Announcing HackStars - <AUTHOR> http://www.techstars.org/2009/04/03/anouncing-hackstars/ You do some unpaid programming for interesting TechStars startups, in exchange for the ability to listen to other startups get advice about their startups.  Can't wait to sign up! <comment><USER4> If you're going to donate this much of your time, spend it writing open source software. Stuff that you can take with you. Stuff that will remain in your toolkit and in your portfolio until _you_ decide otherwise.

</comment><comment><USER5> In general, any sort of unpaid internship biases against people who aren't well enough off to work for free (i.e. whose parents won't support them while they do). It's really a kind of class discrimination that prevents people from lower socioeconomic standing from having much of a chance at certain jobs (like in the finance world) that tend to rely heavily on unpaid internships.

One thing I've always liked about my profession is that we tend not to do that in the software industry, which I think makes it more egalitarian and at least helps open up opportunities to people who actually do need to get paid for the summer. It's disappointing to see a reversal in that trend.

<comment><USER6> Besides any ethical considerations about class-discrimination, unpaid internships are illegal unless the intern gets class credit, because it is a violation of minimum wage laws. Calling a job an "unpaid internship" does not revoke the minimum wage laws. However, these laws are not enforced, which results in more and more companies offering unpaid internships...

<comment><USER7> IANAL, but I believe a strict literal enforcement of minimum-wage laws also prohibits founders working for their own corporation without salary. (Equity doesn't count for minimum wage calculations.)

Much of the bootstrapped-startup culture we celebrate may thus rely on lax enforcement of these laws.

<comment><USER6> Good point, but only employees must be paid the minimum wage. If you founded the company, you are not an employee because you direct your work. The IRS says an employee is "anyone who performs services for an organization is an employee if the organization can control what will be done and how it will be done" (<http://www.irs.gov/charities/article/0,,id=131137,00.html>).

<comment><USER7> But as soon as you incorporate, take on cofounders and investors, and adopt a title, you're essentially working at the direction of the organization. Your equity is likely subject to a vesting schedule and (given the right constellation of agreement among the other founders and investors) you could even be 'let go'.

Also, the IRS doesn't enforce minimum wages and labor laws, so its definitions aren't necessarily relevant. (For example, it will tax equity compensation that doesn't count toward minimum wage calculations.)

So you may be right, but I'm not yet convinced. The strict letter of the law seems to suggest that corporations must pay even their founders minimum wages.

And if there's some 'bright-line' rule that clearly tells us when this is not the case, I've never heard it. (For example, if "5%" is traditionally enough ownership, by statute or administrative ruling, to count someone as an owner rather than employee, that would be very good to know -- you could have exactly 20 equal founders and no investors and still have founders bootstrap with their own donated labor.)

<comment><USER8> I'm pretty sure it's tricker than that because there are a number of high profile executives with their $1 salaries and now even some of the bank folks that are in non-executive positions that have elected to take no salary. It seems like those would be more prone to scrutiny than unpaid interns.

</comment></comment></comment></comment></comment></comment><comment><USER4> Any software startup that would accept an "intern" on the team is failing one test of viability. The last thing you need in startups is more than one level of hierarchy. [1] You don't want people to expend valuable mental and emotional energy trying to figure out if task X is "right" for a mere intern, or if it's really important not to have conversation Y in front of the intern, or (in general) whether or not the intern is really a member of the team. One likely result is that your team will not gel. Another is that the team will gel, but suffer a breakdown when the intern inevitably quits. A third is that the team will defend itself by shutting out the intern, assigning him or her to go mend broken XHTML tags or make coffee while everyone else does the real work. Which is another good reason not to be that intern. ;)

Interns are for big companies, where they make only a tiny marginal contribution to the already massive political overhead. ;)

\---

[1] Two levels, if absolutely necessary. But the best leaders are the ones who always manage to convey the feeling that it's _really_ only one, that they're only the leader because _somebody_ has to have their name on that line of the corporate charter and be forced to take tedious phone calls from big clients.

I can also attest that, if it grows, eventually your software startup _will_ need a hierarchy. But at the beginning it's probably just unnecessary friction.

<comment><USER9> I think this is a great point. At the stage a TechStars company is at, they need founders and advisors. Anything else is going to create inefficiencies. And if they're lacking in hacking talent such that they _need_ one of these interns, then they just don't have the right founder mix.

If a team is missing some key capabilities for producing a functioning prototype, then it should bring someone else in and provide some equity.

</comment></comment><comment><USER10> $6,000/founder and as many 0.375 FTE slaves as they can round up - MBAs around the globe rejoice, TechStars has solved the "I've got this amazing idea, if only I could find some developers" problem.

<comment><USER11> How many do you think they'll round up? If I was fresh out of college and didn't need any money I'd just start my own and hang out at the meetups instead of working for free for someone who may or may not have a clue.

</comment></comment><comment><USER12> I am going to reserve judgement on this for now, but I am really going to be surprised if this works out well for the TS companies. The old adage, "you get what you pay for" is especially true with developers/UI designers who are interested in startups. Without some sort of compensation, whether it be cash money or equity, I wonder if you are going to get the "right" kind of interest.

You have to ask yourself, who is their target talent here?

The real talented AND motivated developers/designers in Boulder and probably Boston (AKA "The Gurus"), who have an affinity for startups and TechStars probably applied to the program themselves and didn't get in. Either way, they know the value of their time and are hard at work on their own startups.

The other talented and motivated people are probably consultants or working full time at a company. Despite this being a poor economy, I've found that there is no shortage of work for the "right" people.

And of course, there are a fair share of those that fit a combination of the above.

This leaves us with the last two groups. The people that are either talented and unmotivated, or lack talent, but have the motivation. My suspicion is that you will get people volunteering to the HackStars program who are TechStars fanboys at best. They like the idea of doing a startup, or being a part of the "startup culture" but in truth may not want to put in the work, or worse, are benched because no one wants to work with them.

I may be totally wrong. Either way, I don't fault the TechStars team for test driving an idea like this. But if I were a founder who made it in to the program, I would be very skeptical of the value of the volunteers.

</comment><comment><USER7> Even if this program deserves a critical assessment, that doesn't belong in a sarcastic headline.

<comment><USER13> Agreed. Headlines are not supposed to editorialize. The HN editors should fix this one.

<comment><AUTHOR> Yes, lets sanitize and PC everything, instead of calling things like they are. Read all the other comments in this thread.

<comment><USER14> there is a time and place for everything. everyone is being allowed to express their opinions. just not in the headline.

snark is never productive. it only serves to harden other people's opinions against you. if you believe techstars is in the wrong here, you're certainly not going to change their minds by mocking them.

</comment></comment></comment></comment><comment><USER15> So, like, I can be in the same room with the mentors? WOW!

<comment><USER16> You mean I'll finally get to meet Paul Graham?! No wait... that's not TechStars...

</comment></comment><comment><USER17> I can't help to wonder if adding more people that are "Learning" won't just get in the way of the founders actually getting work done.

<comment><USER18> Cf. Fred Brooks.

</comment></comment><comment><USER19> It's all about mutual benefit. For example, I'm going to be doing a few server installs for a friend while I'm traveling, in exchange for some cycles on those machines to use for my own project.

My friend is happy, because he doesn't need to spend $2k per server to have an engineer fly out and install them. I'm happy, because I'll be traveling anyway, and I get to use a pile of machines around the world without having to pay for and install them myself.

No money is changing hands, and we both benefit in a way that we find acceptable.

An unpaid 'internship' for a 'guru'? Fifteen hours a week for no pay and no equity?

I think not.

</comment><comment><USER20> If you really want to commit 15 hours a week to doing free work for an up-and- coming startup, don't do it this way. Make a list of the top 20 companies you're fascinated by, and contact them directly, one by one.

If you can't be bothered to "sell" free dev/tech work to the companies you're most interested in, you're not going to make it as an entrepreneur anyways.

</comment><comment><USER21> Unpaid internships are becoming EXTREMELY common (if not in the CS field, certainly elsewhere). In NYC this used to be only the case for fashion, but has now spread to basically every other industry.

We had a discussion the other day at lunch whether this was legal/ethical. I'm still not sure how I feel about it...

<comment><USER22> I'm in an unpaid internship right now and I love it. The employer actually hires most of their talent through the unpaid internship program. They get to see if the people who do the internship are really there because they want to learn and contribute regardless of monetary compensation.

I know everyone can't do this because at some point you need compensation, but the arrangement has taught me a great deal about how to program scalable applications that I will definitely use in the future.

<comment><USER4> _I know everyone can't do this because at some point you need compensation_

Which is why using unpaid internships to screen your hires is unethical. It's an artfully disguised form of class discrimination.

Lots of very smart and hardworking people cannot afford to work for free. Apparently those people are at a severe disadvantage when applying to work at your company. And it's not as if unpaid internships offer financial aid, like schools do.

I think it's fine to screen prospective employees as _paid_ interns. I also think it's fine to try them out as consultants first, or even to have them perform a _few_ hours of work for free, as a test. But in general work should be paid for. Unless, as I've said elsewhere, it is 100% free-software work.

Of course, just because it's unethical doesn't mean it doesn't happen or that you can do anything to change it.

<comment><USER22> Unethical is way too harsh. This is NOT class discrimination. If you ask me,judging on the basis of GPA alone is class discrimination. Poor people don't stand a fighting chance.

But that's a slightly different argument. Unpaid internships don't impose requirements that would keep you from getting paid elsewhere, so regardless of your economic situation, you can decide how much you want to work. My employer doesn't care if you work 30 hours or 2 hours...they just want to see how much you enjoy doing the work.

Any smart and hardworking individual wouldn't be at a disadvantage because they could find a way to make it work.

For the record I'm pretty poor myself. I have two jobs to pay my bills. But I don't see anyone who has significantly more money having more of an advantage than me.

<comment><USER4> _they just want to see how much you enjoy doing the work._

Here's what I'd say to that: "I enjoy doing work that _adds value_. If you have something valuable for me to do for your company, pay me what it is worth. If not, I'll be happy to sit in your air-conditioned office writing free software that has value for _me_. And then you will be able to see how much I enjoy doing that."

But you probably shouldn't say that out loud. You're not in a very strong negotiating position, after all.

This illustrates another reason why unpaid internship is pernicious: It doesn't teach _anyone_ how well you add value. Because your time is unmetered and unpaid, you have no incentive to spend it wisely. And your employer certainly has no incentive to track it -- at least not out loud. (Imagine the conversation: "Wow, last week you worked 10 hours for free and saved the company $100k. Have a muffin!") What, exactly, is either of you learning? I guess your employer is learning how much value you can be coerced to add, for free, without you noticing or complaining. And you're learning how to look and act like a model employee.

Onward. "You can decide how much you want to work?" Yeah, I guess. I could also "decide" to live in a cardboard box and save on expenses. If I have a family, I could "decide" to never see them because I have to work two jobs instead. If I've got elderly parents I could "decide" not to take care of them.

But, more likely, an unpaid internship requirement will tend to select for young people with no family and a lot of time to spend at work. How convenient. Especially since _overtly_ screening your employees for these traits is against the law.

Do you see why I'm tempted to call this "unethical" yet?

Anyway, none of this is to suggest that _you're_ doing the wrong thing. We have to live with the hands we're dealt. Congratulations for finding a way forward, and good luck with your jobs.

<comment><USER22> Wow. You are very passionate about this aren't you? (I'm not being sarcastic, I really admire you for voicing this).

I guess I just don't see this practice as unethical because if I look at the whole spectrum of unethical behaviors, this seems very minor to me. Does that make it excusable? Probably not. But to me this is just about acquiring a skill which I previously did not have. It's not about recognition or compensation.

But even still, I fail to see what my employers are doing wrong. You will be compensated for the skills you bring to the company and what you produce. And if you're middle aged with a family to support you could get a paid job there if you had the skills. If not, you could apply for the unpaid internship.

But nothing bars you from getting hired, so that's why I don't view it as an injustice. At the end of the day, its a choice, and if you didn't like the terms, you are perfectly free to go somewhere else.

<comment><USER4> _You are very passionate about this aren't you?_

I went to graduate school. A Ph.D. program is like being an unpaid intern for _six years_.

(And, yet, in some ways it's better. There is _some_ pay. And a Ph.D. is a regular old-fashioned apprenticeship program: The bad news is that you're a slave, but the good news is that your adviser has a fairly strong incentive to help you graduate. The commitment goes both ways.

And, of course, if you've got an apartment and a web connection you can teach yourself to be a professional programmer -- _especially_ if you already have a CS degree -- but you can't say the same for semiconductor engineering.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> (Disclosure: I'm one of the founders of Devver, one of the TechStars 08 companies)

I think that some of the variables will likely need to be adjusted (for example, 15 hours per week seems high to me), but I think the fundamental idea is interesting, although it's clearly not for everyone.

At 15 hours a week, it's clear that a volunteer developer is not going to come close to replacing a technical founder or a full-time employee. Any team that tries to primarily rely on volunteer developers will suffer for it.

I can imagine this appealing to developers (including those in college) who are strongly considering doing a startup or working for a startup, but want to learn more about the process and want to make great contacts (both technical and business).

There may very well be problems with the quality of some applicants, but assuming the application process doesn't filter them out, I would guess things will work themselves out during the summer. That is, the so-so devs will be a net drain and teams won't ask for their help, while any talented hackers won't be donating their time for long - they'll quickly get snapped up by the companies they help out (either during the summer for all equity or after a funding round for salary + equity).

Of course, this is all speculative. Maybe it won't work at all. But I suspect that connecting a group of hackers with teams that will, either immediately or in the near future, want to hire hackers could work out for everyone involved.

<comment><USER23> Just something to consider - there were at least two TechStars 08 teams that had summer interns that they have hired as employees. Granted, they worked more than 15 hours per week (and I think one of them was paid, but I'm not sure). In any case, if HackStars can successfully make more matches like these, it'd be a good program.

</comment></comment><comment><USER24> Fuck That! - <USER2>

I think that they should at least mention what the benefits of such an arrangement would be. Just hanging out with cool people doing work for free people isn't really that beneficial.

Everyone also knows, once a developer starts working on something like this it will be more than 15 hours of work; they will work all night and day to get things done. It should be more formal and give the developers something in return. The companies will be looking to sign up "real advisers" during this time but they will get something in return. Also this will need to be very carefully orchestrated because if people are working on things that are patentable; the volunteers will need to be listed on the patents.

<comment><USER4> +1, Hilarious Insight Into The Compositional Process

</comment></comment><comment><USER25> Jeff said it best when he was asked the question at an event in Boston, "What is better, YC or TechStars?"

Jeff's answer: "You can teach a hacker business, but you can't teach a businessman how to hack".

'nuff said.

<comment><USER26> Ah yes...there's something magical about hackers that means they can learn business, but "businessmen" can never learn the mystical arts of hacking.

Give me a break.

Actually, rather than repeat myself, here's my comment from a couple weeks ago:

<http://news.ycombinator.com/item?id=515978>

<comment><USER27> Magical hits it on the head, except not the way you think. Magical thinking is what you can't do and be a good hacker. Magical thinking won't stop you from being a good business person with good instincts for opportunities who understands the bottom line, or from being a great sales guy who can close faster than a bank at 4.

The subset of hackers who can learn "business" is greater than the subset of business people who can be hackers because the particular style of thinking needed to succeed as a hacker has a unique rigor and need for persistence, and is comparatively rare.

This is true for comparing any less common skill to a more common one. The subset of NFL quarterbacks who could be good programmers is surely proportionally greater than the subset of programmers who could be NFL quarterbacks.

It isn't all about arrogance (although I don't deny arrogance is a factor).

<comment><USER28> It's not arrogance when it is the truth.

If I could stay awake long enough, that MBA spiel is ELEMENTARY

PLEASE

<comment><USER29> Ah, so you have an MBA? Which you earned while sleeping through that simplistic spiel? Please talk about your experiences so I can develop a similar distaste for an oversimplistic overhyped major, or else stop talking about things you have no personal experience with.

<comment><USER28> (YAWN)

(YYAAAWWWWWWWNNNNNNNNNNNN)

Here is one you can understand:

Successfully represented myself in US Federal Court as a plaintiff in a civil rights case, and won! no legal training at all, just read a couple of books, went at it, won, no help, nothing, just me and a couple of books, oh, and I did most of this over the US Postal service, while locked up in a US immigration jail, with a barracks full of neanderthals around me whom I didn't get along with (but I held my own, no one fd with me), and neanderthals in uniforms on my case . . . want a docket number? 98-0711-CV-W-2-P Roman v. Conard, US District Court for the Western District of Missouri, Kansas City, Missouri . . . Law is at least a somewhat interesting topic that I can respect, it can at least be intellectually challenging (for some time anyway) at times . . . but MBA crap? PUUUHLLLLEEEEEZZZZZ PUHLEEZZ

</comment></comment></comment></comment></comment></comment><comment><USER30> When I went to the Techstars for a Day thing last year I did notice that many of their teams were light on developers. Several had people who learned to program right there or one person who could program a little but all had at least one who knew what he was doing. This may be more of an unofficial way to fill out the teams a little as someone else noted it would be hard to do only 15 hours a week. Either you are in all the way or your not serious therefor likely not reliable except maybe as a programming mentor if you drop by once and awhile.

</comment><comment><USER31> I think part of the problem is that some hackers might sign up thinking it will give them an inside track to TechStars in a future round. But, giving 3 months of part time as an uncompensated intern is a high price to pay for the possibility of a second look at your application.

</comment><comment><USER32> One problem is that they will not get good developers. According to Joel Spolsky, good developers never look for jobs (they re always working), so they are not likely to work for free...

</comment><comment><USER33> Question - does anyone else get offended by the name "coder" I've always found that people who write code prefer to be called developers or hackers. I'm a bit of a hacker myself, so maybe i'm overly sensitive, and i know this is a small point, but i always feel like the people who use the word "coder," don't understand them or what they do.

<comment><USER4> This is offtopic, but...

...the problem, as always, is that the words have different connotations depending on the community.

As you probably know, the word "hacker" means "computer criminal" to the majority of the English-speaking world. As a result, calling yourself a "hacker" only works if (a) you only care about your reputation with other hackers, or (b) you are trying to cultivate an ambiguously dangerous persona. It is not a word I would put on my resume if I were applying at SAP, unless I were already well known for being Steve Wozniak.

So you're down to "programmer", "developer", or "coder". My impression is that most people use "developer" as a highfalutin synonym for "programmer"... but in some environments it connotes "a person who spends a lot of time talking about software but never uses the computer except for Outlook, Office, and Twitter". So, if you want to emphasize that you actually spend the majority of your day in emacs, lean towards the other words.

Sometimes "programmer" carries too strong a connotation of "code monkey". I find it best to just avoid places where this is true.

I don't like the word "coder" -- it doesn't offend me, but it's ugly. So I use the other words at random as whimsy strikes me.

<comment><USER33> i don't think it is off-topic because "coder" is exactly the terminology the author used in the blog. I believe it reflects his general misunderstanding of programmers/developers/hackers

</comment></comment></comment><comment><USER34> Here's my initial impression: 15 hours a week? Is that even going to get anything done?

<comment><USER35> Basecamp was made with 10 hours per week. Doubt you'll find a DHH working for free.

<comment><USER34> Basecamp is among the only applications I know of that were built on 10 hours per week (assuming that's true), and even then it was a side project.

Most successful start ups I know of were spending that much time in a single day.

<comment><USER36> The Apple II was a side project

<http://www.foundersatwork.com/steve-wozniak.html>

</comment></comment></comment></comment><comment><USER37> Mind you... it might be much better use of time than jobhunting.

but then you'd have to seriously compare with Open Source contribution - <USER3> faster way to learn, smarter people to work with and more social benefit...

OSS work likely has even more commercial potential...

</comment><comment><USER38> Um everyone mentions that the money isn't the real value of TS or YC. This lets hackers that didn't get accepted into the program get many of the benefits. They get to meet the mentors, see some of the presentations, spend time working with and getting to know the community. I don't see how that is considered so much worse of a deal than the actual program. Consider hackers still in school, hackers not ready to make the leap and start their own companies...

It seems like an interesting way to become involved and learn a ton about the start up process.

(disclosure I was part of Techstars 08)

<comment><USER39> (disclosure, I've received a lot of free help and advice from David Cohen and Brad Feld, two of the main TS backers)

I would have changed the way they presented this but the idea of opening up these sort of programs to the wider community is a good one. TechStars offers a _lot_ of benefits to its members, this is another door to getting involved.

</comment></comment><comment><USER40> I agree working for free would be foolish. But, once you meet your prospective team just ask them how much equity you'll be able to get. If it doesn't meet your standards I think you could just say no thanks. Seems like a reasonable way to join an interesting startup (if there are any interesting ones in their summer class). If you have actual skills they need, you do have a good bargaining position.

</comment><comment><USER37> I guess there is a real market niche that ycombinator flushed out-

namely, Impedance matching between -

      a) investors with too much cash and too little time for small startups

      b) startups who don't need or want large amounts of cash

You'd think it would be more efficient to cut out the middleman, but I guess the aggregator / 'broker' serves a valuable role, as a retailer.

</comment><comment><USER41> Let's have a TV show, I think in the US they are called "American Idol"? In Germany we have "Germany's Next Topmodel" and "Germany's next Superstar", both concepts could be easily extended into a show that portrays the making of a HackStar.

<comment><USER28> I am sorry, that would be NAUSEATING.

</comment></comment><comment><USER42> wouldn't you agree internships are a good opportunity for students?

Seems like a similar thing but specifically orientated around startups. They should get (a slither) of equity, maybe..

<comment><USER43> To me, an unpaid internship can make sense if you're making coffee and hoping to absorb some experience/wisdom from the bankers/lawyers/whoever you're working for. But if you're someone with actual skills (e.g. " a UI/UX guru and/or a strong coder with PHP, Java, Flex, .NET, Ruby/Rails, or Javascript skills"), making an actual contribution, you should be paid.

<comment><USER44> "should" is a word that doesn't belong in this discussion. The "hackstars" don't have to take this opportunity. They can choose to find a paying job.

<comment><USER43> I agree with you 100%, and my reply nearly included that if one believes in free markets then one can't call it unethical. The only thing that gives me pause is that interns are often young and inexperienced and may not realize that their skills have value. While the burden of such education is on the interns (intern candidates, young 'uns, hackstars, whatever), it still seems morally questionable to me for companies to intentionally exploit that inexperience.

</comment></comment></comment></comment><comment><USER28> What really gets me is how these types, the come-work-for-free scammers, don't give up - but then again that is assuming they have enough presence of mind and brains to realize that

A. This has been tried before, many times

B. There are many who have seen this, and can see right through it

Never fails to amaze me, the room temperature IQ crowd. The crowd that really thinks that someone who is bright enough to do what we can do will - at the same time - be dumb enough to fall for a 7th grade level scam.

</comment><comment><USER45> They can spin this any way the want, at the end of the day, they're trying to do one thing:

find programmers dumb enough to work for free.

<comment><USER28> Notice how bright the suits are?

The people that would get into that, are EXACTLY the kind of people that they need least.

<comment><USER46> Why is this us vs. them? Starting a successful company requires a balanced, capable team, a ton of luck, and long hours. If this is your attitude, I would not want to hire you regardless of your self-proclaimed technical prowess.

<comment><USER28> HAHAHA

out of all 4 strawmen you posted, you hiring me was the funniest . . .

"self-proclaimed technical prowess"

Ok buddy, please quote me proclaiming my technical prowess or do STFU

</comment></comment></comment></comment><comment><USER47> Some people also call this slave labor.

</comment><comment><USER48> Dark comment: Could this be the perfect opportunity for a genious hacker with enough "fuck you" money _(yet doesn't care about their own reputation afterwards)_ to sneak behind enemy lines (whatever that means), work for nothing, and provide a totally unexpected mentor experience - possibly have them running around in circles and setting up a bunch of startups for failure?

 _"You're using PHP! That doesn't scale! You'll need Java. I'll show you how."_

 _"You're using Java! Performance will grind to a halt! You'll need PHP. Lemme see that keyboard."_

An infamous HackStar, indeed.

<comment><USER20> Nobody with "fuck you money" got it by caring that much about what companies in a third-tier seed fund are doing.

</comment></comment><comment><USER49> I think that there are some people on this forum that are missing the point. Just because you are a hacker, does not mean that you have the ingredients to make a successful company. As some have already noted, this is a program for those people who were rejected from TechStars initially to get into the program and glean most of the benefits by donating some of their time. Fifteen hours per week is only two hours per day, and that time could be spent simply providing another set of hacker eyes to a new feature (not building the whole thing from scratch), or another techie to bounce your idea for server architecture off of. What I don't understand is why they do not provide this same system for business types to "hack" into TechStars.

<comment><USER28> "I think that there are some people on this forum that are missing the point. Just because you are a hacker, does not mean that you have the ingredients to make a successful company."

AND?

Who cares?

You are talking as if making a "successful company" is the be all end all and the ultimate objective of hacking.

Hacking is about Hacking, it is not about money, companies, meetings, sub 90 IQ's in suits, etc etc etc

<comment><USER46> Well, I think that based on the context of this forum (YCombinator is a seed stage incubator fund) we can assume most people here are interested in either starting a company themselves, or getting involved with one. So, is making a "successful company" the be all, end all? No. However, TechStars is attempting to open a door here, and many people are slamming it shut.

<comment><USER28> it is called Hacker News for a reason</comment></comment></comment></comment>


Tips: Building Wireframes for Web UI - <AUTHOR> http://www.webuiarchitect.com/tips-building-wireframes-for-web-ui

<comment><USER2> "When it comes to Web UI development, believe me, it is totally different from any kind of development - all rules fail. What ultimately counts is experience - mainly from failures. So take my word - kill your urge to make use of pretty looking and so called smart-choice JavaScript plug-ins - they will make your life difficult later on. I just completed an assignment and like always, only used core JavaScript with some help from jQuery to add all event listener place-holders. Tabs, modal dialog, complex form elements and all; I did it on my own. It wasn't more than 4-5 lines of code each, anyway."

That, to me, is the most important part of the article. Not said nearly enough. If you have trouble implementing something like tabs in jQuery in under 3 lines you are missing fundamental understanding of front end development techniques. Front end plugins always lead to a huge lack of customization ability for a very small upfront time saving win (vs. traditional software libraries, which face similar issues but IMO the decision is not nearly as clear cut).</comment>


EFF Launches A 'Terms of Service' Tracker for Facebook, Google, eBay, Etc. - <AUTHOR> http://www.eff.org/press/archives/2009/06/03-0 <comment><USER2> I knew someone would come along and do this better than me! I started this exact thing a couple of months ago: <http://termswatch.pbworks.com/>

* Every morning my home PC downloads new TOS/Privacy pages for the following sites: <http://termswatch.pbworks.com/browse/#view=ViewAllPages>

* Then it uploads the plain-text version of all those pages to PBWiki

* PBWiki manages changes to plain-text quite well and does the hardwork of feeds/update-history etc. for me.

But I got busy with work/school/life that I couldn't develop/publicize it fully. I almost bought tosupdate.org / termswatch.org / toswatch.org but thought I should wait for someone like EFF to do it right instead. I wasn't really trying to build a business around it so instead of being disheartened, I'm glad that someone out there felt the need for the same app.

<comment><USER3> Congratulations on doing something about it!

Most of us would just have posted a rant on HN once and gone back to sleep :-)

PS: I checked the EFF page. The main criticism is that there is no analysis of the change.

The next step would be for some EFF lawyer to comment on significant changes.

The step after that would be some sort of crowdsourced voting so that if a large number of people don't like the change, the rest of the world knows about it.

<comment><USER2> I was going to auto-post to Tumblr about every change and leave the comments open for users. My idea was that if there was a significant enough change, it would be picked up by other sites like HN/reddit/Slashdot where more insightful analysis could be made.

</comment></comment></comment><comment><USER4> It would be neat to combine this with some sort of consumer advocacy reporting service whereby violations of the TOS could be reported.

</comment><comment><USER5> Glad to see this idea launch, I had played around with something similar in college, I was going to track changes to TOS pages etc but school got busy and the idea fell off.

I think it's something that is dearly needed to protect consumers since most TOSs include some sort of "this is likely to change without notice" as a standard.

</comment><comment><USER6> On the last startup weekend in SF, somebody pitched an idea on some sort of a Yelp for EULAs/TOS. Unfortunately, it never launched.</comment>


Making phone batteries that last longer - <AUTHOR> https://www.bbc.co.uk/news/business-50151543 <comment><USER2> This article is 100% fluff. It mentions "Solid state batteries" without ever saying what they actually are.

<comment><USER3> It actually does, these are batteries with solid rather than liquid or gel polymer electrode. Hard trick to pull off if you want low weight and high capacity - as lithium-sulphur experiments showed.

That's not even counting the entirely different manufacturing process causing very high prices.

At least these batteries are much safer and have much better cycling performance.

</comment></comment><comment><USER4> Quantum will solve this issue I think. Easy process, long life for batteries.</comment>


Venture (pilot) – An indie anime about a tech startup in Tokyo - <AUTHOR> https://www.youtube.com/watch?v=_w_cUYvG3x0&t=427s <comment><AUTHOR> I hope the creators have success with their creation - I really like the concept, and have wished for a long time there to be something like this

</comment><comment><USER2> i kind of enjoyed that, hope they get it off the ground</comment>


10x or not: You've got to do things right - <AUTHOR> https://devup.co/10x-or-not-youve-got-to-do-things-right-8e45311ecbcb#.enn4v8i3v <comment><USER2> > Odds are far better than good that your high performers are achieving what > appears to be high levels of productivity by building technical debt into > the application by taking shortcuts whether intentionally or > unintentionally.

Perhaps this is a true statement; however, I have no doubt that 10x programmers do exist who do not build technical debt into the application. Some people really are _that good_. I don't think the average person realizes exactly how good the best in the world are at what they do. For instance, I ran track for 8 years and competed in college. You don't realize exactly how insane a 12:37 5K is until you've trained as hard as you can for years and you're not even close to that time. Nor do you realize how difficult a perfect rendition of Liszt's transcendental etudes are until you've spent years trying to learn them on your own. I imagine the best programmers in the world are similar, but it would take the average programmer decades of programming before the magnitude of the skill gap becomes evident.

<comment><USER3> 10X programmers are unicorns.

If a 5K of 12:57 was really "10X", an average runner would take just over two hours. That performance is nothing like 10X.

<comment><USER4> I don't think that's a good analogy - a run has a very defined course, a very defined technique (you must run, not use a motorcycle), and very defined end point. Most programming problems have infinite solutions, and you're typical 1x developer can only see what they know and have experienced.

To carry the analogy forward, a 10x runner might take a shortcut, use a better implement to complete the course, etc.

<comment><USER5> It's more about taking an analogy where you compare a normal distribution to something that isn't a normal distribution.

Physical capabilities of organisms (e.g., strength, speed, jumping height, etc.) tend to fall into normal distributions.

Knowledge work where you can take advantage of powerful (mental | software) abstractions don't tend to fall into normal distributions, as previous work can make a bottleneck disappear, leaving you with more mental bandwidth for other concerns, which quickly expands your capabilities.

<comment><USER3> intelligence is a physical capability.

<comment><USER5> I wasn't talking about intelligence.

I'm talking about productivity in knowledge work which is different.

</comment></comment></comment></comment></comment></comment><comment><USER6> It's interesting how different this advice is from what some of the greatest engineering cultures have done.

At Microsoft during its heyday in the 90s, it was common for people to say things like, _" That's the dumbest fucking idea I've ever heard"_ and the behavior came straight from the top. Similarly, Steve Jobs and Jeff Bezos are well known for humiliating engineers in front of an entire room after a presentation.

[http://www.businessinsider.com/things-amazons-jeff-bezos- tel...](http://www.businessinsider.com/things-amazons-jeff-bezos-tells- employees-when-he-gets-angry-2013-10)

There's no way to prove the issue definitively either way, but I suspect this blog post suffers from the cognitive bias of confusing how the world should be with how it is. At the very least, a "no shaming" rule isn't a requirement for building a world-class engineering organization and attracting top talent.

<comment><USER7> Looking at Microsoft (or Ggole, Apple, Facebook, etc) is a distraction. They have the resources to keep great engineers from leaving toxic environments - not just by paying a lot, but by having the most challenging and huge scale projects, and by having other great engineers. Those things don't apply to Acme Software Inc. Most businesses aren't building world-class teams or making cutting edge products. In that environment cultivating a team where someone speaking up might be shot down and made to feel ashamed will lead to developers refusing to share ideas, which is potentially bad for the business, and worse, refusing to share experience, which is _definitely_ bad for the business.

If an engineer feels they can admit a mistake early then the rest of the team can help to fix the issue before it escalates to the point where you lose a client. If an engineer hides their mistakes because they're afraid of how their boss might react, things are left lingering, and they don't get fixed. That's how _really big problems_ happen.

<comment><USER6> This is definitely true today. It wasn't true when MS was a startup and Bill Gates was particularly harsh and it certainly wasn't true when Steve Jobs returned to Apple. At that point they were only a few months away from bankruptcy.

Another data point is the vastly greater acceptance of giving workers a tongue-lashing in China vs the US. In that case as well, the harsher culture has certainly been growing faster in terms of engineering-driven companies. In fact, I've never seen a US company of comparable size that can move as fast as a Chinese tech company. Part of this is due to differences in IP and compliance laws but I believe culture also plays a role.

To be clear, I don't _like_ that employers treat their staff harshly. That doesn't necessarily mean the practice is less effective, though.

</comment></comment></comment><comment><USER8> In my experience, the most important skill in an engineer is figuring out what to build. Someone's skill at the actual task of programming is trivial in comparison.

</comment><comment><USER9> The reason the debt metaphor is used for technical debt is that debt isn't necessarily a bad thing - it just something to understand and manage.

Most people, when they buy a house, go into debt (e.g.: a mortgage) for the initial purchase - without that debt, they would never be able to save up the money needed to buy that house.

A startup seems similar - the first goal of a startup should be to show traction and market fit before running out of runway - and if building up technical debt lets them achieve that more quickly, then that is the right thing to do. This first phase seems to be where the 10x programming would shine.

<comment><USER10> Great point. Debt is a necessary part of bootstrapping a new project. That being said, technical debt is not a blanket excuse for violating elementary engineering precepts, shipping shoddy components full of bugs or a necessary evil part of the final product. The team must be able to be specific about the technical debt and execute a reasonable plan to repay it.

<comment><USER11> Technical debt actually isn't a great metaphor. It breaks down too quickly, as in this case. You don't have to "repay" technical debt. It's not really debt.

A company only needs to build something that works. If it works in spite of violating elementary design precepts, shoddy components, bugs, and necessary evil, then it still works. The only thing that matters is the result. Investing resources into optimizing it so that it works better than necessary is merely an option, whereas getting it to work wasn't.

The iron triangle includes cost and schedule in addition to performance. If it would take more money or time than you have to make it perform better, then it just won't, because you don't have that much money or time. A product that frightens the maintainers, but keeps the lights on, is a good result.

Of course, you might optimize yourself into a local maximum if you're weak on strategy. That's why nearly every organization in the world has some kind of separation between "officer/executive" and "enlisted/staff" in the hierarchy. Someone needs to balance the triangle and someone needs to write code and there isn't enough time for the same person to do both.

</comment></comment></comment><comment><USER12> All all the tools mentioned and similar tools are great and it would be a good idea to integrate them in the development process, but I don't think they're that useful to diminish technical debt.

Technical debt to me is uncessary dependencies, anti patterns etc. The only way to prevent this is a good code review were people pay attention to such things. Ideally the code author and the reviewers have the right thinking: after checking for correctness, they ask themselves "is this code modular/reusable/easily testable _/ easy to debug/..."

_ Hopefully the testing is already here, but that's in a perfect situation

</comment><comment><USER13> "Right" is never fully defined, and keeps changing. Therefore, you can never do the right thing.

My solution is radical, but necessary. 99.999% of code should never be written. Let's start saying no to businesses with arbitrary demands, and let's all agree on a set of standards. Only then will we have affordable and quality software.

<comment><USER14> If we did that then we might actually start resembling a field of engineering. Unfortunately software is much more nebulous than structural, mechanical and other fields of engineering. There are less clear cut right and wrong things to do.

Part of what gives software it's unique advantage in today's world is it's ability to change to meet evolving demands quicker than any other way of formulating solutions. As such unclear specifications are somewhat of a pillar of software engineering.

However with unclear and perhaps rapidly changing specifications comes a lot of judgement calls on what to build, how to build and what are reasonable shortcuts to take. Software engineers are almost alone in this, most other professions have the "correct" way and all the ways you can do it wrong. In software there is no "correct" way and just many different ways of kinda achieving something "right".

<comment><USER15> I guess, if it was possible to build towers and bridges at the same speed we build software projects, we would see the same level of nebulousness appear.

</comment></comment></comment><comment><USER16> If your name is Alice and you live in Wonderland. Or Harry in Hogwarts.

In the real where requirements change constantly, libraries that you rely on rely on left-pad, budgets are short - or hell people just learn to write better code - so the old need to be refactored - the debt accumulates.

Code debt is like entropy - always goes up. The normal state of a software project is under staffer, under budgeted, in constant flux requirement wise and for yesterday.

Doing it right with reviews, refactoring, consistently is a luxury. You can try to have a process that minimizes chaos to minimum, but every project will devolve into unmaintainable mess. You cannot afford to be pure while you have the huge state monad called rest of the world that gives its best to crush you.

<comment><USER17> Like every "we are doomed" answer there's a core of truth in here: If something is used and/or changed it will probably break down.

Given that and trying to use it as starting point for something more helpful: Sofware is nothing special here. Your things will - depending on their quality - break down with time, especially when you tinker with them and/or use them. You can push this further into the future using maintenance, repairing damaged parts and so on, but at some point you will have repaired so much that you will in essence have a new thing, not the old thing anymore.

The task is to balance your efforts with your use case. An engine which has to work for one formula one race is constructed very different from one which has to work 200 or 300k kilometers. Again, software is nothing special here. If your software has to work for one run "doing it right" may be a luxury. If you need your software for years to come your luxury becomes necessity.

</comment></comment><comment><USER18> The article referenced in the blog post is also quite good: [http://thenewstack.io/10x-programmer-just- jerk/](http://thenewstack.io/10x-programmer-just-jerk/)

</comment><comment><USER19> I'm pretty sure the marketplace has decided that doing things "right" isn't particularly valuable.

There are places currently where you'd expect an extremely high degree of rigor to be applied to a variety of engineering and technology problems because the potential financial impact of a cluster of interrelated faults would be irreparably financially and reputationally disastrous. But instead you will often find the overwhelming culture is to instead hire legions of employees/contractors ranging from demonstrably incompetent to tacitly complicit in knowingly producing garbage just so long as that garbage can be produced on reliably unrealistic (were any amount of rigor to be applied) timelines, and where the optics of "progress" vastly outweigh the quality of releases. And while none of this would be a spoken or agreed upon culture, the set of incentives in place guarantee that results do not align with the institutional rhetoric.

And as much as it pains me personally to see cultures like that (as a 1x engineer who labors naively over correctness in design and implementation)... for the most part I think the marketplace got this right. If you consider realistically that the percentage of software programmers/developers/engineers/architects who work on something truly "mission critical"/"carrier grade"/"matter of life and death" is a rounding error compared to the number which work on the next Dashboards as a Service, or Fitbits for Dogs, or next-gen tween sexting mobile platform, or just toiling away fruitlessly on shelf-ware in large directionless companies surviving on the carcasses of well-heeled dinosaurs in their "enterprise sales channels", then quite obviously doing things "right" comes along with almost no actual value other than just the ability to claim you did it that way.

If building most software came with anything remotely resembling the risk and liability of building a high-rise apartment building, or a suspension bridge, or the hydraulic controls of a jetliner, then one would likely see much more common practice, conventions, and thorough auditing of software that gets created. Rather than "best practices" being outliers, they'd be the norm, and they'd be much more codified and immutable than simply the most recent blog post about scar tissue earned from a metaphorical software skyscraper collapsing into The Bay one sunny Tuesday afternoon.

As an informal support of the above claim. How many among us have worked on projects which included, as a central pillar of the engineering process and culture, _all_ the following forms of testing... unit, integration, property- based, concolic, end-to-end, chaos, regression, soak, and mutation, and have indefinitely pushed back releases until _all_ those forms of testing could be exercised and validated? Whatever the number I'd wager a year's salary that there are more people who don't even know what most of those things are than the number which have been required to diligently do all of them. Probably by an order of magnitude. If we're talking about mythological 10x unicorns, perhaps we can start with that one?

</comment><comment><USER20> Instead of a "no shaming" culture, I'd like to find a culture of "don't fuck up". "No shaming" and "no assholes" just leads to people cheerily and politely fucking up.

<comment><USER21> I would rather know about something early so that I can fix it. If your entire business culture is one of berating people for making mistakes and introducing bugs, I can guarantee you that there are some really good latent ones that will bite you in the ass some day. God help you if peoples' lives actually depend on the code you write.

<comment><USER22> I'm won't be the first HN'er to note that the business of aviation has evolved a culture much like the ideal being discussed.

You can see it when you read NTSB AARs, TSBs, even the regs (FARs) themselves. Even the language is chosen so as to avoid shame.

When blame is ascribed it's explicit and for the purpose of explication of root causes, but, more generally, the tone of the narrative is always, "we've critiqued _the process_ and here's how we see to improve it."

People are only seen as participants in the process and aren't targeted for blame or shame.

The amazing safety statistics of commercial flight speak to the efficacy of this philosophy; software project management would do well to adopt much of these strategies, I'd argue.</comment></comment></comment>


Apple the Latest to Abuse DMCA 1201 to Try to Stifle Competition, Research - <AUTHOR> https://www.techdirt.com/articles/20200103/17345443671/disappointing-apple-latest-to-abuse-dmca-1201-to-try-to-stifle-competition-security-research-jailbreaking-more.shtml <comment><USER2> You can call it "abuse" but it's doing specifically what provision 1201 of the DMCA was designed to do: prevent circumvention of technological measures to protect copyrighted content. In this case, "copyrighted content" is Apple's OS instead of, say, a DVD or Blu-Ray.

I mean...it _is_ disappointing, and I still vehemently disagree with the entirety _of_ the DMCA, but that's the law. If it's disagreeable, petition the Librarian of Congress to provide an exemption; they review the provisions of this law every three years: [https://www.law.cornell.edu/uscode/text/17/1201](https://www.law.cornell.edu/uscode/text/17/1201)

</comment><comment><USER3> That poor company, all they were doing was violating copyright for profit under the cover of competition and research.</comment>


Ask HN: Choose Between eBay and Amazon - <AUTHOR> I recently graduated and I am having offers from both eBay and Amazon AWS. Which company is great to start my career. <comment><USER2> Just like programming languages vary in power (PG Quote), company's brand value also varies in power. Having said that, it is equally important or probably more that you are part of the right team.

I would suggest you find out from your recruiter if you have a team matching option where you can speak with multiple teams.

As you are a recent graduate, you need to pick the team that has good mentors who really care about the RCG, help him ramp up and grow. You must add more objective parameters than just this to pick the right team. If you are just assigned a team, then it might be a game of luck!

Being in the right team is more important than being in a more branded company. There is a lot of time in your career, laying down a good foundation now is most critical IMHO. Wish you the best.

</comment><comment><USER3> I'd say neither is bad, but if I had those two options I'd go AWS. I personally think you will learn more (diversity) at AWS and it will set you up for later career choices better than eBay. Also might depend what groups within those two you are getting offers from, but I still would think AWS.

<comment><USER4> I've worked at eBay and heard badthings about Amazon on the logistics/fulfillment side which doesn't apply to AWS. I'd choose AWS as there is so much being done and still so much more to do.

</comment></comment><comment><USER5> Go to Amazon. It's the clear choice. You'll make more money and learn more along the way.

eBay is a dinosaur at this point.

</comment><comment><USER6> Go to AWS. Generally a more values brand in the job market.

</comment><comment><AUTHOR> Hey thanks for the info. I really appreciate it.</comment>


Secure Access to 100 AWS Accounts - <AUTHOR> https://segment.com/blog/secure-access-to-100-aws-accounts/ <comment><USER2> It's good to see an article talking about this. A lot of organizations could benefit from using more than one account to enforce security (IAM is hard!) and separation of concerns.

It doesn't really explain it but to do this, the root account has to be enrolled for AWS Organization[1]. This is what is being used to handle all the accounts and consolidate the billing. It also allows to create rules span all the accounts. Recently terraform gained support for the Organization API[2] so it's possible to control the account list in a declarative manner.

The biggest issue is that now that there are a lot of accounts, the developers need a way to switch between them. Using the IAM assume-role mechanism is a good way to avoid needing a lot of AWS keys per developer.

I don't know if I agree with using Okta as it adds another party that now has access to AWS. I don't see the difference between having a AWS secret or and Okta secret in the keychain security-wise. Okta might provide audit logging facilities but so does AWS.

In either case you will need to generate a `~/.aws/config` per developer. There is also a Chrome plugin[3] that can read this file format and populate the AWS Console switch role. I don't know if the extension publisher is reputable yet as it gives a lot of access to the extension.

[1]: [https://aws.amazon.com/organizations/](https://aws.amazon.com/organizations/)

[2]: [https://github.com/terraform-providers/terraform-provider- aw...](https://github.com/terraform-providers/terraform-provider-aws/pull/903)

[3]: [https://chrome.google.com/webstore/detail/aws-extend- switch-...](https://chrome.google.com/webstore/detail/aws-extend-switch- roles/jpmkfafbacpgapdghgdpembnojdlgkdl)

<comment><USER3> It should be noted that Orgs should be setup when new AWS accounts are created, as it can be tricky to perform once your have systems in production. I would even go so far as to say if you want to commit to Orgs, create a new AWS account hierarchy and move your applications and infrastructure into it.

EDIT: [https://docs.aws.amazon.com/organizations/latest/userguide/o...](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html)

"Warning: We strongly recommend that you do not attach SCPs to the root of your organization without thoroughly testing the impact that the policy has on accounts. Instead, create an OU that you can move your accounts into one at a time, or at least in small numbers, to ensure that you don't inadvertently lock users out of key services."

<comment><USER2> Agreed. One strategy that I have been using quite successfully is to:

* create a new AWS account

* setup IAM and AWS Org

* add 2nd factor on the root account, put the Gemalto in a safe

Then add the "legacy" account to the org and slowly port all the resources to fresh new accounts.

</comment></comment></comment><comment><USER4> We created something similar in house.

Users authenticate to an internal website with ADFS (including MFA) and are then presented with a list of roles where they can either click through to the website assuming a role in that account for an hour, or click an option to access temporary credentials.

The AWS roles are deployed from our CI/CD pipeline to all of our AWS accounts, so we don't have to have user accounts anywhere and can still deploy features from our Pipeline without logging in.

We are also in the process of setting up automated account provisioning from our HR system, Workday. Based on the users team and job title, they'll be added into an Active Directory group which would then give them access to the resources required for their role.

Once complete, this will save the support team a lot of time!

<comment><USER5> That's neat would your company consider open sourcing it if I understand correctly that you made it for your own use not to sell it anyway.

<comment><USER4> It has actually been considered.

I'll bring it up again. Personally I don't see why not!

</comment></comment></comment><comment><USER6> Thanks for posting this here. I'm the author of this blog post. Feel free to ask me any questions you might have.

<comment><USER7> Tangential: Why Okta over some other provider? GSuite can be used as an SAML provider, can't it?

<comment><USER8> GSuite can be an IdP for SAML but it's sometimes limited. AFAIK you can't use it to connect to AWS using SAML because AWS makes some assumptions about attributes in the identity. I may be wrong here, but I tried to do this a few months ago (with Duo and Yubikeys added in) and was not able to get it working. I ended up using Okta and it was simple.

<comment><USER9> About a year ago, I migrated my team's AWS access from manually-provisioned AWS keys to GSuite authentication, using a combination of SAML and OpenID Connect (OIDC):

\- Detailed instructions for Google-federated login to the AWS Management Console through SAML are available [1], and worked more or less as described.

\- CLI/API access is a bit trickier and less thoroughly documented, but is possible using the 'Web Identity Federation' feature [2]. Basically, you generate/refresh temporary AWS credentials by passing a Google OIDC token to the AssumeRoleWithWebIdentity API. The tricky part is keeping both your Google OIDC and AWS STS tokens conveniently refreshed. I wrote some open-source glue code for this that hooks into the AWS Ruby SDK and CLI [3]. It's still a little rough around the edges and not yet extracted into a standalone project, but it's been working well enough for my team over the last year.

[1] [https://aws.amazon.com/blogs/security/how-to-set-up- federate...](https://aws.amazon.com/blogs/security/how-to-set-up-federated- single-sign-on-to-aws-using-google-apps/)

[2] [https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr...](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html)

[3] [https://github.com/code-dot-org/code-dot- org/blob/staging/li...](https://github.com/code-dot-org/code-dot- org/blob/staging/lib/cdo/aws/google_credentials.rb)

</comment></comment></comment></comment><comment><USER10> Excellent article thanks for sharing. It's awesome to see someone documenting their experiences with multi-account strategy. You said you manage account with Terraform, are there any other resource types that you don't give the dev teams access to such as networking? Also, how are you deploying Terraform at scale across all of your accounts?

</comment><comment> ah- How are you dealing with software that expect to get aws tokens? Especially with sts AssumeRoles only lasting up to one hour?

For example, if you want to run the Athena JDBC driver locally or read something from S3 in a longish (>1h) running Python script.

<comment><USER10> I can't answer for Segment, but our AWS account strategy is very similar, so we've found that there is still a need for a centralized KMS solution (system- to-system auth). Our teams are working on a project to wrap more tooling around Vault and make it a centralized KMS. T-Mobile has done some work on this... [https://opensource.t-mobile.com/blog/posts/introducing- tvaul...](https://opensource.t-mobile.com/blog/posts/introducing-tvault/)

</comment></comment><comment><USER11> Atlassian open sourced a tool to help with CLI access when using many AWS accounts through federated roles.

[https://developer.atlassian.com/blog/2017/12/introducing- clo...](https://developer.atlassian.com/blog/2017/12/introducing-cloudtoken/)

</comment><comment><USER12> I am interested in the thought processes behind setting up separate AWS accounts "for GDPR compliance" as opposed to having one AWS account and running multi regions (via VPC etc.) under that account?

Is it because teams in different locations (US, EU etc.) can run semi- independently? How do you manage shared resources (e.g. S3 or RDS SQL servers) that need to be accessed from multiple regions, yet still maintain GDPR compliance?

<comment><USER6> AWS has a lot of resources that are not per region.

The GDPR line is about improving our least privilege access story. There's a lot more to GDPR than that, though

</comment></comment><comment><USER13> What are best practices for sharing build artifacts (e.g. images in ECR, files in S3) among AWS accounts? Cross-account IAM policies, explicit promotion process to move artifacts between accounts, or something else?

<comment><USER6> We use ECR and have all of our images in our hub account, and make them readable from the prod/stage/dev accounts using a cross account policy.

For S3, it's more complicated because of object permissions and all the insanity that comes with cross-account writing etc.

Edit for more info: No explicit promotion process for containers. Engineers build images in our CI pipeline when their pull request is approved and merged to master, which is pushed to the hub account.

</comment></comment><comment><USER14> How would this compare to an LDAP, an LDAP with org wide access control can pretty much enable all of this(keeping in mind GDPR & other security concerns) from just 1 AWS account ?

</comment><comment><USER15> Out of curiosity, how do people handle communication between services that are in different accounts? VPC peering to connect all accounts? Public Internet and OAuth? Another method?

<comment><USER16> You need to define "between services". You mentioned oauth and VPC peering. One is authentication, the other is networking accessibility. There is no one solution.

Generally you have: VPC peering between accounts, Network Access Control List (NACL) for VPC port control, security groups between instances (and some AWS services which uses SG to limit port access), IAM roles to authenticate and authorized certain AWS services to do things (e.gz Lambda to read S3 bucket) - but IAM and policies (bucket policies, SQS policies) govern authentication and authorization. Finally there is also organization service which allows you to control what AWS services are allowrd in a group of AWS accounts.

Sorry, on mobile so I can't make a prettier list. I am generally disappointed at the complexity of authentication and authorization mechanisms exists for AWS services to be really honest.

<comment><USER15> Oh, sorry, absolutely. I'm actually talking about services that talk to each other using HTTP. One option I've though of is using the public internet to connect them and use OAuth to make sure that they are actually allowed to communicate, solving the security issues on the application level.

Another option would be to allow only access from the internal network, but then you have to connect them somehow.

<comment><USER16> This is a good question. I will simplify this to two rules:

* internal traffic goes through VPC, AWS backone, and Direct Connect / VPN (company and AWS accessing each other). Worth noting that, all S3 requests used to go through the Internet, but now we can enable S3 endpoint so requests originated from VPC is now made within AWS backbones).

* incoming public traffic comes through AWS public infrastructure (e.g. load balancer) before handing off to some EC2 instances (the instance could either be in "public" subnet, or "private subnet")

There is a whole lot of architecture approaches highly dependent on the requirements, and I don't think we can discuss them here.

For one microservice to talk to the other one, if all within the same VPC, you just use security group (Network ACL "defends" subnet, but you are better off just using route table). If not within the same VPC, you can peer. If not within the same account, you can peer. I believe now you can peer region too. In some cases, you have to route traffic from VPC1 to VPC2 through your corporate routing...

</comment></comment></comment></comment><comment><USER17> Temporary security credentials from AssumeRole are valid for up to 3600 secs (1 hour). Given that, how do folks handle long running jobs/sessions?

</comment><comment><USER18> Hey segment, are you aware that you can have several env (dev, stag, prod, ...) on the same AWS account? :p You can secure each environement with different credentials (IAM) so no need to create several AWS accounts!

<comment><USER19> In practice, cramming all this into the same account doesn't work. Segment is following best practice here.

For example, IAM doesn't provide the granularity in resources and conditions that you'd want to effectively isolate the blast radius of developer keys. ec2:TerminateInstances didn't (doesn't?) support VPC level conditions, so being able to terminate one instance meant you could terminate all instances.

Similarly, you might want your engineering team to iam:PutUserPolicy in development, but have a much more restricted group in production which isn't possible with IAM today.

I've taken this pretty far in the past to attempt segmenting within one account, but always run into limits: [https://github.com/witoff/self-service- iam](https://github.com/witoff/self-service-iam)

<comment><USER20> The other bit would be blast radius. What if someone does get access to your single account? How confident are you that your policies were airtight? By using many accounts, you create clear isolation boundaries that require opt-in sharing.

<comment><USER21> >>> By using many accounts, you create clear isolation boundaries that require opt-in sharing.

In theory yes. In practice, you will achieve the opposite of that.

Developers and ops will have to juggle between 10 keys and accounts to get anything. The keys will end up saved and written all over the systems. It will be impossible to have audit between all the accounts and access.

<comment><USER6> Op here. I don't think you read the blog post! Our entire engineering org has a grand total of 0 AWS keys!

Per-account isolation is great for security and especially reliability, if you run in to constant ratelimit issues like we do.</comment></comment></comment></comment></comment>


Visual Website Optimizer: Run A/B Tests On Your Site - <AUTHOR> http://techcrunch.com/2010/09/02/visual-website-optimizer-another-way-to-run-ab-tests-on-your-site/

<comment><USER2> Guys, I am happy that TC finally wrote about my startup! Relevant thread where all this started: <http://news.ycombinator.com/item?id=1520001>

After following up for more than 50 days with NUMEROUS emails, looks like they have finally submitted to my persistence ;)

Any way, this is good. I am happy that they wrote about Visual Website Optimizer and hope this brings exposure.

EDIT: They've corrected the typos in the post.

<comment><USER3> Congrats paras! You have a great product, and you deserve the attention you're getting.

Btw, love the articles that you write on smashing.

<comment><USER4> meta-question: why does Paras' reply to this appear as link[dead] ?

<comment><USER2> Actually I had submitted the same response twice. So, deleted one. I'm having some Internet connectively issues today.

</comment></comment></comment></comment><comment><USER5> Considering the effort that went into getting them to do a post it didn't seem like much more than a rehash of whatever Paras has been sending them. More and more recently it seems that much of the value ycombinator gives a company is in the initial attention that they will always receive upon launch making it that much harder for smaller people wanting to bootstrap without VC money and without great industry contacts.

</comment><comment><USER6> Oh, _finally_. Paras Chopra gets the respect he deserves.

I don't know of any startup founder who works as hard as him.

 _Mubarak ho_ Paras gee, but, yar, this is long over due.

<comment><USER2> _Shukriya_ :)

</comment></comment><comment><USER7>
      Website:	visualwebsiteoptimizer.com
      Location:	London, United Kingdom

Paras, you shifted your base from Delhi? :-)

On a serious note, I know you really wanted VWO to be covered on TC. If you find time, please do write a blog post afterwards on what impact this coverage had for your business. (Traffic driven to your site from TC, inquiries, new signups etc )

<comment><USER2> No, I am still in Delhi. I am getting associated with a partner who is based out of London. Yes, definitely. I will soon blog my experience about getting TC coverage and it effects it had.

</comment></comment><comment><USER8> Congratulations Paras!!! Its great to see Indian start-up featured in TC.

</comment><comment><USER9> Congratulations, I am very happy for you, your product is truly great and deserves the coverage.

</comment><comment><USER10> Congratulations paras! Great to see how persistence pays off in the long run.

</comment><comment><USER11> Congrats.

A small nitpick...

The A Weber Communications logo is looking jagged, you might want to re-render it or re-size it depending on how you did it.

<comment><USER2> Yup, tried doing that but still it comes out to be Jagged. Used Photoshop resizing option with default method of resizing. Do you have any recommendation on how to re-render it without making it look jagged?

<comment><USER12> Use the 'Bicubic-sharper' option to reduce size. Here: <http://i.imgur.com/xkHH9.png>

<comment><USER2> Oh wow, this looks beautiful. Mind if I use it?

<comment><USER13> Hey mate, do you have Skype (IM) or AIM?

<comment><USER6> The dude pretty much lives on gmail. Get his email and he is always greened out. Always there when I reach out to him, as a friend, must be heaps more responsive to his clients.

He changed his sleeping habits to accommodate .eu and .us time zones :-|

One day you will get offices in London and San Francisco, Paras, and you will sleep when you damn feel like it. I see success in your immediate future.

</comment></comment></comment></comment></comment></comment><comment><USER14> What an awful writeup for such an accomplished startup.

</comment><comment><USER15> Any idea why TC have a 'twttr' style logo at the moment?

<http://techcrunch.com/2006/07/15/is-twttr-interesting/>

<comment><USER15> Ahah. <http://techcrunch.com/50-days-of-logos/></comment></comment>


Priti Patel: "Facebook encryption threatens public safety" - <AUTHOR> https://www.bbc.co.uk/news/technology-49919464 <comment><AUTHOR> While I don't disagree that more and more criminals use encryption to hide their activities, the 'Cloud Act' completely upsets the balance suggested by Ms Patel:

'"Tech companies like Facebook have a responsibility to balance privacy with the safety of the public," Ms Patel said in the open letter, which was also signed by the US Attorney General William P Barr, Acting US Homeland Security Secretary Kevin McAleenan and the Australian minister for Home Affairs Peter Dutton.'

How are you going to ask companies like Facebook to give you faster access to information _across international borders_ and still say 'Hey you should have some privacy too'. It just seems blatantly dystopian. This is part of a growing trend of governments that want back doors to social media in the name of security and justice: Australia, the USA, and now the UK. That being said HN, how do you propose governments deal with online criminal activity? A lot of people here will criticise this and while that criticism is justified I just wonder if there's an alternative solution to this problem.

<comment><USER2> I think the correct balance already exists.

When you connect to your bank the transmission is encrypted but your bank has the data available in cleartext.

When you use your smartphone to call someone or send a text the transmission is encrypted over the air but your operator has access to the data in cleartext, and there is in fact a system in place to duplicate traffic for police eavesdropping. You have privacy, your bank/operator doesn't abuse data they have, and the police is able to request access within the law.

This has existed for decades, it is accepted, it works.

The issue is that some tech companies (cough Facebook cough, but not only them) have abused the access they have to data and shot their reputation in the process, so now they are trying to salvage the situation by saying "Oh but we now have E2E so you can still use our services"... No-one trusts anyone, and that destroys the established balance between privacy and law enforcement/national security.</comment></comment>


Why GoDaddy is not ready for prime time site hosting - <AUTHOR> http://www.unlimitedmagazine.com/blog/

<comment><USER2> Is this slow server BS the same reason it can take 48 hours for Google DNS changes to propogate? Have they been selling us crap on that for years?

</comment><comment><USER3> Damn, they looked good, but I guess it was all marketing.</comment>


Unknown Mathematician Proves Elusive Property of Prime Numbers - <AUTHOR> http://www.wired.com/wiredscience/2013/05/twin-primes/all/

<comment><USER2> Substantial discussion: <https://news.ycombinator.com/item?id=5734480></comment>


Chinese government reveals draft list of animals which can be farmed for meat - <AUTHOR> https://www.cnn.com/2020/04/10/asia/china-wildlife-law-coronavirus-intl-hnk/index.html <comment><USER2> It will be interesting to see if this sticks. It should... but local government and central government in China don't always seem to be in sync.</comment>


Some Dynamic Measurements of Firefox on X86-64 - <AUTHOR> http://robert.ocallahan.org/2016/06/some-dynamic-measurements-of-firefox-on.html <comment><USER2> Unrelated to content: anyone else (on mobile) find bloggers "gesture detection" to go back/forward in the blog to be bloody annoying and never desirable? I find as I scroll I often inadvertently am now on a different blog post from that linked and then I'm having to fight it vs safari in navigating history.

</comment><comment><USER3> I find it odd that the GPRs r12/r13 are used more than r14/r15, because they're both callee-save and the former have more restrictions on their use in memory operands.

Also, the posts mentions video codecs, but if you're doing SW video decoding then you've already failed at performance and power.

</comment><comment><USER4> Interesting analysis, but in what ways can we realistically affect the instructions used without involving assembly?

<comment><USER5> Perhaps writing longer functions would cause the compiler to use more registers, since it needs to keep track of more variables. Though I think this is not the point.

I think the author was just pointing this out as an interesting exercise rather than a call to action.

The hottest 5 instructions for the call to std::fill were generated by the compiler that inexplicably didn't end up using a _rep_ (or variant) instruction. But we don't know if in this case, fewer x86_64 instructions profiles faster or slower.

<comment><USER6> Compilers routinely inline code, even between source files. Programmers don't need to stress about that.

And I don't think REP is ever the fastest, although it's sometimes the shortest code.</comment></comment></comment>


Google unveils major overhaul of its search engine - <AUTHOR> http://www.usatoday.com/story/tech/2013/09/26/google-overhauls-search-engine/2877491/

<comment><USER2> When they come out with new algorithms for searching, they are completely replacing their old engine, correct? Are they rewriting the core? Or is this more like v1 was PageRank, v2 was Caffeine, and Hummingbird is v3? Is a lot of the code is just being refactored or is everything getting rewritten?

<comment><USER3> It's more likely that they stand up several current versions in parallel, and progressively route more traffic to the new algorithms/services. At least that's what I'd do, if I had no technical, infrastructure or monetary budget.

<comment><USER4> I'd be surprised if that's not how they do it. Less for budgetary reasons and more for testing, doing it this way would let them see if they get the results they are after in aggregate for more useful queries

</comment></comment></comment><comment><USER5> We don't have a better source on this? The article contains nothing that this community could actually discuss.

<comment><USER6> according to the techcrunch article [1] the announcement was pretty light on details. Google invited reporters to a little birthday party and said "oh, yeah, we totally overhauled our search algo the other day".

[1][http://techcrunch.com/2013/09/26/google-recently-made-a- sile...](http://techcrunch.com/2013/09/26/google-recently-made-a-silent-shift- to-a-new-search-algorithm-hummingbird/)

<comment><USER7> Not much of an unveiling then. I wonder if non-complex queries are treated differently.

</comment></comment></comment><comment><USER8> Has anyone produced examples of queries that are better than they were before?

I tried "asking some questions" but the fact that my first test question ended up being 'how many eggs are in a dozen?' demonstrates that I'm currently not in the most creative of moods. :)

<comment><USER9> Following the lead of the article, I searched for "nutritional benefits of olive oil vs canola oil" and all I got was a bunch of links (as expected). No new fancy "within-google" nutritional table.

</comment></comment><comment><USER10> Who is with me in wanting Google to release a web search product?

You type in the search terms, Google will find you websites and websites only containing those terms. Simple.

Something that just searches the web, http and https, no fancy features. Basically the Google of about 1999, with algorithm tweaks. And maybe with a way for A-B testing to establish which websites are better. KISS.

<comment><USER11> How much would you pay monthly/annually to use said service?

<comment><USER10> AdWords</comment></comment></comment>


Show HN: Deploy your websites from Dropbox - <AUTHOR> http://www.websrvr.in/?hn1

<comment><USER2> Founder of BitBalloon ([https://www.bitballoon.com](https://www.bitballoon.com)) here.

Always interesting to see more and more startups popping up in the static hosting space. Since we launched a year ago there's been at least 6 other entering the space.

Right now it looks like your main selling point is price.

Think carefully about whether that's the way you want to go. The real competitors here is the humongous shared hosting market, and the big players there have much deeper pockets and far better economies of scale than any startup.

With a $1/site price you'll pretty much never have a chance to make paid advertising a viable customer acquisition channel and as someone else mentioned, think about what the price of giving any kind of support will be. The lower end of the market will (in my experience) also be the place where people will need the most help with stuff like DNS setup, or basic issues such as not having an index.html file, etc, etc.

Good luck!

<comment><AUTHOR> Thanks, nice to see you here and thanks for the feedback :)

</comment></comment><comment><USER3> Not sure what value proposition is here. Static content is well understood. I'm using google storage and it does the job pretty well.

<comment><AUTHOR> It is not to store content but the ability to create new sites just by creating a new folder, e.g. if you create a new folder in 'Dropbox/Apps/websrvr' called 'apple314159' you would have a new website created and online at '[http://apple314159.websrvr.in/'](http://apple314159.websrvr.in/') and you could manage your website through your local computer.

<comment><USER4> Dropbox doesn't play well with git, or perhaps version control in general. Having a live site which is unversioned is somewhat less than desirable. I am sure there is some category of people for whom this is useful, but I am a professional, which means I have been burned too many times to consider not using version control. Hence, this service is entirely useless to me.

Hiding complexity from the user is mostly good; it's a shame that the replication service isn't more capable.

<comment><USER5> I keep about a dozen personal, non-critical projects in Dropbox. All are versioned with git, and it works great. Dropbox itself is versioned (since I'm a paying subscriber), so I have two layers of security there.

What negative experiences have you had with Dropbox + VCS?

<comment><USER6> Maybe it's better now, but I've had problems with .git folders in dropbox. Dropbox doesn't understand the directory structure and conflicts are handled by merging competing .git folders and renaming internal files as needed -- almost certainly not what you want.

<comment><USER5> I can't speak for before I started using Dropbox with git, but for the past 3 years, conflicts are handled well (and not as you describe).

First of all, Dropbox will not overwrite data. If it finds a conflict, it will save a second file with "[machine name]'s Conflicted Copy" and the modification date at the end.

This hasn't happened to me with any git files yet, however, because my machines are always online. That means my working tree is always the same across devices and my .git folder is always identical.

The only way a conflict would be created is if I committed while working offline and then committed on another machine while working offline.

If that happens, I could just grep my Dropbox folder for files with "conflicted" in the name and remove them. Or, because I committed my files to a remote (often Github, but sometimes others), I could just delete the local copy and clone.

<comment><USER6> Sure, I'm not suggesting there would be permanent data loss... but doesn't Dropbox renaming a bunch of files deep within .git folder result in an unusable repository that you'd have to fix by hand or restore from backup?

<comment><USER5> This whole discussion made me curious, so I tested it. Dropbox doesn't _rename_ files. It _creates new files_. All you have to do is delete the new files (which are really "forks" of your current data) and you have your working tree synced with your data store again. It's really easy.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Just do it your self, [https://gist.github.com/mariocesar/3f3e63cd422e1024d7e5](https://gist.github.com/mariocesar/3f3e63cd422e1024d7e5) (If anyone has enhancements please fork or comment)

Time before when Canonical announce Ubuntu One was going to be discontinued I comment how I depend on U1 to deploy my static websites, like 30 static websites some of them with simple .php scripts that manage contact forms or feed aggregation, it's pretty easy to do and still don't get why so much people put so much effort on making it a SaaS, we are talking about a little sysadmin work.

I have no option that use Dropbox as a backend as most of my clients use it, but it's pretty obvious you can setup the same features with other services.

<comment><AUTHOR> With a SaaS solution you don't have to worry about uptime and having your own server. It's definitely not for every one :)

<comment><USER7> Uptime for an instance that will only serve static content? do we are not just delegating to much? We are talking about a Nginx configuration and a little of sysadmin work.

</comment></comment></comment><comment><USER8> Free is cool too! [http://www.dropboxwiki.com/tips-and-tricks/host-websites- wit...](http://www.dropboxwiki.com/tips-and-tricks/host-websites-with-dropbox)

</comment><comment><USER9> Congratulations on your development. It seems this has been done before, and albeit it is neat what is the benefit over a low-cost "standard" webhost? I can name a few webhosts that are in the $3-5 range and offer standard tools and the ability to install a SSL.

<comment><AUTHOR> The benefit is that you don't have to connect to your webhost over FTP and change files, instead you could just open your file from your dropbox edit it and be done with it. And to create a website all you need to do is create a folder and put your html into it.

Thanks for the feedback :)

I would love to hear about features which might make you consider this service.

</comment></comment><comment><USER10> I build static sites/apps that use saas tools for the dynamic content. For example, a post's comments are stored on parse.com However, this architecture chokes on IE8/7 unless CORS is handled through SSL. How would I install SSL in your service?

<comment><AUTHOR> I have SSL support planned in the near future (1-3 months) if people ask for it. It would require you to upload the private/public keys to websrvr. Thanks for the question :) I was really planning for SSL support because of google's announcement to bump SSL sites in their listings, I wasn't aware of the CORS issues with IE.

</comment></comment><comment><USER11> Minor issue but "Edit your files locally to updated the site." should be "Edit your files locally to update the site."

One positive point is I got basic idea on what the site is and how to use it in minutes.

<comment><AUTHOR> Thanks, fixed it.

</comment></comment><comment><USER12> So, is this like using GitHub Pages without having to do a `git push`?

<comment><AUTHOR> Yes, a little bit like that. However, this is part of our core business so I think that gives us a bit of an advantage. For instance, just today we released the ability to minify css/html/js and also gzip it to the highest compression so that websites hosted on websrvr perform better. For www.websrvr.in's homepage I see a decrease in size from 8799 to 2649 bytes which is a decrease in size by 70%.

<comment><USER12> Gotcha. I use precompilers which take care of file concatenation and minification, but I never could get gzipping to work. Are you targeting devs that probably use github already or not tech folk?

<comment><AUTHOR> Yeah, I am targeting devs and designers, I used to publish my blog posts using jekyll and git on my own server, and it _is_ a bit tedious to push on every typo correction :)

</comment></comment></comment></comment><comment><AUTHOR> Founder here, would love to get feedback

<comment><USER13> Some time back, I was in the market for similar sevices, I evaluated brace.io and site44. If I am not wrong, they both charge $5/month for 5 websites. As a user, I would not mind paying that, because if I want to quickly demo to a client, I would prefer a separate sub-domain/folder without having to pull my credit card for that. Second, I was looking for minification and compression, great to see that you have added that feature. Third, great to see that you have contact forms, the first obstacle where you might think of servers. I like brace.io's implementation. Additionally I liked brace.io's admin and shipping workflow. Do you have anything similar?

<comment><AUTHOR> You don't really have to enter your payment information every time you create a website. Once you signup, you can make a deposit for $3 and we'll charge you only when you create a folder in your dropbox (that too 1 hour after you create the folder in case it was done by a mistake). Also, even if you don't have any funds in your account your websites will be live, we'll send you an email to clear your invoices :) In short, all you have to do to create a website is create a folder with an index.html file. I am also the creator of [http://getsimpleform.com](http://getsimpleform.com) which is a service which allows simple contact forms with akismet integration for spam prevention, it also allows you to use templates for the email notifications on form submissions. websrvr will have all that functionality and a bit more :)

</comment></comment></comment><comment><USER14> How do you deal with naming conflicts?

<comment><AUTHOR> Great question :) If the folder name 'foobar' is taken, the app renames your folder to 'foobar1a1u20c' where the appended string would make it unique. It's not the most elegant way but it works. Moreover, at the end of the day you would have some CNAME pointing to it, so the name doesn't really matter that much.

</comment></comment><comment><USER15> Another one...?</comment>


Startup Quote: Reid Hoffman, founder, LinkedIn - <AUTHOR> http://startupquote.com/post/3504489915

<comment><AUTHOR> Good ideas need good strategy to realize their potential.

\- Reid Hoffman (@quixotic)

<http://startupquote.com/post/3504489915></comment>


Yes, Domain Tasting Will End - <AUTHOR> http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/

<comment><USER2> Ummm - hate to contradicate the title here but the 3rd sentence of that article is, "The argument was that the new fees were insufficient, and that tasting would continue to be profitable."</comment>


Ask HN: Recommend good mobile game wrapper for Android and Java? - <AUTHOR>

Which can enable<p>"pay per play", "rent a game" "subscription" (user can play as long he pays e.g. a monthly fee) or "buy to own" <comment><USER2> Sounds like a 'monetization platform' rather than a "wrapper".</comment>


Show HN: Launchpad – Django deployment made easy - <AUTHOR> https://github.com/sbussard/launchpad I wrote a set of scripts to make django deployment less of a headache. After much deliberation I decided to open source the project. <comment><USER2> One of the first thing this tool will try to do if invoked with the wrong options is to BLAST AWAY my ~/.ssh/known_hosts file. Why not be a good citizen and use ssh-keygen instead of rm?

I understand that this thing is intended for development environments, but to be honest in 2014 with all the container awesomeness we're seeing recently, it doesn't make sense, and if the first thing I see in that script is "rm ~/.ssh/known_hosts" I can't be attracted to the project.

Edit: Grammar.

<comment><AUTHOR> Good point. I didn't know there was another way to do it. I fixed it. If there's an easier way than this I would really like to know it. I created this project because deploying Django has just been one headache after another</comment></comment>


Ask HN: How do you keep track of software you've delivered to clients? - <AUTHOR>

I'm looking for good ways to keep track of which software (and versions) I've installed on my customers' infrastructure. The purpose of which is to know which customers I need to visit after a vulnerability has been found in a piece of software I've installed there.<p>Right now I'm using a simple spreadsheet, but I'm wondering if maybe there's something better out there? Something more tailer to the task? <comment><USER2> LicenseSpot or other License tracking software? But will take a day or 2 to get it setup how you want it.</comment>


Capybara - <AUTHOR> https://en.wikipedia.org/wiki/Capybara <comment><USER2> I assumed this would be about the DSP engine from Symbolic Sound. Though I am a fan of the large rodent creatures with a chill attitude.

</comment><comment><USER3> You can see these at the zoo?

<comment><USER4> Yes. I've seen them at a zoo in CA.</comment></comment>


Hacker news for your interests - <AUTHOR> https://github.com/joelgrus/hackernews <comment><USER2> I love the idea, but I'm a little bit surprised that you manage to have an accurate prediction with so few data and so much parameters.

I've try once to do something like that, I've ended with something extremly simple. The score of a news was: a bonus for the number of likes, a malus for the number of days, and a bonus/malus per domain. The domain bonus was auto adjusted when I readed a news.

Nonetheless, the best function in this reader was to remove the links I had already open. This allowed, each time I browsed the page, to only have new links to explore.</comment>