Open-source Patent Troll - <AUTHOR> I've been writing open-sourced software for a few years now, and never in all these years past have I ever had another person threaten me with patent action on something that I provided for free - for the developer community. Just because I feel bad for this guy, I am not going to post his email address or name, but I will share the email that he sent me:
"""
Azoff,
My name is [ Mr. Troll ]. I am writing you from a company called RazDog.com. We have several patents pending for the rights to navigate like a smart phone on any web content deployed through a browser. We have software which we have had publically available for some time.
We have been made aware of your software which appears to potentially breach our patents pending.
I need you to call me to discuss options ASAP.
Your valuable time is appreciated.
"""
In case you are wondering, the software referred to by Mr. Troll is most likely a jQuery plug-in I currently maintain called OverScroll (http://github.com/azoff/overscroll). I first released it into the public domain back in 2009 (see: http://plugins.jquery.com/node/8738), about the same time RazDog was apparently in the music business and had nothing to do with user interaction on the web (see: http://web.archive.org/web/20090503201355/http://razdog.com/consumers_info.aspx).
Never, ever, in my time as a professional developer did I ever think I would have to deal with this blatant disregard for open-sourced contribution and innovation.
Mr. Troll, you are a vulture.
- Azoff <comment><USER2> Issued patent != patent pending. Patent pending has no legal standing and is non-defensible. It just means something was submitted and may or _may not_ be approved sometime in the future (possibly years from now). Talk to a lawyer, but I'm pretty sure they'll tell you to ignore him. If the troll in question hasn't actually submitted a patent you could sue for damages.

If you were hit with an actual patent claim, the first question you ask is what is the patent # and which specific claims are they referencing. Then go back to any referenced patents and see if the claims are unique to the new patent. Of the unique claims then you can make a case if your product infringes or not.

<comment><USER3> As I understand it, defending a patent suit is _not_ cheap even if you're completely in the right.

</comment></comment><comment><USER4> Also note it's a crime to claim patent pending without an actual patent in the process. Of which there would be a number. They really frown on making false patent claims.

</comment><comment><USER5> Please do this the right way. Any issue concerning IP and claims of infringement or violation of rights requires due diligence on both sides. At a very minimum, you should read the transcript of Andrew Tridgell's talk on patent defense at <http://news.swpat.org/2010/03/transcript-tridgell-patents>.

That your software is open-source is entirely orthogonal to the issue of infringement.

</comment><comment><USER6> So, they have pending patents. And they think that your software is infringing on those pending patents. Those pending patents, which, being pending, have not yet been granted, and are therefor useless as far as litigation goes. Which makes your existing software prior art. Hmm.

Depending on how you're feeling, either tell the guy to fuck off, or try to get those (pending) patents invalidated.

<comment><USER7> You're missing the crucial point of submarine patents: if approved, they are enforced as of the date they were filed. So pending patents can in fact be used as a cudgel, to get licensees to pay for a guarantee that if the patent is approved, they won't be socked with outlandish royalty demands. It's like insurance. To a first approximation, the value of a pending patent is proportional to the probability that it will eventually be approved.

I'm reminded of Tony Soprano to an unhappy customer: "Satisfaction guaranteed, or double your garbage back!"

ps: recent rule changes mean that some patents (those that will be filed outside of the US) will be published 18 months after filing, even if they are not yet approved. Possibly not relevant here, as the troll would presumably want you to see the pending patent to prove the legitimacy of his threat.

</comment></comment><comment><USER8> I'm not a patent lawyer, but from what I can pull up from my patent law class notes: Troll is quite possibly blocked by the public use doctrine. Anything that's been in public use without being patented for a year or more goes into the public domain (35 usc 102(b) for anyone who cares). If he filed on or after June 23, 2010, he failed.

</comment><comment><USER9> Anyone tried out RazDog.com? It's basically an entire site as a JavaScript carousel - if anyone can dig up info on the pending patent it should be incredibly easy to shoot down with prior art.

Horrific usability, too.

<comment><USER10> They also hold another patent, filed in 2007, for an online media player with very vague detailings. I am a fan of patents, but this company is over shotting their bounds.

</comment></comment><comment><USER11> Having a patent pending is a scare-tactic use by alot of companies to scare off competitors. Some companies will keep re-applying for a patent even after being turned down, simply so they can keep displaying a "patent pending" mark on their product.

I'm no expert on patent law, but I would enquire as to which patent applications he's referring to (an ambiguous "we has patents" statement doesn't get them anywhere), and then I would check the applications and the filing party's previous filing history. If they're a pending troll, ignore and move on. If they don't have any actual pending patents relative to your work, ignore and move on. If your work predates his patent application, file a prior art declaration with the patent office against his patents, and move on.

Personally I dislike software patents to the extreme. I believe copyright is enough for software. If people want patent protection on their software, they should have to demonstrate working code that shows their concept in action, and they should submit the full source code with build tools and instructions. The point of patents is that 50 years after a patent is granted, the public should be able to pick up the patent and exactly replicate the original invention from the patent materials alone. I know that is certainly not the case for most modern patents, especially software patents.

</comment><comment><USER12> That you write OSS is fairly irrelevant to the situation, so far as I can tell. IANAL, granted.

</comment><comment><USER10> Have you read over the afore mentioned patent?

<comment><AUTHOR> No, because no reference was ever provided in the original email

</comment></comment><comment><USER13> Don't ignore him! Its would be a very good thing if you'd just call him and explain the prior art to him and gently steer him toward not wasting his time and money pursuing a patent that won't be granted.

Of course you might head off the serendipitous granting of a ridiculous patent that might fall into the hands of a real troll ala Lodsys later. If he refuses to listen to reason, you might look into sending the prior art to the patent office in reference to his application.

<comment><USER13> Downvote? Really? I just thought that maybe the guy might actually not be the awful troll that we instinctively leap to the conclusion that he is. He might just be a guy who really doesn't grok how all this works.

Could a simple call to find out really be that bad. (seriously IANAL so I really don't know)

I think he's just an idiot who happens to be inadvertently trolling. Not a professional troll. It seems like he really does want to sell his goofy cloud motion and probably thinks he's the new new. Whatever.

</comment></comment><comment><USER14> IANAL, but it may be good to get the patents he claims to have claim to, and discuss this with a lawyer.

</comment><comment><USER15> I had an email along these lines last year -- someone accusing me of violating his patent application.

Just junk it.

</comment><comment><AUTHOR> Wow, thanks for all the feedback.

I'm happy there are others who have dealt with this before. I hate to sound like a bleeding heart, but it is really sad that any troll can effectively axe an open-sourced project like this. I really hope that it won't come to litigation.

</comment><comment><AUTHOR> UPDATE: Mr. Troll decided to email me again today, slightly different tone:

"""

Azoff,

There are several options available to you along with an opportunity for you and or your company to make some money regarding your software. Please call me by Wednesday at [ Mr. Troll Hotline ].

Regards,

[ Mr. Troll ]

"""

<comment><USER16> If it's allowed in your jurisdiction, I'd suggest calling him and recording the call. Write a "script" beforehand of the things you want to say, and have a fallback line such as "I'm not sure of the answer, I'll have to follow up with you on that" if he tries to get you to admit to anything. Meanwhile, try to get him to over-reach in his claims and statements.

You might wind up getting some useful ammunition for later use; or if nothing else, a hilarious recording for further public shaming.

</comment></comment><comment><USER17> I think this is where the discussion comes in about whether or not to abolish software patents. It is disgusting that patent trolls go after OpenSource.

<comment><USER18> Open source doesn't really make a difference, there's still ownership, and there's still often corporate use. Someone suing over the GCC could sue Apple, Oracle, IBM, RedHat, etc, but wouldn't bother suing Linus or Stallman.

</comment></comment><comment><USER19> "In fact, the most common reaction we hear is Wow! literally."

Strike 2, RazDog.</comment>


Lawsuit illustrates Bitcoin's chargeback problem - <AUTHOR> http://arstechnica.com/tech-policy/news/2012/03/lawsuit-illustrates-bitcoins-chargeback-problem.ars

<comment><USER2> "Dwolla had advertised its service as having "no chargebacks."

I can't believe they ever had this in their terms.</comment>


Ask HN: Anyone want to build a Bitcoin Exchange with me? - <AUTHOR>

I live in the Cayman Islands ... so offshore and tax free for the exchange! <comment><USER2> Drop us a line at firstname.lastname@example.com - we released an online trading platform for physical gold, so security is our daily thing!

</comment><comment><USER3> What kind of help are you looking for?

</comment><comment><USER4> >...so offshore and tax free....

Please find something more socially responsible to do with your time.

<comment><AUTHOR> Please don't push your socially responsible expectations onto other people.</comment></comment>


Web designers should do their own HTML/CSS - <AUTHOR> http://www.37signals.com/svn/posts/1066-web-designers-should-do-their-own-htmlcss <comment><USER2> "I've worked with many web designers in the past who only did abstractions and then handed over pictures to be chopped and implemented by "HTML monkeys"."

Are there actually designers who don't have to get their hands dirty with HTML/CSS? I've never met 1 in my 8 years of designing and building sites. Sounds like a nice gig.

<comment><USER3> I've worked with many at various design and ad shops. However, they design for other media as well and aren't expected to know HTML/CSS. I've been handed "web" layouts in Quark before. It surprises me that the same would happen in dedicated web shops. Sound like bad hires to me.

<comment><USER4> Our graphic designer -- correction, art director -- does visual design and hands it off to production artists who turn it into HTML using Dreamweaver, or break it into Flash chunks. Want to know how big our art department is, including her? Three people.

<comment><USER5> Where I work too, there are designers who do mockups (in photoshop) who hand it off to developers to create them in HTML/CSS. They understand HTML enough although to not do bone headed designs that are really convulted to do. It saves me time from having to create it myself.

</comment></comment></comment></comment><comment><USER6> Argh, yet another controversial 37signals post. What's with these? I think DHH has a narrow view on web design.

If you're handing your HTML/CSS to a "HTML monkey" and they don't get the "it" stuff right (as opposed to the "around" stuff), then they are a BAD HTML/CSS coder. Period.

The baseline HTML/CSS coder, in my mind, should be able to get pixel perfect (or very close to pixel perfect) designs implemented with cross browser compatilibity (at least IE6 and Mozilla).

HTML/CSS coding is in most cases a solved problem. If you have the man power to segment design from the actual implementation, then all the power to you. It'll probably be more efficient that way. Where I work, we don't have that luxury, and we all have to do a bit of everything.

</comment><comment><AUTHOR> Good background here (in case you missed it)...

<http://news.ycombinator.com/item?id=208152>

<http://news.ycombinator.com/item?id=209991>

</comment><comment><USER7> 37signals is not a "graphics" or "design" company. I wonder why they post these kinds of articles. They can basically outsource a bunch of icons and logos then start building from there.

</comment><comment><USER8> Andddd I'm not clicking 37singals links anymore.

</comment><comment><USER9> Ah... designers vs. coders link bait.

</comment><comment><USER10> I wrote up a blog post about it:

<http://interfacelab.com/?p=16>

In summary, I find 37signals to be full of shit.

</comment><comment><USER11> 37Signals: We do it this way. People who do things differently are wrong.

<comment><USER12> _> People who do things differently are wrong._

They are just stating why they are doing what they are doing. Good information if you want to make use of it.

<comment><USER11> I appreciate a lot of things about 37signals products. The coding is much more solid than a lot of similar products, and they absolutely know what they're doing.

Their blog posts just come across as a bit partisan and dismissive on a lot of issues. Even when they're making good points, as in this post.

</comment></comment></comment><comment><USER2> Yeah could we get another 37signals post on HN today? Maybe a few more dups too and I'll be complete.</comment>


Just launched - Feedback please - <AUTHOR> http://www.kembrel.com/

<comment><AUTHOR> Also check this out: <http://apps.facebook.com/kembrel/>

As far as we know, we are the first to have a private sales store running inside Facebook

</comment><comment><USER2> I think you need an example of what it is on the front page, or at least linked from it. I think most people will be reluctant to register for something without knowing what it is.

<comment><AUTHOR> do you mean put some examples of deals on the front page?</comment></comment>


Estimate cost of mobile app development yourself - <AUTHOR> http://www.agicent.com/app-development-cost-calculator <comment><AUTHOR> Anyone can calculate cost of mobile app (iOS, Android) yourself by answering some questions on this tool, also feel free to give your feedback.

This is ofcourse not a replacement of manual estimation, but would give you a nice idea of the budget you should be taking for hiring an app development company.

<comment><AUTHOR> did anyone use this link yet? [http://www.agicent.com/app-development-cost- calculator](http://www.agicent.com/app-development-cost-calculator)</comment></comment>


Introducing the new PHP on Heroku - <AUTHOR> https://blog.heroku.com/archives/2014/4/29/introducing_the_new_php_on_heroku <comment><USER9> I think it's cool to have great PHP support on Heroku. PHP doesn't always get much love from a lot of the developer community, but it has its place and if nothing else, Heroku support means you can migrate your app there from a shared Dreamhost account if it ever blows up.

It's good to have options.

<comment> at-fates-hands >> PHP doesn't always get much love from a lot of the developer community.

This is odd since most people don't think of equating WordPress with PHP, but WP gets a TON of love from the development community.

<comment><USER10> the irony is that WP source and plugin architecture is written in textbook shit PHP from the 90s. (last i worked with it a couple years ago). i would not wish WP development onto my worst enemies. i really hope it gets displaced by something managable written in proper PSR-0 and >=PHP 5.5

in many ways, WP exemplifies PHP core devs' philosophy of "dont ever break existing ecosystem compat". PHP has some major WTF that lingers on because of this. i'm very surprised that it has been progressing at all considering how stubborn they are on even fixing completely obvious shit like "unexpected comma" errors written in Hebrew. wordpress takes this attitude to a whole new level :(

there is great, maintainable software written in clean* PHP; the only thing i've learned from WP is how not to write software.

<comment><USER11> What's your favorite example of great, maintainable open source software written in clean PHP?

I'd like to look at a good example to give it another chance.

<comment><USER10> \- Doctrine - <USER2>

\- Symfony - <USER5>

\- Silex - micro framework based on symfony components

\- Laravel - <USER5>

\- Slim - <USER5>

\- Swiftmailer - email/transport framework

\- Guzzle - http web service client

\- React - async i/o

\- reactphp/promise - <USER6>

\- AuraPHP - framework components

\- Ratchet - web sockets

\- Assetic - Asset Management for PHP

\- Piwik - Open Source Analytics

\- Monolog - <USER7>

\- Goutte - a simple PHP Web Scraper

many projects use modular components from these and others.

also check out some repos with a lot of stars [https://github.com/search?l=PHP&q=stars%3A%3E1&s=stars&type=...](https://github.com/search?l=PHP&q=stars%3A%3E1&s=stars&type=Repositories)

careful though, Wordpress is there also.

<comment><USER12> You forgot to mention the one that rules them all:

[https://github.com/composer/composer](https://github.com/composer/composer)

<comment><USER10> i half-intentionally left it out. not because it's poorly written, but because its design/architecture may be somewhat lacking.

[http://www.borfast.com/blog/i-hate-php](http://www.borfast.com/blog/i-hate- php) (see Composer section)

while i have not profiled it myself, i've certainly experienced how slow it can be with deep dependency graphs stemming from a few, common top level "require"s. i dont want its slowness to be equated to poor PHP perf in general or something equally unwarranted.

<comment><USER12> That article is just more of the usual bullshit used to bash PHP, maybe to make authors like himself feel better about not using it, and have a good laugh with other bitter peers. Haters gonna hate.

The author is comparing Composer to Bundler, which makes no sense because Composer does a lot more than Bundler. With Composer you can do things exactly the way you want. He says "I don't know what it does under the hood, if it clones every single repository of every required package independently of it being necessary", proving that he didn't even bother learning how to use the tool.

There is no way you can live with Bundler after having used Composer. Trust me, I was a Rails guy.

<comment><USER10> despite the tone, the author does make some valid points. im no php evangelist myself and find [http://phpsadness.com/](http://phpsadness.com/) quite objective

<comment><USER12> Well I only cared about Composer and all his points were wrong.

I'm not here to get into another PHP debate. Non-phpers can waste all their time hating if they want, and then go fight with all the problems they have with outdated components like Bundler, create hacks to simulate features that are native in PHP and other OOP languages (eg: interfaces in ruby, abstract classes in python), etc. I'll just get things done in a professional manner using what seems to be the best web platform of our time and then enjoy life.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> For anyone looking to get into PHP development now, check out Laravel:

[http://laravel.com/](http://laravel.com/)

It's a Rails-like framework for PHP, and seems to be pretty well designed. I wouldn't start a new PHP project without it.

<comment><USER14> Laravel is pretty awesome, but in my opinion, I think it borrows too much from Rails, and it does too much. Just knowing how to use Composer, PSR and a url router will take care of, like, 80% of PHP's headaches (even though, yes, none of this is even necessary, it's still _better_.)

The bare metal lack of abstraction in PHP that other languages have to have but PHP doesn't can be one of its strengths.

<comment><USER15> Ugh the same thing can be said (and has been said - and will be said!) about Rails, "Use Sinatra", ASP.NET MVC, "Use nancy", Python, "Use flask".

The idea is that Laravel gives you a huge solid launching pad and takes the busy work out of making a website run.

<comment><USER14> I've got nothing against Laravel (other than Blade, and my own personal prejudice against ORMs and html generators), I use it and I like it a lot. I'm just saying a lot of what people seem to hate about PHP can be avoided without dependencies on much besides Symfony by way of Composer or even a framework at all - although this depends on how you define "framework."

Which is an interesting question in and of itself - what's the minimum viable feature set for a modern PHP framework? I would say a PSR autoloader, Composer and a url router, and everything else is superfluous. Most people wouldn't even count that as a microframework, and I understand that. And it probably wouldn't scale for crap either.

Although one thing I _really_ like about laravel, which technically has nothing to do with laravel, is Artisan. Using .phar files as command line applications doesn't get as much attention as it should, maybe.

<comment><USER16> Do you know of any good standalone router libraries that aren't microframeworks? Specifically, support for placeholder values in URLs but dispatched through a controller setup, not a Callable for each route.

This would make the ultimate pico framework for PHP.

<comment><USER14> Offhand, no - I have one I wrote myself for prototyping but it basically just does callables (though it does support placeholders.) Support for controllers wouldn't be hard to add though.

</comment></comment></comment></comment></comment></comment><comment><USER17> PHP will be a tough market to enter for Heroku. It will be especially hard to attract owners of small PHP based sites. Almost every traditional, shared hosting provider supports PHP, prices are really low and setup is trivial (just dump PHP files in your public_html folder, set DB connection string and you're done). For larger sites, when scalability and availability become a significant issue, Heroku platform may be appealing.

<comment><USER18> Well, I dont know. It will all come down to cost,and the ability to manage CMSs on Heroku, I think.

Something like Wordpress is in my opinion not built for readonly paas,more for classic/upload with FTP workflow. And Heroku IS expensive while being very easy to use when one think his app as readonly backed up by cdns and databases.

I deployed a few Symfony projects on Heroku,it works well. But why choose PHP when I can choose my entire stack since not limited by host restrictions?

It's an interesting experiment nevertheless.

<comment><USER19> In fact it's exactly why we create FS bucket in the Clever Cloud product : [http://doc.clever-cloud.com/databases-and-services/fs- bucket...](http://doc.clever-cloud.com/databases-and-services/fs-buckets/)

<comment><USER18> Nice,Fellow french,here,i definetly need to check out your paas!

<comment><USER19> :-)

</comment></comment></comment></comment></comment><comment><USER20> Is this a strategy to increase the market potential of Heroku? It was mainly meant for "super fast rails" development and deployment, so I'm wondering why Heroku is targeting PHP.

Some would say its part of their "all platforms" deal, but then I'd argue its not much different than AWS. I'm wondering if they can bring some of the large portion of PHP websites that still run today onto their platform as a way to increase active and paying users.

<comment><USER21> Heroku employee here. I'm curious about this statement:

> I'd argue its not much different than AWS.

Could you expand here? What about the platform do you find similar and different? Which of that is good and bad? What were you using each to accomplish?

I'm happy to answer questions about Heroku. But I do like hearing unfiltered impressions and experiences before I taint them with my own world views.

<comment><USER20> The value proposition on the front page is "Build, run, and scale apps." Arguably, AWS does this and much more. AWS doesn't really make decisions on what technology you use, so if you wanted to run PHP on AWS it wouldn't take additional effort on Amazon's part.

Heroku probably does some nice workflow things, which is a feature, not a product. Whatever "timesavings" the tooling provides is an AWS feature release away from having parity.

Personally, I've only tested Heroku a couple of years ago out of curiosity.

So here is Heroku, working closely with facebook to bring the PHP platform to Heroku, while all along other hosting and infrastructure companies don't even have to worry about supporting PHP because they sell you scaled box-space, not application stacks.

I guess my whole point is "if you're building your apps with PHP these days, you are probably the type of shop that would benefit from the value-add of Heroku." That is, small to medium businesses with 1-2 web guys running a PHP app who don't know shit about hosting, deployment, or scaling.

Does that make sense?

<comment><USER21> We've had huge buy-in from Ruby as it's pretty difficult to set up and deploy a Ruby stack. Where as with PHP it's basically supported out of the box by pretty much everyone.

It's hard to sell Heroku which is why we have the free trial dynos. I find most people either love us see us as a huge value add, or don't understand why anyone would use us.

We're not simply a small abstraction layer, instead we support deployment at the application layer. Which again basically sounds like meaningless fluff unless you've already bought into the product. If I had to sum it up, i would say we're a company that provides a collection of small, sharp, extremely well integrated tools that seek to make your production development experience more pleasant.

For Ruby you get the app setup which is huge, but then you also get process monitoring out of the box so if your app goes down due to hardware failure we get paged at 3am instead of you. It's extremely easy to do things like have multiple staging servers, and I really like our CLI.

Instead of trying Heroku, I would recommend starting off trying out Heroku Postgres and using it through whatever server you deploy to right now. Get the credentials from the CLI.

On a production DB you get forks, and followers. We also have point in time recovery which is pretty fancy. Hacker destroy your DB? Forgot to schedule a backup? Rollback to 1 second before the deletions, and done. If you like Heroku Postgres, then I would recommend trying the dynos, and if not: agree to disagree.

For PHP the sell is management, stability, and consistency. If you're on a shared host your performance is very inconsistent as well as your uptime. If you're on a VPS you have pretty decent performance but now you have to manage everything manually, and even then there's that uptime thing we're not 5 nine's but hopefully above most: [https://status.heroku.com/uptime](https://status.heroku.com/uptime).

I honestly don't think we're right for every application, every developer, and every scenario. When we are though I hope to provide the best experience possible.

<comment><USER20> Right. OK so I had it placed correctly. Heroku is for guys that are not experienced in hosting, deployment, operations, or scaling. And that's a lot of small guys.

Where your customers get bitten is when their needs outgrow you, and it happens in weird ways (routing performance, multiple database types, scaling profile, management tools), and its different for each customer.

And you've nailed it as far as your target audience. So really, supporting extra bells and whistles for PHP is a way to capture more of that market - <USER8> small to medium shop run by a couple of dudes who have some shared host PHP app knowledge.

So, Heroku's value is really in its add-on services, not its hosting, or its scaling. PHP shops feed your every day hosting provider, so if Heroku can consolidate that market its a big win for Heroku. The taste in my mouth is this was spun as innovation when its not.

</comment></comment></comment></comment></comment><comment><USER22> Here's another post as well in relation to our support where we look back at where PHP comes from, but also where it's heading - [https://blog.heroku.com/archives/2014/4/29/php_a_look_back_a...](https://blog.heroku.com/archives/2014/4/29/php_a_look_back_a_look_forward)

<comment><USER23> Speaking about where PHP is heading, I think it's pretty important to mention the funding Fabien Potencier managed to get for SensioLabs (company behind Symfony):

[http://fabien.potencier.org/article/71/sensiolabs- raises-5-m...](http://fabien.potencier.org/article/71/sensiolabs- raises-5-million-euros-to-boost-the-symfony-ecosystem)

I haven't seen any mention of that on HN.

Symfony components are used in Laravel and upcoming Drupal 8. The funding above means that SensioLabs will continue to work on solid platform(s) that will bring higher quality development and standards to PHP.

Honestly, I'm pretty happy for that.

<comment><USER24> Symfony is the best thing to happen to PHP in a long time and the guys at SensioLabs are doing a lot of great things. It wasn't on HN because HN still thinks PHP equals Wordpress/Drupal and those codebases are horrible.

<comment><USER25> Which is unfortunate. Symfony + Composer is powerful elegant (yes _elegant_ ) stuff.

<comment><USER24> It is unfortunate indeed, because it's not just the software that is great, but the surrounding community as well who create a lot of great tools like phpSpec, Behat etc.

</comment></comment></comment></comment></comment><comment><USER26> plug: i'm co-founder of PHP-only-PaaS fortrabbit — seeing Heroku move in our direction shows me that we are doing something right. We see a lot of momentum in the PHP community — some call it a PHP renaissance. Laravel, Composer and lately Facebooks input with HHVM (& Hack) are the cornerstones. Of course PHP is not everyones cup of tea, but something to be taken seriously.

</comment><comment><USER27> This isn't "the new PHP", and I hope it is amended. Facebook making their own runtime by no means makes it newer than the official version produced by the PHP contributors/zend team until (if ever) it makes it into the core.

<comment><USER28> Don't read it so literally. They're just saying it's the newest PHP tech at Heroku. New as in "hip", "latest", "trendy", etc..

<comment><USER29> In other words, a more charitable parsing would be "the new (PHP on Heroku)" instead of "(the new PHP) on Heroku".

</comment></comment></comment><comment><USER30> I used Heroku for hosting my php site ([http://sea-hag.net](http://sea- hag.net)) for a while on the free tier. It was OK, but the DB add-ons were all pretty terrible (even on the lower pay tiers). In the end, I ended up getting a VPS and hosting it on that. Now it's lightning fast and I can't complain.

Heroku held its own for a while. I'd recommend it if you need to do some quick testing and get people on it to start, but I wouldn't pay for it.

</comment><comment><USER31> It's great for quickly hosting a static site on Heroku. Just name your HTML file index.php!

</comment><comment><USER32> Cool. Just in time for the end of free AppFog.

<comment><USER33> You mean the "free forever" AppFog tier that still had that "forever" promise a year ago? They sure have gone downhill since being bought by CenturyLink.

<comment><USER34> Nothing is forever, just ask the suckers who still had stuff hosted at Textdrive (like me)

</comment></comment></comment><comment><USER23> Can't get over the way first sentence sounds:

> PHP developers are makers at heart.

What is the difference between a PHP developer and any other developer? If they tried to stick this in the middle, I could swallow it but opening sentence is just ridiculous.

<comment><USER21> Hello, I helped edit the blog post and actually proposed this sentence. I love this reaction:

> What is the difference between a PHP developer and any other developer?

It's exactly the type of response I was hoping for. In early drafts we got a common "big whup" response from some readers. Most posts on PHP these days only do well when they bash the language, very few focus on __why__ they use PHP: which is to create things. Yes, all developers create things, and PHP developers do as well. This sentence serves to validate PHP and their developers. So to answer your question:

> What is the difference between a PHP developer and any other developer?

Nothing.

Even if you still don't buy my explanation. Maybe you can stomach some non- wordsmithed docs: [https://devcenter.heroku.com/articles/getting-started- with-p...](https://devcenter.heroku.com/articles/getting-started-with-php)

<comment><USER23> I still don't buy it. I find that type of sugarcoating generally unnecessary and distracting in negative sense, especially when you start the announcement with it.

Either way - thanks for taking the time to explain.

<comment><USER21> No worries. I start a lot of writing with a "hook" first sentence and try to end with a memorable sentence. I then diagram the work into bullet points and try to make sure all key takeaways are obvious, note I didn't actually work on the _final_ draft of this doc. I was pleasantly surprised to find they left my first sentence in there.

Some hooks are better than others. I'm an engineer before a writer. It sucks that we have to market tech things, but the sad truth is most announcements that have no "hype" get no hype. I do a bunch of open source work, and some projects I promote and they do well, others I don't promote and they don't do as well.

Generally at Heroku I try to only put one or two flashy sentences in. The rest should be direct substance delivery, though that's not always the case. Thanks for taking the time to click the link, read, and comment!</comment></comment></comment></comment>


Let's Admit Why There Are So Many "Job Hoppers" In Startupland - <AUTHOR> http://mixergy.com/lets-admit-why-there-are-so-many-job-hoppers-in-startupland/ <comment><USER4> My thoughts based on years of representing such companies:

1\. Non-funded startups typically don't have employees or, if they do, they are employee-founders. If the cash isn't there to support salaries, you won't have payroll. People can and do get misled in non-funded companies, though it is the rare exception and by no means the rule, since most of those involved understand they are taking a flyer and that nothing may come of their efforts unless and until the startup gains sufficient traction at least to get funding.

2\. Most of the abuse involving outright misrepresentations concerns _funded_ companies that hit hard times and then tell their employees that they must stick with a failing situation, and endure the accompanying hardships (missed paychecks, etc.), in the name of deferring their reward until the company can rebound. In such cases, employees are in effect being asked to take the risks of founders and yet are often given nothing more than their deferred pay in case the company does bounce back - that is, having taken on an indispensable role to enable the company to save itself, they get no additional equity or other reward for the hardships they undertook.

3\. Funded companies also are more prone to mislead employees with tall talk about what the company will supposedly do and why the options held by employees will be worth so much. Yet, in doing so, they don't tell their employees anything about the capitalization of the company itself, thus leaving the employees with a sense their 50,000 options or whatever will make them rich while in reality they may represent only a miniscule percent of the company and have only a small upside even in a success case. At the same time, no one is ever told about VC liquidation preferences, which can easily be used in many cases to wipe out the interests of the employee-shareholders in an instant as soon as anything goes wobbly with the company.

4\. Opportunities come and go rather quickly in the startup world and it may just be a simple fact of life that employee tenures will tend to be shorter in such an environment for reasons having nothing to do either with flakiness or opportunism on the part of employees or with deception or abuse on the part of employers. I think it is a mistake to overstate this in either direction in seeking to ascribe generalized motives to one side or the other.

<comment><USER5> minor, but I object to your "Non-funded startups typically don't have employees" statement. Or perhaps profitable startups don't qualify as startups anymore?

<comment><USER4> I could say that I just had my Silicon Valley blinders on but even then this was a stupid oversight on my part, as I represent a good number of profitable self-funded ventures as well as the prototypical bootstrap ones - I was obviously thinking only of the typical bootstrap startup in making the statement as I did. Thanks for the clarification.

</comment></comment></comment><comment><USER6> I think this debate can be summed up as:

Flakes are often Job Hoppers. Not all Job Hoppers are Flakes.

Correlation, not causation.

Also, I'd like to see some objective stats here like "do companies with lots of job hoppers do better or worse, here is the data"

Vivek Wadhwa cited in his studies job hopping as an aggregate positive for the economy of silicon valley and its emergence as the prominent startup hub.

[http://techcrunch.com/2009/10/31/the-valley-of-my-dreams- why...](http://techcrunch.com/2009/10/31/the-valley-of-my-dreams-why-silicon- valley-left-bostons-route-128-in-the-dust/)

<comment><USER7> _Flakes are often Job Hoppers. Not all Job Hoppers are Flakes._

Finally, someone taking a shot at that misconception. Just because some people advance their career and improve their conditions by changing employers doesn't mean they're unreliable or incompetent.

Quite often it's the competent people who get sick and tired of a crappy job, widespread incompetence, excessive office politics and stuff like that and they decide to move on. They tie the loose ends, dot the i's, cross the t's and start looking for a better opportunity.

It's not just the startups that mislead people, either. It's just that a big company will lie to you about other kinds of stuff.

<comment><USER8> "doesn't mean they're unreliable" Well, from the point of view of an employer, it kind of does. They never know when you will leave for a new job.

<comment><USER9> I disagree - if the hoppers are hopping because they are not getting the professional growth they need, or that they think they're being taken advantage of, then that's highly predictable for you as an employer.

Are you treating your employees fairly? Do they feel like they're contributing, or are they writing dead-end code?

You know when they will leave for a new job - when you start treating them like trash.

<comment><USER10> Here's a prediction: If a company's environment is shitty...

1\. The best people will quit.

2\. The median people will whine and make the office a miserable place.

3\. The worst people will put their heads down, terrified that they will get fired or laid off.

Consequence? The best people still in their chairs will be the ones with the lowest morale.

</comment></comment></comment></comment></comment><comment><USER11> Turnover rate: a FANTASTIC question to ask at your next job interview. Keep them on their toes.

We _love_ the people who ask hard questions. If the person interviewing you doesn't: don't work there.

Thanks for that post.

<comment><USER12> I've never had any luck getting a serious answer to that question. It's always hand-wavy fluff.

It's the employer's equivalent of "what is your biggest weakness". It just tests their ability to BS.

<comment><USER13> You can keep asking the question in other ways:

      "How long was the person before me here?"
      "What's the average length of time someone stays here?"
      "How long have *you* been here?"

If you really want to know the answer, you just have to keep asking. Turnover rate is the first real question I ask. (Also: the lack of an answer is an answer on its own.)

<comment><USER14> Mentioning a "person before me" in an interview is a bad idea, because it brings forth associations you might not want. Also, there might not be such a person.

The second and third questions are good, but short tenures could also signify a rapidly growing company (which is something to be wary of, but not for the same reason) like Google in 2006.

<comment><USER15> "short tenures could also signify a rapidly growing company"

Sure, but if _everyone_ interviewing you are less than a year in, where are all the people who worked here before?

And why are you being interviewed mostly or exclusively by junior team members who haven't proved themselves yet? Is the company entrusting the selection of successful employees to newbies who haven't yet proved they can be such?

An interviewer for a company in the middle of a growth spurt should be able to explain that, quote some enticing growth figures, and mention that "almost all of the original team members are now project leaders and executives... in fact, if this goes well, you'll meet some of them shortly".

</comment></comment></comment></comment></comment><comment><USER15> This whole discussion about "job hoppers" is so bogus.

Employment is a relationship. It has two sides. When one party decides to end it, the most common reasons are:

1) Other party's chronic inability to respond and satisfy the breaker-upper's needs. 2) A competitor coming along who satisfies those needs much better.

Employers _regularly_ break up employment relations for those two reasons. But now some CEOs and VC managers will have us believe that it's wrong for employees to do the same to them.

Employers are expected - nay, obligated! - to fire employees who fail to meet performance expectations. But if an employer fails to meet your compensation expectations, and you leave, the Susters and Calacanises shall publicly insult you and announce they will not hire you, and nobody else should either.

It is telling that only very specific employers and very specific dream- dealing businessmen are among the mob shouting indignantly about loyalty and morality. When was the last time Google or Palantir blogged petulantly about "Generation Y" and "trophy kids"?

Suster, Calacanis et al are reacting to their own failing at keeping employees, with all the grace, maturity and effectiveness of that girl you dumped, who went out on the street and shouted about what a terrible person you are to leave her, and how nobody else should ever trust or date you.

Mature, successful employers do not waste their time on that. They're too busy making great products with their happy, motivated, tenured employees - <USER2> bidding polite farewell to those who should or want to move on.

This article is spot on. Startup executives are world-class dealers of dreams. They need to be more weary of selling to their own employees. Too many bright engineers work insanely hard for a year or two, then discover all they're getting is fairy dust, and quit. Why don't Suster and Calacanis write an article about that?

It's most striking when a top employee leaves for a company that's not a startup. Take that engineer that left Mahalo for Yahoo recently. Suster and Calacanis call him a flake, yet how much you want to bet he'll stay at Yahoo longer than a year?

And since when is it acceptable to attack an ex-employee that way, sleazily keeping his name out, when everyone on the internet knows who the epitaphs refer to?

These people are sore losers, and they'll keep losing until they figure out what that "dying company" is doing right that makes their best engineers "hop" there rather than labor at their own enterprises.

All they do right now is poison and taint an otherwise healthy, open and mature dialogue between employees and employers.

<comment><USER16> You're way off base. \- I haven't lost any employees so painting me with that brush is wrong \- I never made any commentary on the guy who left Mahalo - <USER3> wrote him a private email making it clear that my commentary had nothing to do with him (I didn't even know that story when I wrote my post) \- I never publicly insulted anybody \- I made a balanced argument that if people leave a few employers early in their careers it's fine. If they make a career out of changing jobs they'll find it hard in the long-run to wind up in senior positions.

And while we're on the topic of insulting posts or people on a rant, why don't you re-read your text and think about how IT sounds

</comment></comment><comment><USER17> As PG says, "Economically, you can think of a startup as a way to compress your whole working life into a few years."[1] The time scales that people use to define "Job Hoppers" is wrong. At most big companies you cannot learn or accomplish much in a short time-frame because things move slower. However, in a startup 6 months is a long time to do something concrete.

[1] - <http://www.paulgraham.com/wealth.html>

</comment><comment><USER18> The best thing an employee can do is ask themselves "Will I be happy _right now_ if I take this job?" Working for a company because they've promised you stock, or career advancement, or a mission in life is a surefire way to guarantee disappointment when the promises fail to pan out. Even the best- meaning managers tend to be grossly optimistic when pitching their companies to a new hire. If the job is satisfying from day one, nothing that fails to happen down the road will be a cause for bitterness and regret.

<comment><USER19> "Even the best-meaning managers tend to be grossly optimistic when pitching their companies to a new hire"

I've learned to view a job interview more like a sales-pitch. Once you view it this way, you become a lot more thorough with your questions.

</comment></comment><comment><USER20> What if I want a new and large challenge every two years? Your efficient is my stagnation? Just asking.

</comment><comment><USER21> At my last job it took me 3 months to find out that the strike price my options received was 3x what my offer letter hinted it would be. That gradually affected my motivation until I left, and I never exercised my options. Not intentional, but misleading.

</comment><comment><USER22> This is an aside, but I'm starting to realize how many gripes, on both sides, are the result of a very poor hiring system.

Kathy Sierra, a while back, wrote a truly eye-opening blog post on "the hollywood model". You're fired at the end of every job, and your job security is your reputation.

I don't love everything about the way hollywood works, of course, but one thing's for sure - they give credit. They _list_ credits. Of course, people can grab credit they haven't earned, and I'm sure that people who have succeeded don't always get the credit they are due... but at least the system _intends_ to give credit.

As a dev, when was the last time you got a by-line? If you release an excellent product, is there a "credits" list where the UI designer, the "producers" (proj managers?), developers are listed? Maybe in the code itself, but that's proprietary.

So instead out industry relies on these stupid indicators, which lead to articles about how "job hoppers are bad". Well, some job hoppers are people who opportunistically abandon a good team that doesn't deserve it, and others are people who people who are too good to waste any more time on a crap situation.

Job hopping, code tests, three minute phone call reference checks, university degrees... hey, I use these things too when I'm hiring. That's what you do when you interview unknown people whose work you can't immediately identify. And I do the monkey dance when I'm interviewed too, because that's what you have to do.

But man, there has got to be a better way... a big goal of my career is to get to the point where the people who interview me have better ways of knowing what I can contribute.

</comment><comment><USER23> Its simply a byproduct of being in an emerging market. I don't know much about The Gold Rush, but I'm guessing people involved with it weren't staying at their jobs very long.

</comment><comment><USER24> Genius = "TheFunded.com for employees to _privately_ rate their employers"

<comment><USER25> This is actually one of the use cases we're most proud about on Unvarnished ( Community-powered professional reviews <http://www.getunvarnished.com> ): the ability for information about hiring managers to float as well as information about employees.

So if a boss has high turnover rates under him, the idea would be that the reason why could float on his Unvarnished profile, such that would-be employees can get this information from the market _before_ signing up to work for him.

Awesome hiring managers should get credit for being awesome. Bad hiring managers should not be able to hide behind information asymmetries. So too with employees.

Information liquidity is a powerful thing!

<comment><USER26> I heard about you guys on NPR, but didn't call in because I was driving. I have a few concerns.

1\. Your basic value proposition rests on getting people to pay money to have the ability to respond to things said about them. That's going to leave a bad taste in people's mouths.

2\. Many people (like me) have deliberately chosen to not join facebook. We can't even try to address issues we see.

3\. Identity is much more complicated than you acknowledge. My name is Ben Tilly. I'm at Google. People by the same name can also be found in a US college, doing graphic design in New Zealand, and being a nurse in England. Just to name a few that come up off of the top of my head. How do you tell which Ben Tilly should be able to respond to a bad comment about someone named Ben Tilly at Rent.com?

4\. Anonymity is not so easy to protect. Only a small fraction of people comment online. A given manager only manages a small number of people. If a negative comment appears, frequently it is surprisingly easy to make an educated guess. If the comment is at all detailed, an analysis of writing style will usually confirm that guess. Unless a large fraction of people in your environment are commenting, the level of anonymity is limited. (Particularly if the boss can get access to proxy logs saying who was visiting getunvarnished, when.)

<comment><USER27> _Many people (like me) have deliberately chosen to not join facebook. We can't even try to address issues we see._

I wouldn't call this "can't". If you actually _couldn't_ use their preferred identity provider, that would be different (and it could happen; I had a lot of trouble getting a Facebook account at all a few years back, due to my unusual name). But choosing not to sign up is not the same as not being able to sign up.

<comment><USER26> In NPR they said that they had checks that your Facebook account was sufficiently well established. They didn't say the exact criteria, but my impression was that it needed to have existed for a certain time, and have had certain levels of activity on it. This is to prevent people from creating throw away accounts, commenting libelously, then disappearing.

The unintended consequence, of course, is that people who don't have a Facebook account can't just create one. Instead you have to create one, use it until you have a sufficiently well-established identity, and only then can you use their service. Which is a high barrier for people who actually don't have a Facebook account.

</comment></comment></comment></comment></comment><comment><USER28> I think I'm a bit naive, but how can a high dollar exit leave your vested shares worthless?

<comment><USER15> Many, many ways.

First of all, "high" is relative. The exit may be high, but still not cover the funding, so all the proceeds go to the funding entities (the VCs) and maybe a few top executives / founders. That happens in countless startups that sell for $50m after raising $30-40m. Even "senior" employees get basically nothing.

Another common issue is dilution. Your vested shares can and will be severely diluted. Again, the VCs and maybe the founders are the only ones with any control or protection over this.

A lot of other interesting things can happen at or around that all important payday. You may want to read about how things like IPO and other liquidity events are actually handled by law. Surprisingly few startup employees do, and this stuff is far from trivial - there's a reason why Goldman et al pay the best and brightest to figure this stuff out.

All of this is doubly true if the founders / execs are untrustworthy / morally indifferent and actually strive to dilute or otherwise deprive you.

<comment><USER29> Our very first investment agreement (3i as main investor with a local VC doing the legwork) had a table of equations defining various things that would effect how much founders and option holders would get in the event of an exit. Working out what these actually meant was non-trivial and we argued strongly against them - no luck.

Ironically when we went public we made a chunk of money from the very ratchet agreements we had argued so vigorously against (combined with help from the taxman).

</comment></comment></comment><comment><USER30> Can anyone please explain to me what he means when he says that 'most' stock options become worthless even when the startup is sold for a hefty profit? I am quite confused by how they could be devaluated like that.

<comment><USER31> I think stock dilution, is a big concern. With each round of funding, and the more stock they issue, this makes your stock worse less unless they can guarantee it. Im not an expert ( please someone expand), but my simple understanding , is something like lets say you get options to buy 10 stock out of 100 total shares, thats a lot. But then next round of funding they issue more stock and now you still have the option to buy 10, but there are 1000 outstanding now. What you had before is worth a lot less.

</comment></comment><comment><USER32> You also forget the other factor, startups fail often.

</comment><comment><USER33> Let me take a moment to rebut this.

"Stick with me and you'll get rich kid" _I've heard of CEOs who actually sat their employees down and showed them how rich they'd be based on what price the company is sold for. ("If we sell for a billion, I get a jet and you get a yacht.")_

I've had someone tell me this before (read my iStoleYourStartup post) and I sort-of got the feeling from the beginning it was a sham. I played along because I wasn't losing anything as I was doing it on the side, but I knew this speak was shady from the start. Not looking twice at this is type of mentality and behavior is a failure on one's own part.

"I'll mentor you." _Most startup CEOs aren't ready to mentor anyone. They're still trying to figure things out for themselves. Even if they could, where would they find the time to mentor?_

What type of history does this CEO have? Are they a serial entrepreneur? Have they made multiple exits or IPO'd other companies in the past? Are they mentoring you under the pure prospect of being a mentor? Again, this takes intuition and judgement.

"We'll change the world together, you'll see" _that's when changing the world gives way to "just increase page views!" and the job becomes more about the mechanics of SEO and link-baiting._

Every CEO of a distruptive start up will want to "change the world." Just because most of them are wrong doesn't make them liars or criminals. When the default to "increase page views," they simply don't have the experience to perform under pressure. This goes back to the second point about CEO career history.

To the point about why he is writing the article in the first place, saying employees are trained to behave that way is removing accountability from the employee who could very easily provide value on his own terms.

I don't believe there is any sort of "solution" as it in the end every developer is accountable for how much of their career they are responsible for. Ever heard the phrase, "its not the jobs you are given, but the jobs you take."

Every single developer in the world has the ability to make their own image, brand, expertise, and career. Real job hoppers know this - employers that don't provide their vision get left behind to ones that _will_ cater to _their own_ demands.

This article is attempting to protect any negative _job hopper_ image with malfeasance on the part of the employer - but only re-enforcing the "employer"/"employee" relationship in the process.

I guess my entire point to this mini-rant is that job hoppers make their own careers, choose trust selectively, and provide value at a level that they can make their own terms.

Downshifting to accusing that the second party is intentionally misleading (even though this can and does happen sometimes - as it did to me), and avoiding taking accountability for one's own actions is delaying the learning process and avoiding change.

If you "hop jobs," let _you_ be the reason why you are leaving, not someone or something else. Take responsibility for your own career, and only give people trust who have earned it.

<comment><USER33> My message of "take responsibility, accountability, and ownership of your own destiny" gets voted down. When you're 40 and still a worker bee and wonder why it didn't work out for you come back to this post.

</comment></comment><comment><USER34> When I was still a wage-slave, I hopped jobs because most start-ups are run by people who have never done this before, and they create lousy work environments.

I also like to leave other peoples' companies every year because I'm a systems engineer, and most of my work is front-loaded. After I've been at a company for a year, my systems are automated well enough that I have little to do but maintain or grow, and I want to be more in life than a systems janitor.

Plus, start-up compensation sucks. If I took a job tomorrow, I would make roughly $200k doing SRE or equivalent at an established company .. or $100k and 15 basis points of stock options vested over 4 years at some me-too start- up whose business model looks a lot like that south park underwear gnomes episode.

Not to mention that most companies do their best to over-hire because they really feel that their problems are incredibly complex and unique, just like all the 6 other companies who got funded in the same marketplace that year.

And, it's just a good investment strategy. Leave a start-up every year as soon as you've gotten your first 25% worth of stock options vested. In a decade you might see $100k for your trouble.

</comment><comment><USER14> I don't think the misleading of employees is endemic to startups, at all. It's also not always intentional; people overestimate what they can do for the new hire in terms of mentoring and support, and business tends to reward those (at all levels) who make big promises.

<comment><USER35> Yeah, but about the second time you realize you broke your promise to a new hire you should be changing what you promise (or fixing the real problem, if that mentoring and support is indeed needed).

<comment><USER14> I agree wholeheartedly. One issue is that every "promise" is a bit unique. HN posters are big on mentoring and interesting work, which are subjective qualifications, but this is not the case for everyone. Some people just want a salary and a chair-- much easier to promise.

The incentive to mentor is long-term. It benefits the company later on, and loyalty is an asset for the person doing the mentoring (his proteges might move with him if he gets sacked). Unfortunately, few people think this far ahead. In the short term, mentoring is an expense.</comment></comment></comment>


The Hunt for Elusive 'Dumb' Rules - <AUTHOR> http://www.nytimes.com/2011/01/22/business/22regulate.html

<comment><USER2> "Dumb" is the wrong metric. "Costs in excess of benefits" is the correct one. But this is hard, because it "ought" to be done in terms of costs to society and benefits to society, but instead since the government is doing the audit it gets analyzed in terms of costs to government vs. benefits to government. (How could it be otherwise?)

The cost to the government of a new regulation is zero. Either they will appropriate the money from the endless money fountain to pay for the necessary expansion, or they will simply fail to enforce it at their discretion. The benefit to the government of a regulation is always positive; if nothing else they get the choice of enforcement, and the corresponding power.

It is no surprise this system never produces results, beyond cosmetic fixes. I don't know what the solution is but somehow the incentives to the government have to be fixed first.

</comment><comment><USER3> Saccharin _is_ toxic waste. I don't see the problem there.

(Okay, Wikipedia tells me it's no longer considered carcinogenic, but certainly it was considered so during a period in which it continued to be used as a sweetener.)</comment>


Looking for Co-Founders - <AUTHOR> i am looking for Co-Founders who are interested in VR/AR Gaming. My goal is to finish the development of the ATOC Gaming Gun. For more information about the product just visit the website. http://www.atoc-gaming-gun.com <comment><AUTHOR> Right now an Android Coder is needed with experience in sensor fusion. A CAD Designer and a PR/Marketing Manager.

<comment><USER2> An interesting project and welcome to Hacker News.

There is a monthly "Who is Hiring" thread where the community believes it appropriate to post job offers. The thread is posted at 11am Eastern on the first business day of each month. The next thread will be on August 1, 2016.

Otherwise, posting employment offers is generally discouraged, though the site allows companies directly affiliated with Ycombinator some latitude.

Good luck.

<comment><AUTHOR> Ok, thanks for the tip with the Who is Hiring thread. Will post there.</comment></comment></comment>


How RSA Works: TLS Foundations - <AUTHOR> https://fly.io/articles/how-rsa-works-tls-foundations/?twitter <comment><USER2> I find the description of the RSA math pretty confusing. And I'm saying that with a minor in math and a CS degree specializing in security; I've don't this before, just not in a while.

For example:

>In order to generate e, we'll need to find a random prime number that has a greatest common divisor (GCD) of 1 in relation to ϕ(n).

How can a prime number have any divisor that isn't 1, let alone a gcd? Either that's mistaken, or it's unnecessary to state.

There's also no explanation of what purpose the totient value is. The author simply states it's needed, but not what value it provides.

In short, it feels like it's written for people who already know the answers, not for people trying to learn.

<comment><USER3> > How can a prime number have any divisor that isn't 1

What they mean by "gcd of 1 in relation to" is what we call "coprime".

5 and 3 are coprime because nothing but 1 divides both at the same time.

> what purpose the totient value is

it allows you to compute the private key out of the public key (only possible if the totient is coprime with the public key)

<comment><USER2> Yes, but why? Just saying "here's the algorithm" doesn't really explain why it works.

</comment></comment></comment><comment><USER4> A better title would be "How RSA does not work".

I'm a bit annoyed by many of these crypto introductions that explain textbook RSA, which is not something anyone uses in a real world application. It is crucial for RSA to use a padding mode and that's where all the fun comes in and what decides about how secure the thing you're building is.

</comment><comment><USER5> Noticed that this page worked on Chrome, but not on FF.

On FF (57.0.2) Windows 7, the message is as below:

Error 1010 Ray ID: 3cc3b2b85d0b9300 • 2017-12-12 21:15:17 UTC Access denied What happened?

The owner of this website (fly-io.ghost.io) has banned your access based on your browser's signature (3cc3b2b85d0b9300-ua48).

Not sure if the author or website owner had a beef with FF.

<comment><USER6> This is CloudFlare helpfully preventing you from DDOSing Ghost. We're working on bypassing CF for our ghost stuff, sorry about that.

<comment><USER7> If you have extra page rules, the "disable security" tick on `[https://fly.io/articles/*`](https://fly.io/articles/*`) may stop this kind of protection.

<comment><USER6> It's not actually our CloudFlare site, unfortunately, we're proxying Ghost Pro through our service (so we can serve `/articles/` on the same hostname).

</comment></comment></comment></comment><comment><USER8> Can someone explain this section some more

>Considering that we need a distinct key for each individual, that exchanging keys with each person would be a significant computational burden, and that there are more cryptographic functions needed than simply exchanging keys, new methods arose.

Isn't this exactly what RSA does, exchanging a private symmetric key with asymmetric crypto? The next paragraph makes it seem like RSA does something different.

<comment><USER9> Most excellent question, kss238. The next part in the series, which breaks apart the different parts of a TLS ciphersuite, was just published: [http://fly.io/articles/how-ciphersuites-work/](http://fly.io/articles/how- ciphersuites-work/)

It should answer your question, in similar spirits to that of this article. Thank you for reading and I wish you well.

<comment><USER10> What is the rest of the context of the Golang code snippet in that that link?

<comment><USER11> It's most likely to be Fly-specific, but you could replicate this behavior with passing appropriate to tls.Config#GetCertificate ([https://golang.org/pkg/crypto/tls/#Config](https://golang.org/pkg/crypto/tls/#Config)). You could then have something like that :

      GetCertificate: func(helloInfo *tls.ClientHelloInfo) (*tls.Certificate, error) {
      	return myGetCertificateImplementation(checkClientSupportForECDSA(helloInfo))
      }

You would see what curves/ciphersuites are supported by the client and check that against what you'd be supporting (if you use LE than that's more than likely going to be ECDSA with P-256). You would then return ECDSA cert (if one exist) for supporting clients and fallback to RSA certs. :boom: :D

<comment><USER10> Thanks, cheers.

</comment></comment></comment></comment></comment><comment><USER12> I just made a quick Python implementation (3.6+ only as it uses the secrets module)

[https://github.com/mcdallas/rsa](https://github.com/mcdallas/rsa)

<comment><USER13> Nice! I also did something similar during my basic crypto course.

I'll just show my implementation of Wiener's attack, which shows that RSA can be super weak if you don't choose your private key with a grain of salt.

[https://gist.github.com/lou1306/df1bfa60e247b4084149139a97da...](https://gist.github.com/lou1306/df1bfa60e247b4084149139a97dab761)

</comment></comment><comment><USER14> interesting, these folks at fly.io sure put out a lot of content!</comment>


"You Don't Know JS" Book Series - <AUTHOR> https://github.com/getify/You-Dont-Know-JS

<comment><USER2> I've taken a training class from this guy before in San Francisco. He's pretty cool but he tries to push his own APIs pretty heavily which I found to be pretty annoying. Other than that it was good.

</comment><comment><USER3> (Free) JavaScript Books:

[http://codecondo.com/free-javascript-books/](http://codecondo.com/free- javascript-books/)

<comment><AUTHOR> Great resource.

</comment></comment><comment><USER4> Can anyone compare/contrast this with the book Secrets of the Javascript Ninja, by John Resig and Bear Bibeault?

I've got a copy of that around that I've been meaning to read for a while.

</comment><comment><USER5> Scope and Closures was very instrumental for me in capturing some JavaScript's slippery concepts. Recommended.

<comment><USER6> I was going to post the same thing. It is a great book if you have already some basic knowledge of Javascript but want to really understand the language and how to use it.

</comment></comment><comment><USER7> Well the comments in here convinced me. Just purchased Scope/Closures and This/Prototypes.

Looking forward to taking my understanding of jack shit to the next level.

Thanks for making this Kyle.

<comment><USER8> I'm honored to see people are finding it useful!

The truth is, we _all_ don't really fully know JS, and we all need to work on knowing it better. The books are my way of learning it, and hoping that others can learn along with me. :)

</comment></comment><comment><USER9> Ooh, yes!! I've actually been writing a little something like this myself, but way more incomplete and so on.

If you think either function or array is a type in Javascript, you have more to learn. (For example.)

</comment><comment><USER10> I attended a conference and took an all-day workshop from the author of this series. He covered a lot of the content from his books in the workshop, and it was phenomenal. Highly recommended!

</comment><comment><USER11> I read this book a little when it was in its infancy. The author does a good job of explaining the closures

</comment><comment><USER12> Very cool, I remember this was a kickstarter project. Glad to see it in completion. [https://www.kickstarter.com/projects/getify/you-dont-know- js...](https://www.kickstarter.com/projects/getify/you-dont-know-js-book- series)

</comment><comment><USER13> Nice double entendre

<comment><USER8> glad you caught the joke. :)

</comment></comment><comment><USER14> Is there a bundle pack on the O'Reilly site? Like some kind of discounted buy all together deal?

<comment><USER8> There will be once I get the book series finished (five titles expected). :)

<comment><USER14> Ah, well a preorder bundle would be great! Get the two finished ones and the in-progress ones with the fifth pre-ordered!

<comment><USER8> Thanks for the idea. I'll pass that along to my editors at O'Reilly. :)

</comment></comment></comment></comment><comment><USER15> Ah, I didn't know that JavaScript has labeled statements.

</comment><comment><USER16> pdf?

<comment><USER17> Right here:

Scope & Closures: [http://shop.oreilly.com/product/0636920026327.do](http://shop.oreilly.com/product/0636920026327.do)

this & Object Prototypes: [http://shop.oreilly.com/product/0636920033738.do](http://shop.oreilly.com/product/0636920033738.do)

Types & Grammar: [http://shop.oreilly.com/product/0636920033745.do](http://shop.oreilly.com/product/0636920033745.do)

Async & Performance: [http://shop.oreilly.com/product/0636920033752.do](http://shop.oreilly.com/product/0636920033752.do)</comment></comment>


Amazon Attacking Apple's iPad Mini on Homepage - <AUTHOR> http://www.amazon.com/?kfvsim

<comment><USER2> In the real world, this is just called marketing, not "an attack." I know HN is pretty much a punchline anymore but seriously, moral outrage over an ad comparing the product it's advertising against a competitor while casting the competitor in an unflattering/unfair light?

That's all advertising ever, why in the holy hell does this matter to anyone here?

edit: Thank god, it was removed from the front page.

</comment><comment><USER3> I am really sympathetic to Amazon here, but to not be misleading, the right column would need to have items such as does video editing with iMovie or equivalent, has cameras and microphones, runs office productivity suite, runs digital music recording and editing studio (GarageBand), etc. My understanding is that the Kindle doesn't really have much software available for it. If that has changed and the software is now comparable to what is available on iOS, Amazon should make that really clear. Obviously it is a huge issue and not some minor thing that should be left off a comparison chart.

The claim that the iPad is incapable of playing HD movies seems to be false based on commonly accepted definitions of HD as being 720 and up. They should define what they mean so as not to give the appearance of misrepresentation. The TV claim is likewise strange as neither device contain a TV receiver, but both are capable of playing TV shows that are appropriately encoded as video files, or available through streaming from the internet.

<comment><USER4> HD video resolution is 1280x720.

iPad mini only has a 1024x768 screen. That makes 780 000 pixels instead of 920 000 pixels, which is a significant difference. Also, iPad mini has a 4:3 screen which means the user will see black bars on top and the bottom while watching an HD movie.

</comment></comment><comment><AUTHOR> Here's a screenshot for posterity: <http://i.imgur.com/QEXaH.png>

</comment><comment><USER5> Are some in the HN community such Apple Fan Boys to label this as "an attack"?

<comment><USER6> Whether you are an Apple fan or not, it is difficult to contest the fact that this Amazon ad is taking direct aim at an Apple product.

What would you call this, if not an "attack"?

</comment></comment><comment><USER7> I love the iPad and already preordered my iPad Mini. But it's nice to see a little competition. Sure, the amazon ad is stretching things a bit, but it's advertising, that's what they do. I can't wait for the "tablet wars" to really start, instead of Apple just dominating. Competition is good for us all, even for Apple themselves in the long run.

</comment><comment><USER8> According to Amazon, 1024x768 is standard definition when in a tablet, but high definition when in a TV. Plasmas that are 720p are almost universally 1024x768 natively.

<comment><USER9> Those plasma screens are 16:9 and have non-rectangular pixels. Since all high- definition content is also 16:9, if you play it back on a 1024x768 4:3 display like the iPad Mini you're actually watching it in 576p with black bars at the top and bottom which is unquestionably standard-definition. In Europe and much of the rest of the world DVDs have always been 576p and there's really no way to dispute that those are standard definition.

</comment></comment><comment><USER10> Well, one potential problem with the mini is that while the for factor is excellent for reading, the low res screen is really going to work against that.

</comment><comment><USER11> Interesting! The UK site <http://www.amazon.co.uk/> has a similar front and centre promo for the Kindle Fire, but without the comparison to / attack on the iPad Mini.

<comment><USER12> If I recall correctly, you can't call out a competitor by name in UK advertisements. All the tv ads we have here will say "compared to the next leading brand..."

Unless that's changed recently. I moved away 4 years ago.

<comment><USER13> I believe it was changed in the last few years, but it's still pretty uncommon. The only examples I can think of, off the top of my head, are by the supermarkets (particularly those from Asda).

<comment><USER12> Thanks, it makes sense that Asda would be one of the first to take advantage of a change in law, I recall Walmart bought them out a few years ago.

</comment></comment></comment></comment><comment><USER14> Amazon has a great case for the Fire vs Mini, but saying the Mini has an SD display hurts the credibility of the ad. Honestly, that Samsung vs iPhone 5 ad was much fairer.

</comment><comment><USER15> They should mention that you pay 199$ for the "Special Offers" version :). Meaning it will load adds on _your_ Kindle.

</comment><comment><USER16> Attacking Apple with technical specifications?

See how well Nokia is doing with that...

</comment><comment><USER17> Typical falsehoods from Amazon. They call their display "stunning" but in my experience they ship low quality TFT displays, while Apple uses the latest LCD technology. Calling the iPad display "standard definition" implies it is 480p, which is a lie, as it is closer to 720p. Calling it "low resolution" is a straight up lie.

Ok, they have more pixels per inch, but like the people who focus on gigahertz but ignore how much work gets done, the real question is the quality and color reproduction in the images produced by the display.

"No HD movies or TV". This is a flat out lie. The iPad mini plays HD movies and TV from the iTunes store, or from everywhere else you might want to play them. 720p is only 1280x720, which is not very far from 1024x768... so, the fact is, you CAN watch HD movies and TV on this device. Further, the display is nearly HD, and I've seen "HD" applied regularly to displays simply because they were larger than 480p.

[Edit: Just noticed, this "HD" display on the kindle fire HD is only 720p. That means it is 40 pixels SMALLER in one dimension and 200 pixels BIGGER in another dimension. In other words, roughly the same resolution. Asinine.]

Somehow I bet the mono speaker in the iPad sounds better than the "dual stereo" in the kindle, but we'll have to see. Certainly a device made out of machined aluminum is going to rattle a lot less than one made out of plastic.

Finally they say "Ultra fast MIMO Wi-Fi". Then leave the spot blank for the iPad, implying it doesn't have it. This is, again, a blatent lie. The iPad has 802.11n, and uses MIMO, and is "ultra fast". (unless they've decided to redefine what "MIMO" means to be something magical that only they have.) They never say the specs of what the WIFI is on the kindle page, so I can't tell for sure.... but the implication that the iPad has no WIFI is typically dishonest.

[Edit: I see now that they claim a, b, g, compatibility, but one of the things Apple has done really well with their devices is make them interoperable, and support more esoteric situations.... I'm dubious that an independant test wouldn't find the iPad WiFi to be faster.]

When you have to lie about the competition like this, well, it says alot about your product, but also what kind of company you are.

Having worked at Amazon, where lying is a key survival trait, I'm not surprised to see this at all.

Frankly, this company is pathological. From the first announcement of AWS (where they lied and claimed Amazon.com ran on AWS infrastructure) to this latest example, I see Amazon constantly lying... and getting away with it. It's a shame. For instance, notice how people think the Kindle is a success, yet Amazon never gives actual sales numbers? (At least in a report that where they would get in trouble with the SEC... they have their PR flacks spread all kinds of lies about it.)

It's shameful.

<comment><USER8> Amazon's table is pretty shoddy, but being misleading in the other direction doesn't right the situation. There is more incorrect information in your comment than in their table.

Some key points:

1\. Amazon has only ever used LCD screens on the Kindle Fire product line. They have always used notably excellent displays: <http://www.anandtech.com/show/5128/amazon-kindle-fire-review>

2\. You're right, calling 1024x768 "standard definition" is a lie.

3\. Amazon's is larger in both dimensions and is not 720p. (1280x800 vs 1024x768).

4\. MIMO WiFi is a real thing. It might not be a huge deal (primarily increases max throughput, which is rarely a constraining factor), but the table is correct.

None of this is to say that the Kindle Fire HD is better than the iPad mini, I'm almost certain it is worse. It's just that facts are facts.

<comment><USER18> re: SD vs HD, is dependent upon who you ask. The CEA, which represents the TV makers, says that anything with at least 720 lines is HDTV, thus enabling 1024x768 to be called HDTV. ATSC, which develops broadcast standards, says that HDTV should be 720 or 1080 lines at 16:9 aspect ratio, which implies 1280x720 or 1920x1080.

I think most TVs now are 1280x720 or 1366x768.</comment></comment></comment>


Happy 10th Birthday Atulos Online - <AUTHOR> https://atulos.com/forum/index.php?topic=180.0 <comment><USER2> It has been quite a journey keeping an indie online RPG going for 10 years, and we are committed to continue developing the game to ensure it survives into the future.</comment>


Bubonic Plague Is Diagnosed in China - <AUTHOR> https://www.nytimes.com/2020/07/06/world/asia/china-bubonic-plague-inner-mongolia.html <comment><USER2> Bubonic plague occurs here and there in the US Great Plains. It used to be that I read of a camper or two every year catching it in southeastern Colorado, from prairie dogs, and I imagine one still does.</comment>


Azure Stack Remote Code Execution Vulnerability - <AUTHOR> https://www.forbes.com/sites/zakdoffman/2020/01/30/severe-perfect-100-microsoft-flaw-confirmed-this-is-a-cloud-security-nightmare/ <comment><AUTHOR> The article links to [https://portal.msrc.microsoft.com/en-US/security- guidance/ad...](https://portal.msrc.microsoft.com/en-US/security- guidance/advisory/CVE-2019-1372) and [https://portal.msrc.microsoft.com/en- US/security-guidance/ad...](https://portal.msrc.microsoft.com/en-US/security- guidance/advisory/CVE-2019-1234)

These CVEs only mention Azure Stack, while the Article suggests Microsoft acknowledged the flaws had also affected Azure public cloud:

> Check Point did not attack the cloud itself, but used the offline Azure > Stack, a near perfect replica of the cloud environment. With the > vulnerabilities detected, they then confirmed with Microsoft that the same > ones would apply to the cloud itself. Yes, said Microsoft, patching the > holes and paying Check Point a bounty.</comment>


Minesweeper in TypeScript and React - <AUTHOR> https://firstname.lastname@example.com/minesweeper-in-typescript-and-react-f5f8a5d57383 <comment><AUTHOR> The author here, if you have any questions happy to discuss.</comment>


How Do You Protect Your Ideas? - <AUTHOR>

Notwithstanding the various "ideas are worthless" threads, there may come a time when you need to prove that the ideas and concepts behind your product were indeed yours, and not swiped (intentionally or otherwise) from a competitor, collaborator, potential business partner, what have you.<p>What, if anything, do people do to document the origin and progress of their (potential)  product ideas?  File provisional patents (seems difficult of you are simply brainstorming)?   Keep dated records, perhaps in hard-bound notebooks? <comment><AUTHOR> Judging by some comments, I don't think my initial post was clear.

My question is not about keeping others from copying my ideas, but demonstrating that I have not filched ideas from others.

Suppose you are working on a product. You have a discussion with some other company; turns out they are working on something similar.

You release your product, and they claim you stole the idea and sue.

How does one demonstrate that your work was done independently and began before any such discussions?

</comment><comment><USER2> I give them away. People assume they are useless because I appear unwilling to pursue them. Then I win.

</comment><comment><USER3> Running as fast as possible with your ideas keeps them pretty safe. You'll drop a few in the scramble, and it won't matter.</comment>


Ask HN: What happens if,world had 1 bank and 1 currency?What could go right/wrong? - <AUTHOR> Can the above scenario be simulated in a computer built virtual world to analyze the outcome! <comment><USER2> I don't have any answers but this seems like an interesting idea!</comment>