The Founder's Guide to Raising a Series A Venture Financing - <AUTHOR> https://blog.atrium.co/the-founders-guide-to-raising-a-series-a-venture-financing-1de4f5aff312?gi=607acbe24e0c <comment><USER2> Hello HN: Justin here. Happy to answer any questions you guys have about raising money!

<comment><USER3> Great article. Is similar to what we witnessed during our fundraising process.

I want to apply for Atrium Academy - but our company is based out of India - are we eligible for the academy?

<comment><USER2> Sure - if you want to raise from US investors you will probably need to be a DE-company (outside of exceptional circumstances). In any case I am happy to help, just enter your info into the form here: [https://atriumllp.typeform.com/to/uTAYKJ](https://atriumllp.typeform.com/to/uTAYKJ)

</comment></comment></comment><comment><USER4> Do first-time founders really ever raise A rounds anymore without first raising some kind of significant unpriced seed round?

<comment><USER5> Personally, I doubt it barring exceptional circumstance: previous achievement in another field, metrics that can't be ignored (tough to get via bootstrapping, though)...

I have heard from some seed stage investors that they will do priced seed rounds -- even some that claim to prefer it -- so there may be technical exceptions that really reinforce your point.

To be fair, the workshop's website also asks about previous fundraising. I've found this always comes up during fundraising discussions, too. Partially because the company's finances matter, but also because investors want social proof. I don't think this is as negative as it seems: early stage startups are black boxes, and any signal is helpful, I suppose -- and there's some sense that previous ability to 'sell' is indicative of future success. (I try to empathize with the investors on this one; they see a lot of pitches.)

</comment></comment><comment><USER6> > you can immediately call the other potential investors, and tell them that > you have a term sheet from someone (don't say who), and put pressure on them > to give you a term sheet

sorry I don't quite understand this part. What would be the benefit of not saying who? (i.e. the first term sheet investor). Wouldn't saying it be more convincing and put more pressure on other investors?

<comment><USER7> If you have a term sheet from a great/good investor, you don't say who it is because all good investors talk and the investor you're trying to get a term sheet from will just call the investor who gave you a term sheet. Worse case, they talk each other out of the deal. Best case, investor B comes in ever-so- slightly above investor A's offer (vs. potentially coming in way above, in absence of knowing the price).

If you have a term sheet from a bad or unknown investor, you don't say who it is because all investors (great, good, bad, or ugly) will discount their offer significantly. There is a huge difference (even if it's bullshit) in getting a $10m A from Sequoia vs. a $10m A from a Dutch strategic investor who's making their second investment in three years.

</comment></comment><comment><USER8> The best way to raise a series A is to be almost ready to raise a series B, which is why the series A is so frustrating.

<comment><USER9> I mean... sure. And the even better way to raise a series A is to not even need it at all because your company is a rocketship that's not only growing at 500% per year, it's ALSO cash flow positive and completely capable of just paying for itself.

But these things are impossible to arrange for many businesses.

</comment></comment><comment><USER10> IMHO, the key remark is:

"When are you ready to raise a Series A?"

"The snide answer is that you are ready to raise an A when you can convince a VC to give you a term sheet. The more nuanced answer is when you have achieved compelling enough intermediate milestones that convince VCs that cash is your constraint to scaling your business. In other words, you have something that works, and all it takes is pouring money on it to grow it much, much bigger."

The rest is assuming that VCs don't know how to read or think and need some exciting _experience_ as in some movie.

A big problem for the VCs is that for a lot of the good information technology startups, by the time the startups have the revenue the VCs want, the startups will also have plenty of cash to grow. Why? Because the associated computing is now so cheap and, for a Web site with a lot of traffic, revenue from ad networks is so easy to get.

<comment><USER11> > Why? Because the associated computing is now so cheap and, for a Web site > with a lot of traffic, revenue from ad networks is so easy to get.

Obviously this is only true if the company makes money from ad revenue. Most startups* don't. Even with an ad revenue model, there's always an opportunity cost to not having more capital. Just because you may bring in revenue which you reinvest back into the business, doesn't mean you couldn't grow faster by having more to spend on hiring, marketing, sales, etc.

It's not the right decision for every company. But if you've already raised seed-round VC, it probably makes sense for yours.

* Following the definition in [http://www.paulgraham.com/growth.html](http://www.paulgraham.com/growth.html)

<comment><USER10> I've posted a lot of long, detailed posts at HN. Here I was trying to be brief.

Yes, I remember the Paul Graham definition about a "startup" being designed to grow fast. He is welcome to his opinion, but, sorry, I don't accept his definition and believe that relatively few people do.

> Obviously this is only true if the company makes money from ad revenue.

Well, you quoted what I said in rebuttal: "for a Web site with a lot of traffic, revenue from ad networks is so easy to get." So, I was talking about a Web site.

And for more in rebuttal, my sentence before had:

"A big problem for the VCs is that for a lot of the good information technology startups, by the time the startups have the revenue the VCs want, the startups will also have plenty of cash to grow."

So, I qualified with "good" and "information technology".

Uh, a "good" one is not to start from nothing to compete with iPhone!

Now, mostly the juicy "good information technology" startups are ad supported Web sites, e.g., be another Google or Facebook.

> Even with an ad revenue model, there's always an opportunity cost to not > having more capital.

Equity capital brings overhead "costs" beyond belief: You and your team own 100% of your company and, with the first equity check, become a Delaware C-corp with a BoD that now controls the company. With common term sheets, you and your team suddenly go from owning 100% to owning 0% with a vesting schedule to get back to, maybe, 35%. But due to the loss of control, the BoD can fire you and your team at any time for any reason or no reason and before much of your stock is vested. And, for the vested stock, it is likely illiquid but has tax due you can't afford. You just had your company taken from you for next to nothing. And, for the BoD meetings, accounting reports, auditing, legal charges, etc., guess who pays for those, including the first class airline seats, limo service, 4 star hotel nights, high end meals, etc. for the BoD members for the meeting?

> Just because you may bring in revenue which you reinvest back into the > business, doesn't mean you couldn't grow faster by having more to spend on > hiring, marketing, sales, etc.

A company that has the _traction_ VCs really like will likely be generating enough cash that cash is not a major constraint on growth. Below let's see some relevant arithmetic:

An example is Plenty of Fish, long just one guy, owned 100% of the company, had two old Dell servers, ran ads just from Google, and had $10 million a year in revenue, nearly all pre-tax earnings. Eventually he deliberately hired some people and sold out for $500+ million. IIRC, he never took an equity check.

That's the startup case more like I had in mind, but I was being brief.

But we can have some more arithmetic:

IMHO, for the "good information tecnology" startups now, your _model_ of the need for cash is outdated and past. Even if some cash could be helpful, the C-corp and BoD overhead, time, effort, cost in cash, loss of control, etc. are really not worth it, that is, are way too much to pay for the cash.

My central point was that for "good information technology" startups, the VCs are out of date, behind the times, and essentially out of business or at least well on the way.

So, for some arithmetic, to add detail, can get a motherboard for $100, an 8 core processor with 64 bit addressing and a 4.0 GHz clock for $125, max it out with 32 GB of DDR3 ECC main memory for about $320, get 2 TB hard disks for about $70 each, a high end power supply for about $100, a case for about $50, high end case fans for about $100, and lots of high end software for free.

I'll do the arithmetic for you -- $825. With cables, keyboard, screen, Windows 7 Professional 64 bit, more hard disks, etc., call it $1500 total.

But that's 8 cores at 4.0 GHz and processor caches big enough that mostly don't need to worry much about DDR3 main memory cycle time. Besides the DDR4 memory has, yes, faster clocks but more clock ticks per access.

That puppy should be able to send 10 relatively simple (that's the only good kind) Web pages a second, supported by quite a lot of SQL Server back end work. Call it 4 ads per page sent at $1 per 1000 ads sent.

For the arithmetic, I'll multiply that out for you: That's revenue of $103,680 a month, from one $1500 server. The ISP? Say the simple Web pages send for 500,000 bits per page for 5 Mbps upload data rate. Gee, my ISP is giving me 25 Mbps upload data rate by default.

Okay, that's $103,680 a month in revenue. For a solo founder company -- hopefully. Now just why in heck does that founder need equity cash? They own 100% of the business, say, as a Subchapter S or LLC; why the heck do they want a Delaware C-corp and BoD? They don't!

If the Web site can't get users enough to permit sending 10 pages a second, then likely the _traction_ is not enough for VCs to want to invest. But if the site is sending 10 pages a second with $100+K a month in revenue, then no way will the founder want, need, or take the equity cash. No way.

Sure, in the old days, with a team of five cofounders, with credit cards maxed out, all five spouses pregnant, paying Silicon Valley housing costs, and using Sun servers, equity cash would be very welcome.

Now it can be a solo founder, no credit card debt, no pregnant spouse, cheap housing costs far from Silicon Valley, and the main server parts for the $865, and that's a very different world.

I was being brief, but that's the world I was describing.

<comment><USER11> To reiterate, seems like the business you're describing fits a pretty narrow profile: free bootstrapped site making money from ad revenue and growing by word of mouth and organic SEO (to minimize marketing spend). That is a phenomenal way to run a company, and if you can pull it off, you have my sincerest congratulations – however, you're likely not the target audience for the post above.

For software companies which don't follow your model (i.e. most of them) OR businesses which are aiming to trade growth for profit (a perfectly valid business strategy, see $AMZN), cost of hardware is almost _never_ the limiting factor compared to cost of labor. And to pay for labor at a loss, one may need to look for equity funding since banks won't extend debt to high-risk seed- stage businesses.

Your assertion as to the desirability of trading growth for profitability is entirely orthogonal, and the arithmetic about cost of server maintenance vs revenue - while informational - seems to miss the point entirely.

There will always be companies so great that VCs need to beg them to take money, but one only has to spend a day in Palo Alto coffeeshops to see that generally demand goes the other way.

<comment><USER10> > growing by word of mouth and organic SEO (to minimize marketing spend)

How else? I never saw an ad for Google, Facebook, Snap Chat, Drudge Report, Instagram, Twitter, or Plenty of Fish. More generally, I'm unsure just what significant bucks should be spent on marketing a startup such as I described. I can see trying to have some stories in some parts of the media and various other forms of publicity, but actual marketing, and as you also mentioned, sales, what's to do?

E.g., I was a B-school prof and across the hall from me was the guy who did, IIRC, the Pillsbury Dough Boy ads -- it was something that famous and novel he did. I've done high end applied math optimization for several cases of marketing. So, from that marketing, I see no connection with the startup I described.

For SEO, I doubt that Google did that! Nor Facebook, Snap Chat, Instagram, Twitter, Drudge Report, Plenty of Fish, etc.

Sure, if I type into the Google one line text box

KVR1333D3E9SK2/16G

I'll get a lot of hits of sellers and can believe that Google got SEO $ for that keyword. So, there may be hits from Amazon, Newegg, eBay, Tiger Direct, Memory4Less, and Kingston, and I can believe that Google got $ for those.

But sellers of

KVR1333D3E9SK2/16G

are not "good information technology" startups or candidates for Series A VC funding.

And for VC funding, there's another huge point: What the usual, even what is common on some Sand Hill Road coffee shop, etc. is essentially irrelevant. Instead, necessarily, especially if take the Paul Graham definition, the only things that are relevant are the really rare, literally once in a decade, exceptions. Here, too, the VCs are stuck-o because they have nearly none of the background to judge what will be so exceptional. The NSF, DARPA, and many departments at MIT, Princeton, and Stanford do at least on the technical parts. But IMHO, the technical parts should be so powerful, solve so well such an important problem, that they are about all that matters and isn't just trivial. The VCs don't agree yet. Tough for the VCs.

You raised the issue of labor: Well, I'd strongly recommend a founder to be a solo founder. This way he is forced to understand all of his business, and a good founder to be CEO needs to do that. Also he saves big bucks. He never has a "co-founder dispute" wastes essentially no time in meetings.

You raised the issue of hiring: Well, for a solo founder before any equity funding with $100+K a month in revenue, he can hire. Let's see: $120K a year is $10K a month plus some overhead, and can cover that a few times for the $100+K a month in revenue.

For hiring a _rock star, full stack programmer_ , for me, no way. In my startup, I'm the _rock star_. And for the work of my startup, essentially no one in startup land, in a Silicon Valley coffee shop, computer science major, experienced developer, etc. has any hope of competing with me. Why? What's crucial for my startup, although the users will never know this, is some original applied math I derived, complete with theorems and proofs, from some advanced pure/applied math prerequisites. That's not programming, full stack programming, rock star programming, ugrad computer science, AI/ML, or chaired full prof of computer science work.

For the programming, sure, for my startup I did that, all of it. It was no big deal and doesn't make me a rock star or full stack programmer. Instead I just used the Windows .NET Framework, Visual Basic .NET (I don't like the C-like syntax of C#), ADO.NET for database, ASP.NET for the Web pages, TCP/IP sockets and object instance de/serialization for program to program communications, etc. Simple stuff. Visual Basic .NET? Fine with me. I'm thrilled with it. While I've programmed in a lot of languages, including C, I've never touched C++, C#, Python, Java, or JavaScript and won't unless I have a need to. I've never touched Linux or Unix and don't plan to. So, I'm no _rock star, full stack_ programmer and see no need to be. Then I see no need to hire any _rock star, full stack_ programmers.

I believe that in a few weeks I can teach any talented, interested experienced computer user how to use a good text editor, Visual Basic .NET, ASP.NET, ADO.NET, simple cases of SQL, TCP/IP sockets, and de/serialization quickly. For joins and foreign keys, so far I don't have any! Each index I have is clustered and, thus, as fast as possible. For the crucial, high end, original technical stuff, that's my job and easy for me, and I couldn't hire for that work anyway.

So, for my startup, hiring, no problem. There will be a delay of a few months getting new people up to speed and nicely productive. I'll hire anyone, fresh out of high school or retired with 40 years in the computer industry or 40 years in anything.

If I need some high end technical info, I'll call Microsoft and pay them. So far I haven't had to.

Currently my code is in alpha test. It's 24,000 programming language statements in 100,000 lines of code for a Web server, a Web session state server, and two back end, highly technical _compute_ servers. They communicate with TCP/IP, etc. They are all single threaded, and the queuing is from just the TCP/IP FIFO queuing. IIRC, the default maximum queue length is 10, but likely I could increase that to 100 and have plenty of slack. In the end, in general, the way to keep queues and stacks from overflowing is just to slow the responses to the users; the software and server farm architecture should exploit this fact.

I will soon add a log server to replace my current usage of what Microsoft has for a Web site log server that I don't like. The many places in my code that write to the log need not be changed; instead I'll just change the one function they all call. Writing the log server will take me an easy afternoon and will be just from removing some cute usage of a collection class from my Web session state server and adding a print statement.

Basically, then, the production code is written -- I thought of it, designed it, and wrote it, all in one stroke, no prototypes, no _refactoring_. Everything worked just as planned.

For being "narrow", essentially every promising startup is necessarily "narrow".

<comment><USER11> Wow.</comment></comment></comment></comment></comment></comment>


Proving Existence of a Second Private Key That Decrypts an RSA-Encrypted Message - <AUTHOR> https://badbytes.blogspot.com/2017/12/proving-existence-of-second-private-key.html <comment><AUTHOR> I can't speak to the validity of this, but would like to see discussion.

Slight edits of title to fit within 80 bytes.

<comment><USER2> as the operation modulo is involved I would say that it's possible. but factorization is still a prime concern (pun not intended)

</comment></comment><comment> java-man what is the impact of this?

<comment><AUTHOR> That's the question.

Essentially, there appear to be at least two keys to RSA encrypted ciphertext.

If the 2nd is hard to find, that's not too concerning. If it's not, either globally or for specific actor, or in specific cases, it greatly reduces overall cipher strength.</comment></comment>


Berkeley cancels scheduled talk by Milo Yiannopoulos - <AUTHOR> http://www.cnn.com/2017/02/01/us/milo-yiannopoulos-berkeley/ <comment><USER2> What a bunch of savages, destroying property and hurting others. These people are out of control.

<comment><AUTHOR> "These people are out of control"

Are you referring to the people in masks or the protesters?

<comment><USER3> The latter give cover to the former, making the rioting possible and preventing apprehension of the rioters.

</comment></comment></comment><comment><USER4> Successful protest. :)

<comment><AUTHOR> Successful is purely subjective. They were "successful" at suppressing free speech is another way to look at it as well. I definitely would not agree with the rhetoric that was going to be spouted by the speaker and protesters have a right to protest. That being said, I believe the protesters are not aware of how their actions have greater implications on future policies that dictate what is fair to say and what isn't to a crowd of listeners.

<comment><USER5> Apparently,

free speech!=hate speech

I'm confused

<comment><USER6> Hate speech is not forbidden outright. Check [https://en.wikipedia.org/wiki/Hate_speech#Supreme_Court_case...](https://en.wikipedia.org/wiki/Hate_speech#Supreme_Court_case_law)

<comment><USER5> How is this relevant? Genuinely confused by your post. I wasn't making a comment about law.

<comment><USER6> Law tells that Free speech = hate speech in some contexts.</comment></comment></comment></comment></comment></comment>


Generating Factoid Questions with RNNs: The 30M Factoid Question-Answer Corpus - <AUTHOR> http://arxiv.org/abs/1603.06807 <comment><USER2> Great project and I enjoyed reading the paper. Thanks for posting it.

I was on a DARPA neural network advisory panel in 1998 and 1999, and I used simple 1 hidden layer or 2 hidden layer back prop networks for several projects.

My mind is blown by both the computational tricks for training many layer networks and the advances of using GPUs to train large networks. We built our own neural network hardware that was excellent for the time, but the progress in the last decade is enormous.

Still I also believe in the power and utility of so-called 'symbolic AI', but I think I am in the minority.

</comment><comment><USER3> This is the type of project which really interests me. In the future we plan on building a service to wholesale trivia questions to pubs, schools, fundraisers, etc. I'll read this paper with interest, because at a quick glance the generated questions do sound great.

The next step from generating good quality questions that sound natural, is to make sure the the questions are up to date and topical. This means keeping up with current affairs, memes, popular cultue, and other trends. Adding questions about "which politician is in trouble for x" really only remain relevant for about a week or two and sit in a different category than these pure fact style questions presented here.

It would be great to see this research team or others to continue in this direction, and look at an increasingly broad metrics of what makes a "good" question, in addition to whether the English phrasing sounds good.

Nevertheless, this really does sound great.

<comment><USER4> This was my first thought too - not "hey pushing back the boundaries of computer science" but "hmmm, way to put pub quizmasters out of business".

<comment><USER5> Read this paper from July of last year and it'll make more sense as to why this research is interesting: [http://arxiv.org/pdf/1506.05869.pdf](http://arxiv.org/pdf/1506.05869.pdf).

Seeding a dataset with human labels, then generating new, better data is pretty cool. Similar to deep mind watching go games, then learning to play better than said games. Add to which, humans can't tell the difference between the human generated data and algo generated data.

We're about 3 months from where you can bootstrap a system like microsofts with freely available code and data. From there, if "memory modules" start working better so models can "remember specific context" (it can already remember general context), you'll have a bot that's a pretty good model for passing the Turing test.

I'm defining a practical Turing test as text-based, human gets 5 questions, other party replies 5 times, then human must predict: human/not human.

</comment></comment></comment><comment><USER6> I'm confused as to how this ends up being useful.

Using an example from the paper:

Q: who's an american singer that plays pop music?

A: nikki flores

So, the generated question and answer match, but the answer isn't exclusively the right answer. There are thousands of "right answers".

They do note this: _" We have also observed that the questions are often ambiguous: that is, one can easily come up with several possible answers that may fit the specifications of the question."_

But they don't say anything more about it. I suppose that's just out of scope for them, and something someone else works on?

</comment><comment><USER7> Unfortunate title.

factoid - an invented fact believed to be true because it appears in print.

<comment><USER8> \- or -

2 : a briefly stated and usually trivial fact.

<comment><USER9> _-oid_

        Of similar form to, but not the same as.

<comment><USER10> This doesn't make the second definition of factoid (in GP post) wrong. Prefixes, suffixes, and even roots end up being used in words that don't follow the literal definition suggested by them. They typically don't start life that way, usually closer to the literal meaning pedants will later expect to be used, but, overtime, usage causes a definitional shift.</comment></comment></comment></comment>


Girl Scouts to introduce game developer badge - <AUTHOR> http://arstechnica.com/gaming/2013/04/in-move-to-pwn-boys-girl-scouts-to-introduce-game-developer-badge/ <comment><USER2> I have a friend who is very active in guiding in the UK (a "Brown Owl", I think?!) and my first instinct upon reading this was to copy the link and paste it on her Facebook wall with a positive, encouraging comment about how cool it is.

I got as far as pasting the link and FB detecting what it was before I noticed the original title: "In move to pwn boys, Girl Scouts to introduce game developer badge". I didn't even clock that the first time, I just went straight from the IMO perfect title here "Girl Scouts to introduce game developer badge" to the body of the article.

I'm now in limbo before posting the link, having replaced the link title with the one here (I really like how FB lets you do that), and considering my positive comment a bit more carefully. It's a niggle, and I anticipate accusations of "reading too much into it", but that title gets under my skin and I think it's because it's misrepresentative - as though the only reason for doing this is to keep up with the lads and "show them what for!". Rubs me right up the wrong way.

[Edit: reading the other comments in here I almost want to delete this because it's a negative nitpick on the presentation of the article rather than, as others are doing, a right on "whoop whoop" about this very cool news, but I had to get it off my chest.]

<comment><USER3> I think you may also want to see this in the context of the US, where the _Boy_ Scouts are an extremely bigoted organisation.

<comment><USER4> "Extremely bigoted" is a pretty unfair way to paint the Boy Scouts of America.

<comment><USER5> Agreed, it's just women, gays, and atheists who are discriminated against by the policies of the Boy Scouts of America.

So "bigoted" is probably more fair.

<comment><USER6> I don't know where you are, but my Troop has all of those. The national organization is pretty heavily Mormon, so that's an obstacle. But our Council just removed the rule against gay Scout.

And hey, the Girl Scouts are bigoted against boys, right? That's pretty disingenious; they are purpose-selective in accordance with massive issues with prepubescent youth. Pretty hard to mentor boys when they're constantly showing off to girls - try to change that!

<comment><USER7> Seems to work pretty well in countries that don't have different scout organizations for boys and girls.

<comment><USER6> I deny that; it seems implausible. But I have no more information than you.

<comment><USER7> You're right in that you have no more information about it than me. I spent some 8 years in such an organization so I probably know a lot more about it. It worked really well. Mixed troops are fairly common in the rest of the world.

<comment><USER6> Well, we have mixed Troops too, at the age of 14 and above, and its optional. But below that, a Boys-only club (and Girls-only as well of course) works pretty good for us.

I'm glad your experience was good. 8 years - so you must be an Eagle Scout? Or do you do that differently?

<comment><USER7> No, we don't have the concept of Eagle Scouts. We did have merit badges, but there wasn't much focus on getting them. We did spend a lot of time learning practical things that would help us on hikes.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I have a just-turned-nine daughter who came up with an awesome video game idea a couple of years ago - she is also a Girl Scout. She'll be so excited to hear she can get a badge for it. Of course now we just have to figure out how to build the thing! She's learning to code at the moment so anything that gives her more motivation to head to the Hacker Dojo with Daddy and her Chromebook and get her geek on is good news in my book.

Edit: from the video it looks like it is a bit restricted, but it's a starting point. Maybe if she builds one of these simple games and gets her badge it will encourage her to learn the more in-depth skills needed to really make the one she wants to create. Still a great idea.

Edit: hmmm trying it now with her and I notice that the first stuff is free but then you have to pay to get the full product. I hope this isn't another bloody affiliate revenue thing by the Girl Scouts - these effectively pay-for- badges annoy me. I already have severe issues with the while Girl Scouts cookies thing where they get only 15% commissions on a product that is twice as expensive as equivalent competing product and wouldn't sell at all if it wasn't for this free labor child workforce and the power of cute combined with guilt.

<comment><USER9> How can you even develop software with a chromebook? I though those were browsing/google docs only.

<comment><USER8> No it's a great tool for learning without going to the fully fledged laptop. She's able to work through codecademy training courses, tools like ShiftEdit and Cloud9 IDE are the next step. Tons of tools out there now for using a chrome book - maybe not for a power developer but for a beginner, particularly one who I don't want to trust with an expensive MacBook just yet, it's good enough to begin with.

<comment><USER10> _"maybe not for a power developer"_

I'd expect an actual "power developer" to be able to cope with any kind of environment! :-) A proper hacker should be able to make a Chromebook do virtually anything.

</comment></comment></comment></comment><comment><USER11> I'm the editor at Ars who approved the headline. I was ok with it because the Girl Scouts badge actually requires development work, whereas the Boy Scouts badge was just for game design. So it's not a matter of the girls "keeping up with the lads," but surpassing them.

Thanks for the feedback!

<comment><USER12> The headline "Girl Scouts to introduce game developer badge" is superb on its own.

No need to bash anyone else, especially when these two organizations are all about building people up.

<comment><USER11> Wasn't my intent to bash anyone. I just wanted to avoid a boring, eye-glazing headline.

<comment><USER13> > I just wanted to avoid a boring, eye-glazing headline.

The word is "factual".

</comment></comment></comment></comment><comment><AUTHOR> This just looks like a great opportunity for awesome outside-the-classroom learning experiences and mentorship. I benefited hugely from various opportunities like this when I was young, but those were all based around local institutions versus the kind of broad-reaching impact that a Girl Scout badge can have.

I can easily see some girls looking over the list of badges, seeing this one, thinking "that's awesome, I want that one" and working to make it happen themselves. Beautiful.

</comment><comment><USER14> I am coming from another culture, so would some kind soul explain to me how, in the 21st century, the society tolerates an organization called "Girl Scouts"? Am I the only one seeing something wrong there, as if there would exist "White Scouts", for example?

<comment><USER15> Does your culture have separate bathrooms for boys and girls?

<comment><USER14> So the reason of having segregated scouts is to protect their privacy? Wouldn't it be enough just to have one scout organization and separate bathrooms as well?

<comment><USER15> Privacy in bathrooms is accommodated through the use of private stalls. Why should you have privacy from someone with different body parts but not privacy from someone with the same body parts? What about transgendered people, or people born with a mixed gender? We all make the same body noises so if the privacy is there via private bathroom stalls, why segregate people?

Regardless of that point, the question was why "Girl Scouts" but not "White Scouts". Modern society frowns upon segregated bathrooms by skin color (look to the southern US for relatively recent examples of that) but not based upon sex. So just as there are segregated bathrooms for male vs female, there are also segregated baseball and volleyball teams, segregated schools, and many other examples where the division is by sex.

Maybe Scouts is one example where it should get with the times and there isn't a particularly good reason why it should be divided by sex, as could be argued for some sports where there are physiological differences justifying the segregation. However, I don't find it particularly archaic that a private organization exists which has separate groups for male vs. female. It would be archaic if only the female group has sewing, or only the male group has hunting, and if that is the case they should modernize those areas.

But it is a private organization and if people don't like the way the organization is run they are free to not participate. Anyone can start up their own private organization which allows members of either sex. Call it the Adventurers or the Pioneers, and have similar achievement badges. That sounds like a good idea to me.

</comment></comment></comment></comment><comment><USER16> This is how you fix gender issues in the modern tech workforce; not after the problem has already taken root.

<comment><USER17> I'd think the best would be a mix of both.

</comment></comment><comment><USER18> Sounds good. The Boy Scouts introduced a similar one last month as well. [http://www.scouting.org/media/pressreleases/2013/2130306.asp...](http://www.scouting.org/media/pressreleases/2013/2130306.aspx)

<comment><USER19> I was at the SXSW gaming expo last month and they had a booth about this merit badge at the event.

</comment></comment><comment><USER20> Very welcome. We need to change things, and the sooner in their lives, the more difference it makes.

Back in the 90's, I was an engineering student at Berkeley. I was bored eating lunch outside one day by the engr bldgs, & decided to pass the time by counting the gender of just those folks passing by. It was consistently 25% female. That includes non-engineers who were going up to the coops.

And, this is Berkeley. Nobody's going to (rightly) accuse them of anything other than liberal.

When your inputs are 75% male, your outputs are too. You can't put the blame downstream like that, & can't change it downstream as easily.

It's orders of magnitude easier to change this from childhood, early.

I ended up marrying a fellow engineer from Berkeley, & we are raising both our son & daughter to be passionate, curious builders & makers & coders. You don't just use the world, you adjust it & improve it.

</comment><comment><USER21> This is so awesome. It's great to see programming penetrating the main stream and being recognized as a useful skill on all levels. I hope that we start to see more of our youth study cs and programming languages at earlier stages of high school and elementary school.

</comment><comment><USER22> Btw the BSA has had a computers merit badge since 1967. <http://meritbadge.org/wiki/index.php/Computers>

<comment><USER23> Yeah, but it's mostly a joke, like most of the technical merit badges.

</comment></comment><comment><USER24> Burying the lead. The real interesting story is that previously the only science related badges were "science of happiness" and "science of style". Girl scouts: part of the problem.

<comment><USER25> What you did here was try to find the master list of Girl Scout badges and grep it for "science", which isn't even close to an accurate depiction of what the programs are. Incidentally: the implied dismissiveness of style is itself a gender bias artifact; we wouldn't bat an eye at the science of rockets or cars. You think there isn't science to dig out of cosmetics?

At any rate, a cursory search will dig up badges for entomology, botany, a bunch of different computer badges, science in general, human biology, engineering, and more. There isn't one handy list of all the badges all in one place that I can find; you have to actually dig into the programs.

(I'm the parent of an 11 year old girl, but she's not a Scout).

<comment><USER24> What I actually did was read the article linked. If it's inaccurate _shrug_ , I don't know, but a googling of "girl scout badge entomology" doesn't show much. If there are and they're meaningful, super, I'm pleased and 'part of the problem' is revoked.

As far as "science to dig out of cosmetics", that's rather a non-sense question. Yes, there is science, good, hard science. It's biology and it's chemistry, it's not "beauty".

Yeah, I get it, the 'idea' is we connect things they're interested in to science. Well, IMHO, the problem isn't getting the girls (or boys) who are into style and make-up to 'dig' science, the problem is encouraging and networking the girls who _do_ _dig_ science and math. (this is already done much better for boys, again IMO).

</comment></comment></comment><comment><USER26> If GS can embrace this then maybe they'll also embrace letting the Brownies collect payment for cookie sales using credit card readers and other methods besides cash.

<comment><USER27> They already have: [http://www.sfgate.com/technology/article/Tech-tagalongs- boos...](http://www.sfgate.com/technology/article/Tech-tagalongs-boost-Scout- cookie-sales-4359198.php)

</comment></comment><comment><USER28> Great to hear! My Boy Scout troops Computer Club was where I wrote my first computer program (yes it was Hello World :-)).

</comment><comment><USER29> Fantastic but why just games though?

</comment><comment><USER30> good for them!

</comment><comment><USER31> Why video games, and not programming in general? Useful work is actively discouraged? Heck, there are tons of _scouting-relevant_ apps one could make, around trip planning, navigation, information+-cataloging..

</comment><comment><USER32> I love Girl Scout cookies. Great organization, and this is a great idea!

</comment><comment><USER33> Smells like a PR stunt to be honest.

<comment><USER34> What's the stunt then?</comment></comment>


YouTube is cracking down on external links in videos - <AUTHOR> https://www.engadget.com/2017/09/29/youtube-links-end-cards-new-requirements/ <comment><USER2> Its about time. The Youtube UI has become a disaster over the last few years. It all started with the ability to let uploaders "annotate" their videos. I've disabled the setting to show annotations probably a dozen times and they keep coming back. I can't figure out if the setting is poorly implemented or if youtube is deliberately switching the setting back.

<comment><USER3> Agreed, but this move seems like a grab at Patreon and self promotion in general. Users can still put obnoxious annotations up.

<comment><USER4> > _Users can still put obnoxious annotations up._

No, annotations are deprecated, you can't add them to videos anymore. [0]

[0]: [https://youtube-creators.googleblog.com/2017/03/keep-fans- en...](https://youtube-creators.googleblog.com/2017/03/keep-fans-engaged-with- cards-end.html)

<comment><USER5> Seriously, good riddance. It added so much clutter to videos that I explicitly hid them any chance I got. I'd rather content creators just use the video description to communicate or edit their videos so that annotations would not be necessary.

<comment><USER6> So you read the entire description of a video before watching it and remember every word of it, including timestamps with comments to note corrections, even when there's 10 of them for a half hour video?

<comment><USER7> Annotations (in the sense of small snippets of text that display briefly to add info) are fine. What YouTube had in many cases was a poorly implemented MySpace page overlaid on the video. And as one of the parent posters said, the setting just kept turning itself back on no matter how many times you turned it off (on the video, or in your settings page).

<comment><USER6> "Many cases" is subjective and anecdotal. Maybe my set of youtubers i followed was particularly high quality, but almost all uses of annotations i have seen were to provide corrections to information found wrong in the video, or additional information learned after the video.

In some cases such things were applied quite heavily too.

And thus the point of my previous post is that for people doing serious work with their youtube videos providing corrections and such via the description is entirely untenable.

I'm sorry you've only seen spam, but cutting off another's tool because some people can't use it correctly is a severe case of FYGM.

<comment><USER8> I don't know why you got downvoted so much, I share the same experience.

<comment><USER6> I expect it's a side effect from casual youtube users who've mostly experienced abuse of the feature and think i'm lying.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> An important note here, if you cannot enable monetize videos, YouTube will not allow you to link to patreon or other sites.

[https://i.imgur.com/byCxnAj.jpg](https://i.imgur.com/byCxnAj.jpg)

Its not enough for Google to ban you from ads, they have decided to cut off any other funding source aswell...

<comment><USER10> Yep. This move is about removing "advertiser unfriendly" content from YT, nothing else.

<comment><USER11> My understanding is that demonetization for "advertiser unfriendliness" is per-video. It doesn't influence the capability of linking to external websites, since this is an account wide capability.

</comment></comment></comment><comment><USER12> YouTube still hasn't stopped the hordes of fake accounts that spam every top creator's new videos.

Ex. PewDiePie video has a dozen comments from fake PewDiePie accounts (name, avatar) posting about "contest" link.

<comment><USER13> It drives me crazy how much this clutters search results. For years I would almost always sort by >20mins/upload date for whatever I was looking for (usually lectures/talks, hence the >20mins) but over the past few years where I used to get the most recent talk from $person, now I get a full page of reuploaded content from 1994, half of which is from the same spam user. Now my search of choice tends to be viewcount/<1month.

I now prefer mps-youtube for the majority of my youtube interaction. It's a gplv3 cli client, and then I just have VLC open up the video. No ads, no popups, no links.

[https://github.com/mps-youtube/mps-youtube](https://github.com/mps- youtube/mps-youtube)

You know, a long time ago when google bought youtube I remember thinking to myself that it meant it was never going to be the same. After things like the google+ name fiasco, etc (Jawed Karim's first comment on youtube was: "why the fuck do i need a google+ account to comment on a video?"), and many other scandals, and not seeing hardly a dent in their userbase, I wonder what it would take to get the users to another platform?

</comment></comment><comment><USER14> From the article it sounds like it's more cracking down on people who rip off other people's content and then use the link cards to get referral traffic to their own properties.

I don't think legitimate creators need to be concerned. From the article, the minimum requirement to be a partner is 10K public views. That's a relatively low bar, and you shouldn't be trying to be monetize when you have that low of a view count anyway.

<comment><USER15> > you shouldn't be trying to be monetize when you have that low of a view > count anyway.

Urm, why? Not everyone is in it for the advertisement money. Want to direct someone to a charity instead of supporting you? Not unless you're 10k+ Patreon? 10k+ Blueprints for the table you just built on screen? 10k+

Not to mention one of the requirements to be a partner is that your content is advertiser friendly. If you make videos about videogames, like Destiny 2, that rules you out.

<comment><USER14> Because 10K total public views is a vanity metric and people can just pump out total crap to get there. This to prevent a spam account from stealing content and monetizing immediately with external links vs. the grind of maximizing your view count. Last I heard 1 million views is about $2,000 in ad dollars from Google. Google has made it unfavorable to compensate based off of view count because there is so much inventory. So the only real way for creators to sustain are platforms like Patreon, selling merch, sponsored posts, or referral links base off of CPA. From what the article states, this prevents illegitimate accounts from siphoning from OPs.

If YT really wanted to keep the bar high in terms of quality creators they would base it off of number of subscribers and the level of engagement that those subscribers watch another video vs. a one hit wonder that goes viral.

<comment><USER16> Ironic how your answer to nullifying the "evil" spam is to force everyone else to create "good" spam. I mean "total crap".

</comment></comment></comment></comment><comment><USER17> Considering the crap ratio in these obnoxious end-of-video links and the fact that external links in the video description (e.g. to point to additional information) are still allowed, I don't think this is a bad thing.

I'd probably prefer it if the same rules applied to anyone though.

</comment><comment><USER18> Google is cracking down on links in their search results too, using AMP.

</comment><comment><USER19> Was youtube always tracking links in Video description? I dont remember ever noticing it, spotted it yesterday, every non google link is redirected with [https://www.youtube.com/redirect?redir_token=blabla+urlencod...](https://www.youtube.com/redirect?redir_token=blabla+urlencoded) link+video title

<comment><USER20> Think this happened within last 6-12 months. Not long ago it wasn't possible to see referral data from YouTube in something like Google Analytics without manually adding utm's. I noticed the data coming in automatically sometime in that period.

</comment></comment><comment><USER21> You know what I want YouTube to "crack" on? Assholes that say "But, what do you guys think? Let me know in the comments section bellow." Any video of those should be immediately demonetized.

This is a half serious rant, but seriously, video quality has gone so low over the last few years. There is practically a format that all those "professional" assholes follow. Does it really help them get more cash?

<comment> james-skemp I believe number of minutes viewed, number of comments, and number of likes and dislikes all have a part in the algorithm for how well a video does in YouTube's eyes. So yes.

Of course source: professional YouTubers who have talked about the changes to the algorithm over the years.

<comment><USER21> I am not talking about the algorithm. I am asking whether saying "leave a comment" actually makes people leave a comment? For me, that acts as a detergent and an automatic down-vote. Are people that gullible that they subscribe when told to, comment when asked, etc?

<comment> james-skemp I wouldn't consider myself a normal user, so I don't know.

"Like, comment, and subscribe" also was once a popular thing to say at the end of videos too. I'm sure for some individuals this would be beneficial to reinforce. For some it had no impact. For others (myself included) it would be mocked.

I guess the question is, does less than five seconds of text at the end of a video (which some people may not even see) hurt more than it could potentially help? My search terms don't seem to find such research, if it was done.

My assumption, however, is that there are plenty of people out there that will do it, and might look at the comments to see what others have discussed. And some just have to comment on everything.</comment></comment></comment></comment>


Fair.com gets $1B from BMW - <AUTHOR> https://techcrunch.com/2017/10/20/flexible-car-ownership-marketplace-fair-com-nabs-up-to-1b-from-bmw-penske-and-sherpa-capital/ <comment><USER2> In case anyone is interested: promo code SHAANR100 for $1,000 off start payment until 10/31/17 (doesn't include taxes, fees, registration).

Disclosure: I work for Fair :)

</comment><comment><USER3> Clarification: the debt portion of "up to $1B" is from Sherpa Capital. An unannounced but probably much smaller amount of equity was raised from BMW and others.</comment>


Linda McMahon for Senate 2012 - <AUTHOR> http://lindaforsenate2012.com/ <comment><AUTHOR> For the records: I'm not sharing to push a candidate, but just sharing the (rumored for a while, and now official) news. Also, of course, curious about the reaction of the HN audience</comment>


Singletasking by Caterina Fake (photo) - <AUTHOR> http://www.flickr.com/photos/caterina/3270176074/

<comment><USER2> This is a handy PDF guide to this principle that I found useful:

<http://practicalist.com/singletasking.pdf>

</comment><comment><USER3> I put together a background of this a month or so back: [http://sponge- ing.com/post/83361398/an-image-of-a-whiteboard...](http://sponge- ing.com/post/83361398/an-image-of-a-whiteboard-with-guidelines-for)

<comment><USER4> horus?

<comment><USER3> I need to correct that spelling error. Eeek.

</comment></comment></comment><comment><USER5> I have seen it before and, like last time, I really think I should follow some of this... I'm very bad at single-tasking and it doesn't help at all getting things done.

</comment><comment><USER6> My inbox is a monster. Usually I've something like 4000 emails in my gmail inbox, I read most of the things, reply almost only to very important emails if I'm busy. All the rest is a flow - like twitter.

Email is not a serious thing this days. It is too simple to send one, and people keep writing emails about things not important, or that are trivial to figure without any help, containing a lot more words than needed to express an otherwise simple message and so on.

Do you really want to pass half of your life reading/writing emails about things that don't interest you? I don't want. This is one of the things that may affect your work performance in a critical way.

<comment><USER7> My gmail inbox used to be like that until a friend of mine, visiting me, got so annoyed with it he archived the lot (with my permission).

Trying to stick at inbox zero after that has been a definite improvement, but it does make for painful periods when I'm away for a day and come back to a ton of unread rubbish I'd normally just archive as soon as it came in. Theoretically select-all-unread-archive is easier than interrupting focus, archive, resuming focus, but the mental burden of 200+ unread messages is not to be underestimated.

<comment><USER6> Argh... now my inbox is "zero" too, and you gave me the illusion that I can keep it this way. But I know that in few weeks it will be a mess again ;)

</comment></comment></comment><comment><USER8> Of course for this to work, you have to have someone at/near the top that believes in it!

(...says someone who used to work in a place that would have gotten me fired if I had worked like this.)

</comment><comment><USER9> This looks like treating the effect, not the cause.

What's the cause of allowing yourself to be distracted so much? Not focusing enough on your core work.

Once you focus on the most important thing, you'll be too busy to be distracted.

If you're not focusing on the most important thing, your problems are too big to be solved with a white board gimmick.</comment>


Lessons from Three Years in AWS - <AUTHOR> http://sef.kloninger.com/posts/aws.html

<comment><USER2> The NAT thing is a miss from a product perspective and something few, if any, want to spend time managing.

That said, there is a place for just using the NAT for software updates. For instance, if you're running Rethink -- or any self-hosted db -- there are few (if any?) good reasons to expose that service to public IP space. In that case, the NAT isn't particularly important after setup and can serve as a bastion host while your're at it.</comment>


Ask HN: Polymer or ReactJS? - <AUTHOR>

Hi, I've been trying to decide between polymer and react.
And from one side i have react with their license+patents clause, but with good browser support and big ecosystem not following web standards.
On other end I have polymer with better license, following web standards, but it has poor browser support - I think IE9 would be good since i plan to write support software so I can't depend on userbase having up to date browsers.
And polymer demos on polymer website and even google io do some weird stuff like flash icons/checkboxes on browser tab focus (maybe this is accessibility feature? It's very consistent in how this works).
I'd really like to go with futureproof solution that would be based on standards but I'm having tough time to decide. What are your experiences using both solutions? <comment><USER2> you are not describing your use case</comment>


Balanced's Architecture - <AUTHOR> http://blog.balancedpayments.com/balanceds-architecture/ <comment><USER2> Solid architecture. For those not familiar with payment industry terms PCI stands for Payment Card Industry. You usually know this as PCI DSS (Data Security Standard). Basically all the payment card providers got together and said that you need to follow these rules if you want to accept credit cards. The rules are pretty straightforward ( have a firewall, don't save CVVs, encrypt credit card #s at rest). You then pay an auditor to audit against PCI DSS.

If I were looking for vulnerabilities I'd probably start with any XSS. Chances are the credit card data is locked down tight and encrypted. But what if I can scoop it up as it gets transformed into a token? Also look at where you store the encryption keys to decrypt the card data. There are hardware devices you can use that are especially hardened.

The problem with bitcoin is that it necessitates an even more secure architecture because you don't have a 3rd party to run to if things hit the fan. Suppose all your credit #s got stolen in this case. You can run to Visa/Mastercard and they will invalidate the card #s in bulk. Or at least do monitoring on them. What do you do when all your bitcoins are stolen?

<comment><AUTHOR> With the Coinbase integration, the OAuth secret is the equivalent of the card number (and stored in knox like all other sensitive data, even though OAuth tokens are outside of PCI scope), and so if they got stolen, could be invalidated by Coinbase.

</comment></comment><comment><USER3> With a name like balanced, I was expecting double entry book keeping[1], so: you give an account to a device, e.g. the credit card processor, and measure how much money is entering and leaving the company per device. Plus you give accounts to each customer and measure money going in and out their separate channels.

Then you check these two different modalities of tracking money conclude your the same liquidity measure for your company.

If they do not then you have sprung a leak somewhere and can halt everything.

That would be an extra layer of security. Passing loads of tokens round is still a single point of failure at the conceptual level.

[1] [http://en.wikipedia.org/wiki/Double- entry_bookkeeping_system](http://en.wikipedia.org/wiki/Double- entry_bookkeeping_system)

<comment><AUTHOR> This post wasn't talking at all about ledgering, just about high-level components.

If ledgering is interesting to you, [http://blog.balancedpayments.com/the- ledger/](http://blog.balancedpayments.com/the-ledger/) and [http://blog.balancedpayments.com/state- machines/](http://blog.balancedpayments.com/state-machines/) are what you're going to want to read.

<comment><USER3> oh great reads. Thanks

</comment></comment></comment><comment><USER4> (Former PayPal employee here.)

I first have to give you a thumbs-up for calling your fraud detection layer "precog".

Does AWS let you firewall off Knox from the open internet? PayPal's architecture has most of the machines that touch payments isolated behind hardware firewalls, with only certain front-end machines able to punch through the firewall.

<comment><USER5> Amazon has VPCs which are virtual private clouds. They let you configure networks with specific requirements, such as being closed off from the outside world.

Once closed off from the world, only your servers within the public subnets can access those in the private subnet. By default, the private subnet can't talk to the outside world. You'd typically setup a NAT instance in your public subnet that tunnels your private subnet's internet to the outside world (because the NAT is in a public subnet, it can access the outside world).

That's just an example setup. It's a very powerful tool for securing your infrastructure. For example, you should typically put your databases, and anything that isn't password protected that stores information or something (except web servers) in a private network so that only your public servers have access to them.

User -> Public Network -> Public Server -> Private Network -> Private Server -> NAT (Tunnel) -> Public Network -> Internet

VPC does take quite a bit of effort to setup, but after that, it's pretty straightforward.

</comment></comment><comment><USER6> I wonder: is EC2 secure enough for this type of credit card store? What if the management layer running the underlying hosts is vulnerable or a XEN zero-day vulnerability shows up?

I'm sure Amazon does a lot on securing its infrastructure, but for credit card data wouldn't a physical, fenced off server be more secure?

<comment><USER7> I suppose it comes down to the amount of investment available. Amazon can pour resources into security, monitoring and have a large staff actively keeping an eye on such things. They're signed off for PCI compliance Level 1[0] (Any service provider that stores, processes and/or transmits over 300,000 transactions annually) which helps isolate you from a lot of costs around getting your dedicated hardware audited yourself.

It's also worth noting that Amazon.com itself is hosted off AWS (since ~2010) though I'm struggling to find a good cite for that

[0] [http://aws.amazon.com/compliance/pci-dss- level-1-faqs/](http://aws.amazon.com/compliance/pci-dss-level-1-faqs/)

[1] [http://www.dummies.com/how-to/content/amazoncom-runs-on- amaz...](http://www.dummies.com/how-to/content/amazoncom-runs-on-amazon-web- services-aws.html)

</comment></comment><comment><USER8> I love that plexiglass on the wall type of whiteboard. Is this a premanufactured solution or homegrown?

<comment><USER9> We repurposed the glass tabletops from IKEA desks and threw them on the wall for white boards ;-)

</comment></comment><comment><USER10> Am I wrong to want to know more about how (for instance) communication between the networks and components is implemented? This post, while well written, doesn't really answer the questions I might ask about any given architecture.

<comment><AUTHOR> You're not wrong! You can only fit so much in one post, and I wanted to keep it fairly high-level here.

I got asked this on Twitter, you might find the thread worthwhile: [https://twitter.com/moritzheiber/status/442037431089786881](https://twitter.com/moritzheiber/status/442037431089786881)

It seems like a lot of people are interested in hearing more details, so I'll try to get into that eventually in another post. Always more to talk about!

<comment><USER10> Thanks very much. The question about latency is certainly relevant, and I would add reliability to that too. I'd definitely be interested in a technical follow-up, when you have the time.

</comment></comment></comment><comment><USER11> I would really love to use Balanced, I'm really excited for the escrow and the bitcoin features... If only they accepted customers from the Netherlands.

<comment><AUTHOR> Yup, it's a bummer. We're working on it, but it's really hard. :/

</comment></comment><comment><USER12> Great post and diagrams. How do you manage/centralize logs ?

<comment><AUTHOR> Thank you, they took forever to draw... My handwriting is terrible.

We wrote about logging here: [http://blog.balancedpayments.com/status- page/](http://blog.balancedpayments.com/status-page/)

      > We already log these to a centralized server using RSYSLOG, so I already had
      > a data source to draw from. Next, I went and brewed a fresh pot of coffee and
      > bestowed it upon bninja for his prescient work in building our log parser,
      > Slurp. We wrote a quick Slurp script that read the HTTP status code from each
      > request and then fed them into Graphite buckets. Each bucket was based on
      > service name (DASHBOARD, API, JS) and then response code family (2xx, 3xx,
      > 4xx, 5xx, and a special case timeout for slow requests).

If infrastructure stuff is interesting to you, you may want to check out [https://github.com/balanced/balanced- infra](https://github.com/balanced/balanced-infra) . If there's interest, I might blog about it in the future.

<comment><USER13> what do you do when rsyslog drops log events?

<comment><AUTHOR> I am not an ops person, but my understanding is that rsyslog does 'store and forward', which would allow replaying of the log if something was dropped: [http://www.rsyslog.com/storing-and-forwarding-remote- message...](http://www.rsyslog.com/storing-and-forwarding-remote-messages/)

</comment></comment></comment></comment><comment><USER14> Great way to explain on a blog. Well done!

</comment><comment><USER15> Who removed (YC W11) from the title of this, and why?

<comment><USER16> The HN mods typically sanitize titles to match the title of the underlying article. (Except when they don't, of course.) They are generally unwilling to explain themselves, even when their edits are clearly making the title worse.

It's honestly a mystery to me why the system even lets submitters specify titles.

<comment><USER15> The problem I have is that Stripe, a competitor to Balanced, seems to keep the (YC S) emblem every time they have a story. It feels like YC is trying to hide the fact that Balanced is a YC company I guess. Pair this along with the fact that (IMHO) Balanced is killing it, but I only ever see PR about Stripe (except for a few weeks ago, when Balanced announced a partnership with CoinBase, another YC company)

But I could be paranoid.

<comment><USER17> > The problem I have is that Stripe, a competitor to Balanced, seems to keep > the (YC S) emblem every time they have a story.

That doesn't seem to be the case:

[https://www.hnsearch.com/search#request/submissions&q=Stripe...](https://www.hnsearch.com/search#request/submissions&q=Stripe&sortby=score+desc&start=0)

</comment></comment></comment></comment><comment><USER18> Yet another unlicensed money transmitter handling Bitcoin transactions (through another unlicensed money transmitter). What could go wrong?

<comment><USER19> Are you posting on the right thread? Balanced Payments handles credit card and ACH payments, not Bitcoin.

<comment><USER20> Balanced did start accepting Bitcoin through Coinbase [http://techcrunch.com/2014/02/20/balanced-coinbase- bitcoin/](http://techcrunch.com/2014/02/20/balanced-coinbase-bitcoin/)

<comment><AUTHOR> I expounded more on the technical details of that integration here: [http://blog.balancedpayments.com/more-details-about- bitcoin/](http://blog.balancedpayments.com/more-details-about-bitcoin/)

<comment><USER18> Expound on the details of your legal status. You're an "open company," right?

<comment><USER21> Ah yes, the scheduled trolling of payment companies by Aaron. Wouldn't miss it for the world.</comment></comment></comment></comment></comment></comment>


We broke the tomato, and we're using science to fix it - <AUTHOR> http://arstechnica.com/science/2013/02/we-broke-the-tomato-and-were-using-science-to-fix-it/ <comment><USER2> The Red Delicious apple underwent a similar change, being bred mainly for size and shelf appeal rather than taste. People stopped buying them in favor of other varieties, and the Washington apple industry, which heavily depended on the Red Delicious, had to be bailed out as a result.

[http://www.washingtonpost.com/wp- dyn/content/article/2005/08...](http://www.washingtonpost.com/wp- dyn/content/article/2005/08/04/AR2005080402194.html)

<comment><USER3> That article is useless without pictures. If people liked old apples better, why didn't growers just switch back?

Maybe people just happened to like other varieries that entered the market.

<comment><USER4> They have to wait for the trees to mature.

(which I realize is obvious, but if you have to wait 10 years or whatever, you can't exactly just switch back)

</comment></comment></comment><comment><USER5> I'm in the produce industry and every year someone claims to have a new variety of tomato that tastes like the tomatoes " your grandparents ate". When the new variety comes to market almost no one is willing to buy the product at a premium price. It happens over and over.

</comment><comment><USER6> Strawberries suffered the same sad fate.

I'm amazed at how huge, juicy, wonderful smelling, and almost completely flavorless strawberries have gotten over the decades. I still buy them a couple times a year, and am always disappointed.

</comment><comment><USER7> Interesting. I find non-heirloom tomatoes taste great as long as they are fresh. This means I can rarely get good tomatoes and only in the summer and early fall. My dad's garden and farmer's markets are the best, Costco tomatoes are a distant (but viable) second. Almost all the tomatoes I've bought in grocery stores are terrible - bland and pulpy.

I've read that the bananas our grandparents ate aren't the same as we get these days due to a blight that wiped them out. I'm not a huge fan of bananas but maybe these researchers should focus there as well. I would probably eat more bananas if they had a little better taste.

<comment><USER6> I agree completely... The ones that are ripened in the grocery store are bland and waxy tasting. I really miss the garden I grew up with in the '70s. There's no comparison to vine ripened tomatoes ( not to be confused with Vine Ripe brand, of course).

I don't know if you are talking about the same ones or not, but the Campari tomatoes that Costco sells are about the only store bought tomato I can stand... They're kind of like a giant cherry tomato.

<comment><USER7> Campari - absolutely. They are linked on a vine and as long as you don't detach the vine they will last a fair amount of time. They are fine straight from the store but they get better if given a couple days.

</comment></comment></comment><comment><USER8> In addition to the red delicious, the strawberries, and the tomato, count in watermelon. It's gotten so you can only buy seedless in the store, and seedless isn't close to the flavor of seeded.

On all of these, flavor has been bred out in favor of looks and hardiness, and we now have a generation of people who don't know what the stuff really tasted like. Hell, I'm forgetting what some of it is like myself, until I eat a different or heritage variety. And don't get me started on poultry.

</comment><comment><USER9> I'm a fan of what is marketed as "Grape Tomatoes"

<http://en.wikipedia.org/wiki/Grape_tomato>

They have a great flavor if you can get past the size

<comment><USER10> I'm not a fan because they have displaced cherry tomatoes which are better. Especially the Sungold variety.

</comment></comment><comment><USER11> I once saw a tomato tasting booth at a farmer's market with some 25 different varietals, and I'm sure there are hundreds of others just waiting to be grown. We don't need to science the solution.

<comment><USER12> The problem with those varieties is they don't produce the same yields.

</comment></comment><comment><USER12> Reminds me of chicken farmers that bred chickens that produced the most eggs - which resulted in highly aggressive chickens that would kill and injure their competitors and break their eggs. Or the wheat farmer that selected only for the largest kernels of wheat and got a crop that only produced a few massive kernels.

In this case we've created tomatoes that grow amazingly huge and fast and pretty looking, and yet they taste much worse. No one was selecting for taste.

</comment><comment><USER13> Part of the problem is that the tomato growers have been very successful in protecting their racket. When someone tries to sell a better-tasting tomato, the Florida Tomato Committee keeps it off the market.

</comment><comment><USER14> The title led me to believe that they were trying to fix the loss of nutrients and mineral content in vegetables like the tomato [1].

I was sorely disappointed to see it was just the taste. I would guess that fixing the mineral content by good farming techniques will enhance the flavor too.

[http://www.scientificamerican.com/article.cfm?id=soil- deplet...](http://www.scientificamerican.com/article.cfm?id=soil-depletion- and-nutrition-loss)

<comment><USER15> Soil depletion has little to do with Florida tomato quality:

"""the majority of the state's tomatoes are raised in sand. Not sandy loam, not sandy soil, but pure sand, no more nutrient rich than the stuff vacationers like to wiggle their toes into on the beaches of Daytona and St. Pete. "A little piece of loam or clay would go a long way," said Ozores- Hampton. "But, hello? — this is just pure sand." In that nearly sterile medium, Florida tomato growers have to practice the equivalent of hydroponic production, only without the greenhouses."""

[http://www.npr.org/2011/06/28/137371975/how-industrial- farmi...](http://www.npr.org/2011/06/28/137371975/how-industrial-farming- destroyed-the-tasty-tomato)

The page ends with an interesting description of the irrigation-from-below system ("seepage irrigation") enabled by the sand-on-hardpan conditions.

</comment></comment><comment><USER16> How about just stop growing shitty tomatoes? Fuck.

The tomatoes I eat taste great, because I don't buy tomatoes grown by ignorant assholes who don't understand how plants work.

<comment><USER4> I'm pretty sure that not understanding plants is not a problem that industrial agriculture has.

<comment><USER16> And yet their tomatoes taste like shit. I disagree.

<comment><USER4> They just target a market you are not part of.

</comment></comment></comment></comment><comment><USER3> I am not pleased with engineering for taste without regard for the corresponding nutrients that our taste evolved to detect.</comment>


Hellcat: netcat that takes unfair advantage of traffic shaping systems - <AUTHOR> https://github.com/matildah/hellcat <comment><USER2> This should work pretty well for tc/iptables shaping where you count the bytes in the connection and move to a lower class.

But I guess most of the time something like aria2[1] works better for real downloads - if you shape only for a single tcp stream this should also defeat this or at least speedup the download enough that the rate limit doesn't matter.

On the server side it's probably easy to stop this - nginx seems to have all you need[2],[3]. Just set a unique cookie for the download and deny access otherwise - not sure what the shared hosters are doing but likely something similar (mandatory waiting time before the cookie or url-hash is set, limit access based on connections/hash)

        limit_conn_zone $uid_got zone=cookie:10m;

        server {
            mp4;
            limit_conn cookie 1;
           	limit_rate_after 10m;
            limit_rate       512k;

        }

On the other hand it probably screws users for mostly no reason most of the time.

1: [https://aria2.github.io/](https://aria2.github.io/)

2: [http://nginx.org/en/docs/http/ngx_http_limit_conn_module.htm...](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)

3: [http://nginx.org/en/docs/http/ngx_http_userid_module.html](http://nginx.org/en/docs/http/ngx_http_userid_module.html)

<comment><USER3> Can you use aria2 to abuse the network shaping for something like SFTP? Or does the handshake dwarf the performance benefit?

<comment><USER2> Good question. I think the only thing aria2 does is using multiple connections - that should work on SFTP.

<comment><USER3> I could TIAS later but does it somehow carry your login between connections?

</comment></comment></comment></comment><comment><USER3> The commit messages for this are gold. [https://github.com/matildah/hellcat/commits/master](https://github.com/matildah/hellcat/commits/master)

<comment><USER4> "mkdir src, put stuff in it."

"we need 4 argz"

"i fail at operators"

</comment></comment><comment><USER5> I've seen other scripts utilizing curls --speed-limit and --continue-at for http to restart the download after the throttling kicks in and resume the download on a new connection. Really nice!

</comment><comment><USER6> I wrote a while ago a shell script utilizing curl to do something similar. But many pages stop high speed download after about 100mb. Not just a couple of kb. So using this approach is actually quite nice. [https://github.com/BrandiATMuhkuh/downloadAccelerator](https://github.com/BrandiATMuhkuh/downloadAccelerator)

</comment><comment><USER7> Could anyone with a custom OS make their own TCP stack that violates all rate limiting and always sends data as fast as possible / reports a humongous window size?

<comment><USER8> >violates all rate limiting

Rate limiting is performed upstream; the network isn't just asking nicely. Your packets will be either queued or dropped if you send them faster then allowed.

Some ISPs allow high speeds for the first N megabytes (often 20 or so), then throttle the shit out of the rest. This trick presents an entire stream as a bunch of little streams, so that you get the "first 20MB" treatment for the whole thing.

Depending on circumstances, the "upstream" place where rate limiting is performed may be your cable modem. People have been known to reflash their cable modems with cracked firmware that doesn't honor the rate limit. This is easy enough to detect and punish further upstream.

</comment></comment><comment><USER9> Is it really faster to do a whole FIN / ACK / FIN / ACK / SYN / SYNACK / ACK every N bytes? How much does this sort of traffic shaping typically throttle, and how long does it typically give a connection?

Can this be easily parallelized? I'll bet it could.

<comment><USER10> Comcast had a feature called "Powerboost" ([http://www.dslreports.com/faq/14520](http://www.dslreports.com/faq/14520)) that would let you burst up 100mbit or something for the first 20MB of a file. I'm not sure if this is still being offered, but I bet it would be awesome with Hellcat.

<comment><USER11> I think that might be a bit outdated since it refers to DOCSIS1, and I haven't ever received a package offer from Comcast before below 200Mbps or so

<comment><USER12> In my area, I have the highest tier of Comcast service (residential) at 75 mbps.

</comment></comment></comment></comment><comment><USER13> Is this a problem where multiple connections wouldn't help?

I can add an option to saldl[1] to use a new connection with each chunk. But I'm not sure there are real world examples where this would help.

[1] [https://github.com/saldl/saldl](https://github.com/saldl/saldl)

</comment><comment><USER14> The HN comments suggest there are other ways to do this. Is this another one?

[http://lftp.yar.ru/lftp-man.html](http://lftp.yar.ru/lftp-man.html)

See pget.

I really like the simplicity of hellcat, but IMO original netcat's brilliance is partly due to its portability and resistance to bit rot; it does not use getaddrinfo and I cannot think of any good reason one needs to use it.</comment>