeching software that they attached while visiting their site, which is the most baffling aspect about this. <comment><USER2> The only reason for things to be "set back" after you change them is malware. Seems like someone is abusing a Yahoo referral code to make money off you.

<comment><AUTHOR> Is there anyway to ban Yahoo's IP, or internet presence from my computer? Being exasperated with dwindling options and Yahoo's insistence on being the persistent friend that you don't want in your life, I am open to completely banning them from my computer.

<comment><USER2> Oh what I mean is, it's not Yahoo that's changing your settings. There's some malware there that's changing your settings, and then taking credit with Yahoo for getting a legit install. It's abusing Yahoo's bounty program for money.

</comment></comment></comment><comment><USER3> My wife uses Yahoo and sometimes logs in on my machine via Chrome. No issue here.

</comment><comment><USER4> remove yahoo products from your computer, may be that will help

<comment><AUTHOR> I don't use anything Yahoo. I have been using Tumblr for a couple of years now though. Do you think they are piggybacking some malware with Tumblr users?

</comment></comment><comment><USER5> I'm late to this, but if I understand your problem correctly, you could tweak your firewall to auto-reject outbound packets being sent to Yahoo or Yahoo subdomains. You could also do this with a proxy intercepting all the requests your browser makes. Look at the headers and bodies of the packets and see if you can get a sense of what's going on in them to find out origin or referral codes for a possible abuser.

The next step is to remove the malware from your system. I'm assuming that you're using Windows (I don't think that's a dangerous assumption, as I've only ever seen toolbar malware and related on Windows). You'll want to google- fu the details you found in the packet headers. If that turns up nothing, dig around in your registry.</comment>


GitHub Supports Web Authentication (WebAuthn) for Security Keys - <AUTHOR> https://github.blog/2019-08-21-github-supports-webauthn-for-security-keys/ <comment><USER2> > GitHub supported physical security keys using the experimental U2F API for > Chrome

Yes, and to make it worse, they used user agent sniffing instead of feature detection even though it work fine in Firefox. Firefox enabled U2F because many sites which do implement U2F, do not implement WebAuthn yet. Luckily, it appears Github is now on the right track.

<comment><USER3> > they used user agent sniffing instead of feature detection even though it > work fine in Firefox

This is one of my pet peeves – and which is why the User Agent strings are so asinine (Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5370a Safari/604.1).

Whitelisting features based on Browser type, version, device type, OS type or version, or any version for that matter is almost always wrong. Like 99% of the time – if you think your case is special, you are most likely wrong too.

Basically it boils down to: "why do I care that this software is running this specific version?" If you are not writing a deployment script and some such and the answer is "because it implements feature X, or displays Y behavior", well, check that.

I've also seen iPhone apps trying to figure out which device it was, to display assets. If you care about screen resolution, that's what you need to check. Your device table will become obsolete.

Features may be backported(like in this case), bugs may be fixed, new weird hardware combinations may be released. Your application is not guaranteed to be in sync when that happens.

<comment><USER4> Why is something like feature checking not used for software dependencies like libraries as well?

<comment><USER5> Gun configure tried [https://en.m.wikipedia.org/wiki/GNU_Build_System](https://en.m.wikipedia.org/wiki/GNU_Build_System)

</comment></comment></comment></comment><comment><USER6> This is fantastic. I look forward to finally having much easier authentication on the web. Imagine browsers syncing between devices a single encryption key that will authenticate you to all sites, which you can easily back up to a piece of paper.

EDIT: Unfortunately, it looks like the WebAuthn credential is only used as the second factor, so you can't use it to replace your password yet, let alone your username.

<comment><USER7> As discussed before, biometric data (used by WebAuthn) will never be used as the single factor for authentication, due to the fact that you can't revoke your face or fingerprint once that data is hacked or leaked. Also, single encryption key is risky (in the way as using the same password across all websites) as it could be hacked or leaked. Username/Password would still stay as the primary authentication method at least for near future IMO.

<comment><USER6> > biometric data (used by WebAuthn) will never be used as the single factor > for authentication

WebAuthn doesn't use biometric data, the authenticator does. You can just as easily use a PIN or whatever you want.

> Also, single encryption key is risky (in the way as using the same password > across all websites) as it could be hacked or leaked

The difference is that one compromised site can't leak your encryption key, someone would have to physically get it from your computer or steal your security key (and, probably, need to guess the PIN in three tries).

<comment> dane-pgp > WebAuthn doesn't use biometric data, the authenticator does. You can just as > easily use a PIN or whatever you want.

Except the standard permits sites to only trust authenticators with specific features, or rather from a specific whitelist of manufacturers/models:

[https://www.imperialviolet.org/2019/01/01/zkattestation.html](https://www.imperialviolet.org/2019/01/01/zkattestation.html)

Of course, not every site will make use of this DRM-like anti-feature, but I can well imagine that a lot of sites/industries will adopt policies that treat non-biometric authenticators as insecure.

<comment><USER8> There is typically a significant UX impact on identifying the authenticator, some of which is effectively baked into the spec.

This is partially because it serves as a fingerprinting vector for authenticating users, and limits functionality (such as reusing the authenticator to access multiple accounts on the same site). This UX penalty will most likely dissuade people from limiting authenticators in cases where they aren't trying to meet AAL3 or rough equivalent.

Once you have an authenticator attestation, you can tie it to metadata on features, certification, and security incidents.

However, I actually don't suspect that real-world policy will rely on such dynamic metadata. Instead, organizations will limit the allowed authenticators to a static set of models, most likely models they issue to users.

So you'll see things such as banks allowing large money transfers only when you use the bank-issued authenticator, or having government contractors only able to authenticate into systems using the key fob they were issued.

<comment><USER9> I agree with you that we likely won't see this feature used much in the real world. I always tell Firefox to deny knowing which device model I have if asked. None of your damn business.

For personal accounts at least my experience was that a very large transfer (hundreds of thousands of dollars in a single transaction) required talking to two random employees. The first was a random call center worker who answered my call & the second was randomly chosen by the bank to run the whole process with me again to confirm. The web UI was clear that I would not be able to perform my transaction without talking to a human. Using two at random defuses the risk of internal collusion to defraud a customer. But I did use my good bank, maybe a mediocre bank would accept something a bit less stringent.

</comment></comment></comment></comment></comment></comment><comment><USER10> In a somewhat related vein: it would be really fantastic if Github allowed the same SSH key (in my case: a Yubikey-resident SSH key) on multiple accounts; we use separate accounts for different clients, and Github's refusal to allow an SSH key to be used on multiple accounts means I can't use Yubikey SSH keys for those.

I get that this is a niche-y concern. :)

<comment><USER11> That would require the ability to specify the username somehow, would it not, e.g. using firstname.lastname@example.com:… and email@example.com:… instead of firstname.lastname@example.com:…?

<comment><USER12> Yeah something tells me this is a deep change related to how they manage identity. GitLab has the same issue.

<comment><USER13> Bitbucket allows you to use your SSH key on as many projects as you like, IIRC. I actually really like Bitbucket as a platform, I wish more people would use it.

<comment><USER14> They were a great platform, but they aren't any longer.

<comment><USER13> Go on...

</comment></comment></comment></comment></comment></comment><comment><USER15> In the thread from the Yubico announcement earlier this week, someone brought up the question about why you can't disable SMS for recovery codes (SMS recovery codes, not SMS 2nd factor), since that undermines the security benefit of having your 2nd factor moved entirely to FIDO or OTP. Are there plans to fix that?

<comment><USER16> Be careful doing this, I've had friends who lost their accounts and it was a pretty big loss for them.

<comment><USER17> I would assume that GitHub support would be willing to provide some out of band authentication to allow someone to recover an account if all other options had been exhausted.

<comment><USER18> I personally hope they dont.

Time and time again it's been shown that one of the weakest links for account security is customer support. It's pretty trivial to gather enough information to impersonate someone well enough for most support reps to believe it's actually you.

It's also part of the reason why SMS is so insecure, because legally most phone companies can't _not_ allow you to transfer your number, and the ways they can verify you are you is limited.

If they do allow support account recovery, I hope they allow the ability to disable it for those who don't want the extra attack vectors.

</comment></comment></comment></comment><comment><USER19> I think security when it comes to third-party products is relative to personal value one sees into that product and to personal use case.

If your GitHub account is really that important as to use your fingerprint each time you access it, sure it is nice GitHub can support that.

But if you do not really mind and are happy with a password, that maybe unlike your finger, you can share with someone in other side of world if you really like to, then why not use a password. I would expect GitHub should not prevent that.

It is sad to see a trend to really "make sure it is you" started by Facebook and Google taking over in all mainstream online services and it is even worse, to have people believe it is the only good for them.

</comment><comment><USER20> > But there's more—GitHub's move toward WebAuthn makes it possible to use your > laptop or phone as a security key without carrying a separate physical key.

How does this work? Is an OTP generated on phone with Google Authenticator like app and that OTP needs to be punched into the login form?

<comment><USER21> Also would like to know how this works for multiple accounts...

<comment><USER8> Web Authentication is basically generating and proving ownership of a private key. You have some hardware/software that manages these keys - it will generate a key at registration time, and then prove ownership as part of authentication. The keys are tied to a web domain and the domain is also included on the challenge/response, which breaks active phishing attempts.

When you are using WebAuthn as a second factor with a hardware key, you are typically using non-resident keys. These are keys that aren't being stored by the authenticator, only by the relying party (in this case GitHub). A "handle" is given at registration, which must be re-supplied at authentication. This is actually how the U2F keys work - the handle has the only copy of the exported, encrypted keys or key material, so the authenticator can't understand a request for authentication without getting that handle.

So, in this case even though it is the same physical hardware authenticator, you have done two registrations, which have generated two separate generated key pair, each with a key handle. Those key handles are saved to different accounts. When I use the authenticator as a second factor, only key handles associated with that account are used for the authentication challenge.

There are wrinkles here because of the diverse ecosystem, of course.

Some software implementations (like Windows Hello) have no premium on storage, so they will still store second factor keys. These still need to behave as above, but Windows will technically know it has been used multiple times on the same site.

Also, when using Web Authentication for primary authentication, you use what is called a resident key. In this case, the key is saved in memory along with metadata on which site it was generated for. The challenge doesn't include handles, but is effectively asking "do you have anything perhaps for GitHub.com?".

In this case, some authenticators simply won't support multiple accounts. Others will, and the browser or operating system will take responsibility for selecting _which_ key is shared, via native UI.

</comment></comment></comment><comment><USER22> I've been waiting a million years for another branded sale on YubiKeys like the last time GitHub did one. Those things are so expensive.

Seems like a cool thing to sponsor, too - as long as it's tied to accounts to prevent underhanded measures.

<comment><USER23> A Solo key is $20.

[https://solokeys.com/](https://solokeys.com/)

<comment><USER12> Note that the feature set on this is limited. Specifically it is missing GPG (and thus SSH) support. It may be added via a software update if the somu campaign goes very well. But frankly that is a long shot.

[https://www.crowdsupply.com/solokeys/somu](https://www.crowdsupply.com/solokeys/somu)

Of course if you only need WebAuthn then solo keys are a great option.

</comment></comment></comment><comment><USER24> I wonder if Github has ever considered allowing a 2FA via the use of the private ssh key that's used for running git push or git fetch/pull?

<comment><USER9> Figuring out what sets of unrelated operations it's safe to do with the same private key is a problem. Definitely don't do this without a cryptographer examining all the operations done and telling you it's safe. Generally if asked they'll tell you to just make a new key instead because that's definitely fine.

Example: If an archaic backup MX mail server with private RSA key P is allowing SSLv3 "for backwards compatibility" then bad guys can use that to impersonate an otherwise unrelated TLS 1.3 web server that shares private RSA key P.

</comment></comment><comment><USER25> Great. This means I can log in on my phone again.

</comment><comment><USER26> And multiple security keys at that! This is excellent.

<comment><USER27> The fact that twitter is restricted to a single key is mind boggling to me. Is that a common restriction elsewhere?

<comment><USER26> Yes, there are precious few places that support sensible hw MFA _and_ allow multiple of them to be registered. It is quite maddening actually.</comment></comment></comment>


Chezjj: Itinerant Hackers, Scientists, Cylons - <AUTHOR> http://www.chezjj.com/

<comment><USER2> I'm staying there right now. (ChezJJ SF) The "captain" here is a very knowledgeable and charming young woman who is also a brilliant cook. The salad she usually makes for brunch is just amazing. (Don't tell my mom, but it's better than even her salads, and my mom puts most chefs to shame as it is.)

Culturally, Chez JJ is an autocracy, but a mellow one. Usually, everyone just does what's needed to be done, but there is someone who will give orders if needed, and you can even be fired in extreme cases.

I'm enjoying my time here immensely.

<comment><AUTHOR> Nice description.

</comment></comment><comment><USER3> I stayed at Rainbow Mansion a while back, and the calibre of people it attracted was fantastic. SF/The Valley need more hacker hostels like this.

++

</comment><comment><USER4> It's a wonderful place to stay. It's a fabulous place to met programmers and to be inspired. I am so glad I choose chez jj than single room in SF.

Downsides? Many. 1\. There's a lot happening and so many interesting people that your productively may at times waver. 2\. You are sleeping in a bunk. 3\. Awesome people. 4\. The entire space is shared. Privacy?

<comment><USER2> _> 2\. You are >trying< to sleep in a bunk._

FTFY. ;)

</comment></comment><comment><USER5> I've stayed at one of the MV houses twice now. It's an awesome place. I can agree with turnersr about the productivity. It is hard to concentrate at times, but that's because there are so many interesting discussions going on that one want to participate in. :)

Also, the at least the MV-house I stayed in had did have private rooms, which is what I've gone for both times.

</comment><comment><AUTHOR> How do you pronounce it?

<comment><USER6> Chez -> "shay" as in "home" in French

JJ -> "jay jay" for Jade and Jocelyn :)</comment></comment>


Introduction to monads in JavaScript - <AUTHOR> http://blog.jcoglan.com/2011/03/05/translation-from-haskell-to-javascript-of-selected-portions-of-the-best-introduction-to-monads-ive-ever-read/ <comment><USER2> Can anyone tell me, in what real-world practical situation, this would be a better design model than just normal IO-based logging?

Would there ever be a reason to do this in the browser? Or is this something that would be more useful in a Node.js environment, and if so, when? Or is it more theoretical than practically useful?

<comment><USER3> If we look at an impure language like JavaScript through Haskell-colored glasses, essentially every line of code in a JS program is automatically in the IO monad. Haskell's bonus is that it gives you the frequently-exercised option of writing code that's explicitly _not_ capable of doing I/O, simply by omitting IO from its type, and having this constraint enforced by the compiler. This self-imposed restriction helps avoid the numerous problems that come along with uncontrolled side effects. But since you can't "escape" the IO monad in JavaScript, there's not much point in making it explicit by doing output in a visibly monadic way.

That being said, there are plenty of uses for the monad pattern outside of the I/O domain. That's where a lot of emphasis is placed in Haskell, because Haskell couldn't do I/O without monads, but there are tons of other useful monads that have nothing to do with side effects. As the article illustrates, two of these are Writer and List (written as [] in Haskell). Another massively useful one is Maybe, which represents nullability, but by making it explicit in a value's type we can avoid a lot of the problems that arise in "nullable by default" languages.

In some sense, jQuery is an example of a monadic library, wherein the unit function is $, which lifts its argument into the jQuery monad, and bind is represented by the chain of method calls applied to that lifted value, each of which returns a different value, still wrapped in the jQuery monad. I've been told that LINQ in the C# world works similarly (in fact, there is supposedly a lot of bleed-over of ideas from Haskell into .NET because Simon Peyton-Jones works alongside some of the .NET language designers at Microsoft Research).

<comment><USER4> > In some sense, jQuery is an example of a monadic library, wherein the unit > function is $, which lifts its argument into the jQuery monad, and bind is > represented by the chain of method calls applied to that lifted value, each > of which returns a different value, still wrapped in the jQuery monad.

Aha. Thank you. Ever since I first learned about monads in Haskell (which is not so long ago), I kept noticing examples of such patterns in some libraries and was wondering whether it's only me who thinks there is a similarity.

<comment><USER5> I've found it easiest to understand monads as "the theoretical basis behind what a lot of languages think of as features". The purpose of understanding monads feels to me as an exercise in returning to first principles.

Naturally, this has the usual consequence of first principles: a lot of things that seem obvious are no longer Just There for you to Take For Granted.

That said, I'm not really prepared to say I understand monads. :P

</comment></comment></comment></comment><comment><USER6> If you like this sort of thing, check out the Arrowlets[1] library for JavaScript. It uses "arrows", an abstraction in a similar vein to monads, to make CPS functions and event handling neater (among other things).

[1]: <http://www.cs.umd.edu/projects/PL/arrowlets/>

From playing around with it, I think the arrows from that library are more useful to practical JavaScript programming than monads.

<comment><USER7> Since you're familiar with arrowlets, would you mind having a look at samsara?

[samsara]: <http://lcfrs.org/samsara/docs/dragndrop.html>

<comment><USER6> That seems cool--CoffeeScript's syntax is definitely better-suited for this sort of thing than JavaScript's!

The main page says the library's in CoffeeScript, but the drag and drop example uses JavaScript. Do you have a similar (or even the same) example in CoffeeScript? I'd like to see what it looks like.

<comment><USER7> There are two parts to example: the plain functions, and the composition. CoffeeScript can make the plain functions look different, but the composition is the strangest looking; I need to find a better syntax for representing a directed graph in code, and CoffeeScript doesn't help with that part.

</comment></comment></comment></comment><comment><USER8> re the comment in the original article about monadic javascript: take a look at roy. <http://roy.brianmckenna.org>

</comment><comment><USER9> Wow, I now understand monads. This article nailed it.

</comment><comment><USER10>
        ...it helps you spot accidental complexity...Being able to spot and extract
        such boilerplate can radically improve the clarity of your code.

I think a second version of this tutorial in CoffeeScript would really shine a light on how CS is the best of JavaScript. Monads and FP are a breeze -- practically encouraged -- in CoffeeScript. It really removes the cruft of JS syntax and lets me focus on well-designed code, and I've found myself using similar patterns since I switched to CS. I code faster and (contrary to what I expected) debugging is much easier.

</comment><comment><USER11> I've read many attempts to explain Monads by now, but this is the first time I think I actually "got" it. Well done!</comment>


Ask PG: Would Facebook have been invited for a YC interview? - <AUTHOR>

Assuming Facebook was just in the idea stage, would you have invited Mark Zuckerberg in for an interview?
His prior experience was pretty impressive (Harvard, Facemash, Synapse) but I assume he would've applied as a single founder. Without a demo, would a social network for college students in the days of Friendster and Myspace have been invited for an interview?
Are there any other big companies you can think of that you would have probably passed on assuming you didn't have a working demo to look at? <comment><USER2> As you noted Zuckerberg's experience would have been impressive, but I think his answers for all questions likely would have been impressive.

For example, "What do you understand that your competitors do not?" or the (chicken/egg question) "How will you get users at first?". Obviously Zuckerberg would have acknowledged the competition and how FB would distinguish itself as the college social network by limiting registered users to users with .edu email accounts and scaling growth from campus to campus, thereby generating untold interest among non-college email account holders around the World setting the stage for a flood of non-college users.

I am not saying that Zuckerberg's "growth strategy" was by any means a guarantee, but I think PG and team would have seen the wheels are turning with this kid and despite taking on the social network establishment of the time (myspace and Friendster)- who by no means had any intent of losing their market share - he devised a strategy to take a monumental task and turn it into "bite-size" pieces. Finally, as you mentioned he had experience/track- record to back-up his ability to not just think big but execute as well.

</comment><comment><USER3> Why would he have applied by himself? He was already working with his roommate Dustin on the programming end and had Eduardo on the business end. 2 technical founders + 1 non-technical founder seems like a solid base.

Given "theFacebook"'s traction was extremely high in the opening days/weeks of launch, AND all three founders had impressive backgrounds and were friends, my guess would be that they would have at least been invited for a YC interview.

<comment><AUTHOR> This hypothetical scenario is in the idea stage. According to wiki, it appears Mark Zuckerberg wrote Facebook himself and the other co-founders joined later.

<comment><USER3> Yes, he wrote Facebook himself but only after consulting with Eduardo; not to mention, Eduardo funded the initial servers and such.

So I guess the most realistic hypothetical question would be whether or not Mark and Eduardo would have both been invited for an interview. I'd still say yes. Given their main competition was myspace, their concept of exclusivity was an innovative and clear edge. In essence, at the time, I imagine their goal was to essentially make Myspace irrelevant by making Facebook a friends- only environment.

To address whether or not Mark would have been invited for interview if he had applied by himself: I also think yes to this, purely because YC seems to care about the people more than anything. Mark's track record before Facebook is extremely impressive so I would say AS LONG AS Mark expressed a desire to add members to the team (in the written application) before coming to YC, he would have been accepted.

</comment></comment></comment><comment><USER4> Zuckerberg probably wouldn't have applied. Judging from his Startup School responses last year, I don't think he considered facebook as being viable as a company until it was already quite successful.

</comment><comment><USER5> As I recall, Zuckerberg did seek investment. And he went looking for terms a little more generous. For 15 to 20 grand, some advice, and a friendly introduction to other investors, Zuckerberg wouldn't be willing to trade them a stick of gum. Much less 5% or more of his company. Ditto Bill Gates.

</comment><comment><USER6> Is this a personal complaint related to "single cofounder"?

<comment><AUTHOR> No

Edit: I think a single founder has a lot of disadvantages. I am simply curious of PG's response to this hypothetical situation.</comment></comment>


Cierge – passwordless authentication - <AUTHOR> https://pwdless.github.io/Cierge-Website/ <comment><USER2> Very cool. The magic link/email address as a ready made authentication platform feels very comfortable from a usability perspective. I'm curious if the venerable crowd here at HN has experienced any downsides to this approach. Are we (over)extending a notoriously easy to pown target in email by using this approach? Or is it just considered the same level of security as say a normal user/pass setup? I know zeit uses it for their system and that's a gateway to applications/websites/micro services/etc. I have to say that I like using it because it's so easy but I'm not sure what the implications could be in aggregate.

Edit: changed a word for clarity.

<comment><USER3> Premise: I just bought a Shield so I could start using Netflix on my TV (they still don't have an installable application for my old HTPC).

On topic: I generate all my passwords (variable length 30+ characters), and to log into both the Shield and (as a family account) my wife's phone, I had to type (or copy/send) the entire password in using a directional remote or a phone keyboard. No magic email link, no netflix.com/auth request, no PIN number, no personal wife account that I could include into my family plan.

Passwordless solutions can't come soon enough. the email route is fine for me, though I'm sure there could be better solutions too.

<comment><USER4> Netflix is one of the few things I've seen that supports google's Smart Lock for signing in. If I'm signed into the same account on my Shield as I use on my laptop, the signin is automatic for me.

</comment></comment></comment><comment><USER5> This is basically (but quite a bit more powerful) than the auth system that The Magazine used back then (enter mail address, get a link, click and have cookies set). I loved that and wish more sites would do something like that.

And from the view point of a site owner it's even better: you don't handle passwords anymore. Passwords that many users share among several sites. So you won't be responsible for really, really keeping them secure. Because you don't have them.

Additionally, mail providers and browser vendors have much more security knowledge than pretty much everyone offering a web service.

<comment><USER6> I hate this workflow. I need to copy-paste the URL from terminal to browser. Even if I used a webmail, I would need to constantly go there and search for a new mail every time I'm logging in instead of having the login form filled on my request.

<comment><USER5> You are doing this once per device, every n days, with n typically at least 90, possibly more. Your login form consists of a single field for your mail address which is autocompleted. I really do not see your point.

<comment><USER6> > You are doing this once per device, every n days

...with n being 2, and sometimes even 0.3. There are few services where I would want to stay logged in.

</comment></comment></comment></comment><comment><USER7> I never want my social media connected to other sites, and I never use the same email address for different sites.

How would this ever work for me?

<comment><USER8> dude, how many fucking email addresses do you have then?

<comment><USER9> Not OP, but I do the same thing using wildcard addresses on a domain I own. I might use email@example.com for Hacker News, email@example.com for Amazon and so on.

Foregoing the custom domain, some email providers also let you add tags to your address (e.g. firstname.lastname@example.com). I'm aware of some people who use that functionality to have unique email addresses for each service.

<comment><USER10> I also use this method. Thanks to it I usually can check if e-mail was automated and also I am not disturbed by e-mails with social media notification, shop promos or marketing spam during work. Also some e-mail providers allow to create many e-mail aliases which shares the same inbox.

</comment></comment></comment></comment><comment><USER11> I am not sure I understand how it works from a user's perspective? I login (using only an email), receive an email with a 'magic link' and this directs me to my authenticated account?

If that is so for the user, how does it work for the site owner? Cierge calls my site and requests a login from a given email, then the site backend conjures a URL which Cierge will use to create the magic link sent back to the user?

It would be very helpful to better understand if they explained the workflow for users and site owners.

If anyone can help me understand this and how it's better than OAUTH (logging FB, Google...) I would be grateful.

<comment><USER12> As far as I can tell, it's exactly the same as the password + one time code approach to 2FA...except without the password. Effectively the same as using Google Authenticator alone instead of in combination with a password.

</comment></comment><comment><USER13> I always wanted to do this. Glad someone did!

</comment><comment><USER14> Services, which use this kind of login do not work for me.

First: email is not a reliable way of communication. Emails can be delayed. That means, a service using this method has lost me before I even had a chance to look into the details of the service.

Second: my email is deliberately delayed for services who contact me first. It is called Greylisting and still to theses days it works great as a spam protection without consulting and relying on some (dubious) blacklist providers. That comes back to the first point. A service using this kind of on-boarding has lost me before I even had a chance to look at it.

<comment><USER15> How does this work when you sign up to a new service and they send an email confirmation to verify your email? Surely it's a similar situation?

<comment><USER14> Many services require email confirmation, that is right. But this is not required immediately. I can do this hours later. Some services even allow it to do days later.

<comment><USER15> Yeah fair enough. I've never used Greylisting before, is there not some folder you can go to to view the emails which have been deleted due to first contact? Like the spam folder or something?

<comment><USER16> That isn't how grey listing generally works, no

</comment></comment></comment></comment></comment><comment><USER17> Cierge means a votive candle in French.

Also using dotnet for things that suppose to run on server still makes me uncomfortable.

But I will try and I hope to change my opinion on projects like that.

<comment><USER18> I'd argue that .NET on server is the only valid scenario. ;) ASP.NET has pretty good security track record (10 CVEs in 14 years of existence with the most recent ones in 2010) and the entire stack (compiler, core libraries, ASP.NET core) are now open source.

<comment><USER19> It's not the open source stack that has that track record though

<comment><USER20> it wouldn't be the best record if it would have 10 critical CVE's since its release

</comment></comment></comment></comment><comment><USER21> > Cierge uses magic links/codes and external logins to authenticate your > users.

Could someone explain how the "magic links/codes" works ?

<comment><USER22> I presume it's the same idea as Slack uses, where they email you a link that you visit. It's similar to verifying your email address for most services you sign up with. That's not literally how it works though, just functionally.

</comment></comment><comment><USER23> Idea is fantastic, it is not quite new, but still great, however implementation is very flawed. One site is where I am loging in, other is where I am entering code, email with code arrives from third site. This is just bad to do like this.

What I would suggest, rewrite and organize everything and came back. Otherwise solid idea.

<comment><USER24> Cierge is stateless so it doesn't matter if you have 100 login tabs open, it'll always work - and once the code is entered it is automatically invalidated.

</comment></comment><comment><USER25> This seems less secure.

This reminds me of slack. The point of a password AND an email is that will essentially make it "two factor". With email only you are no longer two factor.

Once your email is hacked, you will be globally owned. No password required - they just need to send a simple phishing site to collect your email password.

You'll also need to logon to your email to access whatever site which means whatever keylogger is installed on whatever computer you use in some public place will also be a threat.

Hope this helps.

<comment><USER26> > Once your email is hacked, you will be globally owned.

This is also true for 99% of online services that have a "forgot password" function that uses your email address. If your site is in the 1% that needs stronger security, then don't use this.

> You'll also need to logon to your email to access whatever site which means > whatever keylogger is installed on whatever computer you use in some public > place will also be a threat.

Valid point, but it's an edge case that's not applicable to most people. The most common use for using a public computer is probably checking email. Even that happens less these days, which people just using their phones + public WiFi instead.

<comment><USER27> That's the point that I see as well. It's like if they get your email they will be able to get your user/password account anyways. So this seems like a decent way of getting rid of the password.

<comment><USER25> When user password are used for security, proper services have additional questions (in other words 2FA) to reset your password by email.

<comment><USER28> Additional questions are bonus passwords. They are _not_ 2FA.</comment></comment></comment></comment></comment>


Ask HN: Aussies, put your hands up - <AUTHOR>

If you're an Aussie and HN user, say hi! <comment><USER2> Brisbane, hi!

Recently moved to Brisbane from Canberra and starting knowtu. Looking at ilab and will make it to opencoffee sometime. Are there any good Brisbane entrepreneurship/tech groups someone could recommend? HN meetup?

<comment><USER3> Another Brisbane boy here. HN meetup would be great, since we seem to have a few locals. I can probably organise a casual venue one evening in the Valley? Maybe chip in for some drinks or dinner?

<comment><USER4> I'd be keen for that too.

There are some groups on meetup.com already, like <http://www.meetup.com/upstarta-brisbane-qld/>

<comment><USER3> Good to know. I'll be checking that out, and if it seems worth having something HN specific (or, more particularly, HN marketed) I'll put up a post here and drop a line to those Brisbanites mentioned in this post.

</comment></comment></comment></comment><comment><USER5> Just moved to Brisbane to start a startup.

<comment><USER4> Why did you move to Brisbane to start a startup? Are your potential customer's here?

At the risk of starting a heated discussion, my impression is that Melbourne is the capital with the most blossoming startup culture. (I'm in Bris by the way)

<comment><USER2> I would wager it's probably Sydney, but then again I don't think any Australian town is the clear winner.

Canberra had a lot of enterprise focussed software startups which didn't get much notice; but I think compared to the US equivalents, alot of Australian companies fly under the radar.

My belief is if you're starting in the Aus rather than the US it doesn't really matter which city you're in as long as it's got a reasonable feeding uni. Having worked and recruited with US and Aus staff I definitely think Australian software engineers are some of the best and typically suitably pragmatic for software startups. (Until they fully roll out the US style of generalist and masters, aka uni melbourne approach, but I guess we'll see)

<comment><USER4> Yeah I agree with there being no clear winner. I don't know of any area in Australia that has a sufficiently large cluster of startups to create a thriving startup culture.

That's why I'm curious about niko1 coming to Brisbane to start a startup. What's here that isn't elsewhere?

</comment></comment></comment></comment><comment><USER6> Brisbane developer, into govt research mostly. Involved with humbug (unix/linux), brispy (python), dorkbot (arts/eletronics), the edge (creative/design/tech), hackerspace (engineering/electronics), linux.conf.au and other things most likely :)

cheers,

</comment><comment><USER7> Sydney!! Hi... looking for an internship/grad position(final year).

</comment><comment><USER8> * codemoran puts his hand up <codemoran> sydney here.

</comment><comment><USER9> Hi! I'm a lurker from Bondi. Chasing the dream.

</comment><comment><USER10> Melbourne. No plans on startups though.

</comment><comment><USER11> Hello, London (originally Sydney) here.

</comment><comment><USER12> Melbourne (originally Madrid) here.

</comment><comment><USER13> Canberra here. (I'm not Julia Gillard, but sometimes on Call of Duty servers I pretend to be).

</comment><comment><USER14> Hi! Just north of Sydney.I love AbstractServiceLoaderBasedFactoryBean's (aka a Java hacker)

</comment><comment><USER15> Currently living in Clare but I'm in town often enough to say I'm from Adelaide.

</comment><comment><AUTHOR> Perth here, contact details in my profile if you want to chat about whatever

</comment><comment><USER16> London (by way of Brisbane).

</comment><comment><USER17> Sydney lower north shore. Recharging for another startup.

</comment><comment><USER18> Melbourne. Student at Monash University. From India.

</comment><comment><USER19> Hi! Brisbane here

</comment><comment><USER20> Melbourne here!

</comment><comment><USER21> Sydney North West. Lisp Hacker. Lurking.

</comment><comment><USER22> London here.

</comment><comment><USER23> Brisneyland

</comment><comment><USER24> Canberra. Rails. Hi.

</comment><comment><USER25> Hi! Brisbane here.

</comment><comment><USER26> do expats count? Melbournian living in Scotland.

</comment><comment><USER27> Melbourne here.

</comment><comment><USER28> Perth repping.

</comment><comment><USER29> Melbourne!

</comment><comment><USER30> melbourne!

</comment><comment><USER31> Sydney

</comment><comment><USER32> melbourne

</comment><comment><USER33> sydney!!</comment>


Google Image Search imgcolor= Parameter Allows Results Filtering by Color - <AUTHOR> http://images.google.com/images?imgcolor=orange&hl=en&q=color&btnG=Search+Images <comment><USER2> [http://images.google.com/images?imgcolor=red&hl=en&s...](http://images.google.com/images?imgcolor=red&hl=en&safe=off&q=white+shirt&revid=41942398&ei=F0LISfuVIJ6MmQf1goX4Ag&sa=X&oi=revisions_inline&resnum=0&ct=broad- revision&cd=2)

A search for "White Shirt" with imgcolor=red

Fun results

<comment><USER3> Good idea, but the results remind me of a Target commercial:P

If you switch the query to "dog bullseye" with imgcolor=red, 10 out of the first 20 results show the Target dog. If you remove the color restriction, only 5/10 feature the dog. So this feature potentially aids search accuracy.

<comment><USER3> Keyword based searching definitely has limitations. If a search keyword does not appear in the context of any "good" documents you're searching for, the search engine will not return any "good" results. In the example above, a search for "bull terrier" and imgcolor=red only returned 1/20 "good" result. And "bull terrier" has high semantic relevance. This is because the authors of the "good" documents I was looking for (e.g. the Target dog) rarely use "bull terrier" in the document context.

Plus keyword based search engines can be easily hacked to associate garbage with certain keywords.

I guess a color parameter would be considered semantic search? Here's a cool link (new today) about google integrating more semantic search features. [http://www.pcworld.com/businesscenter/article/161890/semanti...](http://www.pcworld.com/businesscenter/article/161890/semantic_search_could_secure_googles_future.html)

</comment></comment></comment><comment><USER4> Reminds me of this great piece of coding/data mining: <http://labs.ideeinc.com/multicolr/#colors=ea977e,5c259a>;

</comment><comment><USER5> Reminds me of the "find pictures on flickr by drawing" site Retrievr: <http://labs.systemone.at/retrievr/>

</comment><comment><USER6> how long has this thing been around? <http://www.google.com/advanced_image_search>

looks like you can search for faces and line art as well

<comment><USER7> You can combine the face search with color: [http://images.google.com/images?imgcolor=purple&hl=en...](http://images.google.com/images?imgcolor=purple&hl=en&q=color&btnG=Search+Images&imgtype=face)

</comment></comment><comment><USER8> It would be awesome if someone could make a mosaic generator using these tools (if they haven't already)

</comment><comment><USER9> I found that if you search for bikini, then adding an imgcolor really hurts the quality of results.

</comment><comment><USER3> It would be nice to submit an image as the search query and have results ordered by color histogram euclidean distance. Result pics would be of similar color and would probably often contain similar objects.

</comment><comment><USER10> WOW! IN my opinion Google is the best company ever. I don't mean this just cause of their products, nor there awesome work environment. Google has extreme pottential and really they make us all happy when they launch a new, cool feature.</comment>


Actual Cost To Make Popular Gadgets - <AUTHOR> http://blog.ziggytek.com/2009/07/05/actual-cost-of-popular-gadgets-to-make/

<comment><USER2> Quoting 5 sig figs is silly - those components aren't made in the US and so the price had changed by the time they wrote it down. Round to nearest $10 USD.

</comment><comment><USER3> This tells me that Palm might just survive after all, and RIM is up a creek without a paddle. The difference in margins on their respective high end devices is huge.

</comment><comment><USER4> Amazing that Sony loses $300 per unit on the highest priced Playstation.</comment>


Official Response to "Bancor Is Flawed" - <AUTHOR> https://blog.bancor.network/this-analysis-of-bancor-is-flawed-18ab8a000d43 <comment><USER3> I went through it, and I can't say that it's any better than what your average corporate response is like.

It brushes over Sirer's points by making note of irrelevant 'achievements' they have managed. The format also reads like a high school teacher nitpicking your paper, where most of his arguments boil down to 'yeah but that doesn't _really_ matter, because...'

I read the whitepaper (a cryptocurrency-fanatic friend pointed it out to me) just a few days before Sirer's post was published, and I noted a few of Sirer's main arguments immediately after reading it. It's not hard to understand the essential problems regarding limited reserves and market- trailing, and this response addresses nothing. It's wishy-washy investor- rubbing talk, not the legitimate debate and discourse they _say_ the want.

<comment><USER4> When they started off by saying it was going to be a "line by line response" I knew they weren't going to be applying the principle of charity[0] and addressing the most persuasive form of Sirer's argument and would be dismissing and—as you say—nitpicing his argument or side stepping the real issues.

[0] [http://philosophy.lander.edu/oriental/charity.html](http://philosophy.lander.edu/oriental/charity.html)

</comment></comment><comment><USER5> This is... not a good response. I've been reading Emin Gün Sirer for years, and his analyses have been very sharp. He's not always right, but he's right often enough that I take him seriously. I don't think it's reasonable for the Bancor people to ask the world for millions and millions of dollars _and_ be sad that people are not always warm and fuzzy in their responses.

It reminds me of those people who ask for feedback on something they wrote and then get upset when you give it to them. They didn't actually want feedback; they wanted compliments and ego-boosting. That's also a valid thing to want and ask for from friends when you're struggling through the writing process. But once you publish, the warm fuzzies end. Critics are not there for authors; they're working for readers.

</comment><comment><USER6> I can't see anything substantial in this official response.

I am mostly seeing a mild corporate language about how they want to build the future, how their team has credentials, how they opened up for feedback on many places ( _in the past_ , not now, convenient isn't it?), and there was zero substance on the article up until the first quotes, and it doesn't get better from there on as well.

I see nothing they defend their current business with. They mostly appeal to the past.

And not even that, they admit they've been doing other cryptocurrencies in the past. To me that doesn't you mean you're experienced in the area and you have what to offer. To me that means you're now a seasoned veteran who can swindle people with a smile while wearing a suit and using soft language.

Sorry, Bancor. You need to write a substantive article to be taken seriously.

</comment><comment><USER7> If there was a bad response to a critic, this will be it. While Sirer's post was a bit terse, this response doesn't earn brownie points by going the same route.

First, they start off as many "responses" in crypto currency seem to start that is - saying this is all FUD and the critic should stop spreading FUD. They also take the Trump route, not a great choice of words - "fake news".

Where I lost them was when they equated themselves as being so important to crypto currency space that critiquing them can be used to tag the whole space as being a giant ponzi scheme.

On still persisting, I found their clarification on "asynchronous price discovery" very funny. The point of a market making algo is to "make the market" ie they have to act as counter parties to each trade irrespective of whether there is a buyer or a seller (ie not a price matching algo). The price discovery in that process happens on how the market making algo is written.

Though I guess being programmers and writing a document for programmers they had to go with a technical term. But with someone who understands economics on their team, they should have done away with it.

All said, the most important part of a market making algo is not to provide liquidity or smooth prices. As Sirer put it, smoothing prices is a bad idea. If something is volatile it is because the market deems it to be so. Going against the market is not good.

I hope these guys watch this video carefully to understand how trading works: [https://www.youtube.com/watch?v=RLySXTIBS3c](https://www.youtube.com/watch?v=RLySXTIBS3c)

<comment><USER8> > Where I lost them was when they equated themselves as being so important to > crypto currency space that critiquing them can be used to tag the whole > space as being a giant ponzi scheme.

To be fair, the whole ICO scene of the past few months largely is a bubble phenomenon: an incoherent idea, incompetent code, and really obviously just creators who see easy money selling to buyers who see easy money. The critique is widely applicable. There are non-bogus ICOs, but mostly it's complete air.

<comment><USER7> Agreed but the same could be said about VC money and unicorns like Uber, Snap Inc. etc. It will be laughable if say Uber's CEO equates bashing of Uber's tech or business model as a threat to all unicorns.

One of the bigger problems I see with these ICOs is they that they don't offer much in terms of business viability other than maybe "cool" tech. I have been thinking of a purely profit focused contract(coin) on top of ethereum network. Something which provides value to people and the investors as well. Unfortunately not a programmer so it has to remain a plan forever.

<comment><USER9> > _but the same could be said about VC money and unicorns like Uber, Snap_

The same cannot be said about VC money going to unicorns. Those companies provide in-demand services that people use and enjoy, even if the business model is tenuous, there is clear value created by the services. Not true of ICOs which create no value.

<comment><USER7> My bad. My phrasing should've been better. I am not implying anything on the value side of ICO vs VC backed real world companies.

I am just pointing out that - No company is an island. Criticizing one doesn't implicate the whole industry as the Bancor guys try to portray.

</comment></comment></comment></comment></comment><comment><USER10> > Our thinking here is that people invented money to solve the [Double > coincidence of Wants] problem in barter, making trade asynchronous, more > efficient and predictable.

Fun fact, that's not true! It's called "the barter myth", and was put forward by Adam Smith in The Wealth of Nations.

But anthropologists everywhere have looked for 'pre-money' societies in their field research and haven't really found any. Bartering today happens in systems like prison where people are used to using money, but they aren't allowed to have (or there isn't) any. Everywhere we've looked, we find complex systems of credit, debt and/or quid pro quo.

Read it in a book called "Debt: The first 5000 years".

<comment><USER11> The "barter myth" isn't really considered valid economic history anymore--and I'm not sure to what extent it ever was--but it's useful to explain the purpose of money in a society that cannot reasonably keep track of informal debt. When modern people in modern economies no longer have access to money (from economic collapse, or being imprisoned, among other things) they often resort to barter. So the barter myth may not explain the economic behavior of primitive tribes, but it might explain us.

As for Graeber's book, I'll excerpt from a comment I made a while ago: he is frequently wrong about easily verifiable facts in such a way that it supports his world view. There's no reason to trust a liar when he tries to tell you something you don't know about. One particularly remarkable Graeberism is where he describes the founding of Apple:

> _Apple Computers is a famous example: it was founded by (mostly Republican) > computer engineers who broke from IBM in Silicon Valley in the 1980s, > forming little democratic circles of twenty to forty people with their > laptops in each other 's garages_

but there are plenty others, an exhaustive list of which would be too long for this comment. He's also a somewhat unhinged and deeply horrible person. All this is discussed here by leftist economist Brad DeLong: [http://delong.typepad.com/sdj/2013/04/david-graeber-april- fo...](http://delong.typepad.com/sdj/2013/04/david-graeber-april-fo..).

<comment><USER12> > Apple Computers is a famous example: it was founded by (mostly Republican) > computer engineers who broke from IBM in Silicon Valley in the 1980s, > forming little democratic circles of twenty to forty people with their > laptops in each other's garages

Umm...Apple was found in '77\. Laptops didn't exist then. Steve Wozniak worked for HP and Steve Jobs worked for Atari when Apple was founded. And IBM didn't even have a facility in Silicon Valley back then. Am I missing something?

</comment></comment></comment><comment><USER13> Well they _should_ learn though:

\- Their clients tell them the message is not clear so they make a video.

\- "Bancor is Flawed" says too many buzzwords make it unclear and fluffy.

\- You have to Google to understand the words according to Bancor themselves.

\- They even have to add parenthesis in this article to explain some words!

But they still think their message is clear. While I have no idea about this world, I do care about communicating my products/ideas. So just simplify the message, make it so people can just understand it.

The only place where an over-engineered message works IMO is with hyped products as everyone puts a lot of effort to understand it.

PS, I got lost in the article mid-way with so many acronyms while I could read "Bancor is Flawed" perfectly...

<comment><USER14> The best book for explaining your product idea is "Made to Stick" [1]. It has a great process for breaking your idea down in the most concrete terms and has some useful tools such as analogy to a similar product ("like dropbox for x").

The cliche adage here is that "if you can't explain your product in one or two sentences then I'm not interested". This is why the "Hollywood pitch" developed organically because people love to overcomplicate everything. VCs look for this as well.

This is why PhDs such as the author make bad people for communicating products. They love abstract terms and advanced hand wavy generalizations. Same with how corporate marketing people are similarily bad because they love buzz words and trends.

Ethereum is full of these companies that are hyper complex and I'm convinced that it's correlated to the number of academics behind all of them. They all have great website designs, they should spend similar time and money on good copywriting - which starts with the founders understanding their own product/service.

They all have a problem with communicating anything of substance. Ethereum has the same problem.

[1] [https://www.amazon.com/gp/aw/d/1400064287/](https://www.amazon.com/gp/aw/d/1400064287/)

<comment><USER15> So simplest way to explain Bancor is to call them a Bank? Has reserves, liquidates over the counter & centralized control (for better or worse).

<comment><USER14> The analogy to banks is helpful but products should:

A) explain what problem they are solving (what pain point they address)

B) have an obvious target user.

In this case: Why do I need a bank when using Ethereum? Is it a bank in the context of retail bank consumers as a storage/transfer mechanism or a bank for businesses? If I'm a business building a decentralized service building on top of Ethereum can I use Bancor to address a set of particular problems that are common among decentralized services?

There's more to this than choosing a generic analogy.

</comment></comment></comment></comment><comment><USER16> Disclaimer: I'm not well-versed in these things. Maybe I'm totally misreading the situation.

Their response to the "BNT is pointless" thing seems to say that BNT has a point because... they made the service require it. I still don't understand _why_ , apart from the founders wanting something to sell to investors.

My understanding is that the main things one looks for in a reserve currency are liquidity in the international market and (relative) stability of value, hence the popularity of the US Dollar and Euro as reserve currencies as opposed to, say, the Zimbabwe Dollar. If that's true, it seems deeply counterintuitive to create a new currency to use as a reserve currency. This sparks a suspicion that the point is not for BNT to add value to Bancor, but rather the reverse.

Am I just misunderstanding something here?

<comment><USER17> If you are missing something it's because it wasn't present.

</comment></comment><comment><USER18> Thanks for confirming that the original article was correct in its analysis and that you have no substantial rebuttal other than nitpicking. Aside from the _awful_ usage of "fake news" (almost as though you think it makes you sound more credible), your first rebuttal is this:

> At time of raise its was $153M within 2:25, this has been covered widely > including a formal statement on our blog.

I think you missed the point the article was making.

As someone who isn't very familiar with economics, the original article was clear and concise with very clear Gedankenerfahrung which encapsulated individual problems with the Bancor protocol. While writing technical pieces like that is difficult, this reads more like a bad teacher trying to save face when a clever student shows them up. You're just hurting your own credibility.

</comment><comment><USER19> TBH this response IMHO confirms most of the findings of the criticised article. So thanks for the clarification, dear Bancor people. I still fail to see how your system in any way implements the BANCOR plan that Keynes had.

</comment><comment><USER20> > Every buy and sell order is an (arguably superior) source of knowledge as to > what is happening in the real world.

If they replaced (arguably superior) with (real if possibly flawed) I might be tempted to take them seriously. But this belief in perfectly efficient market is hilarious, especially in the face of all the people getting rich out of market inefficiencies...

<comment><USER5> Definitely.

I think of markets as a technology. You have problem X, you can solve it with a market structured with A, B, and C. So it's really weird to me the extent to which markets have become a religion. In some quarters, a fundamentalist one.

I have similar concerns with Bitcoin. The technology is really neat. But it doesn't have users so much as it has adherent, devotees, and apostles.

</comment></comment><comment><USER21> > It is hard to reconcile claims like "mumbo jumbo" and "blah blah blah" with > legitimate critique

I just watched one of their intro videos[1] and can confirm "mumbo jumbo".

[1] [https://youtu.be/P8EoAvWfFnY](https://youtu.be/P8EoAvWfFnY)

</comment><comment><USER22> For reference: [https://news.ycombinator.com/item?id=14591454](https://news.ycombinator.com/item?id=14591454)

</comment><comment><USER23> I'm a fan of Emin Gün Sirer and I don't like Bancor's approach in this response, especially in criticizing his informal tone (who cares?), but it does seem that they're right that he's misunderstood two main points: (1) Bancor tokens are automatically created and destroyed as needed and (2) the pool is collectively owned by all the token holders and not the issuing company.

Disclaimer: I don't know whether this makes Bancor great.

</comment><comment><AUTHOR> Another very interesting response to another critique they received: [https://blog.bancor.network/response-to-bancor-unchained- cdb...](https://blog.bancor.network/response-to-bancor-unchained-cdb3bd2ba505)

</comment><comment><USER24> The Double coincidence of Wants is solved by any Medium of Exchange (MoE). The bigger issue in my opinion is how to manage the creation of new MoE. The current system "solves" this by empowering a group (banks) to issue new MoE via loans. We have a significant body of history on the "efficacy" of this approach.

How does Crypto currency, Bancor or other, improve the management/new creation issues?

</comment><comment><USER25> You would get absolutely slaughtered in a public market setting if this happened -- I love the idea of ICOs giving non-accredited investors the ability to invest in risky ventures, but you have to wonder about the diligence layer that comes with it, especially as organizations like Bancor do not have nearly the legal requirements for transparency.

<comment><USER26> Meh, I say let the fools spend their money however they want. Soon they'll understand why there are restrictions on investing in areas like this

<comment><USER5> Nope. It's like feeding pigeons. Pigeon-feeding is illegal because doing it results in an exploding pigeon population and pigeon shit everywhere. It becomes everybody's problem.

We want to keep the number of scam artists to a minimum, and especially to reduce the number of training grounds where novice would-be scammers become practiced experts.

Even if we have zero compassion for people who get rooked, there are a bunch of negative externalities to scams. A giant one is that trust is the lubricant of the machinery of the marketplace. The busiest and most efficient financial marketplaces are the ones that are the most effectively regulated. E.g., many foreign companies list in the US because people trust US regulators better than the home-country regulators, meaning they can raise money more effectively here.

A good analogy is restaurant health and safety inspections. If they didn't happen, more people would get sick. If people were often getting sick at restaurants, they'd go out to eat a lot less. That harms the whole industry, resulting in sub-optimal outcomes for both businesses and consumers.

</comment></comment></comment><comment><USER27> > _With Bancor, there is no need for two opposite wants to exist at the same > time in order for the price discovery (through actual trading) to function_

I don't understand. If everyone wants to buy, nobody will trade and price discovery will _not_ occur. Can someone please help me understand this?

<comment><USER28> That "at the same time" is the important piece. It means there's an speculator in the middle that will guess a price it can buy to sell later and make some money out of the transaction.

<comment><USER7> My guess is you talking about arbitrage[1]. As Sirer pointed out tokens on Bancor present a huge opportunity for arbitragers and it is bad. As time is an unknown risk factor, the speculator will simply buy on Bancor, take the token out and sell it on exchange immediately to make a profit.

[1][http://www.investopedia.com/terms/a/arbitrage.asp](http://www.investopedia.com/terms/a/arbitrage.asp)

<comment><USER27> Arbitrage transports price information between _places_ , _e.g_ if a stock is trading for 360 in Chicago and 370 in New York (after accounting for transportation ). Market making transports price information across _time_ , _i.e._ I buy a sheep at 9am and sell it at Noon. Arbitrage is classically riskless while market making involves significant risk.

<comment><USER7> Not really. The word you are looking for your second example about sheep is simply - speculator. Not market maker and not even arbitrage.

From [1]:The most common type of market maker is a brokerage house that provides purchase and sale solutions for investors in order to keep the financial markets liquid. A market maker can also be an individual intermediary, but due to the size of securities needed to facilitate the volume of purchases and sales, almost all market makers are large institutions.

The keywords being "provides purchase and sale solution". So a better example will be you staying at the same place buying and selling sheep as they come about, specially if there is no one to take up a buyer or seller on their offers or bids.

[1]:[http://www.investopedia.com/terms/m/marketmaker.asp](http://www.investopedia.com/terms/m/marketmaker.asp)

<comment><USER27> > _Not really. The word you are looking for...is simply - <USER2>

Market making _necessarily_ involves speculating. They're one and the same.

Modern market making has many conventions extraneous to the definition, but there are still markets where market makers only quote one side of the market at a time. For over-the-counter stocks in the United States, you are even allowed to offer soft quotes, _i.e._ the market maker can renege on a posted quote if they want.

The sheep example is resolutely a market maker. Just in an illiquid market.

 _Source: I used to be a designated market maker._

</comment></comment></comment></comment></comment></comment><comment><USER29> This response boils down to a combination of ignoring critical parts of the original post and repeatedly arguing that "yes, we're a ponzi scheme, that's why you want to get in early!"

</comment><comment><USER30> Their response to the front-running issues is great. "B-b-but miners _will_ behave!" and "Hey, ya ok, so that's bad but like, someone will fix it so whatever".

</comment><comment><USER8> yeah, not taking Emin Gün Sirer critiques seriously is not the sort of thing that works out well in cryptos.

<comment><USER31> He's often wrong on the market (infamously told people to sell Bitcoin at like $100), but that mostly seems to be about underestimating optimism. On tech critiques like this... well, he predicted the DAO attack in such detail that people accused him of being the one behind it. Seeing a non-response to Sirer here seems very, very bad for Bancor.

<comment><USER8> yeah, when a computer science professor calls you out for rolling your own math routines ...

<comment><USER31> Yeah... they had a partial defense there - the simple functions like add and subtract called existing functions with some wrappers for overflow issues, which they claim is standard practice for Ether (I wouldn't know). But the defense of exponentiation was just "there isn't a good one yet, so we built our own, and according to some tests we didn't show anyone it looks fine".

</comment></comment></comment></comment><comment><USER8> The first-up response was on Twitter: [https://twitter.com/BancorNetwork/status/876934646344404992](https://twitter.com/BancorNetwork/status/876934646344404992) [http://archive.is/75Gqk](http://archive.is/75Gqk)

"This hack job, like the FUD you intentionally spread right before the fundraiser with NO ATTEMPT to contact the team will not age well Emin"

(the responses go into his attempts to contact them ahead of time)

</comment><comment><USER32> After reading the comments on HN, this response is so flawed and disliked that the next post may be:

'Offical Response to the flawed "Bancor Is Flawed" Official Response'

</comment><comment><USER33> I'm flabbergasted by these ICOs and the monetary values associated to them. But that's just the tip of the iceberg really.

Then I think "well, let's see what this startup getting founded wants to produce". And then invariably it's some super "high concept" ultra-virtual "product" that is directly related to ethereum itself.

It's not a new google, facebook, uber or dyson. No it's a protocol that "enables built-in price discovery and a liquidity mechanism for tokens on smart contract blockchains" or sometimes "an open source messaging platform and mobile browser to interact with decentralized applications that run on the Ethereum Network" or even "a new exchange that facilitates secure trades between people from bank accounts to CryptoCurrency".

I'm a coder, I think I have a good general knowledge of how a blockchain works, I even have a passing knowledge of what those smart contracts are and how they're implemented (not enough to, say, implement them correctly myself but definitely more than 99.99% of the general population). Then I read about those innovative products and I'm simply drowning in a see of virtual concepts built on top of other virtual concepts. A concept of a concept of a concept.

See this for instance: [https://www.youtube.com/watch?v=P8EoAvWfFnY](https://www.youtube.com/watch?v=P8EoAvWfFnY) (avoid the comments at all possible cost).

I've watched the video, perused their website and I'm still not clear at all about:

#1 who needs this? #2 why do they need it? #3 how will bancor make money from this? #4 why do they need $144M to do it? #5 what prevents anybody else from just using the same algorithm and providing the same service at a lower cost?

The video even ends with the CEO admitting "we're only beginning to discover the different use cases". Well, looks like you have over a hundred million dollars to finish your homework now.

It's true for that bancor project, it's also true of [https://status.im/](https://status.im/) and a few other big ICOs I've seen in the past few weeks. Projects coming out of nowhere and raising a ridiculous amount of money. And then I google for those projects to see what others think about them and 99% of the hits are only talking about... the ridiculous amount of money they raised and nothing else.

I'm not saying that I'm certain that ethereum and those ICOs are scams but I think the ethereum community should work a lot harder to better explain what they're building exactly, because I'm pretentious enough to believe that I'm not dumber than all of those folks who've just collectively pumped millions in those ICOs. I'm willing to bet that many of those people are not betting on the products (or even that they understand those products), rather they see the insane valuations of cryptocurrencies and they want a piece of that.

</comment><comment><USER34> There is a very simple way to settle this argument. Anyone want to break the Bancor and give Cyber Wednesday a new meaning?

</comment><comment><USER35> > Should all token development stop now that we have ETH? Should ETH never > have been created because we had BTC? Should BTC never have been created > when the USD was already a liquid medium of exchange?

Bitcoin was created because it isn't possible to do Bitcoin with USD.

Ethereum was created because it isn't possible to do Ethereum with BTC.

Bancor was created because you want to make fat stacks of cash. It would work just as well (or better) if it was using ETH directly instead of having its own token.

Disclaimer: I am almost completely uninformed about Bancor.

<comment><USER36> > Ethereum was created because it isn't possible to do Ethereum with BTC.

I don't think that is true. You can absolutely reuse BTC for your so called "smart contracts".

<comment><USER37> That's not entirely true. Bitcoin's scripting language is not Turing complete, among other limitations that Ethereum addresses.

[https://github.com/ethereum/wiki/wiki/White- Paper#scripting](https://github.com/ethereum/wiki/wiki/White-Paper#scripting)

<comment><USER38> It is true that Ethereum has a more powerful scripting language. The real question, however, is if that feature has practical value.

I think the jury is still out on that question but I personally lean towards no. If and when there are profitable applications of this technology, ones that wouldn't have been possible without ethereum scripts then I will be glad to change my mind.

<comment><USER37> I agree that it is still an open question whether the EVM will have profitable applications. I lean towards yes.

It is (in my opinion) no question that the feature has theoretical value. I think the only question is whether that feature's value will outweigh the considerable costs of using a blockchain.

I think there are definitely cases where it will be profitable, but think blockchain tech in general is probably overhyped right now.

<comment><USER39> I would lean towards no but perhaps I will be surprised.

We have had about a year of dapp development gone by so far and there isn't a single dapp with any meaningful userbase.

I think if another year goes by and we are 2 years in the dapp development cycle and there is no successful dapp that will probably mean it's not a successful model.

I am also concerned about these dapps having insane valuations and raising huge sums of money just by releasing a vague whitepaper, without having a working product with users.

Normal startups would usually start with a seed round of hundreds of thousands USD but raising 50 millions or more is just obscene, that's a series B or C round for a fast growing startup with tens of millions real users and hundreds of employees usually.

I am interested how this whole situation plays out but remain skeptical for now.

<comment><USER38> I agree with you. I wonder if the best use case for ethereum scripts is actually with private block chains. For private chains the trust problem with external input to the scripts (which is needed for any serious dapp) would be minimized.

I've seen so many technologies hyped, fail to live up to expectations, and then disappear. Etheruem has some interesting ideas, I'm worried that they have grossly over-stated its potential and it will soon fall off the hype cliff.

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> What is wrong with the Bancor team defending themselves from unjustified, and close to vulgar, criticism? They gave very clear arguments, and you try to turn it into an emotional fight.

As a professor you should use exclusively rational arguments, and under NO circumstances emotional manipulation. It seems you've been paid enough to do the opposite. Shame on you!</comment>