BearSSL – Smaller SSL/TLS - <AUTHOR> https://bearssl.org/ <comment><USER2> The last thing the world needs is another immature SSL/TLS implementation however this makes it very interesting:

> No dynamic allocation whatsoever. There is not a single malloc() call in all > the library. In fact, the whole of BearSSL requires only memcpy(), > memmove(), memcmp() and strlen() from the underlying C library. This makes > it utterly portable even in the most special, OS-less situations. (On "big" > systems, BearSSL will automatically use a couple more system calls to access > the OS-provided clock and random number generator.)

> On big desktop and server OS, this feature still offers an interesting > characteristic: immunity to memory leaks and memory-based DoS attacks. > Outsiders cannot make BearSSL allocate megabytes of RAM since BearSSL does > not actually know how to allocate RAM at all.

Edit: Just discovered what makes this an even more interesting one to watch, it's the work of this Wizard: [http://security.stackexchange.com/users/655/thomas- pornin](http://security.stackexchange.com/users/655/thomas-pornin)

<comment><USER3> What sorts of applications are written for OS-less systems that require a TLS library?

EDIT: Thanks for the sincere responses. In retrospect my question might have appeared smarmy, but that wasn't my intent and I really appreciate the responses.

<comment><USER4> I very badly need a TLS library in my embedded firmware so I can accept new firmware updates over HTTP.

<comment><USER5> You don't need TLS for that, you could simply use an HMAC and a shared secret, assuming you're not worried about people with physical access (and ability to get the secret) being able to create updates. Of course if you've got multiple instances of the device (not some hobby thing where they are all owned by you), then the secret for each device should be different so someone can't buy the device, determine the secret and then push updates to other people's devices.

<comment><USER6> Wouldn't signing each release with a private key be the simplest solution here?

(that can take many forms, but that general idea is how most software updates currently work)

<comment><USER7> RSA means big integer which means unhappy performance on devices that often don't even have floating point in hardware. I think elliptic curve could be faster?

<comment><USER8> > _I think elliptic curve could be faster?_

Yes, EdDSA is faster, with 64 byte signatures. Recommended.

[https://en.wikipedia.org/wiki/EdDSA](https://en.wikipedia.org/wiki/EdDSA)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I love the idea of a zero allocation crypto library, but isn't the fact that this is also in C going eventually lead down a similar path as that of OpenSSL?

I'm personally really excited for this: [https://github.com/briansmith/ring](https://github.com/briansmith/ring)

It's a Rust oxidization of the BoringSSL library, meaning that parts of BoringSSL are being rewritten in Rust, with the eventual goal of being pure Rust.

<comment><USER10> > with the eventual goal of being pure Rust

No, being pure Rust is not the goal. It aims to use Rust as much as possible for the parts that Rust is good at. But core crypto algorithms generally need to be written in assembler, to avoid various timing attacks that could be introduced by optimization. And for things that would require large amounts of `unsafe` in Rust, there's less reason to port that to Rust, and leaving it in C can be more clear.

See the style guidelines from the project:

[https://github.com/briansmith/ring/blob/master/STYLE.md#unsa...](https://github.com/briansmith/ring/blob/master/STYLE.md#unsafe)

The thing that are most appropriate for Rust are parsing, protocol implementation, higher level code that uses core crypto primitives, and providing a safe API to client code. But the core crypto primitives themselves will remain written in C and/or assembler, as appropriate.

<comment><USER11> > to avoid various timing attacks that could be introduced by optimization

Assembler only goes so far. Until you figure out how the processor's front end will decode the machine code and run the underlying RISC program, or how the hypervisor will schedule your program on some shared machines (e.g. in EC2) you're susceptible to a different class of side-channel attacks.

<comment><USER12> This is true but not relevant to the discussion: whatever side channel problems you'd have in pure assembly, you're practically certain to have more of them if you implement crypto in a high-level language with an aggressive optimizer.

<comment><USER11> Note I never disagreed with GGP's premise - I'm only pointing out that you can go further than assembler.

<comment><USER13> Is there any way to write programs that bypass the processor's front end for most the processors in use? If not, it what sense is it true that "you can go further than assembler"?

<comment><USER11> You don't have much choice with commodity hardware - but you could perform crypto on hardware/chips where the behavior is completely specified.

Note that this is not very practical, and impractical crypto is almost as good as no crypto.

<comment><USER14> This is often, though not always, the case with deeply embedded processors of the kind BearSSL seems to be designed for. There's generally some way to get predictable cycle-exact performance on them because it matters for some embedded applications.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Libraries like this are almost invariably a terrible idea: none of the more recent alternatives to OpenSSL I've seen have avoided resurrecting crypto bugs OpenSSL fixed years ago.

But: Thomas Pornin!

So, this is pretty neat. I hope lots of crypto people take a very hard look at it.

<comment><USER15> Yeah, the general wisdom is, basically, "if you don't know what you're doing, leave the crypto to the experts".

I don't know the guy but, from what I gather, he is considered to one of these experts, yes?

(Edit: If I would have read further comments before replying, I would've found the answer to my question.)

<comment><USER16> Besides being a crypto professor, he managed to guess what CRIME was about, after it was announced that some bad OpenSSL advisory was imminent, but before it came out.

Therefore the proposed bug squashing strategy of "just claim that there's a bug in XYZ and let him oracle what it is".

</comment></comment></comment><comment><USER17> One of the cliches about crypto is that you should not implement your own crypto. Not to suggest that the authors don't know what they are doing, but they mention 'alpha' quality themselves on the site. I wonder, how long does it take until a new library is deemed secure? What does the process look like? Trial and error? Or do they compare notes with vulnerabilities found in e.g. openssl?

<comment><USER18> Generally the cliche is about not implementing your own cryptographic algorithms. As long as they only implement existing algorithms and don't generate new ones, I don't think this applies.

<comment><USER17> I used to think that; but I'm following Dan Boneh's crypto course on Coursera at the moment, and he specifically notes that you should not even try to implement known algorithms yourself (for production; you could do it ofcourse for the learning experience).

The reason is that there are subtle attacks on the implementation, such as timing attacks, which can leak information.

<comment><USER19> cant be any worse than openssl.

they have all code running in constant time from the alpha version.

Next comes making sure there are no buffer overflows. the code is stable and compatible.

If everyone leaves it to someone else who does it exactly?

Obviously not ready for use in production until its been audited.

Remind me again where i can download an audited ssl implimentation?

<comment><USER20> > cant be any worse than openssl.

Not sure I'd agree with that. OpenSSL is very far from perfect and obviously contains many many security bugs, but it also has a very long history of fixes, knowledge, etc. and has a large number of eyes on it. It's more of a known quantity than something new.

<comment><USER21> OpenSSL does not have half the fixes people think it does. Generally what gets fixed is the ciphersuites some people happen to use, and the rest remain broken. For example, the constant time ECDSA signing only works with some curves, not all. It still supports horrific hacks for random number generation, instead of using OS provided interfaces. NSS is not much better on this front, but does a far better job of parsing TLS records in a sane way.

</comment></comment></comment></comment></comment></comment><comment><USER22> The page claims: "[...] insecure protocol versions and choices of algorithms are not supported, by design",

followed by:

"TLS 1.0, TLS 1.1 and TLS 1.2 are supported", "3DES/CBC encryption algorithms are supported", and "SHA-1 [is supported]"

Sad-face.

<comment><USER23> There is not supporting insecure protocols and then there is living in fantasy land away from everyone else.

You can't drop all of these things and end up with something generally useful.

<comment><USER22> Sure, I agree -- but that's not what the page claims. It says "insecure protocol versions and choices of algorithms are not supported, by design" \-- the protocols and modes that I listed are known to have various insecurities, and it still supports them. I agree that to be useful it's necessary to support old, less secure or even insecure modes, but this is at odds with the above stated goal.

My point is about the imprecise description.

<comment><USER23> You're right technically but don't you think that's a little bit pedantic?

If your goal is to truly improve the state of the art in the ecosystem, dropping anything that is even remotely insecure is appealing I get that and I do believe the people behind BearSSL would love to do that. However to truly improve anything you need two things: Popularity and improve security.

There is a conflict there because popularity requires, at least some, compatibility to what already exists. You need to balance out security and compatibility. I think there is room for discussion about where precisely that balance is. You could further tilt it towards security by helping users of the library get a sense of what they need to support. Ultimately though you can't just blindly drop everything that's somehow not perfectly secure. Doing so would not improve security at all.

It's a small sacrifice to have one library be a little bit less secure than it could be, if that helps to make everything more secure it all.

</comment></comment></comment></comment><comment><USER24> Given various clues such as: -"OS-less" -small memory footprint -going out of their way to include discussion of legal jurisdictions -the author and past activities -performance seems not a major concern

Makes me suspect that a major goal is anonymity. It's less aimed at users installing on their non-anonymous Windows/Mac/phone but rather leverage generic/commodity hardware to communicate over SSL. Throwaway burner phones.

<comment><USER23> This just looks like someone who is aware of the complex legal history associated with cryptography and has considered embedded devices in the design of the library.

Considering the recent events around IoT having good crypto libraries for that seems like it could be useful.

</comment></comment><comment><USER25> Oh man, can't wait for the docs. TLS 1.2 on an ESP8266 would make it possible to use them with AWS IoT.

<comment><USER26> From what I understand, you _can_ use them already with AWS IoT but I'm not sure if this solution is ideal or secure enough. Haven't used it personally but it's there:

[https://github.com/SuperHouse/esp-open- rtos/blob/master/exam...](https://github.com/SuperHouse/esp-open- rtos/blob/master/examples/aws_iot/README.md)

</comment></comment><comment><USER27> I'm wondering why this isn't on github

<comment><USER28> I wanted a clear situation with regards to laws on cryptographic software distribution and export. With my own server, I can keep everything in Canada, which makes things simpler.

<comment><USER29> Why not run Gitlab on that server?

<comment><USER30> It's hard to get by without all the fancy CVE features in GitLab, but software written in Ruby on Rails is banned in Canada, so they had to use good ol' reliable gitweb.

<comment><USER19> ->Rails is banned in Canada...

wohaa. what?

wow. an opportunity for me to use google. if you are actually serious?

edit:lol my phone default searches to bing... didn't find anything about ruby on rails being banned in canada.

<comment><USER31> haha, I did the same thing. Must be trolling, or sarcasm

</comment></comment></comment></comment></comment></comment><comment><USER32> If Thomas has enough time to finish it (bearing in mind the hundreds of hours it will take to bring it to production quality) - and if he has time to maintain it over the years - and if he is able to commit to years' worth of future maintenance - then this could become a very nice and usable implementation.

I think it's great when people write something for the love of it.

For a high quality TLS implementation that is production-ready, and has had extensive third-party verification and certification, I'd recommend mbedTLS from ARM.

</comment><comment><USER33> Seems like it is trying to replace PolarSSL (now called mBed TLS). It even dervies the name from PolarSSL (Polar Bear). It is nice to have multiple options, however it can make the vulnerability management a nightmare. How many more SSL libraries do we need (OpenSSL, LibreSSL,S2N,GnuTLS), not to mention native SSL libraries (Secure Transport, SChannel)?

<comment><USER34> We need a crypto library that is easy to use in other applications that want security.

This trainwreck of an API is the opposite of what we want: [https://gnutls.org/reference/gnutls- gnutls.html](https://gnutls.org/reference/gnutls-gnutls.html)

It would probably be faster to write your own TLS library than learn all of that.

OpenSSL doesn't fare much better. So far, libtls looks the most promising. But last I checked, it was still a bit _too_ spartan and couldn't operate in non- blocking mode, which kills you if you want an event-driven server.

<comment><USER35> I, for one, am still waiting for the TLS library that's the spiritual equivalent of NaCl or libsodium; where the integration surface is narrowed to the essentials, and sensible and secure (internal) defaults predominate.

</comment></comment></comment><comment><USER36> @pornin

Thanks, we definitely need a secure and reputable TLS implementation with small footprint for IoT devices.

 _[invalid issue removed]_

<comment><USER37> q starts out larger than len, but is decremented inside the inner for loop.

<comment><USER36> Thanks, it seems the separate from variable decrease operator (q --) broke my "internal parser" as I completely missed it somehow. I'll edit my post to remove the noise.

</comment></comment></comment><comment><USER38> I wonder if the Bear reference is in relation to the other smaller SSL implementation in WolfSSL [https://www.wolfssl.com/wolfSSL/Home.html](https://www.wolfssl.com/wolfSSL/Home.html)

<comment><USER39> The bear is more a favourite animal of the author

</comment></comment><comment><USER40> An obvious dig at wolfSSL - I'd be curious to see a comparison between the two. wolfSSL appears to be the more mature of the two (which makes sense, it's been in use for over a decade, and has a business dedicated to its development).

<comment><AUTHOR> Not quite, Thomas's avatar in many places is that of a bear. He has named a few of his works after bears, in particular his password hashing function Makwa.

<comment><USER40> I'll admit, they're a local company that I have a fair bit of respect for, so I'm a bit protective about people attacking them. That said, BearSSL is just too close to be coincidence.

The author could have easily continued with their trend of using alternative languages and ended up with something just as unique. UrsidSSL, BhaalooSSL, XiongSSL; all could have continued the trend without coming across as a sly attack.

It's not as if wolfSSL is a new kid on the block in the world of embedded SSL.

<comment><USER2> It has nothing to do with WolfSSL, Thomas uses a Bear as his avatar, done. I've never heard of WolfSSL, but Thomas's name and avatar was instantly familiar as someone who's contributed a wealth of invaluable Crypto knowledge to the world.

</comment></comment></comment></comment><comment><USER41> Needs some Galois SAW tests. Also using OpenSSL for testing wouldn't be a bad idea.

</comment><comment><USER42> This sounded very interesting.

However, it seems it's been developed "in secret" and the only public commit is a huge import of all of it. :/

Too bad, the development history would have been very interesting to read, digesting it all at once is harder.

<comment><USER28> Honestly, all my internal git commit messages are "...".

I intend to write (in many details) how the whole thing is designed. Give me a couple of months.

<comment><USER42> Okay, that explains it, anyway. :)

I have absolutely nothing to say when it comes to crypto, but as a C dork I found it ... quirky that the encoding/decoding functions in inner.h ([https://bearssl.org/gitweb/?p=BearSSL;a=blob;f=src/inner.h;h...](https://bearssl.org/gitweb/?p=BearSSL;a=blob;f=src/inner.h;h=9edaadd1ffc799655830e87f0d77b447e58d934d;hb=HEAD)) seem to use e.g. uint32_t to get a 32-bit type, while assuming that char is 8 bits (rather than using uint8_t). This seems strange.

<comment><USER43> I don't think it assumes it's 8 bits, but rather it assumes the values won't be outside the range of an 8 bit number, which should be fine, given that it's an octet-oriented protocol?

Using char pointers presumably is to get correct aliasing analysis?

</comment></comment></comment></comment><comment><USER44> I've been reading the code for T0 (a FORTH->C thingy), and I arrived at the conclusion that C# is a terrible language. The code itself is nice and clean if you assume it, though.

</comment><comment><USER45> _finally_ might be able to handle SSL requests on memory-constrained Arduino / ESP-8266 projects?! Yes please!

</comment><comment><USER46> Another OpenSSL alternative:

[https://tls.mbed.org](https://tls.mbed.org)

</comment><comment><USER47> This could be an interesting code base to use in a kernel. It should just work.

</comment><comment><USER48> Edit: [http://www.bolet.org/~pornin/cv- en.html](http://www.bolet.org/~pornin/cv-en.html)

Disregard me.

<comment><USER49> Says who? Maybe the cruft of the old ones means its impractical to fix. Maybe the leadership of the old ones means it can't be fixed due to incompetence or toxic politics. Sometimes rolling your own or forking is the smart move. There's a reason you use x.org and not xfree86 for example.

The idea that no one should ever roll their own cryptography is a cutesey warning for amateurs, but not an absolute rule. If no one ever did, we would never have any.

Also projects like openssl don't have third-party quarterly audits or other formal practices. They're "rolling their own" as much as the other guy.

<comment><USER48> Doesn't matter anymore -- the credibility of the person leading the project is thoroughly established, so I'm retracting my comment.

But generally, "says who" is answerable as "says any reputable applied cryptographer, established audit/research team, etc. who's thoroughly cut their teeth on crypto and security in general."

</comment></comment></comment><comment><USER50> Why bother with TLS 1.0 and TLS 1.1 anymore? I imagine by the time this project is "stable" Google would have already deprecated those two in Chrome.

And 3DES?

[https://sweet32.info/](https://sweet32.info/)

</comment><comment><USER51> Please make a openssl compat api if possible, its incredibly hard porting n programs to $ssl.

<comment><USER52> No really he should not. A separate translation layer is free for anyone to write though. The OpenSSL design from an API perspective is basically as far from "user friendly" as possibly possible. Having a hard-to-use API means that it's hard to get things right. If things are hard to get right it leads to more bugs. You get where I'm going with this.

A clean, simple to use, or rather hard-to-use-in-a-wrong-way API is very much needed (and there are some libraries that are nice to use but not very proven).

<comment><USER51> I don't really know what you mean about a hard-to-use api as openssl compat would just wrap the bearssl api and not make any difference to consumers of bearssl.

<comment><USER53> The problem is that OpenSSL's API itself is quite complicated and probably not in an entirely necessary way. As but one concrete example, there's almost no particularly satisfying way to handle the "error queue" in a world with imperfect software. I also recently found how how insanely impractical it is in practice to perform one's own certificate validation (e.g. so I could interpret the CN field) if a TLS connection is abstracted even a tiny bit (e.g. in a database driver).

Little doubt that someone would find it useful, but it is An Undertaking, to preserve something which is not that desirable.</comment></comment></comment></comment>


IQ and the Job Market (Jordan Peterson) [video] - <AUTHOR> https://www.youtube.com/watch?v=fjs2gPa5sD0 <comment><USER2> This is just a clip from the full lecture here: [https://www.youtube.com/watch?v=D7Kn5p7TP_Y](https://www.youtube.com/watch?v=D7Kn5p7TP_Y)

If you like the clip, watch the whole thing. It's great.

<comment><AUTHOR> Cool, thanks, I'll do that!</comment></comment>


Farmer Manages Cows with GPS Device - <AUTHOR> http://blogs.dovetailsoftware.com/blogs/main/archive/2008/01/08/Digital-World.aspx Article shows the extent that things are digitized but argues that there is so much more to come. <comment><USER2> wait till one of them suddenly drifts to mars</comment>


Top 5 Reasons for Ruby-Ists to Use Crystal - <AUTHOR> https://crystal-lang.org/2018/01/08/top-5-reasons-for-ruby-ists-to-use-crystal.html <comment><USER2> Nice post!</comment>


Show HN: My first project – Football voting app built in RubyMotion - <AUTHOR> http://footpoll.com

<comment><USER2> As a football fan, this looks like it can be fun. Especially as you're watching the game live, create a poll to see the opinion of people in real- time during a controversial play e.g. "Was Rooney tripped or did he dive?". Good stuff bg23.

One small nitpick: on your demo screen shots, you have "Which is the best player?". It should be "Who" not "Which".

<comment><AUTHOR> Thanks waterside, and thanks for picking that error up.

Completely envision the app working in real-time too. Also for man of the match voting etc.

Future versions will also include a breakdown of the votes by supporters as Football is a tribal sport and opinions are biased towards your club.

Thanks for the feedback

<comment> rkuykendall-com I agree with the "event" polls aspect. There should be a way to say that you are live-watching a specific event and get/create realtime polls.

Microsoft did this with the presidential debates and it was a blast. I'm not a sports guy, but once this app is more developed you may consider forking it to politics or TV shows or maybe just generic mass events.

</comment></comment></comment><comment><USER3> Impressive. Really like the design.

A quick note...on your Twitter auth page it's not possible to paste usernames and passwords into the fields. Probably not a huge problem for most but my passwords are at the long and un-typeable end of the spectrum and I normally paste these in from a separate password manager app.

<comment><AUTHOR> Thanks for the heads up. I will look into improving that!

</comment></comment><comment><USER4> Really great idea and looks like it it well executed.

On a side note, I really enjoy the new turn of HN moderation which let a lot more of cool project / show HN rise to the front page.

Good job bg23!

<comment><USER5> Or google, intitle:show hn site:news.ycombinator.com

</comment></comment><comment><USER6> There's one thing I totally disliked: I hate when I need to login as the very first required step. I (may) still don't know what the app does and I already have to login or create an account. To me, that's a bad user experience and in general I uninstall apps that do that. Very few apps really need the user to be logged in from moment zero. I would suggest to let the user see what the app is for, so he feels by himself how cool it'd be to have an account to use the app at its 100%.

<comment><USER7> I understand this argument but I don't believe it is a slam dunk. On the web, a user has invested nothing other than a click or possibly typing a url. On mobile, a user has already downloaded and installed the app. They have more invested, so you would think, are more likely to create an account.

That being said, you are certainly making the "funnel" smaller at the top but possibly the slope of the edges are more forgiving to the app developer as the user progresses down the conversion funnel?

<comment><USER6> I don't know. I know apps requiring login as step zero have a higher rate of "installdeletes" (I myself do that usually). Not sure if the users who actually decide to stay (so, to login) are then "better users". It could be. It actually makes sense. But I have no data about that tbf.

<comment><USER7> Hah, I don't have any data either. This was a debate at the last startup I worked.

</comment></comment></comment></comment><comment><USER8> Really clean design.

This reminds me of the Heineken Star Player app from a couple of years ago.

[http://www.akqa.com/approach/social/case-studies/heineken- st...](http://www.akqa.com/approach/social/case-studies/heineken-star-player)

I work for a pro sporting league and have need for the same experience.

</comment><comment><USER9> Thinking about an Android version?

<comment><USER10> Is there any good way to port a RubyMotion app to Android? Or would you have to rewrite it?

<comment><USER7> I don't believe that is possible. I think the closest thing would be [http://ruboto.org/](http://ruboto.org/) which allows you to code native Android apps in ruby.

</comment></comment></comment><comment><USER11> For a first project, design looks pretty great. It it works like it looks, nice work!

</comment><comment><USER12> Here's a bug:

I signed up via email, I was told my username had already been taken but then it let me go to the next screen and create polls with that username.

I like it though, nice design & well executed.

</comment><comment><USER7> Just installed it, seems to run great and it looks good too. Selfishly, I would LOVE if you wrote an article about implementing signup with facebook/twitter via rubymotion. What did you write your server using?

<comment><AUTHOR> Happy to write an article on that. I initially built the website using Ruby on Rails and had twitter/facebook omniauth implemented.

It was then a simple case of displaying a web view in the app with login similar to how you would on the web, then diverting back to the app upon login.

<comment><USER7> awesome, what's your twitter handle or website? I was thinking the webview might be the simplest way to go. I wonder if you get any extra functionality by tying into iOS's facebook/twitter stuff? Might be easier for things like "post to facebook" and the like.

<comment><AUTHOR> Yeh I think it would be easier eventually. I struggled trying to implement it though looking at objective-c. Its on my to-do list

<comment><USER7> I've found stuff like this [https://github.com/aaronfeng/facebook-auth-ruby- motion-examp...](https://github.com/aaronfeng/facebook-auth-ruby-motion- example) but I haven't actually tried implementing anything yet.

</comment></comment></comment></comment></comment><comment><USER13> Looks awesome man. I presume there are no plans for Android at this time? :)

<comment><AUTHOR> There are definitely plans, I would like to get round to it asap really....

</comment></comment><comment><USER14> This question might be a bit naive. I'm developing a similar app and I have not developed full mobile apps earlier - I started with Phonegap. Was there a reason why you did not consider that?

<comment><AUTHOR> I came from a zero programming background and built the website in Ruby on Rails whilst learning Ruby.

I wanted to build a fully native app for the best user experience and really enjoyed learning ruby, Rubymotion seemed like the perfect fit and it didn't disappoint.

I still have the limitation with Android of course...

<comment><USER14> Great work! Where/How did you learn Ruby (and programming)?

</comment></comment></comment><comment><USER15> This looks great! I'm in the process of building my first iOS app with Rubymotion. May I ask where you got all the awesome looking icons and whether you used RMQ? Awesome work!

<comment><AUTHOR> Thanks! I'm using RMQ for the front end and CDQ (also created from infinitered) for the Models and backend syncing.

The icons are from [https://flaticons.co/](https://flaticons.co/)

<comment><USER15> awesome. I loved RMQ. I can't imagine the level of detail in your cell stylesheets though :) looks fantastic.

<comment><USER16> Offtopic question: I created RMQ, what specifically do you love, what do you think needs improvement?

<comment><USER7> Just to chime in, I've been using rubymotion for a couple weeks and used RMQ for some toy apps. I now have switched to Promotion. I may come back to RMQ but my goal is the quickest path to an MVP on iOS. It seems Promotion is a bit easier (as I have no prior iOS experience) but I could be wrong.

I think RMQ seemed really great, and I do think I could get where I'm going using it (but maybe a little slower). If I recall, working with tableviews is where I switched to Promotion. Tableviews are dead simple for Promotion. I saw your video on the more complex view (the name is escaping me at the moment) but I am generally going to be using the tableview.

At the end of the day, none of the offerings have solid documentation (with examples!). For my needs, Promotion (so far) happened to have the documentation and examples in the places I needed it. I would definitely switch to a framework if it had easier to use docs and examples, but that's just me. I'm not a typical developer (computational physicist and musician turned web/mobile dev).

</comment></comment></comment></comment></comment><comment><USER17> Great app. I have tried. Registred as MANUTD fan. your app gives me some Norwich polls I don't care. Maybe that is something this fabulous app can improve. thanks!

<comment><AUTHOR> When you log in initially you are following 'Footpoll'. The main page is similar to twitter dependent on who you are following. You can go to the categories section to view Man Utd polls.

</comment></comment><comment><USER18> I'm learning Rubymotion myself. Can you list out the different technologies/gems used in this? RMQ, teacup, etc...?

This looks really nice, btw.

<comment><AUTHOR> Thank you.

I bought Rubymotion in November and it took me a month or two testing out different gems etc.

I ended up using RMQ, CDQ, Restkit, formotion, bits of bubblewrap

<comment><USER7> Did you try promotion at all? I've made a few toy apps with RMQ and now have been trying Promotion. I think I'm going to stick with Promotion but would love to hear anyone's experience with the various frameworks.

<comment><AUTHOR> I've not got round to Promotion yet. I'm really enjoying RMQ though and would be hard to move away from it!

<comment><USER7> Definitely stay with what works and obviously RMQ is working for you!

</comment></comment></comment></comment></comment><comment><USER19> I feel there needs to be an expiry date on polls. I'm still getting questions on who's going to win in past football games.

</comment><comment><USER20> Hey this looks impressive. Something I can use to end arguments as well where can I deliver feedback once I start using it? Cheers

<comment><AUTHOR> Yes thanks, any feedback is very much welcome!

</comment></comment><comment><USER21> I've been debating about learning code for a while. Really like what you did. How long did it take you to learn and develop?

</comment><comment><USER22> Did you find help to translate it to portuguese yet? Brazil will love this.

</comment><comment><USER23> Does this exist for general opinions? Looks awesome overall.

<comment><AUTHOR> I think a few have tried but nothing major I don't think. I recall a site called Opinsy a year or so back.

My initial thoughts we're creating it on a subject I was passionate about, as I personally wouldn't go on a generalist site to argue my opinion's about chalk then about cheese.

But the concept can be applied to anything of course.

</comment></comment><comment><USER24> Is that a volleyball in the logo though?

<comment><AUTHOR> Still trying to figure out how to add a piechart/barchart into the logo...

<comment><USER24> You could have a line-chart with the ball at the end? Like this(ish) [http://imgur.com/FGFGjI8](http://imgur.com/FGFGjI8)

</comment></comment></comment><comment><USER25> too bad only for ios, furthermore the SDK that you use can only be deployed to ios as well

<comment><AUTHOR> Well if the app is successful I plan on releasing it for Android and on the web

</comment></comment><comment><USER26> Just in time for the world cup!

</comment><comment><USER27> Love the site design too</comment>


Show HN: Quinesnake – A quine that plays snake over its own source - <AUTHOR> https://github.com/taylorconor/quinesnake <comment><USER2> This is spectacular!

You had me at

        ./quinesnake.cpp

The rest is just the icing on a cake :)

<comment><USER3> So it's not just a quine, but a polyglot quine even. They are the best :)

</comment></comment><comment><USER4> _A quine is a computer program which takes no input and produces a copy of its own source code as its only output. The standard terms for these programs in the computability theory and computer science literature are "self-replicating programs", "self-reproducing programs", and "self-copying programs"._

So it's a self-replicating game of snake? Sounds very much like a worm virus. Very nice project though!

<comment><USER5> Not exactly. It prints _exactly_ it's own source code as output but it doesn't run it again. You can run a quine output manually as it's by definition the same code that printed it but it lacks the ability to keep executing continuously like a worm virus would require. I guess you could make a worm virus that's also a quine but that would be a whole other problem.

</comment></comment><comment><USER6> This is really neat! Unfortunately the color isn't working for me for some reason, which makes locating the initial food quite difficult. Any idea what could cause that?

<comment><AUTHOR> Oh that sucks, the whole point of programs like these is that they should still be portable. Could you make a GitHub issue (or email me) with your platform, shell, compiler version and curses version?

<comment><USER6> Sure thing!

</comment></comment></comment><comment><USER7> Are there resources for making a quine that improve the development process or is it exactly as insanely tedious as it looks? Because this looks pretty impressive.

<comment><USER8> [http://www.madore.org/~david/computers/quine.html](http://www.madore.org/~david/computers/quine.html)

<comment><USER9> Also [https://en.m.wikipedia.org/wiki/Kleene's_recursion_theorem](https://en.m.wikipedia.org/wiki/Kleene's_recursion_theorem)

</comment></comment></comment><comment><USER10> Very cool

</comment><comment><USER11> A quine produces a copy of its own source, but quinine is the stuff they put in tonic water.</comment>


Rapid falling prices of electric car batteries - <AUTHOR> http://techxplore.com/news/2015-04-falling-prices-battery-surge-electric.html

<comment><USER2> _" further reducing costs. That will leave EV makers with two options—lower the price on their vehicles, or add more distance to their cars"_

If the only thing is that prices go down, that second option may not really be there. Adding batteries of the same energy/volume and energy/kg takes volume and adds weight and both decrease range.</comment>


Making Noise (1999) - <AUTHOR> http://noisemachine.com/talk1/

<comment> dj-wonk The cloud animation (linked from [http://noisemachine.com/talk1/24b.html](http://noisemachine.com/talk1/24b.html)), derived from the noise calculations, looks pretty good. I'll bet that it is computationally much less involved than, say a physics-based model, such as [http://www.markmark.net/dissertation/](http://www.markmark.net/dissertation/)

</comment><comment> dj-wonk Stunningly cool; worth reading in full, including the sidebar discussion. It has math equations, code, sun coronas, clouds, and FPGA design schematics! May I suggest this soundtrack while reading: [http://www.makingthenoise.com/music/](http://www.makingthenoise.com/music/)

</comment><comment><USER2> Perlin actually improved his original algorithm by creating the Simplex Noise [http://en.wikipedia.org/wiki/Simplex_noise](http://en.wikipedia.org/wiki/Simplex_noise) which runs much faster. As a matter of interest, Voronoi noise is also quite popular</comment>


Ask HN: If Huawei is smart, it would put everything open source - <AUTHOR> Primarily Drivers. Testable => Trustworthy <comment><USER2> Microsoft allows governments to inspect source code, the so called Government Security Program (GSP), to assure customers. I'd say that's a middle ground so Huawei can keep its IP.</comment>


58 Twitter Apps (and then some) - <AUTHOR> http://www.lo-fi-librarian.co.uk/?p=878 <comment><USER2> Heh, they forgot my two favorite:

twit.el - Twitter from emacs

Jott.com - you can call them, record a Jott to Twitter, and it will be transcribed and posted.</comment>


Yuri Milner, SV Angel Offer Every New Y Combinator Startup $150k - <AUTHOR> http://techcrunch.com/2011/01/28/yuri-milner-sv-angel-offer-every-new-y-combinator-startup-150k/ <comment><USER2> For all the talk from U.S. politicians about encouraging innovation, it takes the Russian to come here and put his money where his mouth is.

<comment><USER3> Consider, also, that most entrepreneurs in tech are foreigners (or children of), Vivek Wadwha had an interesting article on that. But those that stand out: Larry+Sergei.

If "The Russian" comes to the U.S. to make an investment is because the U.S. has done a really really good job in terms of policy to make it easy and convenient for foreign investors to bring money to the U.S. now they (gov) need to do the same for talent/entrepreneurs.

<comment><USER4> Digging up Vivek Wadwha's article, he found that 25% of U.S. tech entrepreneurs were immigrants, which is certainly higher than their share of the population (about 10% of U.S. residents are foreign-born), but not really "most". The numbers were higher for the Bay Area, though, at about 50%; but then the number of total immigrants in the Bay Area is also higher (33% of Californians are foreign-born).

<comment><USER5> Possibly a sign of different upbringings?

Can be parental, culture, education, standard of living, etc.

<comment><USER6> It seems to me that the case is exactly the opposite: the talent appears randomly, so the only way to concentrate it is migration.

<comment><USER7> > the talent appears randomly

That's a pretty strong statement, but even if we take it as an axiom, I think that it isn't migration that concentrates it -- people migrate from everywhere to everywhere all the time.

I think it has more to do with having gone through some hardship, and (selection bias) having done so successfully, makes people better at taking risks.

There's a statistic that says that a huge number (ten percent or so) of immigrants immigrate again to a 3rd country.

Someone who never immigrated would think "all that trouble, again?". Someone who [successfully] has thinks "Well, that wasn't so hard, we can try that again".

<comment><USER8> I think you missed the point- he meant that the fact that you were able to immigrate probably means that you're not the average person. He's right- immigration is much easier if you're rich, smart or both.

Also, I'm offended by your last sentence. You've obviously not immigrated to america recently. I have, and it wasn't easy, nor was it cheap.

<comment><USER7> As a matter of fact, I did. It's not easy, it's far from cheap, but having gone through all of that, another move -- at least to an English speaking country -- is comparatively trivial to what I've thought about it before.

And if you take offence at random remarks by strangers on the internet, you should have a long talk with yourself.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Super news this, that's going to have one nasty little side effect, YC will see an order of magnitude increase in the number of applications they will receive in the next round.

Predictably there will be a lot of bitching by other angels, imo they should create a fund and offer to match.

YC might become a one stop shop.

<comment><USER10> Is more applications necessarily a bad thing though? Sure they are likely to miss more winners and the application/ interview process is going to be even more time consuming but you would have to think it would translate to a highly quality group.

<comment><USER9> Reviewing applications is hard work.

YC now has more partners and a larger network of alumni so that should help a bit with scaling this.

<comment><USER11> And that's why this move is a smart one : Yuri has effectively outsourced all the valuation work for the investments onto really smart people that he doesn't have to pay anything for.

While that doesn't seem particularly fair to the rest of the VC community, it's exactly analogous to investing in an S&P ETF (which just invests in a whole bunch of stocks at the current market prices).

</comment></comment></comment></comment><comment><USER12> This sounds like a campus placement scene. If you get in a top college, you wont be even interviewed properly or see how you have changed in last few years/months. We will just hire you with fat paychecks.

As shown by history - this does not work in the long run and makes things worse than better.

Dont get me wrong - YC is great, pg and rest of the team do an amazing job of selecting startups. But such blanket offers will mean lesser money available to non-YC companies. So if you are competing with a YC company, you have so much ground to cover.

More money for startups is good, but quality of the startups should be judged almost every 3 months. That is very healthy for entire startup community on the whole.

<comment><USER2> " But such blanket offers will mean lesser money available to non-YC companies"

I actually think precisely the opposite will happen.

<comment><USER13> I think you're right. It's like the concept of "anchoring", setting a new normal.

<comment><USER12> I dont have first hand experience of US placements. But this is what happened in India when IT services started booming.

If you go to a top college, they dont interview much. You get a very fat paycheck. If you go to tier II college you are interviewed a bit more and given a bit thinner paycheck.

Over a period of time this became a positive feedback cycle and is the core reason for very low quality yet expensive workforce.

What I feel in my gut is - such blanket investments normally take up valuations to such levels over a period of time that it becomes unsustainable. Whether it is with job markets or investments or real estate.

</comment></comment></comment></comment><comment><USER14> Web startups are now rock bands, and YC is the record label.

<comment><USER15> _%cough%_ There is more to the startup world than just "web" startups, ya know. _%cough%_

And YC don't limit themselves to just web startups, or even just to software companies, according to the FAQ. [1]

[1]: <http://ycombinator.com/faq.html>

<comment><USER16> Relatively few are pure web startups. They all have websites, of course, but most companies YC funds are in a particular business.

</comment></comment></comment><comment><USER17> I saw on the news it was going to rain tonight; I didn't realize they meant that in Mountain View it would be raining money.

</comment><comment><USER18> $150,000 in convertible debt. With no cap and no discount.

I suspect all 40 companies will take the money on those terms. You would be crazy not to.

<comment><USER19> What are the terms of the deal, specifically? How much to startups have to pay back if they take the $150K, and when do they pay it? What about valuation of the startups (ie. $150k for 10% implies $1.5m valuation)? Or is this more like a loan ($150k, pay back over X years, or upon Y liquidity event)?

<comment><USER20> It means your plan IS to give some of your company away for money. Instead of holding 100%, getting ramen-profitable, working your butt off to make it.

<comment><USER21> Actually, even that isn't true. If a company were to take this money, and then never raise another round, they would simply have to pay the debt back, I'm guessing at a fairly modest interest rate.

</comment></comment></comment></comment><comment><USER22> Honestly, I'm surprised that nobody did this sooner. Hell, didn't Conway invest in six of the last round anyhow?

This is sort of like going to the race track and betting on every horse. Except at this particular race track, the horses are all above average and multiple horses can win each race.

I'd take those odds.

<comment><USER11> The clever thing about this is that Yuri doesn't have any of the due-diligence costs of Ron Conway : He's outsourced it all.

OTOH, maybe/probably Ron Conway actually enjoys the thrill of the hunt for new exciting stuff, so he doesn't consider it a particular cost.

Right now, according to the article, YC (pg) is happy about the situation : it improves their brand, helps entrepreneurs, etc. But I'm sure that they'll realize that Yuri just got in at a better valuation (on average) than they did, but they're doing all the work. Of course, they probably already have realized this, but they don't have many other options now - other than inserting 'poison pill' anti-freeloader terms into their deals...

<comment><USER23> Why is he in at a better valuation than YC? From what I read it seemed like he loans 150k for an option to be repayed in stock at whatever valuation they take their first round of funding at? YC's 30k goes in at somthing like a 0.5 million valuation, so i would assume the rounds most of these companies are taking are higher than that?

<comment><USER11> Mea Culpa - you're absolutely right on the valuation side. I think that the majority of value in a YC investment is not in the actual cash, though. And in some ways, this provides a side-by-side comparison of the difference between a 'pure money' investor and a true 'value added' investor should be getting.

Given how (YC) entrepreneur-friendly this is, there must be a whole lot of soul-searching going on at VCs and other angels now : Somehow, the private equity space just got an index investor.

</comment></comment></comment></comment><comment><USER24> Basically he just paid $6M to have a seat at the table and be a guaranteed call when they're raising their series A. I guess that's one way to get in to the early stage game.

<comment><USER25> It's not about PR. It's about a halo effect. DST needs a pipeline of new startups to continue the web x.0 hype-cycle, so he can offload his Groupon, Facebook & Zynga. positions.

He can afford to gamble $6M on YC startups, if they will create demand in the market for his hundreds of millions dollars worth Groupon, Facebook, Zynga shares.

It's a good assymetry position to have.

If one of the 40 becomes the next google, he wins. If he can exit his DST positions, he wins.

However if the web bubble burst, he is sh*t out of luck. And DST will be a huge bagholder.

<comment><USER26> _DST needs a pipeline of new startups to continue the web x.0 hype-cycle, so he can offload his Groupon, Facebook & Zynga. positions._

I don't get it, how does this help with that?

<comment><USER27> Read up on AOL's position during the .com boom.

<comment><USER28> can you just explain it?

<comment><USER27> Startups made "collaboration deals" announcements with AOL then got funding based on those "perspectives". Large part of that funding would go to AOL to buy a front-page add.

They say that the only limit to AOL's revenue from this was the amount of space on their website first page, not the number of interested startups.

Basically the valuation of the giants stayed up for as long as easy funding was available to .com's. Their spending habits, without being backed by actual revenues, were more than enough to sustain the stock prices of the few big ones selling to startups whatever they needed (ad space, big iron or aerons).

They all fell together when the crash came and easy funding dried up.

<comment><USER10> Expenditure is different this time round though, most of these startups aren't looking to blow heaps of investment on advertising and expensive offices and server costs are nowhere near where they were.

Most startups now to know that building an audience isn't enough that they need a revenue model. Many startups being built to are good fits for acquisitions by the bigger players, generally less people getting funding for things that are unworkable.

Also the public is far less adverse to sharing and purchasing online and innovations like the app stores and things like the kindle have opened up many more markets to generate revenue.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> This is awesome. It's great to see big money split up into lots of small investments. I've always wondered what would happen if Microsoft took 1 billion dollars and make 10K $100K angel investments. Something amazing would surely come out of so many trials. Traditionally, that 1 billion (if invested in startups) would be doled out in 100 or so $10MM-ish chunks, mostly to later stage companies.

</comment><comment><USER30> One potential issue I see is that YC companies might get complacent. I know that there are tons of factors that lead to the insane productivity that happens during YC, but I'm sure that the fact that many companies need to raise money or fail contributes.

Also, the money might keep people working on bad ideas instead of giving up and trying something new. Obviously they could pivot, but $150k gives them the ability to spend ~a year working on a bad idea before needing outside validation.

But I'm sure it'll be great for YC overall

<comment><USER20> Fundraising is famously a huge hit to productivity. This should make YC founders an order of magnitude MORE productive.

</comment></comment><comment><USER31> Every YC batch should have at least 1-2 big wins. They're betting that it's more important not to miss out on those than to save a little money trying to pick the winners. A great strategy if you can afford it.

<comment><USER9> > Every YC batch should have at least 1-2 big wins.

Can you quantify a big win?

<comment><USER31> Heroku.

<comment><USER32> Actually, if we assume that Heroku's post-money valuation in their first round of financing was $10m (reasonable since they raised $3m) and that they took a 30% dillution hit each time, this would have returned $2.88m to someone that got in on these terms, or not even enough to cover the investments for that batch.

So either the homeruns have to be further out of the park than Heroku or (as is likely) the median return needs to keep things in balance a bit more.

<comment><USER33> I know the actual numbers for Heroku, and in that YC batch investors pursuing Ron and Yuri's strategy would have been net ahead on Heroku alone. And that batch also included 280 North, which has already been acquired for a significant amount, and several other startups which are likely to generate returns at some point.

<comment><USER9> How does it work out for all YC companies that have run and either exited or died to date?

</comment></comment></comment></comment></comment></comment><comment><USER34> DST is a money laundering operation. Yuri Milner is a criminal.

I can't believe Paul Graham deals with these guys. He should understand that Russia is outside of his circle of competence. His smarts are not enough to make the judgement.

Russia gets roughly $90B annually for oil and gas. Most of the money gets stolen one way or the other and ends up in the funds like DST.

Dealing

<comment><USER35> source?

<comment><USER34> <http://www.rumafia.com/person.php?id=88>

<comment><USER34> Usmanov is Milner's boss, it's his money.

</comment></comment></comment></comment><comment><USER30> > _It's the most investor friendly investment that I can think of, short of > just handing people money as a gift._

s/investor/entrepreneur/

</comment><comment><USER36> YC is now the best deal that exists.

<comment><USER20> Hm. There are folks still using the 'old-fashioned' model of fundraising manually, building a team, honing a product and going to market.

YC may be the best deal for a crew of wet-behind-the-ears startup virgins, I'll grant that.

<comment><USER37> That was a trollish comment but I'll bite.

150k is not going to get a company very far, and certainly not far enough to reinvent the startup model completely. Building a team is still a critical part of building a YC (or any other) company, as is honing a product and bringing it to market (which is primarily what they help you do). Saying that those things aren't part of the YC model just because you get some extra free money on great terms is disingenuous.

Also, more and more experienced entrepreneurs are going to YC, because of the effects of the network and because the money really isn't that expensive. People always bring up that it isn't a great deal for experienced entrepreneurs, but you can ask my friend Steve, who just sold Reddit, went back to YC, and just raised a fat series A for hipmunk whether it was worth it.

<comment><USER20> Hm. 150K is going to get a company, lets see, 10 times as far as $15K? Probably not, but its certainly going to get it something, and fundraising is going to be an order less critical for the duration.

The YC model is something like this: Founders are recruited, then weeks are spent building a prototype whilst attending dinners/lectures about the next step: fundraising.

YC is out of the picture once teambuilding, product honing begins. Its explicitely NOT part of the YC experience. As I understand it.

To expand on my 1st remark: the shoestring bootstrap model is just one; others solicit Angels to fund development in a more structured manner. The reasons to bootstrap are usually, you are not known and cannot convince Angels to cough up. If for instance you have a success behind you, it may be possible to dispense with the grinding poverty phase.

</comment></comment></comment></comment><comment><USER38> Investing in a company based on its acceptance into YC? Hm. Also, I think this breaks the model a bit, I thought the point of the initial small(er) investment was to drive creation of a product or business model that could then expand naturally or take further investment once they've proven the products value/viability etc. I guess for some it would be a bonus, but for some it might be a curse?

Although "Paul Graham seemed very pleased" implies it doesn't, so I figure I'm wrong. Maybe it is for the better, especially when it's optional...

<comment><USER39> The model has changed. Now it's about the ability of Paul et al. to pick horses.

(Also the Ycomb environment and all that too)

<comment><USER9> Yes that's the best way of putting it. YC is seen as a vetting agent that has so much experience in evaluating start-ups now that their ability to separate the wheat from the chaff makes a deal like this feasible.

How long before a major VC steps in to offer a third round for those that get to some pre-set goal to every YC funded company that took the second round too?

</comment></comment></comment><comment><USER40> High five, pg!

<comment><USER33> ⁵

</comment></comment><comment><USER10> So this investment isn't at a valuation and the valuation is only decided at a future round at which point this converts into an amount of equity based off that valuation?

I've read about convertible notes before just a little confusing at first.

<comment><USER41> In the event of a funding event (or change of control), this $150k turns into $150k worth of stock at the valuation established AT THAT TIME.

Example #1: Company A takes the offer and sells for $1m in 6 months. The debt converts to $150k in stock, netting the investor $150k.

Example #2: Company B takes the the offer and raises $1m at a pre-money valuation of $3m (selling 25% of the company and establishing a post-money valuation of $4m). The $150k turns into $150k in stock at the new valuation, so 3.75% of the company.

Normally, there are various ways (discounts, caps, etc) to reward the early investor for the additional risk they are taking for investing so early.

Basically what this means is YC companies can (if they want) eschew funding at demo day, hold out for great terms, or just get busy creating value and raise money when they have more leverage. This is huge.

<comment><USER19> After reading this explanation, it's hard _not_ to acknowledge this as a disruptive gamechanger. I mean, this completely changes the game for YC and every one of their successful applicants.

</comment></comment></comment><comment><USER13> The fact that this story generates so much excitement at 10 PM on Friday night says something about the community. Good things.

</comment><comment><USER28> I am most excited because this will mean hardware and oter "harder" things might be possible with less "baby steps" involved to get companies where they want to be - faster.

</comment><comment><USER42> It sucks to be a graduate from Summer 2010. Missed it by 1 term.

<comment><USER43> Come now, you were admitted into a highly-competitive incubator that attracts a lot of investor attention and puts you in touch with some very valuable mentors.

The next term might be a bit better off, but it certainly doesn't suck to be you.

</comment></comment><comment><USER44> And the collective of the YC W'11 hopefuls just let out a wistful sigh. At least I did.

</comment><comment><AUTHOR> Congrats to YC and all of the startups. Sadly, I can already hear the chants of "Bubble!".

<comment><USER10> Not really, I think most of here would assume YC would in the next few years produce a solid return. Here your basically aligning youself to YC's performance instead of trying to pick which ones you think will turn out the best. Although sounds like they are still doing that additionally.

<comment><USER45> absolutely not. YC is getting their percentage at valuations of around 200-300k.

This investment will convert at valuations closer to 5M these days. So in fact they're effectively paying 10x what YC is paying for about the same stake in a company post the financing.

Congrats to YC and time will tell if it works, exciting either way.

</comment></comment></comment><comment><USER42> ...and they said good guys finish last? PG seems to be proving them wrong, every day.

<comment><USER46> Remember that life is not a race, neither is investing.

<comment><USER42> HaH! Try telling Calacanis that.

</comment></comment></comment><comment><USER47> Techstars is going to be unhappy about this. After one of their premier companies, SendGrid gets hit by the amazon announcement, YC closes this deal.

</comment><comment><USER48> This is truly remarkable. Those of us yet to have submitted to YC now have an additional reason to do so. And it took a foreigner to do it. Po.iticians should take note, because this is how you stimulate an economy and innovation.

</comment><comment><USER49> I think this is fantastic. Whether it is this $150k or the great number of startups that are getting huge funding early on, it all means one thing... it is GREAT for business and competition.

I've heard from quite a few people who say this is a negative thing and they say it defeats the idea of being a startup. My question is, why do you HAVE to start in a garage? Why do you HAVE to eat Ramen noodles for 2 years? At the end of the day, being a startup is about having a creative team and being innovative.

This is a great step forward and if it helps a few more teams create a killer product then we all win.

</comment><comment><USER50> This turn YC into a market index.

The payment pg and company receive for this service is the increased negotiation power in the deals they fund.

Theoretically this makes entire YC batches without a single dollar invested by YC itself possible.

<comment><USER51> It was always possible - the value proposition for YC has always been the advice, connections, and reputation from being associated with them. The monetary investment is just so that founders who wouldn't otherwise be able to do it (eg. those newly out of college) can take part.

</comment></comment><comment><USER52> When was the last time you looked at a yc company and didn't say "Damn that's a great idea." and then follow it up with "wow that's pretty good execution too".

It's a little scary how good the yc companies seem to be lately.

<comment><USER22> I'm not keeping a tally but I often find myself scratching my head and wondering what PG et al saw in some startups.

My guess is that it's usually a bet on the people, not the idea. If you mentor a founder that eventually starts the next Google, they are going to remember that.

</comment></comment><comment><USER53> Convertibles with no-cap, frothy valuations, great time to be an entrepreneur. I wonder if this is going to pressure other angels into offering similar terms, and I think if they try to then ultimately angels have the potential to get severely diluted in follow on rounds. I do think that this is a great PR move. Given the hands-off terms from Yuri, I highly doubt that this is a kiss of death for other large VCs who are looking to invest in the follow on rounds, I think it puts much more pressure on Angels who are looking to get into the seed round.

</comment><comment><USER54> Wow, big win for YC!

</comment><comment><USER55> Unless there are additional terms at play here (e.g. liquidation preference), this means that unless YC companies raise a series A before exiting, Yuri and SV Angels won't get more than a 1x return (plus interest).

It's hard to believe the math works out here, but obviously a lot of thought and number crunching has gone into this decision. Great news for YC though!

<comment><USER56> I think that depends on how the note is written. I've never seen a note without a cap but usually it converts at the cap on acceleration. No idea how a conversion at acceleration would work if there is no pre determined valuation but it could be possible.

</comment></comment><comment><USER57> This really is crazy. I'm sure this will only lead to i liar deals for TechStars and others. Angel Investing needs to evolve.

<comment><USER58> Nothing stops Mr Milner from doing the same offer for TechStars companies, I guess

</comment></comment><comment><USER15> Wow; that's great news. Congrats to the YC companies for this opportunity!

Guess it's time to get cracking on those YC applications, folks...

</comment><comment><USER3> There seems to be a correlation between high performing funds and how fast they move to get into the good deals, this is a very efficient way for SV Angels to move faster than anyone else. They already moved fast before, now it's a tremendous head start.

If it's a bubble, it's a cheap bubble $6M is nothing for most funds.

<comment><USER22> It's only a bubble if the world stops spending money online and every re- discovers network reality television as a hobby.

</comment></comment><comment><USER59> Holy shit. The word "disruptive" is overused but it's pretty applicable here. Crazy.

But is this fair to other angels/investors?

<comment><USER60> Capitalism happens. _plays tiny violin_

Less sardonically: if YC is so ridiculously superior to other investment models that investing money at these terms is profitable _knowing nothing of the actual company invested in_ , then the system is broken. This is the market's corrective measure, attempting to come up with a better approximation of the true value of early stage startups. Might it discomfit people who made a lot of money when it was broken? _shrug_

<comment><USER51> My first thought is that there must be a ridiculous amount of money floating around in the capital markets right now...

<comment><USER60> Much like I look at "200,000 visitors! Whoa!" and think it is a big number, and you guys might think "Hmm, perhaps there was something interesting going on that second.", I think we collectively share a borked perception of what constitutes a big amount of capital.

$150k is a meaningful amount for an early-stage startup. Multiplied by 40, that is $6 million. $6 million is, seat of the pants calculation, two orders of magnitude lower than 2% of United States VC funding in a typical year. VC funding is three orders of magnitude lower than the amount of outstanding bonds in the US. That is one asset class: there are others.

Or, for another visualization: if this investment is one pixel, then the US bond market is a grizzled old neckbeard sporting six monitors at 1024x768. The remainder from that calculation might fit an iPhone, but I don't know the resolution on those off the top of my head.

Long story short: there is _always_ a ridiculous amount of money in the capital markets.

<comment><USER51> I wasn't thinking so much about the _amount_ of capital as to the fact that someone is willing to risk it on someone else's judgment. Money managers aren't known for trusting other people with their money; if they were, they'd be their clients. That someone is willing to do this indicates to me that he considers this "play money", a little loss leader he can dangle to get in on much bigger deals later. It's not really the amount of money going into _these_ deals as to amount of money that it suggests is behind them.

<comment><USER11> All the amount placed into Muni Funds and ETFs is investing on other people's judgement : It's MASSIVE.

</comment></comment></comment></comment></comment></comment><comment><USER61> I was planning to bootstrap my new startup I have in the works, but now I think I will apply to be among the next batch of startups to be funded by Y Combinator. I just woke up to this news, and what a lovely start to my day.

</comment><comment><USER62> Can someone explain what is a "convertible debt. With no cap and no discount" ?

</comment><comment><USER63> That is awesome. I wish I'd made it into the winter 11 batch :(

</comment><comment><USER64> absolutely crazy

</comment><comment><USER65> Y combinator is doing an amazing job!

</comment><comment><USER66> This is great for YC and the new companies coming out, congrats guys.

</comment><comment><USER67> Wow, amazing deal. Only time will tell if its good for them or not.

</comment><comment><USER68> Yuri Milner is a baller. That's all.

</comment><comment><USER69> Is YC become a bubble itself?

</comment><comment><USER70> The recession is over.

</comment><comment><USER71> I want ask an obvious question..

We have at this point in time, the lowest rate of success or ROI of the VC industry since stats were kept. It would seem to me that any deal whereas someone short-changes the process of getting to a Series A deal for any VC or group of VCs is somewhat dangerous of destroying the very model that got all of us here.

What steps are being taken to protect the 'YC-Combinator' VC and start-up incubaor model?

</comment><comment><USER72> No more debates about whether YC is a "good deal" because of the low implied valuation of their initial investment.

This changes the character of the YC experience. YC companies can now spend their time on product, not fundraising. On the other hand, less financial pressure may mean the founders don't learn to hustle and act less lean.</comment>


Venturi: Instead of closing LaGuardia, let's fix it and close Rikers - <AUTHOR> http://www.archpaper.com/news/articles.asp?id=8134#.VduhWSgxbqA

<comment><USER2> I thought LaGuardia is getting a massive update the next years, which I'd assume only is worthwhile if it continues to exist, so why "instead of closing LaGuardia"?

<comment><AUTHOR> From what I hear it is going to be torn down and completely replaced, not just updated. At some point it will have to be closed. Yes, still, the title is not too accurate, but to be fair, the article was written before the announcement of the reconstruction.

[http://www.planetizen.com/node/79879/different-idea- laguardi...](http://www.planetizen.com/node/79879/different-idea-laguardia- airport)</comment></comment>