What does it take to run a web app with 5K – 10K users? - <AUTHOR> A few years ago I was inspired by this artice: http://viniciusvacanti.com/2010/11/01/6-things-you-need-to-learn-to-build-your-own-prototype/. Now I am able to build my own Rails apps and run them in production. I am now wondering what it takes to launch and successfully run a website with 5-10K users? All the articles I have found doing a web search were vary basic. <comment><USER3> The most difficult thing is going to be getting to 10K active users :)

These days RAM is cheap and SSD storage is also widely available. For a very long time, one of my side projects with 50K users was hosted in a EC2 small instance. With that out of the way, here are a few things you will need to take care of:

* Security (especially passwords) - Rails should take care of most of this for you, but you should ensure that you patch vulnerabilities when they are discovered. Also, stuff like having only key-based login to your servers etc.

* Backups - Take regular backups of all user data. It's also VERY important that you actually try restoring the data as well, as it's quite possible that backups are not occurring properly.

* One click deployment - Use Capistrano or Fabric to automate your deployments.

* A good feedback/support system - this could even be email to begin with (depending on the volume you expect), but it should be accessible.

* Unit tests - as your app grows in complexity, you will never be able to test all the features manually. I'm not a big fan of test driven development, but really, start writing unit tests as soon as you have validated your product idea.

* Alerts, monitoring and handling downtime - Downtimes are inevitable. Your host or DNS could go down, you might run out of disk space, etc. Use something like Pingdom to alert you of such failures.

* Logging, logging, logging - I can't stress on this enough. When things break, logging is crucial in piecing together what happened. Use log rotation to archive old logs so they don't hog the disk space.

<comment><USER4> > Logging, logging, logging - I can't stress on this enough. When things > break, logging is crucial in piecing together what happened. Use log > rotation to archive old logs so they don't hog the disk space.

How do most people manage activity logs? Currently what we have set up is the user id (if the user is logged in), IP address, URL they hit, user agent, and timestamp are all inserted into an activity logs table. For one particular site with an API that's being polled the size of the DB grew pretty large.

<comment><USER5> Off-machine logging. There are commercial services (we're using Papertrail but there are tons of them), roll-your-own solutions (Elasticsearch-Logstash- Kibana), and simple solutions (syslog).

For an easy and simple solution, spin up a second instance and send logs to it via rsyslog over a private network interface. Most mature frameworks provide a method to send logs over syslog. It's UDP and very lightweight. Another plus: if you are compromised, you have another server with your logs and that server isn't running your vulnerable app.

<comment><USER6> We're running the Elasticsearch, Logstash, Kibana (ELK) stack with the recommended approach i.e.:

      logstash client
                       \
      logstash client --> redis -> logstash "server" process -> elasticsearch <- kibana
                       /
      logstash client

We have a high logging load (we log every request) due largely to IRS requirements. I've been really happy with it over the past 6 months but something that cannot be overstated is that you'll _really_ need to become familiar with each one of the technologies used as each requires it's own setup and configuration. Not being familiar with any of them, it took me a solid 3 days to get to where the whole thing was usable and performant. Troubleshooting it is a breeze, and the whole system scales really easily, but a lot of that time was invested up front.

<comment><USER7> Just curious about the redis-in-the-middle. Any references so I can dig deeper?

</comment></comment></comment></comment></comment><comment><USER8> Despite what the smart engineers of HN are going to prattle on about running a web app, it's not about systems infrastructure. It's about people. 5-10K user records in the DB, relatively speaking, is a small list and can be kept on a single pretty minimal server instance.

10K user records is not the issue. It's dealing with the humans who use the app on a day to day basis.

Typically getting only a small fraction of your user base to be active in the app is pretty challenging - if you can acquire them in the first place.

That said, having even a few hundred active users can tip the scales in terms of what is manageable, depending on what the app does and whether they're paying money or not. Customer support can be a full-time job or worse. In the early days your users will discover every bug and problem imaginable.

Biggest mistake I ever made was scaling up an active user base on a free product without a revenue model. Twice I managed to hit a sweet spot in acquiring active users but because I couldn't leverage the scale to achieve anything other than more work for myself, I burned out and it collapsed very quickly. If you make more money as you grow, you can afford to invest in delegating responsibilities or at least justify it. Otherwise you've got a very stressful hobby on your hands..

Quick add-on edit:

If you're launching a web app for the first time, the biggest takeaway you should get from the comments on this thread is _anticipate that customer support will be a major challenge_.

One of the best ways to prevent a flood of CS inquiries is aggressive logging and alerts to squash bugs or outages before they inconvenience too many users. Lots of great comments in here cover that point, so take notes.

<comment><USER9> I run a free product without a revenue model as well. (DuckieTV, a chrome extension / node-webkit app, [http://schizoduckie.github.io/DuckieTV](http://schizoduckie.github.io/DuckieTV) )

I have zero costs though, since it's serverless and all hosted on Google and Github's infrastructure.

For privacy reasons I have made the deliberate choice to not include any log reporting tools or use any tracking services that could possibly make development a whole lot easier.

Thankfully I get some support from a couple of other people that mostly help with small dev tweaks and supporting users, finding out what goes wrong and providing excellent feedback.

I can really recommend setting up a subreddit so that people can help themselves and others, and you can provide some feedback where needed.

All in all the load of user support has been quite easily manageable, though now with Trakt.TV's debacle with the new API there is definite pressure to fix things.

</comment></comment><comment><USER10> I run Minimal Reader [1] (which has about 5k users) and I can say that running a web app like this takes a lot of time and energy keeping everything running smoothly.

My service has a lot of moving parts, all of which are distributed among a couple dozen different servers. Keeping the technical infrastructure running smoothly requires a lot of data visualization of server stats, database stats, web request stats, worker stats, user stats, etc. I have everything piped into a nice dashboard so we can see if there is anything odd happening at a glance. When things break (and they will) you need to know where to look first.

Having 5k users also requires time to help them with support issues. Users generate a lot of bug reports, questions, and suggestions. To keep paying users happy, I offer a 1-day response time on support issues, which requires me to spend quite a bit of time sending emails.

Then, of course, if you want to grow the app, you need to spend time marketing it. We could talk for hours about this.

The list goes on and on. Feel free to shoot me an email (email in my profile) if you want to talk specifics about anything.

[1]: [https://minimalreader.com/](https://minimalreader.com/)

<comment><USER11> 24 servers? Can you elaborate on your architecture a little more? What tools do you use to help you manage them?

<comment><USER12> One server to serve an RSS reader to the 5k users, 23 others to host 23 different stats and monitoring applications to make sure that one server is working OK?

<comment><USER13> I can't speak for him, but the RSS reader I am working on at the moment is similarly split into multiple parts:

* Crawler - retrieves RSS feeds and parses articles

* Database server

* Analyser - performs semantic analysis and various other statistical processing on posts

* Propagator - pushes new posts to everyone's feed

* Cacher - serves a cached copy of the user's feed

* Web server

Based on loads I would just add more nodes depending on what was needed.

<comment><USER10> Pretty close :)

</comment></comment></comment></comment></comment><comment><USER14> It's relatively simple to create a server that can handle the traffic as long as your app is something simple. The 10k users you're talking about I'm assuming is monthly active users (means they visit your site once or more per month) I have a website (yes a "web app") with 120k active users per month. It's running just fine on a relatively small server. To get users usually you need to give them something to come back to because they feel like it's something that they can't do without, maybe something that only you can provide, and something that makes them feel good and causes them to keep coming back to you to get their dose. If your question is more about technical details, then I'd just suggest not to worry about that until you have to, ie. your server is crapping out right before your eyes, that's a good problem to have. However, one mistake that I have made is to give up eventually on something that I may not see the immediate value in just b/c it's bit too difficult to maintain. So having said that don't waste a second optimizing something that no one's gonna end up using in 3 months. Everything else is really just noise.

<comment><AUTHOR> Thanks for the comments

</comment></comment><comment><USER15> That's not a very meaningful metric on its own. 5K users per day? Per month?

How's the distribution of traffic? Do people use it spread out over the month or mainly within the last or first days of the month? Do they use it on work days or throughout the week? Are they from different time zones?

What do they do? Is there a lot of write activity or is it mainly read? Is the read stuff cacheable between users or is it highly individualised. etc. etc. etc.

</comment><comment><USER16> Obviously this depends a lot on the kind of usage patterns your application provides, but in my experience you should be able to comfortably run a 30k _daily_ users (the total n. of registered users could be 10x-100x that, depends) web app on a single $200-300/mo AWS machine (with hourly payments, you can get a better rate by prepaying). Get a bunch of cores and plenty of memory and put both your web app and the DB server on the same box for ultimate simplicity. Postpone scaling efforts for as long as humanly possible, probably until PMF and accelerating growth.

With reasonably "low level" tooling such as Java/Clojure/Haskell/whatever and a properly configured Postgres instance you should be able to go quite far. You're very unlikely to be CPU-challenged in the web app (again, no idea what your web app is going to be doing, so it's just a guess), most of the memory and CPU will be consumed by your database server caching and running queries. You should be able to handle a good 500-1000 db transactions / sec without much hassle.

IMHO most of the challenge will be making something that 10k people will want to use daily, not actually being able to scale to that many users.

</comment><comment><USER17> I run Plunker ([http://plnkr.co](http://plnkr.co)) that gets up to 20k daily active users. Users hammer the preview server[1] all day long generating a significant number of requests (by default it refreshes at each keystroke, debounced by 500ms or so).

That server runs happily as a single servo on [http://modulus.io](http://modulus.io) with absolutely no need for intervention on my part.

The rest of the application has similar requirements. I have one micro- equivalent server running the front-end, one the api and one the thumbnail generation. In general, this requires no hand-holding by me.

If your site is not processing or memory-intensive it should be feasible to scale to 10k users with a single $5/month instance on DigitalOcean or an equivalent level server on Heroku or Modulus or GCE.

Good luck attracting your first 5k users!

1: [https://github.com/filearts/plunker_run/](https://github.com/filearts/plunker_run/))

</comment><comment><USER18> PlainSite ([http://www.plainsite.org](http://www.plainsite.org)) has about 12K users per day on average. Most of them are just browsing for cases, not paying, but some are paying.

The main stress on the system is really determined by the complexity of the SQL queries on each page. I've spent a great deal of time optimizing them, and I know there are certain ones that need to be further optimized. I have the database (MySQL) on one server, the web server and documents on another, and static resources such as images on a third, which probably isn't even necessary. All three servers run Linux and the database server has 48GB of RAM. They're hardly new; you could buy all of this equipment today for under $1,000 total.

The biggest technical bottleneck is really RAM; the biggest expense for this kind of site is bandwidth.

</comment><comment><USER19> Depends on what the app does, of course.

I have [http://ficwad.com/](http://ficwad.com/) sitting around, with Google Analytics telling me it gets daily users in the upper end of that range. It runs on the cheapest plan webfaction offers (and I'm making it even cheaper with some affiliate credit...). The only place where it's running into issues is email, which I had to write a little queue system to throttle the sending to keep it under the plan's daily limits while still making sure that the important messages go out first.

I could make it fancier and put it on pricier hosting if I bothered to monetize it in any way.

</comment><comment><USER20> I have a little over 10k DAU for [http://cronometer.com/](http://cronometer.com/) and it runs on 2 fairly small cloud instances + a cloud database. A single host can handle the load fine, but I keep 2 running to survive failures.

And it took me nearly 4 years to get that many users. We can't all grow like facebook!

<comment><USER21> I had never even heard of your site. Could it be you need to do a little marketing?

<comment><USER20> True, it started as a hobby, so it's been fully bootstrapped and I've spent less than $2500 on actual marketing to date. Advertising in the Health / Diet space is super pricy, the ROI still doesn't make sense. CPA >>>>>> LTV

<comment><USER22> Just a quick note: The links to foods on your front page point to the wrong URLs :)

</comment></comment></comment></comment><comment><USER23> Are you talking about 5-10k simultaneous users? It's very subjective depending on the usage profile of your site. The best thing is to pick a service like AWS/Heroku/Cloud Hosting Service that allows you to grow your offering. After you get to a point of profitability, you can look at greater efficiencies like setting up your own hosting hardware depending on your needs, if that makes sense. Our company has grown to a point where we are looking at implementing our own multi-datacenter cloud to save on hosting fees. But that's a good problem to have :D

</comment><comment><USER24> In my experience running [https://thisaintnews.com](https://thisaintnews.com) the hardest part is getting and keeping users. It would probably be easier if I did some marketing, but that's too much like work! Still, it's not doing bad for something that's been around for 6 years, and hasn't been worked on in a year.

The second problem is motivation, after a certain amount of time, it becomes far less fun and much more of a burden, at which point you have to decide if you'll power through, give up, or quit totally.

The rest is just a software/hardware problem, and easily dealt with when needed.

As for the load, it's not that busy, but not that quiet for what it is, ([http://stats.thisaintnews.com](http://stats.thisaintnews.com)) and it runs on a cheap server from [http://www.kimsufi.com/uk/](http://www.kimsufi.com/uk/), has a Xeon(R) CPU E3-1225 V2 @ 3.20GHz, 16Gb ram and 2x 1tb hdd, unlimited bandwidth and 1gbps link. It only costs about £25/month iirc.

</comment><comment><USER25> Okay -- "what it takes" is a pretty broad question, but I'll do my best to put some thoughts together. I run a few web applications, but the most popular one is [http://sleepyti.me](http://sleepyti.me) \-- with about ~50-60k views per day.

\- A reliable hosting environment. I currently have a Linode VPS (basic $20 package, with $5 monthly backups) that runs [http://sleepyti.me](http://sleepyti.me), my personal web site, an IRC server, a Mumble server, and a bunch of other stuff -- it's not even close to being maxed out resource wise, even with all the constant traffic the site is getting. It's important to remember that _consistent_ network connectivity is a really important aspect here: a 30-minute downtime during peak hours can easily lose a lot of users. I'd say Linode is great, and I'm very happy with their service, but I also host several Sinatra web applications on a Digital Ocean VPS that only costs _$5_ per month (although I do my own backups, rather than using their service). I've noticed zero load-related performance impacts. Clearly, though, there is a limit to how far that can scale.

\- A production web server. This probably goes without saying, but a lot of webapp developers are used to just working on their own dev environment. For my apps, I use nginx (and thin, when necessary).

\- Security. Make sure that you have the basics of application security covered in your app itself. OWASP produces some pretty great "cheat sheets" that can help out in this area. Furthermore, make sure that your server is updated frequently, using SSL correctly, etc. I work in information security -- please believe me when I say that getting hacked is _not_ something you want to deal with when you're trying to grow.

Hope this helps, and good luck with launched your apps!

<comment><AUTHOR> Thanks for the tips

</comment></comment><comment><USER26> Since the article you point to is about programming then I'd assume your asking about the technical side of things rather that actually acquiring 5-10k users (which is very difficult). It's an interesting question, but as you have it phrased it's similar to "how long is a piece of string."

Firstly, the load of a web app is going to be dictated by what the app actually does.

Also 5k-10k users should be clarified as to whether you mean total users or concurrent users. Testing capacity can be actually tricky figuring out how the number of users equates to actual hits to your servers.

As an example, we have nearly 50k accounts but on average only a few hundred are using the service at the exact same time. I would guess that our app is fairly complex compared to the average app. We run 3 app servers, 1 DB master, 1 DB slave, and 2 cache servers. Our monthly hosting bill is around $1,200.

</comment><comment><USER27> 1\. First off, don't think too much about what programming language/framework to use. For such a user base you can use mostly anything and it'll run smooth on a low spec server. Using Ruby and Rails for a website with 5-10k users (assuming they're active users) will definitely not cause problems or empty your CC.

2\. Do not invest time and/or money in learning another programming language or framework until you are sure that for a specific component of your product, programming language X will perform at least 2 times better with 2 times less HW resources.

3\. Stressing again on the app stack (I saw some really pushy comments on changing the programming language), it is rarely the bottleneck of a web app. You'll scale your storage stack way earlier and more often than the app stack.

4\. Know your data. That's how you decide if it's better to use a RDBMS, document store, k/v store, graph database etc. Like I said before, you're going to scale your data before any other layer becomes a problem so choosing the right data storage solution is crucial. Don't be afraid to test various storage solutions. They usually have good -> great documentation and ruby tends to be a good friend to every technology. There's a gem for everything. :)

5\. Scale proportionate to your business/product growth. You will have to scale at some point. But be careful to scale proportionate to your growth. For example, if the number of users will double, get the hardware that suffices that growth. Less HW resources will lead to a slower user experience thus user dissatisfaction. More HW resources than needed will increase your costs and the resources that are not needed will stay unused. Why waste money?!

These are my 2c. As your business gets bigger - I hope it does - <USER2> problems will occur. But usually these things will last up to 100k users.

Disclaimer: this is for a generic web app as you didn't give us any details. Depending on the app, some of my points might be inaccurate or invalid.

</comment><comment><USER28> Before we sold WinJunkie.com we had: \- 75K users \- 5K daily w/ 10K burst on Sundays \- Over 1M db transactions \- Rails \- Redis \- Memcache

Heroku: $279 - 400 / month

<comment><AUTHOR> Thanks, that's good information

</comment></comment><comment><USER29> I think you're asking a capacity planning question. To the extent that you're asking a capacity planning question, for most apps in the Rails sweet spot (CRUD which takes data from users, munges it, and stores it in the database, perhaps interacting with a few external APIs and making occasional use of more advanced things like e.g. taking uploads and storing them in S3 prior to processing by queue workers), you're going to not even notice the day that your user count hits 10k.

If you back out the numbers, they go something like this: eight hour work day, worst hour has 25% of the user base actively logged in (we'll assume it is a _very_ sticky app), 10 significant actions per hour implies 25k or so HTTP requests which actually hit Rails, which is less than 8 requests a second. You can, trivially, serve that off of a VPS with ~2 GB of RAM and still have enough capacity to tolerate spikes/growth.

Let's talk about the more interesting aspects of this question, which aren't mostly about capacity planning:

Monitoring: Depending on what you're doing, at some point between 0 users and 10k users, the app failing for long periods of time starts to seriously ruin peoples' days. Principally, yours. Depending on what you're doing, "long periods" can be anything from "hours" in the general case to "tens of minutes" for reasonably mission-critical B2B SaaS used in an office to "seconds" for something which could e.g. disable a customer's website if it is down (e.g. malfunctioning analytics software).

I run a business where 15 seconds of downtime means a suite of automated and semi-automated systems go into red alert mode and my phone starts blowing up. I don't do this because I love getting woken up at 4 AM in the morning, but because I hate checking my inbox at 9:30 AM in the morning and realizing that I've severely inconvenienced several hundred people.

You're going to want to build/borrow/buy sufficient reliability for whatever problem domain it is you're addressing. I wouldn't advise doing anything which requires Google-level ops skills for your first rodeo. (There is a lot to be said for making one's first business something like a WordPress plugin or ebook or whatnot where your site being down doesn't inconvenience existing customers. That way, unexpected technical issues or a SSL certificate expiring or hosting problems or what have you only cost you a fraction of a day's sales. Early on that is likely negligible. When an outage can both cost you new sales/signups and _also_ be an emergency for 100% of your existing customer base, you have to _seriously_ up your game with regards to reliability.)

Customer support:

Again, depending on exactly what you're doing, you will fail well in advance of your server failing on the road from 0 to 10k users. Immature apps tend to have worse support burdens than mature apps, for all the obvious reasons, and us geeks often make choices which pessimize for the ease of doing customer support.

My first business produced a tolerable _rate_ of support requests, particularly as I got better about eliminating the things which were causing them, but I eventually burned out on it. I have a pretty good idea of what my second one would look like if it had 10k customers -- that would imply on the order of 500 tickets a day, 100+ of them requiring 20 minutes or more of remediation time. This would not be sustainable as a solo founder. (Then again, if that business had 10k customers, revenues would presumably be in the tens of millions, so I'd have some options at that point. There are many businesses which would not be able to support a dedicated CS team on only 10k customers, like e.g. many apps businesses, so you'd have to spend _substantial_ brainsweat on making sure the per-customer support burden matched your unit economics.)

The biggest issue: selling 10,000 accounts of a SaaS app is _really freaking hard_.

</comment><comment><USER30> Depends what they're doing. With a Linode + LEMP stack you can serve millions of users. I'd say MySQL is usually the bottleneck but if you have time to perfect your software, there's no telling how many users you could serve from a good VPS account. Don't get caught up in the hype. Cost of the hardware is not really prohibitive. Finding someone that knows what to buy and what to do with it, good luck!

</comment><comment><USER31> > I am now wondering what it takes to launch and successfully run a website > with 5-10K users?

What do you mean by this? Doesn't this depend on the usage patterns? Do you have 5-10k concurrent users or are these users spread over a day?

The operations side is a whole other profession that dovetails into the technical aspects of getting it running on a good architecture.

</comment><comment><USER32> I'm not sure how system intensive Rails app is, but we ran a Facebook game with 20K daily active users on a $8/mo Dreamhost, back in 2008, with a fantasy league and all. My point is, unless you're doing something extraordinary, I doubt you would need more than a VPS.

As others have mentioned, multiple of those users can be hosted on an EC2 small instance. I suggest you start there. When moving to production, a bigger challenge is security, both in terms of intrusion and data protection. Making sure you have good rollback feature built into your rollout regime, because things can be fatal with real users. If you're using something that's basic like Heroku or EC2, you can scale way beyond that user strength with a click of a button. Scaling up would be least of your worries, at least for a few weeks.

If you're unsure, go with Heroku. Once you understand your system use, you can very easily switch to AWS and reduce costs.

</comment><comment><USER33> I can think of three things that you'll really really really want to be on top of while scaling up

1\. your architecture must allow for vertical scaling. this means upgrading your hardware to beefier, stronger, faster machines with more CPU power and more memory. vertical scaling is often a very cost effective of improving performance.

2\. your architecture must allow for horizontal scaling. this means being able to provision and deploy new instances of your application servers very easily, using an automated process. more servers running in parallel is a very effective way of handling increased load.

3\. you must be able to monitor and protect your systems. https everywhere. highly secure passwords everywhere, and you should rotate your passwords on a regular basis. log everything and set up services to monitor your logs and notify you when weird/bad shit happens.

<comment><AUTHOR> Thanks for the advice

</comment></comment><comment><USER34> It mostly depends on what the users do. If the interaction is minimal and most pages can be rendered once and then served from cache you can run this on a laptop. If interaction is intense and everything has to be generated on the fly it could tax a mid range server. It all depends on the use case.

</comment><comment><USER35> Well, I think good indexing is key. How do you have your indexes. If they are aligned with what is frequently queried then you should be in good shape. A database of 5-10K users isn't difficult these days for any major DBMS. The key lies in the other things attached to the users and items you query. That can run into the millions. Even that is not much, but depending on how many times you query a million row table, it could put a pinch on your optimization.

Good database mechanics is key. That is the most important thing in my opinion. That is really the whole point in rails when you are deciding relationships. The abstraction in Rails when deciding what should be the best model structure is the same thing as deciding what should be the best and most efficient table structure in your database.

The rave about MongoDB is that it (maybe not quote me on this) "cures" the need for the desire multi-dimensional database. However, even with MontoDB's ability to expand due to it's not needing a pre-defined structure and the ability to expand out dimensionally to a certain extent, PostgreSQL (claims anyways) is still more efficient if you correctly index your tables (think about how you will be querying) and create the correct relationships. Build out models. Allow flexibility.

Also, don't forget caching. Redis and performing jobs is key in certain situations. However, don't get caught up in too much hype. Especially those coming from closed source technologies (Not just talking about caching technologies here but everything in general). They will sell and produce an atmosphere of necessity, but do some research first. Don't follow the heard. I am not going to call anyone out on this. Just do the research and think why is that necessary. I've mentioned Redis a few times and maybe that isn't even necessary either.

Most importantly, put your stuff out there. If it crashes, so what! At least you know you have something. And then you will have people who will give you advice in a coherent direction if necessary.

I salute you in your efforts. Now the most important part is put it out there and kick ass!

You may even want to look into Redis which is a cache system.

<comment><USER35> Also, I forgot to mention since I am miles deep in my own program and hoping a couple bottles of wine will assist me in getting this app hammered out, but make sure you have a good git system going. A live repo, a dev repo and a staging repo at minimum. And at "another minimum", you probably at least want these three repos both on your remote server and local server.

Eventually you will want to maybe bring on other developers. Have a good private repo on Github. That is a choice of course. This way you can choose what to merge into your live branches. You just need to find a good groove. Git is beautiful. It really does help in organization of your development process.

And analytics. I'm a bit absent on this. The reason why is that you are a developer. You will eventually know what you want to know and even if you need to bring on another developer due to time constraints and such, you will know how to develop out personalized analytics that you want out of your app. I mean it is almost evolution. You build an app. Then you want to know what's up. You know the app the best so you will develop loggin and analytical methods to provide you with what you want to know. So again. Unless you are looking at a gem that will help you with visualizing what you are going to develop on the analytical side of things, don't get overwhelmed. You know best. You built it. It's beautiful, and if your app is really a hit, you will plug in chug and make it work.

</comment></comment><comment><USER36> @DHH's startup school talk says it best.

"Scaling problems rule . . . "

[http://www.youtube.com/watch?v=0CDXJ6bMkMY&t=23m34s](http://www.youtube.com/watch?v=0CDXJ6bMkMY&t=23m34s)

Sounds like you have the skills to grow this up to 500 to 1k paying customers on your own. Early on you can increase ram/cpu to handle any initial scaling issues.

Once you even have 1k customers you'll have revenue to hire experts to help you with scaling and security.

Good luck in 2015.

</comment><comment><USER37> I am hosting upbeatapp.com on heroku's free tier. We have ~10k users, with ~250 concurrent at peak.

Getting the users and keeping your head in the game is the hardest part.

</comment><comment><USER38> I have an online game that has 16k active users and for the backend I use a $90 per month dedicated server. I can share the details if you want but my point is you won't necessarily need a huge server to maintain 5-10k users.

</comment><comment><USER39> Could you clarify if its 5-10k users concurrent? per month? per day?

</comment><comment><USER40> I run Reverb ([https://reverb.com](https://reverb.com)) and there's a lot of good information in this thread. Backups, Security, Alerts, Monitoring, all good things.

However, the biggest piece to scaling your application is the automation of everything you possibly can so that you can scale when you need to. You're going to be in a bit of pain if you need to scale everything manually.

Here's a few things I automate using Jenkins:

* Creation of web application servers(whether it be Puppet, Chef or Ansible, etc) make sure you can bring up a new node quickly and scale your app layer horizontally. Ideally automate the addition of this node to the LB.

* Data store backup/restores to all staging environments on a schedule(tests backups/restores) this is done using some custom code and the Backup gem. This way your dev team has access to an env that closely resembles prod and can resolve current prod bugs.

* External security scans using NMap (again using custom scripts). The jenkins job will fail if output is not as it expects. This way if we change a layer of our infrastructure we can know if something is exposed and shouldn't be.

* Static code analysis using Brakeman

Information you're going to need to scale your infra:

* Metrics on each one of your hosts. Use DataDog if you can afford it, integrates with all major systems and technologies. Great tool.

* Log collection via something like Logstash or Loggly and being able to visualize your application and web logs.

* Application response time measurements using something like NewRelic or building your own using StatsD and tracking the heck out of your application actions

Last but not least, have a plan for failure. While you're laying in bed at night, ask yourself these question:

* What would happen if the DB went poof? Can I restore it? How much data will I lose from the last backup? Will I know when this happens?

* What would happen if you're now being scanned by 30 ips from the netherlands, all of which are submitting garbage data into your forms. Are you protected against this? How will the added load effect your app layer? Do you have a way to automate the responses to those requests so as to deny them? This is a case of when, not if. Be ready.

* What would happen if my site gets put on Digg(lol)?

There's no magic bullet here. It's just practice, failure and learning from yours and others mistakes.

Good luck!

</comment><comment><USER41> Probably the first thing would be to drop ruby and use the PHP Zend framework or node and a nosql db.</comment>


ICANN proposes to lift price limits on .org TLD - <AUTHOR> https://www.icann.org/public-comments/org-renewal-2019-03-18-en <comment><USER2> _Pricing for Domain Name Registrations and Registry Services (Section 2.10 of the .org renewal agreement): In alignment with the base registry agreement, the price cap provisions in the current .org agreement, which limited the price of registrations and allowable price increases for registrations, are removed from the .org renewal agreement._

<comment><AUTHOR> This is somewhat misleading. While technically true, they are comparing .org TLDs to the newer gTLDs (e.g., ".google"), but the legacy TLDs should not grouped with these for a reason.</comment></comment>


Show HN: Tet – A todo app that deletes your tasks at the end of the day - <AUTHOR> http://tet.aswinmohan.me/ <comment><USER2> I once read a statement attributed to Steve Ballmer that every six months, he tears his todo list in half and throws the bottom half away. If anything far down that list was actually a priority, it will naturally get re-added (by thinking of it again, in response to a customer, etc.).

My implementation of that approach is to do the following each month:

        1. Export all my unfinished todo items older than 6 months.
        2. Place that export alongside my other backups.
        3. Then delete those items from my todo app.

I deliberately do not look at any of those items during this process, lest I be tempted to dive back into them.

That way, I limit my total mental clutter while retaining some peace of mind, since I know that I can get back to those items (I sometimes attach photos, notes, etc. to tasks) if needed. I never do.

<comment><USER3> That's an interesting idea. I picked up this book, Principles of Product Development Flow, based on some recommendations I think I came across here on HN:

[https://www.goodreads.com/book/show/6278270-the- principles-o...](https://www.goodreads.com/book/show/6278270-the-principles- of-product-development-flow)

Reinertsen really helps you appreciate the costs associated with queues (of which the TODO list would be a common form) and this seems consistent with the principles he advocates.

One key quote related to this that I am still trying to wrap my head around:

 _Few product developers are aware of the causal links between high capacity- utilization, queues, and poor economic performance. Instead, developers assume that their cycle times will be faster when resources are fully utilized. In reality, as we shall see later, high levels of capacity utilization are actually a primary cause of long cycle time._

<comment><USER4> > _In reality, as we shall see later, high levels of capacity utilization are > actually a primary cause of long cycle time._

So what's the reason explained by the book?

(My guess would be something along the lines of: high level of utilization lead to sudden peaks in load exceeding available capacity, and thus throwing a wrench in the process as you scramble to add capacity.)

<comment><USER5> 100% use of nearly anything is over use, not just because of peaks in load, but because it must both be done and perfect.

Think of a bookcase. 100% means you can never add more books, and it also makes it very difficult to reorganize anything.

</comment></comment></comment></comment><comment><USER6> This would just give me huge anxiety. One reason I write things down in a todo list is to remove the anxiety of having to remember everything. I am happier with triaging my todo list myself, but everyone works differently.

<comment><USER7> I like the idea of this as a complement to a more rigorous todo system. Maybe I'm just bad at it but it's easy for my lists to get overwhelming, a system like this demands that more care is put into making choices over what is and isn't achievable in a day.

</comment></comment><comment><USER8> I like the Ivy Lee method for to-do lists: [https://jamesclear.com/ivy- lee](https://jamesclear.com/ivy-lee) Bonus: No app required, just pencil and paper.

</comment><comment><USER9> I use a shell script called "jrnl" that opens vim with 3 tabs: today, yesterday, tomorrow. It's got a "TODO" section, and if I care enough about something from yesterday, I can bring it over. The files are stored like 2018/2018-02-06.txt, and if I really want something I can just grep for it.

<comment><USER10> Guessing it's [http://jrnl.sh](http://jrnl.sh) ? Seems to written in Python though, while you say shellscript.

Sounds like a useful script, care to share it here?

<comment><USER9> No, it's mine, although I realized how unoriginal I was when I saw that. It's pretty crappy, maybe if I cleaned it up someone might find it useful.

It's pretty much just a handy way to generate the filenames for vim. Oh, and it generates a git commit after vim closes.

</comment></comment></comment><comment><USER11> I'm a fan of Bullet Journaling. It helps to categorize, document, and carry tasks, thoughts, and ideas forward, or remove them while making them available for sourcing.

All it takes is a pen and notebook.

[http://bulletjournal.com/get-started/](http://bulletjournal.com/get-started/)

<comment><USER12> As someone who's been trying to pick up a consistent task tracking system, I have a question: Do you just always have a notepad with you? I tried something similar to this with a pocket-size notepad, but it was annoying and didn't fit very well with a pen.

So far the closest I've gotten is having a Google Doc, but it doesn't have the same flexibility that a hand-written notepad does (e.g. symbols, indexes, ease of writing/ access).

<comment><USER13> Yes, I always carry a notebook even in non work situations. It's never been an issue for me as far as transportation is concerned, I just slip it alongside my laptop or other books.

I also have a Samsung Note phone which is useful in the rare case I'm caught without a notebook or pen. I'll re-write any notes to my work notebook as needed.

</comment></comment></comment><comment><USER14> I use separate daily, monthly and yearly todo lists. Daily means finish it within 24 hours, monthly within the next 30 days. Items promote or demote based on need and get thrown off the yearly list when it's clear they won't happen within the year (which I interpret as "not really needed").

Really helps me focus by removing clutter.

</comment><comment><USER15> One of these days I'm going to follow through on an old idea of mine to use flash paper for my todo list.

[https://www.dreamlandmagic.com/products/flash-paper- pads-2x3...](https://www.dreamlandmagic.com/products/flash-paper- pads-2x3-inch-size-20-sheets)

</comment><comment><USER16> Is the name "Tet" related to the Vietnamese New Year?

<comment><USER17> That was the first thing that came to my mind, too.

It might well be - the Vietnamese like to clean their house before Tết to start fresh into the new year.

</comment></comment><comment><USER18> Not all tasks are designed to be done in one day, or the same day. For that reason I won't be using this app, but appreciate and respect its purpose and possible utility to others.

However, I think other todo apps could use this as a great April Fool's joke to put people into a momentary panic to get them thinking about all the stuff they should have done. When they logged into the app they it would be blank with a "what happened to my stuff?" link which directs them to an announcement they allegedly received in email about the changes taking place and then after a minute it could revert with the April Fool's message. That might get people thinking about their procrastination.

</comment><comment><USER19> I agree that automatically carrying over todo's to the next day is a bad idea. You need to be able to trust your todo tracker. It would be helpful to have some sort of history/log of your tasks just in case you need it.

It reminds me of [https://complice.co/](https://complice.co/) each day you need to put in your new tasks __but __you get to review yesterday 's incomplete items and pull them in. It has a lot of smarts built in and tell you you've pulled in the same task day after day and suggests you split it into smaller pieces.

Nice job shipping aswinmohanme!

</comment><comment><USER20> Another cool idea is to have an app that records your todos with check marks and posts doge memes at the end of the day on your twitter.

"I was going to study convolutional neural networks today @ but instead bought milk".

</comment><comment><USER21> Nice use of "behavioural economics"

<comment><USER22> Did you mean "psychology"?

</comment></comment><comment><USER23> I just write my todos on toilet paper and wipe my ass with it

</comment><comment><USER24> Asking honestly, what would be the benefit of this?

<comment><USER25> Does it make a difference if you were asking it dishonestly?

<comment><USER24> I guess I should have clarified, I didn't want to sound snarky while asking what the benefit would be, I'm actually curious.

<comment><USER26> You mean… the benefit of a to-do list? Asking honestly.

</comment></comment></comment></comment><comment><USER27> s/thier/their/g on the home page, please.

<comment><USER28> I spotted this and actually imagined that it was on the todo list to fix... ( _was_ being the operative word)

</comment></comment><comment><AUTHOR> [https://www.producthunt.com/posts/tet](https://www.producthunt.com/posts/tet)

Here is the product hunt link</comment>


FBI affidavit against Ryan S. Lin in cyberstalking case (2017) - <AUTHOR> https://www.justice.gov/opa/press-release/file/1001841/download <comment><USER2> The relevant bit is on Page 22.

 _> Further, records from Pure VPN show that the same email accounts Lin's gmail account and the teleportfx gmail account-were accessed from the same WANSecurity IP address. Significantly, Pure VPN was able to determine that their service was accessed by the same customer from two originating IP addresses: the RCN IP address from the home Lin was living in at the time, and the software company where Lin was employed at the time._

Also, it seems Lin knew or suspected this at least, seeing as he doesn't believe in a VPN service that doesn't keep logs:

 _> For example, on June 15, 2017, Lin ... re-tweeted a tweet from "IPVanish," that read: "Your privacy is our priority. That's why we have a strict zero log policy." Lin criticized the tweet, saying, "There is no such thing as VPN that doesn't keep logs. If they can limit your connections or track bandwidth usage, they keep logs."_

This will be a useful .pdf to keep on hand because I also don't believe in VPN's that don't keep logs. At a minimum they'll keep 30 days worth and in many countries may actually be required by law to keep them longer than that even (60-90 days usually).

As an aside, it's good to see another example that the FBI does actually investigate cases of cyberharrasment and takes doxing seriously, contrary to popular opinion.

E: A few typo fixes and the last 4 words.

<comment><USER3> I opened the document expecting to sympathize with Lin. In my imagination this was some FBI surveillance state overreach, or "cyberharassment" thing getting overblown.

Instead, reading through the allegations, Lin came off as abominable. Contrary to your conclusion that this shows the FBI takes cyber harassment seriously, it seems like law enforcement generally allowed Lin to publicly subject this poor woman to psychological torture for a couple years before doing anything about it.

Provided the allegations are true, whatever sentence he gets will not be enough...

<comment><USER4> Why would you expect to sympathize with him? Is it usual (i.e more likely than not) that cases of cyberharassment are overblown, or based on faulty knowledge, or outright false? It's strange to me that someone would immediately be so skeptical, unless the rate of false accusations is higher than the rate of true accusations (at least insofar as determined by the imperfect legal system). Is that the case? I'd like to be corrected if it is.

<comment><USER3> I don't know what the rate of false or overblown allegations is. I wrote above about my intuition and not my judgment after a considered study of the issues and evidence. It's just what I expected.

As for why my intuition went that way, I suspect it's because, from the title, I felt like Lin was wronged by the VPN company which misled him, I generally distrust the FBI, deanonymizing VPN traffic seems troubling to me, "cyberharassment" sounds more like being mean to people online than the things Lin did and I don't think sending rude words to people should be criminal, and I suppose that I personally am more likely to be (falsely) accused of cyberharassment than I am to be victimized by it which probably results in implicitly identifying more with the attacker than the victim.

<comment><USER4> I don't think "cyberharassment" sounds like being mean online at all, I think it's what most would consider harassment but conducted through the Internet to the extent that it is possible to do so, and it may even be more pernicious, since it is very easy to stalk people and submit anonymous comments via the Internet. In the same way, I'd also assume you personally more likely to be falsely accused of rape than you are to be victimized by it - simply because you're probably not a rapist. It does not have much to do with the fact that most rape allegations are true, at least to the extent we determine in legal courts.

Maybe we should think about how we act online if we feel that there is a significant risk of being accused of cyberharassment, even if such conduct should not be illegal (and I suspect we also disagree on where the line ought to be drawn here).

<comment><USER3> "Harassment" can refer to a variety of behaviors. I feel "harassed" by telemarketers insisting I apply for a loan or buy whatever they're selling. If someone were to repeatedly bother me at the mall trying to sell me something, I'd think of that as them "harassing" me to buy something etc. Harassing seems to me like repeatedly being a nuisance.

In the context of criminal behavior I'd expect harassment to be a campaign of intentionally bothering someone and invading their space. I'd assume someone like Lin might be guilty of criminal harassment if he waited outside this girl's house and lewdly propositioned her every day, bothered her at work, etc.

I think we should have a higher bar for what constitutes cyberharassment because it's so much less invasive and threatening than physical harassment and so much easier to ignore. It's also possible that it's easier to inadvertently participate in cyberharassment when you can't see how the other person is reacting to you or feel how inappropriate the behavior is.

What Lin did in this case is far beyond any of what I described above. I think of his behavior as transcending what I'd describe as cyberharassment - in my earlier comment I called it psychological torture and I think that's far more apt than cyberharassment which seems too milquetoast a phrase for what happened here.

</comment></comment></comment></comment></comment></comment><comment><USER5> This guy is a monster. Read the whole thing if you have the time. For some reason this bit stuck out at me out of all the crimes: He hacked into her "Rover" account (Uber for dog walking) and messaged all her clients that she had a panic attack and murdered their dogs, and will deliver the dog to them in a ziploc bag.

Total psychopath.

<comment><USER6> Yeah, this primarily inspires the thought of whether we should be providing services that enable this kind of behavior.

</comment></comment><comment><USER7> Started out wondering if Lin was going to be wrongly accused but this hit closer to home that I expected. First off Lin appears to be a POS but what hit me was this line:

> While each of these incidents in isolation may appear relatively harmless, > the cumulative effect of this behavior is both harassing and indicative of a > significant attachment, disproportionate to the amount of time they spent > together.

Specifically the first part "While each of these incidents in isolation may appear relatively harmless". I've had friends harassed online and when you try to explain to law enforcement it sounds petty or minor but I've seen first hand it weigh on my friends who have experienced it.

Services like TextNow and Pinger and amazing tools for someone looking to make someones life a living hell. I've still got screenshots of PAGES of new text messages (from different numbers) all from some asshole who has nothing better to do than harass people.

In my situation I had finally had enough and thew up a webpage explaining how to block ALL TextNow/Pinger numbers and calling out the individual in question (trust me this was done tastefully and with tact) then ran Ads on FB to raise awareness in my community. Turns out way more people that just my immediate friends had been affected by this toxic individual (I had a number of people reach out to me). I spent $40 on ads for 67 clicks, 1,465 reach, and 37,454 impressions. It was worth every penny. I'm not going to say this will work for you OR that it worked for me (the harassment stopped but, you know causation/correlation and all that) but I know I would do it again in a heartbeat.

It's important to note the police were next to useless for this entire saga. I'm not sure what percentage was apathy vs a lack of skills but yeah...

<comment><USER8> That's amazing!

Last year I was desperate for extra work, and met a guy hiring programmers on Craigslist. I ran his name and found a website from a guy saying never do business with him, that he doctored financial documents and was a liar. It was kind-of a crazy site, so I met with the liar anyway, and he brought it up pretty quickly, saying it was an old neighbor and that he's crazy. I went to work for him, but he kept bringing it up, wondering how he could get the site taken down (queue me trying to explain slander and him saying "there's gotta be another way!"), until one day he was exploded with a "I could go over to his house and fucking kill him!".

I already had a new job lined up at that point, so I just left my key on the desk and never came back. I still wonder if I should email the guy that made the website just to let him know how much it gets under his enemy's skin.

</comment></comment><comment><USER9> They all log, and they all turn those logs over to police agencies when they get court orders to do so. These services are only intended to prevent ISP snooping on legal activities that may be personal or embarrassing, but not illegal. That's it.

If you do something illegal on a VPN connection and think the VPN providers have no logs/evidence, you'll be very surprised when the cops show up.

<comment><USER10> Exactly. Even my personal VPN (Streisand) running on a cloud-hosted VPS is not safe if I decide to become a criminal. All LE would have to do is subpoena my hosting company and monitor incoming connections.

A VPN may slow a nation-state down a little, but it will certainly not stop them.

</comment></comment><comment><USER11> I'm always curious at how these VPN providers aren't being hit with false advertising. They claim to keep basically no data about you.

"You are Invisible – Even We Cannot See What You Do Online We DO NOT keep any record of your browsing activities, connection logs, records of the VPN IPs assigned to you, your original IPs, your connection time, the history of your browsing, the sites you visited, your outgoing traffic, the content or data you accessed, or the DNS queries generated by you." [0]

[0] [https://www.purevpn.com/privacy- policy.php](https://www.purevpn.com/privacy-policy.php)

<comment><USER12> Them not keeping a record may be true...

But the rsyslog was delivering the logs to *.fbi.gov

And not retaining logs would still be correct. They said nothing about transporting them to the relevant feds.

<comment><USER13> Ahhh. They aren't _keeping_ the logs, they're merely forwarding the logs to another "non-associated entity" (giving them legal cover), and storing the logs there. Makes sense. They can advertise "we don't keep logs" ( _we_ meaning the corporate entity itself) so they have legal cover, _and_ they make the three letter agencies happy (and thus are allowed to continue to operate)

<comment><USER12> Indeed. And those tools to do such an analysis already exist. Its the formerly NSA tool called "Apache NiFi". It even has a syslog server plugin specifically for this purpose (it's built in already; drag, drop, configure, done):

[https://nifi.apache.org/docs/nifi- docs/components/org.apache...](https://nifi.apache.org/docs/nifi- docs/components/org.apache.nifi/nifi-standard- nar/1.5.0/org.apache.nifi.processors.standard.ListenSyslog/)

Link/proof asserting Apache NiFi is one of the NSA data analytics tools: [https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa...](https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa- nifi-big-data-automation-project-out-in-the-open/#1377a1e555d6)

<comment><USER14> Proof also can be found here: [https://code.nsa.gov](https://code.nsa.gov)

</comment></comment></comment></comment></comment><comment><USER15> Sometimes I feel the anonymity aspect of the Internet brings the worst out of people. If we didn't have anonymity to begin with, people would have not tried those kind of harassment. Or if they do, it'll be a routine case for the police as opposed to requiring substantial FBI involvement.

<comment><USER16> Anonymity is required to maintain freedom of speech. It provides a route for any adult to be the child that calls out the emperors new clothes.

The sad part is yes, it also enables bad people to do bad things without consequence, however, that is the bet that we make. That the bad people doing their bad shit, is a small price to pay to prevent bad people in power from doing very very bad shit

<comment><USER15> It's not anonymity that protected freedom of speech, but people who believe in free speech, represented by supreme court that is protecting it.

And when it comes to overthrowing corrupt ruling class, do people seriously believe anonymously complaining online is going to do anything?

<comment><USER17> One could argue that anonymous complaining and accusations contributed to Trumps election.

How many of those 'anonymous americans' (who were concered about the emails, or spouting off about clinton having parkinsons, or bernie or busters, etc etc) were not americans, but non-americans or bots/sockpuppets created to amplify the signal of a vocal minority of americans or non-americans.

Because of platforms that are largely anonymous you can never know if an anonymous user is your next door neighbor or a bot tied to the marketing arm of some product you might be interested in or the agent of a foreign government.

An interesting concept might be a social network where all users are verified and their profile contains only general information about them, letting you know if their opinion matters or is misleading.

</comment></comment></comment></comment><comment><USER18> > On April 14, 2017, at 14: 55: 52, the email address "email@example.com" was > accessed from IP address 188.8.131.52, an IP address owned by WANSecurity, > a Kansas VPN service. As discussed above, this Gmail address is directly > attributable to Ryan Lin and was used to communicate directly and openly > with Smith and her roommates, including when he first responded to the > Craigslist advertisement to be their roommate.

This type of information couldn't be provided by VPN logs due to gmail using TLS encryption. If they gained physic access to a device that he was currently logged into, they just needed to look at the gmail account activity. Anyone can look at all the IP addresses they have accessed their gmail account from. They could have also just got a warrant.

> On April 14, 2017, at 15:06:27, the email address firstname.lastname@example.com, > provided by "Ashley Plano" to Rover, was accessed from the same exact > WANSecurity IP address, 184.108.40.206

This is more interesting. It doesn't seem likely they caught him logged into this account, or that would be all the evidence they needed. I suspect they issued a warrant to Google for this account and got a list of IP addresses back. I can't imagine that the VPN provider allocated a unique IP addresses for each subscriber. This seems like a really weak correlation unless they are leaving out some important information.

</comment><comment><USER19> Although much of the data seems to have been recovered from his work computer after he lost a job.

This article is two years old. Current status, from US Bureau of Prisons Inmate Locator:

        RYAN S LIN
        Register Number: 00578-138
        Age:  	26
        Race: 	Asian
        Sex: 	Male
        Located at: Brooklyn MDC
        Release Date: 01/02/2033

<comment><USER20> I wonder where he worked and why he was terminated. It was probably a similar pattern of behavior at work.

</comment></comment><comment><USER21> What the guy did was seriously disturbing. He looks like he is going to prison for 17 years and virtually ruined the victim's lives:

[https://www.justice.gov/usao-ma/pr/newton-man-sentenced- over...](https://www.justice.gov/usao-ma/pr/newton-man-sentenced- over-17-years-prison-extensive-cyberstalking-campaign)

<comment><USER22> This dude is a horrible monster and has been one for years. 17 years seems like barely enough.

</comment></comment><comment><USER23> Took me a second to find the follow-up [0], he pleaded guilty and took a 17 year sentence.

[0] [https://www.boston.com/news/local-news/2018/10/04/newton- rya...](https://www.boston.com/news/local-news/2018/10/04/newton-ryan-lin- sentenced-cyberstalking)

</comment><comment><USER24> VPN providers never keep your private data... since when are IP addresses considered private data? Gotcha.

</comment><comment><USER25> The new title tells me what the submission is about but not why it's here on HN. For context, the old title mentioned why it's relevant - that Pure VPN kept logs that assisted the FBI in its investigation of Ryan Lin.

</comment><comment><USER26> If you use PureVPN, you're a sucker, plain and simple. You failed to do basic research into your VPN provider, or failed to consult with someone who actually knows what they're talking about.

Let's do a very quick experiment where we evaluate a few popular VPN services at a glance, and critique them using non-technical insights which can generally be applied to any business trying to sell you a product. In other words, there's no excuse for not being able to develop these insights just because you aren't a "tech person".

Googling PureVPN provides the following summary:

"The best VPN service in 2018. PureVPN leads the industry with its massive network of more than 2000 encrypted VPN servers, around 300000 anonymous IPs..."

PureVPN only has a 150 character limit to describe their business, and they use it for:

1) Overzealous claims about being "the best" and the "industry leader"

2) Throwing out large numbers which they hope the user will correlate to excellence as a VPN service. The clueless user will think, "the more the better, right?"

Nord VPN's summary:

"Protect your privacy online and access media content with no regional restrictions. Strong encryption and no-log policy with 5000+ servers in 60+ countries..."

1) No regional restrictions? That's a given for any decent VPN. Useless noise meant to paint the product in a better light.

2) They claim strong encryption, but again, that's a GIVEN for any decent service. More deception.

3) They immediately try to sucker people in with the "no logs" bullshit

4) More stupid large numbers.

See a trend?

Now look at Mullvad VPN's summary:

"Mullvad is a VPN service that helps keep your online activity, identity, and location private. Only €5/month - We accept Bitcoin, cash, bank wire, credit card..."

Wow! No claims about being the best, no claims about anything. It "helps" keep your data private. No claims about 100% privacy. Then they list the price and payment methods. Informative and non-deceptive.

<comment><USER27> > "Protect your privacy online and access media content with no regional > restrictions. Strong encryption and no-log policy with 5000+ servers in 60+ > countries..."

I don't see how this is deceptive whatsoever? It states known facts about the VPN while also giving a basic outline on their policies. I'm inclined to believe that Nord doesn't keep logs (as of Nov. 1 of 2018) due to their audit by an external company. The report is available: [https://ucp.nordvpn.com/audit-report/](https://ucp.nordvpn.com/audit-report/)

I'm not saying that Nord is 100% safe, as others mentioned in this thread, it is completely possible that any "no-logs" VPN provider may store logs _somewhere else_ or an organization may store their data. It allows a provider to claim _they_ keep no logs, which also technically being truthful. I'm intrigued by Nord's stance to this (as their audit has no mention of it at a quick glance) and I will email their support about this.

Not only that, regional restrictions may apply to services such as Netflix, which have been battling VPNs for years now. Most VPN providers don't work with many of these services, and due to the fact Nord does, I'd claim that as a good advertising standpoint. Never tried "Mullvad", but I doubt they can bypass restrictions of these same sites.

Now onto Mullvad... The reason they can't claim to be the best, in any field for that matter, is because they aren't. Isn't keeping your data private "a GIVEN for any decent service" (to quote your own words...)? I'm also worried about that price, are the potential legal fees Mullvad may pay to keep your privacy safe worth the 5 pounds a month you pay? Same with any VPN for that matter - the cheaper it is, the less likely it is safe.

<comment><USER26> Regarding #2, I flubbed and meant to say "More noise", not "More deception". I didn't realize my mistake till later.

And I was briefly dissecting the Google summaries of these services, but I have read much, much more than that for every major VPN provider before settling with Mullvad.

I recommend Mullvad and if you took more than a cursory glance at their blog and documentation then you would get an understanding of what kind of service they want to be. They strive for top-notch security and service.

Nord also seems like a decent choice, even if they are not for me. For me, a company's ethos is extremely important and comes first. However, Nord still has the standard scummy sales tactics employed by so many companies, as you can see from their summary.

</comment></comment></comment><comment><USER28> Why is this relevant to HN? Is he a famous OSS contributor?

</comment><comment><USER29> Why is a raw legal document better than an accurate news article simplifying it for lay folks?

Dropbox's value is derived from it's ability to make something like rsync more human for non-tech folks.</comment>


Senators put forward new bill to halt expansion of gov't hacking powers - <AUTHOR> http://arstechnica.com/tech-policy/2016/05/senators-put-forward-new-bill-to-halt-expansion-of-govt-hacking-powers/ <comment><USER2> Let's hope that democracy works..</comment>


Grilled by Lawmakers, Big Tech Turns Up the Gaslight - <AUTHOR> https://www.nytimes.com/2020/07/30/technology/big-tech-ceos.html <comment><AUTHOR> For those who have trouble with the link:

[https://archive.is/AF1eb](https://archive.is/AF1eb)</comment>


Ad Networks: The New Pyramid Scheme - <AUTHOR> http://whydoeseverythingsuck.com/2008/04/ad-networks-new-pyramid-scheme.html

<comment><USER2> "no matter how you slice it, there are just not enough advertisers to support all the stuff that we are putting on the web right now"

<comment><USER3> Quote of the week.

</comment></comment><comment><USER4> This isn't true. Adsense and Federated Media kept me very profitable. I don't know a thing about ad sales. The ad networks allowed me to focus on pure development.</comment>


Ask HN: What ratio of users choose a "magic link" to log in? - <AUTHOR> I've been seeing more and more usage of the "magic link" (submit email address, receive tokenized URL in an email, click link to sign in) pattern in web _and_ mobile apps.
I, myself, tend to favor it. I'm skeptical of the general public's acceptance, though.
For those of you building apps with both options, what numbers are you seeing around its adoption?
Thanks! <comment><USER2> "submit email address, receive tokenized URL in an email"

... is a known-vulnerable antipattern, because email normally exposes that token to third parties.

[http://www.goironbox.com/why-email-is-not- secure/](http://www.goironbox.com/why-email-is-not-secure/)

</comment><comment><USER3> Instagram asked for my phone number and permission to read texts so it could connect(and read all my text).

<comment><USER3> I was just pointing out a user flow that a crap load of people have used to become users. not sure why all the down voting. So, a lot of it is going to depend on how much in demand your app is.</comment></comment>


Researcher: Apple developer site hack? I meant no harm - <AUTHOR> http://news.cnet.com/8301-13579_3-57594804-37/researcher-apple-developer-site-hack-i-meant-no-harm/

<comment><USER2> The guy says

> _I have over 100.000+ users details and Apple is informed about this. I didn > 't attempt to get the datas first and report then, instead I have reported > first._

Hmm. He states he has the personal data of 100,000+ users. He then proceeds says he obtained this data _after_ he reported to Apple. So why did he download the (presumably secret) user details of 100,000+ users?

Smells like an illegal black hat computer intrusion to me.</comment>


Singularity Objections - <AUTHOR> http://www.singinst.org/blog/2007/12/27/sotala-mccabes-singularity-objections/#more-90

<comment><USER2> I always have time for a well reasoned argument even if it contradicts my own view. These arguments are not well argued and they contradict my view. I regret reading that article.

<comment><USER3> I agree. Some of the arguments are even wrong. Specially: "Godel's Theorem shows that no computer, or mathematical system, can match human reasoning." This is plainly false, in many ways. Gödel't Theorem says nothing about computers (thanks to Turing we know we can't have an algorithm that solves theorems, that was not Gödel's work and Gödel's work still allowed for that possibility to exist), and in any case, we aren't sure our brains are just Turing machines or not, so we can't say neither Gödel nor Turing proved anything about the relative power of computers and human reasoning.

</comment></comment><comment><AUTHOR> _We might live in a computer simulation and it might be too computationally expensive for our simulators to simulate our world post-singularity._

That's an awful lot of "mights".

<comment><USER4> You know, I always figured that a computer-simulated world would have smart compression techniques. Thus, the massive quantity of electrons flying around necessary for a brain impulse, for instance, only "exists" when someone does an MRI (or whatever tool they use for that sort of thing). Otherwise, a reference to "pleasure" or "pain" is passed into the perceptions.

<comment><USER5> So the Singularity is when we abstract out all the stuff that only exists to trick us into thinking we've evolved from more primitive beings?

</comment></comment></comment><comment><USER6> More interesting is the lower paragraph which discusses objections to creating a _friendly_ transhuman AGI, given that it is possible to create a transhuman AGI. I am aware that singinst thinks a lot about these issues..is anyone aware of any other organizations working with these things?

</comment><comment><USER7> For a far, far more entertaining take on the topic I recommend Bruce Sterling's "The Singularity: Your Future as a Black Hole", available from this page:

<http://www.longnow.org/projects/seminars/>

</comment><comment><USER8> _Extrapolation of graphs doesn't prove anything._

The induction fallacy is what allows humans to get up in the morning and make decisions with incomplete data i guess.

</comment><comment><USER9> You know, simulated universes might not exist simply to exist.

For instance, perhaps they are a form of communication? We could be just a really complex story that one being is telling to another.

</comment><comment><USER10> I sent him this objection:

We already build very powerful intelligences all the time, in the form of children. But despite having a lot of raw computing power, they aren't very useful without _knowledge_. They need to learn a lot of things before they can live effectively, solve important problems, etc...

Artificial intelligence and intelligence are not fundamentally different things. If you want AI's that turn out better than children do, you'll need improved parenting and educational techniques, or an alternative. I haven't seen any commentary on how singularity people plan to deal with this. And if they could, why not just use that technique on human children and vastly improve the world, now?

The main difference between AI and children I've seen proposed is that the AIs can run on superior hardware. But it's not like people currently use all the hardware resources their brain makes available; maybe that will be a bottleneck in the future, but it isn't one we've hit yet.

<comment><USER5> It is very hard to flawlessly copy a memory or concept into a child's brain. This might be easier if we wrote the software and designed the hardware.

<comment><USER10> You think the input format will be easier for AI? I don't know. We have evolved knowledge of the input format for children. Meanwhile the majority of our knowledge is inexplicit, and we are bad at turning that into vague English, let alone into something as precise as code.

Back to children, we're so good at teaching them that we manage to teach them many inexplicit ideas without ever having much understanding of those ideas.</comment></comment></comment>


Enter Mouseless - <AUTHOR> http://www.techi.com/2010/07/we-dont-need-no-stinkin-mice/ <comment><USER2> Good research, but I think this is one of those things that stay in the ivory tower, perhaps to one day be a shoulder for the next improvement after the mouse and trackball:

Mom test: 1\. Mom asks how do i work this thing w/o a mouse? Tries to touch screen or look for the touch pad. Is then confused. Calls tech support (dad, then siblings... etc..) 2\. Scrape fingers on table and get them calloused? No thanks. + would cost to buy more moisturizer.

I always love to be proven wrong though.

</comment><comment><USER3> Cool, I would like to try it out!

I wonder if they released the code and a simple how-to if people would pick this up and run with it?

Here is the mit site: [http://fluid.media.mit.edu/people/pranav/current/mouseless.h...](http://fluid.media.mit.edu/people/pranav/current/mouseless.html)

Here is the mouseless website: <http://www.pranavmistry.com/projects/mouseless/>

</comment><comment><USER4> The movement delay seems significant. Arching your hand like that with no support of the mouse to rest on seems wrong too. I just don't know what the advantage having mouse like movement without a mouse gives.

<comment><USER5> The article is confusing because it starts off talking about USB security issues, which are irrelevant.

The main advantage of not having a mouse is that you wouldn't have to have a mouse. One less thing to carry around with your laptop, one less thing to take up space on your desk.

That is, of course, assuming this could be made to work just as well as a mouse, which I doubt. Few things are as momentarily frustrating as a mouse that doesn't register your movements properly, which is why trackball mice sucked so much.

</comment></comment><comment><USER6> It's limited, not just click and drag as mentioned before but what about scroll wheel action and additional buttons?

</comment><comment><USER7> I expected this to be a tiling window manager, probably for OS X given the capitalized name.

</comment><comment><USER8> This is terrific! The scope for "multitouch" is really exciting.

</comment><comment><USER9> Click-and-drag might be a challenge.</comment>


One reason why you could have been rejected by YC or others - <AUTHOR>

It's simple. They may have funded a start-up that is doing exactly what you are doing in the previous class. After receiving rejections from a lot of incubator programs, one thing i have realized is that there are others who got started doing exactly what we do (or close enough) before us. That said, we have just enough chance of success, but we may have to do it by ourselves. Incubators don't like their children squaring off, and they rather put more effort into an existing baby than another new one. So, if you think your idea was world changing and got rejected, give this possibility a thought- there may be another company doing what you do and you just haven't heard about them :) <comment><USER2> or not. either that or incubators work more like fraternities.</comment>


AES67 resources – Audio over IP protocol - <AUTHOR> https://hartung.io/2020/07/aes67-resources/ <comment><USER2> Remembered this a few days ago when watching the recent Wintergatan video where buddy there hooks up this massive multicore with a bunch of preamps to the Marble Machine X, and I'm just there thinking "It sure is satisfying to attach and click in a 28-channel multicore cable, but why not use AES67 (or AES50 for that matter)?".

Nice thing about AES67 is that you can also, in theory, run the preamps and ADCs off PoE.

<comment><USER3> I think it's because they want to keep the signal analog as long as possible as a fundamental tenet of the machine.

</comment></comment><comment><USER4> I work in a lot of live sound settings and it's common to see Dante[1] cards coming with a lot of audio consoles these days. It's a proprietary protocol (with support for 1024 channels at 32-bit / 192kHz over a single link); add-in cards for consoles can be quite expensive.

A lot of the time, we're needing to connect devices to Dante through a Dante interface (which can be expensive) or via a Dante Virtual Soundcard.

It will be interesting to see AES67 appearing more in consoles, especially lower end consoles. Hopefully this will open up Audio over IP to more audio professionals without resorting to proprietary protocols which can make it hard to connect systems from various vendors.

[1] [https://en.wikipedia.org/wiki/Dante_(networking)](https://en.wikipedia.org/wiki/Dante_\(networking\))

</comment><comment><USER5> This sounds like fun tech.

But isn't this dead before it really lifts off? Intel 1588 is not supported by every customer-NIC, and far from supported by most switches and such.

So if i have to build a "special" hardware environment anyway, why use AES67 and not some other proprietary solution without IP which may (? or may not) deliver better latency and jitter?

Last time i checked (which is a while back), the same support-argument would apply to multicast.

Am i missing the point here? Please enlighten me. Thank you!

<comment><USER6> I had a look at 1588 and was a rabbit hole of paywalls - latest draft seems to be [https://standards.ieee.org/standard/1588-2019.html](https://standards.ieee.org/standard/1588-2019.html)

Why is a standards group paywalled!

<comment><USER7> Many standards groups require payment for their published standards: the ISO and most national standards bodies (ANSI, etc) are maybe the most prominent examples.

This is their business model. You pay for access to the standards documents, and that money funds the development and maintenance process. It's supported by governments requiring adherence to these standards, so implementors are obliged to purchase them.

Gratis access to standards is a newer model which relies on a different funding stream. The IETF is one such example.

</comment></comment></comment><comment><USER8> I started working on an AVB to AES67 gateway, still a work in progress (back to day job now), but code is here – [https://github.com/PADL/OpenAvnu/blob/lukeh/avb/README.AES67...](https://github.com/PADL/OpenAvnu/blob/lukeh/avb/README.AES67.md)

</comment><comment><USER9> What an unfortunate acronym

<comment><USER10> AES? If so, the Audio Engineering Society has existed for a lot longer than the Advanced Encryption Standard.

<comment><USER11> Here are more details in case anyone is wondering.

The Audio Engineer Society has been around since 1948 ([https://en.wikipedia.org/wiki/Audio_Engineering_Society](https://en.wikipedia.org/wiki/Audio_Engineering_Society)).

It released the AES/EBU standard ([https://en.wikipedia.org/wiki/AES3](https://en.wikipedia.org/wiki/AES3)) for digital audio I/O in 1985, and AES/EBU is still used on some pro audio equipment. So in a digital audio context, "AES" is already familiar.</comment></comment></comment>


Cloud Printing and Shipping Service Lob (YC S13) Raises $2.4M Seed Round - <AUTHOR> http://techcrunch.com/2013/11/04/cloud-printing-shipping-service-lob-raises-2-4-million-seed-round/

<comment><USER2> For those who use this service, which part of it appeals the most? Is it removing the hassle of finding a printer? Is it the API part? Is it the shipping/logistics aspect?

I ask because Lob is a generalized version of what we ([http://www.littleheroes.com](http://www.littleheroes.com)) do every day.

I never considered our platform to be a service unto itself so I'm curious which aspects in particular resonate with people.

<comment><USER3> We don't currently use Lob, but we use a service like it and for us it's the printing and mailing functionality that makes it appealing. Giving our customers the ability to send things like invoices directly to their customers from the application is a feature that gets lots of utilization.

<comment><USER4> What service do you use? Does it also have an API?

<comment><USER3> [https://www.trypaper.com/](https://www.trypaper.com/)

</comment></comment></comment></comment><comment><USER5> I love the concept of Lob, especially the CDN for mail.

I do wish the processing time was much lower. 2-3 days is quite a lot of time to wait on-top of the already slow USPS delivery.

"All printing is processed typically within 2-3 business days then mailed right after." [https://www.lob.com/docs](https://www.lob.com/docs)

Is there a reason the processing time is so long? I understand Lob relies on other parties to print and send the mail.

Ideally there would be same-day printing - I submit a job at 9am and it is printed and in USPS's system by 5pm. Combined with the CDN printing & mailing close to the destination, the mail should then arrive within 2 days of the job submission.

EDIT: And congrats to the Lob team! You guys are solving a real pain-point, and it won't be long until you've moved from $1 million in checks to $1 billion.

<comment><USER6> From my experience they have processed same-day or next day, although YMMV.

<comment><USER5> Which is great, but I can't build an app on that.

What I'd really like is a delivery estimate API, so I could stagger job submission to ensure an entire batch ended up in my user's hands on the same day.

<comment><USER6> Agreed, if your use case requires precise delivery times then it won't work. I also would love a delivery estimate API, I wonder if they could make that happen.

<comment><USER2> They should be able to. All major shipping companies' API provides an estimate for delivery. So it's a matter of adding up the estimate days with the printing lead time and returning that (along with a disclaimer!)

</comment></comment></comment></comment></comment><comment><USER7> So I just googled "print photo api", and found a while bunch of similar things, like [http://www.pwinty.com/](http://www.pwinty.com/)

Is Lob different?

</comment><comment><USER8> Huge fan of this company. Great job guys!

</comment><comment><USER9> Congrats guys! We've loved using Lob, and really exciting to see everything taking off!

</comment><comment><USER10> I'm hopeful this means they can start offering their services in the UK! We'd love to integrate this in our app.

</comment><comment><USER6> Congrats Leore and team! So far my experience with Lob has been fantastic. Can't wait to see what's next.

</comment><comment><USER11> Congrats! Cloud printing is a huge market. We're doing something very similar with 3D printing.

</comment><comment><USER12> Nice work Harry & Leore

</comment><comment><USER13> Congrats guys!</comment>