Certified Malice - <AUTHOR> https://textslashplain.com/2017/01/16/certified-malice/ <comment><USER3> This is domain validation (DV). A DV HTTPS/TLS cert doesn't make any assertions about a certificate representing any particular legal entity. Authentication is to a domain: you have an encrypted channel to whatever that domain is. Some CAs used to do extra checks for suspect domains on DV certs but they're not required and they don't scale for automated systems.

        openssl x509 -in domain-validated-example.com.crt -noout -text | grep Subject
         OU=Domain Control Validated
         CN=example.com
         DNS:example.com

As opposed to EV which does. Authentication is to a legal entity, you have a encrypted channel to that legal entity:

      openssl x509 -in extended-validated-example.com.crt -noout -text | grep Subject:
        jurisdictionOfIncorporationCountryName=GB
        businessCategory=Private Organization
        serialNumber=09378892
        C=GB
        ST=City of London
        L=London
        O=example Limited
        CN=example.com
        DNS:example.com -

(Domains are also required to be reviewed by a human for EV)

Disclaimer: work for CertSimple, who only does EV certificates (which match a cert to a legal entity). Though I use DV for my personal site.

<comment><USER4> I would ask: if DV is an acceptable weaker alternative to EV then why do we need certificates at all? Why doesn't anyone allow HTTPS without a certificate- it would allow you to establish you are talking to the same server you thought you were 5 seconds ago. The reason, of course, is: that certificate-less HTTPS and DV are pretty much useless and huge net-negatives as they are confusing and imitate stronger certifications.

<comment><USER5> Why is DV useless? DV asserts that you are securely talking to whomever controls that domain. That's very valuable. If they're confusing, that's on the browsers.

Edit: You also _cannot_ just discard certificates and use HTTPS as an "I'm talking to the same server I was 5 seconds ago", because that does literally nothing to prevent MitM attacks. If you can't assert that you're talking securely to the domain owner, then there's nothing at all stopping someone in a privileged network position from intercepting and altering your traffic, because they could simply proxy it through their own server.

<comment><USER6> This is the same argument as "self-signed certificates are useless". They aren't. Not all interception is MitM. With spy agencies operating passive taps on infrastructure, as a fraction of your intercepted traffic, virtually none of it us. Completely unsigned, unverified encryption is still a massive roadblock to dragnet surveillance.

>does literally nothing to prevent MitM attacks

It does more than nothing. Especially if you make the reasonable assumptions that 1) the user is not being MitMed most of the time and 2) the user is likely to have connected to the (small) set of sensitive sites before they experience their first MitM.

Example: my home internet is unadulterated. I check my mail. My computer saves the certificate. I go to a coffee shop. I check my mail again. Somone tries to MitM me. My computer instantly spots a changed certificate.

Obviously we should still use and verify certificates. But I notice a nasty trend of making the perfect the enemy of the good in security. There's a perception that if it's not perfect, it's worse than useless and should be shunned (probably due to historical bad experiences with false senses of security).

<comment><USER5> Your computer can't simply remember the certificate that was used for the last connection, because then sites can never change their certificates (which would be a huge issue).

<comment><USER7> They could, for example, sign the new cert with the old one.

<comment><USER8> What if the certificate's private key is compromised? How would revocation work?

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> DV certificates are not meant to certify who operates a given site. They only certify that you are securely connected to the authorized server for the domain name, instead of being MITM-ed.

So, in effect, CAs issuing DV certs for websites, including phishing sites, is a feature, not a bug. If users are misinterpreting what a DV certificate means and doesn't mean, then it is up to browsers to make clear the difference between DV, OV, and EV.

A Domain-Validation certificate is just that. We shouldn't expect it to act like OV or EV.

<comment><USER10> We don't - but most of the rest of the browsing public doesn't know the difference.

<comment><USER5> That's why it's up to the browser to distinguish them.

<comment><USER10> The problem with that is that they haven't significantly done so yet - <USER2> people are well-trained to look for the green padlock to ensure the site is secure without much consideraton beyond that point.

So while I see your point, that's another transition that will take years to drill into public awareness - even if the browsers could agree on a meaningful and consistent representation, which seems like its own challenge

<comment><USER5> Safari has. There's no green on the address bar for a DV cert, just a little grey padlock. But with an EV cert you get the green text and the legal name (in addition to the domain). So that makes it easy - if there's green, you can trust it to tell you the legal entity that you're talking to.

</comment></comment></comment></comment></comment><comment><USER11> The big reason that cert's are as unused as they have been for two decades is because of the stupid desire to incorporate identity along with encryption.

They've both useful- they've more useful together, and they're expensive and not used everywhere because of the identity problem.

This is just going to have to be accepted (for a while?) to get proper encryption.

Pointing out that this can happen is neither useful or news, and perpetuates this nonsense that's been holding us back.

<comment><USER12> _stupid desire to incorporate identity along with encryption._

It's not a stupid desire. Encryption is pretty useless without authentication.

<comment><USER13> The average blogger cares that their password is encrypted when logging in to their blog. They probably don't care very much whether someone can also verify their legal identity, and in fact quite a few bloggers probably explicitly _don 't_ want that.

The average banker, on the other hand, does care about the identity verification.

Why have we decided that everyone must have the banker's use case?

<comment><USER5> DV doesn't do legal identity. It does domain verification. And that's exactly what your blogger wants. A secure connection without domain verification means you can be trivially MitM'd.

</comment></comment></comment></comment><comment><USER14> So the browsers should show the right part of the domain name in the bar if the domain name doesn't fit, instead of the left part. Or perhaps not show it at all if it doesn't fit.

<comment><USER12> [https://bugzilla.mozilla.org/show_bug.cgi?id=1236431](https://bugzilla.mozilla.org/show_bug.cgi?id=1236431)

[https://bugzilla.mozilla.org/show_bug.cgi?id=1271998](https://bugzilla.mozilla.org/show_bug.cgi?id=1271998)

</comment></comment><comment> pokemon-trainer It's very unfortunate there isn't a way to force more responsibility/accountability onto CAs who issue phishing certificates.

Of course, the non-internet version of a CA, credit rating agencies, do not behave any better with the trust given to them by the public.

Maybe the creators of the Bitcoin alt coin "namecoin" had the right idea.

<comment><USER12> _It 's very unfortunate there isn't a way to force more responsibility/accountability onto CAs who issue phishing certificates._

It's very easy: get the browser vendors to remove them from the root store. It's exceedingly effective. The "problem" is that the browser vendors seem to agree that CAs shouldn't be content watchdogs.

Did you read the linked position paper from LetsEncrypt?

<comment> pokemon-trainer That's very much a libertarian style nuclear option to remove a CA from the root store. Why can't the industry work out a fine to pay an ICANN-like org for root CAs when it happens?

<comment><USER15> A large percent of phishing sites are hacked wordpress sites.

So if a CA offers a certificate to a legitimate wordpress site, which then proceeds to let itself get hacked and host a phishing page, that CA now has to pay a fine?

</comment></comment></comment></comment><comment><USER16> I thought there was a plan to change browser ux to display DV https as simple white icon some time ago. Chrome and firefox. Unencrypted connections will show red icons and EV certificates will show as green. It makes sense in "encrypted by default" world

</comment><comment><USER17> Google and others could easily look for domain names on the certificate transparency list and immediately add anything containing "PayPal" or "baidu" or whatever to the block list, until it can be checked manually.

In fact, the browser itself could do this...

<comment><USER12> So we ban paypalsucks.com?

</comment></comment><comment><USER18> 1\. Store the certificate directly in DNS, signed by DNSSEC

2\. Have a way for user to easily and prominently display name or domain who is the certificate issued for, hardware button would be best IMO.

No participant in this CA racket has any interest for this to happen...

<comment><USER19> How is that different from DV certs?

</comment></comment><comment><USER20> > Users tend to be annoyed when you tell them only the truth– "This download > was not reported as not safe.".

First time that I am hearing users prefer a vague error explanation than truthful precise one.

And there is a silver bullet. Teach people - and most people already know it, don't assume people are idiots - how to recognize a domain name. Then the padlock. But, domaine names are infinte more important than padlocks. Always been the case and will likely never change in the near future.

<comment><USER21> > teach people how to recognize domain name

You say don't assume people are idiots. I agree, most are not. I will go further and say that, even among those who fall for these scam sites, most are not idiots (though the proportion is higher.)

But! You underestimate the scammers, and you underestimate the size of their toolkit. Sure, it's easy to look at an example like paypal.com.evil.com and think "I can teach users to read that properly". Maybe you can. But how about paypa1.com? And how about once we start playing games with Unicode? Can you tell a Latin lowercase A from the Cyrillic one? Are you going to teach users to copy and paste any suspicious URL into hex editor so as to make sure that its ASCII?

You're right about at least one thing: if you could get people to read domain names, that would be a silver bullet. And it's definitely possible to much better than now. But I worry that the scammers would simply up their game in response.

</comment></comment><comment><USER22> Definitely an issue. Chrome has already changed the SSL indicator to just read "secure" rather than naming the cert.

<comment><USER23> Not that I'm aware of. Still displays the verified identity name for sites using EV certificates, like [https://paypal.com/](https://paypal.com/) ("PayPal, Inc. [US]").

<comment><USER5> OP is talking about DV certificates. Showing the verified legal identity for EV certificates is correct behavior, otherwise there's not much point to having one.

<comment><USER23> If that's what they meant, I'm still confused. Chrome has never displayed a certificate name in the address bar for DV certificates -- the "Secure" text for DV certificates is completely new; older versions just displayed a lock icon there.

<comment><USER5> Chrome uses green for the DV lock, though, which is a bad idea. EV certs taught users that green means good, and then Chrome decided to use it for DV certs too. So users are taught that green is good, and when they go to a DV site they see green text and it says "Secure", so they think they're safe. This is absolutely terrible design on Google's part.</comment></comment></comment></comment></comment>


Ask HN: Do I need a degree for a job as an ML engineer? - <AUTHOR> Up until recently, I dropped everything and have been working on an ML project and studying ML, in hopes that I would be noticed (or at the very least, I'd have it to put on my resume). Recently, I learned it is near impossible to get a job as an ML engineer without a degree. Is this true? <comment><USER2> Unless you are exceptional enough to become somewhat well-known in the field, yes. It's not about ability and whether you can learn the material - you just won't even be invited for an interview if they have a whole line of PhDs (and MS's) waiting. The only hope would be to have people try to recruit you, which would mean that you're well-known, maybe through publishing high-profile open source libraries, dominating numerous Kaggle competitions, etc.

</comment><comment><USER3> It depends on your experience. To be honest I don't think majority of ml engineers out there had a degree in ml engineering.

It is true that without degree for some sort of certificate it will not be easy to get your first job. But I guarantee that after your first job your life as ml engineer will be much easier.

You will need to show expertise about machine learning, big data tools like spark, databases, Linux and shell programming.

</comment><comment><USER4> You need at least a related degree, such as computer science, at my company. A corsera course and a masters in information science would be helpful. Even then, they will likely take someone with a master's or PhD in AI/ML over an internal transfer. I had this happen to me.

</comment><comment><USER5> It's you vs the other guys. If they all have degrees... then yes. It's tougher without one.

Unless you're gifted.

</comment><comment><USER6> I just don't see how you can avoid it unless you're an elite learner.

Even just one course in a CS degree on ML or NLP has a ton of advanced concepts.</comment>


Show HN: A prototype natural-language processing based text recommendation engine - <AUTHOR> http://dpg.crsr.net/

<comment><AUTHOR> The data is taken from the Project Gutenberg 2010 DVD and includes 20,000+ out-of-copyright texts (typically before 1930 or so).</comment>


Do Things that Don't Scale - <AUTHOR> http://paulgraham.com/ds.html <comment><USER2> I saw this on a miniature scale when I created a new subreddit ([http://reddit.com/r/LSAT](http://reddit.com/r/LSAT))

I spent about two weeks creating quality articles for the sidebar, personally replying to every submission/comment, manually recruiting anyone who mentioned the LSAT, and reaching out to moderators of related subreddits for links.

Mercifully, a subreddit is a small thing to launch, and after two weeks the place became self-sustaining and grew to 1500 subscribers.

I'm seeing the same thing again with a website I just launched ([http://lsathacks.com](http://lsathacks.com)), which has free LSAT explanations.

Very positive initial comments, but just letting people know about it hasn't resulted in a surge of traffic. Instead, I'm going to have to manually recruit people. Only then will I know if it's worthwhile.

My point is that this doesn't apply just to high growth startups. Almost anything new requires initial unscaleable effort.

Edit: The LSAT is the Law School Admission Test, a logic test required for admission to North American law schools.

<comment><USER3> Thats a great way to practice user acquisition.

<comment><USER2> For anyone interested in using a subreddit to practice acquiring users:

Metareddit lets you track all mentions of keywords or phrases across Reddit. It let me find literally everyone who commented about the LSAT.

[http://metareddit.com](http://metareddit.com)

<comment><USER4> You should give [http://www.commentfindder.com](http://www.commentfindder.com) a try. I believe it has a more extensive index than metareddit which I'm pretty sure is based on google search.

I'd love any feedback.

<comment><USER2> Some quick notes. Mostly negative, only because I haven't used it long enough to notice advantages. Overall, it looks like a good site. Hope these are helpful:

* I couldn't block subreddits from the feed. In my case, LSAT is also a weapon in some popular videos games. On Metareddit, I was able to block the most common gaming subreddits so those results never came up. * Metareddit produced an actual feed I could check once a day for new comments. This is more of a search engine. * I have to hover over the link to see the subreddit. That's often very relevant

Apart from that, looks good. And obviously, these criticism depend on your use case. I used metareddit specifically for monitoring.

<comment><USER4> Thanks for the thoughts. I think the monitoring use case is a very natural next step. Basically "saved" searches.

On commentfindder you can exclude specific subreddits with "-subreddit:askreddit" syntax or target subreddits by removing the minus. Of course, I should make this more obvious, right now its kind of a cheat code.

</comment></comment></comment></comment></comment></comment><comment><USER5> This bums me out. Majorly. I work at a YC startup (which will remain nameless), and we function exactly the opposite of how this essay suggests. We aren't huge by any means, but we focus heavily on scale, and suppress ideas that do not scale. _Automate everything. Nothing should be manual_.

I'm an engineer, but I recognize the importance of fantastic customer service. While building an iPhone app, I suggested that users should have easy access to our hotline at every step of the purchase and post-purchase flow in case they ran into issues. The founder rejected this. Why? "People would be calling us constantly". We also spent enormous amounts of time and resources tweaking the app design to perfection (pre-launch), and attempted a massive press launch with exclusive blog posts/coverage while turning our noses at any sort of manual user acquisition.

Fast forward 6 months. That product failed.

<comment><USER6> _we function exactly the opposite of how this essay suggests_

Not sure if that is the case, but pg wrote last year[1]:

 _A YC partner wrote:

My feeling with the bad groups is that coming into office hours, they've already decided what they're going to do and everything I say is being put through an internal process in their heads, which either desperately tries to munge what I've said into something that conforms with their decision or just outright dismisses it and creates a rationalization for doing so ..._

[1] [http://paulgraham.com/word.html](http://paulgraham.com/word.html)

<comment><USER7> If this happens too often, the person with the ideas is probably the problem, not the "bad" groups

</comment></comment></comment><comment><USER8> "The Perfect Store" is a book about the early days of eBay. The primary takeaway for me was how they deliberately went to swap meets, flea markets and garage sales all over America — especially the rural flyover states — and talked to people. They identified the key influencers and flew many of them to California to be given VIP treatment. Those folks returned to their communities as true believers and encouraged their flock to get on the train. 15 years later that investment paid off more than any of them could have hoped.

That said, I suspect that there are many founders who would be open to taking the show on the road. It's incredibly daunting to know what that looks like, or where to start. I feel like it's not laziness, just unknowable to people used to tech communities and test suites.

To that end, my friend Ted and I think we've figured out how to help these founders take the leap and get in front of real people. Those people might be clients, developers or community leaders.

If you're interested in what we're doing, let me know. I'm happy to answer any questions you have, here.

And if you need help with hard problems, you should definitely call Ted: [http://usistwo.com/](http://usistwo.com/)

<comment><USER9> "I suspect that there are many founders who would be open to taking the show on the road."

I think this should be taken literally by many startups with national scope. Get the hell out of California, buy a used RV, stick the team in it and travel city to city while you build the startup. It's cheaper and you'll be able to meet more customers.

<comment><USER8> Well, yes: exactly.

I guess you could say that my current "startup" is helping founders do exactly this. Specifically, the exact part that happens right after you concede that it's a potentially great idea and right before you have any idea how to make it happen.

Where to go, who to talk to, and why.

You can follow the origin of the idea starting here: [http://reedwordsinamerica.squarespace.com/blog/2012/12/17/th...](http://reedwordsinamerica.squarespace.com/blog/2012/12/17/the- backstory)

</comment></comment></comment><comment><USER10> _You should take extraordinary measures not just to acquire users, but also to make them happy._

I'd like to elaborate on this point, because it's probably the most valuable thing I learned while working at Cloudkick.

Similar to how every Marine is a rifleman, I think every developer should be tech support[1]. It's an incredibly easy way to please users. Many customers don't realize how small your company is. They expect an experience similar to Comcast or Verizon: Listening to on-hold muzak interrupted by advertisements. Forced to enter obscure info such as an account number on a billing statement. Getting handed between people in various departments, each time repeating answers to the same set of questions.

To your users, it's as if they called Comcast and a cable modem firmware developer picked up the phone.

Could you imagine how much you would love Comcast if that happened to you? You'd still love it if the person said, "Oh sorry, that's a bug in our firmware. We'll probably have it fixed by tomorrow. I'll contact you with an update then."

That sort of support is impossible in a larger company. It makes your users outrageously happy. Many of them will praise you publicly and tell their friends how great you are.

1\. Modulo standard disclaimers, working at a small startup, etc. I also think everyone should be in the on-call rotation, but that's another can of worms.

<comment><USER11> I disagree with having developers do tech support. In fact I think it's insulting to those that are great at tech support. Tech support is a skill in itself, not just a place to let developers play.

If you really care about support, you'll have people with that expertise doing it.

Also, developing is really something where being in the zone gets the most productivity, and support is usually an intermittent and sporadic distraction, it can be a real productivity killer.

I see why people say this in pricinple, I just don't think it's a good idea in practice.

<comment><USER12> Tech support is a skill in itself, but it's also a crucial feedback channel for learning how users use your software. Empathy with users is what lets you distinguish a good programming decision from a bad programming decision when it comes to the software. Distinguishing good programming decisions from bad ones is what programmers do all day.

It's possible for tech support to work out as a disruptive distraction, but it doesn't always have to be that way. And yes, there are programming things where being in the zone is crucial, but there are usually programming things where it isn't, too.

</comment></comment></comment><comment><USER13> TLDR: Startups that try to focus on big launches are generally lazy. Success comes from putting in extraordinary effort to putting your customer first. This means you get super-enthusiastic users. This works by the principle of compound growth as users tell their friends.

Somewhat ironically I am of the opinion that:

(A) this is one of pg's best and most useful essays ever

(B) it is partially more useful because it is longer and more experience driven than some of his other "classic" essays (i.e. the theory behind why blub is bad and lisp is great)

(C) it is too long and could have been edited down a bit more

<comment><USER14> I agree that it's one of his most useful essays ever.

I didn't find it particularly long, though. It would be great if more top links on HN were as in-depth as this.

<comment><USER15> It felt like the main difference from most essays is that this one give lots of concrete examples of everything he talks about.

I'm in two minds about this. It makes it more accessible, but seems like it could divert attention away from the general point to the specific companies.

</comment></comment></comment><comment><USER16> This is probably my favorite PG essay to date, something I've spent a lot of time thinking about as well.

I think what separates novice investors from good ones is that a novice investor will start asking questions that only make sense at a later stage. They're committing a cardinal crime in startups: premature optimization. For some reason, even though they explicitly say they invest at the seed stage, they're looking at it from a warped lens of "let me think about how this works, in your current implementation, at enormous degree of scale." And of course the implementation will change, so the logic immediately breaks down on itself because you're assuming the thing you see now will be the same in 5 or 10 years. The baby analogy seems perfect for this reason. A baby will arguably have little to no resemblance to itself in 5 or 10 years, everything about it will have changed significantly.

The nice thing is you don't have to explain these things to the investors that "get it." It just clicks instantly, and I think this happens even before the meeting--it probably goes all the way back to the introduction that someone else makes for you. Good investors at a seed stage understand there's some degree of risk in a small yet still fragile startup that has at least some degree of promise to it. From the top tier people I've spoken to in the past, they focus less on the specific numbers and metrics, and more on the "does this fundamentally solve a problem in the market right now? Is there a real need for this thing to exist, and what's better about this than everything else out there?" They look at similar companies in different spaces and draw interesting comparisons. "You guys are like this other company, which started out much like you did, and you're applying a very similar solution. I think this will work!"

The really good investors don't try and evaluate your company as a Series D investment, they look at where you are right now at the seed stage and see it for what it is, and what it could be. I suppose this all sounds obvious, but the real world is full of surprises that contradict assumptions.

</comment><comment><USER17> The initial grind is a part of the startup fairytale that I feel is so often overlooked, yet is often the most interesting.

It shows just how the founders built their engine, the pieces they had to forge, parts that needed to be jammed together in some way to just barely function, components that were thrown out for costing too much and working too little. Every successful startup has their own engine. Some may be exact replicas of others. They work because the problems they tackle have been well explored. And others are bespoke, tailored specifically to handle truly difficult problems, and which require an immense amount of exploration, experimentation, failure, and restarts. That's why an Instagram can take off with less refinement and horsepower than an Airbnb -- we've developed the tools and built the maps to tread on one terrain, but not the other.

</comment><comment><USER18> Totally agree.

It's been discussed on HN before, but here's another concrete example of this sort of thinking: killing the no-reply address. IMHO, there is no reason your startup should use no-reply for any emails, ever. Yes, it's a hassle to sort through all the out of office replies, but it's worth it.

Even if you tell people not to, they _will_ reply to your newsletter or order confirmation or forgotten password message. And -- better yet -- they're often complaints! I like reading complaints. It's easy to find people to tell you you're doing great; I want to hear more about how we can improve. At my startup we make a point to reply to just about every message someone sends us (customer or not), but that's _especially_ true of complaints. More than once I've gotten back replies like, "Wow I didn't expect anyone to read [my rant about how the site doesn't work on an Android 1.6 tablet]. Thanks for getting back to me!"

<comment><USER19> Yes, that's a great example.

</comment></comment><comment><USER20> Thanks, I needed that.

Since I haven't launched yet, I have a big file system directory (a _folder_ ) of articles on how to get initial _publicity_ and users. While there is a lot good in that collection, it has looked to me like in total it wouldn't be good enough to get my little airplane off the ground.

For an example of the contrast, PG's essay had essentially no mention of an important role for _publicity_ \-- e.g., contact a writer at C|NET, TechCrunch, etc. for an article. Instead the essay had something that a founder could do on day one -- contact people they know and ask them to try it. Or try it for them and give them the results. And find a way to get feedback and then tweak the functionality. _Good_.

The essay just went to the top of my stack of how to launch. Best _face validity_ with also the best author credibility, experience, and background of anything I've got on how to launch.

Sounds good. Write a little more software and then _launch_ , one user at a time \-- people in the family, people I knew at school, neighbors on my street, the guy I buy pizza from, the guy who repairs my car, etc.

Maybe I'll print up a supply of business cards that invite people to connect to the URL and then use the e-mail address there to give feedback!

Heck, maybe I will even be able to get some useful feedback from some VCs!

</comment><comment><USER21> I'd be curious to know good ways to balance these various things that don't scale. I speak from a position of inexperience, but I can't imagine a fragile startup could possibly max out any of them. Given that, what are some heuristics for allocating focus across several unscalable efforts? Put another way, what are cues to focus more on one thing than another?

<comment><USER19> See the section labelled "Compass" here:

[http://www.paulgraham.com/growth.html](http://www.paulgraham.com/growth.html)

<comment><USER22> Thanks for posting this here. May even be worth mentioning in a footnote of this essay, as it provides a terrific bit of context.

</comment></comment></comment><comment><USER23> PG's point about a lot of startup founders having an engineering background is hugely relevant to this, beyond his assertion that "customer service is not part of the training of engineers."

Systems that don't scale, or that are reliant on the grunt work of humans, are not part of the training of engineers either. For so many engineers, an unscalable, human-dependant system is a bug, not a feature.

Is it too hyperbolic to say doing things that don't scale runs counter- intuitive to an engineering mindset? (I'm a left-brained, analytical, systems- minded designer, so I'm definitely not trying to throw stones at my peers.)

<comment><USER24> "customer service is not part of the training of engineers."

There's a huge cultural issue, its not just education. I'm not agreeing with this, but I'm going to tell it like it is, ignoring the problem isn't going to make it go away. So, that disclaimer said, "Engineering is for the smart kids, the ones smart enough not to end up working $8/hr until their call center gets offshored." "You better spend 80 hour weeks on your own time learning (trendy language of the week) or you'll end up in a call center at $8/hr until your job is offshored." "If I wanted to tell people which key is the 'any' key then I wouldn't have wasted all the time and money going to university." "I would never date someone working in the call center" "Sure its a call center, but sometimes we promote people out if they're any good" That's just real world modern business culture, and it needs to be addressed completely not "well, if we add a seminar to the engineering curriculum that'll surely take care of it"

At all companies I've work at, pretty much everyone thought customer service was the lowest possible level of humanity. Which is too bad; a mere job shouldn't define someones (self) worth as a human.

Places that claim to prioritize CS are usually just marketing, and certainly don't really mean it. If they did, their employment policies and wages would reflect it. They never do.

(edited to note, obviously this is a huge wedge a startup can take advantage of. Having someone who can speak English and expects to be rewarded financially is going to result in somewhat better service than modern international megacorp inc (bad) script readers)

</comment></comment><comment><USER25> I was watching a presentation the other day and heard a relevant story. It was about one of the early internet companies during the first dotcom boom. It was a change of address service. You would input your information and the services you needed to cancel and/or change the address for and it would handle it for you. This was in the early days of the consumer web, so none of these companies had APIs for this company to call or even thier own web forms. This company processed its early orders using old ladies at typewriters and fax machines.

I really wish I could remember the name of the company, but theyr were acquired very quickly for a stupidly large sum of money.

<comment><USER26> This reminded me about Joel Spolsky's Strategy Letter III ([http://www.joelonsoftware.com/articles/fog0000000052.html](http://www.joelonsoftware.com/articles/fog0000000052.html)), where he talks about a company called PayMyBills. PayMyBills would handle the user's bills and send them electronic reports of the bills each month.

Their strategy required the user to manually call each service provider to change the physical address to PayMyBills' so they would receive all the paper and process it. This created huge barrier of entry (who wants to call every single provider to change their address?). At the same time, if you end up signing up you're likely to stay in because of the time it took you to go service by service to change your address again.

FWIW I don't know what happened to PayMyBills but today their site redirect's to one of Intuit's service.

</comment></comment><comment><USER27> A great article. One major point that I think would have been worth including though is that if you are not interacting regularly with happy customers, and making unhappy customers happy, you are denying yourself probably the single most motivating factor when doing a startup. A single positive review on the App Store or through e-mail can get me through an entire day of grinding out bugs. If you don't have the humility and empathy required to genuinely enjoy providing customer service for a product you have developed, then you are probably in the wrong game.

</comment><comment><USER28> I can think of quite a few startups that used a big bang launch with press with success. Off the top of my head - Instagram (MG's series of pieces on Techcrunch), Mailbox, Flipboard, Square, Path. I get where PG is coming from but press can help bootstrap a network effect if you have none.

<comment><USER19> One of the reasons I wrote "there may be a handful that just grew by themselves" is that every time I learn the story behind one of these apparent instant successes, it turns out it wasn't so instant. I don't know the stories of all these companies, but I do know that Instagram's launch was preceded by a lot of manual recruitment of influential users.

<comment><USER29> Would you recommend that strategy--having a quiet, unmemorable, word-of-mouth- driven initial launch (which you can call a "beta period"), and then, once you've already got some hooks into the press and a good userbase, a follow-on publicity stunt (which you can call a "launch")?

<comment><USER30> This worked well for us at Close.io <[http://close.io.>](http://close.io.>)

We had a couple "soft launches" \- one where we put up our first email- collecting landing page and invited some people we knew to use the service (Sept '12). Another where we turned on self-signup on our website and invited more people (Nov '12).

Then after a couple months we had some solid active users and a small number of customers, we were also able to get 2-3 good press articles in the same week, which we now consider our official launch (Jan '13).

I think it's good advice to just keep "launching" until somebody notices :)

</comment></comment></comment></comment><comment><USER31> Great article. I also like Dereck Sivers post on manual work: [http://sivers.org/hi](http://sivers.org/hi) doing things that don't scale

<comment><USER9> Yep, a classic.

</comment></comment><comment><USER32> PG, I'm curious if you have any data among your startups that tests user recruitment methods. For instance, maybe you've seen that Reddit is great for gaining users in consumer startups but cold calling is great for B2B startups.

I think the biggest difficulty non-"famous" hackers face in user recruitment is it's hard to figure out where and how to successfully do it.

</comment><comment><USER33> PG, can you give a couple examples of enterprise startups that took the "consulting" approach to establishing successful (largely productized) businesses?

<comment><USER34> 37signals is one of them. They were in the software consulting business and built applications for in house use to manage their projects. They later realized that their clients need those applications as well.

I believe tumblr was a side project as well while the founder was consulting

<comment><USER35> I think this isn't what Seth meant: there's a lot of consultancies turned into product companies but it's different to start running a startup and then to work with your clients to find product market fit etc.

I would also be interested of examples

<comment><USER36> At least one example is [http://rjmetrics.com/](http://rjmetrics.com/) \- I saw the founder speak for a class I was in a few years ago. Their story is basically that they went to small companies offering analytics services and shaped their services based on what these companies asked for.

</comment></comment></comment></comment><comment><USER37> This is great advice. But I wanted to briefly mention an alternative perspective. We did things very differently.

Now two years later we have 250,000 monthly users, and we're getting ready to roll out our technology to them in a few months.

When you are building an app for people, businesses, or whoever, you have to go where they congregate. Pick an existing social network with a messaging channel that people haven't grown apathetic to. Then you have to have an onboarding process that's simple. Then you have to develop a sales process and maybe even incentivize your existing users to sign up others. Viral coefficients decrease your user acquisition cost. And so forth.

That's why we built our framework. We spent two years solving the problem of "how do you build the next generation of successful, useful apps? And soon we will see if we were right.

I wrote this back in 2008: [http://luckyapps.com/blog/?p=12](http://luckyapps.com/blog/?p=12)

<comment><USER38> I remember the cofounder of Dropbox also talking about this in an Stanford video. He was talking about promoting it, with ads, in Reddit. I think this kind of advice is the one where we need to put more focus instead of dev issues.

</comment></comment><comment><USER39> PG, thanks for this essay, it is such an encouragement for us, giving us a plan for how to approach our startup ([http://automicrofarm.com/](http://automicrofarm.com/)) growth for the next few months.

<comment><USER40> I totally love the concept you guys are working on.

<comment><USER39> Thanks, most people do. However, I'm afraid the concept is a bit too "puppies and rainbows". It won't be an easy road to get to the point that our products resemble the concept. In the meantime, we've gotten back some feedback (mostly from the aquaponics subreddit) that our existing prototype ( [http://blog.automicrofarm.com/post/48893635647/autonanofarm-...](http://blog.automicrofarm.com/post/48893635647/autonanofarm- for-sale) ) is too expensive and not high-enough quality.

So, there's a lot of work for us to do yet.

</comment></comment></comment><comment><USER41> This is brilliant, easily a top-10 of PGs.

re: consulting-- one advanced technique is to put the consulting "into a box" i.e. define precisely what the consulting package is, and offer this standard service at a standard price. If investors/etc. give you flak, tell them that your customers need this anyway, and at least your getting paid for the trouble. FYI I'm doing this now: many of our customers are young companies that need advice, and instead of taking an hour+ to give it free, we take a few hours and charge them. The actual work can be delivered by a number of people, so it scales fine.

adam (6 startups, 3 IPOs - #7 takes this advice to a whole new level and we're winning big, in spite of concern from my friends in tech, who exactly fall into the trap PG is talking about)

</comment><comment><USER42> I'm sure a lot of this is not new for some of you. I'm working on a product [1] and had all sorts of assumptions that I am revisiting after reading this.

 _I should mention one sort of initial tactic that usually doesn 't work: the Big Launch._

This set me right. I have been obsessing over the big launch. I laughed at myself after reading this.

 _And on a tuesday, of course, since they read somewhere that 's the optimum day to launch something._

Yep, that's me. I'm anticipating ridicule from my friends.

 _The need to do something unscalably laborious to get started is so nearly universal that it might be a good idea to stop thinking of startup ideas as scalars. Instead we should try thinking of them as pairs of what you 're going to build, plus the unscalable thing(s) you're going to do initially to get the company going._

I kept thinking that adding features was the way to keep getting more customers. My minimum viable product was a build system + share-new-version- with-beta-users. The laborious things I needed to do to acquire new customers I thought were adding new features: add a package manager, add test integration feature, add a code review tool, add iOS support, and so on. It just dawned on me that I haven't thought about the other laborious things I need to pay attention to: meet with the numerous mobile developers I know, do demos at local meetups, and constantly talk to people about my product.

[1] [https://appramp.io/](https://appramp.io/)

</comment><comment><USER43> _Instead we should try thinking of them as pairs of what you 're going to build, plus the unscalable thing(s) you're going to do initially to get the company going._

This is probably the most important thing a new entrepreneur needs to realize. Envisioning a world where everybody is using your product isn't enough. You need to figure out how to get to that world from this one, and that is where many entrepreneurs don't have a strategy, and subsequently fail.

</comment><comment><USER44> "There are two reasons founders resist going out and recruiting users individually. One is a combination of shyness and laziness. They'd rather sit at home writing code than go out and talk to a bunch of strangers and probably be rejected by most of them. But for a startup to succeed, at least one founder (usually the CEO) will have to spend a lot of time on sales and marketing."

Mike Arrington, before he was of Techcrunch fame, recruited us personally for the new company he had been hired as CEO/President of, Pool.com. Lest anyone thinks he does not know how to hustle he does. He can and was very persistent and determined with anything I threw at him. That ended up being a great relationship lasting many many years after Mike left the company. I feel fairly certain that a regular biz dev guy would have given up with what I threw at Mike. You may not have heard of Pool.com but they made a ton of money and were very successful.

</comment><comment><USER45> I find it fascinating that, with YC and HN, PG has essentially created a "business school for hackers" that is free, open to anyone, and makes it faster and easier for any hacker to gain a solid understanding of business and marketing principles.

And yet on the flip side, I see no one in the MBA/business world who is effectively doing the opposite i.e. creating a forum and/or institution in the mold of YC/HN for "business guys" to develop a fundamental understanding of (and respect for) technical leadership and software engineering concepts. I wonder why... Is it because it's more difficult, or more because business people just don't care and never will?

People often say that YC changed the VC industry, but in a way I think the YC and HN models together are slowly but surely disrupting the "business education industry" as well.

Thoughts?

<comment><USER46> My experience is that many product managers (who often are originally software engineers / in technical roles) end up in MBA programs

</comment></comment><comment><USER47> Even though PG didn't say it, a lot of ideas in this essay reminded me of Eric Reis / Lean Startup thinking. Getting off your ass and giving your customers rock star treatment is essentially the same as the "Genchi Genbutsu" philosophy that ER goes on about. The idea of an initial "manual" service like which Stripe provided is the same thing as a "Concierge MVP".

I have to say, as someone who left a big Fortune 500 company (which was a start-up when I joined it) just one week ago to start my own company, it's pretty refreshing to read articles such as this one. It's completely antithetical to being stuck in a large software group where you're trying desperately to have any contact whatsoever with customers to try and figure out what they want.

EDIT: spelling

</comment><comment><USER48> It's still easy to mess up this process though, at least, that's how I feel about RepairPal. I got an e-mail from my credit union suggesting them, and it was perfect timing cause I had just bought a used car that needed some repairs. So, I signed up, put in the info, and...nothing. No response whatsoever. But then, their marketing team sent me a semi-personalized e-mail requesting feedback. Awesome, so I wrote about the service not providing me with anything, and stating that I wanted to still use the service, I just hadn't been provided any response. And...again...nothing.

Now, I'll never use RepairPal. They've wasted my time twice. So, if you're going to take the time to reach out to users manually, make sure to actually follow up on the responses you receive.

<comment><USER49> Unfortunately, a billion minus one is still a large number. Thus, the penalty for annoying individual users is pretty much nothing unless it turns into bad PR.

</comment></comment><comment><USER50> Who wants to start a user-acquisition startup?

<comment><USER19> We've funded several startups doing components of that. It's hard to do in the general case.

Essentially, every startup is a user-acquisition startup in its own domain, and it's hard to beat the good ones at their specialty.

<comment><USER51> But the domains can be divided into general classes of users. If jawbone can recruit me for it UP band then withings can also recruit me for its body analyzer. Not all startups in health segment have do its own health conscious user recruiting. There is a lot of overlap between products and I am sure there is some market for a generic user recruitment.

<comment><USER52> My suspicion is that you don't want generic users. You want users who are going to stick with your product for a while and not jump from one train to another. Without them thinking that your product stands out changes are pretty low that they are going to talk with somebody else about it.

</comment></comment></comment></comment><comment><USER53> In other words, the only new markets that will be available will be the ones that are protected by some sort of "potential barrier." Otherwise, they would already be actively exploited.

</comment><comment><USER54> "But (like other ways of bestowing one's favors liberally) it's safe to do it so long as you're not being paid to."

We at blogVault love the above line. We often have our customers ask us for help with things completely unrelated to what we do. However, we always refuse to be paid for it. We always tell them that we are in the business of backups. Everything else we will help out but could not accept any payments for. It ensures that we don't have to commit to deadlines etc.

</comment><comment><USER55> Holy shit. This is exactly what I've been doing and it's working incredibly well. For PG to confirm everything I've been doing...I'm on cloud nine.

</comment><comment><USER56> This is a great essay. But since it's long, I suspect some people won't get to the last few paragraphs, which are IMO the most important:

"The need to do something unscalably laborious to get started is so nearly universal that it might be a good idea to stop thinking of startup ideas as scalars. Instead we should try thinking of them as pairs of what you're going to build, plus the unscalable thing(s) you're going to do initially to get the company going."

As someone in the "Startup Scene" for many years, and especially as a Software Consultant, I've talked with hundreds of people about their startups. And this is probably the _number one_ insight I wish more people had - startups are not just "having an idea" (what people used to think), they're also not just "idea * execution" (which is a great concept but incomplete). Rather, the fundamental building blocks of a startup is "what are you doing" and "how are you getting users". Almost everything else can be missing in the high level discussion, but not those two. It's taken me many years to understand this, and PG just put it in a very succint form.

</comment><comment><USER57> I had an odd way to follow this advice. I am learning to code and in 4 months I went from no knowledge at all to learning basic CSS/Html to basic C# to basic MVC to be able to launch and start selling a useful enough SaaS to acquire a few paying customers. I am just not a good enough developer to automate everything, I can't even code properly without Visual Studio helping me.

I am not dangerous, but I now know enough to be useful. I am trying to make my customers happy. The first feature I added after launch was something my first paying customer asked.

My product helps senior citizens to control their medications (what, when and how many pills they must take, which days, and alert when they need to buy more pills). I will start to put handouts on drugstores. Better than hoping elderly internet users know their way through google ads.

I spent 3 hours watching the first prospect to ever use my product taking a look at it for the first time (that would be my father). I left with literally 50 notes of what I should do immediately and some more thoughts of future features.

I am not a hacker, but I guess this helped me thinking more about what people want, because there was not much I could do from my own ideas and knowledge.

<comment><USER58> Speaking from personal experience, it's easier to pick up the traits of customer development/leadership/design with an engineering background. On the contrary, I've seen some of the smartest non engineer MBAs give up on programming. Not sure why.

<comment><USER57> I am not particularly smart, nor a MBA, or a McKinsey. I am learning to code to be useful, to build something useful, not build something great.

I would say that smart MBA try to learn to code to build something great, the next Dropbox, something that match their ambitions. When patio11 is your reference, not Bill Gates, or Zuckerberg, it is easier to keep your motivation. (Please, don't read this as me saying patio11 is not a great engineer, i couldnt know, just to illustrate the difference of ambition)

</comment></comment></comment><comment><USER59> I read this article 2 days ago in the night and that night I stayed awake all night. This is one killer article that made a lot of sense to me. As a freshly graduate engineer trying to startup, I am making the exact mistakes as mentioned in this article. I did try to automate tasks so that I can handle 1000's of users, when there is barely 2 people knocking at the door. What is even worse is that I do not even consider talking to these 2 people knocking on the door - I am an engineer, I am too busy trying to automate the process that I dont have the time to spend time with the customers, my code will. I cant believe how accurate the article is.

The reason for not talking to customers - I am hesitant - I am an engineer, I design stuff, I dont talk to people, that is not my job. I guess the problem and automate the system do that 100s of thousands of people can use it.

After reading the article, for the last 2 days I was very restless, maybe I still am. I was hesitant. But today I took the courage to take the product to the user and sat with him, showed the product and tried to solve just his problem, in a non scalable manner.

For those who might want to know exactly with respect what I am talking about. I launched a crowdfunding campaign for a hardware product - www.indiegogo.com/projects/tangle . The project is still live. The reason for doing the crowdfunding campaign was it because I was shy going around selling the product door to door. I did take feedback from friends but it I wanted to put it up on a platform and let things happen by itself. After launching the campaign, I realize how much people hustle to get the product to work on a crowdfunding campaign. Now I am taking the product offline and trying to sell it to customers directly.

This post is kickass... It just injected a lot of sense into me.

</comment><comment><USER60> I like this essay a lot.

In the early days of Apple, the founders placed minimum orders for parts on 30-day credit, then built the computers in 10 days and sold them before the payment for the parts came due. There wasn't any sexy software at that point. Apple was a hardware startup.

Web startups are in general probably more attractive to VC, but I'm excited about hardware startups.

<comment><USER38> I am excited too but since it is a mass scale business I think it is important to focus on machines/robots to build the hardware.

<comment><USER60> But at what stage do you adopt this focus? From Day 1? The point of the anecdote about Apple is that they began their startup by doing something unscalable. Not only was building computers by hand unscalable, but the financial risk they took was unreasonable. What if they failed to sell enough of their computers to cover the cost of the parts?

Many businesses that you see as "mass scale" may have began life as "small scale" ones. Check your assumptions.

</comment></comment></comment><comment><USER61> Loved this essay, but I'm a little confused by this footnote.

"[5] If you're building something for which you can't easily get a small set of users to observe—e.g. enterprise software—and in a domain where you have no connections, you'll have to rely on cold calls and introductions. But should you even be working on such an idea?"

When pg says, "Should you even be working on such an idea?" \-- is he saying that he questions any startup that is focusing on enterprise and which cannot be sold to fellow founders in a YC batch?

He once wrote "enterprise software companies sell bad software for huge amounts of money", so I suppose he doesn't love enterprise software that doesn't have a long tail customer base.

But, wouldn't this exclude a lot of interesting ideas in education, healthcare, government, finance, etc.?

<comment><USER62> You need to understand the secret handshakes and domain trivia in a particular enterprise space to be successful.

I have worked in government IT for years. When some breathless sales dude tells me that he has some sort of amazing solution for X that allowed Goldman Sachs to cure the common cold, I'm intrigued. When the sales dude doesn't know what a government procurement contract is, I just shake my head, because we probably wasted an hour or more talking about it. Worst case scenario, the sales dude captures the imagination of some big shot and gets fired because instead of selling stuff, he wasted 6 months filling out forms and missed his quota.

The guys who sell to my vertical already know how I'm going to buy the product, and sell to the attributes of the product that matter to us.

</comment></comment><comment><USER63> > And except in domains with big penalties for making mistakes, it's often > better not to aim for perfection initially.

I feel like this exception is another potential pitfall because it is so easy to think e.g. "if this doesnt look polished, users will think that we arent professional" and that is a big hit.

Although that is a more clear case, there are more ambiguous ones: imagine that your startup is doing encrypted email. What level of encryption/protection do you go with at launch? Do you go with the best practices as good as the founders know of or do you get an audit from tptacek? The latter is probably wayy out of your price range as a startup, but if your security takes a hit people wont know if they can trust you with their important information. What is the right line to go with here?

</comment><comment><USER64> The point about paying extreme attention to a single user's needs reminded me very much of _Stop Developing for the 90% Use Case_ : [http://gist.io/5561992](http://gist.io/5561992), which came up here a couple months back.

Basically it demonstrates the problem with aiming for the best ratio of user satisfaction to effort in each feature of your product. If each part of what you build covers 90% of users' needs, that sounds pretty good. But if your product has X main features, the percentage of users who will be entirely satisfied is 90%^X, which gets low very quickly.

You need to focus on servicing all of _someone 's_ needs, not most of everyone's, but consequently all of no one's.

</comment><comment><USER49> If you're willing to do whatever it takes, you can probably round up a group of early users (unless your idea is terrible). I think few founders really doubt their ability to do this. What the founders are really looking for is some validation that the users will eventually grow to a large number. But if the mentality is to compare your early startup with the early version of Pinterest, it will be very hard to find any evidence that yours won't find similar success. A startup is thus an inevitable leap of faith.

In a way, this essay deflates the concept of 'proof' in the lean startup mentality. There is no way to prove that an idea will be a good one (although you can probably filter out particularly bad ones).

</comment><comment><USER65> I've been thinking about this "narrow focus" idea, and I'm not sure how to or whether I should apply it to my own idea. I'm working on building a tool that's supposed to provide a free-form way to record and organize ideas. I think it could be especially useful to writers, and I use my prototype for task tracking. But if I target it to any specific group, I'm afraid it will get pigeon-holed as a "writer's tool" or "task tracking tool" or whatever, and it will be hard to generalize from there, especially once I start adding domain-specific features. How does one usually make the transition between niche and general markets?

<comment><USER66> From someone who's never actually done the startup thing: when you feel like your product is good enough to stand alone, outside of the specific domain you originally targeted for, you likely have to have a second round of "initial" user acquisition, where you cater to, and iterate on, the needs of more general users you recruit.

<comment><USER65> But if you try too hard to get that one domain, you may not reach a point where it's "good enough to stand alone, outside..." because, while your execution was good, you moved in the wrong direction.

</comment></comment></comment><comment><USER67> Related: [http://www.paulgraham.com/schlep.html](http://www.paulgraham.com/schlep.html) and [http://paulgraham.com/startupideas.html](http://paulgraham.com/startupideas.html)

</comment><comment><USER68> Good article. One small thing that wasn't clear to me is

 _The feedback you get from engaging directly with your earliest users will be the best you ever get. When you 're so big you have to resort to focus groups, you'll wish you could go over to your users' homes and offices and watch them use your stuff like you did when there were only a handful of them._

Why can't you do that once the company gets to a certain size? I don't have any experience with these things, so it's not clear to me. Surely there must be some better alternative than focus groups.

<comment><USER69> Sample error.

When you had 100 users, it was feasible to get detailed feedback on 90 out of 100 users. When you have 1.5m users, you cannot get detailed feedback on 1.35m users. Dealing with much smaller fractions of your user base, sampling error grows into larger and larger an issue. That's not to say there aren't wonderful statisticians working on sampling issues, but fundamentally it's not the same as _actually_ interacting with the vast majority of your user base.

</comment></comment><comment><USER70> I think a key thing here is "plan to systematically do something that doesn't scale if the rewards are big enough". And the common bias is thinking that the rewards are not as big as they are. If it's in your top 3 problems and manual work is a path to scaling automatically, you should probably do it.

However, at some point short-term velocity is also contributing speed bumps that are barriers for reaching the next level. I certainly wouldn't want to be doing this ad-hoc or without consideration.

</comment><comment><USER71> Whoa....this footnote flies in the face of the 'charge early' crowd:

 _[8] If you have to choose between the subset that will sign up quickest and those that will pay the most, it 's usually best to pick the former, because those are probably the early adopters. They'll have a better influence on your product, and they won't make you expend as much effort on sales. And though they have less money, you don't need that much to maintain your target growth rate early on._

Very interesting perspective.

<comment><USER72> Note that is probably written for the Startup goes VC route. It may be different for the Bootstrappers.

<comment><USER71> True. Either way...a famous refrain is to charge as quickly as possible.

</comment></comment></comment><comment><USER73> I am so glad to read something about hardware startups here. As a engaged hardware engineer who aims to build my own company soon, I miss reading more about hardware startups.

Funny thing, I read the whole OP thinking about how all these ideas would work in a hardware startup, and came to conclusions similar to his before reaching the point about it in the article.

Crowdfunding brought some fresh air to this world, but I still miss an active community as the software startup one is. Maybe I am missing something?

</comment><comment><USER74> Great essay. But I'm surprised PG didn't mention Pretotyping. Here's the Pretotyping PDF that hammers the point: make sure you are building the right IT before you actually build IT:

[https://docs.google.com/file/d/0B0QztbuDlKs_ZTk2M2RhZWItYzk3...](https://docs.google.com/file/d/0B0QztbuDlKs_ZTk2M2RhZWItYzk3YS00ZDZmLTgyZjItY2Y2ZWIyYjZkOTE3/edit?hl=en_US)

</comment><comment> k-mcgrady Took a lot from this essay. I've a pretty short attention span and usually drop out half way through essays this long but I read this to the end. As someone preparing to launch in a few weeks and trying to get some customers signed up for launch there was some great advice here on acquiring customers and treating them right. Thanks PG.

</comment><comment><USER75> Excellent essay. Good detail. I like the longer format.

Reminded me of, all people, Mother Teresa. She started in Calcutta in 1948. People mocked her: What difference do you think taking care of one poor person will make? But that was her focus: One person at a time. "Do small things with great love."

So too in the quite different field of technology startups.

<comment><USER76> Your analogy is accurate in theory.

However, Teresa and those like her are a total fraud.

</comment></comment><comment><USER77> PG: Do you see any other things founders typically think are going to scale and don't? (not-quite-unlike conferences)

</comment><comment><USER78> > I have never once seen a startup lured down a blind alley by trying too hard > to make their initial users happy.

Aren't lots of service companies killed this way? Bending over backward for some client? Maybe they are small companies rather than startups...

Guess I'm being picky though: pg's point is an excellent one.

<comment><USER79> I interpret "bending over backwards" as compromising the business model, which does have the potential to kill the business. However, I believe pg is alluding to good customer service.

</comment></comment><comment><USER80> It's interesting that what pg writes in this essay is implicit in the word _scale_. If you think about what it means to scale, it means your level of automation grows as your number of users grows. If you don't have many users, it doesn't make sense to automate too much.

<comment><USER81> It's not about whether it makes sense to automate or not... it is about how vital for a young startup it is to do things that a big company wouldn't do (hence cannot scale) to make the client feel special: e.g. sending the client a hand-written note from the CEO. The article is really great and I think it really makes the point that such seemingly unnecessary actions can make the difference. Great read!

</comment></comment><comment><USER82> PS: Brian Chesky of Airbnb came out first with advisig people in doing things that don't scale.

</comment><comment><USER83> So the general idea is that lack of scalability within a domain is a barrier to entry? If so, then the real barrier to entry is finding the domain, not the actual schlep - big companies can schlep pretty well, right?

</comment><comment><USER84> Thank you PG!, this post it's perfectly timed for us. And I was a bit lost on how to begin looking for users. Not much better now but at least with a general direction to follow..

</comment><comment><USER85> It's cute that even though pg is an Internet veteran, he still doesn't understand how HTML (and the web in general) works and he hardcodes br tags in his text at 80 columns.

</comment><comment><USER84> Thank you PG!, this post it's perfectly timed for us. I was a bit lost on how to begin looking for users. Not much better now but at least with a general direction to follow..

</comment><comment><USER38> I think this is the best PG essay because it talks about the human being of flesh and bones. Probably only this subject deserves a site to fill with real stories.

</comment><comment><USER86> Excellent read and dead-on. It's something I'm working on every day since launch and will be a good point of reference should I need reminding.

</comment><comment><USER87> I realise this is sacrilege but the impression I get from a PG essay is that you could make the same points in 1/3 the length.

</comment><comment><USER88> What does the Scotty vs. Kirk comment imply? I don't watch much TV and I'm not a native speaker so I don't get it.

<comment><USER89> Scotty was in charge of the engines that made the ship go. Kirk was in charge of the ship, the mission, and interacting with whatever weird things they ran into.

</comment></comment><comment><USER90> thanks for the advice. I was thinking abiut hosting and scaling architecture before trying to sell my product, but this piece convinced me it's going to be ok if my first customers run on some dedicated server with everything on it. i'll have plenty of time to think about VMs and load balancer later.

Most useful post i've read from pg as well.

</comment><comment><USER91> So the question is: what's the equivalent of an electric starter motor for businesses/startups?

</comment><comment><USER92> Does anyone want to summarize this novel?

</comment><comment><USER93> This is pg's best essay to date.

</comment><comment><USER94> One more important thing to understand about Jobs "miracle" is that he was allowed to do what he was obsessed with. No idiotic "manager" or board member intervene with ideas of "cutting costs" on packaging or materials or any other fast-food technologies to reduce the product to the mix of cheapest and crapest ingredients imaginable. No idiots insisted that it is much more "effective" to just add a "theme" to and old code, to make it look like touch- capable (hi Symbian, WinCE) etc. No one said that re-implementing from scratch, because everything else is crap is costly and time-consuming, and so on.

There are lots of people with good taste, sense of style and quality (read Pirsig's book) and enough self-discipline to follow do what one is preaching, but it is an extreme rare situation when such people have enough influence to make things their own way.

I guess a half of YC business is about trying to spot an employ such obsessed individuals, no matter what exactly they want to accomplish. Early funding of even one of such guys worth waiting and funding hundreds of mediocre, especially if one has connections to channel or sell them off.)

Igor Sysoev was obsessed with efficiency (in that time c10k problem was actual), so src/core and src/os/unix should be taught in colleges (btw, the module system is already an over-engineered mess).

There are many other examples, but the big idea is simple - spot the right people, all that numerous micro-optimizations, while valuable, are superficial.

<comment><USER95> Fred Wilson said something similar about obsession, though in very different language: [https://news.ycombinator.com/item?id=2721767](https://news.ycombinator.com/item?id=2721767). I like that quote very much.

What (if anything) are you obsessed with?

<comment><USER94> Probably it is that very Russian obsession with the naive notion that most things in the world are "not right".)

<comment><USER96> >naive notion

But aren't they?

<comment><USER94> They are, but the causes are even uglier and grounded deeply in so-called human nature which cannot be changed. So, less-naive approach is to understand and accept things as they are.

</comment></comment></comment></comment></comment><comment><USER97> We gotta say this. We have never been a fan of pg's essays.

BUT THIS ONE IS GEM. Probably the Best. Also remember, even after doing all this there is no guarantee that your startup will succeed. But this one has all the optimal paths.</comment>


Ask HN: do you care about the dev teams behind api's? - <AUTHOR>

API providers have developers that build them, improve them, create the documentation, tutorials, and handle support. Do you care about their blogs? Their interests? Getting to know them? Is that important or do you just want the docs and support? <comment><USER2> I'm not so interested in getting to know them, or what their interests are (unless they're related; I'd be interested to know what a email API creator's database interests are). But not interested to find out that the guy behind XYZ's API really likes to skateboard in his spare time.

What I would love to know, beyond what you discuss above, is the design philosophy and crucial decisions that were made in writing the API. Not just how to make the calls, but how the authors thought about the system as they were designing it. When I learn a new language/API, I don't consider myself adept at it until I can get inside the head of the authors.</comment>


Convergence: complete HTML5 game - <AUTHOR> http://www.currantcat.com/convergence/ <comment><USER2> Hello there, I'm the one who made The Convergence! Thanks for viewing my game, I hope everyone enjoyed it!

I didn't have a lot of time to finish it, but I wanted to add the sounds a friend of mine did, as well as a logo for the awesome CONSTRUCT the devs mentioned here.

Me & my girl are amazed by the amount of people that played and shared the game - it's nice to see such positive feelings spreading all around!

I want to polish the game a bit more, I fell like the mechanics deserve it! :D

Thanks for making our day even more special!

<comment><USER3> You deserve the attention! It's a great game and refreshingly original. I've got several colleagues playing it now. Looking forward to the planned improvements...

<comment><USER2> Thanks!

</comment></comment></comment><comment><USER4> Hi guys! I'm Tom from Scirra and we made Construct 2 (<http://www.scirra.com>).

This is a great game made with our engine, the author has also made it available on the Chrome Web Store: [https://chrome.google.com/webstore/detail/lkiiendkaiacnmggpp...](https://chrome.google.com/webstore/detail/lkiiendkaiacnmggppdckogcgmjaoapf)

This game of course deserves it's own post as it's greatly executed, and without meaning to steal it's thunder we would love to show you a couple more excellent games made with Construct 2!

Can't Turn it Off <http://www.scirra.com/construct2/demos/cant-turn-it-off>

Trashoid Attack <http://www.scirra.com/construct2/demos/trashoid-attack>

We also ran a small competition on our website and there's a bunch more games to look at here: [http://www.scirra.com/forum/users-choice-final- poll_topic458...](http://www.scirra.com/forum/users-choice-final- poll_topic45844.html)

Anyway it's really promising what is coming out of Construct 2 now, me and my brother (just two of us running Scirra) love playing games like these that get made! We hope to see lots more :D

All games made in Construct 2 are all pure HTML5, not a whiff of Flash in sight!

<comment><USER5> > _not a whiff of Flash in sight!_

How do you handle sound? HTML5 sound is still very insufficient for games at the moment in my experience.

<comment><USER4> This game doesn't have sound, but Construct 2 does allow for it. We've actually blogged about HTML5 sound quite a lot:

[http://www.scirra.com/blog/46/more-on-html5-audio-codecs- and...](http://www.scirra.com/blog/46/more-on-html5-audio-codecs-and-politics)

It's a bit of a minefield and is difficult to manage. MP3 has some strict licensing rules in regards to distributing games so we made a point of avoiding it. What we do is dual encode every sound to .ogg and .m4a, this will cover all browsers/devices. It's not the best solution space wise but it's safe and works pretty well.

We hope browsers make significant upgrades to HTML5 audio at some point! The easy option is to use Flash to handle sounds but we think this is cheating, we're kinda HTML5 purists :)

</comment></comment></comment><comment><USER6> Shameless plug: my HTML5 Game Engine <http://impactjs.com/> is a perfect fit for games like these.

This particular game seems to be made with Construct2 ( <http://www.scirra.com/construct2> ) though - which is a bit more "point-and- clicky" than Impact.

<comment><USER4> Construct 2 is a very powerful engine, and a lot of great games are being made in it! Describing it as 'point-and-clicky' really doesn't justify it at all.

<comment><USER6> I didn't mean "point-and-clicky" in a negative way; sorry if it sounded like it.

Construct 2 describes itself as "A visual HTML5 game development tool", Impact however is a programming framework. Someone without programming experience wouldn't be able to do much with Impact, but may still be able to make great games with Construct 2.

We're focusing on different target groups and in my book that's great. It's what HTML5 needs to succeed :)

<comment><USER7> Yeah, hopefully between us we can silence the Flash critics who claim there aren't any good tools available :)

</comment></comment></comment></comment><comment><USER8> Cute.

Having the arrow keys move the woman in reverse puts an odd male perspective on it though. This could be fixed by making the arrow keys move in the direction of whichever character is currently right-side-up.

Edit: Having the viewport follow the guy also contributes to this on scrolling levels, and I don't know how to fix it, aside from just having a character select at start.

<comment><USER9> This is the biggest non-issue in any game ever. I can't even imagine how anybody's first thought would be "how DARE the man be directly controlled by the arrow keys instead of the woman." I've made games for my girlfriend several times, with some games having her control me and others controlling herself, and neither time did we think what character was being controlled was an issue.

Hell, I actually read this post to her, and she was just completely confused and annoyed that someone found this a problem.

There's no sexism to be found here. The male just happens to appear on-screen first and that's who you control. I'd struggle to find a single woman that would've even noticed that.

<comment><USER10> > I'd struggle to find a single woman that would've even noticed that.

This is kind of ridiculous. Clearly, people are noticing and some of the people who notice might be women.

I noticed because I assumed which ever character was right-side up would be controlled by the arrow keys. I didn't think it was sexist. I thought it was a flaw in the game.

<comment><USER9> People tend to focus on characters instead of directions. Since the male was the first person I controlled, it was natural that I kept on using the arrow keys to control him and I didn't even take a second to thing about it. Nobody would expect to be moving right, hit the flip button, and then start moving left just to "prove the developer treats genders equally." The control scheme would be disorienting and far more people would complain about that. And if you suggest the player select their gender at the start, then puzzles would have to be adjusted to suit this. It's needless effort to appease people that the game wasn't even made for.

And judging by the name, I'm assuming joeyh is a male, and the only other person to be "bothered" by it is also a male (dgreensp), so my claim isn't exactly baseless.

Besides, this was a game made by a couple. There's outrage where their shouldn't be any. This guy's partner doesn't need to be "liberated from male- dominated control schemes."

<comment><USER11> You don't understand at all — the whole point is that you're concurrently controlling both characters, but then for some reason it's always from the player's perspective of the male. It's a bug.

The game starts with the male on the bottom, I press right, the and both characters move to their right. When you flip the male to the top, both characters move to their left when you press right. I expect my keyboard movements to directly correspond to both characters from their own perspective.

</comment></comment></comment></comment></comment><comment><USER9> Here's a preview of the HTML5 game I've been slowly working on for a year: <http://ektomarch.com/games/>

I already have 50 levels made, most of which are the size of large Super Metroid rooms, and ~60 enemy types. I'm just overwhelmed with work lately and haven't been able to make much progress.

<comment><USER12> I remember seeing this a while back and looking forward to it. Is it playable anywhere?

</comment></comment><comment><USER13> This is cool! Reminds me of VVVVVV (<http://thelettervsixtim.es/>), which had a similar section where you controlled two characters at once. It's a little strange that the secondary character moves even if the primary one is running into a wall, but it looks like the puzzles require that.

<comment><USER14> It's a lot like Binary Land, a game from the mid 80s: <http://youtu.be/NLI415emLzQ?t=42s>

</comment></comment><comment><USER15> It's actually quite fun to play. I think this is the first time I have said this about a HTML5 game/tech demo :)

<comment><USER6> Good gameplay is not a property of the platform (e.g. HTML5 or Flash), but of the game itself. Since HTML5 is still very young, there are mostly web devs building games with it - which often results in games that "feel" wrong.

But I agree, this game is a very nice example of how to do it right.

Also try <http://www.phoboslab.org/ztype/> or <http://playbiolab.com/> :)

</comment></comment><comment><USER16> Looks good, I did notice that the appcache has the wrong mime type it's text/plain and needs to be text/cache-manifest.

<comment><USER7> Scirra dev here. This is indeed a problem. The thing is Chrome is ultra-strict about the MIME type and rejects it if it's wrong. Firefox seems happy with it. Given HTML5 is new and nobody has their servers set up with this MIME type, and lots of people are already making HTML5 games with our tool, I'm tempted to say it's Chrome's fault for being too strict... getting everyone to reconfigure their servers is a real PITA just because Chrome is fussy.

<comment><USER16> It's not being "ultra-strict" it's a requirement of the spec[1] that the file be served with the correct mimetype.

[Edit] It doesn't work in firefox, the attribute triggers the permission bar but because it's the wrong mimetype it doesn't actually store anything.

Check it in Tools > Options > Advanced > Network

You'll notice that it has the domain referenced but has 0 bytes stored.

[1] [http://www.whatwg.org/specs/web-apps/current- work/multipage/...](http://www.whatwg.org/specs/web-apps/current- work/multipage/offline.html)

<comment><USER7> Ah - well I guess the spec is written with the future in mind when everyone's got their servers configured correctly. Until then nobody has their servers set up right so I think it would be practical for browsers to be a bit more relaxed. Right now we're seeing a lot of games on servers without this MIME type, and the browsers respond by requesting all files from the server all over again every single page reload, probably wasting a lot of bandwidth and making HTML5 games look bad. I think there's a good case for a bit of relaxation on the browser side - standards compliance is good, but not if the web isn't ready yet.

<comment><USER17> No... just no. If browsers are relaxed now, then they are forced to provide backwards-compatibility for all the sites that then rely on those relaxed standards. Why do you think Internet Explorer is a complete mess and have dug themselves into a whole of having to ship half a dozen "compatibility modes" with every new version of their browser? Because they didn't stick to standards.

</comment></comment></comment></comment></comment><comment><USER18> This is really well done, and would translate _very_ well to a touch interface.

</comment><comment><USER19> Fun little game where when the twist became opaque, I immediately was excited to play more levels. That's a game design win. Thanks for sharing.

</comment><comment><USER20> Cool concept and fun to play. Good job.

</comment><comment><USER21> That is awesome. Nice work.

</comment><comment><USER22> Charming concept, executed with great skill.

Note: flickers madly on Firefox 7.0.1/Windows XP, but works smoothly on Chrome 15.0.874.106 m/Windows XP.

</comment><comment><USER23> This is great. The level design is fantastic - a fair difficulty and fun progression.

</comment><comment><USER24> How is Convergence a "complete" HTML 5 game without sound?

</comment><comment><USER25> Does anyone else think the guy looks a little like Hitler? Perhaps a different nose...

Just saying. It's hard to tell what exactly I see with 8bit sprites! :-)

<comment><USER26> He looks like a lumberjack</comment></comment>


Have I been banned? - <AUTHOR>

I've submitted a couple links recently, and they don't seem to show up in the New section when I log out. Have I been banned? <comment><USER2> Looking at all your submissions,

<http://news.ycombinator.com/submitted?id=b09>

I'd guess that most of the submissions were flagged dead, because readers who surfed by them thought that they were low-quality links. Try submitting some higher-quality links (look at the main page for examples) and see what happens.

</comment><comment><USER3> news.yc appears to dislike self promotion - go into your profile and turn on ShowDead and you can see that of the seven links you submitted, four were flagged and killed.

If it isn't self-promotion, then you would be better served by submitting the original story link rather than the excerpt surrounded by ads that links to the original story.

</comment><comment><USER4> No, your account is not banned, your submissions are just low quality and are getting killed by other members flagging them.

</comment><comment><USER5> Censorship ftw

<comment><USER6> ...the right way! FTW!</comment></comment>


Another $1M Crowdfunded Gadget Company Collapses - <AUTHOR> http://www.techcrunch.com/2015/11/07/another-1-million-crowdfunded-gadget-company-collapses/ <comment><USER2> posted already yesterday; many comments here:

[https://news.ycombinator.com/item?id=10527070](https://news.ycombinator.com/item?id=10527070)</comment>


Ask HN: How do you find new Apps? - <AUTHOR> Hi, I've cofounded a startup that targets developers, but we're struggling with where to go to find potential users. So how does everyone find a new app to use? For me it's here and personal recommendations, but I'm not sure if I'm representative. <comment><USER2> I have mostly found the software I needed in the package manager, or wrote it by myself; occasionally I find other software but it isn't what I want (regardless where I looked). I wrote my own software too and wanted to see who else is interested in it too, though. I don't know if you are representative or not, and I don't know if I am, but nevertheless you can mention it, and I mention my stuff too.

<comment><AUTHOR> I'll make sure to do that in the future, but I _just_ created this account after lurking for a long time, and didn't want to immediately plug my stuff. That would feel like a bit of an abuse of the community. I will _happily_ gather data though:)</comment></comment>


Google News Redesigned - <AUTHOR> http://news.google.com/

<comment><USER2> It's interesting that they ask me to confirm my choices of broad subject matter areas (like World, U.S, Sports, Business, Entertainment) but not how fresh I like my news, which is a much more relevant question. If they know that I am on several times a day, it's really probably not necessary to take up space on the page today with an article about the death or Robert Byrd, unless there is some surprising new information to be found there.</comment>


Cost-effective method of extracting uranium from seawater - <AUTHOR> https://newatlas.com/nuclear-uranium-seawater-fibers/55033/ <comment><USER2> This is huge. So huge I am having trouble believing it.

We can stop burning oil, et. al.

We can clean the CO2 out of the air!

Rockets! Atomic power means _you_ can go to the Moon. Heck anywhere in the Solar system.

I'm losing it. Can I get a reality check? Did history just change?

<comment><USER3> > that analysis shows that seawater extraction could be competitive with land > mining at present prices.

Price of uranium isn't really the main impediment to more nuclear deployments. Rather its politics and safety concerns etc. So I'd speculate that discovering another (big) uranium mine that costs the same as current mines won't make a lot of difference to nuclear countries.

That said, it could enable all non-landlocked countries to mine it from the ocean. That could change things.</comment></comment>


Linux is not gnu/linux - <AUTHOR> http://linux.topology.org/lingl.html

<comment><USER2> The most historically accurate way to describe things is to use "GNU" as a specification. Any system that meets the FSF's definition of a GNU system could then reasonably be described as a GNU system.

A GNU system built using a Linux kernel would then reasonably be called a GNU/Linux system, but that would not be the _name_ the system. It would be a statement that it is a Linux system that meets the GNU specification.

The naming rights to a system historically go to whoever puts it together. So the complete system that Red Hat sells is the Red Hat Enterprise Linux system. That's its name, because Red Hat put it together so they get naming rights.

The complete system my past employer, Interactive Systems Corporation, sold that consisted of System V ported by us from the 3B2 sources to the 80386 was a UNIX system, but its name was 386/ix. We are the ones who put it together, so we got to pick the name, even though very significant components came from outside.

When describing the system named Red Hat Enterprise Linux by capabilities rather than be name, then it can be called a GNU/Linux system because it satisfies the functional requirements to be a GNU system.

For giving credit to those who provided the components you used to build your system, the traditional place to do this would be in the documentation and if you have a GUI in the "about" box of some major GUI component, such as whatever corresponds to Apple's Finder or Window's Explorer on your system.</comment>


Apple iPhones allow extraction of deep personal data, researcher finds - <AUTHOR> http://www.reuters.com/article/2014/07/26/us-apple-security-spying-idUSKBN0FV01D20140726

<comment><USER2> Please see HN submission early this week: [https://news.ycombinator.com/item?id=8074654](https://news.ycombinator.com/item?id=8074654)

</comment><comment><USER3> Precise: anyone with access to the computers you have "trusted" to pair with your iPhone, can extract encrypted data from your iPhone because that's what the trusted pairing is intended to do.

There are also "backdoor" systems that Apple Store employees use to unlock your phones, which can be exploited by Law Enforcement to extract text messages, contact lists and photos.

Noting of course that Law Enforcement already has access to numbers you have called and all SMS & MMS messages you have sent by subpoena to the carrier responsible for your service.

<comment> sleep-less >> Noting of course that Law Enforcement already has access to numbers you have called and all SMS & MMS messages you have sent by subpoena to the carrier responsible for your service.

That's a poor excuse. Those calls may have been made in a different country.

</comment></comment><comment><USER4> This is ridiculously stupid. You need to (a) have your device unlocked, (b) connected to a computer you don't know and (c) have clicked the 'Trust This Computer' button.

Of course your deep personal data is going to be exposed if you manage to get through all that.

<comment><USER3> The article touches on the "backdoors" used to help customers unbrick their phones, which provide access to more information than is really necessary.</comment></comment>