HTTPS on NYTimes.com - <AUTHOR> https://open.blogs.nytimes.com/2017/01/10/https-on-nytimes-com/ <comment><USER3> It's nice to see more news media moving towards using HTTPS.

NYTimes now joins a small club, alongside the Guardian and the Washington Post.

Here's a dev blog post on the WaPo moving to https: [https://developer.washingtonpost.com/pb/blog/post/2015/12/10...](https://developer.washingtonpost.com/pb/blog/post/2015/12/10/moving- the-washington-post-to-https/)

And one on the Guardian moving to https: [https://www.theguardian.com/info/developer- blog/2016/nov/29/...](https://www.theguardian.com/info/developer- blog/2016/nov/29/the-guardian-has-moved-to-https)

<comment><USER4> Google Chrome is supposed to soon start flashing a "not secure" warning on HTTP sites that have password forms [0]. That's probably at least one motivation for these publisher moves to HTTPS

[0] [https://security.googleblog.com/2016/09/moving-towards- more-...](https://security.googleblog.com/2016/09/moving-towards-more-secure- web.html)

<comment><USER5> What happens with local LAN machines, like the admin webpage for your wireless access point? It's not like they can go HTTPS?

<comment><USER6> This is an issue we're encountering. One solution is trust on first use of a self signed cert, which makes the scary untrusted page a one time cost. This isn't terribly easy in the browser though. With more IOT devices entering the market, this could become a more common issue.

Using https for a local network connection will also be more common, in the case you decide you don't trust the network.

<comment><USER7> I think for the case of the home router admin page (or really any admin page on your local network), the browser can easily detect that it's being served a page on the local net, and could provide a less scary warning that has some text that acknowledges that you're on your local net and that either ignoring the password form security warning (for http) or accepting the self-signed cert (for https) is probably ok. Whether they'll do this is another question...

<comment><USER8> It absolutely makes sense not to display warnings that HTTPS isn't in use in circumstances where HTTPS is not feasible - i.e. local addresses. It's simple enough for a browser to determine. I don't think conditionally accepting a self-signed cert is necessary.

</comment></comment></comment></comment></comment></comment><comment><USER9> They mention it has been a complex undertaking and not complete yet - <USER2> anyone know why they can't just sit a traffic manager in front of everything with SSL offloading?

Also does anyone know what the new personalisation features are that they mention being able to offer now HTTPS in place?

<comment><USER10> At any large media organization, there are tremendous amounts of content no longer connected to any CMS that may have hard-coded insecure links/resources in them. Some of them may live on obscure servers or domains. Or the developers/journalists who worked on them and have knowledge of their construction are long gone. These pages are very laborious to find and update.

If you don't mind 404ing or breaking a ton of your old content, it's probably not too difficult. But if you're the newspaper of record, it's a big deal that URLs live on and continue to work as expected.

<comment><USER7> You also mention "insecure resources", wich I think is a big deal too. I'd imagine there'd be the oddA hard-coded http link to an image that serves an important purpose to an article... that suddenly going missing because a browser refuses to load it would be bad.

But I think you hit the nail on the head -- being the "newspaper of record" means you want to ensure that all your content displays like it did the day it was published.

<comment><USER11> HTTP URLs redirect to HTTPS

</comment></comment></comment></comment><comment><USER12> The thing the NYT needs to fix (as of earlier last year) is the fact that you can't cancel your subscription without calling them (which is not the case for signing up). I spent 20 minutes[1] on the phone telling them that yes, I really did want to cancel. It was a worse experience than dealing with Comcast, not least because I felt bad for the poor woman who obviously had some financial incentive to get me to stay on with them.

[1] This number is approximate. Could have been less, could have been more; it was a while ago.

edit: I feel kinda bad now that this is the top comment in a thread about something positive the NYT did; if anyone tells me that they've since added online unsubscribe, I will change this comment accordingly.

<comment><USER13> Echoes of Comcast ... the NYT is constantly promoting 50% off the posted rates for new subscribers, without ever offering such terms to existing customers. But if you're a "frustrated" long-time customer who's on the verge of canceling, then suddenly the 50% discount is rolled out.

In most other industries, loyal customers get better treatment. Or it's the same deal for everyone. These sorts of inverted pricing structures may squeeze more revenue out of a few long-term, inattentive customers, but the hidden cost in churn, irritation and haggling is considerable.

<comment><USER14> Insurance is another industry with the same inverted pricing structure.

<comment><USER11> What? Your prices go up every year? I've never seen that.

<comment><USER14> Yes (although I should clarify that I'm referring to car / house / contents insurance here). Typically the premium offered at renewal time will increase every year, but if you come in as a new customer you can get a substantially lower premium.

</comment></comment></comment></comment></comment><comment><USER15> "I'm all in favor of news sites using HTTPS, but I assume they're also going to pad all their articles to a uniform length?"

Source: [https://twitter.com/matthew_d_green/status/53504312624809574...](https://twitter.com/matthew_d_green/status/535043126248095744)

<comment><USER16> This isn't an "all or nothing" situation.

Enabling HTTPS is a benefit even if it's not perfect. The integrity and authentication it provides are alone a MASSIVE benefit (especially for a news site).

Now you'll know that your news is coming from their servers, and nobody else is tampering with it.

Then taking into account that it does provide confidentiality, you get rid of "dragnet" style data gathering and inspection.

You'd need to be targeted by someone who not only has a lot of time, but also is very up to date on the pages of NYT and their sizes to be able to track your article by its size.

No matter what, it's still harder than it was before to snoop on what you are doing.

It's a net gain in just about every single way.

<comment><USER17> "Now you'll know that your news is coming from their servers, and nobody else is tampering with it."

I'm a HTTPS noob, can you explain how or why someone would tamper it on normal HTTP? Who would care to target me and what are the chances that NYT has been tampered with ever before?

<comment><USER18> To take an example that's already happened...

How? By being the user's ISP.

Why? To inject adverts.

What are the chances it affected nytimes.com? Almost certain.

Behold: [http://arstechnica.com/tech-policy/2014/09/why-comcasts- java...](http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript- ad-injections-threaten-security-net-neutrality/) \- and that's not the only case of it.

<comment><USER16> And as that last link points out, this isn't a theoretical thing.

Not only do ISPs do it, but wifi hotspots, dodgy wifi routers, malware on anything in-between, and in some (admittedly rare cases) your government.

And the why isn't just ads. But passive tracking (ISPs have been known to analyze your traffic passively and sell that information), active tracking (the famous Verizon super cookie), "page optimization" which frequently breaks sites, and in some cases malware injection into images, executables, or anything else the bad actor could do automatically.

</comment></comment></comment></comment></comment><comment><USER19> Oh no, this was my go-to site whenever I had to login to public wifi and https wouldn't redirect :(

<comment><USER20> [http://neverssl.com/](http://neverssl.com/) my friend.

<comment><USER21> I use [http://plop.org](http://plop.org), a whole four characters shorter!

<comment><USER22> I like that one. My domains for this purpose are: [http://i.net/](http://i.net/) and [http://ip4.me/](http://ip4.me/) (or [http://ip6.me](http://ip6.me), if you know you have IPv6 connectivity)

</comment></comment></comment></comment><comment><USER23> A nice farewell gift for Chris Soghoian's time at ACLU (during which he constantly tried to get news organizations, law firms, and government agencies to use HTTPS and STARTTLS).

</comment><comment><USER24> Interestingly, Certificate Patrol warned me that the certificate at that site changed from a "Domain Validation" to an "Organization Validation" certificate from the same CA.

Why did they do that change, and what would be the advantage for them of an OV instead of a DV certificate?

<comment><USER25> OV are considered more secure than DV due to the higher registration requirements[0]. Additionally a DV certificate is good for a single domain, OV certificates are good for all of that organisation's domains. For example the NYT's certificate is valid for:

          DNS Name=nytimes.com
          DNS Name=*.blogs.nytimes.com
          DNS Name=*.blogs.stg.nytimes.com
          DNS Name=*.dev.nytimes.com
          DNS Name=*.nyt.com
          DNS Name=*.nytimes.com
          DNS Name=*.stg.nytimes.com

This simplifies deployment significantly.

[0] [https://www.ssl.com/article/dv-ov-and-ev- certificates/](https://www.ssl.com/article/dv-ov-and-ev-certificates/)

<comment> vertex-four DV certs can certainly have wildcards and multiple domains, and no, OV certs are not "more secure" \- they simply contain additional fields which suggest that a CA has taken some amount of effort to verify that the domains belong to a given organisation, which the end user can read. This is generally more-or- less useless, as I'm pretty sure we all know that nytimes.com is owned by the New York Times.

<comment><USER26> And who reads the certificate anyway? I've never heard that an end user actually reads the content of the certificate. They just look for the green lock.

It would often be confusing anyway, as the legal entities the certificate is issued to can be named very different from the brand.

</comment></comment></comment></comment><comment><USER27> A good step forward. Does the NY Times itself track what its users read? Does it provide that information to others?

If so, this change amounts to not protecting user privacy as much as insisting that only the NYT can monetize their users' privacy.

<comment><USER28> Random coffee shop / hotel / etc wifi owners and other users on the network will only know that you're reading nytimes.com, and not which particular section/article.

<comment><USER28> And your session cookie..

<comment><USER29> Session cookies are transmitted as headers which are protected by HTTPS.

<comment><USER28> Sorry, I meant that as an additional reply to

"If so, this change amounts to not protecting user privacy as much as insisting that only the NYT can monetize their users' privacy."

The cookie is now hidden from the MITM. Before, not only could they see what pages you see, but they could login as you.

</comment></comment></comment></comment></comment><comment><USER30> I wonder what the reason for HTTPS only for "Articles published in 2014 and later"

<comment><USER31> Yeah, one would think that it's an easy job, but media organizations tend to have different projects, CMSs, designs, sometimes even (sub)domains for different things.

Media websites are constantly-evolving beasts, with a small tech team trying to hack shit up to make them work, and killing older content is never even an option.

At the end, with a limited amount of (mostly human) resources, you kind of have to draw the line somewhere and introduce the change, otherwise you will end up postponing it for possibly months.

</comment></comment><comment><USER32> If only we could get adult websites to do the same.

<comment> angry-hacker Eporner.com did it recently. I'm not sure if they are the first or how big they are compared to pornhub etc., but I happened to notice other day because they asked feedback on their frontpage about https.

</comment></comment><comment><USER33> I'm curious of what's the technologies that are only available with https mentioned in the post. Service workers?

<comment><USER34> HTTP/2 only supports HTTPS, which means HTTP connections don't benefit from HTTP/2's speed improvements. In addition, recent versions of Chrome only allow use of the location API by sites served over HTTPS. These are just two immediate examples that come to mind, but more exist.

</comment></comment><comment><USER35> Went through a frustrating process when switching to https on my baking blog so I imagine that frustration scales with size.

</comment><comment><USER36> Judging by the certificate issue date, they've been working on this since September. Congrats on shipping!

</comment><comment><USER37> Finally. Redirecting from https to http is quite annoying.

</comment><comment><USER38> About time

</comment><comment><USER39> Good to see they are using HTTPS.

</comment><comment><USER40> How is this news worth upvoting though?

<comment><USER41> Context is the key.

They say HTTPS is complex to enable and imply they've been working on it for up to two years. And they finally get it done nine days before Trump.

Some people and organizations are panicking, either about his behavior or that net neutrality is out the window or about some boogeyman. That's why this story is relevant, now, because it's an indication that NYT may feel the internet will soon be a much more hostile environment.

</comment></comment><comment><USER42> They were hacked in 1998 by "H4ck1ng F0r G1rl13z", by Adrian Lamo in 2012, by the Syrian Electronic Army in 2013, and claimed Russia attempted to hack them 5 months ago (and in the same breath said they have no evidence of this). Glad their security team is on the ball with this new-fangled encryption thingy.</comment>


'Ghostbusters' Is a Perfect Example of How Internet Movie Ratings Are Broken - <AUTHOR> http://fivethirtyeight.com/features/ghostbusters-is-a-perfect-example-of-how-internet-ratings-are-broken/ <comment><USER2> If you regularly watch movies at all, you are far better off spending a few hours calibrating by reading real reviews of movies you actually saw. You then can find 2-3 reviewers who match your tastes (pick a few cause nobody will match exactly). Then skip the stupid point systems and go straight to, ya know, actually reading reviews.

As Ebert said, if a reviewer did their job, you should be able to tell if you'd like the movie or not, independent of whether or not the _reviewer_ liked it.

<comment><USER3> Have to agree.. this is part of the reason that Netflix's algorithm can do so well... It would be cool if Netflix would expand their star system to movies that aren't on video yet, so that people can star the in the theaters movies.

<comment><USER4> You could try Movielens: [http://movielens.org](http://movielens.org)

</comment></comment></comment><comment><USER5> Granted, a big problem with this approach is that IMDb ratings are skewed (for movies anyways) and follow a strict 4 point scale from 5-8 rating ([http://minimaxir.com/img/movie-revenue-ratings/box-office- ra...](http://minimaxir.com/img/movie-revenue-ratings/box-office- rating-5.png)) so it's hard to gauge the relative impact of the Ratings difference. Also IMDb is prone to brigading, which may indicate that the reviews are not necessarily neutral.

What would be interesting is comparing the differences in ratings between genders of the Rotten Tomatoes critics, although that data is not easy to obtain. (That data is not in the dataset I used for that chart)

</comment><comment><USER6> The portion I found most interesting, and best illustrates their point:

 _" Here are a few stats I collected early Thursday for the new "Ghostbusters" movie: IMDb average user rating: 4.1 out of 10, of 12,921 reviewers IMDb average user rating among men: 3.6 out of 10, of 7,547 reviewers IMDb average user rating among women: 7.7 out of 10, of 1,564 reviewers The movie isn't even out in theaters as I'm writing this, but over 12,000 people have made their judgment. Male reviewers outnumber female reviewers nearly 5 to 1 and rate "Ghostbusters" 4 points lower, on average."_

And from its related article:

 _" "Sex and the City" has seven Emmys and a suite of Golden Globes and Screen Actors Guild awards... Any reasonable person should concede that "Sex and the City" was an above-average television program ... "Sex and the City" has an overall rating of 7.0 ... the average score ... is 7.3. So why did a show roundly considered seminal in the now ubiquitous genre of driven-New York- women-make-a-go-of-it programming score so low? Yeah, it's men. Nearly 60 percent of the people who rated "Sex and the City" ... are women, and looking only at those scores, the show has an 8.1 ... Male users, though, who made up just over 40 percent of "Sex and the City" raters, assigned it, on average, a 5.8 rating."_

We like to think of these aggregated ratings, as some objective measure of crowd-sourced wisdom. But in reality, it's just an aggregation of thousands of people's personal preferences and biases.

If you're someone whose tastes line up with the average critic/online- commenter, the aggregated ratings will sound pretty accurate to you. If you're someone who differs from the average critic/online-commenter, you'll be left wondering why all your favorite shows are rated so poorly.

There's probably a moral in here somewhere regarding top-rated posts/comments on HN.

</comment><comment><USER7> I fail to see why their views are not as valid as anyone's.

<comment><USER8> "Their views", as in the opinions of men who are upset about a female-driven reboot? Most importantly, they haven't seen the movie yet, so any 'review' is completely worthless.

<comment><USER9> The women (or femininsts) are just as guilty for rating the movie without seeing it first: [http://www.imdb.com/title/tt1289401/ratings?ref_=ttcrv_ql_4](http://www.imdb.com/title/tt1289401/ratings?ref_=ttcrv_ql_4) [EDIT] I think I really meant to use this link: [http://www.imdb.com/title/tt1289401/ratings- female](http://www.imdb.com/title/tt1289401/ratings-female)

</comment></comment></comment><comment><USER10> It's really something to watch how absolutely angry men on reddit are about Ghostbusters. It's kind of beyond words for me how incredibly childish and petty it makes them appear, while simultaneously giving fuel to the notion that there is a surge of misogyny in reaction to things labeled as "feminism", as if a female-reboot of Ghostbusters ought to be deemed an act of 'feminism'. Kind of similar to the backlash of outright racism on reddit that happens everytime the nation has to talk about racial issues as the result of yet more violence against or involving minorities.

It's like, maybe if you weren't screeching about and denigrating feminism and anti-racism efforts... people wouldn't perceive you as being anti-woman and anti-minority.

Sorry, probably a bit political, but it's more or less the phenomena that the article is actually tip-toeing around. (And yes, there have been campaigns organized on reddit to astroturf Ghostbuster ratings.)

<comment><USER3> I'm not sure what the opposite of misogyny would be called, I'm not particularly upset about the reboot, or the mostly female cast... I'm a bit upset about the role of Chris Hemsworth in the new movie, which is _very_ different and sexist compared to the role that Annie Potts played. At least that's how it comes across in the previews that I've seen. It's pretty obvious sexism, and the same people who would pan this type of sexism with reversed roles are in favor of it here. It's hypocritical.

Personally, I'll probably see the movie anyway, just find that bit of hypocrisy irritating, especially since it's a pretty obvious skew from the original character with the female role.

<comment><USER10> >It's pretty obvious sexism, and the same people who would pan this type of sexism with reversed roles are in favor of it here. It's hypocritical.

While I understand the criticism that his character's role doesn't map to the original character's role... is it possible that this is an example of what it means to "punch up"? What does it mean that there is so much hand-wringing about Chris's character and yet when a female plays that role in basically every other movie that comes out... much less is vocalized by the folks upset at Ghostbusters?

I dunno, it still seems like a weird thing to spend this much time trying to form a strong opinion on (I say ironically as I keep thinking about it). I wish studios would leave classics alone but that ship has long since sailed. If they had to reboot it, I think the gender reversal is kind of novel.

<comment><USER3> I'm upset at the dramatic change in the role of the character... beyond this, I don't have a problem with guys or women playing a sex-figure in a movie... It happens a lot. My issue mainly comes from the marketing of the movie, and the change in the character for the movie. There are plenty of people that get upset by reboots of a movie in any number of ways.

Likewise, I didn't get upset when they made Starbuck and Boomer women. It wasn't that they changed the gender role, or even elaborated on the nature of a character or role, but that they fundamentally changed that character.</comment></comment></comment></comment>


Ask HN: Postfix sexps? - <AUTHOR>

I'm a beginner, so perhaps my method is an artifact of that; but I tend to write functions inside-out. I start with the simplest case and work my way out. Make sure an item is parsed correctly, then loop it, then call it from something, etc. etc..
My idea is pretty simple; make the language accommodate that.
For ex.: (defun insert5()
  (dotimes 5
    (insert "foo")))
becomes ((("foo" insert)
    5 dotimes)
      () insert5 defun)
Only problem I can think of w/ doing things this way is that finding function declarations could be hard. I really, really think this could work a lot better. Anybody out there done something like this? How did it work? Any big problems with it? If anybody out there's got a PLT scheme or elisp implementation of this could you post a link?
I think we use prefix notation because of English. Japanese is more like this, almost always w/ the verb at the end of the sentence.
I hope to be using autocompletion, or something to parse the source code in the future to avoid having to read the code for functions, so for me (I hope) this shouldn't be an issue.
Joke: here's the FIRST line of NASA's scheme shuttle-control script: ((((((((((((((((((((((((((( <comment><USER2> Let me introduce you to Reverse Polish Lisp: <http://en.wikipedia.org/wiki/RPL_(programming_language)>

Not everything is postfix, but it has some elements of that, to parallel the reverse polish notation.</comment>


Ask HN: How to find co-founders - <AUTHOR> The question is simple. I found a problem I really want to solve, there's a pretty big market for the solution (data collation and storage of automotive test data).
Except I'm purely a software guy, and I'll openly admit I know nothing about developing a business, networking, or money. So I'll likely need a team.
How do you find one? <comment><USER2> There's a mental hack I would use in situations like these. Essentially, stop looking for a "cofounder" and start looking for a "collaborator."

Right now you don't have a business, per se. You have a concept. It's an interesting concept, but it doesn't need a cofounder just yet. Turn the concept into a project. Work on any bits and pieces of the project that you can. Go to meetups, bring your idea to a hackathon, and maybe do a Show HN when you've got something tangible. (Something tangible could even be a really interesting blog post about the topic.) All the while, look for collaborators to help out.

The "collaborator" mindset frees you of the mental bottleneck of having to have a cofounder before making progress. It also allows you to work with, and to vet people instead of having a shotgun wedding to the first would-be cofounder you think you get along with.

PG once wrote that a sign of a good team is one that's worked together and knows each other. You can't push a magic button and add five or six years of shared history to any cofounder you meet. But you _can_ get some work experience with collaborators before cofounding a business with one of them. You're looking for someone you can click with over the next five or more years; it's worth a few extra months of scramble in the beginning to find someone great.

<comment><USER3> I also use the "turn it into a project" mental hack. Use your engineering mentality to "break it down" and do one step at a time.

Don't shirk the "who can I sell it to for how much" question, though. That's the common fear/concern of technical guys.

<comment><USER4> I suspect the majority of people who see their startups as a "business" before they see them as a "project" tend to fail, or at least not be very successful.

</comment></comment></comment><comment><USER5> Short answer: don't.

Long answer: if you feel you can't get started in any meaningful way on your own, hire somebody who can assist you. While truly good people can be hard to find, it will be a thousand times easier to find a competent paid consultant than a competent co-founder. After all, why in the world would somebody experienced who has valuable skills that can be monetized want to start a business with someone he or she doesn't have a long-standing relationship with? The folks who would be interested in this are precisely the folks you want to avoid.

Additional benefits of paying instead of partnering include the ability to retain full control and ownership of your business (if one materializes) as well as the ability to quickly and cleanly terminate the person you retain if he or she is unable to meet your needs.

If the person you retain delivers and there's a great personal fit that would lend itself to an ongoing collaboration, there's nothing stopping you from later negotiating a co-founder relationship.

</comment><comment><USER6> This is like asking how to find a wife. A co-founder should be someone with not only have knowledge in certain domains but someone who have the same passion for your planning startup like you do. Attending to different events could be a good thing but start with the beginning, search your co-founder in your friends. Didn't find anything? Try to meet new people and don't just search them for their " abilities ".

</comment><comment><USER7> I would also suggest not to look for a cofounder, per se. Try to get a working MVP and get some progress yourself. Even if you are a pure software guy, you are easily able to learn the 1x1 of business development as biz dev is nothing more than 0 and 1. :) I mean, the rules are the same for code & business. There are some variables, some loops, some functions, that is it.

I would not specifically search for a cofounder, but search for the right people who can help you to push the product, even without getting 30% of your company. people who like to talk about idea, help you with daily problem startup problems,...

within a very short time, you will learn much about people, how they act and you will soon find one or more people who are really interested in pushing you project forward.

just because i am curious - is the tool planned for the european or us market?

<comment><AUTHOR> Both that standards organization I'm within/from is based in the EU, but is strongly catching on within the US. Several companies have adopted within just a year.

I'm based in the US, but there will be an EU market.

</comment></comment><comment><USER8> Don't underestimate your own abilities to develop a business, network, find & manage money. Conversely, it's easy to overestimate those skills in others.

<comment><USER3> +1 on this, big time.

As a technical guy who became funded & CEO now CTO, getting a business plan both is, and isn't, rocket science.

Ask yourself: what would an investor want to know?

They want to know how expensive to develop, time horizon, risks, possible positive outcomes.

That's all a business plan is. If you haven't answered this for yourself, or it's just a "feeling" not backed up by data, then you don't really know it.

Run this past your friends, people who will give you a straight answer.

The entrepreneurial spirit is taking the bull by the horns and wrestling, not saying "I'm not a business guy." Try it yourself.

If you try it yourself, and "fail", you'll learn the kind of business guy who adds value, then you can look intelligently and correctly.

If you try and succeed, well, there you are.

</comment></comment><comment><USER9> I am a business guy in automotive for the last 25 years.

What is your product? Who is the buyer?

</comment><comment><USER10> So you're software guy and you can build things. You even have an idea of what to build.

The "business/money" part of things is easy. If you get big enough, you can hire an accountant to do most of that for you. The "networking" thing is pretty easy too: you can hire salespeople for that.

What you need is someone who knows this industry from a strategic standpoint: who are your competitors, who are your customers, and how do you sell to them? What do they even want? What value does your product give them over a more generic data warehousing solution?

I can tell you right now that your idea is neither novel nor particularly valuable (if your customers are big multinational companies, it's just a little custom reporting code on top of their enterprise data warehousing platform). Until you turn it into a product that serves some customer's needs, it will remain without value. But what you need is someone who understands the market enough to be able to tell you these things.

I would say your best option would be to find someone in the industry and say "Hey, I have a business idea I'd like to bounce off of you". Don't worry about people stealing your idea -- if it's worth doing, someone has probably already done it. That doesn't mean there's not an opportunity though, and you just need to find someone qualified to judge that.

</comment><comment><USER11> I want to share an experience that I think will provide a different perspective. Might not be true in everybody's case, but just my two cents.

People often claim that having a deep-rooted work history and relation with a person and knowing them well suggests they could be somebody you can work on a startup with. My experience has proven, that this isn't always true. Having somebody you know inside-out work on you with a startup is a good thing, but also make sure that you don't mix your emotions with your work.

Your best-friend or fiancé might make a great co-founder (considering they work in the same space as you), but it always makes it harder to talk business with them. Emotions are always ugliest when they surface in work conditions. Your cofounder is slacking? Just give them a subtle reminder. Oh wait, now you can't because he's also your best friend so he expects you to let this slide.

Bad for business, worse when said business is in its earliest stages.

</comment><comment> dj-wonk I agree with most of the advice here. In addition, I'd suggest finding ways to vet people before you commit to a "full" cofounder role. Some ways that work for me:

      * Write about the topics and projects that you want to work on
      * Connect with people with similar interests
      * Make time to do small trial projects
      * Get outside your comfort zone
      * Focus on building something and/or testing a business hypothesis
      * Structure your collaborations with tangible deliverables

Once you find some starter projects -- assuming that you are starting off without external funding -- I highly suggest using a dynamic equity split based on time and resources contributed.

Give people a nice out (e.g. "thanks for helping test out that idea, sorry it didn't pan out like we hoped") if the project doesn't work well. Think of it like dating.

</comment><comment><USER12> IMHO, the best way to find like minded co-founders is to actively attend meetups, hackathons, conferences and related events. You will be surprised how often you will find passionate people who are very much willing to work and join forces with people like you.

<comment><USER13> We agree that offline methods are very important to the co-founder search too. In addition to an online matching platform at CoFoundersLab.com, CoFoundersLab holds quarterly Matchups events in many cities (via Meetup) to facilitate some of the "in-person dating" for founders: [http://www.cofounderslab.com/entrepreneurs-meetup- networking](http://www.cofounderslab.com/entrepreneurs-meetup-networking)

</comment></comment><comment><USER14> I went through a similar experience recently. My solution:

1) Find a place where startup people hang out (in San Antonio, there's a co- working space designed for this called Geekdom). Startup people are rarely found in big companies.

2) Find ways to get involved in the startup community by volunteering or just helping others. You'll determine very quickly who are the quality people and who you'll like working with.

3) Get an idea and go talk to everyone about it. Ask for their advice and get mentored. Even if it's a bad idea, you'll develop relationships and they'll connect you to other startup people who can help or possibly get involved.

<comment><USER15> I agree, the startup community can be a great place to meet potential partners.

To extend on something you mentioned, I suggest that you look for volunteer opportunities outside the startup community. The startup community is great, but volunteering with different organizations exposes you to people with diverse backgrounds and different skill sets. Volunteering is great for building a network of people with skills that compliment yours; it allows you to develop genuine relationships with likeminded individuals.

</comment></comment><comment><USER16> Sad to say, but I'll probably go alone when I try to create another business. The first time I tried to start with best friends, they jumped off after a couple months and I hated them for it.

<comment><USER17> Sir, Why did you do that. I am sorry to hear that. As other's have said, finding a co-founder is like finding a wife, you just don't assume your best friend will be a good life partner. and you can ruin your friendship this way.

<comment><USER16> Its been a few years, but I probably believed that we could trust each other and that was pretty important.

</comment></comment></comment><comment><USER18> Good question, has anyone tried Cofounderslab.com or similar services ?

<comment><USER19> CoFoundersLab had been working on solving the problem of cofounder matchmaking for about four years now. It's a big problem: research suggests that of all startups that fail, about 33% fail primarily due to cofounder related issues!

In this quest, they have brought onboard various experts such as former executives from Match.com, and leading researchers for the Kauffman Foundation. Furthermore, CoFoundersLab has acquired several companies over the years enhancing its IP portfolio, and execution capability.

Through CoFoundersLab, members can search a self-selected pool of cofounder candidates, while getting a much better sense for wether the cofounder candidates posses complementary skills, and have compatible personalities, goals, and values!

There is no "silver bullet" solution, but CoFoundersLab.com is an out of this world better approach to embarking on the journey of cofounder search!

Disclosure: I am the CEO at Onevest and we just announced a merger with CoFoundersLab.

<comment><USER20> Hey, no offense but this comment reads like a press release. It's possibly to share your message/perspective in a forum without using terms like "enhanced its IP portfolio."

<comment><USER21> Get over it, it was fine. I love when people start by saying "no offense" for now on just say "offense".

Disclosure: No interest in either of companies or own any stock. Disclosures like this are for jackasses like the comment above by morgante.

</comment></comment></comment></comment><comment><USER21> In a perfect world yea it would be great to find someone from working on projects or school or years and years of knowing someone. I am in the same position as you, I am more of a designer/business guy. I don't have years to wait around and hope someone pops up. I am not sure what will happen in the future, but I know this it comes down to luck and no one way, I don't care what YC says, yes in a perfect world they maybe right, but I live it now and so do you.

</comment><comment><USER22> I would go to car lots and talk to as many salesmen as you can. You might find someone who's interested and they would have industry experience. Set a goal of 100 car lots and hit the pavement. When you're done you might not have a partner but you'll have a lot of data.

Then, choose another venue, lather, rinse, repeat. You just need to dedicate yourself to solving this priblem. Good luck.

</comment><comment><USER23> I agree with most of the comments here, but wanted to add that when you are ready, if you are in the US, most business schools have an 'entrepreneurship club' or something similar, which mostly have a group of business-savvy people desperately looking for technical co-founders. The students running these clubs will be very receptive to an email from someone like you.

</comment><comment><USER24> Finance / biz development guy here. It's real hard talking long term monetization strategy with some developers. I've tried cofounders meetings but been unable to find a The right type of hungry. I think it may be the fact that i live in Thailand. A country rich in programming drifters.

<comment><AUTHOR> Most programmers (in the USA, let alone developing country I assume) are heavily philosophically influenced by the free software movement.

The idea of selling a lot of software for money is kinda foreign to developers who learned their trained purely from the internet. Even me I'd rather make an open source project and sell support rather then just sell black box software.

<comment><USER24> I hear what your saying but I just don't get it. It's all how we view things I guess. From my perspective Making money while solving problems is good thing. No reason to be shy about it.

<comment><AUTHOR> The goal is to innovate, never hurt innovation, let people innovate, fix, hack, break, etc so better things get made. The open source movement is a humanistic movement, that people deserve better and will naturally make better things if we allow them too.

The goal of open source isn't to stop making money. The GPL specifically encourages companies to exist to support and make money off of software. The problem is from a business standpoint its very profitable to make somebody _dependent_ on your product.

This is where we meet the breaking point. Their goals are different, a business wants to exploit while open source wants to grow.

How do we fix this? Adoption. When you try to sell a service to a company, namely a technology company being open source is a positive for one simple reason.

>If you fail they won't lose the service.

Its the ultimate insurance. They don't have to _bet the farm_ on your company. It makes it easier to bid and grow on software as your failure isn't tied to your plateform's failure. Which is often the largest issue with new technology companies.

Nobody would buy an IBM mainframe if IBM started last year. Nobody would have faith, or believe. You can't do the same stunts as companies that are decades old who built the industry as a new kid on the block.

</comment></comment></comment></comment><comment><USER25> This is unbelievable. I was just now writing another related post over here regarding my startup to solve this problem: [https://news.ycombinator.com/item?id=8097145](https://news.ycombinator.com/item?id=8097145)

I will follow up here also. Thank you for the question!

</comment><comment><USER26> Hey, I just created a Facebook group for entrepreneurs to collaborate, feel free to check it out: [https://www.facebook.com/groups/318404371669625/](https://www.facebook.com/groups/318404371669625/)

</comment><comment><USER27> I met a business guy at a meetup in Boston last week who was doing something in exactly this space and looking to build an engineering team. But it looks like I threw his card out. Shit, sorry.

</comment><comment><USER28> Being the software guy gives you a lot of leverage in the situation, especially if you have a lucrative market lined up.

</comment><comment><USER29> A good way to increase your chances of finding one is to do a lot of small projects with different people who complement your skills. You have to work with someone first to know if you are a good fit for something bigger (think of it as dating before marriage). This is easier when you are on a campus environment (which is why facebook and google started on campuses), and harder once you're out of school.

We created [http://www.doerhub.com](http://www.doerhub.com) as a free tool to fix that. People from different disciplines (from surgery, to hacking, AI, business, law, 3d printing and human rights ) post what they are working on/passionate about and anyone who likes their project can contribute by joining, advising, becoming a beta user, doing a task etc. They collaborate right on the site or outside of it. You can share areas you are advanced in and learning in so you can discover complementary people easily [http://peoplesearch-doerhub.herokuapp.com/viz/](http://peoplesearch- doerhub.herokuapp.com/viz/) and do private or public projects.

Other than individual SV doers, UChicago was first full organization in our beta [http://www.doerhub.com/at/uchicago](http://www.doerhub.com/at/uchicago) (1/3rd of the finalists and both winners of their New Venture Challenge and Social New Venture Challenge were using the site). And now we are opening it for free to other universities, hackathons, hack clubs and organizations who want people to get stuff done with others, instead of just talking about it.

When I (a hacker) posted this drone project [http://www.doerhub.com/for/personaldrone](http://www.doerhub.com/for/personaldrone) a pilot with military experience and a VC I didn't know ended up joining me. Here are some other doerhub-powered teams:

[http://www.doerhub.com/for/kikisauceco](http://www.doerhub.com/for/kikisauceco)

[http://www.doerhub.com/for/whichvc](http://www.doerhub.com/for/whichvc)

[http://www.doerhub.com/for/bluetooth- sensor](http://www.doerhub.com/for/bluetooth-sensor)

[http://www.doerhub.com/for/robopaint](http://www.doerhub.com/for/robopaint)

[http://www.doerhub.com/for/qcare](http://www.doerhub.com/for/qcare)

[http://www.doerhub.com/for/surgery-boards- app](http://www.doerhub.com/for/surgery-boards-app)

<comment><USER30> How does it work? Is it legally binding? How do teams work/organize themselves?

I see very few projects fill any information or what/who they need.

</comment></comment><comment><USER31> First, your search is different from what it would be in the corporate theater. In the corporate world, you're either looking for mentors who are 5+ years ahead of you (i.e. better than you at what you want to do) or subordinates to offload grunt work (sorry, I mean "delegate") to. With co- founders, you're looking for complements, not people on the same track. It might be hard to swallow your ego and look for someone with a radically different skill set, especially given the non-meritocracy of business co- founder value (which is 90% connections, 10% innate ability). But it's what you need to do.

Rule 1: Code or Contacts. Hire (at the early stage) only if the person brings something in either department that no one else can do. Most "business co- founders" can't bring funding on an idea. You don't need them, if they can't. Business co-founders are naturally going to end up with a lot of power and you can't afford the slot for a guy who can't make it rain with minimal initial effort (save your effort for building) on your part. You need a guy with the contacts to solve the funding problem, so you can focus on building the product.

Your _third_ co-founder ("the dragon has three heads") should be a crack technologist. Someone even better than you, if you can find him, and not a friend of the business co-founder. If you have _two_ business guys and one technologist, you're not going to have a tech company and they (along with investors) will be calling the shots. In general, you want someone who will push back on technical matters where getting it right is more important than personally winning but _always_ take your side on the political stuff, where the reverse is true.

Once you've established this "initial three" (or 4, if the technical problem merits it) you can hire more business people, but only for defined roles (accounting, business development) and anyone who tries to turn one of your initial team against the rest is fired immediately.

Don't hire a PM until you're at 30 people. "Product" people become necessary when you're hiring second-string engineers. First-stringers PM their own work.</comment>


Is it just me, or are others finding HN has problems? - <AUTHOR>

Recently I've been getting this message:

    We're having some trouble serving your request. If
    we're down, @HNStatus might have more information:

    ...
 It's sporadic, but it feels like it's getting more common.  Is anyone else having this problem? <comment><USER2> The only problem I have are expired links. Page through the "new" section, someone comes and talks to me, continue paging and pagination breaks and I have to start over. Follow a link off to a longer story, come back and continue paging and pagination breaks and I have to start over.

Really annoying.

</comment><comment><USER3> If you see this can you grab the "Ray ID" (long hex string on the page) and send it to me. I can look in the CloudFlare logging stuff to see where the problem occurred.

<comment><AUTHOR> And again:

        Ray ID: 103ebd0cdc7c089f

<comment><USER3> I'll bring this thread to people's attention.

</comment></comment></comment><comment><USER4> I'm having the same problem. Will post next time it hits.</comment>


WhatsApp doesn't understand the web - <AUTHOR> http://andregarzia.com/posts/en/whatsappdoesntunderstandtheweb

<comment><USER4> Previous discussion: [https://news.ycombinator.com/item?id=8926644](https://news.ycombinator.com/item?id=8926644)

<comment><USER5> And it's not considered a duplicate submission because one has a trailing slash and the other doesn't.

<comment><USER6> Of course it is a duplicate. The software doesn't catch all of those; that's on purpose, to allow good stories multiple cracks at the bat (edit: i.e. multiple chances to get attention). We rely on users to search before posting and on moderators to bury the dupes that sneak through. User comments pointing out the duplication are helpful.

This isn't a perfect system but it's much better than being too strict about reposts. We're going to work on a more effective dupe detection system as soon as we can get to it.

</comment></comment></comment><comment><USER7> WhatsApp went from being a poster child to an ugly donkey in my country (Uzbekistan & other countries in Central Asia). Just two years ago everyone I knew was using WhatsApp, and what happened now? Most people use either Viber or Telegram, because uploading/downloading pics on WhatsApp takes forever.

WhatsApp had a POTENTIALLY massive commercial use here and they blew it with paid subscriptions (which people in my country can't pay through Apple/Google stores). So people started switching their mobile numbers to get back into WhatsApp, which actually was really bad for WhatsApp but they blindly saw that as success. Their growth team probably said: "We are killing it because more and more people are signing up!" Yeah, but what's the churn rate? It's probably huge as well. These unique mobile users that they counted were actually the same people who couldn't find a way to pay.

Ok, so if anyone from Whatsapp happened to read my post, here is how you can make (or could have made) money: \- Charge businesses to communicate with their clients through WhatsApp. This is very straightforward -- businesses need A MAC/PC CLIENT for their team to talk to customers. I know our tech company wanted it, but you wouldn't let third party clients exist. So we sticked with Viber and Telegram. Luckily regular users also ditched WhatsApp.

And look, we were not the only ones who needed it. The guy selling shoes/clothes would show products through WhatsApp. The local florist would show what he had available on particular day through pics on WhatsApp. Then he got tired of sending these pics to everyone, so he wanted to have these pics in his profile page. So who offered multiple pics in the profile? Telegram did. As much as I hated their deceptive claim about "being the most secure app", they actually managed to listen to users.

<comment><USER8> It's awesome to read about use cases in countries I know little about. Viber, Telegram for direct marketing? Wow. How do people decide to join? How do you do ad's?

Just like in Argentina in '11 I was amazed that all SME had Facebooks, and were just skipping the website-part I was used to.

Funny how local circumstances (might your Whatsapp problem just be an upload- to-US problem?) create different business environments. It reminds me that country-specific network and adoption effect exist and matter.

<comment><USER7> Doing business in countries like Uzbekistan is tough because of inability to get payments. But there is a solution to that and it's called MIDDLE MAN.

For example, Facebook ads are really picking up here. Of course, most small businesses cannot pay to Facebook directly due to tight payment regulations. So what happens? A middle man comes in. He signs up as a Facebook partner (or regular user), finds small local businesses that pay him extra and then he pays Facebook through his internationally accepted cards to show ads belonging to others.

I have no doubt that if American companies came here and tried a little, they would quickly realize that Uzbeks are entrepreneurs, who can be good partners and can make lots of money.

Even the ideas that I see pop up in the United States have been implemented here long time ago. For instance, we had car-sharing service in Uzbekistan since I was a child -- we just didn't have GPS and mobile phones to make an Uber, so we had middle men finding riders and putting them into one car. Then the driver would pay a fee for that.

Same thing with delivery -- we had delivery services, which you could call, so they could find the closest person to you (or the store/pharmacy) and deliver the items quickly. You would just pay cash to the driver (which of course had to be trustworthy-- otherwise delivery service wouldn't work with them)

<comment><USER9> What you call a "Middle Man" is also known as a "Market Maker" or a "Liquidity Provider". He takes on the risk of connecting supply and demand in order to profit from the bid/ask spread.

The "Middle Man" has been replaced with technology because it's more efficient and enables more liquidity than an actual man or a network of men could.

If you see solutions popping up in Uzbekistan for basic logistical problems such as transportation and delivery, perhaps you should try to implement them elsewhere? I would be interested to hear more examples that could be implemented elsewhere in the world.

</comment></comment></comment></comment><comment><USER10> This one is missing on the list:

[https://www.ssllabs.com/ssltest/analyze.html?d=web.whatsapp....](https://www.ssllabs.com/ssltest/analyze.html?d=web.whatsapp.com&s=22.214.171.124)

Are they serious???

      - Vulnerable to POODLE
      - too short HSTS value
      - <USER2>
      - <USER3>

"maybe they need to support ancient broken browsers"

EDIT: As only Chrome is supported, RC4 & SSL3 are moot.

</comment><comment><USER11> While i agree whatsapp web should work in every browser the auther is forgetting one IMPORTANT gotcha:

Whatsapp, is a messaging-routing platform. It doesnt store any messages. Thats what makes whatsapp strong. Its a feature. Thats why you need your phone. Its like SMS. They are not storing all your sensitive message.

If you dont care about storing sensitive messages on servers. Use Telegram/Facebook Messaging, etc...

I think its really a feature, that its not storing your messages.

<comment><USER12> Perhaps someone can answer this for me. I've seen several comments here saying WhatsApp doesn't store conversations. The other day someone sent me a picture on WhatsApp. Before looking at the message I was going through my photo gallery and noticed a random picture I didn't take so I deleted it. When I went to look at the message it was just a blurred out photo of the picture I had deleted and when I clicked it it said the media didn't exist on my SD card. Now, if I log into the web version that picture is fully visible. This suggests to me that they keep at least the pictures on their server. So is it only the text portion they don't keep?

<comment><USER13> Adding my own anecdotal experience here.

Recently my Z10 got bricked. The only backup available was from April 2014. I bought a new Z10 and restored the backup on that phone. I was expecting that all WhatsApp messages and pictures received between April 2014 and the restoration date would not be available. But, WhatsApp did somehow pull the messages and pictures from recent months. So, where did it restore the messages/pictures from? From other contacts' phones?

<comment><USER14> WhatsApp definitely stores your messages on their server. They have to. If you send a WhatsApp message to someone and their phone is off, does it bounce? If not, they are storing your messages at some point.

Just because they say they don't store them forever really doesn't mean much, and I am pretty surprised by how many people on HN keep repeating it.

</comment></comment></comment></comment><comment><USER15> Don't you get it? It's a mobile app, which performs really well(hence no cloud storage I guess) and is associated with your phone, your phone is and will be the most important thing for whatsapp, the web thing is just a convenience for while you're at your laptop or desktop, like working and stuff, I find it awesome, it's a lot more productive then picking up the phone. I don't mind it requires having my phone connected to the web, it is all times, that's the point o whatsapp.

<comment><USER16> It's the one missing feature of WhatsApp that I personally have been wanting for a very long time so they have at least one happy customer with this... or they would if they'd hurry up and update the iOS client to to work with this. :)

</comment></comment><comment><USER17> I just don't get it. What is so difficult about providing a one-time authentication through the user's phone? Just open Whatsapp on the smartphone, get a token, put your phone number and token and voilà!

I mean, there have been web chats for decades now, so I don't understand why they invented such a messed up set of constraints.

Besides, am I the only one who suspects that Whatsapp is boycotting Apple? They needed almost 2 months to get an iOS 8 update out, now they are limiting the "web" application to non-Apple users...

<comment><USER18> I believe the issue is that unlike web chats and apps like Telegram, Whatsapp doesn't store conversations on their servers beyond what is required to deliver messages to the required destination device(s).

This presents obvious problems with having not just a web client, but any client other than the main device, since the main device is the only store of the existing conversations. New messages sent also need to be synchronized across devices, which I presume is why it's required to keep your phone connected to the Internet. Otherwise Whatsapp would need keep conversations on their servers until they could be synced, which is very much not their model.

Details on their architecture:

[https://www.youtube.com/watch?v=c12cYAUTXXs](https://www.youtube.com/watch?v=c12cYAUTXXs)

[http://highscalability.com/blog/2014/2/26/the-whatsapp- archi...](http://highscalability.com/blog/2014/2/26/the-whatsapp-architecture- facebook-bought-for-19-billion.html)

<comment><USER19> Doesn't that sound like a poor architecture then?

If the system is reliant on the main device, what happens if that gets run over or destroyed? WhatsApp have no control over the fate of the device. Why wouldn't they store the messages on the server and sync from that? WhatsApp have control of the fate of their own servers, which is far more reliable, SURELY.

If I send a new message from a device, either the other devices can poll periodically for messages that I have sent, or they can use WebSockets and be notified when a new message is sent, or when the app opens it can fetch all the recent messages that I have sent from other devices. It isn't difficult with a fine grained timestamp, surely? That's what Google Talk does.

You'd only need to order my messages by timestamp to get all messages that I had sent.

It's a bit of a daft architecture if it is incapable of this basic mechanism, isn't it?

<comment><USER20> It's actually a feature, not poor architecture. They're putting security and privacy above UX. This is especially important in this day and age with all of the NSA and related revelations.

If you want a better UX there are hundreds of other options available.

</comment></comment></comment></comment><comment><USER21> Their site seems to be down, here's a Google cache link: [http://webcache.googleusercontent.com/search?q=cache:2VSoNL8...](http://webcache.googleusercontent.com/search?q=cache:2VSoNL8SUcEJ:andregarzia.com/posts/en/whatsappdoesntunderstandtheweb/+&cd=1&hl=nl&ct=clnk&gl=nl)

</comment><comment><USER22> The web client requires my phone to be online and doesn't support offline notifications so that it has to be open all the time. I guess it's very much like Pushbullet for WhatsApp, not a desktop app for WhatsApp.

</comment><comment><USER23> Is there a good reason to not switch to Telegram (or another alternative), which has a web client _and_ native desktop clients? Especially on mobile it's almost no trouble to use two chat apps side by side, as most of the interaction happens through notifications (which send you straight to relevant app).

I switched initially because I was a bit uncomfortable with having long, personal conversations on a Facebook-owned property with no export capabilities, but I've been getting more and more of my friends to switch simply because of the very solid web and desktop apps. And even though they complain initially about installing 'yet another app', in practice it's no trouble (since they only have to use the two apps on mobile, where using both is not really an issue).

The main thing I'm wondering, I guess, is: is it mostly _perception_ that keeps people within one mobile chat ecosystem, or am I underestimating how difficult it is for the average user to use more than one app, and/or slowly move to another app?

</comment><comment><USER24> I'd love a technical explanation of how this works.

Are all the messages kept on the phone?

How does it relate to the Whisper Systems end to end encryption on the Android to Android version of WhatsApp?

Is there some relationship between the two - is this very bizarre web interface there because of constraints relating to privacy and encryption?

i.e. WhatsApp don't have your messages.

[Edit] Is it peer to peer in some fancy way - is it only for Chrome because it uses WebRTC or something?

<comment><USER25> What i remember from the Erlang discussions around Whatsapp, they dont keep the messages on the server, only temporary until it has been delivered. So Im guessing that is the reason why they need your phone to be connected.

Might have been in this video [1]... Not sure at the moment (will check later when im out of the office).

[1] [http://vimeo.com/44312354](http://vimeo.com/44312354)

<comment><USER25> OK found an explanation here: [1]

"What protocol is used in Whatsapp app? SSL socket to the WhatsApp server pools. All messages are queued on the server until the client reconnects to retrieve the messages. The successful retrieval of a message is sent back to the whatsapp server which forwards this status back to the original sender (which will see that as a "checkmark" icon next to the message). Messages are wiped from the server memory as soon as the client has accepted the message"

[1] [http://www.quora.com/What-is-WhatsApps-server- architecture](http://www.quora.com/What-is-WhatsApps-server-architecture)

</comment></comment></comment><comment><USER26> ...and it seems you can't use this feature with an iPhone (yet?).

From their "web client": Android, BlackBerry, Windows Phone, BlackBerry 10, and Nokia S60.

(In all fairness, my guess is it's pending acceptance of a newer version by the iOS/iTunes review team, but I really hope that's the case.)

EDIT: Scratch that. They're not providing it on iOS because of how convoluted their approach to a web client is. What they have to say: "Unfortunately for now, we will not be able to provide web client to our iOS users due to Apple platform limitations."

[http://blog.whatsapp.com/614/WhatsApp- Web](http://blog.whatsapp.com/614/WhatsApp-Web)

Yeah, right.

</comment><comment><USER27> This reminds me of how weChat/weixing implements their web client, minus the ridiculousness of chrome only `requestFileSystem()`.

Scan a QR code from the client on your phone, and re-authentiate every time the connection is interrupted.

If you don't use a supported platform, like a Blackberry, you pretty much have no way of communicating with anyone in China, since you can't login to the web client.

</comment><comment><USER28> I'd love to say this will make me drop whatsapp. But their lack of a web client didn't, neither did the terrible search or the invasion of privacy (not letting me turn off the blue double check mark). Sadly, whatsapp can do whatever they want and I'm stuck with it.

No whatsapp, no women. I really like women.

</comment><comment> vertex-four Umm. Obviously the web client is supposed to be used on the desktop, not on a phone. They have apps for phones.

Doesn't excuse the Chrome-only-ness, though.

<comment><USER29> I have a Jolla (Sailfish) phone. I can not use the web client, because I need an Android, Windows or Blackberry phone. WhatsApp does however work fine on my phone (via Alien Dalvik).

This "web client" is not actually a web client - it's just an app for your phone that you can display on your computer monitor.

<comment><USER30> A bit of an off-topic question - how would you rate Sailfish and it's interop with Android stuff?

<comment><USER29> Sailfish itself is much better than anything I have ever used - it's clearly designed for touchscreens. For hackers it's awesome because it's actually a Linux, and you can access shell (as a root, too).

Android support is a bit buggy though - for example Skype sometimes breaks (can not send messages), but Spotify and WhatsApp have worked perfectly fine.

If you are interested in it, they dropped the price a while back (down to 250eur).

</comment></comment></comment></comment><comment><USER31> I don't get all the complaints. We are already talking about a modified version of XMPP that only works within their network. We should not complain about the crappyness of their web-client, but rather on the fact that they are not using an open-protocol like XMPP for which the plenty of clients, that suit everyone needs, already exist!

</comment><comment><USER32> Whilst the developer in me appreciates the sentiments expressed in the article I have to point out that to build and app that is used by over 700 millions users you have to be focussed on a fairly narrow set of features. You need to execute those features very well and WhatsApp delivers.

<comment><USER33> Their original client works very well and was certainly the best im client at the time.

Now all that's keeping people there is network effect. Telegram is just better at this point, and it works on almost every platform with no weird restrictions

<comment><USER34> Does Telegram have an app for J2ME?

<comment><USER35> No it doesn't but it does have a public API, libraries and is friendly to third-party developers so nothing is stopping someone from creating a J2ME based client.

You can fetch source code from [https://telegram.org/apps](https://telegram.org/apps)

</comment></comment></comment></comment><comment><USER36> This is basically a Continuity feature that is PR-ed as Client.

</comment><comment><USER37> To be fair, the WeChat desktop client also requires that you scan a QR code from your smartphone to log in. I'm not defending WeChat, but it doesn't seem like the author knows WhatsApp is not alone there.

<comment><USER35> author here. I didn't knew about WeChat since it is not popular here in Brazil.

Using a QR to facilitate login is not a bad decision. Having this as the only method to authenticate makes it a bad client because it can't work as a standalone offering.

I don't like when "web clients" are not full featured in the sense of allowing registration and login. Look at Evernotes, you can register and use thru the web client interface, there is no need for the app if you're on a platform that is not supported.

<comment><USER38> Hi, author, I like your article but those animated GIFs are driving me nuts. Please don't make readers also watch a movie at the same time. Thanks.

<comment><USER39> Seconded. Please stop writing articles that look like they're aimed at 14 year olds.

EDIT: If you feel the need to use cutesy graphics to get your point across, at least make them static. Animated gifs are incredibly distracting when trying to read anything more involved than a tweet, or a silly meme macro.

</comment></comment></comment></comment><comment><USER40> I don't really see what purpose a WhatsApp web client serves to be honest. I was under the impression WhatsApp replaces SMS. It's linked to a phone number, so linked to a phone.

</comment><comment><USER41> Heck, let's just go back to Skype! :)

<comment><USER42> Skype has some security issues that have yet to be resolved and knowing Microsoft's history with MSN Messenger, issues that will likely never be resolved. Also it is plenty unstable under Linux, sadly. I've found Viber to be easiest, only gotcha is you need it on your phone first before you use it elsewhere. Otherwise it's pretty spot on. It also looks and feels the same across platforms.

<comment><USER41> I'm a Viber user but I still prefer Skype, it's the easiest platform to talk to people besides Whatsapp, and I think it's the best mobile video platform there's here today is Skype at least on Windows and iOS.

</comment></comment></comment><comment><USER43> Does it matter? They are sold now, so anything regarding them is yesterday news.

</comment><comment><USER44> I love the web client. Works great for me!

</comment><comment><USER45> o

</comment><comment><USER46> The web app gets approval from Snowden ([http://www.bestvpnservice.com/blog/why-you-should-use- whatsa...](http://www.bestvpnservice.com/blog/why-you-should-use-whatsapp-for- web/))

Great marketing!

<comment><USER47> It's proprietary and owned by Facebook. If that doesn't scare you away, nothing will.

</comment></comment><comment><USER48> I disagree with most of the things in this blog post. The web UI works and quite well that too. Whatsapp has been known to build things that work and that too fast.

I don't care if it works only on chrome and doesn't work on the iPhone. They'll most probably fix it soon.

I can think of one good reason why not having official APIs has been in whatsapp's favour. Almost no spam.

</comment><comment><USER49> Sorry but after reading your post and your bio, I got a few points.

1st your career is too short to fully understand the web and be able to judge a company like facebook.

2nd you haven't realized that whatsapp might be its own company but its owned by facebook, and after the buyout facebook did a clear up on devs and hired / assigned their own devs to that.

3rd you haven't realized that the power of the web is fading over the power of mobile web!

I understand that that's a blog and you are free to express your thoughts, but I am really repulsed by the fact that this post has so many upvotes. It makes me think that people reading and upvoting on this site have no idea of technology.</comment>


On Starting a Software Business - <AUTHOR> http://stephaniehurlburt.com/blog/2017/6/24/on-starting-a-software-business <comment><USER2> Consulting doesn't scale, software does.

One pragmatic strategy to find product/customers:

        1) Pick an industry
        2) Ask someone in that industry what they use spreadsheets for
        3) Build something better

There is a lot of 'cybernetic' processes that are a mix of humans with domain knowledge and machines with spreadsheets for schemaless storage and querying. Generally the move is to encode the domain knowledge into code and standardize the storage (i.e excel -> RDMS) to make it more useful.

<comment><USER3> Accenture revenue in 2016, $32.9 billion. Consulting definitely scales.

<comment><USER4> The point is scaling without increasing linearly the number of employees. Accenture has approx. 400K employees

<comment><USER5> A succinct way of putting it is there is a finite profit margin on consulting.

<comment><USER6> Agreeing: [https://priceonomics.com/which-companies-have-the-highest- re...](https://priceonomics.com/which-companies-have-the-highest-revenue-per/)

Accenture is #493 of the S&P500, at $101k of revenue per employee. (!) They're doing a bit better than McDonalds (#497). The scalability argument holds -- compare to Netflix, which scales quite well (#23, $1.9M/employee).

</comment></comment></comment></comment></comment><comment><USER7> \- "We can make a decent salary out of this" \- 36 months - 48 months

I started and 10 years later made a successfully exit from my company, we never raised any money, the above figure is what it took us to go from financing our development our self (by having two jobs), to having enough customers to break even.

I think everyone should, bootstrap one company to get a feel for how it is, will make you a better entrepreneur.

<comment><USER8> Exactly the same setup as you, although I've not sold my company as I'm a happy owner ([https://www.atlascode.com](https://www.atlascode.com)).

I launched Atlas in 2007, just one year prior to the economic crisis that followed. Nothing ensures that you keep an eye on every bill that is paid and focus ruthlessly on efficiency gains more than a global financial catastrophe. Getting through that taught me I was capable of running an already tough business under pretty much any circumstances, and gave me an incredible confidence boost.

Not that I'd recommend it, definitely some of the toughest years of my working career.

<comment><USER9> Does the website help with getting new clients? I mean completely foreign clientele, outside your reference circle.

</comment></comment></comment><comment><USER10> There is a bit of detail missing that I would like to understand. How to just 'talk' and give help? Do you approach people/businesses and ask if they are having any problems? Or, your aim is to just get the conversation ball rolling, hoping that it leads to the problem part without deliberation?

<comment><USER11> i have a friend who is a construction contractor, and one of the tasks they needed to do is inspection of a property, and take pictures of problematic areas with notes.

Currently, this is a manual process, paper driven with digital photos, and after wards, somebody back in the office would transcribe the hand written notes into an excel spreadsheet along with pics.

This process could be made easier with an automated app on the phone. I had thought about making such an app, but haven't yet.

I guess when you talk to someone, you naturally gravitate towards issues they have.

<comment><USER12> you might like [https://www.planradar.com/](https://www.planradar.com/)

disclaimer: I met the founder once at a party.

<comment><USER13> You shouldn't let the existence of a competitor stop you. The business model of Lyft/Gett/Juno is basically to carbon copy Uber and get piece of their pie. Just being a deliberate copycat isn't a terrible strategy. Trying to one-up something that already exists is also plausible, if not easier because their is already a trailblazer that has made the market and you can just piggyback. Facebook succeeded because of MySpace, not in spite of it.

<comment><USER14> You could argue Uber copied Lyft (although it might be more convergence than anything), which I suppose just highlights your point even further.

</comment></comment></comment></comment></comment><comment><USER15> I'm wondering about how they draw the line between "give first, take later" and "don't do work unless you're getting paid for it."

<comment><USER16> I'd like to hear more specific experiences on switching from working for free to $CONSULTING_RATE for the same client

I helped a local business group with their website, their previous host shut down and all they had was an archive on CD, they had some quotes for 10-20 hours to get it back up and running (and then everyone wanted to charge them hosting/domain registration).

I did the work for free. A couple hours importing databases and site files, configuring WP/Joomla (I forgot which), some testing... My hope was that I'd get a few leads from the 50-60 companies in the business group.

I was contacted by a few but once they found out I wouldn't do the work for free...

<comment><USER17> This is an example of a more general problem with undercharging (or doing spec work) in any creative industry. If you don't charge what you're worth, perhaps because you're trying to be helpful or offering "mate's rates", then you may get one happy client but you'll also get underpaid. Then that client will happily recommend your (excellent value!) services to their friends and colleagues who are also looking for (excellent value!) services and will be happy to similarly underpay you. And so it goes on.

In my experience, there are really only two levels of pricing that work. You _can_ work literally for free, or for some token payment so someone is an official client of your business. This is sometimes helpful very early in a business to start some sort of portfolio and establish a bit of credibility, but otherwise I think it should be reserved for genuine charity work where it's clear that it's a gift and not your normal working practice. Everything else should be charged at decent professional rates immediately, both so you don't undersell yourself and to dissuade potential clients who can't or won't pay decent professional rates and all the other similar potential clients in their network.

<comment><USER18> I phrase it as "Standing problems I solve for free, sitting problems are my usual hourly rate."

Which is to say, if I can solve your problem for you before I get tired of standing up, I'm not going to bother to charge you. In my case that's usually a half hour or so.

People seem to respond well to that, in general. I think it's in line with how most people view the value of their own time.

It's also a one off, as well. Just because it only takes me 15 minutes a week doesn't mean it's free.

</comment></comment></comment></comment><comment><USER19> This is a person who obviously has a lot of talent and a lot of specialised knowledge. I doubt most people can get properly paid consulting work or get to product stage as fast as she clearly could.

<comment><USER20> I'd like to see some responses to this from some gurus. I have the same problem. I have a bunch of generalized skill but I feel not enough to make large $ with consulting.

I don't attribute this to impostor syndrome.

<comment><USER21> Specialize. It doesn't have to be an esoteric domain. Something like Go server apps or Docker is enough.

<comment><USER22> With an industry that moves so ridiculously fast, how do you know what'll be in use in the few years it'll take to become good at something?

I feel like if I'd learned web development five years ago I wouldn't know anything about it today.

<comment><USER23> > I feel like if I'd learned web development five years ago I wouldn't know > anything about it today.

This is a wrong assumption. Web development just gives the feeling of moving fast, it's not really the case. The foundation of web development is roughly the same as 5y ago. Most things from the http protocol, web servers, data storage, authentication, websockets etc. still works the same. Give or take a few UX and state-management tools and we're not that far into the future.

Also due to the huge investments in the web during the past decade(s) things should get slower because of legacy issues. Think fe. how long it's taking browser vendors to dump Flash or to adopt WebRTC.

</comment></comment></comment></comment></comment><comment><USER24> Related piece: Starting a Business as a Developer in 2017 [https://journal.standardnotes.org/starting-a-business-as- a-d...](https://journal.standardnotes.org/starting-a-business-as-a-developer- in-2017-4f4a2a0b1922)

</comment><comment><USER25> OT, but referring to the article: why are so many websites allergic to serving basic HTML these days? You get a lovely white page with a Javascript blocker if you try to open this article. What's particularly offensive about this one is that all the raw data is loaded in correctly anyways - the JS appears to just fiddle with making it look right, and there's no default style for if that doesn't happen.

<comment><USER26> I feel like this comment is the equivalent of posting a meme on Reddit.

</comment></comment><comment><USER27> Observe what people are doing inefficiently that you can fix.

Test whether they'd buy it with google adwords or facebook ads and conversion rate to filling out the form and putting in credit card. Refund everyone.

Imagine how it would be viral and test your hypothesis as well. So your customer acquisitin cost goes down exponentially!

<comment><USER28> Do you mean before building the actual product?

<comment><USER27> Yes

</comment></comment></comment><comment><USER29> So basically she got much skills and happened to meet someone who was a well known player in the game industry.

Most people have neither or just the first one.

<comment><USER30> So basically she worked hard on her skills and invested a lot of time and effort to talk to a lot of people to meet the persons that allowed her to grow her business. Most people don't do that and complain. ;-)

<comment><USER29> For me the point here was, that the meeting of that person the most crucial step and also pure luck.

Writing about "Starting a Software Business" which boils down to "just know the right people" is a bit demotivating :\

<comment><USER31> Did you miss the part where they intentionally spoke to lots and lots of people?

<comment><USER29> I read it that the "talk to lots of people" part was independent of her knowing Rich in the first place.

</comment></comment></comment></comment></comment><comment><USER32> Interesting about the 50-50 split. If you talk to most people in the valley, they would probably tell you this is the worst thing you can do. That is, if you're looking from the perspective of a VC.

<comment><USER33> YCombinator advises equal splits. [https://blog.ycombinator.com/splitting- equity-among-founders...](https://blog.ycombinator.com/splitting-equity-among- founders/)

I've also read a bunch of articles that suggest unequal splits, and the reasons they cite seem to boil down to the idea that the split should reflect the proportional risk taken, and not much else. There are times when founders truly take the same amount of risk, and an even split is justified under the common VC thinking.

In my limited experience pitching to VCs, as someone in an even-split startup, I believe VCs do prefer to have a primary person responsible who is in the CEO seat and has authority to make unilateral decisions. I can imagine an uneven split makes it clear when that's the case. I'm certain many of them have seen cases where even split partnerships were made more difficult and ended up being unfair largely because of the even split. I'm also sure that there are cases where it's harder for them to communicate and negotiate with multiple founders rather than one.

Those reasons don't matter if you're not taking funding, so even split in a contracting partnership (even split effort), turned profitable product startup that doesn't deal with VCs makes a lot of sense.

<comment><USER34> I've done both equal and non-equal, but I've yet to have or observe a business where both the risk, contribution, and effort put in by the founders is actually equal.

Sometimes it's just a conversation founders want to avoid having because it's uncomfortable, but that in itself is a bit of a red flag.

<comment><USER33> I have no doubt you're right that it's frequently a red flag, and that founders often go equal to avoid ranking themselves.

I've also watched and been part of lots of partnerships where the expectation before hand was equal contribution, and the reality after the fact was lopsided. I feel fairly lucky that my most recent experience truly was equal risk and equal effort; my even split experience has been truly reflective of what's happened, and truly fair for both of us.

The big mistake I have made is giving people besides my co-founder too much equity. Nobody else who's contributed to my company so far other than my co- founder have lived up to what they said they'd do, and we gave out too much equity in advance of them doing it.

Considering that, and considering both the issue you brought up and the reasons YCombinator gives for pushing toward equality rather than away from it, I think the main thing founders need to do is have a mechanism for not committing equity in advance of the effort. It's important for founders to be on a vesting schedule so that when one stops contributing or contributes less for a long period of time, you can shut it off. And it's important to communicate that things are going off the rails, and then actually take the action to shut it off.

That's really basic and somewhat stating the obvious, but if you are diligent about cutting off people who don't contribute, then there's no reason to shy away from equal split plans in advance. My experience has been that people I've partnered with for equity aren't avoiding contribution maliciously, they simply and honestly didn't realize in advance that they don't have the time & energy they thought they did.

</comment></comment></comment></comment><comment><USER35> I have a question regarding startup growth so I apologise in advance if its irrelevant here (haven't read the article to be honest).

1) I get that to get the first users, you have to go out and recruit them. That's the advertisement part. So yeah, I get how you get users by advertising.

2) I get that when you have a million customers, they become the advertisement and they are the ones who are bringing you new customers. Your product "ad surface" is _way_ bigger than simple banners through them.

Now what I have a hard time to understand is how 300 users procures the same effect as 2) (or even 3000). I get that they gonna get you 30 more customers by talking about your product to their "friends" who, if everything goes fine, at their turn gonna bring you 3 more customers who gonna bring you 1 more customers, for a grand total of 34 more customers. And that's the end of it. That wont grow much bigger. So basically, you would have to go back to 1) to get new users.

What am I missing? Does a user have to bring you n more new customers, n > 1? How many customers do you need via advertising so that the compound growth effect kicks in?

edit: I can see actually 2 types of compound growth effects: a) a user explicitly recruit another user (ex: "hey my friend, come play to this game"), b) a non user "see" other people using the product and he tells himself that might be a good idea to try it. Anyway, so basically, what I see is that, early on, you can rely only on a) so, in average, your customers have to get you n more new customers, n > 1, by explicitly recruiting them for you. Which, if Im correct here, would give an idea how badass the product must be.

<comment><USER36> The short answer is: it depends.

The long answer...

New customers come from two primary sources: 1) marketing and 2) referrals. Marketing is things like events (trade shows, media hits, advertising, reviews, etc). None of those things happen without outreach on your part. Referrals are when (as you described) existing customers tell other people and a few of them try your product. This will not be constant, right after a customer buys your product/service, they may be excited and tell some friends. Best to model referrals over time with cohort analysis.

At the same time, you will lose existing customers. Like referrals, this is best modeled as cohort analysis. After a customer signs up, after 1 month, x% will leave, next month, a different %, next month yet another %. Typically the churn rate declines for a given customer cohort over time (though there may be bumps along the way).

So, you have customer inflow and outflow. It would be nice if there was a simple formula, but the marketing efficiency, the referral rates and churn rates will all be constantly changing. So, there is no way to know in advance if or when compound growth kicks in until you have solid data. It will vary by market, company and product.

<comment><USER35> Thank you, that gives some meat.

Ultimately, I was focusing on the fact that if a customer brings you n new customers, n < 1 (and real number), it means you get new customers _only_ via marketing. If n > 1, you get new customers with something else than marketing - so to speak.

<comment><USER37> Actually anything n > 0 will mean you get customers by more than just marketing by definition. n > 1 for a static n is exponential growth.

Edit - though under 1 you can see a limit. For example, if n = 0.5 then you would expect to grow to twice the size. In reality it's much more complicated, but on a purely mathematical basis this should be right.

<comment><USER18> N is literally the percentage of your steady state customer base that comes from referral.

So it's the divisor on your marketing expenditure for any given customer quantity.

N > 1 never reaches a steady state, those are "viral" businesses.

</comment></comment></comment></comment></comment><comment><USER38> Is this for the company Binomial, mentioned on the author's home page?

<comment><USER39> Yes

</comment></comment><comment><USER40> Could totally relate to author's personal experience because this is what my biz partner and I are going through right now. Great article by the author.

</comment><comment><USER41> Am I the only one getting a blank page on Firefox, Chromium and Opera included the google cache and archive.org versions ?

</comment><comment><USER42> > legal fees

What is this referring to exactly? Administration fees for starting a company?

<comment><USER30> Legal help in drafting contracts with customers, license agreements for the product etc.

</comment></comment><comment><USER43> I was fortunate to see the author speak at a conference not too long ago, I really enjoyed it. Like her, I have had several bad experiences at tech companies and would just like to not ever work in one again. So I am very envious of her story and it's really cool to see how it has worked out for her and partner. (Unlike her, I don't really have contacts and I don't think I would be very good at the sales side of being a contractor.) Anyway, very inspiring stuff!

<comment><USER44> Yeah, I agree!

I like the people I'm working with, am paid well, have a good work environment and have interesting work to do, but for some reason I'm not happy and feel on the verge of burnout (if it hadn't happened already). I've done startups in the not too distant past and while they were a lot more stressful (and paid very little - we had some funding and had revenues but we never broke even), I was definitely happier working in my own thing. My problem is similar to yours. My personal network is good for changing jobs, but I have no idea how to make it work for consulting work or a startup and I'm really terrible at networking and find it difficult to talk to people (or at least, I find it difficult to strike up conversations - after that I'm not too bad). I also feel like my skills aren't very useful broadly speaking. Maybe it's imposter syndrome because I am good at my day to day work (which can be quite complex).

I enjoyed the article though. It gives me hope that perhaps I can push myself and improve to the point where I can make something work. The thought of going out selling is a scary one to me though.

</comment></comment><comment><USER45> I stopped reading after the "lol". I tend to do not get advice from lols lmaos & company...

<comment><USER46> That might be a decent quality filter if you're reading comments on YouTube or Disqus, but you shouldn't apply it to articles on the front page of Hacker News.</comment></comment>